@dual-os/sdk 0.0.0-stage → 0.8.0-next.0

package/dist/OAuthFlow.js

@@ -0,0 +1,488 @@
+import { __exportAll } from "./_virtual/_rolldown/runtime.js";
+import { Service as Service$1 } from "./OAuth2TokenRefresher.js";
+import { OAuth2ProviderTokenResponse } from "./AuthMethod.js";
+import "./OAuthFlow.js";
+import { Array, Clock, ConfigProvider, Context, Effect, HashSet, Layer, Predicate, Random, Record, Redacted, Schema, String, pipe } from "effect";
+import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/http";
+import { Base64, Base64Url } from "effect/encoding";
+//#region src/OAuthFlow.ts
+/**
+* OAuth protocol runner used by ConnectionStore.
+*
+* OAuthFlow owns provider-facing protocol mechanics: resolving OAuth client
+* configuration, optional discovery, authorization URL construction, token
+* exchange, token refresh, and token response normalization. It does not persist
+* OAuth sessions or create Connections; ConnectionStore owns those product
+* lifecycle records and calls this service for the protocol steps.
+*/
+var OAuthFlow_exports = /* @__PURE__ */ __exportAll({
+	OAuthConnectionValidationFailed: () => OAuthConnectionValidationFailed,
+	OAuthFlow: () => OAuthFlow_exports,
+	OAuthGrantRejected: () => OAuthGrantRejected,
+	OAuthProviderRejected: () => OAuthProviderRejected,
+	Service: () => Service,
+	layer: () => layer,
+	oauth2TokenRefresherLayer: () => oauth2TokenRefresherLayer,
+	testing: () => testing
+});
+var OAuthConnectionValidationFailed = class extends Schema.TaggedError()("OAuthConnectionValidationFailed", {
+	cause: Schema.optionalKey(Schema.Redacted(Schema.Defect())),
+	message: Schema.String
+}) {};
+var OAuthProviderRejected = class extends Schema.TaggedError()("OAuthProviderRejected", {
+	error: Schema.String,
+	errorDescription: Schema.optional(Schema.String)
+}) {};
+var OAuthGrantRejected = class extends Schema.TaggedError()("OAuthGrantRejected", {
+	errorSubtype: Schema.optionalKey(Schema.String),
+	message: Schema.String
+}) {};
+const DefaultFlowTtlMs = 6e5;
+Schema.Struct({
+	authorizationUrl: Schema.String,
+	expectedIssuer: Schema.optional(Schema.String),
+	tokenUrl: Schema.String
+});
+const ClientAuthentication = Schema.Union([
+	Schema.Literal("basic"),
+	Schema.Literal("post"),
+	Schema.Literal("none")
+]);
+const ReservedTokenHeaders = HashSet.fromIterable([
+	"accept",
+	"accept-charset",
+	"accept-encoding",
+	"access-control-request-headers",
+	"access-control-request-method",
+	"authorization",
+	"connection",
+	"content-encoding",
+	"content-length",
+	"content-type",
+	"cookie",
+	"cookie2",
+	"date",
+	"dnt",
+	"expect",
+	"host",
+	"keep-alive",
+	"origin",
+	"permissions-policy",
+	"referer",
+	"set-cookie",
+	"te",
+	"trailer",
+	"transfer-encoding",
+	"upgrade",
+	"user-agent",
+	"via"
+]);
+const TokenHeaders = Schema.Record(Schema.String, Schema.String.check(Schema.isPattern(/^[\t\x20-\x7e\x80-\xff]*$/u))).check(Schema.makeFilter((headers) => {
+	const names = Array.map(Record.keys(headers), String.toLowerCase);
+	return HashSet.size(HashSet.fromIterable(names)) === names.length && Array.every(names, (name) => /^[!#$%&'*+.^_`|~0-9a-z-]+$/u.test(name) && !HashSet.has(ReservedTokenHeaders, name) && !String.startsWith("proxy-")(name) && !String.startsWith("sec-")(name));
+}, { message: "Invalid provider token headers" }));
+Schema.Struct({
+	authorizationParams: Schema.Record(Schema.String, Schema.String),
+	authorizationUrl: Schema.String,
+	clientAuthentication: ClientAuthentication,
+	clientId: Schema.String,
+	clientSecret: Schema.optional(Schema.String),
+	expectedIssuer: Schema.optional(Schema.String),
+	pkce: Schema.Boolean,
+	scopes: Schema.Array(Schema.String),
+	tokenHeaders: TokenHeaders,
+	tokenParams: Schema.Record(Schema.String, Schema.String),
+	tokenRequestEncoding: Schema.Literals(["form", "json"]),
+	tokenUrl: Schema.String
+});
+const ProviderDiscoveryDocument = Schema.Struct({
+	authorization_endpoint: Schema.String,
+	issuer: Schema.optional(Schema.String),
+	token_endpoint: Schema.String
+});
+const decodeDiscoveryDocument = Schema.decodeUnknownSync(ProviderDiscoveryDocument);
+const encodeJsonTokenParams = Schema.encodeSync(Schema.fromJsonString(Schema.Record(Schema.String, Schema.String)));
+const decodeProviderTokenError = Schema.decodeSync(Schema.fromJsonString(Schema.Struct({ error: Schema.Literals([
+	"invalid_request",
+	"invalid_client",
+	"invalid_grant",
+	"unauthorized_client",
+	"unsupported_grant_type",
+	"invalid_scope",
+	"server_error",
+	"temporarily_unavailable"
+]) })));
+const decodeProviderTokenErrorSubtype = Schema.decodeSync(Schema.fromJsonString(Schema.Struct({ error_subtype: Schema.Literals(["invalid_rapt", "rapt_required"]) })));
+const randomBase64Url = (bytes) => {
+	const data = new Uint8Array(bytes);
+	crypto.getRandomValues(data);
+	return Base64Url.encode(data);
+};
+const sha256Base64Url = (value) => Effect.promise(() => crypto.subtle.digest("SHA-256", new TextEncoder().encode(value))).pipe(Effect.map((digest) => Base64Url.encode(new Uint8Array(digest))));
+const requiredString = (value, message) => typeof value === "string" && value.trim() !== "" ? Effect.succeed(value) : Effect.fail(new OAuthConnectionValidationFailed({ message }));
+const fetchDiscovery = Effect.fn("OAuthFlow.fetchDiscovery")(function* (discoveryUrl, client) {
+	const rawDocument = yield* pipe(HttpClient.filterStatusOk(client).get(discoveryUrl, { headers: { Accept: "application/json" } }), Effect.flatMap((response) => response.json), Effect.mapError((cause) => OAuthConnectionValidationFailed.make({
+		cause: Redacted.make(cause),
+		message: "failed to load oauth discovery document"
+	})));
+	const document = yield* Effect.try({
+		catch: () => new OAuthConnectionValidationFailed({ message: "invalid oauth discovery document" }),
+		try: () => decodeDiscoveryDocument(rawDocument)
+	});
+	const authorizationUrl = yield* requiredString(document.authorization_endpoint, "oauth discovery document missing authorization_endpoint");
+	const tokenUrl = yield* requiredString(document.token_endpoint, "oauth discovery document missing token_endpoint");
+	const expectedIssuer = typeof document.issuer === "string" && document.issuer.trim() !== "" ? document.issuer : void 0;
+	return {
+		authorizationUrl,
+		tokenUrl,
+		...expectedIssuer === void 0 ? {} : { expectedIssuer }
+	};
+});
+const resolveEndpoint = (value, setup) => value === void 0 ? void 0 : typeof value === "function" ? value({ setup }) : value;
+const resolveParams = (value, setup) => typeof value === "function" ? value({ setup }) : value ?? {};
+function invalidTokenHeaders() {
+	return OAuthConnectionValidationFailed.make({ message: "invalid oauth token headers" });
+}
+const resolveTokenHeaders = Effect.fnUntraced(function* (input) {
+	const raw = yield* Effect.try({
+		catch: invalidTokenHeaders,
+		try: () => {
+			if (Predicate.isFunction(input.value)) return input.value({ setup: input.setup });
+			if (input.value === void 0) return {};
+			return input.value;
+		}
+	});
+	return yield* pipe(Schema.decodeEffect(TokenHeaders)(raw), Effect.mapError(invalidTokenHeaders));
+});
+const resolveClientValue = Effect.fn("OAuthFlow.resolveClientValue")(function* (input) {
+	if (input.value === void 0) return;
+	if (typeof input.value === "string") return yield* requiredString(input.value, `${input.field} is empty`);
+	return yield* input.value.parse(input.configProvider).pipe(Effect.mapError((cause) => new OAuthConnectionValidationFailed({ message: `failed to resolve ${input.field}: ${cause.message}` })));
+});
+const resolveOAuthConfig = Effect.fn("OAuthFlow.resolveOAuthConfig")(function* (input) {
+	const oauth = input.method.oauth2;
+	if (oauth === void 0) return yield* new OAuthConnectionValidationFailed({ message: "auth method is not oauth2" });
+	const tokenHeaders = yield* resolveTokenHeaders({
+		setup: input.setup,
+		value: oauth.tokenHeaders
+	});
+	const client = typeof oauth.client === "function" ? oauth.client({ setup: input.setup }) : oauth.client;
+	const clientId = yield* resolveClientValue({
+		configProvider: input.configProvider,
+		field: "clientId",
+		value: client.clientId
+	});
+	const clientSecret = yield* resolveClientValue({
+		configProvider: input.configProvider,
+		field: "clientSecret",
+		value: client.clientSecret
+	});
+	if (clientId === void 0) return yield* new OAuthConnectionValidationFailed({ message: "missing oauth client id" });
+	const authorizationUrl = resolveEndpoint(oauth.authorizationUrl, input.setup);
+	const tokenUrl = resolveEndpoint(oauth.tokenUrl, input.setup);
+	const discoveryUrl = resolveEndpoint(oauth.discoveryUrl, input.setup);
+	return {
+		...authorizationUrl !== void 0 && tokenUrl !== void 0 ? {
+			authorizationUrl,
+			tokenUrl
+		} : discoveryUrl === void 0 ? yield* new OAuthConnectionValidationFailed({ message: "oauth method requires explicit endpoints or discoveryUrl" }) : yield* fetchDiscovery(discoveryUrl, input.client),
+		authorizationParams: resolveParams(oauth.authorizationParams, input.setup),
+		clientAuthentication: client.authentication ?? "basic",
+		clientId,
+		clientSecret,
+		pkce: oauth.pkce ?? true,
+		scopes: oauth.scopes,
+		tokenHeaders,
+		tokenParams: resolveParams(oauth.tokenParams, input.setup),
+		tokenRequestEncoding: oauth.tokenRequestEncoding ?? "form"
+	};
+});
+const buildAuthorizationUrl = (input) => {
+	const url = new URL(input.config.authorizationUrl);
+	url.searchParams.set("response_type", "code");
+	url.searchParams.set("client_id", input.config.clientId);
+	url.searchParams.set("redirect_uri", input.redirectUri);
+	url.searchParams.set("state", input.state);
+	if (input.config.scopes.length > 0) url.searchParams.set("scope", input.config.scopes.join(" "));
+	if (input.pkceChallenge !== void 0) {
+		url.searchParams.set("code_challenge", input.pkceChallenge);
+		url.searchParams.set("code_challenge_method", "S256");
+	}
+	for (const [key, value] of Object.entries(input.config.authorizationParams)) url.searchParams.set(key, value);
+	return url.toString();
+};
+const httpStatusClass = (status) => {
+	if (status >= 500) return "5xx";
+	if (status >= 400) return "4xx";
+	return "unexpected";
+};
+const oauthProtocolErrorCode = (body) => {
+	try {
+		return decodeProviderTokenError(body).error;
+	} catch {
+		return;
+	}
+};
+const oauthProtocolErrorSubtype = (body) => {
+	try {
+		return decodeProviderTokenErrorSubtype(body).error_subtype;
+	} catch {
+		return;
+	}
+};
+const tokenRequestHeaders = (config) => {
+	const headers = {
+		...config.tokenHeaders,
+		Accept: "application/json",
+		"Content-Type": config.tokenRequestEncoding === "json" ? "application/json" : "application/x-www-form-urlencoded"
+	};
+	if (config.clientAuthentication === "basic") {
+		if (config.clientSecret === void 0) return Effect.fail(new OAuthConnectionValidationFailed({ message: "missing client secret for basic token auth" }));
+		headers["Authorization"] = `Basic ${Base64.encode(`${config.clientId}:${config.clientSecret}`)}`;
+	}
+	return Effect.succeed(headers);
+};
+const postTokenRequest = Effect.fn("OAuthFlow.postTokenRequest")(function* (input) {
+	if (input.config.clientAuthentication === "post") {
+		input.params.set("client_id", input.config.clientId);
+		if (input.config.clientSecret !== void 0) input.params.set("client_secret", input.config.clientSecret);
+	} else if (input.config.clientAuthentication === "none") input.params.set("client_id", input.config.clientId);
+	for (const [key, value] of Object.entries(input.config.tokenParams)) input.params.set(key, value);
+	const headers = yield* tokenRequestHeaders(input.config);
+	const request = HttpClientRequest.post(input.config.tokenUrl, { headers }).pipe(HttpClientRequest.bodyText(input.config.tokenRequestEncoding === "json" ? encodeJsonTokenParams(Record.fromEntries(input.params)) : input.params.toString(), headers["Content-Type"]));
+	const response = yield* pipe(input.client.execute(request), Effect.provideService(FetchHttpClient.RequestInit, Record.isEmptyRecord(input.config.tokenHeaders) ? {} : { redirect: "error" }), Effect.mapError((cause) => OAuthConnectionValidationFailed.make({
+		cause: Redacted.make(cause),
+		message: `${input.failurePrefix} (network)`
+	})));
+	if (response.status < 200 || response.status >= 300) {
+		const body = yield* pipe(response.text, Effect.mapError((cause) => OAuthConnectionValidationFailed.make({
+			cause: Redacted.make(cause),
+			message: `${input.failurePrefix} (unreadable response)`
+		})));
+		const statusClass = httpStatusClass(response.status);
+		const protocolError = oauthProtocolErrorCode(body);
+		const errorSubtype = oauthProtocolErrorSubtype(body);
+		const reason = Array.join(Array.filter([protocolError, errorSubtype], Predicate.isNotUndefined), ", ");
+		const message = `${input.failurePrefix} (${Array.join(Array.filter([statusClass, reason], String.isNonEmpty), ": ")})`;
+		if (protocolError === "invalid_grant") return yield* OAuthGrantRejected.make({
+			message,
+			...errorSubtype === void 0 ? {} : { errorSubtype }
+		});
+		return yield* OAuthConnectionValidationFailed.make({ message });
+	}
+	return yield* pipe(response.json, Effect.mapError((cause) => OAuthConnectionValidationFailed.make({
+		cause: Redacted.make(cause),
+		message: `${input.failurePrefix} (network)`
+	})), Effect.flatMap((raw) => pipe(Schema.decodeUnknownEffect(Schema.Record(Schema.String, Schema.Unknown))(raw), Effect.mapError(() => OAuthConnectionValidationFailed.make({ message: "invalid oauth token response" })))));
+});
+const numberFromToken = (value) => {
+	if (typeof value === "number" && Number.isFinite(value)) return value;
+	if (typeof value === "string" && value.trim() !== "") {
+		const parsed = Number(value);
+		return Number.isFinite(parsed) ? parsed : void 0;
+	}
+};
+const normalizeTokenResponse = Effect.fn("OAuthFlow.normalizeTokenResponse")(function* (input) {
+	const response = yield* pipe(Schema.decodeUnknownEffect(input.method.oauth2?.tokenResponse ?? OAuth2ProviderTokenResponse)(input.raw), Effect.mapError(() => OAuthConnectionValidationFailed.make({ message: "invalid oauth token response" })));
+	const accessToken = yield* requiredString(response.access_token, "oauth token response missing access_token");
+	if (response.refresh_token?.trim() === "") return yield* OAuthConnectionValidationFailed.make({ message: "invalid oauth token response" });
+	const refreshToken = response.refresh_token ?? input.previousRefreshToken;
+	const expiresIn = numberFromToken(response.expires_in);
+	if (response.expires_in !== void 0 && (expiresIn === void 0 || expiresIn < 0)) return yield* OAuthConnectionValidationFailed.make({ message: "invalid oauth token response" });
+	const now = yield* Clock.currentTimeMillis;
+	const absoluteExpiry = response.expires_at === void 0 ? void 0 : Date.parse(response.expires_at);
+	if (absoluteExpiry !== void 0 && !Number.isFinite(absoluteExpiry)) return yield* OAuthConnectionValidationFailed.make({ message: "invalid oauth token response" });
+	return {
+		accessToken,
+		...refreshToken === void 0 ? {} : { refreshToken },
+		...response.token_type === void 0 ? {} : { tokenType: response.token_type },
+		...expiresIn === void 0 ? {} : {
+			expiresAt: now + expiresIn * 1e3,
+			expiresIn
+		},
+		...absoluteExpiry === void 0 ? {} : { expiresAt: absoluteExpiry },
+		...response.scope === void 0 ? {} : { scope: response.scope },
+		raw: input.raw
+	};
+});
+var Service = class extends Context.Service()("@dual-os/sdk/OAuthFlow") {};
+/** Deterministic OAuthFlow test layer that avoids external provider traffic. */
+const testing = (options = {}) => Layer.succeed(Service, Service.of({
+	complete: Effect.fn("OAuthFlow.testing.complete")(function* (input) {
+		if (input.query["state"] !== input.continuation.state) return yield* new OAuthConnectionValidationFailed({ message: "oauth state mismatch" });
+		if (input.query["error"] !== void 0) return yield* new OAuthProviderRejected({
+			error: input.query["error"],
+			errorDescription: input.query["error_description"]
+		});
+		if (input.query["code"] === void 0 || input.query["code"].trim() === "") return yield* new OAuthConnectionValidationFailed({ message: "missing oauth authorization code" });
+		const tokens = {
+			accessToken: options.accessToken ?? `test_access_${input.query["code"]}`,
+			expiresIn: options.expiresIn ?? 3600,
+			raw: {
+				code: input.query["code"],
+				grantType: "authorization_code",
+				testing: true
+			},
+			refreshToken: options.refreshToken ?? `test_refresh_${input.query["code"]}`,
+			tokenType: options.tokenType ?? "Bearer"
+		};
+		return {
+			material: tokens,
+			tokens
+		};
+	}),
+	refresh: Effect.fn("OAuthFlow.testing.refresh")(function* (input) {
+		const tokens = {
+			accessToken: options.refreshedAccessToken ?? `test_refreshed_${input.refreshToken}`,
+			expiresIn: options.expiresIn ?? 3600,
+			raw: {
+				grantType: "refresh_token",
+				testing: true
+			},
+			refreshToken: input.refreshToken,
+			tokenType: options.tokenType ?? "Bearer"
+		};
+		yield* Effect.void;
+		return {
+			material: tokens,
+			tokens
+		};
+	}),
+	start: Effect.fn("OAuthFlow.testing.start")(function* (input) {
+		const oauth = input.method.oauth2;
+		if (oauth === void 0) return yield* new OAuthConnectionValidationFailed({ message: "auth method is not oauth2" });
+		const client = typeof oauth.client === "function" ? oauth.client({ setup: input.setup }) : oauth.client;
+		const state = `test_state_${yield* Random.nextInt}`;
+		const pkceVerifier = oauth.pkce === false ? null : `test_pkce_${yield* Random.nextInt}`;
+		const authorizationUrl = new URL(resolveEndpoint(oauth.authorizationUrl, input.setup) ?? "https://oauth.testing.local/authorize");
+		authorizationUrl.searchParams.set("response_type", "code");
+		authorizationUrl.searchParams.set("client_id", globalThis.String(client.clientId));
+		authorizationUrl.searchParams.set("redirect_uri", input.redirectUri);
+		authorizationUrl.searchParams.set("state", state);
+		if (oauth.scopes.length > 0) authorizationUrl.searchParams.set("scope", oauth.scopes.join(" "));
+		if (pkceVerifier !== null) {
+			authorizationUrl.searchParams.set("code_challenge", "testing-code-challenge");
+			authorizationUrl.searchParams.set("code_challenge_method", "S256");
+		}
+		for (const [key, value] of Object.entries(resolveParams(oauth.authorizationParams, input.setup))) authorizationUrl.searchParams.set(key, value);
+		return {
+			authorizationUrl: authorizationUrl.toString(),
+			continuation: {
+				expiresAt: new Date((yield* Clock.currentTimeMillis) + (input.ttlMs ?? DefaultFlowTtlMs)),
+				pkceVerifier,
+				redirectUri: input.redirectUri,
+				state
+			}
+		};
+	})
+}));
+/** Live protocol layer that reads OAuth client config from Effect ConfigProvider. */
+const layer = Layer.effect(Service, Effect.gen(function* () {
+	const configProvider = yield* ConfigProvider.ConfigProvider;
+	const client = yield* HttpClient.HttpClient;
+	const start = Effect.fn("OAuthFlow.start")(function* (input) {
+		const config = yield* resolveOAuthConfig({
+			client,
+			configProvider,
+			method: input.method,
+			setup: input.setup
+		});
+		const expiresAt = new Date((yield* Clock.currentTimeMillis) + (input.ttlMs ?? DefaultFlowTtlMs));
+		const state = randomBase64Url(32);
+		const pkceVerifier = config.pkce ? randomBase64Url(32) : void 0;
+		const pkceChallenge = pkceVerifier === void 0 ? void 0 : yield* sha256Base64Url(pkceVerifier);
+		return {
+			authorizationUrl: buildAuthorizationUrl({
+				config,
+				pkceChallenge,
+				redirectUri: input.redirectUri,
+				state
+			}),
+			continuation: {
+				expiresAt,
+				pkceVerifier: pkceVerifier ?? null,
+				redirectUri: input.redirectUri,
+				state
+			}
+		};
+	});
+	const complete = Effect.fn("OAuthFlow.complete")(function* (input) {
+		if (input.query["state"] !== input.continuation.state) return yield* new OAuthConnectionValidationFailed({ message: "oauth state mismatch" });
+		if (input.query["error"] !== void 0) return yield* new OAuthProviderRejected({
+			error: input.query["error"],
+			errorDescription: input.query["error_description"]
+		});
+		const code = input.query["code"];
+		if (code === void 0 || code.trim() === "") return yield* new OAuthConnectionValidationFailed({ message: "missing oauth authorization code" });
+		const config = yield* resolveOAuthConfig({
+			client,
+			configProvider,
+			method: input.method,
+			setup: input.setup
+		});
+		if (config.expectedIssuer !== void 0 && input.query["iss"] !== void 0 && input.query["iss"] !== config.expectedIssuer) return yield* new OAuthConnectionValidationFailed({ message: "oauth issuer mismatch" });
+		const tokenParams = new URLSearchParams({
+			code,
+			grant_type: "authorization_code",
+			redirect_uri: input.continuation.redirectUri
+		});
+		if (input.continuation.pkceVerifier !== null) tokenParams.set("code_verifier", input.continuation.pkceVerifier);
+		const rawTokens = yield* pipe(postTokenRequest({
+			client,
+			config,
+			failurePrefix: "oauth token exchange failed",
+			params: tokenParams
+		}), Effect.catchTag("OAuthGrantRejected", (error) => Effect.fail(OAuthConnectionValidationFailed.make({ message: error.message }))));
+		const tokens = yield* normalizeTokenResponse({
+			method: input.method,
+			raw: rawTokens
+		});
+		return {
+			material: tokens,
+			tokens
+		};
+	});
+	const refresh = Effect.fn("OAuthFlow.refresh")(function* (input) {
+		const config = yield* resolveOAuthConfig({
+			client,
+			configProvider,
+			method: input.method,
+			setup: input.setup
+		});
+		const rawTokens = yield* postTokenRequest({
+			client,
+			config,
+			failurePrefix: "oauth token refresh failed",
+			params: new URLSearchParams({
+				grant_type: "refresh_token",
+				refresh_token: input.refreshToken
+			})
+		});
+		const tokens = yield* normalizeTokenResponse({
+			method: input.method,
+			previousRefreshToken: input.refreshToken,
+			raw: rawTokens
+		});
+		return {
+			material: tokens,
+			tokens
+		};
+	});
+	return Service.of({
+		complete,
+		refresh,
+		start
+	});
+})).pipe(Layer.provide(FetchHttpClient.layer));
+const oauth2TokenRefresherLayer = Layer.effect(Service$1, Effect.gen(function* () {
+	const flow = yield* Service;
+	return Service$1.of({ refresh: (input) => flow.refresh({
+		method: input.method,
+		refreshToken: input.refreshToken,
+		setup: input.setup
+	}).pipe(Effect.map((refreshed) => refreshed.tokens)) });
+}));
+//#endregion
+export { OAuthConnectionValidationFailed, OAuthFlow_exports as OAuthFlow, OAuthFlow_exports, OAuthGrantRejected, OAuthProviderRejected, Service, layer, oauth2TokenRefresherLayer, testing };
+
+//# sourceMappingURL=OAuthFlow.js.map

package/dist/OAuthFlow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthFlow.js","names":["AuthMethod.OAuth2ProviderTokenResponse","OAuth2TokenRefresher.Service"],"sources":["../src/OAuthFlow.ts"],"sourcesContent":["import type { Config } from \"effect\";\nimport {\n  Array,\n  Clock,\n  ConfigProvider,\n  Context,\n  Effect,\n  HashSet,\n  Layer,\n  Predicate,\n  Random,\n  Redacted,\n  Record,\n  Schema,\n  String,\n  pipe,\n} from \"effect\";\n\n/**\n * OAuth protocol runner used by ConnectionStore.\n *\n * OAuthFlow owns provider-facing protocol mechanics: resolving OAuth client\n * configuration, optional discovery, authorization URL construction, token\n * exchange, token refresh, and token response normalization. It does not persist\n * OAuth sessions or create Connections; ConnectionStore owns those product\n * lifecycle records and calls this service for the protocol steps.\n */\nimport { Base64, Base64Url } from \"effect/encoding\";\nimport { FetchHttpClient, HttpClient, HttpClientRequest } from \"effect/http\";\n\nimport * as AuthMethod from \"./AuthMethod.ts\";\nimport * as OAuth2TokenRefresher from \"./OAuth2TokenRefresher.ts\";\n\nexport class OAuthConnectionValidationFailed extends Schema.TaggedError<OAuthConnectionValidationFailed>()(\n  \"OAuthConnectionValidationFailed\",\n  { cause: Schema.optionalKey(Schema.Redacted(Schema.Defect())), message: Schema.String },\n) {}\nexport class OAuthProviderRejected extends Schema.TaggedError<OAuthProviderRejected>()(\n  \"OAuthProviderRejected\",\n  { error: Schema.String, errorDescription: Schema.optional(Schema.String) },\n) {}\nexport class OAuthGrantRejected extends Schema.TaggedError<OAuthGrantRejected>()(\n  \"OAuthGrantRejected\",\n  { errorSubtype: Schema.optionalKey(Schema.String), message: Schema.String },\n) {}\n\nconst DefaultFlowTtlMs = 10 * 60 * 1000;\n\nconst OAuthEndpoints = Schema.Struct({\n  authorizationUrl: Schema.String,\n  expectedIssuer: Schema.optional(Schema.String),\n  tokenUrl: Schema.String,\n});\ntype OAuthEndpoints = typeof OAuthEndpoints.Type;\n\nconst ClientAuthentication = Schema.Union([\n  Schema.Literal(\"basic\"),\n  Schema.Literal(\"post\"),\n  Schema.Literal(\"none\"),\n]);\n\nconst ReservedTokenHeaders = HashSet.fromIterable([\n  \"accept\",\n  \"accept-charset\",\n  \"accept-encoding\",\n  \"access-control-request-headers\",\n  \"access-control-request-method\",\n  \"authorization\",\n  \"connection\",\n  \"content-encoding\",\n  \"content-length\",\n  \"content-type\",\n  \"cookie\",\n  \"cookie2\",\n  \"date\",\n  \"dnt\",\n  \"expect\",\n  \"host\",\n  \"keep-alive\",\n  \"origin\",\n  \"permissions-policy\",\n  \"referer\",\n  \"set-cookie\",\n  \"te\",\n  \"trailer\",\n  \"transfer-encoding\",\n  \"upgrade\",\n  \"user-agent\",\n  \"via\",\n]);\n\ntype TokenHeaders = typeof TokenHeaders.Type;\nconst TokenHeaders = Schema.Record(\n  Schema.String,\n  Schema.String.check(Schema.isPattern(/^[\\t\\x20-\\x7e\\x80-\\xff]*$/u)),\n).check(\n  Schema.makeFilter(\n    headers => {\n      const names = Array.map(Record.keys(headers), String.toLowerCase);\n      return (\n        HashSet.size(HashSet.fromIterable(names)) === names.length &&\n        Array.every(\n          names,\n          name =>\n            /^[!#$%&'*+.^_`|~0-9a-z-]+$/u.test(name) &&\n            !HashSet.has(ReservedTokenHeaders, name) &&\n            !String.startsWith(\"proxy-\")(name) &&\n            !String.startsWith(\"sec-\")(name),\n        )\n      );\n    },\n    { message: \"Invalid provider token headers\" },\n  ),\n);\n\nconst ResolvedOAuth2Config = Schema.Struct({\n  authorizationParams: Schema.Record(Schema.String, Schema.String),\n  authorizationUrl: Schema.String,\n  clientAuthentication: ClientAuthentication,\n  clientId: Schema.String,\n  clientSecret: Schema.optional(Schema.String),\n  expectedIssuer: Schema.optional(Schema.String),\n  pkce: Schema.Boolean,\n  scopes: Schema.Array(Schema.String),\n  tokenHeaders: TokenHeaders,\n  tokenParams: Schema.Record(Schema.String, Schema.String),\n  tokenRequestEncoding: Schema.Literals([\"form\", \"json\"]),\n  tokenUrl: Schema.String,\n});\ntype ResolvedOAuth2Config = typeof ResolvedOAuth2Config.Type;\n\nconst ProviderDiscoveryDocument = Schema.Struct({\n  authorization_endpoint: Schema.String,\n  issuer: Schema.optional(Schema.String),\n  token_endpoint: Schema.String,\n});\n\nconst decodeDiscoveryDocument = Schema.decodeUnknownSync(ProviderDiscoveryDocument);\nconst encodeJsonTokenParams = Schema.encodeSync(\n  Schema.fromJsonString(Schema.Record(Schema.String, Schema.String)),\n);\nconst decodeProviderTokenError = Schema.decodeSync(\n  Schema.fromJsonString(\n    Schema.Struct({\n      error: Schema.Literals([\n        \"invalid_request\",\n        \"invalid_client\",\n        \"invalid_grant\",\n        \"unauthorized_client\",\n        \"unsupported_grant_type\",\n        \"invalid_scope\",\n        \"server_error\",\n        \"temporarily_unavailable\",\n      ]),\n    }),\n  ),\n);\n// Only Google's documented reauthentication subtypes pass, so an echoed secret never reaches an error.\nconst decodeProviderTokenErrorSubtype = Schema.decodeSync(\n  Schema.fromJsonString(\n    Schema.Struct({ error_subtype: Schema.Literals([\"invalid_rapt\", \"rapt_required\"]) }),\n  ),\n);\n\nconst randomBase64Url = (bytes: number): string => {\n  const data = new Uint8Array(bytes);\n  crypto.getRandomValues(data);\n  return Base64Url.encode(data);\n};\n\nconst sha256Base64Url = (value: string): Effect.Effect<string> =>\n  Effect.promise(() => crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(value))).pipe(\n    Effect.map(digest => Base64Url.encode(new Uint8Array(digest))),\n  );\n\nconst requiredString = (\n  value: unknown,\n  message: string,\n): Effect.Effect<string, OAuthConnectionValidationFailed> =>\n  typeof value === \"string\" && value.trim() !== \"\"\n    ? Effect.succeed(value)\n    : Effect.fail(new OAuthConnectionValidationFailed({ message }));\n\nconst fetchDiscovery = Effect.fn(\"OAuthFlow.fetchDiscovery\")(function* (\n  discoveryUrl: string,\n  client: HttpClient.HttpClient,\n): Effect.fn.Return<OAuthEndpoints, OAuthConnectionValidationFailed> {\n  const rawDocument = yield* pipe(\n    HttpClient.filterStatusOk(client).get(discoveryUrl, {\n      headers: { Accept: \"application/json\" },\n    }),\n    Effect.flatMap(response => response.json),\n    Effect.mapError(cause =>\n      OAuthConnectionValidationFailed.make({\n        cause: Redacted.make(cause),\n        message: \"failed to load oauth discovery document\",\n      }),\n    ),\n  );\n\n  const document = yield* Effect.try({\n    catch: () =>\n      new OAuthConnectionValidationFailed({ message: \"invalid oauth discovery document\" }),\n    try: () => decodeDiscoveryDocument(rawDocument),\n  });\n\n  const authorizationUrl = yield* requiredString(\n    document.authorization_endpoint,\n    \"oauth discovery document missing authorization_endpoint\",\n  );\n  const tokenUrl = yield* requiredString(\n    document.token_endpoint,\n    \"oauth discovery document missing token_endpoint\",\n  );\n  const expectedIssuer =\n    typeof document.issuer === \"string\" && document.issuer.trim() !== \"\"\n      ? document.issuer\n      : undefined;\n\n  return {\n    authorizationUrl,\n    tokenUrl,\n    ...(expectedIssuer === undefined ? {} : { expectedIssuer }),\n  };\n});\n\nconst resolveEndpoint = (\n  value: AuthMethod.OAuth2Endpoint<unknown> | undefined,\n  setup: unknown,\n): string | undefined =>\n  value === undefined ? undefined : typeof value === \"function\" ? value({ setup }) : value;\n\nconst resolveParams = (\n  value: AuthMethod.OAuth2Params<unknown> | undefined,\n  setup: unknown,\n): Readonly<Record<string, string>> =>\n  typeof value === \"function\" ? value({ setup }) : (value ?? {});\n\nfunction invalidTokenHeaders() {\n  return OAuthConnectionValidationFailed.make({ message: \"invalid oauth token headers\" });\n}\n\nconst resolveTokenHeaders = Effect.fnUntraced(function* (input: {\n  value: AuthMethod.OAuth2Headers<unknown> | undefined;\n  setup: unknown;\n}): Effect.fn.Return<TokenHeaders, OAuthConnectionValidationFailed> {\n  const raw = yield* Effect.try({\n    catch: invalidTokenHeaders,\n    try: () => {\n      if (Predicate.isFunction(input.value)) {\n        return input.value({ setup: input.setup });\n      }\n      if (input.value === undefined) {\n        return {};\n      }\n      return input.value;\n    },\n  });\n  return yield* pipe(Schema.decodeEffect(TokenHeaders)(raw), Effect.mapError(invalidTokenHeaders));\n});\n\nconst resolveClientValue = Effect.fn(\"OAuthFlow.resolveClientValue\")(function* (input: {\n  readonly value: string | Config.Config<string> | undefined;\n  readonly field: string;\n  readonly configProvider: ConfigProvider.ConfigProvider;\n}): Effect.fn.Return<string | undefined, OAuthConnectionValidationFailed> {\n  if (input.value === undefined) {\n    return undefined;\n  }\n  if (typeof input.value === \"string\") {\n    return yield* requiredString(input.value, `${input.field} is empty`);\n  }\n\n  return yield* input.value\n    .parse(input.configProvider)\n    .pipe(\n      Effect.mapError(\n        cause =>\n          new OAuthConnectionValidationFailed({\n            message: `failed to resolve ${input.field}: ${cause.message}`,\n          }),\n      ),\n    );\n});\n\nconst resolveOAuthConfig = Effect.fn(\"OAuthFlow.resolveOAuthConfig\")(function* (input: {\n  readonly method: AuthMethod.Any;\n  readonly setup: unknown;\n  readonly configProvider: ConfigProvider.ConfigProvider;\n  readonly client: HttpClient.HttpClient;\n}): Effect.fn.Return<ResolvedOAuth2Config, OAuthConnectionValidationFailed> {\n  const oauth = input.method.oauth2;\n  if (oauth === undefined) {\n    return yield* new OAuthConnectionValidationFailed({ message: \"auth method is not oauth2\" });\n  }\n\n  const tokenHeaders = yield* resolveTokenHeaders({\n    setup: input.setup,\n    value: oauth.tokenHeaders,\n  });\n\n  const client =\n    typeof oauth.client === \"function\" ? oauth.client({ setup: input.setup }) : oauth.client;\n  const clientId = yield* resolveClientValue({\n    configProvider: input.configProvider,\n    field: \"clientId\",\n    value: client.clientId,\n  });\n  const clientSecret = yield* resolveClientValue({\n    configProvider: input.configProvider,\n    field: \"clientSecret\",\n    value: client.clientSecret,\n  });\n  if (clientId === undefined) {\n    return yield* new OAuthConnectionValidationFailed({ message: \"missing oauth client id\" });\n  }\n\n  const authorizationUrl = resolveEndpoint(oauth.authorizationUrl, input.setup);\n  const tokenUrl = resolveEndpoint(oauth.tokenUrl, input.setup);\n  const discoveryUrl = resolveEndpoint(oauth.discoveryUrl, input.setup);\n\n  const endpoints =\n    authorizationUrl !== undefined && tokenUrl !== undefined\n      ? { authorizationUrl, tokenUrl }\n      : discoveryUrl === undefined\n        ? yield* new OAuthConnectionValidationFailed({\n            message: \"oauth method requires explicit endpoints or discoveryUrl\",\n          })\n        : yield* fetchDiscovery(discoveryUrl, input.client);\n\n  return {\n    ...endpoints,\n    authorizationParams: resolveParams(oauth.authorizationParams, input.setup),\n    clientAuthentication: client.authentication ?? \"basic\",\n    clientId,\n    clientSecret,\n    pkce: oauth.pkce ?? true,\n    scopes: oauth.scopes,\n    tokenHeaders,\n    tokenParams: resolveParams(oauth.tokenParams, input.setup),\n    tokenRequestEncoding: oauth.tokenRequestEncoding ?? \"form\",\n  };\n});\n\nconst buildAuthorizationUrl = (input: {\n  readonly config: ResolvedOAuth2Config;\n  readonly redirectUri: string;\n  readonly state: string;\n  readonly pkceChallenge: string | undefined;\n}): string => {\n  const url = new URL(input.config.authorizationUrl);\n  url.searchParams.set(\"response_type\", \"code\");\n  url.searchParams.set(\"client_id\", input.config.clientId);\n  url.searchParams.set(\"redirect_uri\", input.redirectUri);\n  url.searchParams.set(\"state\", input.state);\n  if (input.config.scopes.length > 0) {\n    url.searchParams.set(\"scope\", input.config.scopes.join(\" \"));\n  }\n  if (input.pkceChallenge !== undefined) {\n    url.searchParams.set(\"code_challenge\", input.pkceChallenge);\n    url.searchParams.set(\"code_challenge_method\", \"S256\");\n  }\n  for (const [key, value] of Object.entries(input.config.authorizationParams)) {\n    url.searchParams.set(key, value);\n  }\n  return url.toString();\n};\n\nconst httpStatusClass = (status: number): string => {\n  if (status >= 500) {\n    return \"5xx\";\n  }\n  if (status >= 400) {\n    return \"4xx\";\n  }\n  return \"unexpected\";\n};\n\nconst oauthProtocolErrorCode = (body: string): string | undefined => {\n  try {\n    return decodeProviderTokenError(body).error;\n  } catch {\n    return undefined;\n  }\n};\n\nconst oauthProtocolErrorSubtype = (body: string): string | undefined => {\n  try {\n    return decodeProviderTokenErrorSubtype(body).error_subtype;\n  } catch {\n    return undefined;\n  }\n};\n\nconst tokenRequestHeaders = (\n  config: ResolvedOAuth2Config,\n): Effect.Effect<Record<string, string>, OAuthConnectionValidationFailed> => {\n  const headers: Record<string, string> = {\n    ...config.tokenHeaders,\n    Accept: \"application/json\",\n    \"Content-Type\":\n      config.tokenRequestEncoding === \"json\"\n        ? \"application/json\"\n        : \"application/x-www-form-urlencoded\",\n  };\n  if (config.clientAuthentication === \"basic\") {\n    if (config.clientSecret === undefined) {\n      return Effect.fail(\n        new OAuthConnectionValidationFailed({\n          message: \"missing client secret for basic token auth\",\n        }),\n      );\n    }\n    headers[\"Authorization\"] =\n      `Basic ${Base64.encode(`${config.clientId}:${config.clientSecret}`)}`;\n  }\n  return Effect.succeed(headers);\n};\n\nconst postTokenRequest = Effect.fn(\"OAuthFlow.postTokenRequest\")(function* (input: {\n  readonly config: ResolvedOAuth2Config;\n  readonly params: URLSearchParams;\n  readonly failurePrefix: string;\n  readonly client: HttpClient.HttpClient;\n}): Effect.fn.Return<\n  Record<string, unknown>,\n  OAuthConnectionValidationFailed | OAuthGrantRejected\n> {\n  if (input.config.clientAuthentication === \"post\") {\n    input.params.set(\"client_id\", input.config.clientId);\n    if (input.config.clientSecret !== undefined) {\n      input.params.set(\"client_secret\", input.config.clientSecret);\n    }\n  } else if (input.config.clientAuthentication === \"none\") {\n    input.params.set(\"client_id\", input.config.clientId);\n  }\n\n  for (const [key, value] of Object.entries(input.config.tokenParams)) {\n    input.params.set(key, value);\n  }\n\n  const headers = yield* tokenRequestHeaders(input.config);\n  const request = HttpClientRequest.post(input.config.tokenUrl, { headers }).pipe(\n    HttpClientRequest.bodyText(\n      input.config.tokenRequestEncoding === \"json\"\n        ? encodeJsonTokenParams(Record.fromEntries(input.params))\n        : input.params.toString(),\n      headers[\"Content-Type\"],\n    ),\n  );\n  const response = yield* pipe(\n    input.client.execute(request),\n    Effect.provideService(\n      FetchHttpClient.RequestInit,\n      Record.isEmptyRecord(input.config.tokenHeaders) ? {} : { redirect: \"error\" },\n    ),\n    Effect.mapError(cause =>\n      OAuthConnectionValidationFailed.make({\n        cause: Redacted.make(cause),\n        message: `${input.failurePrefix} (network)`,\n      }),\n    ),\n  );\n  if (response.status < 200 || response.status >= 300) {\n    const body = yield* pipe(\n      response.text,\n      Effect.mapError(cause =>\n        OAuthConnectionValidationFailed.make({\n          cause: Redacted.make(cause),\n          message: `${input.failurePrefix} (unreadable response)`,\n        }),\n      ),\n    );\n    const statusClass = httpStatusClass(response.status);\n    const protocolError = oauthProtocolErrorCode(body);\n    const errorSubtype = oauthProtocolErrorSubtype(body);\n    const reason = Array.join(\n      Array.filter([protocolError, errorSubtype], Predicate.isNotUndefined),\n      \", \",\n    );\n    const message = `${input.failurePrefix} (${Array.join(Array.filter([statusClass, reason], String.isNonEmpty), \": \")})`;\n    if (protocolError === \"invalid_grant\") {\n      return yield* OAuthGrantRejected.make({\n        message,\n        ...(errorSubtype === undefined ? {} : { errorSubtype }),\n      });\n    }\n    return yield* OAuthConnectionValidationFailed.make({ message });\n  }\n  return yield* pipe(\n    response.json,\n    Effect.mapError(cause =>\n      OAuthConnectionValidationFailed.make({\n        cause: Redacted.make(cause),\n        message: `${input.failurePrefix} (network)`,\n      }),\n    ),\n    Effect.flatMap(raw =>\n      pipe(\n        Schema.decodeUnknownEffect(Schema.Record(Schema.String, Schema.Unknown))(raw),\n        Effect.mapError(() =>\n          OAuthConnectionValidationFailed.make({ message: \"invalid oauth token response\" }),\n        ),\n      ),\n    ),\n  );\n});\n\nconst numberFromToken = (value: unknown): number | undefined => {\n  if (typeof value === \"number\" && Number.isFinite(value)) {\n    return value;\n  }\n  if (typeof value === \"string\" && value.trim() !== \"\") {\n    const parsed = Number(value);\n    return Number.isFinite(parsed) ? parsed : undefined;\n  }\n  return undefined;\n};\n\nconst normalizeTokenResponse = Effect.fn(\"OAuthFlow.normalizeTokenResponse\")(function* (input: {\n  readonly raw: Record<string, unknown>;\n  readonly method: AuthMethod.Any;\n  readonly previousRefreshToken?: string | undefined;\n}): Effect.fn.Return<AuthMethod.OAuth2TokenResponse, OAuthConnectionValidationFailed> {\n  const response = yield* pipe(\n    Schema.decodeUnknownEffect(\n      input.method.oauth2?.tokenResponse ?? AuthMethod.OAuth2ProviderTokenResponse,\n    )(input.raw),\n    Effect.mapError(() =>\n      OAuthConnectionValidationFailed.make({ message: \"invalid oauth token response\" }),\n    ),\n  );\n  const accessToken = yield* requiredString(\n    response.access_token,\n    \"oauth token response missing access_token\",\n  );\n  if (response.refresh_token?.trim() === \"\") {\n    return yield* OAuthConnectionValidationFailed.make({ message: \"invalid oauth token response\" });\n  }\n  const refreshToken = response.refresh_token ?? input.previousRefreshToken;\n  const expiresIn = numberFromToken(response.expires_in);\n  if (response.expires_in !== undefined && (expiresIn === undefined || expiresIn < 0)) {\n    return yield* OAuthConnectionValidationFailed.make({ message: \"invalid oauth token response\" });\n  }\n  const now = yield* Clock.currentTimeMillis;\n  const absoluteExpiry =\n    response.expires_at === undefined ? undefined : Date.parse(response.expires_at);\n  if (absoluteExpiry !== undefined && !Number.isFinite(absoluteExpiry)) {\n    return yield* OAuthConnectionValidationFailed.make({ message: \"invalid oauth token response\" });\n  }\n\n  return {\n    accessToken,\n    ...(refreshToken === undefined ? {} : { refreshToken }),\n    ...(response.token_type === undefined ? {} : { tokenType: response.token_type }),\n    ...(expiresIn === undefined ? {} : { expiresAt: now + expiresIn * 1000, expiresIn }),\n    ...(absoluteExpiry === undefined ? {} : { expiresAt: absoluteExpiry }),\n    ...(response.scope === undefined ? {} : { scope: response.scope }),\n    raw: input.raw,\n  };\n});\n\nexport type OAuthFlowError = OAuthConnectionValidationFailed | OAuthProviderRejected;\n\nexport interface OAuthFlowContinuation {\n  readonly state: string;\n  readonly redirectUri: string;\n  readonly pkceVerifier: string | null;\n  readonly expiresAt: Date;\n}\n\nexport interface OAuthFlowStarted {\n  readonly authorizationUrl: string;\n  readonly continuation: OAuthFlowContinuation;\n}\n\nexport interface OAuthFlowCompleted<Material> {\n  readonly tokens: AuthMethod.OAuth2TokenResponse;\n  readonly material: Material;\n}\n\nexport class Service extends Context.Service<\n  Service,\n  {\n    readonly start: <Method extends AuthMethod.Any>(input: {\n      readonly method: Method;\n      readonly setup: AuthMethod.Setup<Method>;\n      readonly redirectUri: string;\n      readonly ttlMs?: number;\n    }) => Effect.Effect<OAuthFlowStarted, OAuthFlowError>;\n    readonly complete: <Method extends AuthMethod.Any>(input: {\n      readonly method: Method;\n      readonly setup: AuthMethod.Setup<Method>;\n      readonly continuation: OAuthFlowContinuation;\n      readonly query: Readonly<Record<string, string | undefined>>;\n    }) => Effect.Effect<OAuthFlowCompleted<AuthMethod.OAuth2TokenResponse>, OAuthFlowError>;\n    readonly refresh: <Method extends AuthMethod.Any>(input: {\n      readonly method: Method;\n      readonly setup: AuthMethod.Setup<Method>;\n      readonly refreshToken: string;\n    }) => Effect.Effect<\n      OAuthFlowCompleted<AuthMethod.OAuth2TokenResponse>,\n      OAuthFlowError | OAuthGrantRejected\n    >;\n  }\n>()(\"@dual-os/sdk/OAuthFlow\") {}\n\n/** Deterministic OAuthFlow test layer that avoids external provider traffic. */\nexport const testing = (\n  options: {\n    readonly accessToken?: string;\n    readonly refreshToken?: string;\n    readonly refreshedAccessToken?: string;\n    readonly tokenType?: string;\n    readonly expiresIn?: number;\n  } = {},\n) =>\n  Layer.succeed(\n    Service,\n    Service.of({\n      complete: Effect.fn(\"OAuthFlow.testing.complete\")(function* <\n        Method extends AuthMethod.Any,\n      >(input: {\n        readonly method: Method;\n        readonly setup: AuthMethod.Setup<Method>;\n        readonly continuation: OAuthFlowContinuation;\n        readonly query: Readonly<Record<string, string | undefined>>;\n      }) {\n        if (input.query[\"state\"] !== input.continuation.state) {\n          return yield* new OAuthConnectionValidationFailed({ message: \"oauth state mismatch\" });\n        }\n        if (input.query[\"error\"] !== undefined) {\n          return yield* new OAuthProviderRejected({\n            error: input.query[\"error\"],\n            errorDescription: input.query[\"error_description\"],\n          });\n        }\n        if (input.query[\"code\"] === undefined || input.query[\"code\"].trim() === \"\") {\n          return yield* new OAuthConnectionValidationFailed({\n            message: \"missing oauth authorization code\",\n          });\n        }\n\n        const tokens: AuthMethod.OAuth2TokenResponse = {\n          accessToken: options.accessToken ?? `test_access_${input.query[\"code\"]}`,\n          expiresIn: options.expiresIn ?? 3600,\n          raw: { code: input.query[\"code\"], grantType: \"authorization_code\", testing: true },\n          refreshToken: options.refreshToken ?? `test_refresh_${input.query[\"code\"]}`,\n          tokenType: options.tokenType ?? \"Bearer\",\n        };\n        return { material: tokens, tokens };\n      }),\n      refresh: Effect.fn(\"OAuthFlow.testing.refresh\")(function* <\n        Method extends AuthMethod.Any,\n      >(input: {\n        readonly method: Method;\n        readonly setup: AuthMethod.Setup<Method>;\n        readonly refreshToken: string;\n      }) {\n        const tokens: AuthMethod.OAuth2TokenResponse = {\n          accessToken: options.refreshedAccessToken ?? `test_refreshed_${input.refreshToken}`,\n          expiresIn: options.expiresIn ?? 3600,\n          raw: { grantType: \"refresh_token\", testing: true },\n          refreshToken: input.refreshToken,\n          tokenType: options.tokenType ?? \"Bearer\",\n        };\n        yield* Effect.void;\n        return { material: tokens, tokens };\n      }),\n      start: Effect.fn(\"OAuthFlow.testing.start\")(function* <Method extends AuthMethod.Any>(input: {\n        readonly method: Method;\n        readonly setup: AuthMethod.Setup<Method>;\n        readonly redirectUri: string;\n        readonly ttlMs?: number;\n      }) {\n        const oauth = input.method.oauth2;\n        if (oauth === undefined) {\n          return yield* new OAuthConnectionValidationFailed({\n            message: \"auth method is not oauth2\",\n          });\n        }\n        const client =\n          typeof oauth.client === \"function\" ? oauth.client({ setup: input.setup }) : oauth.client;\n        const state = `test_state_${yield* Random.nextInt}`;\n        const pkceVerifier = oauth.pkce === false ? null : `test_pkce_${yield* Random.nextInt}`;\n        const authorizationUrl = new URL(\n          resolveEndpoint(oauth.authorizationUrl, input.setup) ??\n            \"https://oauth.testing.local/authorize\",\n        );\n        authorizationUrl.searchParams.set(\"response_type\", \"code\");\n        authorizationUrl.searchParams.set(\"client_id\", globalThis.String(client.clientId));\n        authorizationUrl.searchParams.set(\"redirect_uri\", input.redirectUri);\n        authorizationUrl.searchParams.set(\"state\", state);\n        if (oauth.scopes.length > 0) {\n          authorizationUrl.searchParams.set(\"scope\", oauth.scopes.join(\" \"));\n        }\n        if (pkceVerifier !== null) {\n          authorizationUrl.searchParams.set(\"code_challenge\", \"testing-code-challenge\");\n          authorizationUrl.searchParams.set(\"code_challenge_method\", \"S256\");\n        }\n        for (const [key, value] of Object.entries(\n          resolveParams(oauth.authorizationParams, input.setup),\n        )) {\n          authorizationUrl.searchParams.set(key, value);\n        }\n\n        return {\n          authorizationUrl: authorizationUrl.toString(),\n          continuation: {\n            expiresAt: new Date(\n              (yield* Clock.currentTimeMillis) + (input.ttlMs ?? DefaultFlowTtlMs),\n            ),\n            pkceVerifier,\n            redirectUri: input.redirectUri,\n            state,\n          },\n        };\n      }),\n    }),\n  );\n\n/** Live protocol layer that reads OAuth client config from Effect ConfigProvider. */\nexport const layer = Layer.effect(\n  Service,\n  Effect.gen(function* () {\n    const configProvider = yield* ConfigProvider.ConfigProvider;\n    const client = yield* HttpClient.HttpClient;\n\n    const start = Effect.fn(\"OAuthFlow.start\")(function* <Method extends AuthMethod.Any>(input: {\n      readonly method: Method;\n      readonly setup: AuthMethod.Setup<Method>;\n      readonly redirectUri: string;\n      readonly ttlMs?: number;\n    }) {\n      const config = yield* resolveOAuthConfig({\n        client,\n        configProvider,\n        method: input.method,\n        setup: input.setup,\n      });\n      const expiresAt = new Date(\n        (yield* Clock.currentTimeMillis) + (input.ttlMs ?? DefaultFlowTtlMs),\n      );\n      const state = randomBase64Url(32);\n      const pkceVerifier = config.pkce ? randomBase64Url(32) : undefined;\n      const pkceChallenge =\n        pkceVerifier === undefined ? undefined : yield* sha256Base64Url(pkceVerifier);\n\n      return {\n        authorizationUrl: buildAuthorizationUrl({\n          config,\n          pkceChallenge,\n          redirectUri: input.redirectUri,\n          state,\n        }),\n        continuation: {\n          expiresAt,\n          pkceVerifier: pkceVerifier ?? null,\n          redirectUri: input.redirectUri,\n          state,\n        },\n      };\n    });\n\n    const complete = Effect.fn(\"OAuthFlow.complete\")(function* <\n      Method extends AuthMethod.Any,\n    >(input: {\n      readonly method: Method;\n      readonly setup: AuthMethod.Setup<Method>;\n      readonly continuation: OAuthFlowContinuation;\n      readonly query: Readonly<Record<string, string | undefined>>;\n    }) {\n      if (input.query[\"state\"] !== input.continuation.state) {\n        return yield* new OAuthConnectionValidationFailed({ message: \"oauth state mismatch\" });\n      }\n      if (input.query[\"error\"] !== undefined) {\n        return yield* new OAuthProviderRejected({\n          error: input.query[\"error\"],\n          errorDescription: input.query[\"error_description\"],\n        });\n      }\n      const code = input.query[\"code\"];\n      if (code === undefined || code.trim() === \"\") {\n        return yield* new OAuthConnectionValidationFailed({\n          message: \"missing oauth authorization code\",\n        });\n      }\n\n      const config = yield* resolveOAuthConfig({\n        client,\n        configProvider,\n        method: input.method,\n        setup: input.setup,\n      });\n      if (\n        config.expectedIssuer !== undefined &&\n        input.query[\"iss\"] !== undefined &&\n        input.query[\"iss\"] !== config.expectedIssuer\n      ) {\n        return yield* new OAuthConnectionValidationFailed({ message: \"oauth issuer mismatch\" });\n      }\n\n      const tokenParams = new URLSearchParams({\n        code,\n        grant_type: \"authorization_code\",\n        redirect_uri: input.continuation.redirectUri,\n      });\n      if (input.continuation.pkceVerifier !== null) {\n        tokenParams.set(\"code_verifier\", input.continuation.pkceVerifier);\n      }\n\n      const rawTokens = yield* pipe(\n        postTokenRequest({\n          client,\n          config,\n          failurePrefix: \"oauth token exchange failed\",\n          params: tokenParams,\n        }),\n        Effect.catchTag(\"OAuthGrantRejected\", error =>\n          Effect.fail(OAuthConnectionValidationFailed.make({ message: error.message })),\n        ),\n      );\n      const tokens = yield* normalizeTokenResponse({ method: input.method, raw: rawTokens });\n      return { material: tokens, tokens };\n    });\n\n    const refresh = Effect.fn(\"OAuthFlow.refresh\")(function* <\n      Method extends AuthMethod.Any,\n    >(input: {\n      readonly method: Method;\n      readonly setup: AuthMethod.Setup<Method>;\n      readonly refreshToken: string;\n    }) {\n      const config = yield* resolveOAuthConfig({\n        client,\n        configProvider,\n        method: input.method,\n        setup: input.setup,\n      });\n      const rawTokens = yield* postTokenRequest({\n        client,\n        config,\n        failurePrefix: \"oauth token refresh failed\",\n        params: new URLSearchParams({\n          grant_type: \"refresh_token\",\n          refresh_token: input.refreshToken,\n        }),\n      });\n      const tokens = yield* normalizeTokenResponse({\n        method: input.method,\n        previousRefreshToken: input.refreshToken,\n        raw: rawTokens,\n      });\n      return { material: tokens, tokens };\n    });\n\n    return Service.of({ complete, refresh, start });\n  }),\n).pipe(Layer.provide(FetchHttpClient.layer));\n\nexport const oauth2TokenRefresherLayer = Layer.effect(\n  OAuth2TokenRefresher.Service,\n  Effect.gen(function* () {\n    const flow = yield* Service;\n    return OAuth2TokenRefresher.Service.of({\n      refresh: input =>\n        flow\n          .refresh({ method: input.method, refreshToken: input.refreshToken, setup: input.setup })\n          .pipe(Effect.map(refreshed => refreshed.tokens)),\n    });\n  }),\n);\n\nexport * as OAuthFlow from \"./OAuthFlow.ts\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAiCA,IAAa,kCAAb,cAAqD,OAAO,YAA6C,CAAC,CACxG,mCACA;CAAE,OAAO,OAAO,YAAY,OAAO,SAAS,OAAO,OAAO,CAAC,CAAC;CAAG,SAAS,OAAO;AAAO,CACxF,CAAC,CAAC,CAAC;AACH,IAAa,wBAAb,cAA2C,OAAO,YAAmC,CAAC,CACpF,yBACA;CAAE,OAAO,OAAO;CAAQ,kBAAkB,OAAO,SAAS,OAAO,MAAM;AAAE,CAC3E,CAAC,CAAC,CAAC;AACH,IAAa,qBAAb,cAAwC,OAAO,YAAgC,CAAC,CAC9E,sBACA;CAAE,cAAc,OAAO,YAAY,OAAO,MAAM;CAAG,SAAS,OAAO;AAAO,CAC5E,CAAC,CAAC,CAAC;AAEH,MAAM,mBAAmB;AAEF,OAAO,OAAO;CACnC,kBAAkB,OAAO;CACzB,gBAAgB,OAAO,SAAS,OAAO,MAAM;CAC7C,UAAU,OAAO;AACnB,CAAC;AAGD,MAAM,uBAAuB,OAAO,MAAM;CACxC,OAAO,QAAQ,OAAO;CACtB,OAAO,QAAQ,MAAM;CACrB,OAAO,QAAQ,MAAM;AACvB,CAAC;AAED,MAAM,uBAAuB,QAAQ,aAAa;CAChD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAGD,MAAM,eAAe,OAAO,OAC1B,OAAO,QACP,OAAO,OAAO,MAAM,OAAO,UAAU,4BAA4B,CAAC,CACpE,CAAC,CAAC,MACA,OAAO,YACL,YAAW;CACT,MAAM,QAAQ,MAAM,IAAI,OAAO,KAAK,OAAO,GAAG,OAAO,WAAW;CAChE,OACE,QAAQ,KAAK,QAAQ,aAAa,KAAK,CAAC,MAAM,MAAM,UACpD,MAAM,MACJ,QACA,SACE,8BAA8B,KAAK,IAAI,KACvC,CAAC,QAAQ,IAAI,sBAAsB,IAAI,KACvC,CAAC,OAAO,WAAW,QAAQ,CAAC,CAAC,IAAI,KACjC,CAAC,OAAO,WAAW,MAAM,CAAC,CAAC,IAAI,CACnC;AAEJ,GACA,EAAE,SAAS,iCAAiC,CAC9C,CACF;AAE6B,OAAO,OAAO;CACzC,qBAAqB,OAAO,OAAO,OAAO,QAAQ,OAAO,MAAM;CAC/D,kBAAkB,OAAO;CACzB,sBAAsB;CACtB,UAAU,OAAO;CACjB,cAAc,OAAO,SAAS,OAAO,MAAM;CAC3C,gBAAgB,OAAO,SAAS,OAAO,MAAM;CAC7C,MAAM,OAAO;CACb,QAAQ,OAAO,MAAM,OAAO,MAAM;CAClC,cAAc;CACd,aAAa,OAAO,OAAO,OAAO,QAAQ,OAAO,MAAM;CACvD,sBAAsB,OAAO,SAAS,CAAC,QAAQ,MAAM,CAAC;CACtD,UAAU,OAAO;AACnB,CAAC;AAGD,MAAM,4BAA4B,OAAO,OAAO;CAC9C,wBAAwB,OAAO;CAC/B,QAAQ,OAAO,SAAS,OAAO,MAAM;CACrC,gBAAgB,OAAO;AACzB,CAAC;AAED,MAAM,0BAA0B,OAAO,kBAAkB,yBAAyB;AAClF,MAAM,wBAAwB,OAAO,WACnC,OAAO,eAAe,OAAO,OAAO,OAAO,QAAQ,OAAO,MAAM,CAAC,CACnE;AACA,MAAM,2BAA2B,OAAO,WACtC,OAAO,eACL,OAAO,OAAO,EACZ,OAAO,OAAO,SAAS;CACrB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,EACH,CAAC,CACH,CACF;AAEA,MAAM,kCAAkC,OAAO,WAC7C,OAAO,eACL,OAAO,OAAO,EAAE,eAAe,OAAO,SAAS,CAAC,gBAAgB,eAAe,CAAC,EAAE,CAAC,CACrF,CACF;AAEA,MAAM,mBAAmB,UAA0B;CACjD,MAAM,OAAO,IAAI,WAAW,KAAK;CACjC,OAAO,gBAAgB,IAAI;CAC3B,OAAO,UAAU,OAAO,IAAI;AAC9B;AAEA,MAAM,mBAAmB,UACvB,OAAO,cAAc,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,KACrF,OAAO,KAAI,WAAU,UAAU,OAAO,IAAI,WAAW,MAAM,CAAC,CAAC,CAC/D;AAEF,MAAM,kBACJ,OACA,YAEA,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM,KAC1C,OAAO,QAAQ,KAAK,IACpB,OAAO,KAAK,IAAI,gCAAgC,EAAE,QAAQ,CAAC,CAAC;AAElE,MAAM,iBAAiB,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC3D,cACA,QACmE;CACnE,MAAM,cAAc,OAAO,KACzB,WAAW,eAAe,MAAM,CAAC,CAAC,IAAI,cAAc,EAClD,SAAS,EAAE,QAAQ,mBAAmB,EACxC,CAAC,GACD,OAAO,SAAQ,aAAY,SAAS,IAAI,GACxC,OAAO,UAAS,UACd,gCAAgC,KAAK;EACnC,OAAO,SAAS,KAAK,KAAK;EAC1B,SAAS;CACX,CAAC,CACH,CACF;CAEA,MAAM,WAAW,OAAO,OAAO,IAAI;EACjC,aACE,IAAI,gCAAgC,EAAE,SAAS,mCAAmC,CAAC;EACrF,WAAW,wBAAwB,WAAW;CAChD,CAAC;CAED,MAAM,mBAAmB,OAAO,eAC9B,SAAS,wBACT,yDACF;CACA,MAAM,WAAW,OAAO,eACtB,SAAS,gBACT,iDACF;CACA,MAAM,iBACJ,OAAO,SAAS,WAAW,YAAY,SAAS,OAAO,KAAK,MAAM,KAC9D,SAAS,SACT,KAAA;CAEN,OAAO;EACL;EACA;EACA,GAAI,mBAAmB,KAAA,IAAY,CAAC,IAAI,EAAE,eAAe;CAC3D;AACF,CAAC;AAED,MAAM,mBACJ,OACA,UAEA,UAAU,KAAA,IAAY,KAAA,IAAY,OAAO,UAAU,aAAa,MAAM,EAAE,MAAM,CAAC,IAAI;AAErF,MAAM,iBACJ,OACA,UAEA,OAAO,UAAU,aAAa,MAAM,EAAE,MAAM,CAAC,IAAK,SAAS,CAAC;AAE9D,SAAS,sBAAsB;CAC7B,OAAO,gCAAgC,KAAK,EAAE,SAAS,8BAA8B,CAAC;AACxF;AAEA,MAAM,sBAAsB,OAAO,WAAW,WAAW,OAGW;CAClE,MAAM,MAAM,OAAO,OAAO,IAAI;EAC5B,OAAO;EACP,WAAW;GACT,IAAI,UAAU,WAAW,MAAM,KAAK,GAClC,OAAO,MAAM,MAAM,EAAE,OAAO,MAAM,MAAM,CAAC;GAE3C,IAAI,MAAM,UAAU,KAAA,GAClB,OAAO,CAAC;GAEV,OAAO,MAAM;EACf;CACF,CAAC;CACD,OAAO,OAAO,KAAK,OAAO,aAAa,YAAY,CAAC,CAAC,GAAG,GAAG,OAAO,SAAS,mBAAmB,CAAC;AACjG,CAAC;AAED,MAAM,qBAAqB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAAW,OAIN;CACxE,IAAI,MAAM,UAAU,KAAA,GAClB;CAEF,IAAI,OAAO,MAAM,UAAU,UACzB,OAAO,OAAO,eAAe,MAAM,OAAO,GAAG,MAAM,MAAM,UAAU;CAGrE,OAAO,OAAO,MAAM,MACjB,MAAM,MAAM,cAAc,CAAC,CAC3B,KACC,OAAO,UACL,UACE,IAAI,gCAAgC,EAClC,SAAS,qBAAqB,MAAM,MAAM,IAAI,MAAM,UACtD,CAAC,CACL,CACF;AACJ,CAAC;AAED,MAAM,qBAAqB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAAW,OAKJ;CAC1E,MAAM,QAAQ,MAAM,OAAO;CAC3B,IAAI,UAAU,KAAA,GACZ,OAAO,OAAO,IAAI,gCAAgC,EAAE,SAAS,4BAA4B,CAAC;CAG5F,MAAM,eAAe,OAAO,oBAAoB;EAC9C,OAAO,MAAM;EACb,OAAO,MAAM;CACf,CAAC;CAED,MAAM,SACJ,OAAO,MAAM,WAAW,aAAa,MAAM,OAAO,EAAE,OAAO,MAAM,MAAM,CAAC,IAAI,MAAM;CACpF,MAAM,WAAW,OAAO,mBAAmB;EACzC,gBAAgB,MAAM;EACtB,OAAO;EACP,OAAO,OAAO;CAChB,CAAC;CACD,MAAM,eAAe,OAAO,mBAAmB;EAC7C,gBAAgB,MAAM;EACtB,OAAO;EACP,OAAO,OAAO;CAChB,CAAC;CACD,IAAI,aAAa,KAAA,GACf,OAAO,OAAO,IAAI,gCAAgC,EAAE,SAAS,0BAA0B,CAAC;CAG1F,MAAM,mBAAmB,gBAAgB,MAAM,kBAAkB,MAAM,KAAK;CAC5E,MAAM,WAAW,gBAAgB,MAAM,UAAU,MAAM,KAAK;CAC5D,MAAM,eAAe,gBAAgB,MAAM,cAAc,MAAM,KAAK;CAWpE,OAAO;EACL,GATA,qBAAqB,KAAA,KAAa,aAAa,KAAA,IAC3C;GAAE;GAAkB;EAAS,IAC7B,iBAAiB,KAAA,IACf,OAAO,IAAI,gCAAgC,EACzC,SAAS,2DACX,CAAC,IACD,OAAO,eAAe,cAAc,MAAM,MAAM;EAItD,qBAAqB,cAAc,MAAM,qBAAqB,MAAM,KAAK;EACzE,sBAAsB,OAAO,kBAAkB;EAC/C;EACA;EACA,MAAM,MAAM,QAAQ;EACpB,QAAQ,MAAM;EACd;EACA,aAAa,cAAc,MAAM,aAAa,MAAM,KAAK;EACzD,sBAAsB,MAAM,wBAAwB;CACtD;AACF,CAAC;AAED,MAAM,yBAAyB,UAKjB;CACZ,MAAM,MAAM,IAAI,IAAI,MAAM,OAAO,gBAAgB;CACjD,IAAI,aAAa,IAAI,iBAAiB,MAAM;CAC5C,IAAI,aAAa,IAAI,aAAa,MAAM,OAAO,QAAQ;CACvD,IAAI,aAAa,IAAI,gBAAgB,MAAM,WAAW;CACtD,IAAI,aAAa,IAAI,SAAS,MAAM,KAAK;CACzC,IAAI,MAAM,OAAO,OAAO,SAAS,GAC/B,IAAI,aAAa,IAAI,SAAS,MAAM,OAAO,OAAO,KAAK,GAAG,CAAC;CAE7D,IAAI,MAAM,kBAAkB,KAAA,GAAW;EACrC,IAAI,aAAa,IAAI,kBAAkB,MAAM,aAAa;EAC1D,IAAI,aAAa,IAAI,yBAAyB,MAAM;CACtD;CACA,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,OAAO,mBAAmB,GACxE,IAAI,aAAa,IAAI,KAAK,KAAK;CAEjC,OAAO,IAAI,SAAS;AACtB;AAEA,MAAM,mBAAmB,WAA2B;CAClD,IAAI,UAAU,KACZ,OAAO;CAET,IAAI,UAAU,KACZ,OAAO;CAET,OAAO;AACT;AAEA,MAAM,0BAA0B,SAAqC;CACnE,IAAI;EACF,OAAO,yBAAyB,IAAI,CAAC,CAAC;CACxC,QAAQ;EACN;CACF;AACF;AAEA,MAAM,6BAA6B,SAAqC;CACtE,IAAI;EACF,OAAO,gCAAgC,IAAI,CAAC,CAAC;CAC/C,QAAQ;EACN;CACF;AACF;AAEA,MAAM,uBACJ,WAC2E;CAC3E,MAAM,UAAkC;EACtC,GAAG,OAAO;EACV,QAAQ;EACR,gBACE,OAAO,yBAAyB,SAC5B,qBACA;CACR;CACA,IAAI,OAAO,yBAAyB,SAAS;EAC3C,IAAI,OAAO,iBAAiB,KAAA,GAC1B,OAAO,OAAO,KACZ,IAAI,gCAAgC,EAClC,SAAS,6CACX,CAAC,CACH;EAEF,QAAQ,mBACN,SAAS,OAAO,OAAO,GAAG,OAAO,SAAS,GAAG,OAAO,cAAc;CACtE;CACA,OAAO,OAAO,QAAQ,OAAO;AAC/B;AAEA,MAAM,mBAAmB,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAAW,OAQ1E;CACA,IAAI,MAAM,OAAO,yBAAyB,QAAQ;EAChD,MAAM,OAAO,IAAI,aAAa,MAAM,OAAO,QAAQ;EACnD,IAAI,MAAM,OAAO,iBAAiB,KAAA,GAChC,MAAM,OAAO,IAAI,iBAAiB,MAAM,OAAO,YAAY;CAE/D,OAAO,IAAI,MAAM,OAAO,yBAAyB,QAC/C,MAAM,OAAO,IAAI,aAAa,MAAM,OAAO,QAAQ;CAGrD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,OAAO,WAAW,GAChE,MAAM,OAAO,IAAI,KAAK,KAAK;CAG7B,MAAM,UAAU,OAAO,oBAAoB,MAAM,MAAM;CACvD,MAAM,UAAU,kBAAkB,KAAK,MAAM,OAAO,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,KACzE,kBAAkB,SAChB,MAAM,OAAO,yBAAyB,SAClC,sBAAsB,OAAO,YAAY,MAAM,MAAM,CAAC,IACtD,MAAM,OAAO,SAAS,GAC1B,QAAQ,eACV,CACF;CACA,MAAM,WAAW,OAAO,KACtB,MAAM,OAAO,QAAQ,OAAO,GAC5B,OAAO,eACL,gBAAgB,aAChB,OAAO,cAAc,MAAM,OAAO,YAAY,IAAI,CAAC,IAAI,EAAE,UAAU,QAAQ,CAC7E,GACA,OAAO,UAAS,UACd,gCAAgC,KAAK;EACnC,OAAO,SAAS,KAAK,KAAK;EAC1B,SAAS,GAAG,MAAM,cAAc;CAClC,CAAC,CACH,CACF;CACA,IAAI,SAAS,SAAS,OAAO,SAAS,UAAU,KAAK;EACnD,MAAM,OAAO,OAAO,KAClB,SAAS,MACT,OAAO,UAAS,UACd,gCAAgC,KAAK;GACnC,OAAO,SAAS,KAAK,KAAK;GAC1B,SAAS,GAAG,MAAM,cAAc;EAClC,CAAC,CACH,CACF;EACA,MAAM,cAAc,gBAAgB,SAAS,MAAM;EACnD,MAAM,gBAAgB,uBAAuB,IAAI;EACjD,MAAM,eAAe,0BAA0B,IAAI;EACnD,MAAM,SAAS,MAAM,KACnB,MAAM,OAAO,CAAC,eAAe,YAAY,GAAG,UAAU,cAAc,GACpE,IACF;EACA,MAAM,UAAU,GAAG,MAAM,cAAc,IAAI,MAAM,KAAK,MAAM,OAAO,CAAC,aAAa,MAAM,GAAG,OAAO,UAAU,GAAG,IAAI,EAAE;EACpH,IAAI,kBAAkB,iBACpB,OAAO,OAAO,mBAAmB,KAAK;GACpC;GACA,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa;EACvD,CAAC;EAEH,OAAO,OAAO,gCAAgC,KAAK,EAAE,QAAQ,CAAC;CAChE;CACA,OAAO,OAAO,KACZ,SAAS,MACT,OAAO,UAAS,UACd,gCAAgC,KAAK;EACnC,OAAO,SAAS,KAAK,KAAK;EAC1B,SAAS,GAAG,MAAM,cAAc;CAClC,CAAC,CACH,GACA,OAAO,SAAQ,QACb,KACE,OAAO,oBAAoB,OAAO,OAAO,OAAO,QAAQ,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,GAC5E,OAAO,eACL,gCAAgC,KAAK,EAAE,SAAS,+BAA+B,CAAC,CAClF,CACF,CACF,CACF;AACF,CAAC;AAED,MAAM,mBAAmB,UAAuC;CAC9D,IAAI,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GACpD,OAAO;CAET,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM,IAAI;EACpD,MAAM,SAAS,OAAO,KAAK;EAC3B,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS,KAAA;CAC5C;AAEF;AAEA,MAAM,yBAAyB,OAAO,GAAG,kCAAkC,CAAC,CAAC,WAAW,OAIF;CACpF,MAAM,WAAW,OAAO,KACtB,OAAO,oBACL,MAAM,OAAO,QAAQ,iBAAiBA,2BACxC,CAAC,CAAC,MAAM,GAAG,GACX,OAAO,eACL,gCAAgC,KAAK,EAAE,SAAS,+BAA+B,CAAC,CAClF,CACF;CACA,MAAM,cAAc,OAAO,eACzB,SAAS,cACT,2CACF;CACA,IAAI,SAAS,eAAe,KAAK,MAAM,IACrC,OAAO,OAAO,gCAAgC,KAAK,EAAE,SAAS,+BAA+B,CAAC;CAEhG,MAAM,eAAe,SAAS,iBAAiB,MAAM;CACrD,MAAM,YAAY,gBAAgB,SAAS,UAAU;CACrD,IAAI,SAAS,eAAe,KAAA,MAAc,cAAc,KAAA,KAAa,YAAY,IAC/E,OAAO,OAAO,gCAAgC,KAAK,EAAE,SAAS,+BAA+B,CAAC;CAEhG,MAAM,MAAM,OAAO,MAAM;CACzB,MAAM,iBACJ,SAAS,eAAe,KAAA,IAAY,KAAA,IAAY,KAAK,MAAM,SAAS,UAAU;CAChF,IAAI,mBAAmB,KAAA,KAAa,CAAC,OAAO,SAAS,cAAc,GACjE,OAAO,OAAO,gCAAgC,KAAK,EAAE,SAAS,+BAA+B,CAAC;CAGhG,OAAO;EACL;EACA,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa;EACrD,GAAI,SAAS,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,SAAS,WAAW;EAC9E,GAAI,cAAc,KAAA,IAAY,CAAC,IAAI;GAAE,WAAW,MAAM,YAAY;GAAM;EAAU;EAClF,GAAI,mBAAmB,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,eAAe;EACpE,GAAI,SAAS,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,SAAS,MAAM;EAChE,KAAK,MAAM;CACb;AACF,CAAC;AAqBD,IAAa,UAAb,cAA6B,QAAQ,QAwBnC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC;;AAG/B,MAAa,WACX,UAMI,CAAC,MAEL,MAAM,QACJ,SACA,QAAQ,GAAG;CACT,UAAU,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAEhD,OAKC;EACD,IAAI,MAAM,MAAM,aAAa,MAAM,aAAa,OAC9C,OAAO,OAAO,IAAI,gCAAgC,EAAE,SAAS,uBAAuB,CAAC;EAEvF,IAAI,MAAM,MAAM,aAAa,KAAA,GAC3B,OAAO,OAAO,IAAI,sBAAsB;GACtC,OAAO,MAAM,MAAM;GACnB,kBAAkB,MAAM,MAAM;EAChC,CAAC;EAEH,IAAI,MAAM,MAAM,YAAY,KAAA,KAAa,MAAM,MAAM,OAAO,CAAC,KAAK,MAAM,IACtE,OAAO,OAAO,IAAI,gCAAgC,EAChD,SAAS,mCACX,CAAC;EAGH,MAAM,SAAyC;GAC7C,aAAa,QAAQ,eAAe,eAAe,MAAM,MAAM;GAC/D,WAAW,QAAQ,aAAa;GAChC,KAAK;IAAE,MAAM,MAAM,MAAM;IAAS,WAAW;IAAsB,SAAS;GAAK;GACjF,cAAc,QAAQ,gBAAgB,gBAAgB,MAAM,MAAM;GAClE,WAAW,QAAQ,aAAa;EAClC;EACA,OAAO;GAAE,UAAU;GAAQ;EAAO;CACpC,CAAC;CACD,SAAS,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAE9C,OAIC;EACD,MAAM,SAAyC;GAC7C,aAAa,QAAQ,wBAAwB,kBAAkB,MAAM;GACrE,WAAW,QAAQ,aAAa;GAChC,KAAK;IAAE,WAAW;IAAiB,SAAS;GAAK;GACjD,cAAc,MAAM;GACpB,WAAW,QAAQ,aAAa;EAClC;EACA,OAAO,OAAO;EACd,OAAO;GAAE,UAAU;GAAQ;EAAO;CACpC,CAAC;CACD,OAAO,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAA0C,OAKnF;EACD,MAAM,QAAQ,MAAM,OAAO;EAC3B,IAAI,UAAU,KAAA,GACZ,OAAO,OAAO,IAAI,gCAAgC,EAChD,SAAS,4BACX,CAAC;EAEH,MAAM,SACJ,OAAO,MAAM,WAAW,aAAa,MAAM,OAAO,EAAE,OAAO,MAAM,MAAM,CAAC,IAAI,MAAM;EACpF,MAAM,QAAQ,cAAc,OAAO,OAAO;EAC1C,MAAM,eAAe,MAAM,SAAS,QAAQ,OAAO,aAAa,OAAO,OAAO;EAC9E,MAAM,mBAAmB,IAAI,IAC3B,gBAAgB,MAAM,kBAAkB,MAAM,KAAK,KACjD,uCACJ;EACA,iBAAiB,aAAa,IAAI,iBAAiB,MAAM;EACzD,iBAAiB,aAAa,IAAI,aAAa,WAAW,OAAO,OAAO,QAAQ,CAAC;EACjF,iBAAiB,aAAa,IAAI,gBAAgB,MAAM,WAAW;EACnE,iBAAiB,aAAa,IAAI,SAAS,KAAK;EAChD,IAAI,MAAM,OAAO,SAAS,GACxB,iBAAiB,aAAa,IAAI,SAAS,MAAM,OAAO,KAAK,GAAG,CAAC;EAEnE,IAAI,iBAAiB,MAAM;GACzB,iBAAiB,aAAa,IAAI,kBAAkB,wBAAwB;GAC5E,iBAAiB,aAAa,IAAI,yBAAyB,MAAM;EACnE;EACA,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAChC,cAAc,MAAM,qBAAqB,MAAM,KAAK,CACtD,GACE,iBAAiB,aAAa,IAAI,KAAK,KAAK;EAG9C,OAAO;GACL,kBAAkB,iBAAiB,SAAS;GAC5C,cAAc;IACZ,WAAW,IAAI,MACZ,OAAO,MAAM,sBAAsB,MAAM,SAAS,iBACrD;IACA;IACA,aAAa,MAAM;IACnB;GACF;EACF;CACF,CAAC;AACH,CAAC,CACH;;AAGF,MAAa,QAAQ,MAAM,OACzB,SACA,OAAO,IAAI,aAAa;CACtB,MAAM,iBAAiB,OAAO,eAAe;CAC7C,MAAM,SAAS,OAAO,WAAW;CAEjC,MAAM,QAAQ,OAAO,GAAG,iBAAiB,CAAC,CAAC,WAA0C,OAKlF;EACD,MAAM,SAAS,OAAO,mBAAmB;GACvC;GACA;GACA,QAAQ,MAAM;GACd,OAAO,MAAM;EACf,CAAC;EACD,MAAM,YAAY,IAAI,MACnB,OAAO,MAAM,sBAAsB,MAAM,SAAS,iBACrD;EACA,MAAM,QAAQ,gBAAgB,EAAE;EAChC,MAAM,eAAe,OAAO,OAAO,gBAAgB,EAAE,IAAI,KAAA;EACzD,MAAM,gBACJ,iBAAiB,KAAA,IAAY,KAAA,IAAY,OAAO,gBAAgB,YAAY;EAE9E,OAAO;GACL,kBAAkB,sBAAsB;IACtC;IACA;IACA,aAAa,MAAM;IACnB;GACF,CAAC;GACD,cAAc;IACZ;IACA,cAAc,gBAAgB;IAC9B,aAAa,MAAM;IACnB;GACF;EACF;CACF,CAAC;CAED,MAAM,WAAW,OAAO,GAAG,oBAAoB,CAAC,CAAC,WAE/C,OAKC;EACD,IAAI,MAAM,MAAM,aAAa,MAAM,aAAa,OAC9C,OAAO,OAAO,IAAI,gCAAgC,EAAE,SAAS,uBAAuB,CAAC;EAEvF,IAAI,MAAM,MAAM,aAAa,KAAA,GAC3B,OAAO,OAAO,IAAI,sBAAsB;GACtC,OAAO,MAAM,MAAM;GACnB,kBAAkB,MAAM,MAAM;EAChC,CAAC;EAEH,MAAM,OAAO,MAAM,MAAM;EACzB,IAAI,SAAS,KAAA,KAAa,KAAK,KAAK,MAAM,IACxC,OAAO,OAAO,IAAI,gCAAgC,EAChD,SAAS,mCACX,CAAC;EAGH,MAAM,SAAS,OAAO,mBAAmB;GACvC;GACA;GACA,QAAQ,MAAM;GACd,OAAO,MAAM;EACf,CAAC;EACD,IACE,OAAO,mBAAmB,KAAA,KAC1B,MAAM,MAAM,WAAW,KAAA,KACvB,MAAM,MAAM,WAAW,OAAO,gBAE9B,OAAO,OAAO,IAAI,gCAAgC,EAAE,SAAS,wBAAwB,CAAC;EAGxF,MAAM,cAAc,IAAI,gBAAgB;GACtC;GACA,YAAY;GACZ,cAAc,MAAM,aAAa;EACnC,CAAC;EACD,IAAI,MAAM,aAAa,iBAAiB,MACtC,YAAY,IAAI,iBAAiB,MAAM,aAAa,YAAY;EAGlE,MAAM,YAAY,OAAO,KACvB,iBAAiB;GACf;GACA;GACA,eAAe;GACf,QAAQ;EACV,CAAC,GACD,OAAO,SAAS,uBAAsB,UACpC,OAAO,KAAK,gCAAgC,KAAK,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;EACA,MAAM,SAAS,OAAO,uBAAuB;GAAE,QAAQ,MAAM;GAAQ,KAAK;EAAU,CAAC;EACrF,OAAO;GAAE,UAAU;GAAQ;EAAO;CACpC,CAAC;CAED,MAAM,UAAU,OAAO,GAAG,mBAAmB,CAAC,CAAC,WAE7C,OAIC;EACD,MAAM,SAAS,OAAO,mBAAmB;GACvC;GACA;GACA,QAAQ,MAAM;GACd,OAAO,MAAM;EACf,CAAC;EACD,MAAM,YAAY,OAAO,iBAAiB;GACxC;GACA;GACA,eAAe;GACf,QAAQ,IAAI,gBAAgB;IAC1B,YAAY;IACZ,eAAe,MAAM;GACvB,CAAC;EACH,CAAC;EACD,MAAM,SAAS,OAAO,uBAAuB;GAC3C,QAAQ,MAAM;GACd,sBAAsB,MAAM;GAC5B,KAAK;EACP,CAAC;EACD,OAAO;GAAE,UAAU;GAAQ;EAAO;CACpC,CAAC;CAED,OAAO,QAAQ,GAAG;EAAE;EAAU;EAAS;CAAM,CAAC;AAChD,CAAC,CACH,CAAC,CAAC,KAAK,MAAM,QAAQ,gBAAgB,KAAK,CAAC;AAE3C,MAAa,4BAA4B,MAAM,OAC7CC,WACA,OAAO,IAAI,aAAa;CACtB,MAAM,OAAO,OAAO;CACpB,OAAA,UAAoC,GAAG,EACrC,UAAS,UACP,KACG,QAAQ;EAAE,QAAQ,MAAM;EAAQ,cAAc,MAAM;EAAc,OAAO,MAAM;CAAM,CAAC,CAAC,CACvF,KAAK,OAAO,KAAI,cAAa,UAAU,MAAM,CAAC,EACrD,CAAC;AACH,CAAC,CACH"}