@yielded/auth 0.1.0-beta.1

package/dist/oauth/connected.mjs

@@ -0,0 +1,526 @@
+import { TokenDigest } from "../Schema.mjs";
+import { IdentityConflict } from "../identity/models.mjs";
+import { HookDenied, LifecycleEventId, lifecycleEvent, lifecycleSnapshot } from "../hooks/models.mjs";
+import { AuthenticationRequired } from "../operations/errors.mjs";
+import { makeOperation, operationGroup } from "../operations/operation.mjs";
+import { AuthenticationFlowId, SecurityRevision } from "../sessions/models.mjs";
+import { LifecycleHooks } from "../hooks/LifecycleHooks.mjs";
+import { assessAuthentication } from "../sessions/assurance.mjs";
+import { makeRequestBinding } from "../operations/requestBinding.mjs";
+import { OAuthAuthorizationUrl, OAuthCallbackResponse, OAuthClaimId, OAuthExternalIdentity, OAuthReturnTarget, OAuthSealedTransaction, OAuthSignInAuthorization, OAuthTransactionSecrets } from "./signInModels.mjs";
+import { OAuthAccountRevision } from "./accountsModels.mjs";
+import { OAuthMethodUnsupported, OAuthProtocolRejected, OAuthRejected, OAuthUnavailable } from "./signInErrors.mjs";
+import { snapshotOAuth, snapshotOAuthSync } from "./signInSnapshot.mjs";
+import { OAuthConnectedAccess, OAuthConnectedActionAuthorization, OAuthConnectedActionChallenge, OAuthConnectedActionRequired, OAuthConnectedBegin, OAuthConnectedBusy, OAuthConnectedClaim, OAuthConnectedClaimDecision, OAuthConnectedComplete, OAuthConnectedConfiguration, OAuthConnectedDisconnect, OAuthConnectedDisconnectDecision, OAuthConnectedDisconnectGrant, OAuthConnectedDisconnectInspection, OAuthConnectedDisconnected, OAuthConnectedGrantInspection, OAuthConnectedIssueDecision, OAuthConnectedList, OAuthConnectedListResult, OAuthConnectedOutcome, OAuthConnectedPendingFlow, OAuthConnectedProfile, OAuthConnectedReauthorizationRequired, OAuthConnectedResult, OAuthConnectedRevocationContext, OAuthConnectedRevocationJob, OAuthConnectedSettlementDecision, OAuthConnectedStoredGrant, OAuthConnectedTarget, OAuthConnectedTokenContext, OAuthConnectedTokenMaterial, OAuthConnectedTransactionContext, OAuthGrantId } from "./connectedModels.mjs";
+import { OAuthConnectedPersistence } from "./OAuthConnectedPersistence.mjs";
+import { OAuthConnectedProtocol } from "./OAuthConnectedProtocol.mjs";
+import { OAuthConnectedTokenProtector } from "./OAuthConnectedTokenProtector.mjs";
+import { OAuthConnectedUseAuthority } from "./OAuthConnectedUseAuthority.mjs";
+import { captureConnectedPolicy, connectedBounded, connectedCaller, connectedGrantResponse, connectedProfile, connectedRead, connectedSafe, connectedSame, connectedUseAuthorization, makeOAuthConnectedAccess, validateConnectedPolicy, wipeConnectedMaterial } from "./connectedAccess.mjs";
+import { OAuthConnectedActionEvidence } from "./OAuthConnectedActionEvidence.mjs";
+import { OAuthConnectedTransactionProtector } from "./OAuthConnectedTransactionProtector.mjs";
+import { OAuthReturnTargets } from "./OAuthReturnTargets.mjs";
+import { makeOAuthConnectedMaintenance } from "./connectedMaintenance.mjs";
+import { Cause, Context, Crypto, DateTime, Effect, Encoding, Exit, Layer, Redacted, Result, Schema } from "effect";
+//#region src/oauth/connected.ts
+const Failure = Schema.Union([
+	AuthenticationRequired,
+	OAuthConnectedActionRequired,
+	OAuthConnectedBusy,
+	OAuthConnectedReauthorizationRequired,
+	OAuthRejected,
+	OAuthUnavailable,
+	OAuthMethodUnsupported,
+	IdentityConflict,
+	HookDenied
+]);
+const capturedSchema = Schema.Struct({
+	revision: OAuthAccountRevision,
+	target: Schema.optionalKey(OAuthConnectedTarget)
+});
+const preparationSchema = Schema.Struct({
+	configuration: OAuthConnectedConfiguration,
+	authorizationUrl: OAuthAuthorizationUrl,
+	secrets: OAuthTransactionSecrets
+});
+const encoder = new TextEncoder();
+const strings = Schema.fromJsonString(Schema.Array(Schema.String));
+const contextJson = Schema.fromJsonString(OAuthConnectedTransactionContext);
+const clearBinding = Object.freeze([Object.freeze({
+	_tag: "Clear",
+	slot: "request-binding"
+})]);
+/** Opt-in API access. No login factor/session creation or token-bearing RPC. */
+const makeOAuthConnected = (moduleId, configuration) => {
+	const binding = makeRequestBinding(moduleId, "oauth-connected");
+	const Connected = Context.Service()("effect-auth/oauth/" + moduleId.length + ":" + moduleId + "/Connected");
+	const captured = captureConnectedPolicy(configuration);
+	const layer = Layer.effect(Connected, Effect.gen(function* () {
+		const { id, policy } = yield* validateConnectedPolicy(moduleId, captured);
+		const { issue: issueBinding, verify: verifyBinding } = yield* binding.RequestBinding;
+		const { capture, issue, preflight, claim, inspectGrant, settle, list: listRows, inspectDisconnect, disconnect: disconnectRow } = yield* OAuthConnectedPersistence;
+		const { verify: verifyAction } = yield* OAuthConnectedActionEvidence;
+		const { authorize: authorizeUse } = yield* OAuthConnectedUseAuthority;
+		const { prepareAuthorization, exchangeGrant } = yield* OAuthConnectedProtocol;
+		const { seal: sealFlow, open: openFlow } = yield* OAuthConnectedTransactionProtector;
+		const { seal: sealTokens, open: openTokens } = yield* OAuthConnectedTokenProtector;
+		const { resolve: resolveTarget } = yield* OAuthReturnTargets;
+		const { before } = yield* LifecycleHooks;
+		const { randomBytes, digest } = yield* Crypto.Crypto;
+		const random = Effect.fn("OAuthConnected.random")(function* () {
+			const bytes = yield* randomBytes(32).pipe(Effect.mapError(() => OAuthUnavailable.make({})));
+			const value = OAuthClaimId.make(Encoding.encodeBase64Url(bytes));
+			bytes.fill(0);
+			return value;
+		});
+		const hash = Effect.fn("OAuthConnected.hash")(function* (value) {
+			const bytes = yield* digest("SHA-256", encoder.encode(value)).pipe(Effect.mapError(() => OAuthUnavailable.make({})));
+			return TokenDigest.make(Encoding.encodeBase64Url(bytes));
+		});
+		const stateDigest = Effect.fn("OAuthConnected.stateDigest")(function* (flowId, provider, secret) {
+			const raw = Redacted.value(secret);
+			if (!/^[A-Za-z0-9_-]{43}$/.test(raw)) return yield* OAuthRejected.make({});
+			const bytes = Result.getOrUndefined(Encoding.decodeBase64Url(raw));
+			if (!bytes || bytes.length !== 32 || Encoding.encodeBase64Url(bytes) !== raw) {
+				bytes?.fill(0);
+				return yield* OAuthRejected.make({});
+			}
+			bytes.fill(0);
+			return yield* hash(Schema.encodeSync(strings)([
+				"effect-auth/oauth-connected-state/v1",
+				id,
+				String(policy.generation),
+				provider,
+				flowId,
+				raw
+			]));
+		});
+		const challenge = Effect.fn("OAuthConnected.challenge")(function* (action, flowId, commandId, revision, intent) {
+			const intentDigest = yield* hash(intent);
+			return snapshotOAuthSync(OAuthConnectedActionChallenge, {
+				moduleId: id,
+				action,
+				flowId,
+				commandId,
+				revision,
+				intentDigest,
+				bindingDigest: yield* hash(Schema.encodeSync(strings)([
+					"effect-auth/oauth-connected-action/v1",
+					id,
+					action,
+					flowId,
+					commandId,
+					intentDigest
+				]))
+			});
+		});
+		const authorize = Effect.fn("OAuthConnected.authorize")(function* (caller, expected, proof, maximumAge = policy.maximumEvidenceAgeMillis) {
+			const granted = yield* verifyAction({
+				invocation: { ...caller },
+				challenge: snapshotOAuthSync(OAuthConnectedActionChallenge, expected),
+				...proof === void 0 ? {} : { proof: Redacted.make(Redacted.value(proof)) }
+			});
+			const authorization = yield* snapshotOAuth(OAuthConnectedActionAuthorization, {
+				challenge: expected,
+				evidence: granted.evidence,
+				requirement: {
+					...granted.requirement,
+					maximumAgeMillis: Math.min(maximumAge, policy.maximumEvidenceAgeMillis, granted.requirement.maximumAgeMillis)
+				}
+			}).pipe(Effect.mapError(() => OAuthConnectedActionRequired.make({})));
+			const evidence = authorization.evidence;
+			if (evidence.flowId !== AuthenticationFlowId.make(expected.flowId) || evidence.bindingDigest !== expected.bindingDigest || !connectedSame(OAuthAccountRevision, evidence.revision, expected.revision) || new Set(evidence.revision.credentials.map((v) => v.credentialId)).size !== evidence.revision.credentials.length || !(yield* assessAuthentication(evidence, authorization.requirement).pipe(Effect.mapError(() => OAuthConnectedActionRequired.make({})))).satisfied) return yield* OAuthConnectedActionRequired.make({});
+			return authorization;
+		});
+		const binderError = (error) => error._tag === "RequestBindingInvalid" ? OAuthRejected.make({}) : OAuthUnavailable.make({});
+		const eventFor = Effect.fn("OAuthConnected.event")(function* (operation, subjectId) {
+			const snapshot = lifecycleSnapshot({
+				action: "linking",
+				operation: moduleId + "/connected/" + operation,
+				subjectId,
+				method: "oauth-connected",
+				identifiers: []
+			});
+			yield* before(snapshot);
+			return lifecycleEvent({
+				id: LifecycleEventId.make(yield* random()),
+				occurredAtMillis: DateTime.toEpochMillis(yield* DateTime.now),
+				snapshot
+			});
+		});
+		const begin = Effect.fn("OAuthConnected.begin")(function* (invocation, raw) {
+			const caller = yield* connectedCaller(invocation);
+			const request = yield* snapshotOAuth(OAuthConnectedBegin, raw);
+			const found = yield* capture({
+				moduleId: id,
+				subjectId: caller.subjectId,
+				...request.intent._tag === "Reconnect" ? { grantId: request.intent.grantId } : {}
+			});
+			if (!found) return yield* OAuthRejected.make({});
+			const owned = yield* snapshotOAuth(capturedSchema, found);
+			if (owned.revision.subjectId !== caller.subjectId || request.intent._tag === "Reconnect" && (!owned.target || owned.target.grantId !== request.intent.grantId)) return yield* OAuthUnavailable.make({});
+			const profile = policy.profiles.find((value) => value.key === request.intent.profileKey && value.issuance === "active");
+			const provider = request.intent._tag === "Connect" ? request.intent.provider : owned.target.identity.provider;
+			if (!profile || profile.provider !== provider || request.intent._tag === "Reconnect" && profile.clientRegistrationId !== owned.target.configuration.profile.clientRegistrationId) return yield* OAuthRejected.make({});
+			const returnTarget = yield* resolveTarget(request.returnTarget).pipe(Effect.flatMap((value) => snapshotOAuth(OAuthReturnTarget, value)));
+			const issued = yield* issueBinding(request.flowId).pipe(Effect.mapError(binderError));
+			const original = issued.credentialCommands[0];
+			if (issued.credentialCommands.length !== 1 || original?._tag !== "Issue" || original.slot !== "request-binding" || issued.value.flowId !== request.flowId || original.expiresAtMillis !== issued.value.expiresAtMillis) return yield* OAuthUnavailable.make({});
+			const command = Object.freeze({
+				_tag: "Issue",
+				slot: "request-binding",
+				credential: Redacted.make(Redacted.value(original.credential)),
+				expiresAtMillis: original.expiresAtMillis
+			});
+			const binder = { ...yield* verifyBinding(request.flowId, Redacted.make(Redacted.value(command.credential))).pipe(Effect.mapError(binderError)) };
+			if (binder.expiresAtMillis !== command.expiresAtMillis) return yield* OAuthUnavailable.make({});
+			const prepared = yield* prepareAuthorization({
+				profile: snapshotOAuthSync(OAuthConnectedProfile, profile),
+				callbackId: request.callbackId,
+				flowId: request.flowId
+			}).pipe(Effect.mapError((error) => error._tag === "OAuthProtocolRejected" ? OAuthRejected.make({}) : error), Effect.flatMap((value) => snapshotOAuth(preparationSchema, value)));
+			if (prepared.configuration.provider !== provider || prepared.configuration.callbackId !== request.callbackId || !connectedSame(OAuthConnectedProfile, prepared.configuration.profile, profile) || prepared.configuration.protocol === "oidc" !== (prepared.secrets.oidcNonce !== void 0) || request.intent._tag === "Reconnect" && prepared.configuration.issuer !== owned.target.identity.issuer) return yield* OAuthUnavailable.make({});
+			const now = DateTime.toEpochMillis(yield* DateTime.now);
+			const expiresAtMillis = Math.min(now + policy.lifetimeMillis, binder.expiresAtMillis);
+			if (expiresAtMillis <= now) return yield* OAuthRejected.make({});
+			const context = snapshotOAuthSync(OAuthConnectedTransactionContext, {
+				...prepared.configuration,
+				namespace: "effect-auth/oauth-connected-context/v1",
+				moduleId: id,
+				generation: policy.generation,
+				flowId: request.flowId,
+				commandId: request.commandId,
+				revision: owned.revision,
+				grantId: request.intent._tag === "Reconnect" ? request.intent.grantId : OAuthGrantId.make(yield* random()),
+				...request.intent._tag === "Reconnect" ? { reconnect: owned.target } : {},
+				maximumEvidenceAgeMillis: policy.maximumEvidenceAgeMillis,
+				returnTarget,
+				stateDigest: yield* stateDigest(request.flowId, provider, prepared.secrets.state),
+				requestBindingVerifier: binder.verifier,
+				requestBindingExpiresAtMillis: binder.expiresAtMillis,
+				issuedAtMillis: now,
+				expiresAtMillis,
+				claimLifetimeMillis: policy.claimLifetimeMillis
+			});
+			const authorization = yield* authorize(caller, yield* challenge("connected-begin", context.flowId, context.commandId, context.revision, Schema.encodeSync(contextJson)(context)), request.actionProof);
+			const sealed = yield* sealFlow({
+				context,
+				secrets: snapshotOAuthSync(OAuthTransactionSecrets, prepared.secrets)
+			}).pipe(Effect.flatMap((value) => snapshotOAuth(OAuthSealedTransaction, value)));
+			const flow = snapshotOAuthSync(OAuthConnectedPendingFlow, {
+				context,
+				sealed,
+				retentionUntilMillis: expiresAtMillis + policy.retentionMillis
+			});
+			const receipt = yield* issue({
+				flow: snapshotOAuthSync(OAuthConnectedPendingFlow, flow),
+				authorization
+			}, (value, journal) => {
+				const decision = snapshotOAuthSync(OAuthConnectedIssueDecision, value);
+				if (decision._tag === "Issued" && !connectedSame(OAuthConnectedPendingFlow, decision.flow, flow)) throw OAuthUnavailable.make({});
+				return journal.prepare(decision._tag === "Issued");
+			});
+			if (!(yield* connectedRead(receipt))) return yield* OAuthRejected.make({});
+			return {
+				value: {
+					flowId: request.flowId,
+					authorizationUrl: prepared.authorizationUrl,
+					expiresAtMillis
+				},
+				credentialCommands: [command]
+			};
+		}, connectedSafe);
+		const complete = Effect.fn("OAuthConnected.complete")(function* (invocation, raw) {
+			const caller = yield* connectedCaller(invocation);
+			const request = yield* snapshotOAuth(OAuthConnectedComplete, raw);
+			const response = request.response;
+			if (encoder.encode(Schema.encodeSync(Schema.fromJsonString(OAuthCallbackResponse))(response)).length > 16384) return yield* OAuthRejected.make({});
+			const binder = { ...yield* verifyBinding(request.flowId, request.requestBinding).pipe(Effect.mapError(binderError)) };
+			const access = snapshotOAuthSync(OAuthConnectedAccess, {
+				moduleId: id,
+				generation: policy.generation,
+				subjectId: caller.subjectId,
+				flowId: request.flowId,
+				provider: request.provider,
+				callbackId: request.callbackId,
+				stateDigest: yield* stateDigest(request.flowId, request.provider, response.state),
+				requestBindingVerifier: binder.verifier,
+				requestBindingExpiresAtMillis: binder.expiresAtMillis,
+				...response.issuer === void 0 ? {} : { responseIssuer: response.issuer },
+				nowMillis: DateTime.toEpochMillis(yield* DateTime.now)
+			});
+			const inspected = yield* preflight(access);
+			if (!inspected) return yield* OAuthRejected.make({});
+			const flow = yield* snapshotOAuth(OAuthConnectedPendingFlow, inspected);
+			const context = flow.context;
+			if (context.moduleId !== id || context.generation !== policy.generation || context.flowId !== request.flowId || context.provider !== request.provider || context.callbackId !== request.callbackId || context.revision.subjectId !== caller.subjectId || context.stateDigest !== access.stateDigest || context.requestBindingVerifier !== binder.verifier || context.requestBindingExpiresAtMillis !== binder.expiresAtMillis || context.expiresAtMillis > binder.expiresAtMillis || access.nowMillis < context.issuedAtMillis || access.nowMillis >= context.expiresAtMillis || !connectedProfile(policy, context.profile) || (context.responseIssuerMode === "required" ? response.issuer !== context.issuer : response.issuer !== void 0)) return yield* OAuthUnavailable.make({});
+			const authorization = yield* authorize(caller, yield* challenge("connected-complete", context.flowId, context.commandId, context.revision, Schema.encodeSync(contextJson)(context)), request.actionProof, context.maximumEvidenceAgeMillis);
+			const event = yield* eventFor("connect", caller.subjectId);
+			const claimId = yield* random();
+			const finished = yield* Effect.uninterruptibleMask((restore) => Effect.gen(function* () {
+				const receipt = yield* restore(claim({
+					access,
+					flow,
+					claimId,
+					authorization
+				}, (value, journal) => journal.prepare(snapshotOAuthSync(OAuthConnectedClaimDecision, value))));
+				const decision = yield* connectedRead(receipt);
+				if (decision._tag !== "Claimed") return yield* OAuthRejected.make({});
+				const owned = snapshotOAuthSync(OAuthConnectedClaim, decision.claim);
+				if (owned.claimId !== claimId || !connectedSame(OAuthConnectedPendingFlow, owned.flow, flow) || owned.claimedAtMillis < context.issuedAtMillis || owned.claimedAtMillis >= context.expiresAtMillis || owned.claimedAtMillis > DateTime.toEpochMillis(yield* DateTime.now) || owned.claimExpiresAtMillis !== owned.claimedAtMillis + context.claimLifetimeMillis || flow.retentionUntilMillis < owned.claimExpiresAtMillis) return yield* OAuthUnavailable.make({});
+				const exchange = Effect.gen(function* () {
+					const secrets = yield* openFlow({
+						context,
+						sealed: flow.sealed
+					}).pipe(Effect.flatMap((value) => snapshotOAuth(OAuthTransactionSecrets, value)));
+					if (context.protocol === "oidc" !== (secrets.oidcNonce !== void 0) || (yield* stateDigest(context.flowId, context.provider, secrets.state)) !== context.stateDigest || Redacted.value(secrets.state) !== Redacted.value(response.state)) return yield* OAuthUnavailable.make({});
+					if (response._tag !== "Code") return yield* OAuthProtocolRejected.make({});
+					const start = DateTime.toEpochMillis(yield* DateTime.now);
+					if (start >= owned.claimExpiresAtMillis) return yield* OAuthUnavailable.make({});
+					const protocolConfiguration = snapshotOAuthSync(OAuthConnectedConfiguration, context);
+					const rawGrant = yield* exchangeGrant({
+						configuration: protocolConfiguration,
+						secrets,
+						response,
+						verificationStartedAt: DateTime.makeUnsafe(start)
+					});
+					const projected = yield* connectedGrantResponse(protocolConfiguration, rawGrant, start);
+					return yield* Effect.gen(function* () {
+						if (context.reconnect && !connectedSame(OAuthExternalIdentity, context.reconnect.identity, projected.identity) || projected.material.continuation._tag === "Oidc" && (!projected.material.continuation.nonce || !secrets.oidcNonce || Redacted.value(projected.material.continuation.nonce) !== Redacted.value(secrets.oidcNonce))) return yield* OAuthProtocolRejected.make({});
+						const inspectedGrant = yield* inspectGrant({
+							claim: owned,
+							identity: projected.identity
+						}).pipe(Effect.flatMap((value) => snapshotOAuth(OAuthConnectedGrantInspection, value)));
+						if (inspectedGrant._tag === "Conflict") return { _tag: "Conflict" };
+						if (inspectedGrant._tag === "Rejected") return { _tag: "Rejected" };
+						const tokenContext = snapshotOAuthSync(OAuthConnectedTokenContext, {
+							namespace: "effect-auth/oauth-connected-token-context/v1",
+							moduleId: id,
+							subjectId: caller.subjectId,
+							identity: projected.identity,
+							configuration: protocolConfiguration,
+							grantId: context.grantId,
+							grantVersion: SecurityRevision.make(yield* random()),
+							tokenVersion: SecurityRevision.make(yield* random()),
+							cohortGeneration: inspectedGrant.cohortGeneration,
+							metadata: projected.metadata
+						});
+						const sealed = yield* sealTokens({
+							context: tokenContext,
+							material: snapshotOAuthSync(OAuthConnectedTokenMaterial, projected.material)
+						});
+						const grant = snapshotOAuthSync(OAuthConnectedStoredGrant, {
+							context: tokenContext,
+							sealed
+						});
+						let cleanup;
+						if (context.profile.revocation === "cohort") {
+							const cleanupContext = snapshotOAuthSync(OAuthConnectedRevocationContext, {
+								namespace: "effect-auth/oauth-connected-revocation-context/v1",
+								jobId: yield* random(),
+								token: tokenContext
+							});
+							cleanup = snapshotOAuthSync(OAuthConnectedRevocationJob, {
+								context: cleanupContext,
+								sealed: yield* sealTokens({
+									context: cleanupContext,
+									material: snapshotOAuthSync(OAuthConnectedTokenMaterial, projected.material)
+								})
+							});
+						}
+						return snapshotOAuthSync(OAuthConnectedOutcome, {
+							_tag: inspectedGrant._tag === "Quarantine" ? "Quarantined" : "Verified",
+							grant,
+							...cleanup ? { cleanup } : {}
+						});
+					}).pipe(Effect.ensuring(Effect.sync(() => wipeConnectedMaterial(projected.material))));
+				});
+				const remaining = Math.max(1, owned.claimExpiresAtMillis - DateTime.toEpochMillis(yield* DateTime.now));
+				const exchanged = response._tag === "Error" ? void 0 : yield* Effect.exit(restore(connectedBounded(exchange, remaining)));
+				const rejected = exchanged && Exit.isFailure(exchanged) && exchanged.cause.reasons.length === 1 && exchanged.cause.reasons[0]?._tag === "Fail" && Schema.is(OAuthProtocolRejected)(exchanged.cause.reasons[0].error);
+				const outcome = exchanged === void 0 ? { _tag: "Cancelled" } : Exit.isSuccess(exchanged) ? exchanged.value : rejected ? { _tag: "Rejected" } : { _tag: "Ambiguous" };
+				const committed = yield* connectedBounded(settle({
+					claim: owned,
+					outcome,
+					authorization,
+					nowMillis: DateTime.toEpochMillis(yield* DateTime.now)
+				}, (value, journal) => {
+					const result = snapshotOAuthSync(OAuthConnectedSettlementDecision, value);
+					if (result._tag === "Connected") {
+						if (outcome._tag !== "Verified" || !connectedSame(OAuthConnectedStoredGrant, result.grant, outcome.grant)) throw OAuthUnavailable.make({});
+						journal.stage(event);
+					} else if (result._tag === "Cancelled" && outcome._tag !== "Cancelled") throw OAuthUnavailable.make({});
+					return journal.prepare(result);
+				}), policy.settlementTimeoutMillis).pipe(Effect.flatMap(connectedRead), Effect.mapError(() => OAuthUnavailable.make({})));
+				if (exchanged && Exit.isFailure(exchanged) && Cause.hasInterrupts(exchanged.cause)) return yield* Effect.interrupt;
+				return committed;
+			}));
+			if (finished._tag === "Ambiguous") return yield* OAuthUnavailable.make({});
+			if (finished._tag === "Busy") return yield* OAuthConnectedBusy.make({});
+			if (finished._tag === "Conflict") return yield* IdentityConflict.make({});
+			if (finished._tag === "Rejected") return yield* OAuthRejected.make({});
+			return {
+				value: finished._tag === "Cancelled" ? {
+					_tag: "Cancelled",
+					returnTarget: context.returnTarget
+				} : {
+					_tag: "Connected",
+					grantId: context.grantId,
+					profileKey: context.profile.key,
+					status: "Active",
+					returnTarget: context.returnTarget
+				},
+				credentialCommands: clearBinding
+			};
+		}, connectedSafe);
+		const list = Effect.fn("OAuthConnected.list")(function* (invocation, raw) {
+			const caller = yield* connectedCaller(invocation);
+			const input = yield* snapshotOAuth(OAuthConnectedList, raw);
+			const authorization = yield* connectedUseAuthorization(yield* authorizeUse({
+				invocation: caller,
+				moduleId: id,
+				purpose: "metadata"
+			}), id, caller.subjectId, "metadata");
+			const result = yield* listRows({
+				authorization,
+				...input
+			}).pipe(Effect.flatMap((value) => snapshotOAuth(OAuthConnectedListResult, value)));
+			if (result.items.length > input.limit || new Set(result.items.map((v) => v.grantId)).size !== result.items.length) return yield* OAuthUnavailable.make({});
+			return result;
+		}, connectedSafe);
+		const disconnect = Effect.fn("OAuthConnected.disconnect")(function* (invocation, raw) {
+			const caller = yield* connectedCaller(invocation);
+			const request = yield* snapshotOAuth(OAuthConnectedDisconnect, raw);
+			const metadataAuthorization = yield* connectedUseAuthorization(yield* authorizeUse({
+				invocation: caller,
+				moduleId: id,
+				purpose: "metadata"
+			}), id, caller.subjectId, "metadata");
+			const inspected = yield* inspectDisconnect({
+				moduleId: id,
+				subjectId: caller.subjectId,
+				authorization: metadataAuthorization,
+				commandId: request.commandId,
+				grantId: request.grantId
+			}).pipe(Effect.flatMap((value) => snapshotOAuth(OAuthConnectedDisconnectInspection, value)));
+			if (inspected._tag === "Rejected") return yield* OAuthRejected.make({});
+			if (inspected._tag === "Conflict") return yield* IdentityConflict.make({});
+			if (inspected._tag === "Replay") {
+				if (inspected.result.grantId !== request.grantId || !inspected.result.replayed) return yield* OAuthUnavailable.make({});
+				return inspected.result;
+			}
+			const grant = inspected.grant, context = grant.context;
+			if (context.moduleId !== id || context.subjectId !== caller.subjectId || context.grantId !== request.grantId || inspected.revision.subjectId !== caller.subjectId) return yield* OAuthUnavailable.make({});
+			const authorization = yield* authorize(caller, yield* challenge("connected-disconnect", OAuthConnectedActionChallenge.fields.flowId.make(request.commandId), request.commandId, inspected.revision, Schema.encodeSync(Schema.fromJsonString(OAuthConnectedDisconnectGrant))(grant)), request.actionProof);
+			const event = yield* eventFor("disconnect", caller.subjectId);
+			let revocation;
+			if (grant.sealed && context.configuration.profile.revocation === "cohort") {
+				const material = yield* openTokens({
+					context,
+					sealed: grant.sealed
+				}).pipe(Effect.flatMap((value) => snapshotOAuth(OAuthConnectedTokenMaterial, value)));
+				revocation = yield* Effect.gen(function* () {
+					const jobContext = snapshotOAuthSync(OAuthConnectedRevocationContext, {
+						namespace: "effect-auth/oauth-connected-revocation-context/v1",
+						jobId: yield* random(),
+						token: context
+					});
+					return snapshotOAuthSync(OAuthConnectedRevocationJob, {
+						context: jobContext,
+						sealed: yield* sealTokens({
+							context: jobContext,
+							material
+						})
+					});
+				}).pipe(Effect.ensuring(Effect.sync(() => wipeConnectedMaterial(material))));
+			}
+			const receipt = yield* disconnectRow({
+				moduleId: id,
+				commandId: request.commandId,
+				grant,
+				authorization,
+				...revocation ? { revocation } : {},
+				retentionUntilMillis: DateTime.toEpochMillis(yield* DateTime.now) + policy.retentionMillis
+			}, (value, journal) => {
+				const decision = snapshotOAuthSync(OAuthConnectedDisconnectDecision, value);
+				if (decision._tag === "Disconnected") {
+					if (decision.grantId !== request.grantId || !decision.replayed && context.configuration.profile.revocation === "unsupported" && decision.remoteRevocation !== "Unsupported" || !decision.replayed && revocation !== void 0 && decision.remoteRevocation !== "Pending") throw OAuthUnavailable.make({});
+					if (!decision.replayed) journal.stage(event);
+				}
+				return journal.prepare(decision);
+			});
+			const result = yield* connectedRead(receipt);
+			if (result._tag === "Rejected") return yield* OAuthRejected.make({});
+			if (result._tag === "Conflict") return yield* IdentityConflict.make({});
+			return result;
+		}, connectedSafe);
+		return Connected.of({
+			begin,
+			complete,
+			list,
+			disconnect
+		});
+	}));
+	const Begin = makeOperation(`${moduleId}/connected/begin`, {
+		payload: OAuthConnectedBegin,
+		success: OAuthSignInAuthorization,
+		error: Failure,
+		access: "authenticated",
+		exposure: "public",
+		replay: "non-idempotent",
+		credentials: true
+	});
+	const Complete = makeOperation(`${moduleId}/connected/complete`, {
+		payload: OAuthConnectedComplete,
+		success: OAuthConnectedResult,
+		error: Failure,
+		access: "authenticated",
+		exposure: "public",
+		replay: "single-use",
+		credentials: true
+	});
+	const List = makeOperation(`${moduleId}/connected/list`, {
+		payload: OAuthConnectedList,
+		success: OAuthConnectedListResult,
+		error: Failure,
+		access: "authenticated",
+		exposure: "public",
+		replay: "read-only"
+	});
+	const Disconnect = makeOperation(`${moduleId}/connected/disconnect`, {
+		payload: OAuthConnectedDisconnect,
+		success: OAuthConnectedDisconnected,
+		error: Failure,
+		access: "authenticated",
+		exposure: "public",
+		replay: "idempotent"
+	});
+	const handlersLayer = Layer.mergeAll(Begin.credentialHandlerLayer(Effect.fn("OAuthConnected.Begin")(function* (input, invocation) {
+		return yield* (yield* Connected).begin(invocation, input);
+	})), Complete.credentialHandlerLayer(Effect.fn("OAuthConnected.Complete")(function* (input, invocation) {
+		return yield* (yield* Connected).complete(invocation, input);
+	})), List.handlerLayer(Effect.fn("OAuthConnected.List")(function* (input, invocation) {
+		return yield* (yield* Connected).list(invocation, input);
+	})), Disconnect.handlerLayer(Effect.fn("OAuthConnected.Disconnect")(function* (input, invocation) {
+		return yield* (yield* Connected).disconnect(invocation, input);
+	})));
+	return Object.freeze({
+		Connected,
+		binding,
+		layer,
+		operations: Object.freeze({
+			Begin,
+			Complete,
+			List,
+			Disconnect
+		}),
+		handlersLayer,
+		group: operationGroup(Begin, Complete, List, Disconnect),
+		...makeOAuthConnectedAccess(moduleId, configuration),
+		...makeOAuthConnectedMaintenance(moduleId, configuration)
+	});
+};
+//#endregion
+export { makeOAuthConnected };
+
+//# sourceMappingURL=connected.mjs.map