@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.26

package/src/internal/oauth/connected-flow.ts

@@ -1,562 +0,0 @@
-import {
-  OAuthAccountRevision,
-  snapshotOAuthSync,
-  type OAuthConnectedPersistence,
-} from "@yielded/auth/OAuth";
-import * as M from "@yielded/auth/OAuth";
-import { Effect, Context, Layer } from "effect";
-
-import { OAuthConnectedState } from "./connected-state";
-import type * as STypes from "./connected-state";
-import { CurrentOAuthTransaction } from "./owner";
-import { OAuthQueryCompiler } from "./query-compiler";
-import { OAuthRegistration } from "./registration";
-import { digest, invariant, oauthIdentityKey, sameIdentity, sameRevision } from "./state";
-
-export type Input<K extends keyof OAuthConnectedPersistence["Service"]> = Parameters<
-  OAuthConnectedPersistence["Service"][K]
->[0];
-
-const make = Effect.gen(function* () {
-  const operations = yield* OAuthQueryCompiler;
-  const S = yield* OAuthConnectedState;
-  const registration = yield* OAuthRegistration;
-
-  const { sql } = operations;
-  const { both, copiedRow, equal } = operations;
-  const { acquireTuple, readTuple } = registration;
-
-  const pending = Effect.fn("oauthConnected.pending")(function* (
-    mapping: STypes.Authority,
-    access: M.OAuthConnectedAccess,
-    lock = true,
-  ) {
-    const owner = yield* CurrentOAuthTransaction;
-    const f = mapping.flow;
-
-    const read = yield* owner.read(
-      f.table,
-      equal(f.table, { [f.moduleId]: access.moduleId, [f.flowId]: access.flowId }),
-      { limit: 1, lock, observe: lock },
-    );
-
-    const row = read.rows[0];
-
-    if (row === undefined || row[f.snapshot] === null) return undefined;
-
-    const flow = S.flowStorage.decode(row[f.snapshot]),
-      c = flow.context;
-
-    const native = yield* mapping.subjectId.toNative(c.revision.subjectId);
-
-    invariant(
-      row[f.moduleId] === c.moduleId &&
-        row[f.flowId] === c.flowId &&
-        row[f.commandId] === c.commandId &&
-        mapping.subjectId.equals(native, row[f.subjectId]) &&
-        row[f.clientKey] === (yield* S.clientKey(S.configuration(flow))) &&
-        row[f.stateDigest] === c.stateDigest &&
-        mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis &&
-        mapping.clock.decodeInstant(row[f.retentionUntil]) === flow.retentionUntilMillis,
-    );
-
-    const matches =
-      c.moduleId === access.moduleId &&
-      c.generation === access.generation &&
-      c.flowId === access.flowId &&
-      c.revision.subjectId === access.subjectId &&
-      c.provider === access.provider &&
-      c.callbackId === access.callbackId &&
-      c.stateDigest === access.stateDigest &&
-      c.requestBindingVerifier === access.requestBindingVerifier &&
-      c.requestBindingExpiresAtMillis === access.requestBindingExpiresAtMillis &&
-      (c.responseIssuerMode === "required"
-        ? access.responseIssuer === c.issuer
-        : access.responseIssuer === undefined);
-
-    return matches ? { row, flow, native } : undefined;
-  });
-
-  const live = (flow: M.OAuthConnectedPendingFlow, now: number) =>
-    flow.context.issuedAtMillis <= now &&
-    now < flow.context.expiresAtMillis &&
-    flow.context.expiresAtMillis <= flow.context.requestBindingExpiresAtMillis &&
-    flow.retentionUntilMillis >= flow.context.expiresAtMillis + flow.context.claimLifetimeMillis;
-
-  const expected = (flow: M.OAuthConnectedPendingFlow) => ({
-    moduleId: flow.context.moduleId,
-    flowId: flow.context.flowId,
-    commandId: flow.context.commandId,
-    revision: flow.context.revision,
-    intent: S.contextStorage.encode(flow.context),
-    maximumAgeMillis: flow.context.maximumEvidenceAgeMillis,
-    configuration: S.configuration(flow),
-  });
-
-  const retain = Effect.fn("oauthConnected.retain")(function* (
-    mapping: STypes.Mapping,
-    input:
-      | ({ readonly _tag: "Prepare" } & Input<"prepare">)
-      | ({ readonly _tag: "Issue" } & Input<"issue">),
-  ) {
-    const owner = yield* CurrentOAuthTransaction;
-
-    const flow = snapshotOAuthSync(M.OAuthConnectedPendingFlow, input.flow),
-      c = flow.context;
-
-    const found = yield* S.current(mapping, c.revision.subjectId);
-
-    if (found === undefined) return { _tag: "Rejected" } as const;
-    if (input._tag === "Prepare") {
-      if (
-        input.authorization.moduleId !== c.moduleId ||
-        !sameRevision(input.authorization.revision, c.revision) ||
-        !sameRevision(found.revision, c.revision) ||
-        (yield* S.useAuthority(mapping, input.authorization, "metadata")) === undefined
-      )
-        return { _tag: "Rejected" } as const;
-    } else if (!(yield* S.action(mapping, found, input.authorization, "issue", expected(flow))))
-      return { _tag: "Rejected" } as const;
-    if (c.profile.revocation === "cohort") invariant(mapping.revocation.mode === "cohort");
-    const client = yield* S.client(mapping, S.configuration(flow), true);
-
-    invariant(client !== undefined);
-
-    const now = yield* owner.now(mapping.clock),
-      f = mapping.flow;
-
-    if (!live(flow, now)) return { _tag: "Rejected" } as const;
-    if (c.reconnect !== undefined) {
-      const original = yield* S.readGrant(mapping, c.moduleId, c.reconnect.grantId, false);
-
-      if (
-        original === undefined ||
-        original.context.subjectId !== c.revision.subjectId ||
-        !sameTarget(c.reconnect, original.context)
-      )
-        return { _tag: "Rejected" } as const;
-      owner.postconditions.push(
-        sql`exists(select 1 from ${mapping.grant.table} where ${owner.exact(mapping.grant.table, original.row)})`,
-      );
-    }
-    const key = { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId };
-    const prior = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });
-
-    const command = yield* owner.read(
-      f.table,
-      equal(f.table, { [f.moduleId]: c.moduleId, [f.commandId]: c.commandId }),
-      { limit: 1 },
-    );
-
-    owner.postconditions.push(
-      sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis} and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`,
-    );
-    if (input._tag === "Issue") {
-      const row = prior.rows[0];
-
-      if (
-        row === undefined ||
-        command.rows[0] === undefined ||
-        row[f.state] !== "Prepared" ||
-        row[f.snapshot] !== S.flowStorage.encode(flow) ||
-        command.rows[0][f.flowId] !== c.flowId
-      )
-        return { _tag: "Rejected" } as const;
-      yield* owner.update(
-        f.table,
-        { ...key, [f.state]: "Prepared", [f.version]: row[f.version] },
-        { [f.state]: "Pending", [f.version]: owner.marker },
-      );
-      owner.postconditions.push(
-        sql`exists(select 1 from ${f.table} where ${equal(f.table, { ...key, [f.state]: "Pending", [f.version]: owner.marker })})`,
-      );
-
-      return { _tag: "Issued", flow } as const;
-    }
-    if (prior.rows.length || command.rows.length) return { _tag: "Rejected" } as const;
-
-    const values = {
-      ...f.encodeInsert({
-        flow: snapshotOAuthSync(M.OAuthConnectedPendingFlow, flow),
-        subjectId: S.nativeCopy(found.nativeId),
-      }),
-      ...key,
-      [f.commandId]: c.commandId,
-      [f.subjectId]: found.nativeId,
-      [f.clientKey]: client.id,
-      [f.cohortKey]: null,
-      [f.state]: "Prepared",
-      [f.version]: owner.marker,
-      [f.stateDigest]: c.stateDigest,
-      [f.snapshot]: S.flowStorage.encode(flow),
-      [f.claimId]: null,
-      [f.claimDigest]: null,
-      [f.claimOrder]: null,
-      [f.claimedAt]: null,
-      [f.claimExpiresAt]: null,
-      [f.expiresAt]: mapping.clock.encodeInstant(c.expiresAtMillis),
-      [f.retentionUntil]: mapping.clock.encodeInstant(flow.retentionUntilMillis),
-      [f.work]: "None",
-      [f.custody]: null,
-    };
-
-    const inserted = yield* owner.insert(f.table, values, key, true);
-
-    prior.rows = inserted.rows;
-    command.rows = inserted.rows;
-    if (inserted.rows[0]?.[f.version] !== owner.marker) return { _tag: "Rejected" } as const;
-
-    return { _tag: "Issued", flow } as const;
-  });
-
-  const prepare = (mapping: STypes.Mapping, input: Input<"prepare">) =>
-    retain(mapping, { _tag: "Prepare", ...input });
-
-  const issue = (mapping: STypes.Mapping, input: Input<"issue">) =>
-    retain(mapping, { _tag: "Issue", ...input });
-
-  const inspectPrepared = Effect.fn("oauthConnected.inspectPrepared")(function* (
-    mapping: STypes.Mapping,
-    access: M.OAuthConnectedPreparedAccess,
-  ) {
-    const owner = yield* CurrentOAuthTransaction;
-    const found = yield* S.current(mapping, access.subjectId);
-
-    if (found === undefined) return undefined;
-    const f = mapping.flow;
-
-    const read = yield* owner.read(
-      f.table,
-      equal(f.table, {
-        [f.moduleId]: access.moduleId,
-        [f.flowId]: access.flowId,
-        [f.subjectId]: found.nativeId,
-      }),
-      { limit: 1 },
-    );
-
-    const row = read.rows[0];
-
-    if (row === undefined || row[f.state] !== "Prepared" || row[f.snapshot] === null)
-      return undefined;
-    const flow = S.flowStorage.decode(row[f.snapshot]);
-    const c = flow.context;
-
-    invariant(
-      row[f.moduleId] === c.moduleId &&
-        row[f.flowId] === c.flowId &&
-        row[f.commandId] === c.commandId &&
-        mapping.subjectId.equals(found.nativeId, row[f.subjectId]) &&
-        row[f.clientKey] === (yield* S.clientKey(S.configuration(flow))) &&
-        row[f.stateDigest] === c.stateDigest &&
-        mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis &&
-        mapping.clock.decodeInstant(row[f.retentionUntil]) === flow.retentionUntilMillis,
-    );
-    const now = yield* owner.now(mapping.clock);
-
-    return c.moduleId === access.moduleId &&
-      c.generation === access.generation &&
-      c.flowId === access.flowId &&
-      c.commandId === access.commandId &&
-      c.revision.subjectId === access.subjectId &&
-      sameRevision(found.revision, c.revision) &&
-      c.requestBindingVerifier === access.requestBindingVerifier &&
-      c.requestBindingExpiresAtMillis === access.requestBindingExpiresAtMillis &&
-      live(flow, now)
-      ? flow
-      : undefined;
-  });
-
-  const sameTarget = (target: M.OAuthConnectedTarget, context: M.OAuthConnectedTokenContext) =>
-    target.grantId === context.grantId &&
-    target.grantVersion === context.grantVersion &&
-    target.tokenVersion === context.tokenVersion &&
-    target.cohortGeneration === context.cohortGeneration &&
-    sameIdentity(target.identity, context.identity) &&
-    S.tokenContextStorage.encode({ ...context, configuration: target.configuration }) ===
-      S.tokenContextStorage.encode(context);
-
-  const capture = Effect.fn("oauthConnected.capture")(function* (
-    mapping: STypes.Mapping,
-    input: Input<"capture">,
-  ) {
-    const found = yield* S.current(mapping, input.subjectId);
-
-    if (found === undefined) return undefined;
-    if (input.grantId === undefined)
-      return { revision: snapshotOAuthSync(OAuthAccountRevision, found.revision) };
-    const grant = yield* S.readGrant(mapping, input.moduleId, input.grantId, false);
-
-    if (grant === undefined || grant.context.subjectId !== input.subjectId) return undefined;
-
-    return {
-      revision: snapshotOAuthSync(OAuthAccountRevision, found.revision),
-      target: snapshotOAuthSync(M.OAuthConnectedTarget, grant.context),
-    };
-  });
-
-  const preflight = Effect.fn("oauthConnected.preflight")(function* (
-    mapping: STypes.Mapping,
-    input: Input<"preflight">,
-  ) {
-    const owner = yield* CurrentOAuthTransaction;
-    const read = yield* pending(mapping, input);
-    const now = yield* owner.now(mapping.clock);
-
-    if (read === undefined || read.row[mapping.flow.state] !== "Pending" || !live(read.flow, now))
-      return undefined;
-
-    return read.flow;
-  });
-
-  const claim = Effect.fn("oauthConnected.claim")(function* (
-    mapping: STypes.Mapping,
-    input: Input<"claim">,
-  ) {
-    const owner = yield* CurrentOAuthTransaction;
-
-    const flow = snapshotOAuthSync(M.OAuthConnectedPendingFlow, input.flow),
-      c = flow.context;
-
-    const found = yield* S.current(mapping, c.revision.subjectId);
-
-    if (
-      found === undefined ||
-      !(yield* S.action(mapping, found, input.authorization, "claim", expected(flow)))
-    )
-      return { _tag: "Rejected" } as const;
-    const client = yield* S.client(mapping, S.configuration(flow), false);
-
-    if (client === undefined) return { _tag: "Rejected" } as const;
-
-    const read = yield* pending(mapping, input.access),
-      now = yield* owner.now(mapping.clock),
-      f = mapping.flow;
-
-    if (
-      read === undefined ||
-      read.row[f.state] !== "Pending" ||
-      S.flowStorage.encode(read.flow) !== S.flowStorage.encode(flow) ||
-      !live(flow, now)
-    )
-      return { _tag: "Rejected" } as const;
-    const expires = now + c.claimLifetimeMillis;
-
-    invariant(Number.isSafeInteger(expires) && expires <= flow.retentionUntilMillis);
-    yield* S.touchScope(mapping, client.scope);
-    const order = yield* S.nextOrder(mapping, client);
-
-    const claimed = snapshotOAuthSync(M.OAuthConnectedClaim, {
-      flow,
-      claimId: input.claimId,
-      claimedAtMillis: now,
-      claimExpiresAtMillis: expires,
-      order: String(order),
-    });
-
-    yield* owner.update(
-      f.table,
-      {
-        [f.moduleId]: c.moduleId,
-        [f.flowId]: c.flowId,
-        [f.state]: "Pending",
-        [f.version]: read.row[f.version],
-      },
-      {
-        [f.state]: "Claimed",
-        [f.claimId]: claimed.claimId,
-        [f.claimDigest]: yield* digest(S.claimStorage.encode(claimed)),
-        [f.claimOrder]: mapping.order.encode(order),
-        [f.claimedAt]: mapping.clock.encodeInstant(now),
-        [f.claimExpiresAt]: mapping.clock.encodeInstant(expires),
-        [f.work]: "Unresolved",
-        [f.version]: owner.marker,
-      },
-    );
-    owner.postconditions.push(
-      sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${Math.min(c.expiresAtMillis, expires)}`,
-    );
-
-    return { _tag: "Claimed", claim: claimed } as const;
-  });
-
-  const exact = Effect.fn("oauthConnected.exactClaim")(function* (
-    mapping: STypes.Authority,
-    claim: M.OAuthConnectedClaim,
-  ) {
-    const owner = yield* CurrentOAuthTransaction;
-
-    const f = mapping.flow,
-      c = claim.flow.context;
-
-    const read = yield* owner.read(
-      f.table,
-      equal(f.table, { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId }),
-      { limit: 1 },
-    );
-
-    const row = read.rows[0];
-
-    if (
-      row === undefined ||
-      row[f.work] !== "Unresolved" ||
-      row[f.claimId] !== claim.claimId ||
-      row[f.claimDigest] !== (yield* digest(S.claimStorage.encode(claim)))
-    )
-      return undefined;
-    const native = yield* mapping.subjectId.toNative(c.revision.subjectId);
-
-    invariant(
-      row[f.commandId] === c.commandId &&
-        mapping.subjectId.equals(native, row[f.subjectId]) &&
-        row[f.stateDigest] === c.stateDigest &&
-        mapping.clock.decodeInstant(row[f.expiresAt]) === c.expiresAtMillis &&
-        mapping.clock.decodeInstant(row[f.retentionUntil]) === claim.flow.retentionUntilMillis &&
-        row[f.clientKey] === (yield* S.clientKey(S.configuration(claim.flow))) &&
-        S.nativeOrder(mapping, row[f.claimOrder]) === S.orderNumber(claim.order) &&
-        mapping.clock.decodeInstant(row[f.claimedAt]) === claim.claimedAtMillis &&
-        mapping.clock.decodeInstant(row[f.claimExpiresAt]) === claim.claimExpiresAtMillis,
-    );
-    const now = yield* owner.now(mapping.clock);
-
-    invariant(now >= claim.claimedAtMillis);
-
-    return { row, now, active: row[f.state] === "Claimed" && now < claim.claimExpiresAtMillis };
-  });
-
-  const terminal = Effect.fn("oauthConnected.terminal")(function* (
-    mapping: STypes.Authority,
-    claim: M.OAuthConnectedClaim,
-    state: string,
-    work: "Resolved" | "Unresolved",
-    custody?: { cohort: string; sealed?: M.OAuthConnectedStoredGrant },
-  ) {
-    const owner = yield* CurrentOAuthTransaction;
-
-    const f = mapping.flow,
-      c = claim.flow.context;
-
-    yield* owner.update(
-      f.table,
-      { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId, [f.claimId]: claim.claimId },
-      {
-        [f.state]: state,
-        [f.snapshot]: null,
-        [f.work]: work,
-        [f.cohortKey]: custody?.cohort ?? null,
-        [f.custody]: custody?.sealed === undefined ? null : S.grantStorage.encode(custody.sealed),
-        [f.version]: owner.marker,
-      },
-    );
-  });
-
-  const inspectTuple = Effect.fn("oauthConnected.inspectTuple")(function* (
-    mapping: STypes.Authority,
-    identity: M.OAuthConnectedTokenContext["identity"],
-  ) {
-    const owner = yield* CurrentOAuthTransaction;
-
-    const t = mapping.ownership.tuple,
-      key = yield* oauthIdentityKey(identity);
-
-    const read = yield* owner.read(t.table, equal(t.table, { [t.identityKey]: key }), { limit: 1 });
-    const row = read.rows[0];
-
-    if (row !== undefined) {
-      invariant(
-        row[t.provider] === identity.provider &&
-          row[t.issuer] === identity.issuer &&
-          row[t.externalSubject] === identity.subject &&
-          ["Owned", "Unowned", "Reserved"].includes(row[t.state]),
-      );
-    }
-    if (mapping.ownership.mode === "separate") {
-      const o = mapping.ownership.external;
-
-      const external = yield* owner.read(o.table, equal(o.table, { [o.identityKey]: key }), {
-        limit: 1,
-      });
-
-      if (row?.[t.state] === "Owned") {
-        const e = external.rows[0];
-
-        invariant(
-          e !== undefined &&
-            e[o.provider] === identity.provider &&
-            e[o.issuer] === identity.issuer &&
-            e[o.externalSubject] === identity.subject &&
-            mapping.subjectId.equals(o.decodeSubjectId(copiedRow(e)), row[t.subjectId]),
-        );
-        const condition = sql`exists(select 1 from ${o.table} where ${both(equal(o.table, { [o.identityKey]: key }), o.ownedCondition)})`;
-
-        invariant(yield* owner.check(condition));
-        owner.postconditions.push(condition);
-      } else invariant(external.rows.length === 0);
-    }
-
-    return { key, row };
-  });
-
-  const inspectGrant = Effect.fn("oauthConnected.inspectGrant")(function* (
-    mapping: STypes.Mapping,
-    input: Input<"inspectGrant">,
-  ) {
-    const c = input.claim.flow.context;
-
-    if (input.identity.provider !== c.provider || input.identity.issuer !== c.issuer)
-      return { _tag: "Rejected" } as const;
-    const found = yield* S.current(mapping, c.revision.subjectId);
-
-    if (found === undefined || !sameRevision(found.revision, c.revision))
-      return { _tag: "Rejected" } as const;
-    const cl = yield* S.client(mapping, S.configuration(input.claim.flow), false);
-
-    if (cl === undefined) return { _tag: "Rejected" } as const;
-
-    const tuple = yield* inspectTuple(mapping, input.identity),
-      t = mapping.ownership.tuple;
-
-    if (
-      tuple.row?.[t.state] === "Reserved" ||
-      (tuple.row?.[t.state] === "Owned" &&
-        !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId))
-    )
-      return { _tag: "Conflict" } as const;
-    const co = yield* S.cohort(mapping, cl.id, tuple.key, false);
-    const claimed = yield* exact(mapping, input.claim);
-
-    if (claimed === undefined) return { _tag: "Rejected" } as const;
-    if (c.reconnect !== undefined && !sameIdentity(c.reconnect.identity, input.identity))
-      return { _tag: "Conflict" } as const;
-
-    return co.blocked || S.orderNumber(input.claim.order) <= co.cutoff || !claimed.active
-      ? ({ _tag: "Quarantine", cohortGeneration: co.generation } as const)
-      : ({ _tag: "Target", cohortGeneration: co.generation } as const);
-  });
-
-  return {
-    pending,
-    live,
-    expected,
-    prepare,
-    issue,
-    inspectPrepared,
-    sameTarget,
-    capture,
-    preflight,
-    claim,
-    exact,
-    terminal,
-    inspectTuple,
-    inspectGrant,
-    acquireTuple,
-    readTuple,
-  };
-});
-
-export class OAuthConnectedFlow extends Context.Service<
-  OAuthConnectedFlow,
-  Effect.Success<typeof make>
->()("effect-auth/persistence/OAuthConnectedFlow") {
-  static readonly layer = Layer.effect(OAuthConnectedFlow, make);
-}

package/src/internal/oauth/connected-input.ts

@@ -1,147 +0,0 @@
-import * as M from "@yielded/auth/OAuth";
-import {
-  OAuthConnectedRevocationClaim,
-  OAuthClaimId,
-  OAuthCleanupInput,
-  OAuthCommandId,
-  OAuthExternalIdentity,
-  OAuthInstant,
-  OAuthModuleId,
-  snapshotOAuthSync,
-} from "@yielded/auth/OAuth";
-import { Schema } from "effect";
-
-const capture = Schema.Struct({
-  moduleId: OAuthModuleId,
-  subjectId: M.OAuthConnectedUseAuthorization.fields.revision.fields.subjectId,
-  grantId: Schema.optionalKey(M.OAuthGrantId),
-});
-
-const issue = Schema.Struct({
-  flow: M.OAuthConnectedPendingFlow,
-  authorization: M.OAuthConnectedActionAuthorization,
-});
-
-const preparation = Schema.Struct({
-  flow: M.OAuthConnectedPendingFlow,
-  authorization: M.OAuthConnectedUseAuthorization,
-});
-
-const claim = Schema.Struct({
-  ...issue.fields,
-  access: M.OAuthConnectedAccess,
-  claimId: OAuthClaimId,
-});
-
-const inspectGrant = Schema.Struct({
-  claim: M.OAuthConnectedClaim,
-  identity: OAuthExternalIdentity,
-});
-
-const settle = Schema.Struct({
-  claim: M.OAuthConnectedClaim,
-  outcome: M.OAuthConnectedOutcome,
-  authorization: M.OAuthConnectedActionAuthorization,
-  nowMillis: OAuthInstant,
-});
-
-const list = Schema.Struct({
-  ...M.OAuthConnectedList.fields,
-  authorization: M.OAuthConnectedUseAuthorization,
-});
-
-const inspectDisconnect = Schema.Struct({
-  moduleId: OAuthModuleId,
-  subjectId: capture.fields.subjectId,
-  authorization: M.OAuthConnectedUseAuthorization,
-  commandId: OAuthCommandId,
-  grantId: M.OAuthGrantId,
-});
-
-const disconnect = Schema.Struct({
-  moduleId: OAuthModuleId,
-  commandId: OAuthCommandId,
-  grant: M.OAuthConnectedDisconnectGrant,
-  authorization: M.OAuthConnectedActionAuthorization,
-  revocation: Schema.optionalKey(M.OAuthConnectedRevocationJob),
-  retentionUntilMillis: OAuthInstant,
-});
-
-const inspectAccess = Schema.Struct({
-  authorization: M.OAuthConnectedUseAuthorization,
-  ...M.OAuthConnectedUse.fields,
-});
-
-const claimRefresh = Schema.Struct({
-  grant: M.OAuthConnectedStoredGrant,
-  authorization: M.OAuthConnectedUseAuthorization,
-  claimId: OAuthClaimId,
-  nextTokenVersion: M.OAuthConnectedRefreshClaim.fields.nextTokenVersion,
-  lifetimeMillis: M.OAuthConnectedPolicy.fields.refreshClaimLifetimeMillis,
-});
-
-const settleRefresh = Schema.Struct({
-  claim: M.OAuthConnectedRefreshClaim,
-  authorization: M.OAuthConnectedUseAuthorization,
-  outcome: M.OAuthConnectedRefreshOutcome,
-});
-
-const admitUse = Schema.Struct({
-  grant: M.OAuthConnectedStoredGrant,
-  authorization: M.OAuthConnectedUseAuthorization,
-  admissionId: OAuthClaimId,
-  lifetimeMillis: M.OAuthConnectedPolicy.fields.useAdmissionLifetimeMillis,
-});
-
-const revocationClaim = Schema.Struct({
-  moduleId: OAuthModuleId,
-  claimId: OAuthClaimId,
-  lifetimeMillis: M.OAuthConnectedPolicy.fields.refreshClaimLifetimeMillis,
-});
-
-const revocationSettle = Schema.Struct({
-  claim: OAuthConnectedRevocationClaim,
-  outcome: Schema.Literals(["Confirmed", "Unknown"]),
-});
-
-const snapshot =
-  <A, I>(schema: Schema.Codec<A, I, never, never>) =>
-  (input: A) =>
-    snapshotOAuthSync(schema, input);
-
-export const connectedInputs = {
-  claimSignIn: snapshot(
-    Schema.Struct({ claim: M.OAuthClaim, configuration: M.OAuthConnectedConfiguration }),
-  ),
-  inspectSignIn: snapshot(
-    Schema.Struct({
-      reservation: M.OAuthSignInAccessClaim,
-      credential: M.OAuthCredentialSnapshot,
-      grantId: M.OAuthGrantId,
-    }),
-  ),
-  settleSignIn: snapshot(
-    Schema.Struct({ reservation: M.OAuthSignInAccessClaim, outcome: M.OAuthSignInAccessOutcome }),
-  ),
-  capture: snapshot(capture),
-  issue: snapshot(issue),
-  prepare: snapshot(preparation),
-  inspectPrepared: snapshot(M.OAuthConnectedPreparedAccess),
-  preflight: snapshot(M.OAuthConnectedAccess),
-  claim: snapshot(claim),
-  inspectGrant: snapshot(inspectGrant),
-  settle: snapshot(settle),
-  list: snapshot(list),
-  inspectDisconnect: snapshot(inspectDisconnect),
-  disconnect: snapshot(disconnect),
-  inspectAccess: snapshot(inspectAccess),
-  claimRefresh: snapshot(claimRefresh),
-  settleRefresh: snapshot(settleRefresh),
-  admitUse: snapshot(admitUse),
-  cleanup: snapshot(OAuthCleanupInput),
-};
-
-export const connectedRevocationInputs = {
-  claim: snapshot(revocationClaim),
-  settle: snapshot(revocationSettle),
-};