{"prompt":"You are comparing an AI-suggested code fix with actual changes made in a commit.\n\nYour task: Determine if the commit contains the essence of the AI fix and provide a confidence level.\n\n## AI-Suggested Fix\n\n**What it fixes:** @forgerock/journey-suites:e2e-ci--src/protect.test.ts\n\n**Description:** fix(journey-client): use fetch API for wellknown config resolution\n\n**Reasoning:** The PR added well-known endpoint configuration support to the journey-client, which included creating a temporary Redux store to fetch OIDC discovery documents using RTK Query's wellknownApi. However, this approach had a critical flaw: RTK Query APIs created with createApi() are singletons with global middleware.\n\nWhen the e2e test logged out and restarted the journey, a new journey client instance was created with a new Redux store. The wellknownApi middleware from the temporary store (created \n\n**Suggested Changes (diff):**\n```diff\ndiff --git a/packages/journey-client/src/lib/client.store.ts b/packages/journey-client/src/lib/client.store.ts\nindex 35c130bd..d7f3ac61 100644\n--- a/packages/journey-client/src/lib/client.store.ts\n+++ b/packages/journey-client/src/lib/client.store.ts\n@@ -17,7 +17,6 @@ import { journeyApi } from './journey.api.js';\n import { setConfig } from './journey.slice.js';\n import { createStorage } from '@forgerock/storage';\n import { createJourneyObject } from './journey.utils.js';\n-import { wellknownApi } from './wellknown.api.js';\n import {\n hasWellknownConfig,\n inferRealmFromIssuer,\n@@ -80,19 +79,22 @@ async function resolveAsyncConfig(\n throw error;\n }\n \n- // Create a temporary store to fetch well-known (we need the RTK Query infrastructure)\n- const tempConfig: InternalJourneyClientConfig = {\n- serverConfig: { baseUrl: baseUrl || '', paths, timeout },\n- realmPath: config.realmPath,\n- };\n- const tempStore = createJourneyStore({ config: tempConfig, logger: log });\n-\n- // Fetch the well-known configuration\n- const { data: wellknownResponse, error: fetchError } = await tempStore.dispatch(\n- wellknownApi.endpoints.configuration.initiate(wellknown),\n- );\n+ // Fetch the well-known configuration directly using fetch API\n+ // We avoid using RTK Query here to prevent store singleton issues\n+ let wellknownResponse: any;\n+ try {\n+ const response = await fetch(wellknown, {\n+ headers: {\n+ Accept: 'application/json',\n+ },\n+ });\n+\n+ if (!response.ok) {\n+ throw new Error(`HTTP ${response.status}: ${response.statusText}`);\n+ }\n \n- if (fetchError || !wellknownResponse) {\n+ wellknownResponse = await response.json();\n+ } catch (fetchError: any) {\n const genericError = createWellknownError(fetchError);\n log.error(`${genericError.error}: ${genericError.message}`);\n throw new Error(genericError.message);\n\n```\n\n## Actual Commit Changes\n\n**Commit Diff:**\n```diff\ndiff --git a/packages/davinci-client/src/lib/client.store.ts b/packages/davinci-client/src/lib/client.store.ts\nindex 851b17db84..94e4b4ed06 100644\n--- a/packages/davinci-client/src/lib/client.store.ts\n+++ b/packages/davinci-client/src/lib/client.store.ts\n@@ -15,7 +15,7 @@ import { createClientStore, handleUpdateValidateError, RootState } from './clien\n import { nodeSlice } from './node.slice.js';\n import { davinciApi } from './davinci.api.js';\n import { configSlice } from './config.slice.js';\n-import { wellknownApi } from './wellknown.api.js';\n+import { wellknownApi, createWellknownError } from './wellknown.api.js';\n \n import type { ActionTypes, RequestMiddleware } from '@forgerock/sdk-request-middleware';\n /**\n@@ -88,14 +88,14 @@ export async function davinci({\n throw error;\n }\n \n- const { data: openIdResponse } = await store.dispatch(\n- wellknownApi.endpoints.wellknown.initiate(config.serverConfig.wellknown),\n+ const { data: openIdResponse, error: fetchError } = await store.dispatch(\n+ wellknownApi.endpoints.configuration.initiate(config.serverConfig.wellknown),\n );\n \n- if (!openIdResponse) {\n- const error = new Error('error fetching `wellknown` response for OpenId Configuration');\n- log.error(error.message);\n- throw error;\n+ if (fetchError || !openIdResponse) {\n+ const genericError = createWellknownError(fetchError);\n+ log.error(`${genericError.error}: ${genericError.message}`);\n+ throw new Error(genericError.message);\n }\n \n store.dispatch(configSlice.actions.set({ ...config, wellknownResponse: openIdResponse }));\ndiff --git a/packages/davinci-client/src/lib/config.types.test-d.ts b/packages/davinci-client/src/lib/config.types.test-d.ts\nindex 340f7d4634..2c65e8e4e5 100644\n--- a/packages/davinci-client/src/lib/config.types.test-d.ts\n+++ b/packages/davinci-client/src/lib/config.types.test-d.ts\n@@ -6,8 +6,7 @@\n */\n import { describe, expectTypeOf, it } from 'vitest';\n import type { DaVinciConfig, InternalDaVinciConfig } from './config.types.js';\n-import type { AsyncLegacyConfigOptions } from '@forgerock/sdk-types';\n-import type { WellknownResponse } from './wellknown.types.js';\n+import type { AsyncLegacyConfigOptions, WellKnownResponse } from '@forgerock/sdk-types';\n \n describe('Config Types', () => {\n describe('DaVinciConfig', () => {\n@@ -51,30 +50,9 @@ describe('Config Types', () => {\n authorization_endpoint: 'https://example.com/auth',\n token_endpoint: 'https://example.com/token',\n userinfo_endpoint: 'https://example.com/userinfo',\n- jwks_uri: 'https://example.com/jwks',\n- revocation_endpoint: 'https://example.com/register',\n end_session_endpoint: 'https://example.com/logout',\n- pushed_authorization_request_endpoint: '',\n- check_session_iframe: '',\n- introspection_endpoint: '',\n- device_authorization_endpoint: '',\n- claims_parameter_supported: '',\n- request_parameter_supported: '',\n- request_uri_parameter_supported: '',\n- require_pushed_authorization_requests: '',\n- scopes_supported: [],\n- response_types_supported: [],\n- response_modes_supported: [],\n- grant_types_supported: [],\n- subject_types_supported: [],\n- id_token_signing_alg_values_supported: [],\n- userinfo_signing_alg_values_supported: [],\n- request_object_signing_alg_values_supported: [],\n- token_endpoint_auth_methods_supported: [],\n- token_endpoint_auth_signing_alg_values_supported: [],\n- claim_types_supported: [],\n- claims_supported: [],\n- code_challenge_methods_supported: [],\n+ introspection_endpoint: 'https://example.com/introspect',\n+ revocation_endpoint: 'https://example.com/revoke',\n },\n responseType: 'code',\n serverConfig: {},\n@@ -100,30 +78,12 @@ describe('Config Types', () => {\n authorization_endpoint: 'https://example.com/auth',\n token_endpoint: 'https://example.com/token',\n userinfo_endpoint: 'https://example.com/userinfo',\n- jwks_uri: 'https://example.com/jwks',\n- revocation_endpoint: 'https://example.com/revoke',\n end_session_endpoint: 'https://example.com/logout',\n- pushed_authorization_request_endpoint: '',\n- check_session_iframe: '',\n- introspection_endpoint: '',\n- device_authorization_endpoint: '',\n- claims_parameter_supported: '',\n- request_parameter_supported: '',\n- request_uri_parameter_supported: '',\n- require_pushed_authorization_requests: '',\n- scopes_supported: [],\n- response_types_supported: [],\n- response_modes_supported: [],\n- grant_types_supported: [],\n- subject_types_supported: [],\n- id_token_signing_alg_values_supported: [],\n- userinfo_signing_alg_values_supported: [],\n- request_object_signing_alg_values_supported: [],\n- token_endpoint_auth_methods_supported: [],\n- token_endpoint_auth_signing_alg_values_supported: [],\n- claim_types_supported: [],\n- claims_supported: [],\n- code_challenge_methods_supported: [],\n+ introspection_endpoint: 'https://example.com/introspect',\n+ revocation_endpoint: 'https://example.com/revoke',\n+ // Optional properties\n+ jwks_uri: 'https://example.com/jwks',\n+ scopes_supported: ['openid', 'profile'],\n },\n };\n expectTypeOf(config).toMatchTypeOf();\n@@ -131,143 +91,101 @@ describe('Config Types', () => {\n });\n });\n \n-describe('WellknownResponse', () => {\n- it('should have all required OIDC properties', () => {\n- const wellknown: WellknownResponse = {\n+/**\n+ * WellKnownResponse type tests.\n+ *\n+ * Note: WellKnownResponse is now imported from @forgerock/sdk-types.\n+ * The type correctly follows the OIDC Discovery spec where only\n+ * issuer, authorization_endpoint, token_endpoint, and userinfo_endpoint\n+ * are required. Other properties are optional.\n+ */\n+describe('WellKnownResponse', () => {\n+ it('should have required OIDC properties', () => {\n+ // Minimal wellknown response with only required properties\n+ const wellknown: WellKnownResponse = {\n issuer: 'https://example.com',\n authorization_endpoint: 'https://example.com/auth',\n token_endpoint: 'https://example.com/token',\n userinfo_endpoint: 'https://example.com/userinfo',\n- jwks_uri: 'https://example.com/jwks',\n- revocation_endpoint: 'https://example.com/revoke',\n end_session_endpoint: 'https://example.com/logout',\n- pushed_authorization_request_endpoint: '',\n- check_session_iframe: '',\n- introspection_endpoint: '',\n- device_authorization_endpoint: '',\n- claims_parameter_supported: '',\n- request_parameter_supported: '',\n- request_uri_parameter_supported: '',\n- require_pushed_authorization_requests: '',\n- scopes_supported: [],\n- response_types_supported: [],\n- response_modes_supported: [],\n- grant_types_supported: [],\n- subject_types_supported: [],\n- id_token_signing_alg_values_supported: [],\n- userinfo_signing_alg_values_supported: [],\n- request_object_signing_alg_values_supported: [],\n- token_endpoint_auth_methods_supported: [],\n- token_endpoint_auth_signing_alg_values_supported: [],\n- claim_types_supported: [],\n- claims_supported: [],\n- code_challenge_methods_supported: [],\n+ introspection_endpoint: 'https://example.com/introspect',\n+ revocation_endpoint: 'https://example.com/revoke',\n };\n \n- expectTypeOf().toHaveProperty('issuer').toBeString();\n- expectTypeOf().toHaveProperty('authorization_endpoint').toBeString();\n- expectTypeOf().toHaveProperty('token_endpoint').toBeString();\n- expectTypeOf().toHaveProperty('userinfo_endpoint').toBeString();\n- expectTypeOf().toHaveProperty('jwks_uri').toBeString();\n- expectTypeOf().toHaveProperty('revocation_endpoint').toBeString();\n- expectTypeOf().toHaveProperty('end_session_endpoint').toBeString();\n+ // Required properties should be strings\n+ expectTypeOf().toHaveProperty('issuer').toBeString();\n+ expectTypeOf().toHaveProperty('authorization_endpoint').toBeString();\n+ expectTypeOf().toHaveProperty('token_endpoint').toBeString();\n+ expectTypeOf().toHaveProperty('userinfo_endpoint').toBeString();\n+ expectTypeOf().toHaveProperty('end_session_endpoint').toBeString();\n+ expectTypeOf().toHaveProperty('introspection_endpoint').toBeString();\n+ expectTypeOf().toHaveProperty('revocation_endpoint').toBeString();\n \n- expectTypeOf(wellknown).toMatchTypeOf();\n+ expectTypeOf(wellknown).toMatchTypeOf();\n });\n \n it('should allow optional OIDC properties', () => {\n- const wellknownWithOptionals: WellknownResponse = {\n+ const wellknownWithOptionals: WellKnownResponse = {\n issuer: 'https://example.com',\n authorization_endpoint: 'https://example.com/auth',\n token_endpoint: 'https://example.com/token',\n userinfo_endpoint: 'https://example.com/userinfo',\n- jwks_uri: 'https://example.com/jwks',\n- revocation_endpoint: 'https://example.com/revoke',\n end_session_endpoint: 'https://example.com/logout',\n+ introspection_endpoint: 'https://example.com/introspect',\n+ revocation_endpoint: 'https://example.com/revoke',\n // Optional properties\n+ jwks_uri: 'https://example.com/jwks',\n scopes_supported: ['openid', 'profile', 'email'],\n response_types_supported: ['code', 'token'],\n grant_types_supported: ['authorization_code', 'refresh_token'],\n subject_types_supported: ['public'],\n id_token_signing_alg_values_supported: ['RS256'],\n token_endpoint_auth_methods_supported: ['client_secret_basic'],\n- pushed_authorization_request_endpoint: '',\n- check_session_iframe: '',\n- introspection_endpoint: '',\n- device_authorization_endpoint: '',\n- claims_parameter_supported: '',\n- request_parameter_supported: '',\n- request_uri_parameter_supported: '',\n- require_pushed_authorization_requests: '',\n- response_modes_supported: [],\n- userinfo_signing_alg_values_supported: [],\n- request_object_signing_alg_values_supported: [],\n- token_endpoint_auth_signing_alg_values_supported: [],\n- claim_types_supported: [],\n- claims_supported: [],\n- code_challenge_methods_supported: [],\n };\n \n // Test optional properties are allowed but not required\n- expectTypeOf().toHaveProperty('scopes_supported');\n- expectTypeOf().toHaveProperty('response_types_supported');\n- expectTypeOf().toHaveProperty('grant_types_supported');\n+ expectTypeOf().toHaveProperty('scopes_supported');\n+ expectTypeOf().toHaveProperty('response_types_supported');\n+ expectTypeOf().toHaveProperty('grant_types_supported');\n+ expectTypeOf().toHaveProperty('jwks_uri');\n \n- expectTypeOf(wellknownWithOptionals).toMatchTypeOf();\n+ expectTypeOf(wellknownWithOptionals).toMatchTypeOf();\n });\n \n- it('should validate property types', () => {\n- // Test that array properties must contain strings\n- expectTypeOf().toEqualTypeOf();\n- expectTypeOf().toEqualTypeOf();\n- expectTypeOf().toEqualTypeOf();\n- expectTypeOf().toEqualTypeOf();\n- expectTypeOf().toEqualTypeOf<\n- string[]\n+ it('should validate optional array property types', () => {\n+ // Test that optional array properties are string[] | undefined\n+ expectTypeOf().toEqualTypeOf();\n+ expectTypeOf().toEqualTypeOf<\n+ string[] | undefined\n >();\n- expectTypeOf().toEqualTypeOf<\n- string[]\n+ expectTypeOf().toEqualTypeOf<\n+ string[] | undefined\n+ >();\n+ expectTypeOf().toEqualTypeOf<\n+ string[] | undefined\n+ >();\n+ expectTypeOf().toEqualTypeOf<\n+ string[] | undefined\n+ >();\n+ expectTypeOf().toEqualTypeOf<\n+ string[] | undefined\n >();\n });\n \n- it('should enforce URL format for endpoint properties', () => {\n- const wellknown: WellknownResponse = {\n+ it('should enforce URL format for required endpoint properties', () => {\n+ const wellknown: WellKnownResponse = {\n issuer: 'https://example.com',\n authorization_endpoint: 'https://example.com/auth',\n token_endpoint: 'https://example.com/token',\n userinfo_endpoint: 'https://example.com/userinfo',\n- jwks_uri: 'https://example.com/jwks',\n- revocation_endpoint: 'https://example.com/register',\n end_session_endpoint: 'https://example.com/logout',\n- pushed_authorization_request_endpoint: '',\n- check_session_iframe: '',\n- introspection_endpoint: '',\n- device_authorization_endpoint: '',\n- claims_parameter_supported: '',\n- request_parameter_supported: '',\n- request_uri_parameter_supported: '',\n- require_pushed_authorization_requests: '',\n- scopes_supported: [],\n- response_types_supported: [],\n- response_modes_supported: [],\n- grant_types_supported: [],\n- subject_types_supported: [],\n- id_token_signing_alg_values_supported: [],\n- userinfo_signing_alg_values_supported: [],\n- request_object_signing_alg_values_supported: [],\n- token_endpoint_auth_methods_supported: [],\n- token_endpoint_auth_signing_alg_values_supported: [],\n- claim_types_supported: [],\n- claims_supported: [],\n- code_challenge_methods_supported: [],\n+ introspection_endpoint: 'https://example.com/introspect',\n+ revocation_endpoint: 'https://example.com/revoke',\n };\n \n- // Type assertion to ensure all endpoint properties are strings (URLs)\n+ // Type assertion to ensure required endpoint properties are strings (URLs)\n expectTypeOf(wellknown.authorization_endpoint).toBeString();\n expectTypeOf(wellknown.token_endpoint).toBeString();\n expectTypeOf(wellknown.userinfo_endpoint).toBeString();\n- expectTypeOf(wellknown.jwks_uri).toBeString();\n- expectTypeOf(wellknown.revocation_endpoint).toBeString();\n- expectTypeOf(wellknown.end_session_endpoint).toBeString();\n });\n });\ndiff --git a/packages/davinci-client/src/lib/config.types.ts b/packages/davinci-client/src/lib/config.types.ts\nindex c443a704cf..8e129c442d 100644\n--- a/packages/davinci-client/src/lib/config.types.ts\n+++ b/packages/davinci-client/src/lib/config.types.ts\n@@ -4,16 +4,13 @@\n * This software may be modified and distributed under the terms\n * of the MIT license. See the LICENSE file for details.\n */\n-/**\n- * Import LegacyConfigOptions type from the JavaScript SDK\n- */\n-import type { AsyncLegacyConfigOptions } from '@forgerock/sdk-types';\n-import { WellknownResponse } from './wellknown.types.js';\n+\n+import type { AsyncLegacyConfigOptions, WellKnownResponse } from '@forgerock/sdk-types';\n \n export interface DaVinciConfig extends AsyncLegacyConfigOptions {\n responseType?: string;\n }\n \n export interface InternalDaVinciConfig extends DaVinciConfig {\n- wellknownResponse: WellknownResponse;\n+ wellknownResponse: WellKnownResponse;\n }\ndiff --git a/packages/davinci-client/src/lib/wellknown.api.ts b/packages/davinci-client/src/lib/wellknown.api.ts\nindex 6c3edd6118..0f60b91c4d 100644\n--- a/packages/davinci-client/src/lib/wellknown.api.ts\n+++ b/packages/davinci-client/src/lib/wellknown.api.ts\n@@ -4,20 +4,11 @@\n * This software may be modified and distributed under the terms\n * of the MIT license. See the LICENSE file for details.\n */\n-import { createApi, fetchBaseQuery } from '@reduxjs/toolkit/query';\n-import { WellknownResponse } from './wellknown.types.js';\n \n-export const wellknownApi = createApi({\n- reducerPath: 'wellknown',\n- baseQuery: fetchBaseQuery({\n- prepareHeaders: (headers) => {\n- headers.set('Accept', 'application/json');\n- return headers;\n- },\n- }),\n- endpoints: (builder) => ({\n- wellknown: builder.query({\n- query: (endpoint: string) => ({ url: endpoint }),\n- }),\n- }),\n-});\n+/**\n+ * Re-export the shared wellknown RTK Query API from @forgerock/sdk-oidc.\n+ *\n+ * The wellknown API provides OIDC endpoint discovery functionality via\n+ * the `.well-known/openid-configuration` endpoint.\n+ */\n+export { wellknownApi, createWellknownSelector, createWellknownError } from '@forgerock/sdk-oidc';\ndiff --git a/packages/davinci-client/src/lib/wellknown.types.ts b/packages/davinci-client/src/lib/wellknown.types.ts\nindex 0fa71de10c..b0adb1329b 100644\n--- a/packages/davinci-client/src/lib/wellknown.types.ts\n+++ b/packages/davinci-client/src/lib/wellknown.types.ts\n@@ -4,37 +4,14 @@\n * This software may be modified and distributed under the terms\n * of the MIT license. See the LICENSE file for details.\n */\n-export interface WellknownResponse {\n- issuer: string;\n- authorization_endpoint: string;\n- pushed_authorization_request_endpoint: string;\n- token_endpoint: string;\n- userinfo_endpoint: string;\n- jwks_uri: string;\n- end_session_endpoint: string;\n- check_session_iframe: string;\n- introspection_endpoint: string;\n- revocation_endpoint: string;\n- device_authorization_endpoint: string;\n- claims_parameter_supported: string;\n- request_parameter_supported: string;\n- request_uri_parameter_supported: string;\n- require_pushed_authorization_requests: string;\n- scopes_supported: string[];\n- response_types_supported: string[];\n- response_modes_supported: string[];\n- grant_types_supported: string[];\n- subject_types_supported: string[];\n- id_token_signing_alg_values_supported: string[];\n- userinfo_signing_alg_values_supported: string[];\n- request_object_signing_alg_values_supported: string[];\n- token_endpoint_auth_methods_supported: string[];\n- token_endpoint_auth_signing_alg_values_supported: string[];\n- claim_types_supported: string[];\n- claims_supported: string[];\n- code_challenge_methods_supported: string[];\n-}\n \n+// Re-export WellKnownResponse from shared types for convenience\n+export type { WellKnownResponse } from '@forgerock/sdk-types';\n+\n+/**\n+ * Simplified endpoint mapping extracted from well-known response.\n+ * Used internally by DaVinci client for OAuth/OIDC operations.\n+ */\n export interface Endpoints {\n authorize: string;\n issuer: string;\ndiff --git a/packages/journey-client/package.json b/packages/journey-client/package.json\nindex 13f386b22a..31b7a4a415 100644\n--- a/packages/journey-client/package.json\n+++ b/packages/journey-client/package.json\n@@ -23,6 +23,7 @@\n },\n \"dependencies\": {\n \"@forgerock/sdk-logger\": \"workspace:*\",\n+ \"@forgerock/sdk-oidc\": \"workspace:*\",\n \"@forgerock/sdk-request-middleware\": \"workspace:*\",\n \"@forgerock/sdk-types\": \"workspace:*\",\n \"@forgerock/sdk-utilities\": \"workspace:*\",\ndiff --git a/packages/journey-client/src/lib/client.store.ts b/packages/journey-client/src/lib/client.store.ts\nindex c71fe799eb..35c130bdf5 100644\n--- a/packages/journey-client/src/lib/client.store.ts\n+++ b/packages/journey-client/src/lib/client.store.ts\n@@ -7,6 +7,7 @@\n \n import { logger as loggerFn, LogLevel, CustomLogger } from '@forgerock/sdk-logger';\n import { callbackType } from '@forgerock/sdk-types';\n+import { isGenericError } from '@forgerock/sdk-utilities';\n \n import type { RequestMiddleware } from '@forgerock/sdk-request-middleware';\n import type { GenericError, Step } from '@forgerock/sdk-types';\n@@ -21,6 +22,7 @@ import {\n hasWellknownConfig,\n inferRealmFromIssuer,\n isValidWellknownUrl,\n+ createWellknownError,\n } from './wellknown.utils.js';\n \n import type { JourneyStep } from './step.utils.js';\n@@ -91,12 +93,9 @@ async function resolveAsyncConfig(\n );\n \n if (fetchError || !wellknownResponse) {\n- const errorMessage = fetchError\n- ? `Failed to fetch well-known configuration: ${JSON.stringify(fetchError)}`\n- : 'Failed to fetch well-known configuration: No response received';\n- const error = new Error(errorMessage);\n- log.error(error.message);\n- throw error;\n+ const genericError = createWellknownError(fetchError);\n+ log.error(`${genericError.error}: ${genericError.message}`);\n+ throw new Error(genericError.message);\n }\n \n // Optionally infer realmPath from the issuer URL if not provided\n@@ -238,11 +237,6 @@ export async function journey({\n return (code && state) || form_post_entry || responsekey;\n }\n \n- // Type guard for GenericError (assuming GenericError has 'error' and 'message' properties)\n- function isGenericError(obj: unknown): obj is GenericError {\n- return typeof obj === 'object' && obj !== null && 'error' in obj && 'message' in obj;\n- }\n-\n // Type guard for { step: JourneyStep }\n function isStoredStep(obj: unknown): obj is { step: Step } {\n return (\ndiff --git a/packages/journey-client/src/lib/wellknown.api.ts b/packages/journey-client/src/lib/wellknown.api.ts\nindex b14b9834a8..067d975a7a 100644\n--- a/packages/journey-client/src/lib/wellknown.api.ts\n+++ b/packages/journey-client/src/lib/wellknown.api.ts\n@@ -5,55 +5,10 @@\n * of the MIT license. See the LICENSE file for details.\n */\n \n-import { createSelector } from '@reduxjs/toolkit';\n-import { createApi, fetchBaseQuery } from '@reduxjs/toolkit/query';\n-\n-import type { WellKnownResponse } from '@forgerock/sdk-types';\n-import type { RootState } from './client.store.utils.js';\n-\n-/**\n- * RTK Query API for fetching the OIDC well-known configuration endpoint.\n- *\n- * The well-known endpoint provides OIDC-related URLs such as:\n- * - authorization_endpoint\n- * - token_endpoint\n- * - userinfo_endpoint\n- * - end_session_endpoint\n- * - revocation_endpoint\n- *\n- * Note: AM-specific endpoints (authenticate, sessions) are NOT included\n- * in the standard OIDC well-known response and must be derived from\n- * the baseUrl configuration.\n- */\n-export const wellknownApi = createApi({\n- reducerPath: 'wellknown',\n- baseQuery: fetchBaseQuery({\n- prepareHeaders: (headers) => {\n- headers.set('Accept', 'application/json');\n- return headers;\n- },\n- }),\n- endpoints: (builder) => ({\n- configuration: builder.query({\n- query: (endpoint) => endpoint,\n- }),\n- }),\n-});\n-\n /**\n- * Selector to retrieve the cached well-known response from Redux state.\n+ * Re-export the shared wellknown RTK Query API from @forgerock/sdk-oidc.\n *\n- * @param wellknownUrl - The well-known endpoint URL used as the cache key\n- * @param state - The Redux root state\n- * @returns The cached WellKnownResponse or undefined if not yet fetched\n+ * The wellknown API provides OIDC endpoint discovery functionality via\n+ * the `.well-known/openid-configuration` endpoint.\n */\n-export function wellknownSelector(\n- wellknownUrl: string,\n- state: RootState,\n-): WellKnownResponse | undefined {\n- const selector = createSelector(\n- wellknownApi.endpoints.configuration.select(wellknownUrl),\n- (result) => result?.data,\n- );\n- return selector(state);\n-}\n+export { wellknownApi, createWellknownSelector } from '@forgerock/sdk-oidc';\ndiff --git a/packages/journey-client/src/lib/wellknown.utils.test.ts b/packages/journey-client/src/lib/wellknown.utils.test.ts\nindex 9c85386847..85d7517055 100644\n--- a/packages/journey-client/src/lib/wellknown.utils.test.ts\n+++ b/packages/journey-client/src/lib/wellknown.utils.test.ts\n@@ -6,17 +6,20 @@\n */\n \n import { describe, it, expect } from 'vitest';\n-import {\n- hasWellknownConfig,\n- inferRealmFromIssuer,\n- isValidWellknownUrl,\n-} from './wellknown.utils.js';\n+import { hasWellknownConfig } from './wellknown.utils.js';\n import type {\n JourneyConfigInput,\n AsyncJourneyClientConfig,\n JourneyClientConfig,\n } from './config.types.js';\n \n+/**\n+ * Tests for journey-client specific wellknown utilities.\n+ *\n+ * Note: Tests for createWellknownError, inferRealmFromIssuer, and isValidWellknownUrl\n+ * are in @forgerock/sdk-oidc and @forgerock/sdk-utilities respectively,\n+ * as those are shared utilities.\n+ */\n describe('wellknown.utils', () => {\n describe('hasWellknownConfig', () => {\n describe('hasWellknownConfig_ConfigWithWellknown_ReturnsTrue', () => {\n@@ -109,219 +112,4 @@ describe('wellknown.utils', () => {\n });\n });\n });\n-\n- describe('inferRealmFromIssuer', () => {\n- describe('inferRealmFromIssuer_SubrealmIssuer_ReturnsSubrealm', () => {\n- it('should extract subrealm from standard AM issuer URL', () => {\n- // Arrange\n- const issuer = 'https://am.example.com/am/oauth2/realms/root/realms/alpha';\n-\n- // Act\n- const result = inferRealmFromIssuer(issuer);\n-\n- // Assert\n- expect(result).toBe('alpha');\n- });\n- });\n-\n- describe('inferRealmFromIssuer_NestedSubrealm_ReturnsFullPath', () => {\n- it('should extract nested subrealm path', () => {\n- // Arrange\n- const issuer =\n- 'https://am.example.com/am/oauth2/realms/root/realms/customers/realms/premium';\n-\n- // Act\n- const result = inferRealmFromIssuer(issuer);\n-\n- // Assert\n- expect(result).toBe('customers/realms/premium');\n- });\n- });\n-\n- describe('inferRealmFromIssuer_RootRealmOnly_ReturnsRoot', () => {\n- it('should return \"root\" for root realm issuer', () => {\n- // Arrange\n- const issuer = 'https://am.example.com/am/oauth2/realms/root';\n-\n- // Act\n- const result = inferRealmFromIssuer(issuer);\n-\n- // Assert\n- expect(result).toBe('root');\n- });\n- });\n-\n- describe('inferRealmFromIssuer_NonAmIssuer_ReturnsUndefined', () => {\n- it('should return undefined for non-AM issuer (PingOne)', () => {\n- // Arrange\n- const issuer = 'https://auth.pingone.com/env-id/as';\n-\n- // Act\n- const result = inferRealmFromIssuer(issuer);\n-\n- // Assert\n- expect(result).toBeUndefined();\n- });\n- });\n-\n- describe('inferRealmFromIssuer_GenericOidcIssuer_ReturnsUndefined', () => {\n- it('should return undefined for generic OIDC issuer', () => {\n- // Arrange\n- const issuer = 'https://accounts.google.com';\n-\n- // Act\n- const result = inferRealmFromIssuer(issuer);\n-\n- // Assert\n- expect(result).toBeUndefined();\n- });\n- });\n-\n- describe('inferRealmFromIssuer_InvalidUrl_ReturnsUndefined', () => {\n- it('should return undefined for invalid URL', () => {\n- // Arrange\n- const issuer = 'not-a-valid-url';\n-\n- // Act\n- const result = inferRealmFromIssuer(issuer);\n-\n- // Assert\n- expect(result).toBeUndefined();\n- });\n- });\n-\n- describe('inferRealmFromIssuer_IssuerWithPort_ReturnsRealm', () => {\n- it('should correctly parse issuer with port number', () => {\n- // Arrange\n- const issuer = 'https://am.example.com:8443/am/oauth2/realms/root/realms/test';\n-\n- // Act\n- const result = inferRealmFromIssuer(issuer);\n-\n- // Assert\n- expect(result).toBe('test');\n- });\n- });\n-\n- describe('inferRealmFromIssuer_IssuerWithQueryParams_ReturnsRealm', () => {\n- it('should correctly parse issuer even with query parameters (edge case)', () => {\n- // Arrange - Note: well-formed issuer URLs shouldn't have query params,\n- // but we should handle this gracefully\n- const issuer = 'https://am.example.com/am/oauth2/realms/root/realms/alpha?extra=param';\n-\n- // Act\n- const result = inferRealmFromIssuer(issuer);\n-\n- // Assert\n- // The regex matches the pathname, so query params don't interfere\n- expect(result).toBe('alpha');\n- });\n- });\n- });\n-\n- describe('isValidWellknownUrl', () => {\n- describe('isValidWellknownUrl_HttpsUrl_ReturnsTrue', () => {\n- it('should return true for HTTPS URL', () => {\n- // Arrange\n- const url = 'https://am.example.com/.well-known/openid-configuration';\n-\n- // Act\n- const result = isValidWellknownUrl(url);\n-\n- // Assert\n- expect(result).toBe(true);\n- });\n- });\n-\n- describe('isValidWellknownUrl_HttpLocalhost_ReturnsTrue', () => {\n- it('should return true for HTTP localhost', () => {\n- // Arrange\n- const url = 'http://localhost:8080/.well-known/openid-configuration';\n-\n- // Act\n- const result = isValidWellknownUrl(url);\n-\n- // Assert\n- expect(result).toBe(true);\n- });\n- });\n-\n- describe('isValidWellknownUrl_Http127001_ReturnsTrue', () => {\n- it('should return true for HTTP 127.0.0.1', () => {\n- // Arrange\n- const url = 'http://127.0.0.1:8080/.well-known/openid-configuration';\n-\n- // Act\n- const result = isValidWellknownUrl(url);\n-\n- // Assert\n- expect(result).toBe(true);\n- });\n- });\n-\n- describe('isValidWellknownUrl_HttpNonLocalhost_ReturnsFalse', () => {\n- it('should return false for HTTP non-localhost URL', () => {\n- // Arrange\n- const url = 'http://am.example.com/.well-known/openid-configuration';\n-\n- // Act\n- const result = isValidWellknownUrl(url);\n-\n- // Assert\n- expect(result).toBe(false);\n- });\n- });\n-\n- describe('isValidWellknownUrl_InvalidUrl_ReturnsFalse', () => {\n- it('should return false for invalid URL', () => {\n- // Arrange\n- const url = 'not-a-valid-url';\n-\n- // Act\n- const result = isValidWellknownUrl(url);\n-\n- // Assert\n- expect(result).toBe(false);\n- });\n- });\n-\n- describe('isValidWellknownUrl_EmptyString_ReturnsFalse', () => {\n- it('should return false for empty string', () => {\n- // Arrange\n- const url = '';\n-\n- // Act\n- const result = isValidWellknownUrl(url);\n-\n- // Assert\n- expect(result).toBe(false);\n- });\n- });\n-\n- describe('isValidWellknownUrl_FtpProtocol_ReturnsFalse', () => {\n- it('should return false for non-HTTP protocols', () => {\n- // Arrange\n- const url = 'ftp://am.example.com/.well-known/openid-configuration';\n-\n- // Act\n- const result = isValidWellknownUrl(url);\n-\n- // Assert\n- expect(result).toBe(false);\n- });\n- });\n-\n- describe('isValidWellknownUrl_HttpsLocalhost_ReturnsTrue', () => {\n- it('should return true for HTTPS localhost', () => {\n- // Arrange\n- const url = 'https://localhost:8443/.well-known/openid-configuration';\n-\n- // Act\n- const result = isValidWellknownUrl(url);\n-\n- // Assert\n- expect(result).toBe(true);\n- });\n- });\n- });\n });\ndiff --git a/packages/journey-client/src/lib/wellknown.utils.ts b/packages/journey-client/src/lib/wellknown.utils.ts\nindex 9a71cca7ae..4cff21914a 100644\n--- a/packages/journey-client/src/lib/wellknown.utils.ts\n+++ b/packages/journey-client/src/lib/wellknown.utils.ts\n@@ -5,6 +5,13 @@\n * of the MIT license. See the LICENSE file for details.\n */\n \n+// Re-export shared wellknown utilities from sdk-oidc\n+export {\n+ createWellknownError,\n+ inferRealmFromIssuer,\n+ isValidWellknownUrl,\n+} from '@forgerock/sdk-oidc';\n+\n import type { AsyncJourneyClientConfig, JourneyConfigInput } from './config.types.js';\n \n /**\n@@ -38,95 +45,3 @@ export function hasWellknownConfig(config: JourneyConfigInput): config is AsyncJ\n config.serverConfig.wellknown.length > 0\n );\n }\n-\n-/**\n- * Attempts to infer the realm path from an OIDC issuer URL.\n- *\n- * AM issuer URLs follow the pattern:\n- * `https://{host}/am/oauth2/realms/root/realms/{subrealm}`\n- *\n- * This function extracts the realm path after `/realms/root/realms/`.\n- * If the issuer doesn't match the expected pattern, returns undefined.\n- *\n- * @param issuer - The issuer URL from the well-known response\n- * @returns The inferred realm path, or undefined if it cannot be determined\n- *\n- * @example\n- * ```typescript\n- * // Standard AM issuer with subrealm\n- * inferRealmFromIssuer('https://am.example.com/am/oauth2/realms/root/realms/alpha')\n- * // Returns: 'alpha'\n- *\n- * // Nested subrealm\n- * inferRealmFromIssuer('https://am.example.com/am/oauth2/realms/root/realms/customers/realms/premium')\n- * // Returns: 'customers/realms/premium'\n- *\n- * // Root realm only\n- * inferRealmFromIssuer('https://am.example.com/am/oauth2/realms/root')\n- * // Returns: 'root'\n- *\n- * // Non-AM issuer (e.g., PingOne)\n- * inferRealmFromIssuer('https://auth.pingone.com/env-id/as')\n- * // Returns: undefined\n- * ```\n- */\n-export function inferRealmFromIssuer(issuer: string): string | undefined {\n- try {\n- const url = new URL(issuer);\n- const pathname = url.pathname;\n-\n- // Pattern 1: Subrealm - /oauth2/realms/root/realms/{subrealm}\n- const subRealmMatch = pathname.match(/\\/oauth2\\/realms\\/root\\/realms\\/(.+)$/);\n- if (subRealmMatch) {\n- return subRealmMatch[1];\n- }\n-\n- // Pattern 2: Root realm only - /oauth2/realms/root\n- const rootRealmMatch = pathname.match(/\\/oauth2\\/realms\\/(root)$/);\n- if (rootRealmMatch) {\n- return rootRealmMatch[1];\n- }\n-\n- // Could not infer realm from issuer URL\n- return undefined;\n- } catch {\n- // Invalid URL - return undefined\n- return undefined;\n- }\n-}\n-\n-/**\n- * Validates that a well-known URL is properly formatted.\n- *\n- * @param wellknownUrl - The URL to validate\n- * @returns True if the URL is valid and uses HTTPS (or HTTP for localhost)\n- *\n- * @example\n- * ```typescript\n- * isValidWellknownUrl('https://am.example.com/.well-known/openid-configuration')\n- * // Returns: true\n- *\n- * isValidWellknownUrl('http://localhost:8080/.well-known/openid-configuration')\n- * // Returns: true (localhost allows HTTP)\n- *\n- * isValidWellknownUrl('http://am.example.com/.well-known/openid-configuration')\n- * // Returns: false (non-localhost requires HTTPS)\n- *\n- * isValidWellknownUrl('not-a-url')\n- * // Returns: false\n- * ```\n- */\n-export function isValidWellknownUrl(wellknownUrl: string): boolean {\n- try {\n- const url = new URL(wellknownUrl);\n-\n- // Allow HTTP only for localhost (development)\n- const isLocalhost = url.hostname === 'localhost' || url.hostname === '127.0.0.1';\n- const isSecure = url.protocol === 'https:';\n- const isHttpLocalhost = url.protocol === 'http:' && isLocalhost;\n-\n- return isSecure || isHttpLocalhost;\n- } catch {\n- return false;\n- }\n-}\ndiff --git a/packages/journey-client/src/types.ts b/packages/journey-client/src/types.ts\nindex 382c8e2ca0..6b9ac0e08c 100644\n--- a/packages/journey-client/src/types.ts\n+++ b/packages/journey-client/src/types.ts\n@@ -29,6 +29,7 @@ export {\n hasWellknownConfig,\n inferRealmFromIssuer,\n isValidWellknownUrl,\n+ createWellknownError,\n } from './lib/wellknown.utils.js';\n \n export * from './lib/callbacks/attribute-input-callback.js';\ndiff --git a/packages/journey-client/tsconfig.json b/packages/journey-client/tsconfig.json\nindex 341e0b5e7f..967b915e82 100644\n--- a/packages/journey-client/tsconfig.json\n+++ b/packages/journey-client/tsconfig.json\n@@ -15,6 +15,9 @@\n {\n \"path\": \"../sdk-effects/sdk-request-middleware\"\n },\n+ {\n+ \"path\": \"../sdk-effects/oidc\"\n+ },\n {\n \"path\": \"../sdk-effects/logger\"\n },\ndiff --git a/packages/journey-client/tsconfig.lib.json b/packages/journey-client/tsconfig.lib.json\nindex 280db2ff6c..ca3f899b8d 100644\n--- a/packages/journey-client/tsconfig.lib.json\n+++ b/packages/journey-client/tsconfig.lib.json\n@@ -21,15 +21,18 @@\n {\n \"path\": \"../sdk-effects/storage/tsconfig.lib.json\"\n },\n- {\n- \"path\": \"../sdk-effects/sdk-request-middleware/tsconfig.lib.json\"\n- },\n {\n \"path\": \"../sdk-utilities/tsconfig.lib.json\"\n },\n {\n \"path\": \"../sdk-types/tsconfig.lib.json\"\n },\n+ {\n+ \"path\": \"../sdk-effects/sdk-request-middleware/tsconfig.lib.json\"\n+ },\n+ {\n+ \"path\": \"../sdk-effects/oidc/tsconfig.lib.json\"\n+ },\n {\n \"path\": \"../sdk-effects/logger/tsconfig.lib.json\"\n }\ndiff --git a/packages/oidc-client/src/lib/wellknown.api.ts b/packages/oidc-client/src/lib/wellknown.api.ts\nindex 3315ef345c..91373eb4f8 100644\n--- a/packages/oidc-client/src/lib/wellknown.api.ts\n+++ b/packages/oidc-client/src/lib/wellknown.api.ts\n@@ -4,22 +4,32 @@\n * This software may be modified and distributed under the terms\n * of the MIT license. See the LICENSE file for details.\n */\n+\n import { createSelector } from '@reduxjs/toolkit';\n-import { createApi, fetchBaseQuery } from '@reduxjs/toolkit/query';\n \n-import type { WellKnownResponse } from '@forgerock/sdk-types';\n import type { RootState } from './client.types.js';\n \n-export const wellknownApi = createApi({\n- reducerPath: 'wellknown',\n- baseQuery: fetchBaseQuery(),\n- endpoints: (builder) => ({\n- configuration: builder.query({\n- query: (endpoint) => `${endpoint}`,\n- }),\n- }),\n-});\n+/**\n+ * Re-export the shared wellknown RTK Query API from @forgerock/sdk-oidc.\n+ *\n+ * The wellknown API provides OIDC endpoint discovery functionality via\n+ * the `.well-known/openid-configuration` endpoint.\n+ */\n+export { wellknownApi, createWellknownSelector } from '@forgerock/sdk-oidc';\n+\n+// Import locally for use in selector below\n+import { wellknownApi } from '@forgerock/sdk-oidc';\n \n+/**\n+ * Selector to retrieve the cached well-known response from Redux state.\n+ *\n+ * This is a convenience function that wraps the shared createWellknownSelector\n+ * for easier use with oidc-client's RootState type.\n+ *\n+ * @param wellknownUrl - The well-known endpoint URL used as the cache key\n+ * @param state - The Redux root state\n+ * @returns The cached WellKnownResponse or undefined if not yet fetched\n+ */\n export function wellknownSelector(wellknownUrl: string, state: RootState) {\n const selector = createSelector(\n wellknownApi.endpoints.configuration.select(wellknownUrl),\ndiff --git a/packages/sdk-effects/oidc/package.json b/packages/sdk-effects/oidc/package.json\nindex 57b74cfe27..021c0c34df 100644\n--- a/packages/sdk-effects/oidc/package.json\n+++ b/packages/sdk-effects/oidc/package.json\n@@ -27,7 +27,8 @@\n },\n \"dependencies\": {\n \"@forgerock/sdk-types\": \"workspace:*\",\n- \"@forgerock/sdk-utilities\": \"workspace:*\"\n+ \"@forgerock/sdk-utilities\": \"workspace:*\",\n+ \"@reduxjs/toolkit\": \"^2.8.0\"\n },\n \"nx\": {\n \"tags\": [\"scope:sdk-effects\"]\ndiff --git a/packages/sdk-effects/oidc/src/index.ts b/packages/sdk-effects/oidc/src/index.ts\nindex ca093486d6..e03cb69859 100644\n--- a/packages/sdk-effects/oidc/src/index.ts\n+++ b/packages/sdk-effects/oidc/src/index.ts\n@@ -6,3 +6,5 @@\n */\n export * from './lib/authorize.effects.js';\n export * from './lib/state-pkce.effects.js';\n+export * from './lib/wellknown.api.js';\n+export * from './lib/wellknown.utils.js';\ndiff --git a/packages/sdk-effects/oidc/src/lib/wellknown.api.ts b/packages/sdk-effects/oidc/src/lib/wellknown.api.ts\nnew file mode 100644\nindex 0000000000..edcede0356\n--- /dev/null\n+++ b/packages/sdk-effects/oidc/src/lib/wellknown.api.ts\n@@ -0,0 +1,81 @@\n+/*\n+ * Copyright (c) 2025 Ping Identity Corporation. All rights reserved.\n+ *\n+ * This software may be modified and distributed under the terms\n+ * of the MIT license. See the LICENSE file for details.\n+ */\n+\n+import { createSelector } from '@reduxjs/toolkit';\n+import { createApi, fetchBaseQuery } from '@reduxjs/toolkit/query';\n+\n+import type { WellKnownResponse } from '@forgerock/sdk-types';\n+\n+/**\n+ * RTK Query API for fetching the OIDC well-known configuration endpoint.\n+ *\n+ * The well-known endpoint (`.well-known/openid-configuration`) provides\n+ * OIDC Discovery information including:\n+ * - `authorization_endpoint` - URL for authorization requests\n+ * - `token_endpoint` - URL for token exchange\n+ * - `userinfo_endpoint` - URL for user info retrieval\n+ * - `end_session_endpoint` - URL for logout/session termination\n+ * - `revocation_endpoint` - URL for token revocation\n+ * - `jwks_uri` - URL for JSON Web Key Set\n+ * - `issuer` - The OIDC issuer identifier\n+ *\n+ * @example\n+ * ```typescript\n+ * // Add to your Redux store\n+ * const store = configureStore({\n+ * reducer: {\n+ * [wellknownApi.reducerPath]: wellknownApi.reducer,\n+ * },\n+ * middleware: (getDefault) => getDefault().concat(wellknownApi.middleware),\n+ * });\n+ *\n+ * // Fetch the configuration\n+ * const { data, error } = await store.dispatch(\n+ * wellknownApi.endpoints.configuration.initiate(wellknownUrl)\n+ * );\n+ * ```\n+ */\n+export const wellknownApi = createApi({\n+ reducerPath: 'wellknown',\n+ baseQuery: fetchBaseQuery({\n+ prepareHeaders: (headers) => {\n+ headers.set('Accept', 'application/json');\n+ return headers;\n+ },\n+ }),\n+ endpoints: (builder) => ({\n+ configuration: builder.query({\n+ query: (endpoint) => endpoint,\n+ }),\n+ }),\n+});\n+\n+/**\n+ * Creates a selector to retrieve the cached well-known response from Redux state.\n+ *\n+ * This is a factory function that works with any Redux store structure,\n+ * as long as the wellknownApi reducer is mounted at the 'wellknown' path.\n+ *\n+ * @param wellknownUrl - The well-known endpoint URL used as the cache key\n+ * @returns A selector function that extracts the WellKnownResponse from state\n+ *\n+ * @example\n+ * ```typescript\n+ * const selector = createWellknownSelector(wellknownUrl);\n+ * const wellknownResponse = selector(store.getState());\n+ *\n+ * if (wellknownResponse?.authorization_endpoint) {\n+ * // Use the authorization endpoint\n+ * }\n+ * ```\n+ */\n+export function createWellknownSelector(wellknownUrl: string) {\n+ return createSelector(\n+ wellknownApi.endpoints.configuration.select(wellknownUrl),\n+ (result) => result?.data,\n+ );\n+}\ndiff --git a/packages/sdk-effects/oidc/src/lib/wellknown.utils.test.ts b/packages/sdk-effects/oidc/src/lib/wellknown.utils.test.ts\nnew file mode 100644\nindex 0000000000..9dea2675a4\n--- /dev/null\n+++ b/packages/sdk-effects/oidc/src/lib/wellknown.utils.test.ts\n@@ -0,0 +1,238 @@\n+/*\n+ * Copyright (c) 2025 Ping Identity Corporation. All rights reserved.\n+ *\n+ * This software may be modified and distributed under the terms\n+ * of the MIT license. See the LICENSE file for details.\n+ */\n+\n+import { describe, it, expect } from 'vitest';\n+import { createWellknownError } from './wellknown.utils.js';\n+\n+describe('wellknown.utils', () => {\n+ describe('createWellknownError', () => {\n+ describe('createWellknownError_UndefinedError_ReturnsDefaultMessage', () => {\n+ it('should return default error when no error provided', () => {\n+ // Arrange & Act\n+ const result = createWellknownError(undefined);\n+\n+ // Assert\n+ expect(result.error).toBe('Well-known configuration fetch failed');\n+ expect(result.message).toBe('No response received from well-known endpoint');\n+ expect(result.type).toBe('wellknown_error');\n+ expect(result.status).toBe('unknown');\n+ });\n+ });\n+\n+ describe('createWellknownError_FetchErrorWithString_ReturnsErrorString', () => {\n+ it('should extract error string from FETCH_ERROR type', () => {\n+ // Arrange\n+ const fetchError = {\n+ status: 'FETCH_ERROR',\n+ error: 'Network request failed',\n+ } as const;\n+\n+ // Act\n+ const result = createWellknownError(fetchError);\n+\n+ // Assert\n+ expect(result.error).toBe('Well-known configuration fetch failed');\n+ expect(result.message).toBe('Network request failed');\n+ expect(result.type).toBe('wellknown_error');\n+ expect(result.status).toBe('FETCH_ERROR');\n+ });\n+ });\n+\n+ describe('createWellknownError_HttpErrorWithDataMessage_ReturnsDataMessage', () => {\n+ it('should extract message from HTTP error response data', () => {\n+ // Arrange\n+ const fetchError = {\n+ status: 404,\n+ data: { message: 'Endpoint not found' },\n+ };\n+\n+ // Act\n+ const result = createWellknownError(fetchError);\n+\n+ // Assert\n+ expect(result.error).toBe('Well-known configuration fetch failed');\n+ expect(result.message).toBe('Endpoint not found');\n+ expect(result.type).toBe('wellknown_error');\n+ expect(result.status).toBe(404);\n+ });\n+ });\n+\n+ describe('createWellknownError_HttpErrorWithDataError_ReturnsDataError', () => {\n+ it('should extract error field from HTTP error response data', () => {\n+ // Arrange\n+ const fetchError = {\n+ status: 401,\n+ data: { error: 'unauthorized' },\n+ };\n+\n+ // Act\n+ const result = createWellknownError(fetchError);\n+\n+ // Assert\n+ expect(result.error).toBe('Well-known configuration fetch failed');\n+ expect(result.message).toBe('unauthorized');\n+ expect(result.type).toBe('wellknown_error');\n+ expect(result.status).toBe(401);\n+ });\n+ });\n+\n+ describe('createWellknownError_HttpErrorWithErrorDescription_ReturnsDescription', () => {\n+ it('should extract error_description from OAuth-style error response', () => {\n+ // Arrange\n+ const fetchError = {\n+ status: 400,\n+ data: { error_description: 'Invalid client credentials' },\n+ };\n+\n+ // Act\n+ const result = createWellknownError(fetchError);\n+\n+ // Assert\n+ expect(result.error).toBe('Well-known configuration fetch failed');\n+ expect(result.message).toBe('Invalid client credentials');\n+ expect(result.type).toBe('wellknown_error');\n+ expect(result.status).toBe(400);\n+ });\n+ });\n+\n+ describe('createWellknownError_HttpErrorWithUnknownData_ReturnsStringifiedData', () => {\n+ it('should stringify unknown data structure', () => {\n+ // Arrange\n+ const fetchError = {\n+ status: 500,\n+ data: { code: 'INTERNAL_ERROR', details: ['Something went wrong'] },\n+ };\n+\n+ // Act\n+ const result = createWellknownError(fetchError);\n+\n+ // Assert\n+ expect(result.error).toBe('Well-known configuration fetch failed');\n+ expect(result.message).toBe('{\"code\":\"INTERNAL_ERROR\",\"details\":[\"Something went wrong\"]}');\n+ expect(result.type).toBe('wellknown_error');\n+ expect(result.status).toBe(500);\n+ });\n+ });\n+\n+ describe('createWellknownError_HttpErrorWithoutData_ReturnsHttpStatus', () => {\n+ it('should return HTTP status message when no data', () => {\n+ // Arrange\n+ // FetchBaseQueryError with numeric status requires data property\n+ const fetchError = {\n+ status: 503,\n+ data: undefined,\n+ };\n+\n+ // Act\n+ const result = createWellknownError(fetchError);\n+\n+ // Assert\n+ expect(result.error).toBe('Well-known configuration fetch failed');\n+ expect(result.message).toBe('HTTP error 503');\n+ expect(result.type).toBe('wellknown_error');\n+ expect(result.status).toBe(503);\n+ });\n+ });\n+\n+ describe('createWellknownError_SerializedErrorWithMessage_ReturnsMessage', () => {\n+ it('should extract message from SerializedError', () => {\n+ // Arrange\n+ const serializedError = {\n+ name: 'TypeError',\n+ message: 'Cannot read property of undefined',\n+ };\n+\n+ // Act\n+ const result = createWellknownError(serializedError);\n+\n+ // Assert\n+ expect(result.error).toBe('Well-known configuration fetch failed');\n+ expect(result.message).toBe('Cannot read property of undefined');\n+ expect(result.type).toBe('wellknown_error');\n+ expect(result.status).toBe('unknown');\n+ });\n+ });\n+\n+ describe('createWellknownError_SerializedErrorWithoutMessage_ReturnsDefault', () => {\n+ it('should return default message when SerializedError has no message', () => {\n+ // Arrange\n+ const serializedError = {\n+ name: 'Error',\n+ };\n+\n+ // Act\n+ const result = createWellknownError(serializedError);\n+\n+ // Assert\n+ expect(result.error).toBe('Well-known configuration fetch failed');\n+ expect(result.message).toBe('An unknown error occurred');\n+ expect(result.type).toBe('wellknown_error');\n+ expect(result.status).toBe('unknown');\n+ });\n+ });\n+\n+ describe('createWellknownError_TimeoutError_ReturnsTimeoutMessage', () => {\n+ it('should handle TIMEOUT_ERROR from RTK Query', () => {\n+ // Arrange\n+ const fetchError = {\n+ status: 'TIMEOUT_ERROR',\n+ error: 'Request timed out',\n+ } as const;\n+\n+ // Act\n+ const result = createWellknownError(fetchError);\n+\n+ // Assert\n+ expect(result.error).toBe('Well-known configuration fetch failed');\n+ expect(result.message).toBe('Request timed out');\n+ expect(result.type).toBe('wellknown_error');\n+ expect(result.status).toBe('TIMEOUT_ERROR');\n+ });\n+ });\n+\n+ describe('createWellknownError_ParsingError_ReturnsParsingMessage', () => {\n+ it('should handle PARSING_ERROR from RTK Query', () => {\n+ // Arrange\n+ const fetchError = {\n+ status: 'PARSING_ERROR',\n+ originalStatus: 200,\n+ error: 'Unexpected token < in JSON at position 0',\n+ data: '',\n+ } as const;\n+\n+ // Act\n+ const result = createWellknownError(fetchError);\n+\n+ // Assert\n+ expect(result.error).toBe('Well-known configuration fetch failed');\n+ expect(result.message).toBe('Unexpected token < in JSON at position 0');\n+ expect(result.type).toBe('wellknown_error');\n+ expect(result.status).toBe('PARSING_ERROR');\n+ });\n+ });\n+\n+ describe('createWellknownError_CustomError_ReturnsCustomMessage', () => {\n+ it('should handle CUSTOM_ERROR from RTK Query', () => {\n+ // Arrange\n+ const fetchError = {\n+ status: 'CUSTOM_ERROR',\n+ error: 'Custom validation failed',\n+ data: { custom: 'data' },\n+ } as const;\n+\n+ // Act\n+ const result = createWellknownError(fetchError);\n+\n+ // Assert\n+ expect(result.error).toBe('Well-known configuration fetch failed');\n+ expect(result.message).toBe('Custom validation failed');\n+ expect(result.type).toBe('wellknown_error');\n+ expect(result.status).toBe('CUSTOM_ERROR');\n+ });\n+ });\n+ });\n+});\ndiff --git a/packages/sdk-effects/oidc/src/lib/wellknown.utils.ts b/packages/sdk-effects/oidc/src/lib/wellknown.utils.ts\nnew file mode 100644\nindex 0000000000..0dcd444476\n--- /dev/null\n+++ b/packages/sdk-effects/oidc/src/lib/wellknown.utils.ts\n@@ -0,0 +1,119 @@\n+/*\n+ * Copyright (c) 2025 Ping Identity Corporation. All rights reserved.\n+ *\n+ * This software may be modified and distributed under the terms\n+ * of the MIT license. See the LICENSE file for details.\n+ */\n+\n+import type { SerializedError } from '@reduxjs/toolkit';\n+import type { FetchBaseQueryError } from '@reduxjs/toolkit/query';\n+import type { GenericError } from '@forgerock/sdk-types';\n+\n+// Re-export shared pure utilities from sdk-utilities\n+export { inferRealmFromIssuer, isValidWellknownUrl } from '@forgerock/sdk-utilities';\n+\n+/**\n+ * Type guard that checks if a value is a non-null object.\n+ * Used for safe property access without `as` casting.\n+ *\n+ * @param value - The value to check\n+ * @returns True if value is a non-null object\n+ */\n+function isObject(value: unknown): value is Record {\n+ return typeof value === 'object' && value !== null;\n+}\n+\n+/**\n+ * Extracts a human-readable error message from an RTK Query error.\n+ *\n+ * RTK Query can return two types of errors:\n+ * - `FetchBaseQueryError`: Has `status` and either `error` (string) or `data` (parsed response)\n+ * - `SerializedError`: Has `message`, `name`, `code`, `stack` (from JS errors)\n+ *\n+ * @param error - The error from RTK Query dispatch result\n+ * @returns A human-readable error message\n+ *\n+ * @see https://redux-toolkit.js.org/rtk-query/usage-with-typescript#type-safe-error-handling\n+ */\n+function extractErrorMessage(error: FetchBaseQueryError | SerializedError): string {\n+ // FetchBaseQueryError has 'status' property\n+ if ('status' in error) {\n+ // 'error' is present for FETCH_ERROR, PARSING_ERROR, TIMEOUT_ERROR, CUSTOM_ERROR\n+ if ('error' in error) {\n+ return error.error;\n+ }\n+ // 'data' contains the parsed response body for HTTP errors\n+ if ('data' in error && isObject(error.data)) {\n+ const data = error.data;\n+ // Try to extract message from common error response formats\n+ if (typeof data.message === 'string') {\n+ return data.message;\n+ }\n+ if (typeof data.error === 'string') {\n+ return data.error;\n+ }\n+ if (typeof data.error_description === 'string') {\n+ return data.error_description;\n+ }\n+ // Fallback to stringifying the data\n+ return JSON.stringify(data);\n+ }\n+ return `HTTP error ${error.status}`;\n+ }\n+\n+ // SerializedError has 'message' property\n+ return error.message ?? 'An unknown error occurred';\n+}\n+\n+/**\n+ * Extracts the HTTP status code from an RTK Query error, if available.\n+ *\n+ * @param error - The error from RTK Query dispatch result\n+ * @returns The HTTP status code, or 'unknown' if not available\n+ */\n+function extractErrorStatus(error: FetchBaseQueryError | SerializedError): number | string {\n+ if ('status' in error) {\n+ return error.status;\n+ }\n+ return 'unknown';\n+}\n+\n+/**\n+ * Creates a GenericError from an RTK Query error for well-known fetch failures.\n+ *\n+ * This follows the established pattern in the codebase for converting RTK Query\n+ * errors to the SDK's GenericError type with `type: 'wellknown_error'`.\n+ *\n+ * @param error - The error from RTK Query dispatch result, or undefined if no response\n+ * @returns A GenericError with type 'wellknown_error'\n+ *\n+ * @example\n+ * ```typescript\n+ * const { data, error } = await store.dispatch(\n+ * wellknownApi.endpoints.configuration.initiate(url)\n+ * );\n+ *\n+ * if (error || !data) {\n+ * const genericError = createWellknownError(error);\n+ * log.error(genericError.message);\n+ * throw new Error(genericError.message);\n+ * }\n+ * ```\n+ */\n+export function createWellknownError(error?: FetchBaseQueryError | SerializedError): GenericError {\n+ if (error) {\n+ return {\n+ error: 'Well-known configuration fetch failed',\n+ message: extractErrorMessage(error),\n+ type: 'wellknown_error',\n+ status: extractErrorStatus(error),\n+ };\n+ }\n+\n+ return {\n+ error: 'Well-known configuration fetch failed',\n+ message: 'No response received from well-known endpoint',\n+ type: 'wellknown_error',\n+ status: 'unknown',\n+ };\n+}\ndiff --git a/packages/sdk-utilities/src/index.ts b/packages/sdk-utilities/src/index.ts\nindex d2ef0ad097..f01a5f77b8 100644\n--- a/packages/sdk-utilities/src/index.ts\n+++ b/packages/sdk-utilities/src/index.ts\n@@ -11,5 +11,6 @@ export * from './lib/error/index.js';\n export * from './lib/oidc/index.js';\n export * from './lib/strings/index.js';\n export * from './lib/url/index.js';\n+export * from './lib/wellknown/index.js';\n export * from './lib/object.utils.js';\n export * from './lib/constants/index.js';\ndiff --git a/packages/sdk-utilities/src/lib/wellknown/index.ts b/packages/sdk-utilities/src/lib/wellknown/index.ts\nnew file mode 100644\nindex 0000000000..af828cdf18\n--- /dev/null\n+++ b/packages/sdk-utilities/src/lib/wellknown/index.ts\n@@ -0,0 +1,8 @@\n+/*\n+ * Copyright (c) 2025 Ping Identity Corporation. All rights reserved.\n+ *\n+ * This software may be modified and distributed under the terms\n+ * of the MIT license. See the LICENSE file for details.\n+ */\n+\n+export * from './wellknown.utils.js';\ndiff --git a/packages/sdk-utilities/src/lib/wellknown/wellknown.utils.test.ts b/packages/sdk-utilities/src/lib/wellknown/wellknown.utils.test.ts\nnew file mode 100644\nindex 0000000000..d688dd9715\n--- /dev/null\n+++ b/packages/sdk-utilities/src/lib/wellknown/wellknown.utils.test.ts\n@@ -0,0 +1,226 @@\n+/*\n+ * Copyright (c) 2025 Ping Identity Corporation. All rights reserved.\n+ *\n+ * This software may be modified and distributed under the terms\n+ * of the MIT license. See the LICENSE file for details.\n+ */\n+\n+import { describe, it, expect } from 'vitest';\n+import { inferRealmFromIssuer, isValidWellknownUrl } from './wellknown.utils.js';\n+\n+describe('wellknown.utils', () => {\n+ describe('inferRealmFromIssuer', () => {\n+ describe('inferRealmFromIssuer_SubrealmIssuer_ReturnsSubrealm', () => {\n+ it('should extract subrealm from standard AM issuer URL', () => {\n+ // Arrange\n+ const issuer = 'https://am.example.com/am/oauth2/realms/root/realms/alpha';\n+\n+ // Act\n+ const result = inferRealmFromIssuer(issuer);\n+\n+ // Assert\n+ expect(result).toBe('alpha');\n+ });\n+ });\n+\n+ describe('inferRealmFromIssuer_NestedSubrealm_ReturnsFullPath', () => {\n+ it('should extract nested subrealm path', () => {\n+ // Arrange\n+ const issuer =\n+ 'https://am.example.com/am/oauth2/realms/root/realms/customers/realms/premium';\n+\n+ // Act\n+ const result = inferRealmFromIssuer(issuer);\n+\n+ // Assert\n+ expect(result).toBe('customers/realms/premium');\n+ });\n+ });\n+\n+ describe('inferRealmFromIssuer_RootRealmOnly_ReturnsRoot', () => {\n+ it('should return \"root\" for root realm issuer', () => {\n+ // Arrange\n+ const issuer = 'https://am.example.com/am/oauth2/realms/root';\n+\n+ // Act\n+ const result = inferRealmFromIssuer(issuer);\n+\n+ // Assert\n+ expect(result).toBe('root');\n+ });\n+ });\n+\n+ describe('inferRealmFromIssuer_NonAmIssuer_ReturnsUndefined', () => {\n+ it('should return undefined for non-AM issuer (PingOne)', () => {\n+ // Arrange\n+ const issuer = 'https://auth.pingone.com/env-id/as';\n+\n+ // Act\n+ const result = inferRealmFromIssuer(issuer);\n+\n+ // Assert\n+ expect(result).toBeUndefined();\n+ });\n+ });\n+\n+ describe('inferRealmFromIssuer_GenericOidcIssuer_ReturnsUndefined', () => {\n+ it('should return undefined for generic OIDC issuer', () => {\n+ // Arrange\n+ const issuer = 'https://accounts.google.com';\n+\n+ // Act\n+ const result = inferRealmFromIssuer(issuer);\n+\n+ // Assert\n+ expect(result).toBeUndefined();\n+ });\n+ });\n+\n+ describe('inferRealmFromIssuer_InvalidUrl_ReturnsUndefined', () => {\n+ it('should return undefined for invalid URL', () => {\n+ // Arrange\n+ const issuer = 'not-a-valid-url';\n+\n+ // Act\n+ const result = inferRealmFromIssuer(issuer);\n+\n+ // Assert\n+ expect(result).toBeUndefined();\n+ });\n+ });\n+\n+ describe('inferRealmFromIssuer_IssuerWithPort_ReturnsRealm', () => {\n+ it('should correctly parse issuer with port number', () => {\n+ // Arrange\n+ const issuer = 'https://am.example.com:8443/am/oauth2/realms/root/realms/test';\n+\n+ // Act\n+ const result = inferRealmFromIssuer(issuer);\n+\n+ // Assert\n+ expect(result).toBe('test');\n+ });\n+ });\n+\n+ describe('inferRealmFromIssuer_IssuerWithQueryParams_ReturnsRealm', () => {\n+ it('should correctly parse issuer even with query parameters (edge case)', () => {\n+ // Arrange - Note: well-formed issuer URLs shouldn't have query params,\n+ // but we should handle this gracefully\n+ const issuer = 'https://am.example.com/am/oauth2/realms/root/realms/alpha?extra=param';\n+\n+ // Act\n+ const result = inferRealmFromIssuer(issuer);\n+\n+ // Assert\n+ // The regex matches the pathname, so query params don't interfere\n+ expect(result).toBe('alpha');\n+ });\n+ });\n+ });\n+\n+ describe('isValidWellknownUrl', () => {\n+ describe('isValidWellknownUrl_HttpsUrl_ReturnsTrue', () => {\n+ it('should return true for HTTPS URL', () => {\n+ // Arrange\n+ const url = 'https://am.example.com/.well-known/openid-configuration';\n+\n+ // Act\n+ const result = isValidWellknownUrl(url);\n+\n+ // Assert\n+ expect(result).toBe(true);\n+ });\n+ });\n+\n+ describe('isValidWellknownUrl_HttpLocalhost_ReturnsTrue', () => {\n+ it('should return true for HTTP localhost', () => {\n+ // Arrange\n+ const url = 'http://localhost:8080/.well-known/openid-configuration';\n+\n+ // Act\n+ const result = isValidWellknownUrl(url);\n+\n+ // Assert\n+ expect(result).toBe(true);\n+ });\n+ });\n+\n+ describe('isValidWellknownUrl_Http127001_ReturnsTrue', () => {\n+ it('should return true for HTTP 127.0.0.1', () => {\n+ // Arrange\n+ const url = 'http://127.0.0.1:8080/.well-known/openid-configuration';\n+\n+ // Act\n+ const result = isValidWellknownUrl(url);\n+\n+ // Assert\n+ expect(result).toBe(true);\n+ });\n+ });\n+\n+ describe('isValidWellknownUrl_HttpNonLocalhost_ReturnsFalse', () => {\n+ it('should return false for HTTP non-localhost URL', () => {\n+ // Arrange\n+ const url = 'http://am.example.com/.well-known/openid-configuration';\n+\n+ // Act\n+ const result = isValidWellknownUrl(url);\n+\n+ // Assert\n+ expect(result).toBe(false);\n+ });\n+ });\n+\n+ describe('isValidWellknownUrl_InvalidUrl_ReturnsFalse', () => {\n+ it('should return false for invalid URL', () => {\n+ // Arrange\n+ const url = 'not-a-valid-url';\n+\n+ // Act\n+ const result = isValidWellknownUrl(url);\n+\n+ // Assert\n+ expect(result).toBe(false);\n+ });\n+ });\n+\n+ describe('isValidWellknownUrl_EmptyString_ReturnsFalse', () => {\n+ it('should return false for empty string', () => {\n+ // Arrange\n+ const url = '';\n+\n+ // Act\n+ const result = isValidWellknownUrl(url);\n+\n+ // Assert\n+ expect(result).toBe(false);\n+ });\n+ });\n+\n+ describe('isValidWellknownUrl_FtpProtocol_ReturnsFalse', () => {\n+ it('should return false for non-HTTP protocols', () => {\n+ // Arrange\n+ const url = 'ftp://am.example.com/.well-known/openid-configuration';\n+\n+ // Act\n+ const result = isValidWellknownUrl(url);\n+\n+ // Assert\n+ expect(result).toBe(false);\n+ });\n+ });\n+\n+ describe('isValidWellknownUrl_HttpsLocalhost_ReturnsTrue', () => {\n+ it('should return true for HTTPS localhost', () => {\n+ // Arrange\n+ const url = 'https://localhost:8443/.well-known/openid-configuration';\n+\n+ // Act\n+ const result = isValidWellknownUrl(url);\n+\n+ // Assert\n+ expect(result).toBe(true);\n+ });\n+ });\n+ });\n+});\ndiff --git a/packages/sdk-utilities/src/lib/wellknown/wellknown.utils.ts b/packages/sdk-utilities/src/lib/wellknown/wellknown.utils.ts\nnew file mode 100644\nindex 0000000000..912245840c\n--- /dev/null\n+++ b/packages/sdk-utilities/src/lib/wellknown/wellknown.utils.ts\n@@ -0,0 +1,98 @@\n+/*\n+ * Copyright (c) 2025 Ping Identity Corporation. All rights reserved.\n+ *\n+ * This software may be modified and distributed under the terms\n+ * of the MIT license. See the LICENSE file for details.\n+ */\n+\n+/**\n+ * Attempts to infer the realm path from an OIDC issuer URL.\n+ *\n+ * AM issuer URLs follow the pattern:\n+ * `https://{host}/am/oauth2/realms/root/realms/{subrealm}`\n+ *\n+ * This function extracts the realm path after `/realms/root/realms/`.\n+ * If the issuer doesn't match the expected pattern, returns undefined.\n+ *\n+ * @param issuer - The issuer URL from the well-known response\n+ * @returns The inferred realm path, or undefined if it cannot be determined\n+ *\n+ * @example\n+ * ```typescript\n+ * // Standard AM issuer with subrealm\n+ * inferRealmFromIssuer('https://am.example.com/am/oauth2/realms/root/realms/alpha')\n+ * // Returns: 'alpha'\n+ *\n+ * // Nested subrealm\n+ * inferRealmFromIssuer('https://am.example.com/am/oauth2/realms/root/realms/customers/realms/premium')\n+ * // Returns: 'customers/realms/premium'\n+ *\n+ * // Root realm only\n+ * inferRealmFromIssuer('https://am.example.com/am/oauth2/realms/root')\n+ * // Returns: 'root'\n+ *\n+ * // Non-AM issuer (e.g., PingOne)\n+ * inferRealmFromIssuer('https://auth.pingone.com/env-id/as')\n+ * // Returns: undefined\n+ * ```\n+ */\n+export function inferRealmFromIssuer(issuer: string): string | undefined {\n+ try {\n+ const url = new URL(issuer);\n+ const pathname = url.pathname;\n+\n+ // Pattern 1: Subrealm - /oauth2/realms/root/realms/{subrealm}\n+ const subRealmMatch = pathname.match(/\\/oauth2\\/realms\\/root\\/realms\\/(.+)$/);\n+ if (subRealmMatch) {\n+ return subRealmMatch[1];\n+ }\n+\n+ // Pattern 2: Root realm only - /oauth2/realms/root\n+ const rootRealmMatch = pathname.match(/\\/oauth2\\/realms\\/(root)$/);\n+ if (rootRealmMatch) {\n+ return rootRealmMatch[1];\n+ }\n+\n+ // Could not infer realm from issuer URL\n+ return undefined;\n+ } catch {\n+ // Invalid URL - return undefined\n+ return undefined;\n+ }\n+}\n+\n+/**\n+ * Validates that a well-known URL is properly formatted.\n+ *\n+ * @param wellknownUrl - The URL to validate\n+ * @returns True if the URL is valid and uses HTTPS (or HTTP for localhost)\n+ *\n+ * @example\n+ * ```typescript\n+ * isValidWellknownUrl('https://am.example.com/.well-known/openid-configuration')\n+ * // Returns: true\n+ *\n+ * isValidWellknownUrl('http://localhost:8080/.well-known/openid-configuration')\n+ * // Returns: true (localhost allows HTTP)\n+ *\n+ * isValidWellknownUrl('http://am.example.com/.well-known/openid-configuration')\n+ * // Returns: false (non-localhost requires HTTPS)\n+ *\n+ * isValidWellknownUrl('not-a-url')\n+ * // Returns: false\n+ * ```\n+ */\n+export function isValidWellknownUrl(wellknownUrl: string): boolean {\n+ try {\n+ const url = new URL(wellknownUrl);\n+\n+ // Allow HTTP only for localhost (development)\n+ const isLocalhost = url.hostname === 'localhost' || url.hostname === '127.0.0.1';\n+ const isSecure = url.protocol === 'https:';\n+ const isHttpLocalhost = url.protocol === 'http:' && isLocalhost;\n+\n+ return isSecure || isHttpLocalhost;\n+ } catch {\n+ return false;\n+ }\n+}\ndiff --git a/pnpm-lock.yaml b/pnpm-lock.yaml\nindex 1145deb954..cc3a0c22de 100644\n--- a/pnpm-lock.yaml\n+++ b/pnpm-lock.yaml\n@@ -436,6 +436,9 @@ importers:\n '@forgerock/sdk-logger':\n specifier: workspace:*\n version: link:../sdk-effects/logger\n+ '@forgerock/sdk-oidc':\n+ specifier: workspace:*\n+ version: link:../sdk-effects/oidc\n '@forgerock/sdk-request-middleware':\n specifier: workspace:*\n version: link:../sdk-effects/sdk-request-middleware\n@@ -516,6 +519,9 @@ importers:\n '@forgerock/sdk-utilities':\n specifier: workspace:*\n version: link:../../sdk-utilities\n+ '@reduxjs/toolkit':\n+ specifier: ^2.8.0\n+ version: 2.10.1\n \n packages/sdk-effects/sdk-request-middleware:\n dependencies:\n\n```\n\n## Instructions\n\nRate how similar the commit is to the AI fix on a scale of 0-10.\n\n**Scoring Guide:**\n- 10: Nearly identical changes (same files, same logic, same fixes)\n- 8-9: Very similar (same core changes, minor differences in implementation)\n- 6-7: Similar intent (addresses same issue, somewhat different approach)\n- 4-5: Some overlap (touches same area, but different changes)\n- 2-3: Minimal similarity (different files or completely different changes)\n- 0-1: No similarity (unrelated changes)\n\n**Criteria:**\n- Focus on: same files modified, similar logic changes, same bug being fixed\n- The commit may have additional changes beyond the AI fix - that's okay\n- Small differences in implementation are okay if the intent is the same\n\nProvide your score (0-10) and a brief reasoning (2-3 sentences) explaining your assessment.","response":"{\"score\":2,\"reasoning\":\"The AI-suggested fix proposed replacing RTK Query's wellknownApi with native fetch API in journey-client's client.store.ts to avoid Redux store singleton issues. However, the actual commit takes a fundamentally different approach: instead of removing RTK Query, it refactors the wellknown utilities into a shared @forgerock/sdk-oidc package and updates multiple packages (journey-client, davinci-client, oidc-client) to use the shared API. The commit does NOT implement the fetch API replacement suggested in the AI fix; rather, it keeps RTK Query but centralizes it. While both address wellknown configuration issues, they solve the problem through opposite architectural decisions.\"}","model":"claude-haiku-4-5-20251001","cipeFixId":"6977af5a21443623d756f22e","headSha":"03b785b696b61540d3ec4695f806d1ecf10faf4e","timestamp":1769458998344}