@yielded/oauth 0.1.0-beta.30 → 0.1.0-beta.31

package/README.md

@@ -1,60 +1,33 @@
 # @yielded/oauth
 
-Native Effect OAuth authorization-code and refresh flows, PKCE S256, and signed
-RS256 OpenID Connect. Runtime dependencies are Effect and `@yielded/jose`.
+Effect OAuth authorization-code and refresh flows, PKCE S256, and signed OpenID
+Connect. Runtime dependencies are Effect and `@yielded/jose`; applications own
+registered callbacks, provider configuration, permissions, identity, and grant storage.
 
 Use `OAuth.make` for an installed client and `Oidc.makeVerifier` for its OIDC
 verifier. Both require `HttpClient` and an owning `Scope`; keep that scope open
-for their lifetime. `Pkce` requires Effect `Crypto`; verification requires
-`Signature` from `@yielded/crypto` and Effect `Crypto`. Runtime Layers belong
-to the application. `Oidc.discover` retrieves metadata from the exact trusted
-issuer's OIDC discovery endpoint.
-
-Closing either factory's scope cancels and joins its active operations; pending
-results and subsequent calls fail with `OAuthUnavailable`. Caller interruption
-cancels and joins that operation while leaving the client or verifier usable.
+for their lifetime. `Pkce` requires Effect `Crypto`; verification also requires
+`Signature` from `@yielded/crypto`. `Oidc.discover` retrieves metadata from the
+exact trusted issuer. Closing a factory's scope cancels its work and prevents reuse.
 
 `client.codeGrant` and `client.refreshGrant` return private `TokenReceipt` values.
-Inspect `Redacted.value(receipt.body)` for provider-specific receipt rules, then
-call `OAuth.tokens`. Its tokens remain redacted. Raw expiry extensions and scope
-strings are retained unchanged, including provider-specific comma scopes.
-`OAuth.tokens` accepts `expires_in` as a finite nonnegative number or a whole
-decimal string such as `"60.5"`; whitespace, numeric-prefix junk, exponent syntax,
-`NaN` and infinity are rejected. Provider checks can still require a raw number.
-A returned receipt has not established grant success or an authenticated identity.
-For OIDC, require an ID token on initial exchange and call `verifier.verify` with
-the captured `verificationStartedAt`, nonce, access token and authorization code.
-It verifies the signature before claims, checks present `at_hash`/`c_hash`, and
-returns redacted verified claims for application-owned identity/profile mapping.
-On refresh, verify any returned ID token with `previous` subject/authentication
-time; an omitted refresh ID token is an application-owned continuation.
-
-The application owns registered callbacks, expected state and response issuer,
-provider generations, permissions, identity callbacks, grant retention and durable
-receipts. This package makes one request per exchange, refresh or revocation.
-`OAuthRejected` identifies a complete HTTP 400 `invalid_grant` or an authenticated
-claim rejection. Malformed responses and expected transport, key and signature
-failures are `OAuthUnavailable`; they do not authorize repeating a possibly
-committed request. Implementation defects, including those in injected services,
-remain in Effect's defect channel.
-
-Provider endpoints require HTTPS and exact response URLs. Redirects, cookies and
-HTTP tracing are disabled for Fetch; custom HttpClients must preserve cancellation
-and have no retry, redirect or cookie middleware. Installed profile endpoints and
-headers are validated before credentials are sent. Responses are bounded to 1 MiB
-by default (configurable downward). JSON is limited to 64 object/array levels and
-65,536 values, including the root in both limits; excess depth or size fails with
-`OAuthUnavailable`. Installed metadata and returned JSON snapshots are deeply
-frozen. Requests to token/revocation endpoints are bounded to 128 KiB and
-authorization URLs to 16 KiB. `timeoutMs` covers each request
-through body consumption. Applications bound their complete multi-step workflow.
-The current Fetch reference is captured when constructing the client/verifier.
-
-Each verifier owns one scoped JOSE JWKS cache: at most 64 keys and 64 waiters, a
-10-minute cache lifetime and a 30-second refresh cooldown. There is no global
-issuer cache, background polling, stale-on-error fallback, or token-supplied key
-endpoint. The supported profile requires advertised code, S256 and RS256 support;
-other OAuth grants and ID-token signature algorithms are outside this profile.
-
-See [third-party notices](THIRD_PARTY_NOTICES.md) for pinned upstream contract
-sources and licenses.
+Check the provider-specific receipt, then call `OAuth.tokens`. A receipt alone
+does not establish a successful grant or authenticated identity. Tokens stay
+redacted. For initial OIDC sign-in, require an ID token and call `verifier.verify`
+with the captured verification time, nonce, access token, and authorization code.
+On refresh, verify any returned ID token against the previous identity; accepting
+an omitted ID token is application policy.
+
+Each exchange, refresh, or revocation makes one request. An uncertain outcome
+requires application recovery, not an automatic retry. Provider endpoints require
+HTTPS. Custom HttpClients must preserve cancellation and disable retries,
+redirects, and ambient cookies. Bound the complete workflow as well as individual
+requests; keep token receipts out of logs and telemetry.
+
+Each verifier owns a scoped JWKS cache. It never takes a key endpoint from a token
+or serves expired keys after refresh failure. Configure the issuer's advertised
+code flow and signing algorithms. Keep S256 PKCE enabled unless the issuer cannot
+support it. Other OAuth grants are outside this package's profile.
+
+See the [public API comments](src/OAuth.ts), [OIDC options](src/Oidc.ts), and
+[third-party notices](THIRD_PARTY_NOTICES.md).

package/dist/OAuth.d.mts

@@ -69,14 +69,16 @@ export interface AuthorizationInput extends Parameters {
   readonly redirectUri: string;
   readonly scopes: ReadonlyArray<string>;
   readonly state: Redacted.Redacted<string>;
-  readonly codeChallenge: string;
+  readonly codeChallenge?: string;
   readonly nonce?: Redacted.Redacted<string>;
   readonly maxAgeSeconds?: number;
+  readonly prompt?: "none" | "login" | "consent" | "select_account";
+  readonly loginHint?: string;
 }
 export interface CodeGrantInput extends Parameters {
   readonly code: Redacted.Redacted<string>;
   readonly redirectUri: string;
-  readonly pkceVerifier: Redacted.Redacted<string>;
+  readonly pkceVerifier?: Redacted.Redacted<string>;
 }
 export interface RefreshGrantInput extends Parameters {
   readonly refreshToken: Redacted.Redacted<string>;

package/dist/OAuth.mjs

@@ -70,15 +70,22 @@ const Authorization = Schema.Struct({
 	redirectUri: Callback,
 	scopes: Scopes,
 	state: secret(256),
-	codeChallenge: Challenge,
+	codeChallenge: Schema.optionalKey(Challenge),
 	nonce: Schema.optionalKey(secret(256)),
-	maxAgeSeconds: Schema.optionalKey(integer(0, 86400))
+	maxAgeSeconds: Schema.optionalKey(integer(0, 86400)),
+	prompt: Schema.optionalKey(Schema.Literals([
+		"none",
+		"login",
+		"consent",
+		"select_account"
+	])),
+	loginHint: Schema.optionalKey(text(1024))
 });
 const CodeGrant = Schema.Struct({
 	...additional,
 	code: secret(16384),
 	redirectUri: Callback,
-	pkceVerifier: Verifier
+	pkceVerifier: Schema.optionalKey(Verifier)
 });
 const RefreshGrant = Schema.Struct({
 	...additional,
@@ -183,8 +190,8 @@ const make = Effect.fnUntraced(function* (input) {
 	}));
 	const send = Effect.fnUntraced(function* (body) {
 		yield* available;
-		const request$1 = yield* authenticated(new URL(metadata.token_endpoint).href, options.clientId, authentication, body);
-		return yield* json(yield* request(http, request$1, options));
+		const request$2 = yield* authenticated(new URL(metadata.token_endpoint).href, options.clientId, authentication, body);
+		return yield* json(yield* request(http, request$2, options));
 	});
 	return {
 		metadata,
@@ -199,10 +206,14 @@ const make = Effect.fnUntraced(function* (input) {
 			body.set("response_mode", "query");
 			body.set("scope", value.scopes.join(" "));
 			body.set("state", yield* reveal(value.state));
-			body.set("code_challenge", value.codeChallenge);
-			body.set("code_challenge_method", "S256");
+			if (value.codeChallenge !== void 0) {
+				body.set("code_challenge", value.codeChallenge);
+				body.set("code_challenge_method", "S256");
+			}
 			if (value.nonce !== void 0) body.set("nonce", yield* reveal(value.nonce));
 			if (value.maxAgeSeconds !== void 0) body.set("max_age", String(value.maxAgeSeconds));
+			if (value.prompt !== void 0) body.set("prompt", value.prompt);
+			if (value.loginHint !== void 0) body.set("login_hint", value.loginHint);
 			for (const [key, item] of body) url.searchParams.append(key, item);
 			if (url.href.length > 16384) return yield* ConfigurationError.make({ reason: "parameters" });
 			return Redacted.make(url.href);
@@ -213,7 +224,7 @@ const make = Effect.fnUntraced(function* (input) {
 			const body = parameters(value);
 			body.set("grant_type", "authorization_code");
 			body.set("code", yield* reveal(value.code));
-			body.set("code_verifier", yield* reveal(value.pkceVerifier));
+			if (value.pkceVerifier !== void 0) body.set("code_verifier", yield* reveal(value.pkceVerifier));
 			body.set("redirect_uri", value.redirectUri);
 			return yield* send(body);
 		}, use),
@@ -230,8 +241,8 @@ const make = Effect.fnUntraced(function* (input) {
 			yield* available;
 			if (profile === void 0) return yield* ConfigurationError.make({ reason: "endpoint" });
 			const token = yield* reveal(yield* decode(Bearer, input));
-			const request$2 = HttpClientRequest.get(new URL(profile.url).href).pipe(HttpClientRequest.acceptJson, HttpClientRequest.setHeaders(profile.headers ?? {}), HttpClientRequest.setHeader("authorization", `Bearer ${token}`));
-			const response = yield* request(http, request$2, options);
+			const request$1 = HttpClientRequest.get(new URL(profile.url).href).pipe(HttpClientRequest.acceptJson, HttpClientRequest.setHeaders(profile.headers ?? {}), HttpClientRequest.setHeader("authorization", `Bearer ${token}`));
+			const response = yield* request(http, request$1, options);
 			if (response.status !== 200) return yield* Unavailable.make({});
 			return yield* reveal((yield* json(response)).body);
 		}, use),

package/dist/OAuth.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"OAuth.mjs","names":["V.JsonObject","V.Issuer","V.ProtocolEndpoint","V.Endpoint","V.text","V.secret","V.integer","V.Headers","V.Parameters","V.Resources","V.Callback","V.Scopes","V.Challenge","V.Verifier","V.decode","Transport.isJson","V.reveal","V.configuration","V.freeze","Ownership.make","Transport.capture","request","Transport.json","Transport.request"],"sources":["../src/OAuth.ts"],"sourcesContent":["import { Effect, Redacted, Schema, type Scope } from \"effect\";\nimport { Base64 } from \"effect/encoding\";\nimport type { HttpClient } from \"effect/http\";\nimport { HttpClientRequest } from \"effect/http\";\n\nimport { ConfigurationError, Rejected, Unavailable } from \"./Errors\";\nimport * as Ownership from \"./internal/ownership\";\nimport * as Transport from \"./internal/transport\";\nimport * as V from \"./internal/validation\";\n\nexport const JsonObject = V.JsonObject;\nexport type JsonObject = typeof JsonObject.Type;\n\nexport const Metadata = Schema.Struct({\n  issuer: V.Issuer,\n  authorization_endpoint: V.ProtocolEndpoint,\n  token_endpoint: V.ProtocolEndpoint,\n  jwks_uri: Schema.optionalKey(V.Endpoint),\n  userinfo_endpoint: Schema.optionalKey(V.Endpoint),\n  revocation_endpoint: Schema.optionalKey(V.ProtocolEndpoint),\n  code_challenge_methods_supported: Schema.optionalKey(\n    Schema.Array(V.text(64)).check(Schema.isMaxLength(64)),\n  ),\n  response_types_supported: Schema.optionalKey(\n    Schema.Array(V.text(64)).check(Schema.isMaxLength(64)),\n  ),\n  grant_types_supported: Schema.optionalKey(\n    Schema.Array(V.text(128)).check(Schema.isMaxLength(64)),\n  ),\n  id_token_signing_alg_values_supported: Schema.optionalKey(\n    Schema.Array(V.text(64)).check(Schema.isMaxLength(64)),\n  ),\n  token_endpoint_auth_methods_supported: Schema.optionalKey(\n    Schema.Array(V.text(64)).check(Schema.isMaxLength(64)),\n  ),\n  revocation_endpoint_auth_methods_supported: Schema.optionalKey(\n    Schema.Array(V.text(64)).check(Schema.isMaxLength(64)),\n  ),\n  authorization_response_iss_parameter_supported: Schema.optionalKey(Schema.Boolean),\n});\n\nexport type Metadata = typeof Metadata.Type;\n\nexport const Authentication = Schema.Union([\n  Schema.Struct({ method: Schema.Literal(\"client_secret_basic\"), secret: V.secret(4096) }),\n  Schema.Struct({ method: Schema.Literal(\"client_secret_post\"), secret: V.secret(4096) }),\n  Schema.Struct({ method: Schema.Literal(\"none\"), publicClient: Schema.Literal(true) }),\n]);\n\nexport type Authentication = typeof Authentication.Type;\n\n/** Uninterpreted private receipt. Inspect provider extensions before calling tokens. */\nexport const TokenReceipt = Schema.Struct({\n  status: V.integer(100, 599),\n  contentType: Schema.NullOr(Schema.String.check(Schema.isMaxLength(512))),\n  body: Schema.Redacted(JsonObject, { disallowJsonEncode: true }),\n});\n\nexport type TokenReceipt = typeof TokenReceipt.Type;\n\nexport const TokenSet = Schema.Struct({\n  tokenType: Schema.Literal(\"bearer\"),\n  accessToken: V.secret(16384),\n  refreshToken: Schema.optionalKey(V.secret(16384)),\n  idToken: Schema.optionalKey(V.secret(65536)),\n  expiresIn: Schema.optionalKey(Schema.Finite.check(Schema.isGreaterThanOrEqualTo(0))),\n  scope: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(16447))),\n});\n\nexport type TokenSet = typeof TokenSet.Type;\n\nexport interface RequestOptions {\n  readonly timeoutMs: number;\n  readonly maxResponseBytes?: number;\n}\n\nexport interface ClientOptions extends RequestOptions {\n  readonly metadata: Metadata;\n  readonly clientId: string;\n  readonly authentication: Authentication;\n  readonly profile?: { readonly url: string; readonly headers?: Readonly<Record<string, string>> };\n  readonly revocationAuthentication?: Authentication;\n}\n\nexport interface Parameters {\n  readonly parameters?: Readonly<Record<string, string>>;\n  readonly resources?: ReadonlyArray<string>;\n}\n\nexport interface AuthorizationInput extends Parameters {\n  readonly redirectUri: string;\n  readonly scopes: ReadonlyArray<string>;\n  readonly state: Redacted.Redacted<string>;\n  readonly codeChallenge: string;\n  readonly nonce?: Redacted.Redacted<string>;\n  readonly maxAgeSeconds?: number;\n}\n\nexport interface CodeGrantInput extends Parameters {\n  readonly code: Redacted.Redacted<string>;\n  readonly redirectUri: string;\n  readonly pkceVerifier: Redacted.Redacted<string>;\n}\n\nexport interface RefreshGrantInput extends Parameters {\n  readonly refreshToken: Redacted.Redacted<string>;\n  readonly scopes?: ReadonlyArray<string>;\n}\n\nexport interface RevocationInput {\n  readonly token: Redacted.Redacted<string>;\n  readonly tokenTypeHint: \"access_token\" | \"refresh_token\";\n}\n\nexport interface Client {\n  readonly metadata: Metadata;\n  readonly authorizationUrl: (\n    input: AuthorizationInput,\n  ) => Effect.Effect<Redacted.Redacted<string>, ConfigurationError | Unavailable>;\n  readonly codeGrant: (\n    input: CodeGrantInput,\n  ) => Effect.Effect<TokenReceipt, ConfigurationError | Unavailable>;\n  readonly refreshGrant: (\n    input: RefreshGrantInput,\n  ) => Effect.Effect<TokenReceipt, ConfigurationError | Unavailable>;\n  readonly fetchProfile: (\n    accessToken: Redacted.Redacted<string>,\n  ) => Effect.Effect<JsonObject, ConfigurationError | Unavailable>;\n  readonly revoke: (\n    input: RevocationInput,\n  ) => Effect.Effect<void, ConfigurationError | Unavailable>;\n}\n\nconst ClientOptionsSchema = Schema.Struct({\n  metadata: Metadata,\n  clientId: V.text(1024),\n  authentication: Authentication,\n  ...V.RequestOptions.fields,\n  profile: Schema.optionalKey(\n    Schema.Struct({ url: V.Endpoint, headers: Schema.optionalKey(V.Headers) }),\n  ),\n  revocationAuthentication: Schema.optionalKey(Authentication),\n});\n\nconst additional = {\n  parameters: Schema.optionalKey(V.Parameters),\n  resources: Schema.optionalKey(V.Resources),\n};\n\nconst Authorization = Schema.Struct({\n  ...additional,\n  redirectUri: V.Callback,\n  scopes: V.Scopes,\n  state: V.secret(256),\n  codeChallenge: V.Challenge,\n  nonce: Schema.optionalKey(V.secret(256)),\n  maxAgeSeconds: Schema.optionalKey(V.integer(0, 86400)),\n});\n\nconst CodeGrant = Schema.Struct({\n  ...additional,\n  code: V.secret(16384),\n  redirectUri: V.Callback,\n  pkceVerifier: V.Verifier,\n});\n\nconst RefreshGrant = Schema.Struct({\n  ...additional,\n  refreshToken: V.secret(16384),\n  scopes: Schema.optionalKey(V.Scopes),\n});\n\nconst Revocation = Schema.Struct({\n  token: V.secret(16384),\n  tokenTypeHint: Schema.Literals([\"access_token\", \"refresh_token\"]),\n});\n\nconst ExpiresIn = Schema.Union([\n  Schema.Finite,\n  Schema.String.check(Schema.isPattern(/^(?:0|[1-9][0-9]*)(?:\\.[0-9]+)?$/u)).pipe(\n    Schema.decodeTo(Schema.FiniteFromString),\n  ),\n]).check(Schema.isGreaterThanOrEqualTo(0));\n\nconst RawToken = Schema.Struct({\n  access_token: V.text(16384),\n  token_type: Schema.String.check(Schema.isPattern(/^[Bb][Ee][Aa][Rr][Ee][Rr]$/)),\n  refresh_token: Schema.optionalKey(V.text(16384)),\n  id_token: Schema.optionalKey(V.text(65536)),\n  expires_in: Schema.optionalKey(ExpiresIn),\n  scope: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(16447))),\n});\n\nconst Terminal = Schema.Struct({\n  error: V.text(128),\n  error_description: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(4096))),\n  error_uri: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(2048))),\n});\n\nconst successFields = [\n  \"access_token\",\n  \"refresh_token\",\n  \"id_token\",\n  \"token_type\",\n  \"scope\",\n  \"expires_in\",\n  \"refresh_expires_in\",\n  \"refresh_token_expires_in\",\n];\n\n/** Parse once provider-specific receipt checks have succeeded. expires_in accepts\n * finite nonnegative numbers and whole decimal strings (for example \"60.5\").\n * Whitespace, exponent/prefix syntax and nonfinite values are rejected. Raw\n * receipt extensions/scopes are untouched; no request, retry or claim verification. */\nexport const tokens = Effect.fnUntraced(function* (\n  input: TokenReceipt,\n): Effect.fn.Return<TokenSet, Rejected | Unavailable> {\n  const receipt = yield* V.decode(TokenReceipt, input);\n\n  if (!Transport.isJson(receipt.contentType)) return yield* Unavailable.make({});\n  const raw = yield* V.reveal(receipt.body);\n\n  if (Object.hasOwn(raw, \"error\")) {\n    if (successFields.some((key) => Object.hasOwn(raw, key))) return yield* Unavailable.make({});\n    const terminal = yield* V.decode(Terminal, raw);\n\n    if (receipt.status === 400 && terminal.error === \"invalid_grant\")\n      return yield* Rejected.make({ reason: \"invalid_grant\" });\n\n    return yield* Unavailable.make({});\n  }\n  if (\n    receipt.status !== 200 ||\n    Object.hasOwn(raw, \"error_description\") ||\n    Object.hasOwn(raw, \"error_uri\")\n  )\n    return yield* Unavailable.make({});\n  const value = yield* V.decode(RawToken, raw);\n\n  return {\n    tokenType: \"bearer\",\n    accessToken: Redacted.make(value.access_token),\n    ...(value.refresh_token === undefined\n      ? {}\n      : { refreshToken: Redacted.make(value.refresh_token) }),\n    ...(value.id_token === undefined ? {} : { idToken: Redacted.make(value.id_token) }),\n    ...(value.expires_in === undefined ? {} : { expiresIn: value.expires_in }),\n    ...(value.scope === undefined ? {} : { scope: value.scope }),\n  };\n});\n\nconst parameters = (input: Parameters) => {\n  const values = new URLSearchParams(input.parameters);\n\n  for (const resource of input.resources ?? []) values.append(\"resource\", resource);\n\n  return values;\n};\n\n// RFC6749 Appendix B: encode client credentials before joining with the colon.\n// Adapted from oauth4webapi 3.8.8 src/index.ts::formUrlEncode (MIT, Filip Skokan).\n// Exact source commit and license: ../THIRD_PARTY_NOTICES.md.\nconst basicComponent = (value: string) =>\n  encodeURIComponent(value).replace(/[-_.!~*'()]|%20/gu, (part) =>\n    part === \"%20\" ? \"+\" : `%${part.charCodeAt(0).toString(16).toUpperCase()}`,\n  );\n\nconst authenticated = Effect.fnUntraced(function* (\n  url: string,\n  clientId: string,\n  authentication: Authentication,\n  body: URLSearchParams,\n) {\n  let request = HttpClientRequest.post(url).pipe(HttpClientRequest.acceptJson);\n\n  if (authentication.method === \"client_secret_basic\") {\n    const secret = yield* V.reveal(authentication.secret);\n\n    const credential = yield* Effect.try({\n      try: () => Base64.encode(`${basicComponent(clientId)}:${basicComponent(secret)}`),\n      catch: () => Unavailable.make({}),\n    });\n\n    request = HttpClientRequest.setHeader(request, \"authorization\", `Basic ${credential}`);\n  } else {\n    body.set(\"client_id\", clientId);\n    if (authentication.method === \"client_secret_post\")\n      body.set(\"client_secret\", yield* V.reveal(authentication.secret));\n  }\n  const encoded = body.toString();\n\n  if (new TextEncoder().encode(encoded).length > 131072)\n    return yield* ConfigurationError.make({ reason: \"parameters\" });\n\n  return HttpClientRequest.bodyText(\n    request,\n    encoded,\n    \"application/x-www-form-urlencoded;charset=UTF-8\",\n  );\n});\n\n/** One installed client, exact endpoints, private credentials and owning Scope.\n * Supply an HttpClient without retry/redirect/cookie middleware. Fetch injection\n * active at construction is captured. Owner closure cancels and joins active\n * operations, then rejects their results as unavailable; caller interruption\n * cancels and joins its operation without closing the client. */\nexport const make = Effect.fnUntraced(function* (\n  input: ClientOptions,\n): Effect.fn.Return<Client, ConfigurationError | Unavailable, HttpClient.HttpClient | Scope.Scope> {\n  const options = yield* V.configuration(ClientOptionsSchema, input, \"metadata\");\n\n  const authentication = yield* detachAuthentication(options.authentication);\n\n  const revocationAuthentication =\n    options.revocationAuthentication === undefined\n      ? authentication\n      : yield* detachAuthentication(options.revocationAuthentication);\n\n  const metadata = V.freeze(options.metadata);\n\n  const supported =\n    metadata.token_endpoint_auth_methods_supported ??\n    (metadata.jwks_uri === undefined ? undefined : [\"client_secret_basic\"]);\n\n  const revokeSupported =\n    metadata.revocation_endpoint_auth_methods_supported ??\n    (metadata.jwks_uri === undefined ? undefined : [\"client_secret_basic\"]);\n\n  if (\n    (supported !== undefined && !supported.includes(authentication.method)) ||\n    (options.revocationAuthentication !== undefined &&\n      metadata.revocation_endpoint !== undefined &&\n      revokeSupported !== undefined &&\n      !revokeSupported.includes(revocationAuthentication.method))\n  )\n    return yield* ConfigurationError.make({ reason: \"authentication\" });\n  const { available, use } = yield* Ownership.make;\n  const http = yield* Transport.capture;\n  const profile = options.profile === undefined ? undefined : V.freeze(options.profile);\n\n  yield* Effect.addFinalizer(() =>\n    Effect.sync(() => {\n      if (authentication.method !== \"none\") Redacted.wipeUnsafe(authentication.secret);\n      if (revocationAuthentication.method !== \"none\")\n        Redacted.wipeUnsafe(revocationAuthentication.secret);\n    }),\n  );\n\n  const send = Effect.fnUntraced(function* (body: URLSearchParams) {\n    yield* available;\n\n    const request = yield* authenticated(\n      new URL(metadata.token_endpoint).href,\n      options.clientId,\n      authentication,\n      body,\n    );\n\n    return yield* Transport.json(yield* Transport.request(http, request, options));\n  });\n\n  const authorizationUrl = Effect.fnUntraced(function* (input: AuthorizationInput) {\n    yield* available;\n    const value = yield* V.configuration(Authorization, input);\n    const url = new URL(metadata.authorization_endpoint);\n    const body = parameters(value);\n\n    body.set(\"client_id\", options.clientId);\n    body.set(\"redirect_uri\", value.redirectUri);\n    body.set(\"response_type\", \"code\");\n    body.set(\"response_mode\", \"query\");\n    body.set(\"scope\", value.scopes.join(\" \"));\n    body.set(\"state\", yield* V.reveal(value.state));\n    body.set(\"code_challenge\", value.codeChallenge);\n    body.set(\"code_challenge_method\", \"S256\");\n    if (value.nonce !== undefined) body.set(\"nonce\", yield* V.reveal(value.nonce));\n    if (value.maxAgeSeconds !== undefined) body.set(\"max_age\", String(value.maxAgeSeconds));\n    for (const [key, item] of body) url.searchParams.append(key, item);\n    if (url.href.length > 16384) return yield* ConfigurationError.make({ reason: \"parameters\" });\n\n    return Redacted.make(url.href);\n  }, use);\n\n  const codeGrant = Effect.fnUntraced(function* (input: CodeGrantInput) {\n    yield* available;\n    const value = yield* V.configuration(CodeGrant, input);\n    const body = parameters(value);\n\n    body.set(\"grant_type\", \"authorization_code\");\n    body.set(\"code\", yield* V.reveal(value.code));\n    body.set(\"code_verifier\", yield* V.reveal(value.pkceVerifier));\n    body.set(\"redirect_uri\", value.redirectUri);\n\n    return yield* send(body);\n  }, use);\n\n  const refreshGrant = Effect.fnUntraced(function* (input: RefreshGrantInput) {\n    yield* available;\n    const value = yield* V.configuration(RefreshGrant, input);\n    const body = parameters(value);\n\n    body.set(\"grant_type\", \"refresh_token\");\n    body.set(\"refresh_token\", yield* V.reveal(value.refreshToken));\n    if (value.scopes !== undefined) body.set(\"scope\", value.scopes.join(\" \"));\n\n    return yield* send(body);\n  }, use);\n\n  const fetchProfile = Effect.fnUntraced(function* (input: Redacted.Redacted<string>) {\n    yield* available;\n    if (profile === undefined) return yield* ConfigurationError.make({ reason: \"endpoint\" });\n    const token = yield* V.reveal(yield* V.decode(Bearer, input));\n\n    const request = HttpClientRequest.get(new URL(profile.url).href).pipe(\n      HttpClientRequest.acceptJson,\n      HttpClientRequest.setHeaders(profile.headers ?? {}),\n      HttpClientRequest.setHeader(\"authorization\", `Bearer ${token}`),\n    );\n\n    const response = yield* Transport.request(http, request, options);\n\n    if (response.status !== 200) return yield* Unavailable.make({});\n\n    return yield* V.reveal((yield* Transport.json(response)).body);\n  }, use);\n\n  const revoke = Effect.fnUntraced(function* (input: RevocationInput) {\n    yield* available;\n    if (metadata.revocation_endpoint === undefined)\n      return yield* ConfigurationError.make({ reason: \"endpoint\" });\n    if (revokeSupported !== undefined && !revokeSupported.includes(revocationAuthentication.method))\n      return yield* ConfigurationError.make({ reason: \"authentication\" });\n    const value = yield* V.configuration(Revocation, input);\n\n    const request = yield* authenticated(\n      new URL(metadata.revocation_endpoint).href,\n      options.clientId,\n      revocationAuthentication,\n      new URLSearchParams({\n        token: yield* V.reveal(value.token),\n        token_type_hint: value.tokenTypeHint,\n      }),\n    );\n\n    const response = yield* Transport.request(http, request, options);\n\n    if (response.status !== 200) return yield* Unavailable.make({});\n  }, use);\n\n  return { metadata, authorizationUrl, codeGrant, refreshGrant, fetchProfile, revoke };\n});\n\nconst Bearer = Schema.Redacted(V.text(16384).check(Schema.isPattern(/^[A-Za-z0-9._~+/-]+=*$/u)), {\n  disallowJsonEncode: true,\n});\n\nconst detachAuthentication = Effect.fnUntraced(function* (\n  authentication: Authentication,\n): Effect.fn.Return<Authentication, Unavailable> {\n  return authentication.method === \"none\"\n    ? { ...authentication }\n    : { ...authentication, secret: Redacted.make(yield* V.reveal(authentication.secret)) };\n});\n"],"mappings":";;;;;;;;AAUA,MAAa,aAAaA;AAG1B,MAAa,WAAW,OAAO,OAAO;CACpC,QAAQC;CACR,wBAAwBC;CACxB,gBAAgBA;CAChB,UAAU,OAAO,YAAYC,QAAU;CACvC,mBAAmB,OAAO,YAAYA,QAAU;CAChD,qBAAqB,OAAO,YAAYD,gBAAkB;CAC1D,kCAAkC,OAAO,YACvC,OAAO,MAAME,KAAO,EAAE,CAAC,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC,CACvD;CACA,0BAA0B,OAAO,YAC/B,OAAO,MAAMA,KAAO,EAAE,CAAC,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC,CACvD;CACA,uBAAuB,OAAO,YAC5B,OAAO,MAAMA,KAAO,GAAG,CAAC,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC,CACxD;CACA,uCAAuC,OAAO,YAC5C,OAAO,MAAMA,KAAO,EAAE,CAAC,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC,CACvD;CACA,uCAAuC,OAAO,YAC5C,OAAO,MAAMA,KAAO,EAAE,CAAC,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC,CACvD;CACA,4CAA4C,OAAO,YACjD,OAAO,MAAMA,KAAO,EAAE,CAAC,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC,CACvD;CACA,gDAAgD,OAAO,YAAY,OAAO,OAAO;AACnF,CAAC;AAID,MAAa,iBAAiB,OAAO,MAAM;CACzC,OAAO,OAAO;EAAE,QAAQ,OAAO,QAAQ,qBAAqB;EAAG,QAAQC,OAAS,IAAI;CAAE,CAAC;CACvF,OAAO,OAAO;EAAE,QAAQ,OAAO,QAAQ,oBAAoB;EAAG,QAAQA,OAAS,IAAI;CAAE,CAAC;CACtF,OAAO,OAAO;EAAE,QAAQ,OAAO,QAAQ,MAAM;EAAG,cAAc,OAAO,QAAQ,IAAI;CAAE,CAAC;AACtF,CAAC;;AAKD,MAAa,eAAe,OAAO,OAAO;CACxC,QAAQC,QAAU,KAAK,GAAG;CAC1B,aAAa,OAAO,OAAO,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC;CACvE,MAAM,OAAO,SAAS,YAAY,EAAE,oBAAoB,KAAK,CAAC;AAChE,CAAC;AAID,MAAa,WAAW,OAAO,OAAO;CACpC,WAAW,OAAO,QAAQ,QAAQ;CAClC,aAAaD,OAAS,KAAK;CAC3B,cAAc,OAAO,YAAYA,OAAS,KAAK,CAAC;CAChD,SAAS,OAAO,YAAYA,OAAS,KAAK,CAAC;CAC3C,WAAW,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,uBAAuB,CAAC,CAAC,CAAC;CACnF,OAAO,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,KAAK,CAAC,CAAC;AAC1E,CAAC;AAkED,MAAM,sBAAsB,OAAO,OAAO;CACxC,UAAU;CACV,UAAUD,KAAO,IAAI;CACrB,gBAAgB;CAChB,GAAA,eAAoB;CACpB,SAAS,OAAO,YACd,OAAO,OAAO;EAAE,KAAKD;EAAY,SAAS,OAAO,YAAYI,OAAS;CAAE,CAAC,CAC3E;CACA,0BAA0B,OAAO,YAAY,cAAc;AAC7D,CAAC;AAED,MAAM,aAAa;CACjB,YAAY,OAAO,YAAYC,UAAY;CAC3C,WAAW,OAAO,YAAYC,SAAW;AAC3C;AAEA,MAAM,gBAAgB,OAAO,OAAO;CAClC,GAAG;CACH,aAAaC;CACb,QAAQC;CACR,OAAON,OAAS,GAAG;CACnB,eAAeO;CACf,OAAO,OAAO,YAAYP,OAAS,GAAG,CAAC;CACvC,eAAe,OAAO,YAAYC,QAAU,GAAG,KAAK,CAAC;AACvD,CAAC;AAED,MAAM,YAAY,OAAO,OAAO;CAC9B,GAAG;CACH,MAAMD,OAAS,KAAK;CACpB,aAAaK;CACb,cAAcG;AAChB,CAAC;AAED,MAAM,eAAe,OAAO,OAAO;CACjC,GAAG;CACH,cAAcR,OAAS,KAAK;CAC5B,QAAQ,OAAO,YAAYM,MAAQ;AACrC,CAAC;AAED,MAAM,aAAa,OAAO,OAAO;CAC/B,OAAON,OAAS,KAAK;CACrB,eAAe,OAAO,SAAS,CAAC,gBAAgB,eAAe,CAAC;AAClE,CAAC;AAED,MAAM,YAAY,OAAO,MAAM,CAC7B,OAAO,QACP,OAAO,OAAO,MAAM,OAAO,UAAU,mCAAmC,CAAC,CAAC,CAAC,KACzE,OAAO,SAAS,OAAO,gBAAgB,CACzC,CACF,CAAC,CAAC,CAAC,MAAM,OAAO,uBAAuB,CAAC,CAAC;AAEzC,MAAM,WAAW,OAAO,OAAO;CAC7B,cAAcD,KAAO,KAAK;CAC1B,YAAY,OAAO,OAAO,MAAM,OAAO,UAAU,4BAA4B,CAAC;CAC9E,eAAe,OAAO,YAAYA,KAAO,KAAK,CAAC;CAC/C,UAAU,OAAO,YAAYA,KAAO,KAAK,CAAC;CAC1C,YAAY,OAAO,YAAY,SAAS;CACxC,OAAO,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,WAAW,OAAO,OAAO;CAC7B,OAAOA,KAAO,GAAG;CACjB,mBAAmB,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;CACnF,WAAW,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,gBAAgB;CACpB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;AAMA,MAAa,SAAS,OAAO,WAAW,WACtC,OACoD;CACpD,MAAM,UAAU,OAAOU,OAAS,cAAc,KAAK;CAEnD,IAAI,CAACC,OAAiB,QAAQ,WAAW,GAAG,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;CAC7E,MAAM,MAAM,OAAOC,OAAS,QAAQ,IAAI;CAExC,IAAI,OAAO,OAAO,KAAK,OAAO,GAAG;EAC/B,IAAI,cAAc,MAAM,QAAQ,OAAO,OAAO,KAAK,GAAG,CAAC,GAAG,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;EAC3F,MAAM,WAAW,OAAOF,OAAS,UAAU,GAAG;EAE9C,IAAI,QAAQ,WAAW,OAAO,SAAS,UAAU,iBAC/C,OAAO,OAAO,SAAS,KAAK,EAAE,QAAQ,gBAAgB,CAAC;EAEzD,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;CACnC;CACA,IACE,QAAQ,WAAW,OACnB,OAAO,OAAO,KAAK,mBAAmB,KACtC,OAAO,OAAO,KAAK,WAAW,GAE9B,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;CACnC,MAAM,QAAQ,OAAOA,OAAS,UAAU,GAAG;CAE3C,OAAO;EACL,WAAW;EACX,aAAa,SAAS,KAAK,MAAM,YAAY;EAC7C,GAAI,MAAM,kBAAkB,KAAA,IACxB,CAAC,IACD,EAAE,cAAc,SAAS,KAAK,MAAM,aAAa,EAAE;EACvD,GAAI,MAAM,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,SAAS,KAAK,MAAM,QAAQ,EAAE;EACjF,GAAI,MAAM,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,MAAM,WAAW;EACxE,GAAI,MAAM,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;CAC5D;AACF,CAAC;AAED,MAAM,cAAc,UAAsB;CACxC,MAAM,SAAS,IAAI,gBAAgB,MAAM,UAAU;CAEnD,KAAK,MAAM,YAAY,MAAM,aAAa,CAAC,GAAG,OAAO,OAAO,YAAY,QAAQ;CAEhF,OAAO;AACT;AAKA,MAAM,kBAAkB,UACtB,mBAAmB,KAAK,CAAC,CAAC,QAAQ,sBAAsB,SACtD,SAAS,QAAQ,MAAM,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,YAAY,GACzE;AAEF,MAAM,gBAAgB,OAAO,WAAW,WACtC,KACA,UACA,gBACA,MACA;CACA,IAAI,UAAU,kBAAkB,KAAK,GAAG,CAAC,CAAC,KAAK,kBAAkB,UAAU;CAE3E,IAAI,eAAe,WAAW,uBAAuB;EACnD,MAAM,SAAS,OAAOE,OAAS,eAAe,MAAM;EAEpD,MAAM,aAAa,OAAO,OAAO,IAAI;GACnC,WAAW,OAAO,OAAO,GAAG,eAAe,QAAQ,EAAE,GAAG,eAAe,MAAM,GAAG;GAChF,aAAa,YAAY,KAAK,CAAC,CAAC;EAClC,CAAC;EAED,UAAU,kBAAkB,UAAU,SAAS,iBAAiB,SAAS,YAAY;CACvF,OAAO;EACL,KAAK,IAAI,aAAa,QAAQ;EAC9B,IAAI,eAAe,WAAW,sBAC5B,KAAK,IAAI,iBAAiB,OAAOA,OAAS,eAAe,MAAM,CAAC;CACpE;CACA,MAAM,UAAU,KAAK,SAAS;CAE9B,IAAI,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,SAAS,QAC7C,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,aAAa,CAAC;CAEhE,OAAO,kBAAkB,SACvB,SACA,SACA,iDACF;AACF,CAAC;;;;;;AAOD,MAAa,OAAO,OAAO,WAAW,WACpC,OACiG;CACjG,MAAM,UAAU,OAAOC,cAAgB,qBAAqB,OAAO,UAAU;CAE7E,MAAM,iBAAiB,OAAO,qBAAqB,QAAQ,cAAc;CAEzE,MAAM,2BACJ,QAAQ,6BAA6B,KAAA,IACjC,iBACA,OAAO,qBAAqB,QAAQ,wBAAwB;CAElE,MAAM,WAAWC,OAAS,QAAQ,QAAQ;CAE1C,MAAM,YACJ,SAAS,0CACR,SAAS,aAAa,KAAA,IAAY,KAAA,IAAY,CAAC,qBAAqB;CAEvE,MAAM,kBACJ,SAAS,+CACR,SAAS,aAAa,KAAA,IAAY,KAAA,IAAY,CAAC,qBAAqB;CAEvE,IACG,cAAc,KAAA,KAAa,CAAC,UAAU,SAAS,eAAe,MAAM,KACpE,QAAQ,6BAA6B,KAAA,KACpC,SAAS,wBAAwB,KAAA,KACjC,oBAAoB,KAAA,KACpB,CAAC,gBAAgB,SAAS,yBAAyB,MAAM,GAE3D,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,iBAAiB,CAAC;CACpE,MAAM,EAAE,WAAW,QAAQ,OAAOC;CAClC,MAAM,OAAO,OAAOC;CACpB,MAAM,UAAU,QAAQ,YAAY,KAAA,IAAY,KAAA,IAAYF,OAAS,QAAQ,OAAO;CAEpF,OAAO,OAAO,mBACZ,OAAO,WAAW;EAChB,IAAI,eAAe,WAAW,QAAQ,SAAS,WAAW,eAAe,MAAM;EAC/E,IAAI,yBAAyB,WAAW,QACtC,SAAS,WAAW,yBAAyB,MAAM;CACvD,CAAC,CACH;CAEA,MAAM,OAAO,OAAO,WAAW,WAAW,MAAuB;EAC/D,OAAO;EAEP,MAAMG,YAAU,OAAO,cACrB,IAAI,IAAI,SAAS,cAAc,CAAC,CAAC,MACjC,QAAQ,UACR,gBACA,IACF;EAEA,OAAO,OAAOC,KAAe,OAAOC,QAAkB,MAAMF,WAAS,OAAO,CAAC;CAC/E,CAAC;CA0FD,OAAO;EAAE;EAAU,kBAxFM,OAAO,WAAW,WAAW,OAA2B;GAC/E,OAAO;GACP,MAAM,QAAQ,OAAOJ,cAAgB,eAAe,KAAK;GACzD,MAAM,MAAM,IAAI,IAAI,SAAS,sBAAsB;GACnD,MAAM,OAAO,WAAW,KAAK;GAE7B,KAAK,IAAI,aAAa,QAAQ,QAAQ;GACtC,KAAK,IAAI,gBAAgB,MAAM,WAAW;GAC1C,KAAK,IAAI,iBAAiB,MAAM;GAChC,KAAK,IAAI,iBAAiB,OAAO;GACjC,KAAK,IAAI,SAAS,MAAM,OAAO,KAAK,GAAG,CAAC;GACxC,KAAK,IAAI,SAAS,OAAOD,OAAS,MAAM,KAAK,CAAC;GAC9C,KAAK,IAAI,kBAAkB,MAAM,aAAa;GAC9C,KAAK,IAAI,yBAAyB,MAAM;GACxC,IAAI,MAAM,UAAU,KAAA,GAAW,KAAK,IAAI,SAAS,OAAOA,OAAS,MAAM,KAAK,CAAC;GAC7E,IAAI,MAAM,kBAAkB,KAAA,GAAW,KAAK,IAAI,WAAW,OAAO,MAAM,aAAa,CAAC;GACtF,KAAK,MAAM,CAAC,KAAK,SAAS,MAAM,IAAI,aAAa,OAAO,KAAK,IAAI;GACjE,IAAI,IAAI,KAAK,SAAS,OAAO,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,aAAa,CAAC;GAE3F,OAAO,SAAS,KAAK,IAAI,IAAI;EAC/B,GAAG,GAoE+B;EAAG,WAlEnB,OAAO,WAAW,WAAW,OAAuB;GACpE,OAAO;GACP,MAAM,QAAQ,OAAOC,cAAgB,WAAW,KAAK;GACrD,MAAM,OAAO,WAAW,KAAK;GAE7B,KAAK,IAAI,cAAc,oBAAoB;GAC3C,KAAK,IAAI,QAAQ,OAAOD,OAAS,MAAM,IAAI,CAAC;GAC5C,KAAK,IAAI,iBAAiB,OAAOA,OAAS,MAAM,YAAY,CAAC;GAC7D,KAAK,IAAI,gBAAgB,MAAM,WAAW;GAE1C,OAAO,OAAO,KAAK,IAAI;EACzB,GAAG,GAuD0C;EAAG,cArD3B,OAAO,WAAW,WAAW,OAA0B;GAC1E,OAAO;GACP,MAAM,QAAQ,OAAOC,cAAgB,cAAc,KAAK;GACxD,MAAM,OAAO,WAAW,KAAK;GAE7B,KAAK,IAAI,cAAc,eAAe;GACtC,KAAK,IAAI,iBAAiB,OAAOD,OAAS,MAAM,YAAY,CAAC;GAC7D,IAAI,MAAM,WAAW,KAAA,GAAW,KAAK,IAAI,SAAS,MAAM,OAAO,KAAK,GAAG,CAAC;GAExE,OAAO,OAAO,KAAK,IAAI;EACzB,GAAG,GA2CwD;EAAG,cAzCzC,OAAO,WAAW,WAAW,OAAkC;GAClF,OAAO;GACP,IAAI,YAAY,KAAA,GAAW,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,WAAW,CAAC;GACvF,MAAM,QAAQ,OAAOA,OAAS,OAAOF,OAAS,QAAQ,KAAK,CAAC;GAE5D,MAAMO,YAAU,kBAAkB,IAAI,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAC/D,kBAAkB,YAClB,kBAAkB,WAAW,QAAQ,WAAW,CAAC,CAAC,GAClD,kBAAkB,UAAU,iBAAiB,UAAU,OAAO,CAChE;GAEA,MAAM,WAAW,OAAOE,QAAkB,MAAMF,WAAS,OAAO;GAEhE,IAAI,SAAS,WAAW,KAAK,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;GAE9D,OAAO,OAAOL,QAAU,OAAOM,KAAe,QAAQ,EAAA,CAAG,IAAI;EAC/D,GAAG,GAyBsE;EAAG,QAvB7D,OAAO,WAAW,WAAW,OAAwB;GAClE,OAAO;GACP,IAAI,SAAS,wBAAwB,KAAA,GACnC,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,WAAW,CAAC;GAC9D,IAAI,oBAAoB,KAAA,KAAa,CAAC,gBAAgB,SAAS,yBAAyB,MAAM,GAC5F,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,iBAAiB,CAAC;GACpE,MAAM,QAAQ,OAAOL,cAAgB,YAAY,KAAK;GAEtD,MAAMI,YAAU,OAAO,cACrB,IAAI,IAAI,SAAS,mBAAmB,CAAC,CAAC,MACtC,QAAQ,UACR,0BACA,IAAI,gBAAgB;IAClB,OAAO,OAAOL,OAAS,MAAM,KAAK;IAClC,iBAAiB,MAAM;GACzB,CAAC,CACH;GAIA,KAAI,OAFoBO,QAAkB,MAAMF,WAAS,OAAO,EAAA,CAEnD,WAAW,KAAK,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;EAChE,GAAG,GAE8E;CAAE;AACrF,CAAC;AAED,MAAM,SAAS,OAAO,SAASjB,KAAO,KAAK,CAAC,CAAC,MAAM,OAAO,UAAU,yBAAyB,CAAC,GAAG,EAC/F,oBAAoB,KACtB,CAAC;AAED,MAAM,uBAAuB,OAAO,WAAW,WAC7C,gBAC+C;CAC/C,OAAO,eAAe,WAAW,SAC7B,EAAE,GAAG,eAAe,IACpB;EAAE,GAAG;EAAgB,QAAQ,SAAS,KAAK,OAAOY,OAAS,eAAe,MAAM,CAAC;CAAE;AACzF,CAAC"}
+{"version":3,"file":"OAuth.mjs","names":["V.JsonObject","V.Issuer","V.ProtocolEndpoint","V.Endpoint","V.text","V.secret","V.integer","V.Headers","V.Parameters","V.Resources","V.Callback","V.Scopes","V.Challenge","V.Verifier","V.decode","Transport.isJson","V.reveal","V.configuration","V.freeze","Ownership.make","Transport.capture","request","Transport.json","Transport.request"],"sources":["../src/OAuth.ts"],"sourcesContent":["import { Effect, Redacted, Schema, type Scope } from \"effect\";\nimport { Base64 } from \"effect/encoding\";\nimport type { HttpClient } from \"effect/http\";\nimport { HttpClientRequest } from \"effect/http\";\n\nimport { ConfigurationError, Rejected, Unavailable } from \"./Errors\";\nimport * as Ownership from \"./internal/ownership\";\nimport * as Transport from \"./internal/transport\";\nimport * as V from \"./internal/validation\";\n\nexport const JsonObject = V.JsonObject;\nexport type JsonObject = typeof JsonObject.Type;\n\nexport const Metadata = Schema.Struct({\n  issuer: V.Issuer,\n  authorization_endpoint: V.ProtocolEndpoint,\n  token_endpoint: V.ProtocolEndpoint,\n  jwks_uri: Schema.optionalKey(V.Endpoint),\n  userinfo_endpoint: Schema.optionalKey(V.Endpoint),\n  revocation_endpoint: Schema.optionalKey(V.ProtocolEndpoint),\n  code_challenge_methods_supported: Schema.optionalKey(\n    Schema.Array(V.text(64)).check(Schema.isMaxLength(64)),\n  ),\n  response_types_supported: Schema.optionalKey(\n    Schema.Array(V.text(64)).check(Schema.isMaxLength(64)),\n  ),\n  grant_types_supported: Schema.optionalKey(\n    Schema.Array(V.text(128)).check(Schema.isMaxLength(64)),\n  ),\n  id_token_signing_alg_values_supported: Schema.optionalKey(\n    Schema.Array(V.text(64)).check(Schema.isMaxLength(64)),\n  ),\n  token_endpoint_auth_methods_supported: Schema.optionalKey(\n    Schema.Array(V.text(64)).check(Schema.isMaxLength(64)),\n  ),\n  revocation_endpoint_auth_methods_supported: Schema.optionalKey(\n    Schema.Array(V.text(64)).check(Schema.isMaxLength(64)),\n  ),\n  authorization_response_iss_parameter_supported: Schema.optionalKey(Schema.Boolean),\n});\n\nexport type Metadata = typeof Metadata.Type;\n\nexport const Authentication = Schema.Union([\n  Schema.Struct({ method: Schema.Literal(\"client_secret_basic\"), secret: V.secret(4096) }),\n  Schema.Struct({ method: Schema.Literal(\"client_secret_post\"), secret: V.secret(4096) }),\n  Schema.Struct({ method: Schema.Literal(\"none\"), publicClient: Schema.Literal(true) }),\n]);\n\nexport type Authentication = typeof Authentication.Type;\n\n/** Uninterpreted private receipt. Inspect provider extensions before calling tokens. */\nexport const TokenReceipt = Schema.Struct({\n  status: V.integer(100, 599),\n  contentType: Schema.NullOr(Schema.String.check(Schema.isMaxLength(512))),\n  body: Schema.Redacted(JsonObject, { disallowJsonEncode: true }),\n});\n\nexport type TokenReceipt = typeof TokenReceipt.Type;\n\nexport const TokenSet = Schema.Struct({\n  tokenType: Schema.Literal(\"bearer\"),\n  accessToken: V.secret(16384),\n  refreshToken: Schema.optionalKey(V.secret(16384)),\n  idToken: Schema.optionalKey(V.secret(65536)),\n  expiresIn: Schema.optionalKey(Schema.Finite.check(Schema.isGreaterThanOrEqualTo(0))),\n  scope: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(16447))),\n});\n\nexport type TokenSet = typeof TokenSet.Type;\n\nexport interface RequestOptions {\n  readonly timeoutMs: number;\n  readonly maxResponseBytes?: number;\n}\n\nexport interface ClientOptions extends RequestOptions {\n  readonly metadata: Metadata;\n  readonly clientId: string;\n  readonly authentication: Authentication;\n  readonly profile?: { readonly url: string; readonly headers?: Readonly<Record<string, string>> };\n  readonly revocationAuthentication?: Authentication;\n}\n\nexport interface Parameters {\n  readonly parameters?: Readonly<Record<string, string>>;\n  readonly resources?: ReadonlyArray<string>;\n}\n\nexport interface AuthorizationInput extends Parameters {\n  readonly redirectUri: string;\n  readonly scopes: ReadonlyArray<string>;\n  readonly state: Redacted.Redacted<string>;\n  readonly codeChallenge?: string;\n  readonly nonce?: Redacted.Redacted<string>;\n  readonly maxAgeSeconds?: number;\n  readonly prompt?: \"none\" | \"login\" | \"consent\" | \"select_account\";\n  readonly loginHint?: string;\n}\n\nexport interface CodeGrantInput extends Parameters {\n  readonly code: Redacted.Redacted<string>;\n  readonly redirectUri: string;\n  readonly pkceVerifier?: Redacted.Redacted<string>;\n}\n\nexport interface RefreshGrantInput extends Parameters {\n  readonly refreshToken: Redacted.Redacted<string>;\n  readonly scopes?: ReadonlyArray<string>;\n}\n\nexport interface RevocationInput {\n  readonly token: Redacted.Redacted<string>;\n  readonly tokenTypeHint: \"access_token\" | \"refresh_token\";\n}\n\nexport interface Client {\n  readonly metadata: Metadata;\n  readonly authorizationUrl: (\n    input: AuthorizationInput,\n  ) => Effect.Effect<Redacted.Redacted<string>, ConfigurationError | Unavailable>;\n  readonly codeGrant: (\n    input: CodeGrantInput,\n  ) => Effect.Effect<TokenReceipt, ConfigurationError | Unavailable>;\n  readonly refreshGrant: (\n    input: RefreshGrantInput,\n  ) => Effect.Effect<TokenReceipt, ConfigurationError | Unavailable>;\n  readonly fetchProfile: (\n    accessToken: Redacted.Redacted<string>,\n  ) => Effect.Effect<JsonObject, ConfigurationError | Unavailable>;\n  readonly revoke: (\n    input: RevocationInput,\n  ) => Effect.Effect<void, ConfigurationError | Unavailable>;\n}\n\nconst ClientOptionsSchema = Schema.Struct({\n  metadata: Metadata,\n  clientId: V.text(1024),\n  authentication: Authentication,\n  ...V.RequestOptions.fields,\n  profile: Schema.optionalKey(\n    Schema.Struct({ url: V.Endpoint, headers: Schema.optionalKey(V.Headers) }),\n  ),\n  revocationAuthentication: Schema.optionalKey(Authentication),\n});\n\nconst additional = {\n  parameters: Schema.optionalKey(V.Parameters),\n  resources: Schema.optionalKey(V.Resources),\n};\n\nconst Authorization = Schema.Struct({\n  ...additional,\n  redirectUri: V.Callback,\n  scopes: V.Scopes,\n  state: V.secret(256),\n  codeChallenge: Schema.optionalKey(V.Challenge),\n  nonce: Schema.optionalKey(V.secret(256)),\n  maxAgeSeconds: Schema.optionalKey(V.integer(0, 86400)),\n  prompt: Schema.optionalKey(Schema.Literals([\"none\", \"login\", \"consent\", \"select_account\"])),\n  loginHint: Schema.optionalKey(V.text(1024)),\n});\n\nconst CodeGrant = Schema.Struct({\n  ...additional,\n  code: V.secret(16384),\n  redirectUri: V.Callback,\n  pkceVerifier: Schema.optionalKey(V.Verifier),\n});\n\nconst RefreshGrant = Schema.Struct({\n  ...additional,\n  refreshToken: V.secret(16384),\n  scopes: Schema.optionalKey(V.Scopes),\n});\n\nconst Revocation = Schema.Struct({\n  token: V.secret(16384),\n  tokenTypeHint: Schema.Literals([\"access_token\", \"refresh_token\"]),\n});\n\nconst ExpiresIn = Schema.Union([\n  Schema.Finite,\n  Schema.String.check(Schema.isPattern(/^(?:0|[1-9][0-9]*)(?:\\.[0-9]+)?$/u)).pipe(\n    Schema.decodeTo(Schema.FiniteFromString),\n  ),\n]).check(Schema.isGreaterThanOrEqualTo(0));\n\nconst RawToken = Schema.Struct({\n  access_token: V.text(16384),\n  token_type: Schema.String.check(Schema.isPattern(/^[Bb][Ee][Aa][Rr][Ee][Rr]$/)),\n  refresh_token: Schema.optionalKey(V.text(16384)),\n  id_token: Schema.optionalKey(V.text(65536)),\n  expires_in: Schema.optionalKey(ExpiresIn),\n  scope: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(16447))),\n});\n\nconst Terminal = Schema.Struct({\n  error: V.text(128),\n  error_description: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(4096))),\n  error_uri: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(2048))),\n});\n\nconst successFields = [\n  \"access_token\",\n  \"refresh_token\",\n  \"id_token\",\n  \"token_type\",\n  \"scope\",\n  \"expires_in\",\n  \"refresh_expires_in\",\n  \"refresh_token_expires_in\",\n];\n\n/** Parse once provider-specific receipt checks have succeeded. expires_in accepts\n * finite nonnegative numbers and whole decimal strings (for example \"60.5\").\n * Whitespace, exponent/prefix syntax and nonfinite values are rejected. Raw\n * receipt extensions/scopes are untouched; no request, retry or claim verification. */\nexport const tokens = Effect.fnUntraced(function* (\n  input: TokenReceipt,\n): Effect.fn.Return<TokenSet, Rejected | Unavailable> {\n  const receipt = yield* V.decode(TokenReceipt, input);\n\n  if (!Transport.isJson(receipt.contentType)) return yield* Unavailable.make({});\n  const raw = yield* V.reveal(receipt.body);\n\n  if (Object.hasOwn(raw, \"error\")) {\n    if (successFields.some((key) => Object.hasOwn(raw, key))) return yield* Unavailable.make({});\n    const terminal = yield* V.decode(Terminal, raw);\n\n    if (receipt.status === 400 && terminal.error === \"invalid_grant\")\n      return yield* Rejected.make({ reason: \"invalid_grant\" });\n\n    return yield* Unavailable.make({});\n  }\n  if (\n    receipt.status !== 200 ||\n    Object.hasOwn(raw, \"error_description\") ||\n    Object.hasOwn(raw, \"error_uri\")\n  )\n    return yield* Unavailable.make({});\n  const value = yield* V.decode(RawToken, raw);\n\n  return {\n    tokenType: \"bearer\",\n    accessToken: Redacted.make(value.access_token),\n    ...(value.refresh_token === undefined\n      ? {}\n      : { refreshToken: Redacted.make(value.refresh_token) }),\n    ...(value.id_token === undefined ? {} : { idToken: Redacted.make(value.id_token) }),\n    ...(value.expires_in === undefined ? {} : { expiresIn: value.expires_in }),\n    ...(value.scope === undefined ? {} : { scope: value.scope }),\n  };\n});\n\nconst parameters = (input: Parameters) => {\n  const values = new URLSearchParams(input.parameters);\n\n  for (const resource of input.resources ?? []) values.append(\"resource\", resource);\n\n  return values;\n};\n\n// RFC6749 Appendix B: encode client credentials before joining with the colon.\n// Adapted from oauth4webapi 3.8.8 src/index.ts::formUrlEncode (MIT, Filip Skokan).\n// Exact source commit and license: ../THIRD_PARTY_NOTICES.md.\nconst basicComponent = (value: string) =>\n  encodeURIComponent(value).replace(/[-_.!~*'()]|%20/gu, (part) =>\n    part === \"%20\" ? \"+\" : `%${part.charCodeAt(0).toString(16).toUpperCase()}`,\n  );\n\nconst authenticated = Effect.fnUntraced(function* (\n  url: string,\n  clientId: string,\n  authentication: Authentication,\n  body: URLSearchParams,\n) {\n  let request = HttpClientRequest.post(url).pipe(HttpClientRequest.acceptJson);\n\n  if (authentication.method === \"client_secret_basic\") {\n    const secret = yield* V.reveal(authentication.secret);\n\n    const credential = yield* Effect.try({\n      try: () => Base64.encode(`${basicComponent(clientId)}:${basicComponent(secret)}`),\n      catch: () => Unavailable.make({}),\n    });\n\n    request = HttpClientRequest.setHeader(request, \"authorization\", `Basic ${credential}`);\n  } else {\n    body.set(\"client_id\", clientId);\n    if (authentication.method === \"client_secret_post\")\n      body.set(\"client_secret\", yield* V.reveal(authentication.secret));\n  }\n  const encoded = body.toString();\n\n  if (new TextEncoder().encode(encoded).length > 131072)\n    return yield* ConfigurationError.make({ reason: \"parameters\" });\n\n  return HttpClientRequest.bodyText(\n    request,\n    encoded,\n    \"application/x-www-form-urlencoded;charset=UTF-8\",\n  );\n});\n\n/** One installed client, exact endpoints, private credentials and owning Scope.\n * Supply an HttpClient without retry/redirect/cookie middleware. Fetch injection\n * active at construction is captured. Owner closure cancels and joins active\n * operations, then rejects their results as unavailable; caller interruption\n * cancels and joins its operation without closing the client. */\nexport const make = Effect.fnUntraced(function* (\n  input: ClientOptions,\n): Effect.fn.Return<Client, ConfigurationError | Unavailable, HttpClient.HttpClient | Scope.Scope> {\n  const options = yield* V.configuration(ClientOptionsSchema, input, \"metadata\");\n\n  const authentication = yield* detachAuthentication(options.authentication);\n\n  const revocationAuthentication =\n    options.revocationAuthentication === undefined\n      ? authentication\n      : yield* detachAuthentication(options.revocationAuthentication);\n\n  const metadata = V.freeze(options.metadata);\n\n  const supported =\n    metadata.token_endpoint_auth_methods_supported ??\n    (metadata.jwks_uri === undefined ? undefined : [\"client_secret_basic\"]);\n\n  const revokeSupported =\n    metadata.revocation_endpoint_auth_methods_supported ??\n    (metadata.jwks_uri === undefined ? undefined : [\"client_secret_basic\"]);\n\n  if (\n    (supported !== undefined && !supported.includes(authentication.method)) ||\n    (options.revocationAuthentication !== undefined &&\n      metadata.revocation_endpoint !== undefined &&\n      revokeSupported !== undefined &&\n      !revokeSupported.includes(revocationAuthentication.method))\n  )\n    return yield* ConfigurationError.make({ reason: \"authentication\" });\n  const { available, use } = yield* Ownership.make;\n  const http = yield* Transport.capture;\n  const profile = options.profile === undefined ? undefined : V.freeze(options.profile);\n\n  yield* Effect.addFinalizer(() =>\n    Effect.sync(() => {\n      if (authentication.method !== \"none\") Redacted.wipeUnsafe(authentication.secret);\n      if (revocationAuthentication.method !== \"none\")\n        Redacted.wipeUnsafe(revocationAuthentication.secret);\n    }),\n  );\n\n  const send = Effect.fnUntraced(function* (body: URLSearchParams) {\n    yield* available;\n\n    const request = yield* authenticated(\n      new URL(metadata.token_endpoint).href,\n      options.clientId,\n      authentication,\n      body,\n    );\n\n    return yield* Transport.json(yield* Transport.request(http, request, options));\n  });\n\n  const authorizationUrl = Effect.fnUntraced(function* (input: AuthorizationInput) {\n    yield* available;\n    const value = yield* V.configuration(Authorization, input);\n    const url = new URL(metadata.authorization_endpoint);\n    const body = parameters(value);\n\n    body.set(\"client_id\", options.clientId);\n    body.set(\"redirect_uri\", value.redirectUri);\n    body.set(\"response_type\", \"code\");\n    body.set(\"response_mode\", \"query\");\n    body.set(\"scope\", value.scopes.join(\" \"));\n    body.set(\"state\", yield* V.reveal(value.state));\n    if (value.codeChallenge !== undefined) {\n      body.set(\"code_challenge\", value.codeChallenge);\n      body.set(\"code_challenge_method\", \"S256\");\n    }\n    if (value.nonce !== undefined) body.set(\"nonce\", yield* V.reveal(value.nonce));\n    if (value.maxAgeSeconds !== undefined) body.set(\"max_age\", String(value.maxAgeSeconds));\n    if (value.prompt !== undefined) body.set(\"prompt\", value.prompt);\n    if (value.loginHint !== undefined) body.set(\"login_hint\", value.loginHint);\n    for (const [key, item] of body) url.searchParams.append(key, item);\n    if (url.href.length > 16384) return yield* ConfigurationError.make({ reason: \"parameters\" });\n\n    return Redacted.make(url.href);\n  }, use);\n\n  const codeGrant = Effect.fnUntraced(function* (input: CodeGrantInput) {\n    yield* available;\n    const value = yield* V.configuration(CodeGrant, input);\n    const body = parameters(value);\n\n    body.set(\"grant_type\", \"authorization_code\");\n    body.set(\"code\", yield* V.reveal(value.code));\n    if (value.pkceVerifier !== undefined)\n      body.set(\"code_verifier\", yield* V.reveal(value.pkceVerifier));\n    body.set(\"redirect_uri\", value.redirectUri);\n\n    return yield* send(body);\n  }, use);\n\n  const refreshGrant = Effect.fnUntraced(function* (input: RefreshGrantInput) {\n    yield* available;\n    const value = yield* V.configuration(RefreshGrant, input);\n    const body = parameters(value);\n\n    body.set(\"grant_type\", \"refresh_token\");\n    body.set(\"refresh_token\", yield* V.reveal(value.refreshToken));\n    if (value.scopes !== undefined) body.set(\"scope\", value.scopes.join(\" \"));\n\n    return yield* send(body);\n  }, use);\n\n  const fetchProfile = Effect.fnUntraced(function* (input: Redacted.Redacted<string>) {\n    yield* available;\n    if (profile === undefined) return yield* ConfigurationError.make({ reason: \"endpoint\" });\n    const token = yield* V.reveal(yield* V.decode(Bearer, input));\n\n    const request = HttpClientRequest.get(new URL(profile.url).href).pipe(\n      HttpClientRequest.acceptJson,\n      HttpClientRequest.setHeaders(profile.headers ?? {}),\n      HttpClientRequest.setHeader(\"authorization\", `Bearer ${token}`),\n    );\n\n    const response = yield* Transport.request(http, request, options);\n\n    if (response.status !== 200) return yield* Unavailable.make({});\n\n    return yield* V.reveal((yield* Transport.json(response)).body);\n  }, use);\n\n  const revoke = Effect.fnUntraced(function* (input: RevocationInput) {\n    yield* available;\n    if (metadata.revocation_endpoint === undefined)\n      return yield* ConfigurationError.make({ reason: \"endpoint\" });\n    if (revokeSupported !== undefined && !revokeSupported.includes(revocationAuthentication.method))\n      return yield* ConfigurationError.make({ reason: \"authentication\" });\n    const value = yield* V.configuration(Revocation, input);\n\n    const request = yield* authenticated(\n      new URL(metadata.revocation_endpoint).href,\n      options.clientId,\n      revocationAuthentication,\n      new URLSearchParams({\n        token: yield* V.reveal(value.token),\n        token_type_hint: value.tokenTypeHint,\n      }),\n    );\n\n    const response = yield* Transport.request(http, request, options);\n\n    if (response.status !== 200) return yield* Unavailable.make({});\n  }, use);\n\n  return { metadata, authorizationUrl, codeGrant, refreshGrant, fetchProfile, revoke };\n});\n\nconst Bearer = Schema.Redacted(V.text(16384).check(Schema.isPattern(/^[A-Za-z0-9._~+/-]+=*$/u)), {\n  disallowJsonEncode: true,\n});\n\nconst detachAuthentication = Effect.fnUntraced(function* (\n  authentication: Authentication,\n): Effect.fn.Return<Authentication, Unavailable> {\n  return authentication.method === \"none\"\n    ? { ...authentication }\n    : { ...authentication, secret: Redacted.make(yield* V.reveal(authentication.secret)) };\n});\n"],"mappings":";;;;;;;;AAUA,MAAa,aAAaA;AAG1B,MAAa,WAAW,OAAO,OAAO;CACpC,QAAQC;CACR,wBAAwBC;CACxB,gBAAgBA;CAChB,UAAU,OAAO,YAAYC,QAAU;CACvC,mBAAmB,OAAO,YAAYA,QAAU;CAChD,qBAAqB,OAAO,YAAYD,gBAAkB;CAC1D,kCAAkC,OAAO,YACvC,OAAO,MAAME,KAAO,EAAE,CAAC,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC,CACvD;CACA,0BAA0B,OAAO,YAC/B,OAAO,MAAMA,KAAO,EAAE,CAAC,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC,CACvD;CACA,uBAAuB,OAAO,YAC5B,OAAO,MAAMA,KAAO,GAAG,CAAC,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC,CACxD;CACA,uCAAuC,OAAO,YAC5C,OAAO,MAAMA,KAAO,EAAE,CAAC,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC,CACvD;CACA,uCAAuC,OAAO,YAC5C,OAAO,MAAMA,KAAO,EAAE,CAAC,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC,CACvD;CACA,4CAA4C,OAAO,YACjD,OAAO,MAAMA,KAAO,EAAE,CAAC,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC,CACvD;CACA,gDAAgD,OAAO,YAAY,OAAO,OAAO;AACnF,CAAC;AAID,MAAa,iBAAiB,OAAO,MAAM;CACzC,OAAO,OAAO;EAAE,QAAQ,OAAO,QAAQ,qBAAqB;EAAG,QAAQC,OAAS,IAAI;CAAE,CAAC;CACvF,OAAO,OAAO;EAAE,QAAQ,OAAO,QAAQ,oBAAoB;EAAG,QAAQA,OAAS,IAAI;CAAE,CAAC;CACtF,OAAO,OAAO;EAAE,QAAQ,OAAO,QAAQ,MAAM;EAAG,cAAc,OAAO,QAAQ,IAAI;CAAE,CAAC;AACtF,CAAC;;AAKD,MAAa,eAAe,OAAO,OAAO;CACxC,QAAQC,QAAU,KAAK,GAAG;CAC1B,aAAa,OAAO,OAAO,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC;CACvE,MAAM,OAAO,SAAS,YAAY,EAAE,oBAAoB,KAAK,CAAC;AAChE,CAAC;AAID,MAAa,WAAW,OAAO,OAAO;CACpC,WAAW,OAAO,QAAQ,QAAQ;CAClC,aAAaD,OAAS,KAAK;CAC3B,cAAc,OAAO,YAAYA,OAAS,KAAK,CAAC;CAChD,SAAS,OAAO,YAAYA,OAAS,KAAK,CAAC;CAC3C,WAAW,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,uBAAuB,CAAC,CAAC,CAAC;CACnF,OAAO,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,KAAK,CAAC,CAAC;AAC1E,CAAC;AAoED,MAAM,sBAAsB,OAAO,OAAO;CACxC,UAAU;CACV,UAAUD,KAAO,IAAI;CACrB,gBAAgB;CAChB,GAAA,eAAoB;CACpB,SAAS,OAAO,YACd,OAAO,OAAO;EAAE,KAAKD;EAAY,SAAS,OAAO,YAAYI,OAAS;CAAE,CAAC,CAC3E;CACA,0BAA0B,OAAO,YAAY,cAAc;AAC7D,CAAC;AAED,MAAM,aAAa;CACjB,YAAY,OAAO,YAAYC,UAAY;CAC3C,WAAW,OAAO,YAAYC,SAAW;AAC3C;AAEA,MAAM,gBAAgB,OAAO,OAAO;CAClC,GAAG;CACH,aAAaC;CACb,QAAQC;CACR,OAAON,OAAS,GAAG;CACnB,eAAe,OAAO,YAAYO,SAAW;CAC7C,OAAO,OAAO,YAAYP,OAAS,GAAG,CAAC;CACvC,eAAe,OAAO,YAAYC,QAAU,GAAG,KAAK,CAAC;CACrD,QAAQ,OAAO,YAAY,OAAO,SAAS;EAAC;EAAQ;EAAS;EAAW;CAAgB,CAAC,CAAC;CAC1F,WAAW,OAAO,YAAYF,KAAO,IAAI,CAAC;AAC5C,CAAC;AAED,MAAM,YAAY,OAAO,OAAO;CAC9B,GAAG;CACH,MAAMC,OAAS,KAAK;CACpB,aAAaK;CACb,cAAc,OAAO,YAAYG,QAAU;AAC7C,CAAC;AAED,MAAM,eAAe,OAAO,OAAO;CACjC,GAAG;CACH,cAAcR,OAAS,KAAK;CAC5B,QAAQ,OAAO,YAAYM,MAAQ;AACrC,CAAC;AAED,MAAM,aAAa,OAAO,OAAO;CAC/B,OAAON,OAAS,KAAK;CACrB,eAAe,OAAO,SAAS,CAAC,gBAAgB,eAAe,CAAC;AAClE,CAAC;AAED,MAAM,YAAY,OAAO,MAAM,CAC7B,OAAO,QACP,OAAO,OAAO,MAAM,OAAO,UAAU,mCAAmC,CAAC,CAAC,CAAC,KACzE,OAAO,SAAS,OAAO,gBAAgB,CACzC,CACF,CAAC,CAAC,CAAC,MAAM,OAAO,uBAAuB,CAAC,CAAC;AAEzC,MAAM,WAAW,OAAO,OAAO;CAC7B,cAAcD,KAAO,KAAK;CAC1B,YAAY,OAAO,OAAO,MAAM,OAAO,UAAU,4BAA4B,CAAC;CAC9E,eAAe,OAAO,YAAYA,KAAO,KAAK,CAAC;CAC/C,UAAU,OAAO,YAAYA,KAAO,KAAK,CAAC;CAC1C,YAAY,OAAO,YAAY,SAAS;CACxC,OAAO,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,WAAW,OAAO,OAAO;CAC7B,OAAOA,KAAO,GAAG;CACjB,mBAAmB,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;CACnF,WAAW,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,gBAAgB;CACpB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;AAMA,MAAa,SAAS,OAAO,WAAW,WACtC,OACoD;CACpD,MAAM,UAAU,OAAOU,OAAS,cAAc,KAAK;CAEnD,IAAI,CAACC,OAAiB,QAAQ,WAAW,GAAG,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;CAC7E,MAAM,MAAM,OAAOC,OAAS,QAAQ,IAAI;CAExC,IAAI,OAAO,OAAO,KAAK,OAAO,GAAG;EAC/B,IAAI,cAAc,MAAM,QAAQ,OAAO,OAAO,KAAK,GAAG,CAAC,GAAG,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;EAC3F,MAAM,WAAW,OAAOF,OAAS,UAAU,GAAG;EAE9C,IAAI,QAAQ,WAAW,OAAO,SAAS,UAAU,iBAC/C,OAAO,OAAO,SAAS,KAAK,EAAE,QAAQ,gBAAgB,CAAC;EAEzD,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;CACnC;CACA,IACE,QAAQ,WAAW,OACnB,OAAO,OAAO,KAAK,mBAAmB,KACtC,OAAO,OAAO,KAAK,WAAW,GAE9B,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;CACnC,MAAM,QAAQ,OAAOA,OAAS,UAAU,GAAG;CAE3C,OAAO;EACL,WAAW;EACX,aAAa,SAAS,KAAK,MAAM,YAAY;EAC7C,GAAI,MAAM,kBAAkB,KAAA,IACxB,CAAC,IACD,EAAE,cAAc,SAAS,KAAK,MAAM,aAAa,EAAE;EACvD,GAAI,MAAM,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,SAAS,KAAK,MAAM,QAAQ,EAAE;EACjF,GAAI,MAAM,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,MAAM,WAAW;EACxE,GAAI,MAAM,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;CAC5D;AACF,CAAC;AAED,MAAM,cAAc,UAAsB;CACxC,MAAM,SAAS,IAAI,gBAAgB,MAAM,UAAU;CAEnD,KAAK,MAAM,YAAY,MAAM,aAAa,CAAC,GAAG,OAAO,OAAO,YAAY,QAAQ;CAEhF,OAAO;AACT;AAKA,MAAM,kBAAkB,UACtB,mBAAmB,KAAK,CAAC,CAAC,QAAQ,sBAAsB,SACtD,SAAS,QAAQ,MAAM,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,YAAY,GACzE;AAEF,MAAM,gBAAgB,OAAO,WAAW,WACtC,KACA,UACA,gBACA,MACA;CACA,IAAI,UAAU,kBAAkB,KAAK,GAAG,CAAC,CAAC,KAAK,kBAAkB,UAAU;CAE3E,IAAI,eAAe,WAAW,uBAAuB;EACnD,MAAM,SAAS,OAAOE,OAAS,eAAe,MAAM;EAEpD,MAAM,aAAa,OAAO,OAAO,IAAI;GACnC,WAAW,OAAO,OAAO,GAAG,eAAe,QAAQ,EAAE,GAAG,eAAe,MAAM,GAAG;GAChF,aAAa,YAAY,KAAK,CAAC,CAAC;EAClC,CAAC;EAED,UAAU,kBAAkB,UAAU,SAAS,iBAAiB,SAAS,YAAY;CACvF,OAAO;EACL,KAAK,IAAI,aAAa,QAAQ;EAC9B,IAAI,eAAe,WAAW,sBAC5B,KAAK,IAAI,iBAAiB,OAAOA,OAAS,eAAe,MAAM,CAAC;CACpE;CACA,MAAM,UAAU,KAAK,SAAS;CAE9B,IAAI,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,SAAS,QAC7C,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,aAAa,CAAC;CAEhE,OAAO,kBAAkB,SACvB,SACA,SACA,iDACF;AACF,CAAC;;;;;;AAOD,MAAa,OAAO,OAAO,WAAW,WACpC,OACiG;CACjG,MAAM,UAAU,OAAOC,cAAgB,qBAAqB,OAAO,UAAU;CAE7E,MAAM,iBAAiB,OAAO,qBAAqB,QAAQ,cAAc;CAEzE,MAAM,2BACJ,QAAQ,6BAA6B,KAAA,IACjC,iBACA,OAAO,qBAAqB,QAAQ,wBAAwB;CAElE,MAAM,WAAWC,OAAS,QAAQ,QAAQ;CAE1C,MAAM,YACJ,SAAS,0CACR,SAAS,aAAa,KAAA,IAAY,KAAA,IAAY,CAAC,qBAAqB;CAEvE,MAAM,kBACJ,SAAS,+CACR,SAAS,aAAa,KAAA,IAAY,KAAA,IAAY,CAAC,qBAAqB;CAEvE,IACG,cAAc,KAAA,KAAa,CAAC,UAAU,SAAS,eAAe,MAAM,KACpE,QAAQ,6BAA6B,KAAA,KACpC,SAAS,wBAAwB,KAAA,KACjC,oBAAoB,KAAA,KACpB,CAAC,gBAAgB,SAAS,yBAAyB,MAAM,GAE3D,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,iBAAiB,CAAC;CACpE,MAAM,EAAE,WAAW,QAAQ,OAAOC;CAClC,MAAM,OAAO,OAAOC;CACpB,MAAM,UAAU,QAAQ,YAAY,KAAA,IAAY,KAAA,IAAYF,OAAS,QAAQ,OAAO;CAEpF,OAAO,OAAO,mBACZ,OAAO,WAAW;EAChB,IAAI,eAAe,WAAW,QAAQ,SAAS,WAAW,eAAe,MAAM;EAC/E,IAAI,yBAAyB,WAAW,QACtC,SAAS,WAAW,yBAAyB,MAAM;CACvD,CAAC,CACH;CAEA,MAAM,OAAO,OAAO,WAAW,WAAW,MAAuB;EAC/D,OAAO;EAEP,MAAMG,YAAU,OAAO,cACrB,IAAI,IAAI,SAAS,cAAc,CAAC,CAAC,MACjC,QAAQ,UACR,gBACA,IACF;EAEA,OAAO,OAAOC,KAAe,OAAOC,QAAkB,MAAMF,WAAS,OAAO,CAAC;CAC/E,CAAC;CA+FD,OAAO;EAAE;EAAU,kBA7FM,OAAO,WAAW,WAAW,OAA2B;GAC/E,OAAO;GACP,MAAM,QAAQ,OAAOJ,cAAgB,eAAe,KAAK;GACzD,MAAM,MAAM,IAAI,IAAI,SAAS,sBAAsB;GACnD,MAAM,OAAO,WAAW,KAAK;GAE7B,KAAK,IAAI,aAAa,QAAQ,QAAQ;GACtC,KAAK,IAAI,gBAAgB,MAAM,WAAW;GAC1C,KAAK,IAAI,iBAAiB,MAAM;GAChC,KAAK,IAAI,iBAAiB,OAAO;GACjC,KAAK,IAAI,SAAS,MAAM,OAAO,KAAK,GAAG,CAAC;GACxC,KAAK,IAAI,SAAS,OAAOD,OAAS,MAAM,KAAK,CAAC;GAC9C,IAAI,MAAM,kBAAkB,KAAA,GAAW;IACrC,KAAK,IAAI,kBAAkB,MAAM,aAAa;IAC9C,KAAK,IAAI,yBAAyB,MAAM;GAC1C;GACA,IAAI,MAAM,UAAU,KAAA,GAAW,KAAK,IAAI,SAAS,OAAOA,OAAS,MAAM,KAAK,CAAC;GAC7E,IAAI,MAAM,kBAAkB,KAAA,GAAW,KAAK,IAAI,WAAW,OAAO,MAAM,aAAa,CAAC;GACtF,IAAI,MAAM,WAAW,KAAA,GAAW,KAAK,IAAI,UAAU,MAAM,MAAM;GAC/D,IAAI,MAAM,cAAc,KAAA,GAAW,KAAK,IAAI,cAAc,MAAM,SAAS;GACzE,KAAK,MAAM,CAAC,KAAK,SAAS,MAAM,IAAI,aAAa,OAAO,KAAK,IAAI;GACjE,IAAI,IAAI,KAAK,SAAS,OAAO,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,aAAa,CAAC;GAE3F,OAAO,SAAS,KAAK,IAAI,IAAI;EAC/B,GAAG,GAqE+B;EAAG,WAnEnB,OAAO,WAAW,WAAW,OAAuB;GACpE,OAAO;GACP,MAAM,QAAQ,OAAOC,cAAgB,WAAW,KAAK;GACrD,MAAM,OAAO,WAAW,KAAK;GAE7B,KAAK,IAAI,cAAc,oBAAoB;GAC3C,KAAK,IAAI,QAAQ,OAAOD,OAAS,MAAM,IAAI,CAAC;GAC5C,IAAI,MAAM,iBAAiB,KAAA,GACzB,KAAK,IAAI,iBAAiB,OAAOA,OAAS,MAAM,YAAY,CAAC;GAC/D,KAAK,IAAI,gBAAgB,MAAM,WAAW;GAE1C,OAAO,OAAO,KAAK,IAAI;EACzB,GAAG,GAuD0C;EAAG,cArD3B,OAAO,WAAW,WAAW,OAA0B;GAC1E,OAAO;GACP,MAAM,QAAQ,OAAOC,cAAgB,cAAc,KAAK;GACxD,MAAM,OAAO,WAAW,KAAK;GAE7B,KAAK,IAAI,cAAc,eAAe;GACtC,KAAK,IAAI,iBAAiB,OAAOD,OAAS,MAAM,YAAY,CAAC;GAC7D,IAAI,MAAM,WAAW,KAAA,GAAW,KAAK,IAAI,SAAS,MAAM,OAAO,KAAK,GAAG,CAAC;GAExE,OAAO,OAAO,KAAK,IAAI;EACzB,GAAG,GA2CwD;EAAG,cAzCzC,OAAO,WAAW,WAAW,OAAkC;GAClF,OAAO;GACP,IAAI,YAAY,KAAA,GAAW,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,WAAW,CAAC;GACvF,MAAM,QAAQ,OAAOA,OAAS,OAAOF,OAAS,QAAQ,KAAK,CAAC;GAE5D,MAAMO,YAAU,kBAAkB,IAAI,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAC/D,kBAAkB,YAClB,kBAAkB,WAAW,QAAQ,WAAW,CAAC,CAAC,GAClD,kBAAkB,UAAU,iBAAiB,UAAU,OAAO,CAChE;GAEA,MAAM,WAAW,OAAOE,QAAkB,MAAMF,WAAS,OAAO;GAEhE,IAAI,SAAS,WAAW,KAAK,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;GAE9D,OAAO,OAAOL,QAAU,OAAOM,KAAe,QAAQ,EAAA,CAAG,IAAI;EAC/D,GAAG,GAyBsE;EAAG,QAvB7D,OAAO,WAAW,WAAW,OAAwB;GAClE,OAAO;GACP,IAAI,SAAS,wBAAwB,KAAA,GACnC,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,WAAW,CAAC;GAC9D,IAAI,oBAAoB,KAAA,KAAa,CAAC,gBAAgB,SAAS,yBAAyB,MAAM,GAC5F,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,iBAAiB,CAAC;GACpE,MAAM,QAAQ,OAAOL,cAAgB,YAAY,KAAK;GAEtD,MAAMI,YAAU,OAAO,cACrB,IAAI,IAAI,SAAS,mBAAmB,CAAC,CAAC,MACtC,QAAQ,UACR,0BACA,IAAI,gBAAgB;IAClB,OAAO,OAAOL,OAAS,MAAM,KAAK;IAClC,iBAAiB,MAAM;GACzB,CAAC,CACH;GAIA,KAAI,OAFoBO,QAAkB,MAAMF,WAAS,OAAO,EAAA,CAEnD,WAAW,KAAK,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;EAChE,GAAG,GAE8E;CAAE;AACrF,CAAC;AAED,MAAM,SAAS,OAAO,SAASjB,KAAO,KAAK,CAAC,CAAC,MAAM,OAAO,UAAU,yBAAyB,CAAC,GAAG,EAC/F,oBAAoB,KACtB,CAAC;AAED,MAAM,uBAAuB,OAAO,WAAW,WAC7C,gBAC+C;CAC/C,OAAO,eAAe,WAAW,SAC7B,EAAE,GAAG,eAAe,IACpB;EAAE,GAAG;EAAgB,QAAQ,SAAS,KAAK,OAAOY,OAAS,eAAe,MAAM,CAAC;CAAE;AACzF,CAAC"}

package/dist/Oidc.d.mts

@@ -1,13 +1,22 @@
 import { ConfigurationError, Rejected, Unavailable } from "./Errors.mjs";
 import { JsonObject, Metadata, RequestOptions } from "./OAuth.mjs";
-import { Crypto, DateTime, Effect, Redacted, Scope } from "effect";
+import { Crypto, DateTime, Effect, Redacted, Schema, Scope } from "effect";
 import { HttpClient } from "effect/http";
 import * as Jwks from "@yielded/jose/Jwks";
 import * as Jws from "@yielded/jose/Jws";
 //#region src/Oidc.d.ts
+export declare const IdTokenAlgorithm: Schema.Literals<readonly ["RS256", "PS256", "ES256", "EdDSA"]>;
+export type IdTokenAlgorithm = typeof IdTokenAlgorithm.Type;
+export declare const defaultIdTokenAlgorithms: readonly IdTokenAlgorithm[];
 export interface VerifierOptions extends RequestOptions {
   readonly metadata: Metadata;
   readonly clientId: string;
+  /** Algorithms this verifier will accept. Discovery must advertise at least one.
+   * Defaults to RS256, PS256, ES256 and EdDSA. */
+  readonly algorithms?: ReadonlyArray<IdTokenAlgorithm>;
+  /** Require advertised S256 PKCE. Defaults to true. Set false only for issuers
+   * that cannot complete authorization-code + PKCE. */
+  readonly pkceS256?: boolean;
 }
 export interface VerificationInput {
   readonly verificationStartedAt: DateTime.Utc;
@@ -48,10 +57,11 @@ export declare const discover: (input: string, inputOptions: RequestOptions) =>
   readonly revocation_endpoint_auth_methods_supported?: readonly string[];
   readonly authorization_response_iss_parameter_supported?: boolean;
 }, ConfigurationError | Unavailable, HttpClient.HttpClient>;
-/** RS256-only signed ID tokens. Verification and the bounded JWKS cache belong
- * to the caller's Scope. Owner closure cancels and joins active verification,
- * returning Unavailable; caller interruption joins its operation without closing
- * the verifier. No process cache or automatic exchange retry is created. */
+/** Signed ID tokens using advertised RS256, PS256, ES256 or EdDSA. Verification
+ * and the bounded JWKS cache belong to the caller's Scope. Owner closure cancels
+ * and joins active verification, returning Unavailable; caller interruption joins
+ * its operation without closing the verifier. No process cache or automatic
+ * exchange retry is created. */
 export declare const makeVerifier: (input: VerifierOptions) => Effect.Effect<Verifier, ConfigurationError | Unavailable, HttpClient.HttpClient | Scope.Scope>;
 //#endregion
 //# sourceMappingURL=Oidc.d.mts.map

package/dist/Oidc.mjs

@@ -9,10 +9,24 @@ import { HttpClient, HttpClientRequest } from "effect/http";
 import * as Jwks from "@yielded/jose/Jwks";
 import * as Jwt from "@yielded/jose/Jwt";
 //#region src/Oidc.ts
+const IdTokenAlgorithm = Schema.Literals([
+	"RS256",
+	"PS256",
+	"ES256",
+	"EdDSA"
+]);
+const defaultIdTokenAlgorithms = [
+	"RS256",
+	"PS256",
+	"ES256",
+	"EdDSA"
+];
 const Configuration = Schema.Struct({
 	metadata: Metadata,
 	clientId: text(1024),
-	...RequestOptions.fields
+	...RequestOptions.fields,
+	algorithms: Schema.optionalKey(Schema.Array(IdTokenAlgorithm).check(Schema.isMinLength(1), Schema.isMaxLength(4))),
+	pkceS256: Schema.optionalKey(Schema.Boolean)
 });
 const VerifyInput = Schema.Struct({
 	verificationStartedAt: Schema.DateTimeUtc,
@@ -35,9 +49,16 @@ const IdClaims = Schema.Struct({
 	nbf: Schema.optionalKey(NumericDate),
 	auth_time: Schema.optionalKey(NumericDate),
 	nonce: Schema.optionalKey(text(256)),
-	at_hash: Schema.optionalKey(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{22}$/u))),
-	c_hash: Schema.optionalKey(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{22}$/u)))
+	at_hash: Schema.optionalKey(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{22}(?:[A-Za-z0-9_-]{21})?$/u))),
+	c_hash: Schema.optionalKey(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{22}(?:[A-Za-z0-9_-]{21})?$/u)))
 });
+const tokenHash = (algorithm) => algorithm === "EdDSA" ? {
+	digest: "SHA-512",
+	octets: 32
+} : algorithm === "RS256" || algorithm === "PS256" || algorithm === "ES256" ? {
+	digest: "SHA-256",
+	octets: 16
+} : void 0;
 /** OIDC discovery uses the trusted issuer identifier, retaining its exact
 * spelling for claim comparison even if its network URL normalizes. */
 const discover = Effect.fnUntraced(function* (input, inputOptions) {
@@ -54,14 +75,16 @@ const discover = Effect.fnUntraced(function* (input, inputOptions) {
 	return freeze(metadata);
 });
 const claimFailure = () => Rejected.make({ reason: "claims" });
-/** RS256-only signed ID tokens. Verification and the bounded JWKS cache belong
-* to the caller's Scope. Owner closure cancels and joins active verification,
-* returning Unavailable; caller interruption joins its operation without closing
-* the verifier. No process cache or automatic exchange retry is created. */
+/** Signed ID tokens using advertised RS256, PS256, ES256 or EdDSA. Verification
+* and the bounded JWKS cache belong to the caller's Scope. Owner closure cancels
+* and joins active verification, returning Unavailable; caller interruption joins
+* its operation without closing the verifier. No process cache or automatic
+* exchange retry is created. */
 const makeVerifier = Effect.fnUntraced(function* (input) {
 	const options = yield* configuration(Configuration, input, "metadata");
 	const metadata = freeze(options.metadata);
-	if (metadata.jwks_uri === void 0 || !metadata.code_challenge_methods_supported?.includes("S256") || !metadata.response_types_supported?.includes("code") || !metadata.id_token_signing_alg_values_supported?.includes("RS256")) return yield* ConfigurationError.make({ reason: "metadata" });
+	const advertised = defaultIdTokenAlgorithms.filter((algorithm) => (options.algorithms ?? defaultIdTokenAlgorithms).includes(algorithm)).filter((algorithm) => metadata.id_token_signing_alg_values_supported?.includes(algorithm));
+	if (metadata.jwks_uri === void 0 || advertised.length === 0 || !metadata.response_types_supported?.includes("code") || (options.pkceS256 ?? true) && !metadata.code_challenge_methods_supported?.includes("S256")) return yield* ConfigurationError.make({ reason: "metadata" });
 	const http = yield* capture;
 	const context = yield* Layer.build(Jwks.layerRemote({
 		url: metadata.jwks_uri,
@@ -77,7 +100,7 @@ const makeVerifier = Effect.fnUntraced(function* (input) {
 		const accessToken = policy.accessToken === void 0 ? void 0 : yield* reveal(policy.accessToken);
 		const code = policy.code === void 0 ? void 0 : yield* reveal(policy.code);
 		const verified = yield* Jwt.verifyWithKeySet(JsonObject, token, {
-			algorithms: ["RS256"],
+			algorithms: advertised,
 			issuer: metadata.issuer,
 			audience: options.clientId,
 			requiredClaims: [
@@ -95,12 +118,14 @@ const makeVerifier = Effect.fnUntraced(function* (input) {
 		if (policy.previous === void 0) {
 			if (claims.nonce !== expectedNonce || policy.maxAgeSeconds !== void 0 && (claims.auth_time === void 0 || claims.auth_time + policy.maxAgeSeconds < Math.floor(now))) return yield* claimFailure();
 		} else if (claims.sub !== policy.previous.subject || claims.nonce !== void 0 && claims.nonce !== expectedNonce || claims.auth_time !== void 0 && claims.auth_time !== policy.previous.authTime) return yield* claimFailure();
+		const hashProfile = tokenHash(verified.protectedHeader.alg);
+		if (hashProfile === void 0) return yield* claimFailure();
 		for (const [hash, secret] of [[claims.at_hash, accessToken], [claims.c_hash, code]]) {
 			if (hash === void 0) continue;
 			if (secret === void 0) return yield* claimFailure();
-			const digest = yield* (yield* Crypto.Crypto).digest("SHA-256", new TextEncoder().encode(secret)).pipe(Effect.mapError(() => Unavailable.make({})));
-			if (digest.length !== 32) return yield* Unavailable.make({});
-			if (hash !== Base64Url.encode(digest.subarray(0, 16))) return yield* claimFailure();
+			const digest = yield* (yield* Crypto.Crypto).digest(hashProfile.digest, new TextEncoder().encode(secret)).pipe(Effect.mapError(() => Unavailable.make({})));
+			if (digest.length !== hashProfile.octets * 2) return yield* Unavailable.make({});
+			if (hash !== Base64Url.encode(digest.subarray(0, hashProfile.octets))) return yield* claimFailure();
 		}
 		const finished = (yield* Clock.currentTimeMillis) / 1e3;
 		if (claims.exp <= finished || policy.previous === void 0 && policy.maxAgeSeconds !== void 0 && claims.auth_time !== void 0 && claims.auth_time + policy.maxAgeSeconds < Math.floor(finished)) return yield* claimFailure();
@@ -115,6 +140,6 @@ const makeVerifier = Effect.fnUntraced(function* (input) {
 	}, use) };
 });
 //#endregion
-export { discover, makeVerifier };
+export { IdTokenAlgorithm, defaultIdTokenAlgorithms, discover, makeVerifier };
 
 //# sourceMappingURL=Oidc.mjs.map

package/dist/Oidc.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"Oidc.mjs","names":["V.text","V.secret","V.integer","V.NumericDate","V.configuration","V.Issuer","V.RequestOptions","Transport.capture","Transport.request","Transport.json","V.reveal","V.freeze","Ownership.make","V.decode"],"sources":["../src/Oidc.ts"],"sourcesContent":["import * as Jwks from \"@yielded/jose/Jwks\";\nimport type * as Jws from \"@yielded/jose/Jws\";\nimport * as Jwt from \"@yielded/jose/Jwt\";\nimport {\n  Clock,\n  Context,\n  Crypto,\n  DateTime,\n  Effect,\n  Layer,\n  Redacted,\n  Schema,\n  type Scope,\n} from \"effect\";\nimport { Base64Url } from \"effect/encoding\";\nimport { HttpClient, HttpClientRequest } from \"effect/http\";\n\nimport { ConfigurationError, Rejected, Unavailable } from \"./Errors\";\nimport * as Ownership from \"./internal/ownership\";\nimport * as Transport from \"./internal/transport\";\nimport * as V from \"./internal/validation\";\nimport { JsonObject, Metadata, type RequestOptions } from \"./OAuth\";\n\nexport interface VerifierOptions extends RequestOptions {\n  readonly metadata: Metadata;\n  readonly clientId: string;\n}\n\nexport interface VerificationInput {\n  readonly verificationStartedAt: DateTime.Utc;\n  readonly nonce: Redacted.Redacted<string>;\n  readonly maxAgeSeconds?: number;\n  readonly accessToken?: Redacted.Redacted<string>;\n  readonly code?: Redacted.Redacted<string>;\n  /** Refresh continuation: same subject, optional nonce must match, auth_time cannot change. */\n  readonly previous?: { readonly subject: string; readonly authTime?: number };\n}\n\nexport interface Verified {\n  readonly claims: Redacted.Redacted<JsonObject>;\n  readonly subject: string;\n  readonly authTime?: number;\n  readonly upstreamAuthenticatedAt?: DateTime.Utc;\n}\n\ntype VerificationRequirements =\n  | Exclude<Effect.Services<ReturnType<typeof Jws.verifyWithKeySet>>, Jwks.Jwks>\n  | Crypto.Crypto;\n\nexport interface Verifier {\n  readonly verify: (\n    token: Redacted.Redacted<string>,\n    input: VerificationInput,\n  ) => Effect.Effect<Verified, Rejected | Unavailable, VerificationRequirements>;\n}\n\nconst Configuration = Schema.Struct({\n  metadata: Metadata,\n  clientId: V.text(1024),\n  ...V.RequestOptions.fields,\n});\n\nconst VerifyInput = Schema.Struct({\n  verificationStartedAt: Schema.DateTimeUtc,\n  nonce: V.secret(256),\n  maxAgeSeconds: Schema.optional(V.integer(0, 86400)),\n  accessToken: Schema.optional(V.secret(16384)),\n  code: Schema.optional(V.secret(16384)),\n  previous: Schema.optional(\n    Schema.Struct({ subject: V.text(1024), authTime: Schema.optional(V.NumericDate) }),\n  ),\n});\n\nconst IdClaims = Schema.Struct({\n  iss: V.text(2048),\n  sub: V.text(1024),\n  aud: Schema.Union([\n    V.text(1024),\n    Schema.Array(V.text(1024)).check(Schema.isMinLength(1), Schema.isMaxLength(1)),\n  ]),\n  azp: Schema.optionalKey(V.text(1024)),\n  exp: V.NumericDate,\n  iat: V.NumericDate,\n  nbf: Schema.optionalKey(V.NumericDate),\n  auth_time: Schema.optionalKey(V.NumericDate),\n  nonce: Schema.optionalKey(V.text(256)),\n  // The RS256 half digest is 128 bits (22 base64url characters).\n  at_hash: Schema.optionalKey(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{22}$/u))),\n  c_hash: Schema.optionalKey(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{22}$/u))),\n});\n\n/** OIDC discovery uses the trusted issuer identifier, retaining its exact\n * spelling for claim comparison even if its network URL normalizes. */\nexport const discover = Effect.fnUntraced(function* (\n  input: string,\n  inputOptions: RequestOptions,\n): Effect.fn.Return<Metadata, ConfigurationError | Unavailable, HttpClient.HttpClient> {\n  const issuer = yield* V.configuration(V.Issuer, input, \"issuer\");\n\n  const options = yield* V.configuration(V.RequestOptions, inputOptions);\n\n  const url = new URL(issuer);\n\n  url.pathname = `${url.pathname.replace(/\\/$/u, \"\")}/.well-known/openid-configuration`;\n  const http = yield* Transport.capture;\n\n  const response = yield* Transport.request(\n    http,\n    HttpClientRequest.get(url.href).pipe(HttpClientRequest.acceptJson),\n    options,\n  );\n\n  if (response.status !== 200) return yield* Unavailable.make({});\n  const document = yield* Transport.json(response);\n  const metadata = yield* V.configuration(Metadata, yield* V.reveal(document.body), \"metadata\");\n\n  if (metadata.issuer !== issuer) return yield* ConfigurationError.make({ reason: \"issuer\" });\n\n  return V.freeze(metadata);\n});\n\nconst claimFailure = () => Rejected.make({ reason: \"claims\" });\n\n/** RS256-only signed ID tokens. Verification and the bounded JWKS cache belong\n * to the caller's Scope. Owner closure cancels and joins active verification,\n * returning Unavailable; caller interruption joins its operation without closing\n * the verifier. No process cache or automatic exchange retry is created. */\nexport const makeVerifier = Effect.fnUntraced(function* (\n  input: VerifierOptions,\n): Effect.fn.Return<\n  Verifier,\n  ConfigurationError | Unavailable,\n  HttpClient.HttpClient | Scope.Scope\n> {\n  const options = yield* V.configuration(Configuration, input, \"metadata\");\n\n  const metadata = V.freeze(options.metadata);\n\n  if (\n    metadata.jwks_uri === undefined ||\n    !metadata.code_challenge_methods_supported?.includes(\"S256\") ||\n    !metadata.response_types_supported?.includes(\"code\") ||\n    !metadata.id_token_signing_alg_values_supported?.includes(\"RS256\")\n  )\n    return yield* ConfigurationError.make({ reason: \"metadata\" });\n  const http = yield* Transport.capture;\n\n  const context = yield* Layer.build(\n    Jwks.layerRemote({\n      url: metadata.jwks_uri,\n      timeoutMs: options.timeoutMs,\n      maxResponseBytes: options.maxResponseBytes,\n    }).pipe(Layer.provide(Layer.succeed(HttpClient.HttpClient, http))),\n  ).pipe(Effect.mapError(() => Unavailable.make({})));\n\n  const keys = Context.get(context, Jwks.Jwks);\n  const { use } = yield* Ownership.make;\n\n  const verify = Effect.fnUntraced(function* (\n    token: Redacted.Redacted<string>,\n    input: VerificationInput,\n  ): Effect.fn.Return<Verified, Rejected | Unavailable, VerificationRequirements> {\n    // Capture caller policy and secret values before key lookup or cryptography.\n    const policy = yield* V.decode(VerifyInput, input);\n    const start = DateTime.toEpochMillis(policy.verificationStartedAt);\n    const expectedNonce = yield* V.reveal(policy.nonce);\n\n    const accessToken =\n      policy.accessToken === undefined ? undefined : yield* V.reveal(policy.accessToken);\n\n    const code = policy.code === undefined ? undefined : yield* V.reveal(policy.code);\n\n    // Jwt verifies the signature before any registered/application claim checks.\n    // Unauthenticated malformed/key/signature failures must never burn a receipt.\n    const verified = yield* Jwt.verifyWithKeySet(JsonObject, token, {\n      algorithms: [\"RS256\"],\n      issuer: metadata.issuer,\n      audience: options.clientId,\n      requiredClaims: [\"iss\", \"sub\", \"aud\", \"exp\", \"iat\"],\n      clockTolerance: 0,\n    }).pipe(\n      Effect.provideService(Jwks.Jwks, keys),\n      Effect.mapError((error) =>\n        error._tag === \"JoseClaimValidationFailed\" ? claimFailure() : Unavailable.make({}),\n      ),\n    );\n\n    const claims = yield* V.decode(IdClaims, verified.claims).pipe(Effect.mapError(claimFailure));\n\n    const now = (yield* Clock.currentTimeMillis) / 1000;\n\n    if (\n      start < 0 ||\n      start > now * 1000 ||\n      (claims.azp !== undefined && claims.azp !== options.clientId) ||\n      claims.exp <= now ||\n      claims.iat > now ||\n      (claims.nbf !== undefined && claims.nbf > now) ||\n      (claims.auth_time !== undefined && claims.auth_time > now)\n    )\n      return yield* claimFailure();\n    if (policy.previous === undefined) {\n      if (\n        claims.nonce !== expectedNonce ||\n        (policy.maxAgeSeconds !== undefined &&\n          (claims.auth_time === undefined ||\n            claims.auth_time + policy.maxAgeSeconds < Math.floor(now)))\n      )\n        return yield* claimFailure();\n    } else if (\n      claims.sub !== policy.previous.subject ||\n      (claims.nonce !== undefined && claims.nonce !== expectedNonce) ||\n      (claims.auth_time !== undefined && claims.auth_time !== policy.previous.authTime)\n    )\n      return yield* claimFailure();\n    for (const [hash, secret] of [\n      [claims.at_hash, accessToken],\n      [claims.c_hash, code],\n    ] as const) {\n      if (hash === undefined) continue;\n      if (secret === undefined) return yield* claimFailure();\n      const crypto = yield* Crypto.Crypto;\n\n      const digest = yield* crypto\n        .digest(\"SHA-256\", new TextEncoder().encode(secret))\n        .pipe(Effect.mapError(() => Unavailable.make({})));\n\n      if (digest.length !== 32) return yield* Unavailable.make({});\n      if (hash !== Base64Url.encode(digest.subarray(0, 16))) return yield* claimFailure();\n    }\n    // Re-read time after optional digest I/O so expired tokens cannot escape.\n    const finished = (yield* Clock.currentTimeMillis) / 1000;\n\n    if (\n      claims.exp <= finished ||\n      (policy.previous === undefined &&\n        policy.maxAgeSeconds !== undefined &&\n        claims.auth_time !== undefined &&\n        claims.auth_time + policy.maxAgeSeconds < Math.floor(finished))\n    )\n      return yield* claimFailure();\n\n    return {\n      claims: Redacted.make(V.freeze(verified.claims)),\n      subject: claims.sub,\n      ...(claims.auth_time === undefined\n        ? {}\n        : {\n            authTime: claims.auth_time,\n            upstreamAuthenticatedAt: DateTime.makeUnsafe(Math.min(start, claims.auth_time * 1000)),\n          }),\n    };\n  }, use);\n\n  return { verify };\n});\n"],"mappings":";;;;;;;;;;;AAwDA,MAAM,gBAAgB,OAAO,OAAO;CAClC,UAAU;CACV,UAAUA,KAAO,IAAI;CACrB,GAAA,eAAoB;AACtB,CAAC;AAED,MAAM,cAAc,OAAO,OAAO;CAChC,uBAAuB,OAAO;CAC9B,OAAOC,OAAS,GAAG;CACnB,eAAe,OAAO,SAASC,QAAU,GAAG,KAAK,CAAC;CAClD,aAAa,OAAO,SAASD,OAAS,KAAK,CAAC;CAC5C,MAAM,OAAO,SAASA,OAAS,KAAK,CAAC;CACrC,UAAU,OAAO,SACf,OAAO,OAAO;EAAE,SAASD,KAAO,IAAI;EAAG,UAAU,OAAO,SAASG,WAAa;CAAE,CAAC,CACnF;AACF,CAAC;AAED,MAAM,WAAW,OAAO,OAAO;CAC7B,KAAKH,KAAO,IAAI;CAChB,KAAKA,KAAO,IAAI;CAChB,KAAK,OAAO,MAAM,CAChBA,KAAO,IAAI,GACX,OAAO,MAAMA,KAAO,IAAI,CAAC,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,CAAC,CAAC,CAC/E,CAAC;CACD,KAAK,OAAO,YAAYA,KAAO,IAAI,CAAC;CACpC,KAAKG;CACL,KAAKA;CACL,KAAK,OAAO,YAAYA,WAAa;CACrC,WAAW,OAAO,YAAYA,WAAa;CAC3C,OAAO,OAAO,YAAYH,KAAO,GAAG,CAAC;CAErC,SAAS,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,UAAU,sBAAsB,CAAC,CAAC;CACzF,QAAQ,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,UAAU,sBAAsB,CAAC,CAAC;AAC1F,CAAC;;;AAID,MAAa,WAAW,OAAO,WAAW,WACxC,OACA,cACqF;CACrF,MAAM,SAAS,OAAOI,cAAgBC,QAAU,OAAO,QAAQ;CAE/D,MAAM,UAAU,OAAOD,cAAgBE,gBAAkB,YAAY;CAErE,MAAM,MAAM,IAAI,IAAI,MAAM;CAE1B,IAAI,WAAW,GAAG,IAAI,SAAS,QAAQ,QAAQ,EAAE,EAAE;CACnD,MAAM,OAAO,OAAOC;CAEpB,MAAM,WAAW,OAAOC,QACtB,MACA,kBAAkB,IAAI,IAAI,IAAI,CAAC,CAAC,KAAK,kBAAkB,UAAU,GACjE,OACF;CAEA,IAAI,SAAS,WAAW,KAAK,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;CAC9D,MAAM,WAAW,OAAOC,KAAe,QAAQ;CAC/C,MAAM,WAAW,OAAOL,cAAgB,UAAU,OAAOM,OAAS,SAAS,IAAI,GAAG,UAAU;CAE5F,IAAI,SAAS,WAAW,QAAQ,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,SAAS,CAAC;CAE1F,OAAOC,OAAS,QAAQ;AAC1B,CAAC;AAED,MAAM,qBAAqB,SAAS,KAAK,EAAE,QAAQ,SAAS,CAAC;;;;;AAM7D,MAAa,eAAe,OAAO,WAAW,WAC5C,OAKA;CACA,MAAM,UAAU,OAAOP,cAAgB,eAAe,OAAO,UAAU;CAEvE,MAAM,WAAWO,OAAS,QAAQ,QAAQ;CAE1C,IACE,SAAS,aAAa,KAAA,KACtB,CAAC,SAAS,kCAAkC,SAAS,MAAM,KAC3D,CAAC,SAAS,0BAA0B,SAAS,MAAM,KACnD,CAAC,SAAS,uCAAuC,SAAS,OAAO,GAEjE,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,WAAW,CAAC;CAC9D,MAAM,OAAO,OAAOJ;CAEpB,MAAM,UAAU,OAAO,MAAM,MAC3B,KAAK,YAAY;EACf,KAAK,SAAS;EACd,WAAW,QAAQ;EACnB,kBAAkB,QAAQ;CAC5B,CAAC,CAAC,CAAC,KAAK,MAAM,QAAQ,MAAM,QAAQ,WAAW,YAAY,IAAI,CAAC,CAAC,CACnE,CAAC,CAAC,KAAK,OAAO,eAAe,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC;CAElD,MAAM,OAAO,QAAQ,IAAI,SAAS,KAAK,IAAI;CAC3C,MAAM,EAAE,QAAQ,OAAOK;CAkGvB,OAAO,EAAE,QAhGM,OAAO,WAAW,WAC/B,OACA,OAC8E;EAE9E,MAAM,SAAS,OAAOC,OAAS,aAAa,KAAK;EACjD,MAAM,QAAQ,SAAS,cAAc,OAAO,qBAAqB;EACjE,MAAM,gBAAgB,OAAOH,OAAS,OAAO,KAAK;EAElD,MAAM,cACJ,OAAO,gBAAgB,KAAA,IAAY,KAAA,IAAY,OAAOA,OAAS,OAAO,WAAW;EAEnF,MAAM,OAAO,OAAO,SAAS,KAAA,IAAY,KAAA,IAAY,OAAOA,OAAS,OAAO,IAAI;EAIhF,MAAM,WAAW,OAAO,IAAI,iBAAiB,YAAY,OAAO;GAC9D,YAAY,CAAC,OAAO;GACpB,QAAQ,SAAS;GACjB,UAAU,QAAQ;GAClB,gBAAgB;IAAC;IAAO;IAAO;IAAO;IAAO;GAAK;GAClD,gBAAgB;EAClB,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,KAAK,MAAM,IAAI,GACrC,OAAO,UAAU,UACf,MAAM,SAAS,8BAA8B,aAAa,IAAI,YAAY,KAAK,CAAC,CAAC,CACnF,CACF;EAEA,MAAM,SAAS,OAAOG,OAAS,UAAU,SAAS,MAAM,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,CAAC;EAE5F,MAAM,OAAO,OAAO,MAAM,qBAAqB;EAE/C,IACE,QAAQ,KACR,QAAQ,MAAM,OACb,OAAO,QAAQ,KAAA,KAAa,OAAO,QAAQ,QAAQ,YACpD,OAAO,OAAO,OACd,OAAO,MAAM,OACZ,OAAO,QAAQ,KAAA,KAAa,OAAO,MAAM,OACzC,OAAO,cAAc,KAAA,KAAa,OAAO,YAAY,KAEtD,OAAO,OAAO,aAAa;EAC7B,IAAI,OAAO,aAAa,KAAA,GAEpB;OAAA,OAAO,UAAU,iBAChB,OAAO,kBAAkB,KAAA,MACvB,OAAO,cAAc,KAAA,KACpB,OAAO,YAAY,OAAO,gBAAgB,KAAK,MAAM,GAAG,IAE5D,OAAO,OAAO,aAAa;EAAA,OACxB,IACL,OAAO,QAAQ,OAAO,SAAS,WAC9B,OAAO,UAAU,KAAA,KAAa,OAAO,UAAU,iBAC/C,OAAO,cAAc,KAAA,KAAa,OAAO,cAAc,OAAO,SAAS,UAExE,OAAO,OAAO,aAAa;EAC7B,KAAK,MAAM,CAAC,MAAM,WAAW,CAC3B,CAAC,OAAO,SAAS,WAAW,GAC5B,CAAC,OAAO,QAAQ,IAAI,CACtB,GAAY;GACV,IAAI,SAAS,KAAA,GAAW;GACxB,IAAI,WAAW,KAAA,GAAW,OAAO,OAAO,aAAa;GAGrD,MAAM,SAAS,QAAO,OAFA,OAAO,OAAA,CAG1B,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,CACnD,KAAK,OAAO,eAAe,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC;GAEnD,IAAI,OAAO,WAAW,IAAI,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;GAC3D,IAAI,SAAS,UAAU,OAAO,OAAO,SAAS,GAAG,EAAE,CAAC,GAAG,OAAO,OAAO,aAAa;EACpF;EAEA,MAAM,YAAY,OAAO,MAAM,qBAAqB;EAEpD,IACE,OAAO,OAAO,YACb,OAAO,aAAa,KAAA,KACnB,OAAO,kBAAkB,KAAA,KACzB,OAAO,cAAc,KAAA,KACrB,OAAO,YAAY,OAAO,gBAAgB,KAAK,MAAM,QAAQ,GAE/D,OAAO,OAAO,aAAa;EAE7B,OAAO;GACL,QAAQ,SAAS,KAAKF,OAAS,SAAS,MAAM,CAAC;GAC/C,SAAS,OAAO;GAChB,GAAI,OAAO,cAAc,KAAA,IACrB,CAAC,IACD;IACE,UAAU,OAAO;IACjB,yBAAyB,SAAS,WAAW,KAAK,IAAI,OAAO,OAAO,YAAY,GAAI,CAAC;GACvF;EACN;CACF,GAAG,GAEW,EAAE;AAClB,CAAC"}
+{"version":3,"file":"Oidc.mjs","names":["V.text","V.secret","V.integer","V.NumericDate","V.configuration","V.Issuer","V.RequestOptions","Transport.capture","Transport.request","Transport.json","V.reveal","V.freeze","Ownership.make","V.decode"],"sources":["../src/Oidc.ts"],"sourcesContent":["import * as Jwks from \"@yielded/jose/Jwks\";\nimport type * as Jws from \"@yielded/jose/Jws\";\nimport * as Jwt from \"@yielded/jose/Jwt\";\nimport {\n  Clock,\n  Context,\n  Crypto,\n  DateTime,\n  Effect,\n  Layer,\n  Redacted,\n  Schema,\n  type Scope,\n} from \"effect\";\nimport { Base64Url } from \"effect/encoding\";\nimport { HttpClient, HttpClientRequest } from \"effect/http\";\n\nimport { ConfigurationError, Rejected, Unavailable } from \"./Errors\";\nimport * as Ownership from \"./internal/ownership\";\nimport * as Transport from \"./internal/transport\";\nimport * as V from \"./internal/validation\";\nimport { JsonObject, Metadata, type RequestOptions } from \"./OAuth\";\n\nexport const IdTokenAlgorithm = Schema.Literals([\"RS256\", \"PS256\", \"ES256\", \"EdDSA\"]);\nexport type IdTokenAlgorithm = typeof IdTokenAlgorithm.Type;\n\nexport const defaultIdTokenAlgorithms: readonly IdTokenAlgorithm[] = [\n  \"RS256\",\n  \"PS256\",\n  \"ES256\",\n  \"EdDSA\",\n];\n\nexport interface VerifierOptions extends RequestOptions {\n  readonly metadata: Metadata;\n  readonly clientId: string;\n  /** Algorithms this verifier will accept. Discovery must advertise at least one.\n   * Defaults to RS256, PS256, ES256 and EdDSA. */\n  readonly algorithms?: ReadonlyArray<IdTokenAlgorithm>;\n  /** Require advertised S256 PKCE. Defaults to true. Set false only for issuers\n   * that cannot complete authorization-code + PKCE. */\n  readonly pkceS256?: boolean;\n}\n\nexport interface VerificationInput {\n  readonly verificationStartedAt: DateTime.Utc;\n  readonly nonce: Redacted.Redacted<string>;\n  readonly maxAgeSeconds?: number;\n  readonly accessToken?: Redacted.Redacted<string>;\n  readonly code?: Redacted.Redacted<string>;\n  /** Refresh continuation: same subject, optional nonce must match, auth_time cannot change. */\n  readonly previous?: { readonly subject: string; readonly authTime?: number };\n}\n\nexport interface Verified {\n  readonly claims: Redacted.Redacted<JsonObject>;\n  readonly subject: string;\n  readonly authTime?: number;\n  readonly upstreamAuthenticatedAt?: DateTime.Utc;\n}\n\ntype VerificationRequirements =\n  | Exclude<Effect.Services<ReturnType<typeof Jws.verifyWithKeySet>>, Jwks.Jwks>\n  | Crypto.Crypto;\n\nexport interface Verifier {\n  readonly verify: (\n    token: Redacted.Redacted<string>,\n    input: VerificationInput,\n  ) => Effect.Effect<Verified, Rejected | Unavailable, VerificationRequirements>;\n}\n\nconst Configuration = Schema.Struct({\n  metadata: Metadata,\n  clientId: V.text(1024),\n  ...V.RequestOptions.fields,\n  algorithms: Schema.optionalKey(\n    Schema.Array(IdTokenAlgorithm).check(Schema.isMinLength(1), Schema.isMaxLength(4)),\n  ),\n  pkceS256: Schema.optionalKey(Schema.Boolean),\n});\n\nconst VerifyInput = Schema.Struct({\n  verificationStartedAt: Schema.DateTimeUtc,\n  nonce: V.secret(256),\n  maxAgeSeconds: Schema.optional(V.integer(0, 86400)),\n  accessToken: Schema.optional(V.secret(16384)),\n  code: Schema.optional(V.secret(16384)),\n  previous: Schema.optional(\n    Schema.Struct({ subject: V.text(1024), authTime: Schema.optional(V.NumericDate) }),\n  ),\n});\n\nconst IdClaims = Schema.Struct({\n  iss: V.text(2048),\n  sub: V.text(1024),\n  aud: Schema.Union([\n    V.text(1024),\n    Schema.Array(V.text(1024)).check(Schema.isMinLength(1), Schema.isMaxLength(1)),\n  ]),\n  azp: Schema.optionalKey(V.text(1024)),\n  exp: V.NumericDate,\n  iat: V.NumericDate,\n  nbf: Schema.optionalKey(V.NumericDate),\n  auth_time: Schema.optionalKey(V.NumericDate),\n  nonce: Schema.optionalKey(V.text(256)),\n  // Leftmost half of the signing-algorithm hash, unpadded base64url: 22\n  // characters for SHA-256 (RS256, PS256, ES256) and 43 for SHA-512 (Ed25519).\n  at_hash: Schema.optionalKey(\n    Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{22}(?:[A-Za-z0-9_-]{21})?$/u)),\n  ),\n  c_hash: Schema.optionalKey(\n    Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{22}(?:[A-Za-z0-9_-]{21})?$/u)),\n  ),\n});\n\nconst tokenHash = (algorithm: string) =>\n  algorithm === \"EdDSA\"\n    ? { digest: \"SHA-512\" as const, octets: 32 }\n    : algorithm === \"RS256\" || algorithm === \"PS256\" || algorithm === \"ES256\"\n      ? { digest: \"SHA-256\" as const, octets: 16 }\n      : undefined;\n\n/** OIDC discovery uses the trusted issuer identifier, retaining its exact\n * spelling for claim comparison even if its network URL normalizes. */\nexport const discover = Effect.fnUntraced(function* (\n  input: string,\n  inputOptions: RequestOptions,\n): Effect.fn.Return<Metadata, ConfigurationError | Unavailable, HttpClient.HttpClient> {\n  const issuer = yield* V.configuration(V.Issuer, input, \"issuer\");\n\n  const options = yield* V.configuration(V.RequestOptions, inputOptions);\n\n  const url = new URL(issuer);\n\n  url.pathname = `${url.pathname.replace(/\\/$/u, \"\")}/.well-known/openid-configuration`;\n  const http = yield* Transport.capture;\n\n  const response = yield* Transport.request(\n    http,\n    HttpClientRequest.get(url.href).pipe(HttpClientRequest.acceptJson),\n    options,\n  );\n\n  if (response.status !== 200) return yield* Unavailable.make({});\n  const document = yield* Transport.json(response);\n  const metadata = yield* V.configuration(Metadata, yield* V.reveal(document.body), \"metadata\");\n\n  if (metadata.issuer !== issuer) return yield* ConfigurationError.make({ reason: \"issuer\" });\n\n  return V.freeze(metadata);\n});\n\nconst claimFailure = () => Rejected.make({ reason: \"claims\" });\n\n/** Signed ID tokens using advertised RS256, PS256, ES256 or EdDSA. Verification\n * and the bounded JWKS cache belong to the caller's Scope. Owner closure cancels\n * and joins active verification, returning Unavailable; caller interruption joins\n * its operation without closing the verifier. No process cache or automatic\n * exchange retry is created. */\nexport const makeVerifier = Effect.fnUntraced(function* (\n  input: VerifierOptions,\n): Effect.fn.Return<\n  Verifier,\n  ConfigurationError | Unavailable,\n  HttpClient.HttpClient | Scope.Scope\n> {\n  const options = yield* V.configuration(Configuration, input, \"metadata\");\n\n  const metadata = V.freeze(options.metadata);\n\n  const algorithms = defaultIdTokenAlgorithms.filter((algorithm) =>\n    (options.algorithms ?? defaultIdTokenAlgorithms).includes(algorithm),\n  );\n\n  const advertised = algorithms.filter((algorithm) =>\n    metadata.id_token_signing_alg_values_supported?.includes(algorithm),\n  );\n\n  if (\n    metadata.jwks_uri === undefined ||\n    advertised.length === 0 ||\n    !metadata.response_types_supported?.includes(\"code\") ||\n    ((options.pkceS256 ?? true) && !metadata.code_challenge_methods_supported?.includes(\"S256\"))\n  )\n    return yield* ConfigurationError.make({ reason: \"metadata\" });\n  const http = yield* Transport.capture;\n\n  const context = yield* Layer.build(\n    Jwks.layerRemote({\n      url: metadata.jwks_uri,\n      timeoutMs: options.timeoutMs,\n      maxResponseBytes: options.maxResponseBytes,\n    }).pipe(Layer.provide(Layer.succeed(HttpClient.HttpClient, http))),\n  ).pipe(Effect.mapError(() => Unavailable.make({})));\n\n  const keys = Context.get(context, Jwks.Jwks);\n  const { use } = yield* Ownership.make;\n\n  const verify = Effect.fnUntraced(function* (\n    token: Redacted.Redacted<string>,\n    input: VerificationInput,\n  ): Effect.fn.Return<Verified, Rejected | Unavailable, VerificationRequirements> {\n    // Capture caller policy and secret values before key lookup or cryptography.\n    const policy = yield* V.decode(VerifyInput, input);\n    const start = DateTime.toEpochMillis(policy.verificationStartedAt);\n    const expectedNonce = yield* V.reveal(policy.nonce);\n\n    const accessToken =\n      policy.accessToken === undefined ? undefined : yield* V.reveal(policy.accessToken);\n\n    const code = policy.code === undefined ? undefined : yield* V.reveal(policy.code);\n\n    // Jwt verifies the signature before any registered/application claim checks.\n    // Unauthenticated malformed/key/signature failures must never burn a receipt.\n    const verified = yield* Jwt.verifyWithKeySet(JsonObject, token, {\n      algorithms: advertised,\n      issuer: metadata.issuer,\n      audience: options.clientId,\n      requiredClaims: [\"iss\", \"sub\", \"aud\", \"exp\", \"iat\"],\n      clockTolerance: 0,\n    }).pipe(\n      Effect.provideService(Jwks.Jwks, keys),\n      Effect.mapError((error) =>\n        error._tag === \"JoseClaimValidationFailed\" ? claimFailure() : Unavailable.make({}),\n      ),\n    );\n\n    const claims = yield* V.decode(IdClaims, verified.claims).pipe(Effect.mapError(claimFailure));\n\n    const now = (yield* Clock.currentTimeMillis) / 1000;\n\n    if (\n      start < 0 ||\n      start > now * 1000 ||\n      (claims.azp !== undefined && claims.azp !== options.clientId) ||\n      claims.exp <= now ||\n      claims.iat > now ||\n      (claims.nbf !== undefined && claims.nbf > now) ||\n      (claims.auth_time !== undefined && claims.auth_time > now)\n    )\n      return yield* claimFailure();\n    if (policy.previous === undefined) {\n      if (\n        claims.nonce !== expectedNonce ||\n        (policy.maxAgeSeconds !== undefined &&\n          (claims.auth_time === undefined ||\n            claims.auth_time + policy.maxAgeSeconds < Math.floor(now)))\n      )\n        return yield* claimFailure();\n    } else if (\n      claims.sub !== policy.previous.subject ||\n      (claims.nonce !== undefined && claims.nonce !== expectedNonce) ||\n      (claims.auth_time !== undefined && claims.auth_time !== policy.previous.authTime)\n    )\n      return yield* claimFailure();\n    const hashProfile = tokenHash(verified.protectedHeader.alg);\n\n    if (hashProfile === undefined) return yield* claimFailure();\n\n    for (const [hash, secret] of [\n      [claims.at_hash, accessToken],\n      [claims.c_hash, code],\n    ] as const) {\n      if (hash === undefined) continue;\n      if (secret === undefined) return yield* claimFailure();\n      const crypto = yield* Crypto.Crypto;\n\n      const digest = yield* crypto\n        .digest(hashProfile.digest, new TextEncoder().encode(secret))\n        .pipe(Effect.mapError(() => Unavailable.make({})));\n\n      if (digest.length !== hashProfile.octets * 2) return yield* Unavailable.make({});\n      if (hash !== Base64Url.encode(digest.subarray(0, hashProfile.octets)))\n        return yield* claimFailure();\n    }\n    // Re-read time after optional digest I/O so expired tokens cannot escape.\n    const finished = (yield* Clock.currentTimeMillis) / 1000;\n\n    if (\n      claims.exp <= finished ||\n      (policy.previous === undefined &&\n        policy.maxAgeSeconds !== undefined &&\n        claims.auth_time !== undefined &&\n        claims.auth_time + policy.maxAgeSeconds < Math.floor(finished))\n    )\n      return yield* claimFailure();\n\n    return {\n      claims: Redacted.make(V.freeze(verified.claims)),\n      subject: claims.sub,\n      ...(claims.auth_time === undefined\n        ? {}\n        : {\n            authTime: claims.auth_time,\n            upstreamAuthenticatedAt: DateTime.makeUnsafe(Math.min(start, claims.auth_time * 1000)),\n          }),\n    };\n  }, use);\n\n  return { verify };\n});\n"],"mappings":";;;;;;;;;;;AAuBA,MAAa,mBAAmB,OAAO,SAAS;CAAC;CAAS;CAAS;CAAS;AAAO,CAAC;AAGpF,MAAa,2BAAwD;CACnE;CACA;CACA;CACA;AACF;AAyCA,MAAM,gBAAgB,OAAO,OAAO;CAClC,UAAU;CACV,UAAUA,KAAO,IAAI;CACrB,GAAA,eAAoB;CACpB,YAAY,OAAO,YACjB,OAAO,MAAM,gBAAgB,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,CAAC,CAAC,CACnF;CACA,UAAU,OAAO,YAAY,OAAO,OAAO;AAC7C,CAAC;AAED,MAAM,cAAc,OAAO,OAAO;CAChC,uBAAuB,OAAO;CAC9B,OAAOC,OAAS,GAAG;CACnB,eAAe,OAAO,SAASC,QAAU,GAAG,KAAK,CAAC;CAClD,aAAa,OAAO,SAASD,OAAS,KAAK,CAAC;CAC5C,MAAM,OAAO,SAASA,OAAS,KAAK,CAAC;CACrC,UAAU,OAAO,SACf,OAAO,OAAO;EAAE,SAASD,KAAO,IAAI;EAAG,UAAU,OAAO,SAASG,WAAa;CAAE,CAAC,CACnF;AACF,CAAC;AAED,MAAM,WAAW,OAAO,OAAO;CAC7B,KAAKH,KAAO,IAAI;CAChB,KAAKA,KAAO,IAAI;CAChB,KAAK,OAAO,MAAM,CAChBA,KAAO,IAAI,GACX,OAAO,MAAMA,KAAO,IAAI,CAAC,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,CAAC,CAAC,CAC/E,CAAC;CACD,KAAK,OAAO,YAAYA,KAAO,IAAI,CAAC;CACpC,KAAKG;CACL,KAAKA;CACL,KAAK,OAAO,YAAYA,WAAa;CACrC,WAAW,OAAO,YAAYA,WAAa;CAC3C,OAAO,OAAO,YAAYH,KAAO,GAAG,CAAC;CAGrC,SAAS,OAAO,YACd,OAAO,OAAO,MAAM,OAAO,UAAU,4CAA4C,CAAC,CACpF;CACA,QAAQ,OAAO,YACb,OAAO,OAAO,MAAM,OAAO,UAAU,4CAA4C,CAAC,CACpF;AACF,CAAC;AAED,MAAM,aAAa,cACjB,cAAc,UACV;CAAE,QAAQ;CAAoB,QAAQ;AAAG,IACzC,cAAc,WAAW,cAAc,WAAW,cAAc,UAC9D;CAAE,QAAQ;CAAoB,QAAQ;AAAG,IACzC,KAAA;;;AAIR,MAAa,WAAW,OAAO,WAAW,WACxC,OACA,cACqF;CACrF,MAAM,SAAS,OAAOI,cAAgBC,QAAU,OAAO,QAAQ;CAE/D,MAAM,UAAU,OAAOD,cAAgBE,gBAAkB,YAAY;CAErE,MAAM,MAAM,IAAI,IAAI,MAAM;CAE1B,IAAI,WAAW,GAAG,IAAI,SAAS,QAAQ,QAAQ,EAAE,EAAE;CACnD,MAAM,OAAO,OAAOC;CAEpB,MAAM,WAAW,OAAOC,QACtB,MACA,kBAAkB,IAAI,IAAI,IAAI,CAAC,CAAC,KAAK,kBAAkB,UAAU,GACjE,OACF;CAEA,IAAI,SAAS,WAAW,KAAK,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;CAC9D,MAAM,WAAW,OAAOC,KAAe,QAAQ;CAC/C,MAAM,WAAW,OAAOL,cAAgB,UAAU,OAAOM,OAAS,SAAS,IAAI,GAAG,UAAU;CAE5F,IAAI,SAAS,WAAW,QAAQ,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,SAAS,CAAC;CAE1F,OAAOC,OAAS,QAAQ;AAC1B,CAAC;AAED,MAAM,qBAAqB,SAAS,KAAK,EAAE,QAAQ,SAAS,CAAC;;;;;;AAO7D,MAAa,eAAe,OAAO,WAAW,WAC5C,OAKA;CACA,MAAM,UAAU,OAAOP,cAAgB,eAAe,OAAO,UAAU;CAEvE,MAAM,WAAWO,OAAS,QAAQ,QAAQ;CAM1C,MAAM,aAJa,yBAAyB,QAAQ,eACjD,QAAQ,cAAc,yBAAA,CAA0B,SAAS,SAAS,CAGzC,CAAC,CAAC,QAAQ,cACpC,SAAS,uCAAuC,SAAS,SAAS,CACpE;CAEA,IACE,SAAS,aAAa,KAAA,KACtB,WAAW,WAAW,KACtB,CAAC,SAAS,0BAA0B,SAAS,MAAM,MACjD,QAAQ,YAAY,SAAS,CAAC,SAAS,kCAAkC,SAAS,MAAM,GAE1F,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,WAAW,CAAC;CAC9D,MAAM,OAAO,OAAOJ;CAEpB,MAAM,UAAU,OAAO,MAAM,MAC3B,KAAK,YAAY;EACf,KAAK,SAAS;EACd,WAAW,QAAQ;EACnB,kBAAkB,QAAQ;CAC5B,CAAC,CAAC,CAAC,KAAK,MAAM,QAAQ,MAAM,QAAQ,WAAW,YAAY,IAAI,CAAC,CAAC,CACnE,CAAC,CAAC,KAAK,OAAO,eAAe,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC;CAElD,MAAM,OAAO,QAAQ,IAAI,SAAS,KAAK,IAAI;CAC3C,MAAM,EAAE,QAAQ,OAAOK;CAuGvB,OAAO,EAAE,QArGM,OAAO,WAAW,WAC/B,OACA,OAC8E;EAE9E,MAAM,SAAS,OAAOC,OAAS,aAAa,KAAK;EACjD,MAAM,QAAQ,SAAS,cAAc,OAAO,qBAAqB;EACjE,MAAM,gBAAgB,OAAOH,OAAS,OAAO,KAAK;EAElD,MAAM,cACJ,OAAO,gBAAgB,KAAA,IAAY,KAAA,IAAY,OAAOA,OAAS,OAAO,WAAW;EAEnF,MAAM,OAAO,OAAO,SAAS,KAAA,IAAY,KAAA,IAAY,OAAOA,OAAS,OAAO,IAAI;EAIhF,MAAM,WAAW,OAAO,IAAI,iBAAiB,YAAY,OAAO;GAC9D,YAAY;GACZ,QAAQ,SAAS;GACjB,UAAU,QAAQ;GAClB,gBAAgB;IAAC;IAAO;IAAO;IAAO;IAAO;GAAK;GAClD,gBAAgB;EAClB,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,KAAK,MAAM,IAAI,GACrC,OAAO,UAAU,UACf,MAAM,SAAS,8BAA8B,aAAa,IAAI,YAAY,KAAK,CAAC,CAAC,CACnF,CACF;EAEA,MAAM,SAAS,OAAOG,OAAS,UAAU,SAAS,MAAM,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,CAAC;EAE5F,MAAM,OAAO,OAAO,MAAM,qBAAqB;EAE/C,IACE,QAAQ,KACR,QAAQ,MAAM,OACb,OAAO,QAAQ,KAAA,KAAa,OAAO,QAAQ,QAAQ,YACpD,OAAO,OAAO,OACd,OAAO,MAAM,OACZ,OAAO,QAAQ,KAAA,KAAa,OAAO,MAAM,OACzC,OAAO,cAAc,KAAA,KAAa,OAAO,YAAY,KAEtD,OAAO,OAAO,aAAa;EAC7B,IAAI,OAAO,aAAa,KAAA,GAEpB;OAAA,OAAO,UAAU,iBAChB,OAAO,kBAAkB,KAAA,MACvB,OAAO,cAAc,KAAA,KACpB,OAAO,YAAY,OAAO,gBAAgB,KAAK,MAAM,GAAG,IAE5D,OAAO,OAAO,aAAa;EAAA,OACxB,IACL,OAAO,QAAQ,OAAO,SAAS,WAC9B,OAAO,UAAU,KAAA,KAAa,OAAO,UAAU,iBAC/C,OAAO,cAAc,KAAA,KAAa,OAAO,cAAc,OAAO,SAAS,UAExE,OAAO,OAAO,aAAa;EAC7B,MAAM,cAAc,UAAU,SAAS,gBAAgB,GAAG;EAE1D,IAAI,gBAAgB,KAAA,GAAW,OAAO,OAAO,aAAa;EAE1D,KAAK,MAAM,CAAC,MAAM,WAAW,CAC3B,CAAC,OAAO,SAAS,WAAW,GAC5B,CAAC,OAAO,QAAQ,IAAI,CACtB,GAAY;GACV,IAAI,SAAS,KAAA,GAAW;GACxB,IAAI,WAAW,KAAA,GAAW,OAAO,OAAO,aAAa;GAGrD,MAAM,SAAS,QAAO,OAFA,OAAO,OAAA,CAG1B,OAAO,YAAY,QAAQ,IAAI,YAAY,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,CAC5D,KAAK,OAAO,eAAe,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC;GAEnD,IAAI,OAAO,WAAW,YAAY,SAAS,GAAG,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;GAC/E,IAAI,SAAS,UAAU,OAAO,OAAO,SAAS,GAAG,YAAY,MAAM,CAAC,GAClE,OAAO,OAAO,aAAa;EAC/B;EAEA,MAAM,YAAY,OAAO,MAAM,qBAAqB;EAEpD,IACE,OAAO,OAAO,YACb,OAAO,aAAa,KAAA,KACnB,OAAO,kBAAkB,KAAA,KACzB,OAAO,cAAc,KAAA,KACrB,OAAO,YAAY,OAAO,gBAAgB,KAAK,MAAM,QAAQ,GAE/D,OAAO,OAAO,aAAa;EAE7B,OAAO;GACL,QAAQ,SAAS,KAAKF,OAAS,SAAS,MAAM,CAAC;GAC/C,SAAS,OAAO;GAChB,GAAI,OAAO,cAAc,KAAA,IACrB,CAAC,IACD;IACE,UAAU,OAAO;IACjB,yBAAyB,SAAS,WAAW,KAAK,IAAI,OAAO,OAAO,YAAY,GAAI,CAAC;GACvF;EACN;CACF,GAAG,GAEW,EAAE;AAClB,CAAC"}

package/package.json

@@ -1 +1 @@
-{"name":"@yielded/oauth","version":"0.1.0-beta.30","dependencies":{"@yielded/jose":"0.1.0-beta.30"},"devDependencies":{"@effect/platform-node":"4.0.0","@effect/vitest":"4.0.0","@types/node":"26.1.2","@yielded/crypto":"0.1.0-beta.30","effect":"4.0.0","jose":"6.2.12","typescript":"7.0.2","vite-plus":"0.3.3"},"peerDependencies":{"effect":"^4.0.0"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./Errors":{"types":"./dist/Errors.d.mts","default":"./dist/Errors.mjs"},"./OAuth":{"types":"./dist/OAuth.d.mts","default":"./dist/OAuth.mjs"},"./Oidc":{"types":"./dist/Oidc.d.mts","default":"./dist/Oidc.mjs"},"./Pkce":{"types":"./dist/Pkce.d.mts","default":"./dist/Pkce.mjs"}},"description":"Native Effect OAuth and signed OpenID Connect protocols.","homepage":"https://yielded.dev/auth/","bugs":{"url":"https://github.com/yielded-dev/auth/issues"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/yielded-dev/auth.git","directory":"packages/oauth"},"files":["dist","src","THIRD_PARTY_NOTICES.md"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json","test":"vp test"}}
+{"name":"@yielded/oauth","version":"0.1.0-beta.31","dependencies":{"@yielded/jose":"0.1.0-beta.31"},"devDependencies":{"@effect/platform-node":"4.0.0","@effect/vitest":"4.0.0","@types/node":"26.1.2","@yielded/crypto":"0.1.0-beta.31","effect":"4.0.0","jose":"6.2.12","typescript":"7.0.2","vite":"npm:@voidzero-dev/vite-plus-core@1.1.0","vite-plus":"1.1.0","vitest":"5.0.3"},"peerDependencies":{"effect":"^4.0.0"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./Errors":{"types":"./dist/Errors.d.mts","default":"./dist/Errors.mjs"},"./OAuth":{"types":"./dist/OAuth.d.mts","default":"./dist/OAuth.mjs"},"./Oidc":{"types":"./dist/Oidc.d.mts","default":"./dist/Oidc.mjs"},"./Pkce":{"types":"./dist/Pkce.d.mts","default":"./dist/Pkce.mjs"}},"description":"Native Effect OAuth and signed OpenID Connect protocols.","homepage":"https://yielded.dev/auth/","bugs":{"url":"https://github.com/yielded-dev/auth/issues"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/yielded-dev/auth.git","directory":"packages/oauth"},"files":["dist","src","THIRD_PARTY_NOTICES.md"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json","test":"vp test"}}

package/src/OAuth.ts

@@ -91,15 +91,17 @@ export interface AuthorizationInput extends Parameters {
   readonly redirectUri: string;
   readonly scopes: ReadonlyArray<string>;
   readonly state: Redacted.Redacted<string>;
-  readonly codeChallenge: string;
+  readonly codeChallenge?: string;
   readonly nonce?: Redacted.Redacted<string>;
   readonly maxAgeSeconds?: number;
+  readonly prompt?: "none" | "login" | "consent" | "select_account";
+  readonly loginHint?: string;
 }
 
 export interface CodeGrantInput extends Parameters {
   readonly code: Redacted.Redacted<string>;
   readonly redirectUri: string;
-  readonly pkceVerifier: Redacted.Redacted<string>;
+  readonly pkceVerifier?: Redacted.Redacted<string>;
 }
 
 export interface RefreshGrantInput extends Parameters {
@@ -152,16 +154,18 @@ const Authorization = Schema.Struct({
   redirectUri: V.Callback,
   scopes: V.Scopes,
   state: V.secret(256),
-  codeChallenge: V.Challenge,
+  codeChallenge: Schema.optionalKey(V.Challenge),
   nonce: Schema.optionalKey(V.secret(256)),
   maxAgeSeconds: Schema.optionalKey(V.integer(0, 86400)),
+  prompt: Schema.optionalKey(Schema.Literals(["none", "login", "consent", "select_account"])),
+  loginHint: Schema.optionalKey(V.text(1024)),
 });
 
 const CodeGrant = Schema.Struct({
   ...additional,
   code: V.secret(16384),
   redirectUri: V.Callback,
-  pkceVerifier: V.Verifier,
+  pkceVerifier: Schema.optionalKey(V.Verifier),
 });
 
 const RefreshGrant = Schema.Struct({
@@ -371,10 +375,14 @@ export const make = Effect.fnUntraced(function* (
     body.set("response_mode", "query");
     body.set("scope", value.scopes.join(" "));
     body.set("state", yield* V.reveal(value.state));
-    body.set("code_challenge", value.codeChallenge);
-    body.set("code_challenge_method", "S256");
+    if (value.codeChallenge !== undefined) {
+      body.set("code_challenge", value.codeChallenge);
+      body.set("code_challenge_method", "S256");
+    }
     if (value.nonce !== undefined) body.set("nonce", yield* V.reveal(value.nonce));
     if (value.maxAgeSeconds !== undefined) body.set("max_age", String(value.maxAgeSeconds));
+    if (value.prompt !== undefined) body.set("prompt", value.prompt);
+    if (value.loginHint !== undefined) body.set("login_hint", value.loginHint);
     for (const [key, item] of body) url.searchParams.append(key, item);
     if (url.href.length > 16384) return yield* ConfigurationError.make({ reason: "parameters" });
 
@@ -388,7 +396,8 @@ export const make = Effect.fnUntraced(function* (
 
     body.set("grant_type", "authorization_code");
     body.set("code", yield* V.reveal(value.code));
-    body.set("code_verifier", yield* V.reveal(value.pkceVerifier));
+    if (value.pkceVerifier !== undefined)
+      body.set("code_verifier", yield* V.reveal(value.pkceVerifier));
     body.set("redirect_uri", value.redirectUri);
 
     return yield* send(body);

package/src/Oidc.ts

@@ -21,9 +21,25 @@ import * as Transport from "./internal/transport";
 import * as V from "./internal/validation";
 import { JsonObject, Metadata, type RequestOptions } from "./OAuth";
 
+export const IdTokenAlgorithm = Schema.Literals(["RS256", "PS256", "ES256", "EdDSA"]);
+export type IdTokenAlgorithm = typeof IdTokenAlgorithm.Type;
+
+export const defaultIdTokenAlgorithms: readonly IdTokenAlgorithm[] = [
+  "RS256",
+  "PS256",
+  "ES256",
+  "EdDSA",
+];
+
 export interface VerifierOptions extends RequestOptions {
   readonly metadata: Metadata;
   readonly clientId: string;
+  /** Algorithms this verifier will accept. Discovery must advertise at least one.
+   * Defaults to RS256, PS256, ES256 and EdDSA. */
+  readonly algorithms?: ReadonlyArray<IdTokenAlgorithm>;
+  /** Require advertised S256 PKCE. Defaults to true. Set false only for issuers
+   * that cannot complete authorization-code + PKCE. */
+  readonly pkceS256?: boolean;
 }
 
 export interface VerificationInput {
@@ -58,6 +74,10 @@ const Configuration = Schema.Struct({
   metadata: Metadata,
   clientId: V.text(1024),
   ...V.RequestOptions.fields,
+  algorithms: Schema.optionalKey(
+    Schema.Array(IdTokenAlgorithm).check(Schema.isMinLength(1), Schema.isMaxLength(4)),
+  ),
+  pkceS256: Schema.optionalKey(Schema.Boolean),
 });
 
 const VerifyInput = Schema.Struct({
@@ -84,11 +104,23 @@ const IdClaims = Schema.Struct({
   nbf: Schema.optionalKey(V.NumericDate),
   auth_time: Schema.optionalKey(V.NumericDate),
   nonce: Schema.optionalKey(V.text(256)),
-  // The RS256 half digest is 128 bits (22 base64url characters).
-  at_hash: Schema.optionalKey(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{22}$/u))),
-  c_hash: Schema.optionalKey(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{22}$/u))),
+  // Leftmost half of the signing-algorithm hash, unpadded base64url: 22
+  // characters for SHA-256 (RS256, PS256, ES256) and 43 for SHA-512 (Ed25519).
+  at_hash: Schema.optionalKey(
+    Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{22}(?:[A-Za-z0-9_-]{21})?$/u)),
+  ),
+  c_hash: Schema.optionalKey(
+    Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{22}(?:[A-Za-z0-9_-]{21})?$/u)),
+  ),
 });
 
+const tokenHash = (algorithm: string) =>
+  algorithm === "EdDSA"
+    ? { digest: "SHA-512" as const, octets: 32 }
+    : algorithm === "RS256" || algorithm === "PS256" || algorithm === "ES256"
+      ? { digest: "SHA-256" as const, octets: 16 }
+      : undefined;
+
 /** OIDC discovery uses the trusted issuer identifier, retaining its exact
  * spelling for claim comparison even if its network URL normalizes. */
 export const discover = Effect.fnUntraced(function* (
@@ -121,10 +153,11 @@ export const discover = Effect.fnUntraced(function* (
 
 const claimFailure = () => Rejected.make({ reason: "claims" });
 
-/** RS256-only signed ID tokens. Verification and the bounded JWKS cache belong
- * to the caller's Scope. Owner closure cancels and joins active verification,
- * returning Unavailable; caller interruption joins its operation without closing
- * the verifier. No process cache or automatic exchange retry is created. */
+/** Signed ID tokens using advertised RS256, PS256, ES256 or EdDSA. Verification
+ * and the bounded JWKS cache belong to the caller's Scope. Owner closure cancels
+ * and joins active verification, returning Unavailable; caller interruption joins
+ * its operation without closing the verifier. No process cache or automatic
+ * exchange retry is created. */
 export const makeVerifier = Effect.fnUntraced(function* (
   input: VerifierOptions,
 ): Effect.fn.Return<
@@ -136,11 +169,19 @@ export const makeVerifier = Effect.fnUntraced(function* (
 
   const metadata = V.freeze(options.metadata);
 
+  const algorithms = defaultIdTokenAlgorithms.filter((algorithm) =>
+    (options.algorithms ?? defaultIdTokenAlgorithms).includes(algorithm),
+  );
+
+  const advertised = algorithms.filter((algorithm) =>
+    metadata.id_token_signing_alg_values_supported?.includes(algorithm),
+  );
+
   if (
     metadata.jwks_uri === undefined ||
-    !metadata.code_challenge_methods_supported?.includes("S256") ||
+    advertised.length === 0 ||
     !metadata.response_types_supported?.includes("code") ||
-    !metadata.id_token_signing_alg_values_supported?.includes("RS256")
+    ((options.pkceS256 ?? true) && !metadata.code_challenge_methods_supported?.includes("S256"))
   )
     return yield* ConfigurationError.make({ reason: "metadata" });
   const http = yield* Transport.capture;
@@ -173,7 +214,7 @@ export const makeVerifier = Effect.fnUntraced(function* (
     // Jwt verifies the signature before any registered/application claim checks.
     // Unauthenticated malformed/key/signature failures must never burn a receipt.
     const verified = yield* Jwt.verifyWithKeySet(JsonObject, token, {
-      algorithms: ["RS256"],
+      algorithms: advertised,
       issuer: metadata.issuer,
       audience: options.clientId,
       requiredClaims: ["iss", "sub", "aud", "exp", "iat"],
@@ -213,6 +254,10 @@ export const makeVerifier = Effect.fnUntraced(function* (
       (claims.auth_time !== undefined && claims.auth_time !== policy.previous.authTime)
     )
       return yield* claimFailure();
+    const hashProfile = tokenHash(verified.protectedHeader.alg);
+
+    if (hashProfile === undefined) return yield* claimFailure();
+
     for (const [hash, secret] of [
       [claims.at_hash, accessToken],
       [claims.c_hash, code],
@@ -222,11 +267,12 @@ export const makeVerifier = Effect.fnUntraced(function* (
       const crypto = yield* Crypto.Crypto;
 
       const digest = yield* crypto
-        .digest("SHA-256", new TextEncoder().encode(secret))
+        .digest(hashProfile.digest, new TextEncoder().encode(secret))
         .pipe(Effect.mapError(() => Unavailable.make({})));
 
-      if (digest.length !== 32) return yield* Unavailable.make({});
-      if (hash !== Base64Url.encode(digest.subarray(0, 16))) return yield* claimFailure();
+      if (digest.length !== hashProfile.octets * 2) return yield* Unavailable.make({});
+      if (hash !== Base64Url.encode(digest.subarray(0, hashProfile.octets)))
+        return yield* claimFailure();
     }
     // Re-read time after optional digest I/O so expired tokens cannot escape.
     const finished = (yield* Clock.currentTimeMillis) / 1000;