@yielded/auth 0.1.0-beta.1

package/dist/oauth/connected.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"connected.mjs","names":["M.OAuthConnectedActionRequired","M.OAuthConnectedBusy","M.OAuthConnectedReauthorizationRequired","M.OAuthConnectedTarget","M.OAuthConnectedConfiguration","M.OAuthConnectedTransactionContext","M.OAuthConnectedActionChallenge","M.OAuthConnectedActionAuthorization","M.OAuthConnectedBegin","M.OAuthConnectedProfile","M.OAuthConnectedPendingFlow","M.OAuthConnectedIssueDecision","M.OAuthConnectedComplete","M.OAuthConnectedAccess","M.OAuthConnectedClaimDecision","M.OAuthConnectedClaim","M.OAuthConnectedGrantInspection","M.OAuthConnectedTokenContext","M.OAuthConnectedTokenMaterial","M.OAuthConnectedStoredGrant","M.OAuthConnectedRevocationContext","M.OAuthConnectedRevocationJob","M.OAuthConnectedOutcome","M.OAuthConnectedSettlementDecision","M.OAuthConnectedList","M.OAuthConnectedListResult","M.OAuthConnectedDisconnect","M.OAuthConnectedDisconnectInspection","M.OAuthConnectedDisconnectGrant","M.OAuthConnectedDisconnectDecision","M.OAuthConnectedResult","M.OAuthConnectedDisconnected"],"sources":["../../src/oauth/connected.ts"],"sourcesContent":["import {\n  Cause,\n  Context,\n  Crypto,\n  DateTime,\n  Effect,\n  Encoding,\n  Exit,\n  Layer,\n  Redacted,\n  Result,\n  Schema,\n} from \"effect\";\n\nimport { LifecycleHooks } from \"../hooks/LifecycleHooks\";\nimport { HookDenied, LifecycleEventId, lifecycleEvent, lifecycleSnapshot } from \"../hooks/models\";\nimport { IdentityConflict } from \"../identity/models\";\nimport type { AuthInvocation } from \"../operations/context\";\nimport type { AuthCredentialCommand, AuthOperationResult } from \"../operations/credentials\";\nimport { AuthenticationRequired } from \"../operations/errors\";\nimport { makeOperation, operationGroup } from \"../operations/operation\";\nimport { makeRequestBinding } from \"../operations/requestBinding\";\nimport { TokenDigest } from \"../Schema\";\nimport { assessAuthentication } from \"../sessions/assurance\";\nimport { AuthenticationFlowId, SecurityRevision } from \"../sessions/models\";\nimport { OAuthAccountRevision } from \"./accountsModels\";\nimport {\n  captureConnectedPolicy,\n  connectedBounded,\n  connectedCaller,\n  connectedGrantResponse,\n  connectedProfile,\n  connectedRead,\n  connectedSafe,\n  connectedSame,\n  connectedUseAuthorization,\n  makeOAuthConnectedAccess,\n  validateConnectedPolicy,\n  wipeConnectedMaterial,\n} from \"./connectedAccess\";\nimport { makeOAuthConnectedMaintenance } from \"./connectedMaintenance\";\nimport * as M from \"./connectedModels\";\nimport { OAuthConnectedActionEvidence } from \"./OAuthConnectedActionEvidence\";\nimport { OAuthConnectedPersistence } from \"./OAuthConnectedPersistence\";\nimport { OAuthConnectedProtocol } from \"./OAuthConnectedProtocol\";\nimport { OAuthConnectedTokenProtector } from \"./OAuthConnectedTokenProtector\";\nimport { OAuthConnectedTransactionProtector } from \"./OAuthConnectedTransactionProtector\";\nimport { OAuthConnectedUseAuthority } from \"./OAuthConnectedUseAuthority\";\nimport { OAuthReturnTargets } from \"./OAuthReturnTargets\";\nimport {\n  OAuthMethodUnsupported,\n  OAuthProtocolRejected,\n  OAuthRejected,\n  OAuthUnavailable,\n} from \"./signInErrors\";\nimport {\n  OAuthAuthorizationUrl,\n  OAuthCallbackResponse,\n  OAuthClaimId,\n  OAuthExternalIdentity,\n  OAuthReturnTarget,\n  OAuthSealedTransaction,\n  OAuthSignInAuthorization,\n  OAuthTransactionSecrets,\n} from \"./signInModels\";\nimport { snapshotOAuth, snapshotOAuthSync } from \"./signInSnapshot\";\n\nconst Failure = Schema.Union([\n  AuthenticationRequired,\n  M.OAuthConnectedActionRequired,\n  M.OAuthConnectedBusy,\n  M.OAuthConnectedReauthorizationRequired,\n  OAuthRejected,\n  OAuthUnavailable,\n  OAuthMethodUnsupported,\n  IdentityConflict,\n  HookDenied,\n]);\n\ntype Failure = typeof Failure.Type;\n\nconst capturedSchema = Schema.Struct({\n  revision: OAuthAccountRevision,\n  target: Schema.optionalKey(M.OAuthConnectedTarget),\n});\n\nconst preparationSchema = Schema.Struct({\n  configuration: M.OAuthConnectedConfiguration,\n  authorizationUrl: OAuthAuthorizationUrl,\n  secrets: OAuthTransactionSecrets,\n});\n\nconst encoder = new TextEncoder();\nconst strings = Schema.fromJsonString(Schema.Array(Schema.String));\nconst contextJson = Schema.fromJsonString(M.OAuthConnectedTransactionContext);\n\nconst clearBinding: ReadonlyArray<AuthCredentialCommand> = Object.freeze([\n  Object.freeze({ _tag: \"Clear\", slot: \"request-binding\" }),\n]);\n\nexport interface ConnectedModule<Id extends string> {\n  readonly moduleId: Id;\n  readonly kind: \"oauth-connected\";\n}\n\n/** Opt-in API access. No login factor/session creation or token-bearing RPC. */\nexport const makeOAuthConnected = <const Id extends string>(\n  moduleId: Id,\n  configuration: M.OAuthConnectedPolicy,\n) => {\n  const binding = makeRequestBinding(moduleId, \"oauth-connected\");\n\n  const Connected = Context.Service<\n    ConnectedModule<Id>,\n    {\n      readonly begin: (\n        invocation: AuthInvocation,\n        input: typeof M.OAuthConnectedBegin.Type,\n      ) => Effect.Effect<AuthOperationResult<typeof OAuthSignInAuthorization.Type>, Failure>;\n      readonly complete: (\n        invocation: AuthInvocation,\n        input: typeof M.OAuthConnectedComplete.Type,\n      ) => Effect.Effect<AuthOperationResult<typeof M.OAuthConnectedResult.Type>, Failure>;\n      readonly list: (\n        invocation: AuthInvocation,\n        input: typeof M.OAuthConnectedList.Type,\n      ) => Effect.Effect<typeof M.OAuthConnectedListResult.Type, Failure>;\n      readonly disconnect: (\n        invocation: AuthInvocation,\n        input: typeof M.OAuthConnectedDisconnect.Type,\n      ) => Effect.Effect<typeof M.OAuthConnectedDisconnected.Type, Failure>;\n    }\n  >()(\"effect-auth/oauth/\" + moduleId.length + \":\" + moduleId + \"/Connected\");\n\n  const captured = captureConnectedPolicy(configuration);\n\n  const layer = Layer.effect(\n    Connected,\n    Effect.gen(function* () {\n      const { id, policy } = yield* validateConnectedPolicy(moduleId, captured);\n      const { issue: issueBinding, verify: verifyBinding } = yield* binding.RequestBinding;\n\n      const {\n        capture,\n        issue,\n        preflight,\n        claim,\n        inspectGrant,\n        settle,\n        list: listRows,\n        inspectDisconnect,\n        disconnect: disconnectRow,\n      } = yield* OAuthConnectedPersistence;\n\n      const { verify: verifyAction } = yield* OAuthConnectedActionEvidence;\n      const { authorize: authorizeUse } = yield* OAuthConnectedUseAuthority;\n      const { prepareAuthorization, exchangeGrant } = yield* OAuthConnectedProtocol;\n      const { seal: sealFlow, open: openFlow } = yield* OAuthConnectedTransactionProtector;\n      const { seal: sealTokens, open: openTokens } = yield* OAuthConnectedTokenProtector;\n      const { resolve: resolveTarget } = yield* OAuthReturnTargets;\n      const { before } = yield* LifecycleHooks;\n      const { randomBytes, digest } = yield* Crypto.Crypto;\n\n      const random = Effect.fn(\"OAuthConnected.random\")(function* () {\n        const bytes = yield* randomBytes(32).pipe(Effect.mapError(() => OAuthUnavailable.make({})));\n        const value = OAuthClaimId.make(Encoding.encodeBase64Url(bytes));\n\n        bytes.fill(0);\n\n        return value;\n      });\n\n      const hash = Effect.fn(\"OAuthConnected.hash\")(function* (value: string) {\n        const bytes = yield* digest(\"SHA-256\", encoder.encode(value)).pipe(\n          Effect.mapError(() => OAuthUnavailable.make({})),\n        );\n\n        return TokenDigest.make(Encoding.encodeBase64Url(bytes));\n      });\n\n      const stateDigest = Effect.fn(\"OAuthConnected.stateDigest\")(function* (\n        flowId: typeof M.OAuthConnectedBegin.Type.flowId,\n        provider: typeof M.OAuthConnectedTransactionContext.Type.provider,\n        secret: Redacted.Redacted<string>,\n      ) {\n        const raw = Redacted.value(secret);\n\n        if (!/^[A-Za-z0-9_-]{43}$/.test(raw)) return yield* OAuthRejected.make({});\n        const bytes = Result.getOrUndefined(Encoding.decodeBase64Url(raw));\n\n        if (!bytes || bytes.length !== 32 || Encoding.encodeBase64Url(bytes) !== raw) {\n          bytes?.fill(0);\n\n          return yield* OAuthRejected.make({});\n        }\n        bytes.fill(0);\n\n        return yield* hash(\n          Schema.encodeSync(strings)([\n            \"effect-auth/oauth-connected-state/v1\",\n            id,\n            String(policy.generation),\n            provider,\n            flowId,\n            raw,\n          ]),\n        );\n      });\n\n      const challenge = Effect.fn(\"OAuthConnected.challenge\")(function* (\n        action: M.OAuthConnectedActionChallenge[\"action\"],\n        flowId: M.OAuthConnectedActionChallenge[\"flowId\"],\n        commandId: M.OAuthConnectedActionChallenge[\"commandId\"],\n        revision: OAuthAccountRevision,\n        intent: string,\n      ) {\n        const intentDigest = yield* hash(intent);\n\n        return snapshotOAuthSync(M.OAuthConnectedActionChallenge, {\n          moduleId: id,\n          action,\n          flowId,\n          commandId,\n          revision,\n          intentDigest,\n          bindingDigest: yield* hash(\n            Schema.encodeSync(strings)([\n              \"effect-auth/oauth-connected-action/v1\",\n              id,\n              action,\n              flowId,\n              commandId,\n              intentDigest,\n            ]),\n          ),\n        });\n      });\n\n      const authorize = Effect.fn(\"OAuthConnected.authorize\")(function* (\n        caller: Effect.Success<ReturnType<typeof connectedCaller>>,\n        expected: M.OAuthConnectedActionChallenge,\n        proof: Redacted.Redacted<string> | undefined,\n        maximumAge = policy.maximumEvidenceAgeMillis,\n      ) {\n        const granted = yield* verifyAction({\n          invocation: { ...caller },\n          challenge: snapshotOAuthSync(M.OAuthConnectedActionChallenge, expected),\n          ...(proof === undefined ? {} : { proof: Redacted.make(Redacted.value(proof)) }),\n        });\n\n        const authorization = yield* snapshotOAuth(M.OAuthConnectedActionAuthorization, {\n          challenge: expected,\n          evidence: granted.evidence,\n          requirement: {\n            ...granted.requirement,\n            maximumAgeMillis: Math.min(\n              maximumAge,\n              policy.maximumEvidenceAgeMillis,\n              granted.requirement.maximumAgeMillis,\n            ),\n          },\n        }).pipe(Effect.mapError(() => M.OAuthConnectedActionRequired.make({})));\n\n        const evidence = authorization.evidence;\n\n        if (\n          evidence.flowId !== AuthenticationFlowId.make(expected.flowId) ||\n          evidence.bindingDigest !== expected.bindingDigest ||\n          !connectedSame(OAuthAccountRevision, evidence.revision, expected.revision) ||\n          new Set(evidence.revision.credentials.map((v) => v.credentialId)).size !==\n            evidence.revision.credentials.length ||\n          !(yield* assessAuthentication(evidence, authorization.requirement).pipe(\n            Effect.mapError(() => M.OAuthConnectedActionRequired.make({})),\n          )).satisfied\n        )\n          return yield* M.OAuthConnectedActionRequired.make({});\n\n        return authorization;\n      });\n\n      const binderError = (error: { readonly _tag: string }) =>\n        error._tag === \"RequestBindingInvalid\" ? OAuthRejected.make({}) : OAuthUnavailable.make({});\n\n      const eventFor = Effect.fn(\"OAuthConnected.event\")(function* (\n        operation: \"connect\" | \"disconnect\",\n        subjectId: OAuthAccountRevision[\"subjectId\"],\n      ) {\n        const snapshot = lifecycleSnapshot({\n          action: \"linking\",\n          operation: moduleId + \"/connected/\" + operation,\n          subjectId,\n          method: \"oauth-connected\",\n          identifiers: [],\n        });\n\n        yield* before(snapshot);\n\n        return lifecycleEvent({\n          id: LifecycleEventId.make(yield* random()),\n          occurredAtMillis: DateTime.toEpochMillis(yield* DateTime.now),\n          snapshot,\n        });\n      });\n\n      const begin = Effect.fn(\"OAuthConnected.begin\")(function* (\n        invocation: AuthInvocation,\n        raw: typeof M.OAuthConnectedBegin.Type,\n      ) {\n        const caller = yield* connectedCaller(invocation);\n        const request = yield* snapshotOAuth(M.OAuthConnectedBegin, raw);\n\n        const found = yield* capture({\n          moduleId: id,\n          subjectId: caller.subjectId,\n          ...(request.intent._tag === \"Reconnect\" ? { grantId: request.intent.grantId } : {}),\n        });\n\n        if (!found) return yield* OAuthRejected.make({});\n        const owned = yield* snapshotOAuth(capturedSchema, found);\n\n        if (\n          owned.revision.subjectId !== caller.subjectId ||\n          (request.intent._tag === \"Reconnect\" &&\n            (!owned.target || owned.target.grantId !== request.intent.grantId))\n        )\n          return yield* OAuthUnavailable.make({});\n\n        const profile = policy.profiles.find(\n          (value) => value.key === request.intent.profileKey && value.issuance === \"active\",\n        );\n\n        const provider =\n          request.intent._tag === \"Connect\"\n            ? request.intent.provider\n            : owned.target!.identity.provider;\n\n        if (\n          !profile ||\n          profile.provider !== provider ||\n          (request.intent._tag === \"Reconnect\" &&\n            profile.clientRegistrationId !==\n              owned.target!.configuration.profile.clientRegistrationId)\n        )\n          return yield* OAuthRejected.make({});\n\n        const returnTarget = yield* resolveTarget(request.returnTarget).pipe(\n          Effect.flatMap((value) => snapshotOAuth(OAuthReturnTarget, value)),\n        );\n\n        const issued = yield* issueBinding(request.flowId).pipe(Effect.mapError(binderError));\n        const original = issued.credentialCommands[0];\n\n        if (\n          issued.credentialCommands.length !== 1 ||\n          original?._tag !== \"Issue\" ||\n          original.slot !== \"request-binding\" ||\n          issued.value.flowId !== request.flowId ||\n          original.expiresAtMillis !== issued.value.expiresAtMillis\n        )\n          return yield* OAuthUnavailable.make({});\n\n        const command = Object.freeze({\n          _tag: \"Issue\" as const,\n          slot: \"request-binding\" as const,\n          credential: Redacted.make(Redacted.value(original.credential)),\n          expiresAtMillis: original.expiresAtMillis,\n        });\n\n        const binder = {\n          ...(yield* verifyBinding(\n            request.flowId,\n            Redacted.make(Redacted.value(command.credential)),\n          ).pipe(Effect.mapError(binderError))),\n        };\n\n        if (binder.expiresAtMillis !== command.expiresAtMillis)\n          return yield* OAuthUnavailable.make({});\n\n        const prepared = yield* prepareAuthorization({\n          profile: snapshotOAuthSync(M.OAuthConnectedProfile, profile),\n          callbackId: request.callbackId,\n          flowId: request.flowId,\n        }).pipe(\n          Effect.mapError((error) =>\n            error._tag === \"OAuthProtocolRejected\" ? OAuthRejected.make({}) : error,\n          ),\n          Effect.flatMap((value) => snapshotOAuth(preparationSchema, value)),\n        );\n\n        if (\n          prepared.configuration.provider !== provider ||\n          prepared.configuration.callbackId !== request.callbackId ||\n          !connectedSame(M.OAuthConnectedProfile, prepared.configuration.profile, profile) ||\n          (prepared.configuration.protocol === \"oidc\") !==\n            (prepared.secrets.oidcNonce !== undefined) ||\n          (request.intent._tag === \"Reconnect\" &&\n            prepared.configuration.issuer !== owned.target!.identity.issuer)\n        )\n          return yield* OAuthUnavailable.make({});\n        const now = DateTime.toEpochMillis(yield* DateTime.now);\n        const expiresAtMillis = Math.min(now + policy.lifetimeMillis, binder.expiresAtMillis);\n\n        if (expiresAtMillis <= now) return yield* OAuthRejected.make({});\n\n        const context = snapshotOAuthSync(M.OAuthConnectedTransactionContext, {\n          ...prepared.configuration,\n          namespace: \"effect-auth/oauth-connected-context/v1\",\n          moduleId: id,\n          generation: policy.generation,\n          flowId: request.flowId,\n          commandId: request.commandId,\n          revision: owned.revision,\n          grantId:\n            request.intent._tag === \"Reconnect\"\n              ? request.intent.grantId\n              : M.OAuthGrantId.make(yield* random()),\n          ...(request.intent._tag === \"Reconnect\" ? { reconnect: owned.target } : {}),\n          maximumEvidenceAgeMillis: policy.maximumEvidenceAgeMillis,\n          returnTarget,\n          stateDigest: yield* stateDigest(request.flowId, provider, prepared.secrets.state),\n          requestBindingVerifier: binder.verifier,\n          requestBindingExpiresAtMillis: binder.expiresAtMillis,\n          issuedAtMillis: now,\n          expiresAtMillis,\n          claimLifetimeMillis: policy.claimLifetimeMillis,\n        });\n\n        const authorization = yield* authorize(\n          caller,\n          yield* challenge(\n            \"connected-begin\",\n            context.flowId,\n            context.commandId,\n            context.revision,\n            Schema.encodeSync(contextJson)(context),\n          ),\n          request.actionProof,\n        );\n\n        const sealed = yield* sealFlow({\n          context,\n          secrets: snapshotOAuthSync(OAuthTransactionSecrets, prepared.secrets),\n        }).pipe(Effect.flatMap((value) => snapshotOAuth(OAuthSealedTransaction, value)));\n\n        const flow = snapshotOAuthSync(M.OAuthConnectedPendingFlow, {\n          context,\n          sealed,\n          retentionUntilMillis: expiresAtMillis + policy.retentionMillis,\n        });\n\n        const receipt = yield* issue(\n          { flow: snapshotOAuthSync(M.OAuthConnectedPendingFlow, flow), authorization },\n          (value, journal) => {\n            const decision = snapshotOAuthSync(M.OAuthConnectedIssueDecision, value);\n\n            if (\n              decision._tag === \"Issued\" &&\n              !connectedSame(M.OAuthConnectedPendingFlow, decision.flow, flow)\n            )\n              throw OAuthUnavailable.make({});\n\n            return journal.prepare(decision._tag === \"Issued\");\n          },\n        );\n\n        if (!(yield* connectedRead(receipt))) return yield* OAuthRejected.make({});\n\n        return {\n          value: {\n            flowId: request.flowId,\n            authorizationUrl: prepared.authorizationUrl,\n            expiresAtMillis,\n          },\n          credentialCommands: [command],\n        };\n      }, connectedSafe);\n\n      const complete = Effect.fn(\"OAuthConnected.complete\")(function* (\n        invocation: AuthInvocation,\n        raw: typeof M.OAuthConnectedComplete.Type,\n      ) {\n        const caller = yield* connectedCaller(invocation);\n        const request = yield* snapshotOAuth(M.OAuthConnectedComplete, raw);\n        const response = request.response;\n\n        if (\n          encoder.encode(Schema.encodeSync(Schema.fromJsonString(OAuthCallbackResponse))(response))\n            .length > 16384\n        )\n          return yield* OAuthRejected.make({});\n\n        const binder = {\n          ...(yield* verifyBinding(request.flowId, request.requestBinding).pipe(\n            Effect.mapError(binderError),\n          )),\n        };\n\n        const access = snapshotOAuthSync(M.OAuthConnectedAccess, {\n          moduleId: id,\n          generation: policy.generation,\n          subjectId: caller.subjectId,\n          flowId: request.flowId,\n          provider: request.provider,\n          callbackId: request.callbackId,\n          stateDigest: yield* stateDigest(request.flowId, request.provider, response.state),\n          requestBindingVerifier: binder.verifier,\n          requestBindingExpiresAtMillis: binder.expiresAtMillis,\n          ...(response.issuer === undefined ? {} : { responseIssuer: response.issuer }),\n          nowMillis: DateTime.toEpochMillis(yield* DateTime.now),\n        });\n\n        const inspected = yield* preflight(access);\n\n        if (!inspected) return yield* OAuthRejected.make({});\n        const flow = yield* snapshotOAuth(M.OAuthConnectedPendingFlow, inspected);\n        const context = flow.context;\n\n        if (\n          context.moduleId !== id ||\n          context.generation !== policy.generation ||\n          context.flowId !== request.flowId ||\n          context.provider !== request.provider ||\n          context.callbackId !== request.callbackId ||\n          context.revision.subjectId !== caller.subjectId ||\n          context.stateDigest !== access.stateDigest ||\n          context.requestBindingVerifier !== binder.verifier ||\n          context.requestBindingExpiresAtMillis !== binder.expiresAtMillis ||\n          context.expiresAtMillis > binder.expiresAtMillis ||\n          access.nowMillis < context.issuedAtMillis ||\n          access.nowMillis >= context.expiresAtMillis ||\n          !connectedProfile(policy, context.profile) ||\n          (context.responseIssuerMode === \"required\"\n            ? response.issuer !== context.issuer\n            : response.issuer !== undefined)\n        )\n          return yield* OAuthUnavailable.make({});\n\n        const authorization = yield* authorize(\n          caller,\n          yield* challenge(\n            \"connected-complete\",\n            context.flowId,\n            context.commandId,\n            context.revision,\n            Schema.encodeSync(contextJson)(context),\n          ),\n          request.actionProof,\n          context.maximumEvidenceAgeMillis,\n        );\n\n        const event = yield* eventFor(\"connect\", caller.subjectId);\n        const claimId = yield* random();\n\n        const finished = yield* Effect.uninterruptibleMask((restore) =>\n          Effect.gen(function* () {\n            const receipt = yield* restore(\n              claim({ access, flow, claimId, authorization }, (value, journal) =>\n                journal.prepare(snapshotOAuthSync(M.OAuthConnectedClaimDecision, value)),\n              ),\n            );\n\n            const decision = yield* connectedRead(receipt);\n\n            if (decision._tag !== \"Claimed\") return yield* OAuthRejected.make({});\n            const owned = snapshotOAuthSync(M.OAuthConnectedClaim, decision.claim);\n\n            if (\n              owned.claimId !== claimId ||\n              !connectedSame(M.OAuthConnectedPendingFlow, owned.flow, flow) ||\n              owned.claimedAtMillis < context.issuedAtMillis ||\n              owned.claimedAtMillis >= context.expiresAtMillis ||\n              owned.claimedAtMillis > DateTime.toEpochMillis(yield* DateTime.now) ||\n              owned.claimExpiresAtMillis !== owned.claimedAtMillis + context.claimLifetimeMillis ||\n              flow.retentionUntilMillis < owned.claimExpiresAtMillis\n            )\n              return yield* OAuthUnavailable.make({});\n\n            const exchange = Effect.gen(function* () {\n              const secrets = yield* openFlow({ context, sealed: flow.sealed }).pipe(\n                Effect.flatMap((value) => snapshotOAuth(OAuthTransactionSecrets, value)),\n              );\n\n              if (\n                (context.protocol === \"oidc\") !== (secrets.oidcNonce !== undefined) ||\n                (yield* stateDigest(context.flowId, context.provider, secrets.state)) !==\n                  context.stateDigest ||\n                Redacted.value(secrets.state) !== Redacted.value(response.state)\n              )\n                return yield* OAuthUnavailable.make({});\n              if (response._tag !== \"Code\") return yield* OAuthProtocolRejected.make({});\n              const start = DateTime.toEpochMillis(yield* DateTime.now);\n\n              if (start >= owned.claimExpiresAtMillis) return yield* OAuthUnavailable.make({});\n\n              const protocolConfiguration = snapshotOAuthSync(\n                M.OAuthConnectedConfiguration,\n                context,\n              );\n\n              const rawGrant = yield* exchangeGrant({\n                configuration: protocolConfiguration,\n                secrets,\n                response,\n                verificationStartedAt: DateTime.makeUnsafe(start),\n              });\n\n              const projected = yield* connectedGrantResponse(\n                protocolConfiguration,\n                rawGrant,\n                start,\n              );\n\n              return yield* Effect.gen(function* () {\n                if (\n                  (context.reconnect &&\n                    !connectedSame(\n                      OAuthExternalIdentity,\n                      context.reconnect.identity,\n                      projected.identity,\n                    )) ||\n                  (projected.material.continuation._tag === \"Oidc\" &&\n                    (!projected.material.continuation.nonce ||\n                      !secrets.oidcNonce ||\n                      Redacted.value(projected.material.continuation.nonce) !==\n                        Redacted.value(secrets.oidcNonce)))\n                )\n                  return yield* OAuthProtocolRejected.make({});\n\n                const inspectedGrant = yield* inspectGrant({\n                  claim: owned,\n                  identity: projected.identity,\n                }).pipe(\n                  Effect.flatMap((value) => snapshotOAuth(M.OAuthConnectedGrantInspection, value)),\n                );\n\n                if (inspectedGrant._tag === \"Conflict\") return { _tag: \"Conflict\" as const };\n                if (inspectedGrant._tag === \"Rejected\") return { _tag: \"Rejected\" as const };\n\n                const tokenContext = snapshotOAuthSync(M.OAuthConnectedTokenContext, {\n                  namespace: \"effect-auth/oauth-connected-token-context/v1\",\n                  moduleId: id,\n                  subjectId: caller.subjectId,\n                  identity: projected.identity,\n                  configuration: protocolConfiguration,\n                  grantId: context.grantId,\n                  grantVersion: SecurityRevision.make(yield* random()),\n                  tokenVersion: SecurityRevision.make(yield* random()),\n                  cohortGeneration: inspectedGrant.cohortGeneration,\n                  metadata: projected.metadata,\n                });\n\n                const sealed = yield* sealTokens({\n                  context: tokenContext,\n                  material: snapshotOAuthSync(M.OAuthConnectedTokenMaterial, projected.material),\n                });\n\n                const grant = snapshotOAuthSync(M.OAuthConnectedStoredGrant, {\n                  context: tokenContext,\n                  sealed,\n                });\n\n                let cleanup: M.OAuthConnectedRevocationJob | undefined;\n\n                if (context.profile.revocation === \"cohort\") {\n                  const cleanupContext = snapshotOAuthSync(M.OAuthConnectedRevocationContext, {\n                    namespace: \"effect-auth/oauth-connected-revocation-context/v1\",\n                    jobId: yield* random(),\n                    token: tokenContext,\n                  });\n\n                  cleanup = snapshotOAuthSync(M.OAuthConnectedRevocationJob, {\n                    context: cleanupContext,\n                    sealed: yield* sealTokens({\n                      context: cleanupContext,\n                      material: snapshotOAuthSync(\n                        M.OAuthConnectedTokenMaterial,\n                        projected.material,\n                      ),\n                    }),\n                  });\n                }\n\n                return snapshotOAuthSync(M.OAuthConnectedOutcome, {\n                  _tag: inspectedGrant._tag === \"Quarantine\" ? \"Quarantined\" : \"Verified\",\n                  grant,\n                  ...(cleanup ? { cleanup } : {}),\n                });\n              }).pipe(\n                Effect.ensuring(Effect.sync(() => wipeConnectedMaterial(projected.material))),\n              );\n            });\n\n            const remaining = Math.max(\n              1,\n              owned.claimExpiresAtMillis - DateTime.toEpochMillis(yield* DateTime.now),\n            );\n\n            const exchanged =\n              response._tag === \"Error\"\n                ? undefined\n                : yield* Effect.exit(restore(connectedBounded(exchange, remaining)));\n\n            const rejected =\n              exchanged &&\n              Exit.isFailure(exchanged) &&\n              exchanged.cause.reasons.length === 1 &&\n              exchanged.cause.reasons[0]?._tag === \"Fail\" &&\n              Schema.is(OAuthProtocolRejected)(exchanged.cause.reasons[0].error);\n\n            const outcome: M.OAuthConnectedOutcome =\n              exchanged === undefined\n                ? { _tag: \"Cancelled\" }\n                : Exit.isSuccess(exchanged)\n                  ? exchanged.value\n                  : rejected\n                    ? { _tag: \"Rejected\" }\n                    : { _tag: \"Ambiguous\" };\n\n            const committed = yield* connectedBounded(\n              settle(\n                {\n                  claim: owned,\n                  outcome,\n                  authorization,\n                  nowMillis: DateTime.toEpochMillis(yield* DateTime.now),\n                },\n                (value, journal) => {\n                  const result = snapshotOAuthSync(M.OAuthConnectedSettlementDecision, value);\n\n                  if (result._tag === \"Connected\") {\n                    if (\n                      outcome._tag !== \"Verified\" ||\n                      !connectedSame(M.OAuthConnectedStoredGrant, result.grant, outcome.grant)\n                    )\n                      throw OAuthUnavailable.make({});\n                    journal.stage(event);\n                  } else if (result._tag === \"Cancelled\" && outcome._tag !== \"Cancelled\")\n                    throw OAuthUnavailable.make({});\n\n                  return journal.prepare(result);\n                },\n              ),\n              policy.settlementTimeoutMillis,\n            ).pipe(\n              Effect.flatMap(connectedRead),\n              Effect.mapError(() => OAuthUnavailable.make({})),\n            );\n\n            if (exchanged && Exit.isFailure(exchanged) && Cause.hasInterrupts(exchanged.cause))\n              return yield* Effect.interrupt;\n\n            return committed;\n          }),\n        );\n\n        if (finished._tag === \"Ambiguous\") return yield* OAuthUnavailable.make({});\n        if (finished._tag === \"Busy\") return yield* M.OAuthConnectedBusy.make({});\n        if (finished._tag === \"Conflict\") return yield* IdentityConflict.make({});\n        if (finished._tag === \"Rejected\") return yield* OAuthRejected.make({});\n\n        return {\n          value:\n            finished._tag === \"Cancelled\"\n              ? { _tag: \"Cancelled\" as const, returnTarget: context.returnTarget }\n              : {\n                  _tag: \"Connected\" as const,\n                  grantId: context.grantId,\n                  profileKey: context.profile.key,\n                  status: \"Active\" as const,\n                  returnTarget: context.returnTarget,\n                },\n          credentialCommands: clearBinding,\n        };\n      }, connectedSafe);\n\n      const list = Effect.fn(\"OAuthConnected.list\")(function* (\n        invocation: AuthInvocation,\n        raw: typeof M.OAuthConnectedList.Type,\n      ) {\n        const caller = yield* connectedCaller(invocation);\n        const input = yield* snapshotOAuth(M.OAuthConnectedList, raw);\n\n        const authorization = yield* connectedUseAuthorization(\n          yield* authorizeUse({ invocation: caller, moduleId: id, purpose: \"metadata\" }),\n          id,\n          caller.subjectId,\n          \"metadata\",\n        );\n\n        const result = yield* listRows({ authorization, ...input }).pipe(\n          Effect.flatMap((value) => snapshotOAuth(M.OAuthConnectedListResult, value)),\n        );\n\n        if (\n          result.items.length > input.limit ||\n          new Set(result.items.map((v) => v.grantId)).size !== result.items.length\n        )\n          return yield* OAuthUnavailable.make({});\n\n        return result;\n      }, connectedSafe);\n\n      const disconnect = Effect.fn(\"OAuthConnected.disconnect\")(function* (\n        invocation: AuthInvocation,\n        raw: typeof M.OAuthConnectedDisconnect.Type,\n      ) {\n        const caller = yield* connectedCaller(invocation);\n        const request = yield* snapshotOAuth(M.OAuthConnectedDisconnect, raw);\n\n        const metadataAuthorization = yield* connectedUseAuthorization(\n          yield* authorizeUse({ invocation: caller, moduleId: id, purpose: \"metadata\" }),\n          id,\n          caller.subjectId,\n          \"metadata\",\n        );\n\n        const inspected = yield* inspectDisconnect({\n          moduleId: id,\n          subjectId: caller.subjectId,\n          authorization: metadataAuthorization,\n          commandId: request.commandId,\n          grantId: request.grantId,\n        }).pipe(\n          Effect.flatMap((value) => snapshotOAuth(M.OAuthConnectedDisconnectInspection, value)),\n        );\n\n        if (inspected._tag === \"Rejected\") return yield* OAuthRejected.make({});\n        if (inspected._tag === \"Conflict\") return yield* IdentityConflict.make({});\n        if (inspected._tag === \"Replay\") {\n          if (inspected.result.grantId !== request.grantId || !inspected.result.replayed)\n            return yield* OAuthUnavailable.make({});\n\n          return inspected.result;\n        }\n\n        const grant = inspected.grant,\n          context = grant.context;\n\n        if (\n          context.moduleId !== id ||\n          context.subjectId !== caller.subjectId ||\n          context.grantId !== request.grantId ||\n          inspected.revision.subjectId !== caller.subjectId\n        )\n          return yield* OAuthUnavailable.make({});\n\n        const authorization = yield* authorize(\n          caller,\n          yield* challenge(\n            \"connected-disconnect\",\n            M.OAuthConnectedActionChallenge.fields.flowId.make(request.commandId),\n            request.commandId,\n            inspected.revision,\n            Schema.encodeSync(Schema.fromJsonString(M.OAuthConnectedDisconnectGrant))(grant),\n          ),\n          request.actionProof,\n        );\n\n        const event = yield* eventFor(\"disconnect\", caller.subjectId);\n        let revocation: M.OAuthConnectedRevocationJob | undefined;\n\n        if (grant.sealed && context.configuration.profile.revocation === \"cohort\") {\n          const material = yield* openTokens({ context, sealed: grant.sealed }).pipe(\n            Effect.flatMap((value) => snapshotOAuth(M.OAuthConnectedTokenMaterial, value)),\n          );\n\n          revocation = yield* Effect.gen(function* () {\n            const jobContext = snapshotOAuthSync(M.OAuthConnectedRevocationContext, {\n              namespace: \"effect-auth/oauth-connected-revocation-context/v1\",\n              jobId: yield* random(),\n              token: context,\n            });\n\n            return snapshotOAuthSync(M.OAuthConnectedRevocationJob, {\n              context: jobContext,\n              sealed: yield* sealTokens({ context: jobContext, material }),\n            });\n          }).pipe(Effect.ensuring(Effect.sync(() => wipeConnectedMaterial(material))));\n        }\n\n        const receipt = yield* disconnectRow(\n          {\n            moduleId: id,\n            commandId: request.commandId,\n            grant,\n            authorization,\n            ...(revocation ? { revocation } : {}),\n            retentionUntilMillis:\n              DateTime.toEpochMillis(yield* DateTime.now) + policy.retentionMillis,\n          },\n          (value, journal) => {\n            const decision = snapshotOAuthSync(M.OAuthConnectedDisconnectDecision, value);\n\n            if (decision._tag === \"Disconnected\") {\n              if (\n                decision.grantId !== request.grantId ||\n                (!decision.replayed &&\n                  context.configuration.profile.revocation === \"unsupported\" &&\n                  decision.remoteRevocation !== \"Unsupported\") ||\n                (!decision.replayed &&\n                  revocation !== undefined &&\n                  decision.remoteRevocation !== \"Pending\")\n              )\n                throw OAuthUnavailable.make({});\n              if (!decision.replayed) journal.stage(event);\n            }\n\n            return journal.prepare(decision);\n          },\n        );\n\n        const result = yield* connectedRead(receipt);\n\n        if (result._tag === \"Rejected\") return yield* OAuthRejected.make({});\n        if (result._tag === \"Conflict\") return yield* IdentityConflict.make({});\n\n        return result;\n      }, connectedSafe);\n\n      return Connected.of({ begin, complete, list, disconnect });\n    }),\n  );\n\n  const Begin = makeOperation(`${moduleId}/connected/begin`, {\n    payload: M.OAuthConnectedBegin,\n    success: OAuthSignInAuthorization,\n    error: Failure,\n    access: \"authenticated\",\n    exposure: \"public\",\n    replay: \"non-idempotent\",\n    credentials: true,\n  });\n\n  const Complete = makeOperation(`${moduleId}/connected/complete`, {\n    payload: M.OAuthConnectedComplete,\n    success: M.OAuthConnectedResult,\n    error: Failure,\n    access: \"authenticated\",\n    exposure: \"public\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const List = makeOperation(`${moduleId}/connected/list`, {\n    payload: M.OAuthConnectedList,\n    success: M.OAuthConnectedListResult,\n    error: Failure,\n    access: \"authenticated\",\n    exposure: \"public\",\n    replay: \"read-only\",\n  });\n\n  const Disconnect = makeOperation(`${moduleId}/connected/disconnect`, {\n    payload: M.OAuthConnectedDisconnect,\n    success: M.OAuthConnectedDisconnected,\n    error: Failure,\n    access: \"authenticated\",\n    exposure: \"public\",\n    replay: \"idempotent\",\n  });\n\n  const handlersLayer = Layer.mergeAll(\n    Begin.credentialHandlerLayer(\n      Effect.fn(\"OAuthConnected.Begin\")(function* (input, invocation) {\n        return yield* (yield* Connected).begin(invocation, input);\n      }),\n    ),\n    Complete.credentialHandlerLayer(\n      Effect.fn(\"OAuthConnected.Complete\")(function* (input, invocation) {\n        return yield* (yield* Connected).complete(invocation, input);\n      }),\n    ),\n    List.handlerLayer(\n      Effect.fn(\"OAuthConnected.List\")(function* (input, invocation) {\n        return yield* (yield* Connected).list(invocation, input);\n      }),\n    ),\n    Disconnect.handlerLayer(\n      Effect.fn(\"OAuthConnected.Disconnect\")(function* (input, invocation) {\n        return yield* (yield* Connected).disconnect(invocation, input);\n      }),\n    ),\n  );\n\n  return Object.freeze({\n    Connected,\n    binding,\n    layer,\n    operations: Object.freeze({ Begin, Complete, List, Disconnect }),\n    handlersLayer,\n    group: operationGroup(Begin, Complete, List, Disconnect),\n    ...makeOAuthConnectedAccess(moduleId, configuration),\n    ...makeOAuthConnectedMaintenance(moduleId, configuration),\n  });\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAmEA,MAAM,UAAU,OAAO,MAAM;CAC3B;CACAA;CACAC;CACAC;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAID,MAAM,iBAAiB,OAAO,OAAO;CACnC,UAAU;CACV,QAAQ,OAAO,YAAYC,oBAAsB;AACnD,CAAC;AAED,MAAM,oBAAoB,OAAO,OAAO;CACtC,eAAeC;CACf,kBAAkB;CAClB,SAAS;AACX,CAAC;AAED,MAAM,UAAU,IAAI,YAAY;AAChC,MAAM,UAAU,OAAO,eAAe,OAAO,MAAM,OAAO,MAAM,CAAC;AACjE,MAAM,cAAc,OAAO,eAAeC,gCAAkC;AAE5E,MAAM,eAAqD,OAAO,OAAO,CACvE,OAAO,OAAO;CAAE,MAAM;CAAS,MAAM;AAAkB,CAAC,CAC1D,CAAC;;AAQD,MAAa,sBACX,UACA,kBACG;CACH,MAAM,UAAU,mBAAmB,UAAU,iBAAiB;CAE9D,MAAM,YAAY,QAAQ,QAoBxB,CAAC,CAAC,uBAAuB,SAAS,SAAS,MAAM,WAAW,YAAY;CAE1E,MAAM,WAAW,uBAAuB,aAAa;CAErD,MAAM,QAAQ,MAAM,OAClB,WACA,OAAO,IAAI,aAAa;EACtB,MAAM,EAAE,IAAI,WAAW,OAAO,wBAAwB,UAAU,QAAQ;EACxE,MAAM,EAAE,OAAO,cAAc,QAAQ,kBAAkB,OAAO,QAAQ;EAEtE,MAAM,EACJ,SACA,OACA,WACA,OACA,cACA,QACA,MAAM,UACN,mBACA,YAAY,kBACV,OAAO;EAEX,MAAM,EAAE,QAAQ,iBAAiB,OAAO;EACxC,MAAM,EAAE,WAAW,iBAAiB,OAAO;EAC3C,MAAM,EAAE,sBAAsB,kBAAkB,OAAO;EACvD,MAAM,EAAE,MAAM,UAAU,MAAM,aAAa,OAAO;EAClD,MAAM,EAAE,MAAM,YAAY,MAAM,eAAe,OAAO;EACtD,MAAM,EAAE,SAAS,kBAAkB,OAAO;EAC1C,MAAM,EAAE,WAAW,OAAO;EAC1B,MAAM,EAAE,aAAa,WAAW,OAAO,OAAO;EAE9C,MAAM,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,aAAa;GAC7D,MAAM,QAAQ,OAAO,YAAY,EAAE,CAAC,CAAC,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;GAC1F,MAAM,QAAQ,aAAa,KAAK,SAAS,gBAAgB,KAAK,CAAC;GAE/D,MAAM,KAAK,CAAC;GAEZ,OAAO;EACT,CAAC;EAED,MAAM,OAAO,OAAO,GAAG,qBAAqB,CAAC,CAAC,WAAW,OAAe;GACtE,MAAM,QAAQ,OAAO,OAAO,WAAW,QAAQ,OAAO,KAAK,CAAC,CAAC,CAAC,KAC5D,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;GAEA,OAAO,YAAY,KAAK,SAAS,gBAAgB,KAAK,CAAC;EACzD,CAAC;EAED,MAAM,cAAc,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAC1D,QACA,UACA,QACA;GACA,MAAM,MAAM,SAAS,MAAM,MAAM;GAEjC,IAAI,CAAC,sBAAsB,KAAK,GAAG,GAAG,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;GACzE,MAAM,QAAQ,OAAO,eAAe,SAAS,gBAAgB,GAAG,CAAC;GAEjE,IAAI,CAAC,SAAS,MAAM,WAAW,MAAM,SAAS,gBAAgB,KAAK,MAAM,KAAK;IAC5E,OAAO,KAAK,CAAC;IAEb,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;GACrC;GACA,MAAM,KAAK,CAAC;GAEZ,OAAO,OAAO,KACZ,OAAO,WAAW,OAAO,CAAC,CAAC;IACzB;IACA;IACA,OAAO,OAAO,UAAU;IACxB;IACA;IACA;GACF,CAAC,CACH;EACF,CAAC;EAED,MAAM,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WACtD,QACA,QACA,WACA,UACA,QACA;GACA,MAAM,eAAe,OAAO,KAAK,MAAM;GAEvC,OAAO,kBAAkBC,+BAAiC;IACxD,UAAU;IACV;IACA;IACA;IACA;IACA;IACA,eAAe,OAAO,KACpB,OAAO,WAAW,OAAO,CAAC,CAAC;KACzB;KACA;KACA;KACA;KACA;KACA;IACF,CAAC,CACH;GACF,CAAC;EACH,CAAC;EAED,MAAM,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WACtD,QACA,UACA,OACA,aAAa,OAAO,0BACpB;GACA,MAAM,UAAU,OAAO,aAAa;IAClC,YAAY,EAAE,GAAG,OAAO;IACxB,WAAW,kBAAkBA,+BAAiC,QAAQ;IACtE,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,SAAS,KAAK,SAAS,MAAM,KAAK,CAAC,EAAE;GAC/E,CAAC;GAED,MAAM,gBAAgB,OAAO,cAAcC,mCAAqC;IAC9E,WAAW;IACX,UAAU,QAAQ;IAClB,aAAa;KACX,GAAG,QAAQ;KACX,kBAAkB,KAAK,IACrB,YACA,OAAO,0BACP,QAAQ,YAAY,gBACtB;IACF;GACF,CAAC,CAAC,CAAC,KAAK,OAAO,eAAA,6BAA8C,KAAK,CAAC,CAAC,CAAC,CAAC;GAEtE,MAAM,WAAW,cAAc;GAE/B,IACE,SAAS,WAAW,qBAAqB,KAAK,SAAS,MAAM,KAC7D,SAAS,kBAAkB,SAAS,iBACpC,CAAC,cAAc,sBAAsB,SAAS,UAAU,SAAS,QAAQ,KACzE,IAAI,IAAI,SAAS,SAAS,YAAY,KAAK,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,SAChE,SAAS,SAAS,YAAY,UAChC,EAAE,OAAO,qBAAqB,UAAU,cAAc,WAAW,CAAC,CAAC,KACjE,OAAO,eAAA,6BAA8C,KAAK,CAAC,CAAC,CAAC,CAC/D,EAAA,CAAG,WAEH,OAAO,OAAA,6BAAsC,KAAK,CAAC,CAAC;GAEtD,OAAO;EACT,CAAC;EAED,MAAM,eAAe,UACnB,MAAM,SAAS,0BAA0B,cAAc,KAAK,CAAC,CAAC,IAAI,iBAAiB,KAAK,CAAC,CAAC;EAE5F,MAAM,WAAW,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACjD,WACA,WACA;GACA,MAAM,WAAW,kBAAkB;IACjC,QAAQ;IACR,WAAW,WAAW,gBAAgB;IACtC;IACA,QAAQ;IACR,aAAa,CAAC;GAChB,CAAC;GAED,OAAO,OAAO,QAAQ;GAEtB,OAAO,eAAe;IACpB,IAAI,iBAAiB,KAAK,OAAO,OAAO,CAAC;IACzC,kBAAkB,SAAS,cAAc,OAAO,SAAS,GAAG;IAC5D;GACF,CAAC;EACH,CAAC;EAED,MAAM,QAAQ,OAAO,GAAG,sBAAsB,CAAC,CAAC,WAC9C,YACA,KACA;GACA,MAAM,SAAS,OAAO,gBAAgB,UAAU;GAChD,MAAM,UAAU,OAAO,cAAcC,qBAAuB,GAAG;GAE/D,MAAM,QAAQ,OAAO,QAAQ;IAC3B,UAAU;IACV,WAAW,OAAO;IAClB,GAAI,QAAQ,OAAO,SAAS,cAAc,EAAE,SAAS,QAAQ,OAAO,QAAQ,IAAI,CAAC;GACnF,CAAC;GAED,IAAI,CAAC,OAAO,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;GAC/C,MAAM,QAAQ,OAAO,cAAc,gBAAgB,KAAK;GAExD,IACE,MAAM,SAAS,cAAc,OAAO,aACnC,QAAQ,OAAO,SAAS,gBACtB,CAAC,MAAM,UAAU,MAAM,OAAO,YAAY,QAAQ,OAAO,UAE5D,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GAExC,MAAM,UAAU,OAAO,SAAS,MAC7B,UAAU,MAAM,QAAQ,QAAQ,OAAO,cAAc,MAAM,aAAa,QAC3E;GAEA,MAAM,WACJ,QAAQ,OAAO,SAAS,YACpB,QAAQ,OAAO,WACf,MAAM,OAAQ,SAAS;GAE7B,IACE,CAAC,WACD,QAAQ,aAAa,YACpB,QAAQ,OAAO,SAAS,eACvB,QAAQ,yBACN,MAAM,OAAQ,cAAc,QAAQ,sBAExC,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;GAErC,MAAM,eAAe,OAAO,cAAc,QAAQ,YAAY,CAAC,CAAC,KAC9D,OAAO,SAAS,UAAU,cAAc,mBAAmB,KAAK,CAAC,CACnE;GAEA,MAAM,SAAS,OAAO,aAAa,QAAQ,MAAM,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;GACpF,MAAM,WAAW,OAAO,mBAAmB;GAE3C,IACE,OAAO,mBAAmB,WAAW,KACrC,UAAU,SAAS,WACnB,SAAS,SAAS,qBAClB,OAAO,MAAM,WAAW,QAAQ,UAChC,SAAS,oBAAoB,OAAO,MAAM,iBAE1C,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GAExC,MAAM,UAAU,OAAO,OAAO;IAC5B,MAAM;IACN,MAAM;IACN,YAAY,SAAS,KAAK,SAAS,MAAM,SAAS,UAAU,CAAC;IAC7D,iBAAiB,SAAS;GAC5B,CAAC;GAED,MAAM,SAAS,EACb,GAAI,OAAO,cACT,QAAQ,QACR,SAAS,KAAK,SAAS,MAAM,QAAQ,UAAU,CAAC,CAClD,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC,EACrC;GAEA,IAAI,OAAO,oBAAoB,QAAQ,iBACrC,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GAExC,MAAM,WAAW,OAAO,qBAAqB;IAC3C,SAAS,kBAAkBC,uBAAyB,OAAO;IAC3D,YAAY,QAAQ;IACpB,QAAQ,QAAQ;GAClB,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,MAAM,SAAS,0BAA0B,cAAc,KAAK,CAAC,CAAC,IAAI,KACpE,GACA,OAAO,SAAS,UAAU,cAAc,mBAAmB,KAAK,CAAC,CACnE;GAEA,IACE,SAAS,cAAc,aAAa,YACpC,SAAS,cAAc,eAAe,QAAQ,cAC9C,CAAC,cAAcA,uBAAyB,SAAS,cAAc,SAAS,OAAO,KAC9E,SAAS,cAAc,aAAa,YAClC,SAAS,QAAQ,cAAc,KAAA,MACjC,QAAQ,OAAO,SAAS,eACvB,SAAS,cAAc,WAAW,MAAM,OAAQ,SAAS,QAE3D,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GACxC,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;GACtD,MAAM,kBAAkB,KAAK,IAAI,MAAM,OAAO,gBAAgB,OAAO,eAAe;GAEpF,IAAI,mBAAmB,KAAK,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;GAE/D,MAAM,UAAU,kBAAkBJ,kCAAoC;IACpE,GAAG,SAAS;IACZ,WAAW;IACX,UAAU;IACV,YAAY,OAAO;IACnB,QAAQ,QAAQ;IAChB,WAAW,QAAQ;IACnB,UAAU,MAAM;IAChB,SACE,QAAQ,OAAO,SAAS,cACpB,QAAQ,OAAO,UAAA,aACA,KAAK,OAAO,OAAO,CAAC;IACzC,GAAI,QAAQ,OAAO,SAAS,cAAc,EAAE,WAAW,MAAM,OAAO,IAAI,CAAC;IACzE,0BAA0B,OAAO;IACjC;IACA,aAAa,OAAO,YAAY,QAAQ,QAAQ,UAAU,SAAS,QAAQ,KAAK;IAChF,wBAAwB,OAAO;IAC/B,+BAA+B,OAAO;IACtC,gBAAgB;IAChB;IACA,qBAAqB,OAAO;GAC9B,CAAC;GAED,MAAM,gBAAgB,OAAO,UAC3B,QACA,OAAO,UACL,mBACA,QAAQ,QACR,QAAQ,WACR,QAAQ,UACR,OAAO,WAAW,WAAW,CAAC,CAAC,OAAO,CACxC,GACA,QAAQ,WACV;GAEA,MAAM,SAAS,OAAO,SAAS;IAC7B;IACA,SAAS,kBAAkB,yBAAyB,SAAS,OAAO;GACtE,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,UAAU,cAAc,wBAAwB,KAAK,CAAC,CAAC;GAE/E,MAAM,OAAO,kBAAkBK,2BAA6B;IAC1D;IACA;IACA,sBAAsB,kBAAkB,OAAO;GACjD,CAAC;GAED,MAAM,UAAU,OAAO,MACrB;IAAE,MAAM,kBAAkBA,2BAA6B,IAAI;IAAG;GAAc,IAC3E,OAAO,YAAY;IAClB,MAAM,WAAW,kBAAkBC,6BAA+B,KAAK;IAEvE,IACE,SAAS,SAAS,YAClB,CAAC,cAAcD,2BAA6B,SAAS,MAAM,IAAI,GAE/D,MAAM,iBAAiB,KAAK,CAAC,CAAC;IAEhC,OAAO,QAAQ,QAAQ,SAAS,SAAS,QAAQ;GACnD,CACF;GAEA,IAAI,EAAE,OAAO,cAAc,OAAO,IAAI,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;GAEzE,OAAO;IACL,OAAO;KACL,QAAQ,QAAQ;KAChB,kBAAkB,SAAS;KAC3B;IACF;IACA,oBAAoB,CAAC,OAAO;GAC9B;EACF,GAAG,aAAa;EAEhB,MAAM,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WACpD,YACA,KACA;GACA,MAAM,SAAS,OAAO,gBAAgB,UAAU;GAChD,MAAM,UAAU,OAAO,cAAcE,wBAA0B,GAAG;GAClE,MAAM,WAAW,QAAQ;GAEzB,IACE,QAAQ,OAAO,OAAO,WAAW,OAAO,eAAe,qBAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CACtF,SAAS,OAEZ,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;GAErC,MAAM,SAAS,EACb,GAAI,OAAO,cAAc,QAAQ,QAAQ,QAAQ,cAAc,CAAC,CAAC,KAC/D,OAAO,SAAS,WAAW,CAC7B,EACF;GAEA,MAAM,SAAS,kBAAkBC,sBAAwB;IACvD,UAAU;IACV,YAAY,OAAO;IACnB,WAAW,OAAO;IAClB,QAAQ,QAAQ;IAChB,UAAU,QAAQ;IAClB,YAAY,QAAQ;IACpB,aAAa,OAAO,YAAY,QAAQ,QAAQ,QAAQ,UAAU,SAAS,KAAK;IAChF,wBAAwB,OAAO;IAC/B,+BAA+B,OAAO;IACtC,GAAI,SAAS,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,SAAS,OAAO;IAC3E,WAAW,SAAS,cAAc,OAAO,SAAS,GAAG;GACvD,CAAC;GAED,MAAM,YAAY,OAAO,UAAU,MAAM;GAEzC,IAAI,CAAC,WAAW,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;GACnD,MAAM,OAAO,OAAO,cAAcH,2BAA6B,SAAS;GACxE,MAAM,UAAU,KAAK;GAErB,IACE,QAAQ,aAAa,MACrB,QAAQ,eAAe,OAAO,cAC9B,QAAQ,WAAW,QAAQ,UAC3B,QAAQ,aAAa,QAAQ,YAC7B,QAAQ,eAAe,QAAQ,cAC/B,QAAQ,SAAS,cAAc,OAAO,aACtC,QAAQ,gBAAgB,OAAO,eAC/B,QAAQ,2BAA2B,OAAO,YAC1C,QAAQ,kCAAkC,OAAO,mBACjD,QAAQ,kBAAkB,OAAO,mBACjC,OAAO,YAAY,QAAQ,kBAC3B,OAAO,aAAa,QAAQ,mBAC5B,CAAC,iBAAiB,QAAQ,QAAQ,OAAO,MACxC,QAAQ,uBAAuB,aAC5B,SAAS,WAAW,QAAQ,SAC5B,SAAS,WAAW,KAAA,IAExB,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GAExC,MAAM,gBAAgB,OAAO,UAC3B,QACA,OAAO,UACL,sBACA,QAAQ,QACR,QAAQ,WACR,QAAQ,UACR,OAAO,WAAW,WAAW,CAAC,CAAC,OAAO,CACxC,GACA,QAAQ,aACR,QAAQ,wBACV;GAEA,MAAM,QAAQ,OAAO,SAAS,WAAW,OAAO,SAAS;GACzD,MAAM,UAAU,OAAO,OAAO;GAE9B,MAAM,WAAW,OAAO,OAAO,qBAAqB,YAClD,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO,QACrB,MAAM;KAAE;KAAQ;KAAM;KAAS;IAAc,IAAI,OAAO,YACtD,QAAQ,QAAQ,kBAAkBI,6BAA+B,KAAK,CAAC,CACzE,CACF;IAEA,MAAM,WAAW,OAAO,cAAc,OAAO;IAE7C,IAAI,SAAS,SAAS,WAAW,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;IACpE,MAAM,QAAQ,kBAAkBC,qBAAuB,SAAS,KAAK;IAErE,IACE,MAAM,YAAY,WAClB,CAAC,cAAcL,2BAA6B,MAAM,MAAM,IAAI,KAC5D,MAAM,kBAAkB,QAAQ,kBAChC,MAAM,mBAAmB,QAAQ,mBACjC,MAAM,kBAAkB,SAAS,cAAc,OAAO,SAAS,GAAG,KAClE,MAAM,yBAAyB,MAAM,kBAAkB,QAAQ,uBAC/D,KAAK,uBAAuB,MAAM,sBAElC,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAExC,MAAM,WAAW,OAAO,IAAI,aAAa;KACvC,MAAM,UAAU,OAAO,SAAS;MAAE;MAAS,QAAQ,KAAK;KAAO,CAAC,CAAC,CAAC,KAChE,OAAO,SAAS,UAAU,cAAc,yBAAyB,KAAK,CAAC,CACzE;KAEA,IACG,QAAQ,aAAa,YAAa,QAAQ,cAAc,KAAA,OACxD,OAAO,YAAY,QAAQ,QAAQ,QAAQ,UAAU,QAAQ,KAAK,OACjE,QAAQ,eACV,SAAS,MAAM,QAAQ,KAAK,MAAM,SAAS,MAAM,SAAS,KAAK,GAE/D,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;KACxC,IAAI,SAAS,SAAS,QAAQ,OAAO,OAAO,sBAAsB,KAAK,CAAC,CAAC;KACzE,MAAM,QAAQ,SAAS,cAAc,OAAO,SAAS,GAAG;KAExD,IAAI,SAAS,MAAM,sBAAsB,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;KAE/E,MAAM,wBAAwB,kBAC5BN,6BACA,OACF;KAEA,MAAM,WAAW,OAAO,cAAc;MACpC,eAAe;MACf;MACA;MACA,uBAAuB,SAAS,WAAW,KAAK;KAClD,CAAC;KAED,MAAM,YAAY,OAAO,uBACvB,uBACA,UACA,KACF;KAEA,OAAO,OAAO,OAAO,IAAI,aAAa;MACpC,IACG,QAAQ,aACP,CAAC,cACC,uBACA,QAAQ,UAAU,UAClB,UAAU,QACZ,KACD,UAAU,SAAS,aAAa,SAAS,WACvC,CAAC,UAAU,SAAS,aAAa,SAChC,CAAC,QAAQ,aACT,SAAS,MAAM,UAAU,SAAS,aAAa,KAAK,MAClD,SAAS,MAAM,QAAQ,SAAS,IAEtC,OAAO,OAAO,sBAAsB,KAAK,CAAC,CAAC;MAE7C,MAAM,iBAAiB,OAAO,aAAa;OACzC,OAAO;OACP,UAAU,UAAU;MACtB,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,UAAU,cAAcY,+BAAiC,KAAK,CAAC,CACjF;MAEA,IAAI,eAAe,SAAS,YAAY,OAAO,EAAE,MAAM,WAAoB;MAC3E,IAAI,eAAe,SAAS,YAAY,OAAO,EAAE,MAAM,WAAoB;MAE3E,MAAM,eAAe,kBAAkBC,4BAA8B;OACnE,WAAW;OACX,UAAU;OACV,WAAW,OAAO;OAClB,UAAU,UAAU;OACpB,eAAe;OACf,SAAS,QAAQ;OACjB,cAAc,iBAAiB,KAAK,OAAO,OAAO,CAAC;OACnD,cAAc,iBAAiB,KAAK,OAAO,OAAO,CAAC;OACnD,kBAAkB,eAAe;OACjC,UAAU,UAAU;MACtB,CAAC;MAED,MAAM,SAAS,OAAO,WAAW;OAC/B,SAAS;OACT,UAAU,kBAAkBC,6BAA+B,UAAU,QAAQ;MAC/E,CAAC;MAED,MAAM,QAAQ,kBAAkBC,2BAA6B;OAC3D,SAAS;OACT;MACF,CAAC;MAED,IAAI;MAEJ,IAAI,QAAQ,QAAQ,eAAe,UAAU;OAC3C,MAAM,iBAAiB,kBAAkBC,iCAAmC;QAC1E,WAAW;QACX,OAAO,OAAO,OAAO;QACrB,OAAO;OACT,CAAC;OAED,UAAU,kBAAkBC,6BAA+B;QACzD,SAAS;QACT,QAAQ,OAAO,WAAW;SACxB,SAAS;SACT,UAAU,kBACRH,6BACA,UAAU,QACZ;QACF,CAAC;OACH,CAAC;MACH;MAEA,OAAO,kBAAkBI,uBAAyB;OAChD,MAAM,eAAe,SAAS,eAAe,gBAAgB;OAC7D;OACA,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;MAC/B,CAAC;KACH,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,OAAO,WAAW,sBAAsB,UAAU,QAAQ,CAAC,CAAC,CAC9E;IACF,CAAC;IAED,MAAM,YAAY,KAAK,IACrB,GACA,MAAM,uBAAuB,SAAS,cAAc,OAAO,SAAS,GAAG,CACzE;IAEA,MAAM,YACJ,SAAS,SAAS,UACd,KAAA,IACA,OAAO,OAAO,KAAK,QAAQ,iBAAiB,UAAU,SAAS,CAAC,CAAC;IAEvE,MAAM,WACJ,aACA,KAAK,UAAU,SAAS,KACxB,UAAU,MAAM,QAAQ,WAAW,KACnC,UAAU,MAAM,QAAQ,EAAE,EAAE,SAAS,UACrC,OAAO,GAAG,qBAAqB,CAAC,CAAC,UAAU,MAAM,QAAQ,EAAE,CAAC,KAAK;IAEnE,MAAM,UACJ,cAAc,KAAA,IACV,EAAE,MAAM,YAAY,IACpB,KAAK,UAAU,SAAS,IACtB,UAAU,QACV,WACE,EAAE,MAAM,WAAW,IACnB,EAAE,MAAM,YAAY;IAE9B,MAAM,YAAY,OAAO,iBACvB,OACE;KACE,OAAO;KACP;KACA;KACA,WAAW,SAAS,cAAc,OAAO,SAAS,GAAG;IACvD,IACC,OAAO,YAAY;KAClB,MAAM,SAAS,kBAAkBC,kCAAoC,KAAK;KAE1E,IAAI,OAAO,SAAS,aAAa;MAC/B,IACE,QAAQ,SAAS,cACjB,CAAC,cAAcJ,2BAA6B,OAAO,OAAO,QAAQ,KAAK,GAEvE,MAAM,iBAAiB,KAAK,CAAC,CAAC;MAChC,QAAQ,MAAM,KAAK;KACrB,OAAO,IAAI,OAAO,SAAS,eAAe,QAAQ,SAAS,aACzD,MAAM,iBAAiB,KAAK,CAAC,CAAC;KAEhC,OAAO,QAAQ,QAAQ,MAAM;IAC/B,CACF,GACA,OAAO,uBACT,CAAC,CAAC,KACA,OAAO,QAAQ,aAAa,GAC5B,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;IAEA,IAAI,aAAa,KAAK,UAAU,SAAS,KAAK,MAAM,cAAc,UAAU,KAAK,GAC/E,OAAO,OAAO,OAAO;IAEvB,OAAO;GACT,CAAC,CACH;GAEA,IAAI,SAAS,SAAS,aAAa,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GACzE,IAAI,SAAS,SAAS,QAAQ,OAAO,OAAA,mBAA4B,KAAK,CAAC,CAAC;GACxE,IAAI,SAAS,SAAS,YAAY,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GACxE,IAAI,SAAS,SAAS,YAAY,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;GAErE,OAAO;IACL,OACE,SAAS,SAAS,cACd;KAAE,MAAM;KAAsB,cAAc,QAAQ;IAAa,IACjE;KACE,MAAM;KACN,SAAS,QAAQ;KACjB,YAAY,QAAQ,QAAQ;KAC5B,QAAQ;KACR,cAAc,QAAQ;IACxB;IACN,oBAAoB;GACtB;EACF,GAAG,aAAa;EAEhB,MAAM,OAAO,OAAO,GAAG,qBAAqB,CAAC,CAAC,WAC5C,YACA,KACA;GACA,MAAM,SAAS,OAAO,gBAAgB,UAAU;GAChD,MAAM,QAAQ,OAAO,cAAcK,oBAAsB,GAAG;GAE5D,MAAM,gBAAgB,OAAO,0BAC3B,OAAO,aAAa;IAAE,YAAY;IAAQ,UAAU;IAAI,SAAS;GAAW,CAAC,GAC7E,IACA,OAAO,WACP,UACF;GAEA,MAAM,SAAS,OAAO,SAAS;IAAE;IAAe,GAAG;GAAM,CAAC,CAAC,CAAC,KAC1D,OAAO,SAAS,UAAU,cAAcC,0BAA4B,KAAK,CAAC,CAC5E;GAEA,IACE,OAAO,MAAM,SAAS,MAAM,SAC5B,IAAI,IAAI,OAAO,MAAM,KAAK,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,OAAO,MAAM,QAElE,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GAExC,OAAO;EACT,GAAG,aAAa;EAEhB,MAAM,aAAa,OAAO,GAAG,2BAA2B,CAAC,CAAC,WACxD,YACA,KACA;GACA,MAAM,SAAS,OAAO,gBAAgB,UAAU;GAChD,MAAM,UAAU,OAAO,cAAcC,0BAA4B,GAAG;GAEpE,MAAM,wBAAwB,OAAO,0BACnC,OAAO,aAAa;IAAE,YAAY;IAAQ,UAAU;IAAI,SAAS;GAAW,CAAC,GAC7E,IACA,OAAO,WACP,UACF;GAEA,MAAM,YAAY,OAAO,kBAAkB;IACzC,UAAU;IACV,WAAW,OAAO;IAClB,eAAe;IACf,WAAW,QAAQ;IACnB,SAAS,QAAQ;GACnB,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,UAAU,cAAcC,oCAAsC,KAAK,CAAC,CACtF;GAEA,IAAI,UAAU,SAAS,YAAY,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;GACtE,IAAI,UAAU,SAAS,YAAY,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GACzE,IAAI,UAAU,SAAS,UAAU;IAC/B,IAAI,UAAU,OAAO,YAAY,QAAQ,WAAW,CAAC,UAAU,OAAO,UACpE,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAExC,OAAO,UAAU;GACnB;GAEA,MAAM,QAAQ,UAAU,OACtB,UAAU,MAAM;GAElB,IACE,QAAQ,aAAa,MACrB,QAAQ,cAAc,OAAO,aAC7B,QAAQ,YAAY,QAAQ,WAC5B,UAAU,SAAS,cAAc,OAAO,WAExC,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GAExC,MAAM,gBAAgB,OAAO,UAC3B,QACA,OAAO,UACL,wBAAA,8BACgC,OAAO,OAAO,KAAK,QAAQ,SAAS,GACpE,QAAQ,WACR,UAAU,UACV,OAAO,WAAW,OAAO,eAAeC,6BAA+B,CAAC,CAAC,CAAC,KAAK,CACjF,GACA,QAAQ,WACV;GAEA,MAAM,QAAQ,OAAO,SAAS,cAAc,OAAO,SAAS;GAC5D,IAAI;GAEJ,IAAI,MAAM,UAAU,QAAQ,cAAc,QAAQ,eAAe,UAAU;IACzE,MAAM,WAAW,OAAO,WAAW;KAAE;KAAS,QAAQ,MAAM;IAAO,CAAC,CAAC,CAAC,KACpE,OAAO,SAAS,UAAU,cAAcV,6BAA+B,KAAK,CAAC,CAC/E;IAEA,aAAa,OAAO,OAAO,IAAI,aAAa;KAC1C,MAAM,aAAa,kBAAkBE,iCAAmC;MACtE,WAAW;MACX,OAAO,OAAO,OAAO;MACrB,OAAO;KACT,CAAC;KAED,OAAO,kBAAkBC,6BAA+B;MACtD,SAAS;MACT,QAAQ,OAAO,WAAW;OAAE,SAAS;OAAY;MAAS,CAAC;KAC7D,CAAC;IACH,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,OAAO,WAAW,sBAAsB,QAAQ,CAAC,CAAC,CAAC;GAC7E;GAEA,MAAM,UAAU,OAAO,cACrB;IACE,UAAU;IACV,WAAW,QAAQ;IACnB;IACA;IACA,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;IACnC,sBACE,SAAS,cAAc,OAAO,SAAS,GAAG,IAAI,OAAO;GACzD,IACC,OAAO,YAAY;IAClB,MAAM,WAAW,kBAAkBQ,kCAAoC,KAAK;IAE5E,IAAI,SAAS,SAAS,gBAAgB;KACpC,IACE,SAAS,YAAY,QAAQ,WAC5B,CAAC,SAAS,YACT,QAAQ,cAAc,QAAQ,eAAe,iBAC7C,SAAS,qBAAqB,iBAC/B,CAAC,SAAS,YACT,eAAe,KAAA,KACf,SAAS,qBAAqB,WAEhC,MAAM,iBAAiB,KAAK,CAAC,CAAC;KAChC,IAAI,CAAC,SAAS,UAAU,QAAQ,MAAM,KAAK;IAC7C;IAEA,OAAO,QAAQ,QAAQ,QAAQ;GACjC,CACF;GAEA,MAAM,SAAS,OAAO,cAAc,OAAO;GAE3C,IAAI,OAAO,SAAS,YAAY,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;GACnE,IAAI,OAAO,SAAS,YAAY,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GAEtE,OAAO;EACT,GAAG,aAAa;EAEhB,OAAO,UAAU,GAAG;GAAE;GAAO;GAAU;GAAM;EAAW,CAAC;CAC3D,CAAC,CACH;CAEA,MAAM,QAAQ,cAAc,GAAG,SAAS,mBAAmB;EACzD,SAASrB;EACT,SAAS;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,WAAW,cAAc,GAAG,SAAS,sBAAsB;EAC/D,SAASI;EACT,SAASkB;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,OAAO,cAAc,GAAG,SAAS,kBAAkB;EACvD,SAASN;EACT,SAASC;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;CACV,CAAC;CAED,MAAM,aAAa,cAAc,GAAG,SAAS,wBAAwB;EACnE,SAASC;EACT,SAASK;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;CACV,CAAC;CAED,MAAM,gBAAgB,MAAM,SAC1B,MAAM,uBACJ,OAAO,GAAG,sBAAsB,CAAC,CAAC,WAAW,OAAO,YAAY;EAC9D,OAAO,QAAQ,OAAO,UAAA,CAAW,MAAM,YAAY,KAAK;CAC1D,CAAC,CACH,GACA,SAAS,uBACP,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,OAAO,YAAY;EACjE,OAAO,QAAQ,OAAO,UAAA,CAAW,SAAS,YAAY,KAAK;CAC7D,CAAC,CACH,GACA,KAAK,aACH,OAAO,GAAG,qBAAqB,CAAC,CAAC,WAAW,OAAO,YAAY;EAC7D,OAAO,QAAQ,OAAO,UAAA,CAAW,KAAK,YAAY,KAAK;CACzD,CAAC,CACH,GACA,WAAW,aACT,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAAW,OAAO,YAAY;EACnE,OAAO,QAAQ,OAAO,UAAA,CAAW,WAAW,YAAY,KAAK;CAC/D,CAAC,CACH,CACF;CAEA,OAAO,OAAO,OAAO;EACnB;EACA;EACA;EACA,YAAY,OAAO,OAAO;GAAE;GAAO;GAAU;GAAM;EAAW,CAAC;EAC/D;EACA,OAAO,eAAe,OAAO,UAAU,MAAM,UAAU;EACvD,GAAG,yBAAyB,UAAU,aAAa;EACnD,GAAG,8BAA8B,UAAU,aAAa;CAC1D,CAAC;AACH"}

package/dist/oauth/connectedAccess.d.mts

@@ -0,0 +1,20 @@
+import { AuthenticationRequired } from "../operations/errors.mjs";
+import "../operations/context.mjs";
+import "../hooks/commit.mjs";
+import { OAuthMethodUnsupported, OAuthRejected, OAuthUnavailable } from "./signInErrors.mjs";
+import { OAuthConnectedBusy, OAuthConnectedReauthorizationRequired } from "./connectedModels.mjs";
+import "./OAuthConnectedPersistence.mjs";
+import "./OAuthConnectedProtocol.mjs";
+import "./OAuthConnectedTokenProtector.mjs";
+import "./OAuthConnectedUseAuthority.mjs";
+import { Cause, Context, Crypto, DateTime, Effect, Layer, Redacted, Schema } from "effect";
+//#region src/oauth/connectedAccess.d.ts
+declare const OAuthConnectedAccessFailure: Schema.Union<readonly [typeof AuthenticationRequired, typeof OAuthRejected, typeof OAuthUnavailable, typeof OAuthMethodUnsupported, typeof OAuthConnectedBusy, typeof OAuthConnectedReauthorizationRequired]>;
+type OAuthConnectedAccessFailure = typeof OAuthConnectedAccessFailure.Type;
+interface AccessModule<Id extends string> {
+  readonly moduleId: Id;
+  readonly kind: "oauth-connected-access";
+}
+//#endregion
+export { AccessModule, OAuthConnectedAccessFailure };
+//# sourceMappingURL=connectedAccess.d.mts.map

package/dist/oauth/connectedAccess.mjs

@@ -0,0 +1,279 @@
+import { reportAuthFailure } from "../internal/diagnostics.mjs";
+import { AuthenticationRequired } from "../operations/errors.mjs";
+import { AssuranceEvidence, AuthenticationAssurance, requireAuthenticated } from "../operations/context.mjs";
+import { SecurityRevision } from "../sessions/models.mjs";
+import { hasCommitScope } from "../hooks/commit.mjs";
+import { OAuthClaimId, OAuthExternalIdentity, OAuthModuleId } from "./signInModels.mjs";
+import { OAuthConfigurationError, OAuthMethodUnsupported, OAuthRejected, OAuthUnavailable } from "./signInErrors.mjs";
+import { snapshotOAuth, snapshotOAuthSync } from "./signInSnapshot.mjs";
+import { OAuthConnectedAccessInspection, OAuthConnectedBusy, OAuthConnectedContinuation, OAuthConnectedGrantResponse, OAuthConnectedPolicy, OAuthConnectedProfile, OAuthConnectedReauthorizationRequired, OAuthConnectedRefreshClaim, OAuthConnectedRefreshDecision, OAuthConnectedRefreshOutcome, OAuthConnectedRefreshSettlement, OAuthConnectedResources, OAuthConnectedRevocationContext, OAuthConnectedRevocationJob, OAuthConnectedScopes, OAuthConnectedStoredGrant, OAuthConnectedTokenContext, OAuthConnectedTokenMaterial, OAuthConnectedTokenMetadata, OAuthConnectedUse, OAuthConnectedUseAdmission, OAuthConnectedUseAuthorization } from "./connectedModels.mjs";
+import { OAuthConnectedPersistence } from "./OAuthConnectedPersistence.mjs";
+import { OAuthConnectedProtocol } from "./OAuthConnectedProtocol.mjs";
+import { OAuthConnectedTokenProtector } from "./OAuthConnectedTokenProtector.mjs";
+import { OAuthConnectedUseAuthority } from "./OAuthConnectedUseAuthority.mjs";
+import { Cause, Context, Crypto, DateTime, Effect, Encoding, Exit, Fiber, Layer, Redacted, Schema } from "effect";
+//#region src/oauth/connectedAccess.ts
+const OAuthConnectedAccessFailure = Schema.Union([
+	AuthenticationRequired,
+	OAuthRejected,
+	OAuthUnavailable,
+	OAuthMethodUnsupported,
+	OAuthConnectedBusy,
+	OAuthConnectedReauthorizationRequired
+]);
+const invocationSchema = Schema.TaggedStruct("Authenticated", {
+	subjectId: OAuthConnectedTokenContext.fields.subjectId,
+	sessionId: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256))),
+	assurance: Schema.Struct({
+		...AuthenticationAssurance.fields,
+		method: Schema.NonEmptyString.check(Schema.isMaxLength(128)),
+		factors: AuthenticationAssurance.fields.factors.check(Schema.isMaxLength(8)),
+		evidence: Schema.optionalKey(Schema.NonEmptyArray(Schema.Struct({
+			...AssuranceEvidence.fields,
+			method: Schema.NonEmptyString.check(Schema.isMaxLength(128)),
+			factors: AssuranceEvidence.fields.factors.check(Schema.isMaxLength(8))
+		})).check(Schema.isMaxLength(64)))
+	})
+});
+const connectedCaller = Effect.fn("OAuthConnected.caller")(function* (invocation) {
+	if (yield* hasCommitScope) return yield* OAuthMethodUnsupported.make({});
+	return yield* snapshotOAuth(invocationSchema, yield* requireAuthenticated(invocation));
+});
+const connectedRead = (receipt) => receipt.read.pipe(Effect.mapError(() => OAuthUnavailable.make({})));
+const connectedSafe = (effect) => effect.pipe(Effect.tapCause((cause) => Cause.hasDies(cause) ? reportAuthFailure("oauth-connected", cause) : Effect.void), Effect.catchCause((cause) => Cause.hasInterrupts(cause) ? Effect.interrupt : Cause.hasDies(cause) ? Effect.fail(OAuthUnavailable.make({})) : Effect.failCause(cause)));
+const connectedBounded = (effect, millis) => Effect.gen(function* () {
+	const fiber = yield* effect.pipe(Effect.interruptible, Effect.forkDetach);
+	return yield* Fiber.join(fiber).pipe(Effect.timeout(millis), Effect.ensuring(Fiber.interrupt(fiber).pipe(Effect.forkDetach, Effect.asVoid)));
+});
+const connectedSame = (schema, a, b) => Schema.encodeSync(Schema.fromJsonString(schema))(a) === Schema.encodeSync(Schema.fromJsonString(schema))(b);
+const captureConnectedPolicy = (input) => {
+	try {
+		return snapshotOAuthSync(OAuthConnectedPolicy, input);
+	} catch {
+		return;
+	}
+};
+const validateConnectedPolicy = Effect.fn("OAuthConnected.policy")(function* (moduleId, captured) {
+	const id = yield* Schema.decodeEffect(OAuthModuleId)(moduleId).pipe(Effect.mapError(() => OAuthConfigurationError.make({ reason: "module" })));
+	if (!captured) return yield* OAuthConfigurationError.make({ reason: "policy" });
+	const seen = /* @__PURE__ */ new Set(), active = /* @__PURE__ */ new Set();
+	for (const profile of captured.profiles) {
+		const key = profile.key + ":" + profile.generation;
+		if (seen.has(key) || profile.issuance === "active" && active.has(profile.key) || new Set(profile.scopes).size !== profile.scopes.length || new Set(profile.resources).size !== profile.resources.length || profile.refreshAheadMillis >= profile.maximumAccessLifetimeMillis || profile.retention === "access-and-refresh" && (profile.maximumRefreshLifetimeMillis === void 0 || profile.refresh === "unsupported") || profile.retention === "access-only" && profile.refresh !== "unsupported") return yield* OAuthConfigurationError.make({ reason: "policy" });
+		seen.add(key);
+		if (profile.issuance === "active") active.add(profile.key);
+	}
+	if (active.size === 0) return yield* OAuthConfigurationError.make({ reason: "policy" });
+	return {
+		id,
+		policy: captured
+	};
+});
+const connectedProfile = (policy, input) => {
+	const current = policy.profiles.find((p) => p.key === input.key && p.issuance === "active");
+	return current !== void 0 && connectedSame(OAuthConnectedProfile, current, {
+		...input,
+		issuance: "active"
+	});
+};
+const connectedUseAuthorization = Effect.fn("OAuthConnected.useAuthorization")(function* (value, moduleId, subjectId, purpose, grantId, profileKey) {
+	const authorization = yield* snapshotOAuth(OAuthConnectedUseAuthorization, value);
+	const now = DateTime.toEpochMillis(yield* DateTime.now);
+	if (authorization.moduleId !== moduleId || authorization.revision.subjectId !== subjectId || authorization.purpose !== purpose || authorization.grantId !== grantId || authorization.profileKey !== profileKey || authorization.expiresAtMillis <= now || new Set(authorization.revision.credentials.map((v) => v.credentialId)).size !== authorization.revision.credentials.length) return yield* OAuthUnavailable.make({});
+	return authorization;
+});
+const wipeConnectedMaterial = (material) => {
+	Redacted.wipeUnsafe(material.accessToken);
+	if (material.refreshToken) Redacted.wipeUnsafe(material.refreshToken);
+	if (material.continuation._tag === "Oidc" && material.continuation.nonce) Redacted.wipeUnsafe(material.continuation.nonce);
+};
+/** Private bounded projection shared by initial and refresh orchestration. */
+const connectedGrantResponse = Effect.fn("OAuthConnected.grantResponse")(function* (configuration, raw, startedAtMillis, previous) {
+	const response = yield* snapshotOAuth(OAuthConnectedGrantResponse, raw);
+	const now = DateTime.toEpochMillis(yield* DateTime.now);
+	const profile = configuration.profile;
+	if (response.identity.provider !== configuration.provider || response.identity.issuer !== configuration.issuer || configuration.protocol === "oidc" !== (response.material.continuation._tag === "Oidc") || new Set(response.scopes).size !== response.scopes.length || new Set(response.resources).size !== response.resources.length || !connectedSame(OAuthConnectedScopes, [...response.scopes].sort(), [...profile.scopes].sort()) || !connectedSame(OAuthConnectedResources, [...response.resources].sort(), [...profile.resources].sort()) || response.accessExpiresAtMillis !== void 0 && response.accessExpiresAtMillis <= now || startedAtMillis > now || startedAtMillis < 0) return yield* OAuthUnavailable.make({});
+	if (previous && (!connectedSame(OAuthExternalIdentity, response.identity, previous.context.identity) || !connectedSame(OAuthConnectedContinuation, response.material.continuation, previous.material.continuation))) return yield* OAuthUnavailable.make({});
+	const retainedRefresh = profile.retention === "access-and-refresh" ? response.material.refreshToken ?? previous?.material.refreshToken : void 0;
+	const material = snapshotOAuthSync(OAuthConnectedTokenMaterial, {
+		namespace: response.material.namespace,
+		accessToken: response.material.accessToken,
+		continuation: response.material.continuation,
+		...retainedRefresh === void 0 ? {} : { refreshToken: Redacted.make(Redacted.value(retainedRefresh)) }
+	});
+	const oldExpiry = previous !== void 0 && (response.material.refreshToken === void 0 || previous.material.refreshToken !== void 0 && Redacted.value(response.material.refreshToken) === Redacted.value(previous.material.refreshToken)) ? previous?.context.metadata.refreshExpiresAtMillis : void 0;
+	const refreshExpires = oldExpiry === void 0 ? response.refreshExpiresAtMillis : Math.min(oldExpiry, response.refreshExpiresAtMillis ?? Number.MAX_SAFE_INTEGER);
+	const refreshUseUntil = retainedRefresh === void 0 ? void 0 : Math.min(previous?.context.metadata.refreshUseUntilMillis ?? startedAtMillis + (profile.maximumRefreshLifetimeMillis ?? 0), refreshExpires ?? Number.MAX_SAFE_INTEGER);
+	const useUntil = Math.min(startedAtMillis + profile.maximumAccessLifetimeMillis, response.accessExpiresAtMillis ?? Number.MAX_SAFE_INTEGER);
+	if (useUntil <= now || refreshUseUntil !== void 0 && refreshUseUntil <= now) return yield* OAuthUnavailable.make({});
+	const metadata = yield* snapshotOAuth(OAuthConnectedTokenMetadata, {
+		scopes: response.scopes,
+		resources: response.resources,
+		useUntilMillis: useUntil,
+		obtainedAtMillis: startedAtMillis,
+		...response.accessExpiresAtMillis === void 0 ? {} : { accessExpiresAtMillis: response.accessExpiresAtMillis },
+		...retainedRefresh === void 0 || refreshExpires === void 0 ? {} : { refreshExpiresAtMillis: refreshExpires },
+		...refreshUseUntil === void 0 ? {} : { refreshUseUntilMillis: refreshUseUntil },
+		...response.profile === void 0 ? {} : { profile: response.profile }
+	});
+	return {
+		identity: response.identity,
+		metadata,
+		material
+	};
+});
+const makeOAuthConnectedAccess = (moduleId, configuration) => {
+	const ConnectedAccess = Context.Service()("effect-auth/oauth/" + moduleId.length + ":" + moduleId + "/ConnectedAccess");
+	const captured = captureConnectedPolicy(configuration);
+	return {
+		ConnectedAccess,
+		accessLayer: Layer.effect(ConnectedAccess, Effect.gen(function* () {
+			const { id, policy } = yield* validateConnectedPolicy(moduleId, captured);
+			const { authorize } = yield* OAuthConnectedUseAuthority;
+			const { inspectAccess, claimRefresh, settleRefresh, admitUse } = yield* OAuthConnectedPersistence;
+			const { refreshGrant } = yield* OAuthConnectedProtocol;
+			const { seal, open } = yield* OAuthConnectedTokenProtector;
+			const { randomBytes } = yield* Crypto.Crypto;
+			const random = Effect.fn("OAuthConnectedAccess.random")(function* () {
+				const bytes = yield* randomBytes(32).pipe(Effect.mapError(() => OAuthUnavailable.make({})));
+				const result = OAuthClaimId.make(Encoding.encodeBase64Url(bytes));
+				bytes.fill(0);
+				return result;
+			});
+			const refresh = Effect.fn("OAuthConnectedAccess.refresh")(function* (grant, authorization) {
+				const claimId = yield* random(), nextTokenVersion = SecurityRevision.make(yield* random());
+				return yield* Effect.uninterruptibleMask((restore) => Effect.gen(function* () {
+					const receipt = yield* restore(claimRefresh({
+						grant: snapshotOAuthSync(OAuthConnectedStoredGrant, grant),
+						authorization,
+						claimId,
+						nextTokenVersion,
+						lifetimeMillis: policy.refreshClaimLifetimeMillis
+					}, (value, journal) => journal.prepare(snapshotOAuthSync(OAuthConnectedRefreshDecision, value))));
+					const decision = yield* connectedRead(receipt);
+					if (decision._tag === "Busy") return yield* OAuthConnectedBusy.make({});
+					if (decision._tag === "ReauthorizationRequired") return yield* OAuthConnectedReauthorizationRequired.make({});
+					if (decision._tag !== "Claimed") return yield* OAuthRejected.make({});
+					const owned = snapshotOAuthSync(OAuthConnectedRefreshClaim, decision.claim);
+					if (owned.claimId !== claimId || owned.nextTokenVersion !== nextTokenVersion || !connectedSame(OAuthConnectedStoredGrant, owned.grant, grant) || owned.claimExpiresAtMillis !== owned.claimedAtMillis + policy.refreshClaimLifetimeMillis || owned.claimedAtMillis > DateTime.toEpochMillis(yield* DateTime.now)) return yield* OAuthUnavailable.make({});
+					const exchange = Effect.gen(function* () {
+						const material = yield* open(snapshotOAuthSync(OAuthConnectedStoredGrant, grant)).pipe(Effect.flatMap((v) => snapshotOAuth(OAuthConnectedTokenMaterial, v)));
+						return yield* Effect.gen(function* () {
+							const start = DateTime.toEpochMillis(yield* DateTime.now);
+							if (!material.refreshToken || grant.context.configuration.profile.refresh === "unsupported" || grant.context.metadata.refreshUseUntilMillis === void 0 || grant.context.metadata.refreshUseUntilMillis <= start || start >= owned.claimExpiresAtMillis) return yield* OAuthConnectedReauthorizationRequired.make({});
+							const response = yield* refreshGrant({
+								context: snapshotOAuthSync(OAuthConnectedTokenContext, grant.context),
+								material: snapshotOAuthSync(OAuthConnectedTokenMaterial, material),
+								verificationStartedAt: DateTime.makeUnsafe(start)
+							});
+							const projected = yield* connectedGrantResponse(grant.context.configuration, response, start, {
+								context: grant.context,
+								material
+							});
+							return yield* Effect.gen(function* () {
+								const context = snapshotOAuthSync(OAuthConnectedTokenContext, {
+									...grant.context,
+									tokenVersion: nextTokenVersion,
+									metadata: projected.metadata
+								});
+								const sealed = yield* seal({
+									context,
+									material: snapshotOAuthSync(OAuthConnectedTokenMaterial, projected.material)
+								});
+								const updated = snapshotOAuthSync(OAuthConnectedStoredGrant, {
+									context,
+									sealed
+								});
+								let cleanup;
+								if (context.configuration.profile.revocation === "cohort") {
+									const cleanupContext = snapshotOAuthSync(OAuthConnectedRevocationContext, {
+										namespace: "effect-auth/oauth-connected-revocation-context/v1",
+										jobId: yield* random(),
+										token: context
+									});
+									cleanup = snapshotOAuthSync(OAuthConnectedRevocationJob, {
+										context: cleanupContext,
+										sealed: yield* seal({
+											context: cleanupContext,
+											material: snapshotOAuthSync(OAuthConnectedTokenMaterial, projected.material)
+										})
+									});
+								}
+								return snapshotOAuthSync(OAuthConnectedRefreshOutcome, {
+									_tag: "Refreshed",
+									grant: updated,
+									...cleanup ? { cleanup } : {}
+								});
+							}).pipe(Effect.ensuring(Effect.sync(() => wipeConnectedMaterial(projected.material))));
+						}).pipe(Effect.ensuring(Effect.sync(() => wipeConnectedMaterial(material))));
+					});
+					const remaining = Math.max(1, owned.claimExpiresAtMillis - DateTime.toEpochMillis(yield* DateTime.now));
+					const exchanged = yield* Effect.exit(restore(connectedBounded(exchange, remaining)));
+					const outcome = Exit.isSuccess(exchanged) ? exchanged.value : { _tag: "ReauthorizationRequired" };
+					const finished = yield* Effect.exit(connectedBounded(settleRefresh({
+						claim: owned,
+						authorization,
+						outcome
+					}, (value, journal) => journal.prepare(snapshotOAuthSync(OAuthConnectedRefreshSettlement, value))), policy.settlementTimeoutMillis));
+					if (Exit.isFailure(exchanged) && Cause.hasInterrupts(exchanged.cause)) return yield* Effect.interrupt;
+					if (Exit.isFailure(finished)) return yield* OAuthUnavailable.make({});
+					const settled = yield* connectedRead(finished.value);
+					if (settled._tag !== "Refreshed") return yield* OAuthConnectedReauthorizationRequired.make({});
+					if (outcome._tag !== "Refreshed" || !connectedSame(OAuthConnectedStoredGrant, settled.grant, outcome.grant)) return yield* OAuthUnavailable.make({});
+					return snapshotOAuthSync(OAuthConnectedStoredGrant, settled.grant);
+				}));
+			});
+			const prepare = Effect.fn("OAuthConnectedAccess.prepare")(function* (invocation, raw) {
+				const caller = yield* connectedCaller(invocation);
+				const input = yield* snapshotOAuth(OAuthConnectedUse, raw);
+				const authorization = yield* connectedUseAuthorization(yield* authorize({
+					invocation: caller,
+					moduleId: id,
+					purpose: "use",
+					...input
+				}), id, caller.subjectId, "use", input.grantId, input.profileKey);
+				const inspected = yield* inspectAccess({
+					authorization,
+					...input
+				}).pipe(Effect.flatMap((v) => snapshotOAuth(OAuthConnectedAccessInspection, v)));
+				if (inspected._tag === "Busy") return yield* OAuthConnectedBusy.make({});
+				if (inspected._tag === "ReauthorizationRequired") return yield* OAuthConnectedReauthorizationRequired.make({});
+				if (inspected._tag !== "Target") return yield* OAuthRejected.make({});
+				let grant = inspected.grant;
+				if (grant.context.moduleId !== id || grant.context.subjectId !== caller.subjectId || grant.context.grantId !== input.grantId || grant.context.configuration.profile.key !== input.profileKey || !connectedProfile(policy, grant.context.configuration.profile)) return yield* OAuthRejected.make({});
+				const now = DateTime.toEpochMillis(yield* DateTime.now);
+				if (grant.context.configuration.profile.refresh !== "unsupported" && grant.context.metadata.refreshUseUntilMillis !== void 0 && grant.context.metadata.refreshUseUntilMillis > now && now + grant.context.configuration.profile.refreshAheadMillis >= grant.context.metadata.useUntilMillis) grant = yield* refresh(grant, authorization);
+				const material = yield* open(snapshotOAuthSync(OAuthConnectedStoredGrant, grant)).pipe(Effect.flatMap((v) => snapshotOAuth(OAuthConnectedTokenMaterial, v)));
+				return yield* Effect.gen(function* () {
+					yield* connectedUseAuthorization(authorization, id, caller.subjectId, "use", input.grantId, input.profileKey);
+					if (DateTime.toEpochMillis(yield* DateTime.now) >= grant.context.metadata.useUntilMillis) return yield* OAuthConnectedReauthorizationRequired.make({});
+					const admissionId = yield* random();
+					const receipt = yield* admitUse({
+						grant: snapshotOAuthSync(OAuthConnectedStoredGrant, grant),
+						authorization,
+						admissionId,
+						lifetimeMillis: policy.useAdmissionLifetimeMillis
+					}, (value, journal) => journal.prepare(snapshotOAuthSync(OAuthConnectedUseAdmission, value)));
+					const admitted = yield* connectedRead(receipt);
+					if (admitted._tag === "Busy") return yield* OAuthConnectedBusy.make({});
+					if (admitted._tag === "ReauthorizationRequired") return yield* OAuthConnectedReauthorizationRequired.make({});
+					if (admitted._tag !== "Admitted") return yield* OAuthRejected.make({});
+					if (admitted.admissionId !== admissionId || admitted.grantId !== grant.context.grantId || admitted.tokenVersion !== grant.context.tokenVersion || admitted.expiresAtMillis <= admitted.admittedAtMillis || admitted.admittedAtMillis > DateTime.toEpochMillis(yield* DateTime.now) || admitted.expiresAtMillis > Math.min(admitted.admittedAtMillis + policy.useAdmissionLifetimeMillis, grant.context.metadata.useUntilMillis, authorization.expiresAtMillis) || DateTime.toEpochMillis(yield* DateTime.now) >= admitted.expiresAtMillis) return yield* OAuthUnavailable.make({});
+					return {
+						token: Redacted.make(Redacted.value(material.accessToken)),
+						expiresAtMillis: admitted.expiresAtMillis
+					};
+				}).pipe(Effect.ensuring(Effect.sync(() => wipeConnectedMaterial(material))));
+			}, connectedSafe);
+			const withAccessToken = (invocation, input, use) => prepare(invocation, input).pipe(Effect.flatMap(({ token, expiresAtMillis }) => Effect.gen(function* () {
+				if (DateTime.toEpochMillis(yield* DateTime.now) >= expiresAtMillis) return yield* OAuthUnavailable.make({});
+				return yield* Effect.suspend(() => use(token)).pipe(Effect.interruptible);
+			}).pipe(Effect.ensuring(Effect.sync(() => Redacted.wipeUnsafe(token))))));
+			return ConnectedAccess.of({ withAccessToken });
+		}))
+	};
+};
+//#endregion
+export { OAuthConnectedAccessFailure, captureConnectedPolicy, connectedBounded, connectedCaller, connectedGrantResponse, connectedProfile, connectedRead, connectedSafe, connectedSame, connectedUseAuthorization, makeOAuthConnectedAccess, validateConnectedPolicy, wipeConnectedMaterial };
+
+//# sourceMappingURL=connectedAccess.mjs.map

package/dist/oauth/connectedAccess.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"connectedAccess.mjs","names":["M.OAuthConnectedBusy","M.OAuthConnectedReauthorizationRequired","M.OAuthConnectedPolicy","M.OAuthConnectedProfile","M.OAuthConnectedUseAuthorization","M.OAuthConnectedGrantResponse","M.OAuthConnectedScopes","M.OAuthConnectedResources","M.OAuthConnectedContinuation","M.OAuthConnectedTokenMaterial","M.OAuthConnectedTokenMetadata","M.OAuthConnectedStoredGrant","M.OAuthConnectedRefreshDecision","M.OAuthConnectedRefreshClaim","M.OAuthConnectedTokenContext","M.OAuthConnectedRevocationContext","M.OAuthConnectedRevocationJob","M.OAuthConnectedRefreshOutcome","M.OAuthConnectedRefreshSettlement","M.OAuthConnectedUse","M.OAuthConnectedAccessInspection","M.OAuthConnectedUseAdmission"],"sources":["../../src/oauth/connectedAccess.ts"],"sourcesContent":["import {\n  Cause,\n  Context,\n  Crypto,\n  DateTime,\n  Effect,\n  Encoding,\n  Exit,\n  Fiber,\n  Layer,\n  Redacted,\n  Schema,\n} from \"effect\";\n\nimport { hasCommitScope, type PreparedCommit } from \"../hooks/commit\";\nimport { reportAuthFailure } from \"../internal/diagnostics\";\nimport {\n  AuthenticationAssurance,\n  AssuranceEvidence,\n  requireAuthenticated,\n  type AuthInvocation,\n} from \"../operations/context\";\nimport { AuthenticationRequired } from \"../operations/errors\";\nimport { SecurityRevision } from \"../sessions/models\";\nimport * as M from \"./connectedModels\";\nimport { OAuthConnectedPersistence } from \"./OAuthConnectedPersistence\";\nimport { OAuthConnectedProtocol } from \"./OAuthConnectedProtocol\";\nimport { OAuthConnectedTokenProtector } from \"./OAuthConnectedTokenProtector\";\nimport { OAuthConnectedUseAuthority } from \"./OAuthConnectedUseAuthority\";\nimport {\n  OAuthConfigurationError,\n  OAuthMethodUnsupported,\n  OAuthRejected,\n  OAuthUnavailable,\n} from \"./signInErrors\";\nimport { OAuthClaimId, OAuthExternalIdentity, OAuthModuleId } from \"./signInModels\";\nimport { snapshotOAuth, snapshotOAuthSync } from \"./signInSnapshot\";\n\nexport const OAuthConnectedAccessFailure = Schema.Union([\n  AuthenticationRequired,\n  OAuthRejected,\n  OAuthUnavailable,\n  OAuthMethodUnsupported,\n  M.OAuthConnectedBusy,\n  M.OAuthConnectedReauthorizationRequired,\n]);\n\nexport type OAuthConnectedAccessFailure = typeof OAuthConnectedAccessFailure.Type;\n\nconst invocationSchema = Schema.TaggedStruct(\"Authenticated\", {\n  subjectId: M.OAuthConnectedTokenContext.fields.subjectId,\n  sessionId: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256))),\n  assurance: Schema.Struct({\n    ...AuthenticationAssurance.fields,\n    method: Schema.NonEmptyString.check(Schema.isMaxLength(128)),\n    factors: AuthenticationAssurance.fields.factors.check(Schema.isMaxLength(8)),\n    evidence: Schema.optionalKey(\n      Schema.NonEmptyArray(\n        Schema.Struct({\n          ...AssuranceEvidence.fields,\n          method: Schema.NonEmptyString.check(Schema.isMaxLength(128)),\n          factors: AssuranceEvidence.fields.factors.check(Schema.isMaxLength(8)),\n        }),\n      ).check(Schema.isMaxLength(64)),\n    ),\n  }),\n});\n\nexport const connectedCaller = Effect.fn(\"OAuthConnected.caller\")(function* (\n  invocation: AuthInvocation,\n) {\n  if (yield* hasCommitScope) return yield* OAuthMethodUnsupported.make({});\n\n  return yield* snapshotOAuth(invocationSchema, yield* requireAuthenticated(invocation));\n});\n\nexport const connectedRead = <A>(receipt: PreparedCommit<A>) =>\n  receipt.read.pipe(Effect.mapError(() => OAuthUnavailable.make({})));\n\nexport const connectedSafe = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n  effect.pipe(\n    Effect.tapCause((cause) =>\n      Cause.hasDies(cause) ? reportAuthFailure(\"oauth-connected\", cause) : Effect.void,\n    ),\n    Effect.catchCause((cause): Effect.Effect<never, E | OAuthUnavailable> =>\n      Cause.hasInterrupts(cause)\n        ? Effect.interrupt\n        : Cause.hasDies(cause)\n          ? Effect.fail(OAuthUnavailable.make({}))\n          : Effect.failCause(cause),\n    ),\n  );\n\nexport const connectedBounded = <A, E, R>(effect: Effect.Effect<A, E, R>, millis: number) =>\n  Effect.gen(function* () {\n    const fiber = yield* effect.pipe(Effect.interruptible, Effect.forkDetach);\n\n    return yield* Fiber.join(fiber).pipe(\n      Effect.timeout(millis),\n      Effect.ensuring(Fiber.interrupt(fiber).pipe(Effect.forkDetach, Effect.asVoid)),\n    );\n  });\n\nexport const connectedSame = <A>(schema: Schema.Codec<A, unknown, never, never>, a: A, b: A) =>\n  Schema.encodeSync(Schema.fromJsonString(schema))(a) ===\n  Schema.encodeSync(Schema.fromJsonString(schema))(b);\n\nexport const captureConnectedPolicy = (input: M.OAuthConnectedPolicy) => {\n  try {\n    return snapshotOAuthSync(M.OAuthConnectedPolicy, input);\n  } catch {\n    return undefined;\n  }\n};\n\nexport const validateConnectedPolicy = Effect.fn(\"OAuthConnected.policy\")(function* (\n  moduleId: string,\n  captured: M.OAuthConnectedPolicy | undefined,\n) {\n  const id = yield* Schema.decodeEffect(OAuthModuleId)(moduleId).pipe(\n    Effect.mapError(() => OAuthConfigurationError.make({ reason: \"module\" })),\n  );\n\n  if (!captured) return yield* OAuthConfigurationError.make({ reason: \"policy\" });\n\n  const seen = new Set<string>(),\n    active = new Set<string>();\n\n  for (const profile of captured.profiles) {\n    const key = profile.key + \":\" + profile.generation;\n\n    if (\n      seen.has(key) ||\n      (profile.issuance === \"active\" && active.has(profile.key)) ||\n      new Set(profile.scopes).size !== profile.scopes.length ||\n      new Set(profile.resources).size !== profile.resources.length ||\n      profile.refreshAheadMillis >= profile.maximumAccessLifetimeMillis ||\n      (profile.retention === \"access-and-refresh\" &&\n        (profile.maximumRefreshLifetimeMillis === undefined ||\n          profile.refresh === \"unsupported\")) ||\n      (profile.retention === \"access-only\" && profile.refresh !== \"unsupported\")\n    )\n      return yield* OAuthConfigurationError.make({ reason: \"policy\" });\n    seen.add(key);\n    if (profile.issuance === \"active\") active.add(profile.key);\n  }\n  if (active.size === 0) return yield* OAuthConfigurationError.make({ reason: \"policy\" });\n\n  return { id, policy: captured };\n});\n\nexport const connectedProfile = (\n  policy: M.OAuthConnectedPolicy,\n  input: M.OAuthConnectedProfile,\n) => {\n  const current = policy.profiles.find((p) => p.key === input.key && p.issuance === \"active\");\n\n  return (\n    current !== undefined &&\n    connectedSame(M.OAuthConnectedProfile, current, { ...input, issuance: \"active\" })\n  );\n};\n\nexport const connectedUseAuthorization = Effect.fn(\"OAuthConnected.useAuthorization\")(function* (\n  value: M.OAuthConnectedUseAuthorization,\n  moduleId: typeof OAuthModuleId.Type,\n  subjectId: typeof M.OAuthConnectedTokenContext.Type.subjectId,\n  purpose: \"metadata\" | \"use\",\n  grantId?: typeof M.OAuthGrantId.Type,\n  profileKey?: typeof M.OAuthPermissionProfileKey.Type,\n) {\n  const authorization = yield* snapshotOAuth(M.OAuthConnectedUseAuthorization, value);\n  const now = DateTime.toEpochMillis(yield* DateTime.now);\n\n  if (\n    authorization.moduleId !== moduleId ||\n    authorization.revision.subjectId !== subjectId ||\n    authorization.purpose !== purpose ||\n    authorization.grantId !== grantId ||\n    authorization.profileKey !== profileKey ||\n    authorization.expiresAtMillis <= now ||\n    new Set(authorization.revision.credentials.map((v) => v.credentialId)).size !==\n      authorization.revision.credentials.length\n  )\n    return yield* OAuthUnavailable.make({});\n\n  return authorization;\n});\n\nexport const wipeConnectedMaterial = (material: M.OAuthConnectedTokenMaterial) => {\n  Redacted.wipeUnsafe(material.accessToken);\n  if (material.refreshToken) Redacted.wipeUnsafe(material.refreshToken);\n  if (material.continuation._tag === \"Oidc\" && material.continuation.nonce)\n    Redacted.wipeUnsafe(material.continuation.nonce);\n};\n\n/** Private bounded projection shared by initial and refresh orchestration. */\nexport const connectedGrantResponse = Effect.fn(\"OAuthConnected.grantResponse\")(function* (\n  configuration: M.OAuthConnectedConfiguration,\n  raw: M.OAuthConnectedGrantResponse,\n  startedAtMillis: number,\n  previous?: {\n    readonly context: M.OAuthConnectedTokenContext;\n    readonly material: M.OAuthConnectedTokenMaterial;\n  },\n) {\n  const response = yield* snapshotOAuth(M.OAuthConnectedGrantResponse, raw);\n  const now = DateTime.toEpochMillis(yield* DateTime.now);\n  const profile = configuration.profile;\n\n  if (\n    response.identity.provider !== configuration.provider ||\n    response.identity.issuer !== configuration.issuer ||\n    (configuration.protocol === \"oidc\") !== (response.material.continuation._tag === \"Oidc\") ||\n    new Set(response.scopes).size !== response.scopes.length ||\n    new Set(response.resources).size !== response.resources.length ||\n    !connectedSame(\n      M.OAuthConnectedScopes,\n      [...response.scopes].sort(),\n      [...profile.scopes].sort(),\n    ) ||\n    !connectedSame(\n      M.OAuthConnectedResources,\n      [...response.resources].sort(),\n      [...profile.resources].sort(),\n    ) ||\n    (response.accessExpiresAtMillis !== undefined && response.accessExpiresAtMillis <= now) ||\n    startedAtMillis > now ||\n    startedAtMillis < 0\n  )\n    return yield* OAuthUnavailable.make({});\n  if (\n    previous &&\n    (!connectedSame(OAuthExternalIdentity, response.identity, previous.context.identity) ||\n      !connectedSame(\n        M.OAuthConnectedContinuation,\n        response.material.continuation,\n        previous.material.continuation,\n      ))\n  )\n    return yield* OAuthUnavailable.make({});\n\n  const retainedRefresh =\n    profile.retention === \"access-and-refresh\"\n      ? (response.material.refreshToken ?? previous?.material.refreshToken)\n      : undefined;\n\n  const material = snapshotOAuthSync(M.OAuthConnectedTokenMaterial, {\n    namespace: response.material.namespace,\n    accessToken: response.material.accessToken,\n    continuation: response.material.continuation,\n    ...(retainedRefresh === undefined\n      ? {}\n      : { refreshToken: Redacted.make(Redacted.value(retainedRefresh)) }),\n  });\n\n  const oldRefreshRetained =\n    previous !== undefined &&\n    (response.material.refreshToken === undefined ||\n      (previous.material.refreshToken !== undefined &&\n        Redacted.value(response.material.refreshToken) ===\n          Redacted.value(previous.material.refreshToken)));\n\n  const oldExpiry = oldRefreshRetained\n    ? previous?.context.metadata.refreshExpiresAtMillis\n    : undefined;\n\n  const refreshExpires =\n    oldExpiry === undefined\n      ? response.refreshExpiresAtMillis\n      : Math.min(oldExpiry, response.refreshExpiresAtMillis ?? Number.MAX_SAFE_INTEGER);\n\n  const refreshUseUntil =\n    retainedRefresh === undefined\n      ? undefined\n      : Math.min(\n          previous?.context.metadata.refreshUseUntilMillis ??\n            startedAtMillis + (profile.maximumRefreshLifetimeMillis ?? 0),\n          refreshExpires ?? Number.MAX_SAFE_INTEGER,\n        );\n\n  const useUntil = Math.min(\n    startedAtMillis + profile.maximumAccessLifetimeMillis,\n    response.accessExpiresAtMillis ?? Number.MAX_SAFE_INTEGER,\n  );\n\n  if (useUntil <= now || (refreshUseUntil !== undefined && refreshUseUntil <= now))\n    return yield* OAuthUnavailable.make({});\n\n  const metadata = yield* snapshotOAuth(M.OAuthConnectedTokenMetadata, {\n    scopes: response.scopes,\n    resources: response.resources,\n    useUntilMillis: useUntil,\n    obtainedAtMillis: startedAtMillis,\n    ...(response.accessExpiresAtMillis === undefined\n      ? {}\n      : { accessExpiresAtMillis: response.accessExpiresAtMillis }),\n    ...(retainedRefresh === undefined || refreshExpires === undefined\n      ? {}\n      : { refreshExpiresAtMillis: refreshExpires }),\n    ...(refreshUseUntil === undefined ? {} : { refreshUseUntilMillis: refreshUseUntil }),\n    ...(response.profile === undefined ? {} : { profile: response.profile }),\n  });\n\n  return { identity: response.identity, metadata, material };\n});\n\nexport interface AccessModule<Id extends string> {\n  readonly moduleId: Id;\n  readonly kind: \"oauth-connected-access\";\n}\n\nexport const makeOAuthConnectedAccess = <const Id extends string>(\n  moduleId: Id,\n  configuration: M.OAuthConnectedPolicy,\n) => {\n  const ConnectedAccess = Context.Service<\n    AccessModule<Id>,\n    {\n      readonly withAccessToken: <A, E, R>(\n        invocation: AuthInvocation,\n        input: typeof M.OAuthConnectedUse.Type,\n        use: (accessToken: Redacted.Redacted<string>) => Effect.Effect<A, E, R>,\n      ) => Effect.Effect<A, E | OAuthConnectedAccessFailure, R>;\n    }\n  >()(\"effect-auth/oauth/\" + moduleId.length + \":\" + moduleId + \"/ConnectedAccess\");\n\n  const captured = captureConnectedPolicy(configuration);\n\n  const accessLayer = Layer.effect(\n    ConnectedAccess,\n    Effect.gen(function* () {\n      const { id, policy } = yield* validateConnectedPolicy(moduleId, captured);\n      const { authorize } = yield* OAuthConnectedUseAuthority;\n\n      const { inspectAccess, claimRefresh, settleRefresh, admitUse } =\n        yield* OAuthConnectedPersistence;\n\n      const { refreshGrant } = yield* OAuthConnectedProtocol;\n      const { seal, open } = yield* OAuthConnectedTokenProtector;\n      const { randomBytes } = yield* Crypto.Crypto;\n\n      const random = Effect.fn(\"OAuthConnectedAccess.random\")(function* () {\n        const bytes = yield* randomBytes(32).pipe(Effect.mapError(() => OAuthUnavailable.make({})));\n        const result = OAuthClaimId.make(Encoding.encodeBase64Url(bytes));\n\n        bytes.fill(0);\n\n        return result;\n      });\n\n      const refresh = Effect.fn(\"OAuthConnectedAccess.refresh\")(function* (\n        grant: M.OAuthConnectedStoredGrant,\n        authorization: M.OAuthConnectedUseAuthorization,\n      ) {\n        const claimId = yield* random(),\n          nextTokenVersion = SecurityRevision.make(yield* random());\n\n        return yield* Effect.uninterruptibleMask((restore) =>\n          Effect.gen(function* () {\n            const receipt = yield* restore(\n              claimRefresh(\n                {\n                  grant: snapshotOAuthSync(M.OAuthConnectedStoredGrant, grant),\n                  authorization,\n                  claimId,\n                  nextTokenVersion,\n                  lifetimeMillis: policy.refreshClaimLifetimeMillis,\n                },\n                (value, journal) =>\n                  journal.prepare(snapshotOAuthSync(M.OAuthConnectedRefreshDecision, value)),\n              ),\n            );\n\n            const decision = yield* connectedRead(receipt);\n\n            if (decision._tag === \"Busy\") return yield* M.OAuthConnectedBusy.make({});\n            if (decision._tag === \"ReauthorizationRequired\")\n              return yield* M.OAuthConnectedReauthorizationRequired.make({});\n            if (decision._tag !== \"Claimed\") return yield* OAuthRejected.make({});\n            const owned = snapshotOAuthSync(M.OAuthConnectedRefreshClaim, decision.claim);\n\n            if (\n              owned.claimId !== claimId ||\n              owned.nextTokenVersion !== nextTokenVersion ||\n              !connectedSame(M.OAuthConnectedStoredGrant, owned.grant, grant) ||\n              owned.claimExpiresAtMillis !==\n                owned.claimedAtMillis + policy.refreshClaimLifetimeMillis ||\n              owned.claimedAtMillis > DateTime.toEpochMillis(yield* DateTime.now)\n            )\n              return yield* OAuthUnavailable.make({});\n\n            const exchange = Effect.gen(function* () {\n              const material = yield* open(\n                snapshotOAuthSync(M.OAuthConnectedStoredGrant, grant),\n              ).pipe(Effect.flatMap((v) => snapshotOAuth(M.OAuthConnectedTokenMaterial, v)));\n\n              return yield* Effect.gen(function* () {\n                const start = DateTime.toEpochMillis(yield* DateTime.now);\n\n                if (\n                  !material.refreshToken ||\n                  grant.context.configuration.profile.refresh === \"unsupported\" ||\n                  grant.context.metadata.refreshUseUntilMillis === undefined ||\n                  grant.context.metadata.refreshUseUntilMillis <= start ||\n                  start >= owned.claimExpiresAtMillis\n                )\n                  return yield* M.OAuthConnectedReauthorizationRequired.make({});\n\n                const response = yield* refreshGrant({\n                  context: snapshotOAuthSync(M.OAuthConnectedTokenContext, grant.context),\n                  material: snapshotOAuthSync(M.OAuthConnectedTokenMaterial, material),\n                  verificationStartedAt: DateTime.makeUnsafe(start),\n                });\n\n                const projected = yield* connectedGrantResponse(\n                  grant.context.configuration,\n                  response,\n                  start,\n                  { context: grant.context, material },\n                );\n\n                return yield* Effect.gen(function* () {\n                  const context = snapshotOAuthSync(M.OAuthConnectedTokenContext, {\n                    ...grant.context,\n                    tokenVersion: nextTokenVersion,\n                    metadata: projected.metadata,\n                  });\n\n                  const sealed = yield* seal({\n                    context,\n                    material: snapshotOAuthSync(M.OAuthConnectedTokenMaterial, projected.material),\n                  });\n\n                  const updated = snapshotOAuthSync(M.OAuthConnectedStoredGrant, {\n                    context,\n                    sealed,\n                  });\n\n                  let cleanup: M.OAuthConnectedRevocationJob | undefined;\n\n                  if (context.configuration.profile.revocation === \"cohort\") {\n                    const cleanupContext = snapshotOAuthSync(M.OAuthConnectedRevocationContext, {\n                      namespace: \"effect-auth/oauth-connected-revocation-context/v1\",\n                      jobId: yield* random(),\n                      token: context,\n                    });\n\n                    cleanup = snapshotOAuthSync(M.OAuthConnectedRevocationJob, {\n                      context: cleanupContext,\n                      sealed: yield* seal({\n                        context: cleanupContext,\n                        material: snapshotOAuthSync(\n                          M.OAuthConnectedTokenMaterial,\n                          projected.material,\n                        ),\n                      }),\n                    });\n                  }\n\n                  return snapshotOAuthSync(M.OAuthConnectedRefreshOutcome, {\n                    _tag: \"Refreshed\",\n                    grant: updated,\n                    ...(cleanup ? { cleanup } : {}),\n                  });\n                }).pipe(\n                  Effect.ensuring(Effect.sync(() => wipeConnectedMaterial(projected.material))),\n                );\n              }).pipe(Effect.ensuring(Effect.sync(() => wipeConnectedMaterial(material))));\n            });\n\n            const remaining = Math.max(\n              1,\n              owned.claimExpiresAtMillis - DateTime.toEpochMillis(yield* DateTime.now),\n            );\n\n            const exchanged = yield* Effect.exit(restore(connectedBounded(exchange, remaining)));\n\n            const outcome: M.OAuthConnectedRefreshOutcome = Exit.isSuccess(exchanged)\n              ? exchanged.value\n              : { _tag: \"ReauthorizationRequired\" };\n\n            const finished = yield* Effect.exit(\n              connectedBounded(\n                settleRefresh(\n                  {\n                    claim: owned,\n                    authorization,\n                    outcome,\n                  },\n                  (value, journal) =>\n                    journal.prepare(snapshotOAuthSync(M.OAuthConnectedRefreshSettlement, value)),\n                ),\n                policy.settlementTimeoutMillis,\n              ),\n            );\n\n            if (Exit.isFailure(exchanged) && Cause.hasInterrupts(exchanged.cause))\n              return yield* Effect.interrupt;\n            if (Exit.isFailure(finished)) return yield* OAuthUnavailable.make({});\n            const settled = yield* connectedRead(finished.value);\n\n            if (settled._tag !== \"Refreshed\")\n              return yield* M.OAuthConnectedReauthorizationRequired.make({});\n            if (\n              outcome._tag !== \"Refreshed\" ||\n              !connectedSame(M.OAuthConnectedStoredGrant, settled.grant, outcome.grant)\n            )\n              return yield* OAuthUnavailable.make({});\n\n            return snapshotOAuthSync(M.OAuthConnectedStoredGrant, settled.grant);\n          }),\n        );\n      });\n\n      const prepare = Effect.fn(\"OAuthConnectedAccess.prepare\")(function* (\n        invocation: AuthInvocation,\n        raw: typeof M.OAuthConnectedUse.Type,\n      ) {\n        const caller = yield* connectedCaller(invocation);\n        const input = yield* snapshotOAuth(M.OAuthConnectedUse, raw);\n\n        const authorization = yield* connectedUseAuthorization(\n          yield* authorize({\n            invocation: caller,\n            moduleId: id,\n            purpose: \"use\",\n            ...input,\n          }),\n          id,\n          caller.subjectId,\n          \"use\",\n          input.grantId,\n          input.profileKey,\n        );\n\n        const inspected = yield* inspectAccess({ authorization, ...input }).pipe(\n          Effect.flatMap((v) => snapshotOAuth(M.OAuthConnectedAccessInspection, v)),\n        );\n\n        if (inspected._tag === \"Busy\") return yield* M.OAuthConnectedBusy.make({});\n        if (inspected._tag === \"ReauthorizationRequired\")\n          return yield* M.OAuthConnectedReauthorizationRequired.make({});\n        if (inspected._tag !== \"Target\") return yield* OAuthRejected.make({});\n        let grant = inspected.grant;\n\n        if (\n          grant.context.moduleId !== id ||\n          grant.context.subjectId !== caller.subjectId ||\n          grant.context.grantId !== input.grantId ||\n          grant.context.configuration.profile.key !== input.profileKey ||\n          !connectedProfile(policy, grant.context.configuration.profile)\n        )\n          return yield* OAuthRejected.make({});\n        const now = DateTime.toEpochMillis(yield* DateTime.now);\n\n        if (\n          grant.context.configuration.profile.refresh !== \"unsupported\" &&\n          grant.context.metadata.refreshUseUntilMillis !== undefined &&\n          grant.context.metadata.refreshUseUntilMillis > now &&\n          now + grant.context.configuration.profile.refreshAheadMillis >=\n            grant.context.metadata.useUntilMillis\n        )\n          grant = yield* refresh(grant, authorization);\n\n        const material = yield* open(snapshotOAuthSync(M.OAuthConnectedStoredGrant, grant)).pipe(\n          Effect.flatMap((v) => snapshotOAuth(M.OAuthConnectedTokenMaterial, v)),\n        );\n\n        return yield* Effect.gen(function* () {\n          yield* connectedUseAuthorization(\n            authorization,\n            id,\n            caller.subjectId,\n            \"use\",\n            input.grantId,\n            input.profileKey,\n          );\n          if (DateTime.toEpochMillis(yield* DateTime.now) >= grant.context.metadata.useUntilMillis)\n            return yield* M.OAuthConnectedReauthorizationRequired.make({});\n          const admissionId = yield* random();\n\n          const receipt = yield* admitUse(\n            {\n              grant: snapshotOAuthSync(M.OAuthConnectedStoredGrant, grant),\n              authorization,\n              admissionId,\n              lifetimeMillis: policy.useAdmissionLifetimeMillis,\n            },\n            (value, journal) =>\n              journal.prepare(snapshotOAuthSync(M.OAuthConnectedUseAdmission, value)),\n          );\n\n          const admitted = yield* connectedRead(receipt);\n\n          if (admitted._tag === \"Busy\") return yield* M.OAuthConnectedBusy.make({});\n          if (admitted._tag === \"ReauthorizationRequired\")\n            return yield* M.OAuthConnectedReauthorizationRequired.make({});\n          if (admitted._tag !== \"Admitted\") return yield* OAuthRejected.make({});\n          if (\n            admitted.admissionId !== admissionId ||\n            admitted.grantId !== grant.context.grantId ||\n            admitted.tokenVersion !== grant.context.tokenVersion ||\n            admitted.expiresAtMillis <= admitted.admittedAtMillis ||\n            admitted.admittedAtMillis > DateTime.toEpochMillis(yield* DateTime.now) ||\n            admitted.expiresAtMillis >\n              Math.min(\n                admitted.admittedAtMillis + policy.useAdmissionLifetimeMillis,\n                grant.context.metadata.useUntilMillis,\n                authorization.expiresAtMillis,\n              ) ||\n            DateTime.toEpochMillis(yield* DateTime.now) >= admitted.expiresAtMillis\n          )\n            return yield* OAuthUnavailable.make({});\n\n          return {\n            token: Redacted.make(Redacted.value(material.accessToken)),\n            expiresAtMillis: admitted.expiresAtMillis,\n          };\n        }).pipe(Effect.ensuring(Effect.sync(() => wipeConnectedMaterial(material))));\n      }, connectedSafe);\n\n      const withAccessToken = <A, E, R>(\n        invocation: AuthInvocation,\n        input: typeof M.OAuthConnectedUse.Type,\n        use: (token: Redacted.Redacted<string>) => Effect.Effect<A, E, R>,\n      ): Effect.Effect<A, E | OAuthConnectedAccessFailure, R> =>\n        prepare(invocation, input).pipe(\n          Effect.flatMap(({ token, expiresAtMillis }) =>\n            Effect.gen(function* () {\n              if (DateTime.toEpochMillis(yield* DateTime.now) >= expiresAtMillis)\n                return yield* OAuthUnavailable.make({});\n\n              return yield* Effect.suspend(() => use(token)).pipe(Effect.interruptible);\n            }).pipe(Effect.ensuring(Effect.sync(() => Redacted.wipeUnsafe(token)))),\n          ),\n        );\n\n      return ConnectedAccess.of({ withAccessToken });\n    }),\n  );\n\n  return { ConnectedAccess, accessLayer };\n};\n"],"mappings":";;;;;;;;;;;;;;;AAsCA,MAAa,8BAA8B,OAAO,MAAM;CACtD;CACA;CACA;CACA;CACAA;CACAC;AACF,CAAC;AAID,MAAM,mBAAmB,OAAO,aAAa,iBAAiB;CAC5D,WAAA,2BAAwC,OAAO;CAC/C,WAAW,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC;CAC1E,WAAW,OAAO,OAAO;EACvB,GAAG,wBAAwB;EAC3B,QAAQ,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;EAC3D,SAAS,wBAAwB,OAAO,QAAQ,MAAM,OAAO,YAAY,CAAC,CAAC;EAC3E,UAAU,OAAO,YACf,OAAO,cACL,OAAO,OAAO;GACZ,GAAG,kBAAkB;GACrB,QAAQ,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;GAC3D,SAAS,kBAAkB,OAAO,QAAQ,MAAM,OAAO,YAAY,CAAC,CAAC;EACvE,CAAC,CACH,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC,CAChC;CACF,CAAC;AACH,CAAC;AAED,MAAa,kBAAkB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAChE,YACA;CACA,IAAI,OAAO,gBAAgB,OAAO,OAAO,uBAAuB,KAAK,CAAC,CAAC;CAEvE,OAAO,OAAO,cAAc,kBAAkB,OAAO,qBAAqB,UAAU,CAAC;AACvF,CAAC;AAED,MAAa,iBAAoB,YAC/B,QAAQ,KAAK,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;AAEpE,MAAa,iBAA0B,WACrC,OAAO,KACL,OAAO,UAAU,UACf,MAAM,QAAQ,KAAK,IAAI,kBAAkB,mBAAmB,KAAK,IAAI,OAAO,IAC9E,GACA,OAAO,YAAY,UACjB,MAAM,cAAc,KAAK,IACrB,OAAO,YACP,MAAM,QAAQ,KAAK,IACjB,OAAO,KAAK,iBAAiB,KAAK,CAAC,CAAC,CAAC,IACrC,OAAO,UAAU,KAAK,CAC9B,CACF;AAEF,MAAa,oBAA6B,QAAgC,WACxE,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,OAAO,OAAO,KAAK,OAAO,eAAe,OAAO,UAAU;CAExE,OAAO,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,KAC9B,OAAO,QAAQ,MAAM,GACrB,OAAO,SAAS,MAAM,UAAU,KAAK,CAAC,CAAC,KAAK,OAAO,YAAY,OAAO,MAAM,CAAC,CAC/E;AACF,CAAC;AAEH,MAAa,iBAAoB,QAAgD,GAAM,MACrF,OAAO,WAAW,OAAO,eAAe,MAAM,CAAC,CAAC,CAAC,CAAC,MAClD,OAAO,WAAW,OAAO,eAAe,MAAM,CAAC,CAAC,CAAC,CAAC;AAEpD,MAAa,0BAA0B,UAAkC;CACvE,IAAI;EACF,OAAO,kBAAkBC,sBAAwB,KAAK;CACxD,QAAQ;EACN;CACF;AACF;AAEA,MAAa,0BAA0B,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACxE,UACA,UACA;CACA,MAAM,KAAK,OAAO,OAAO,aAAa,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAC,KAC7D,OAAO,eAAe,wBAAwB,KAAK,EAAE,QAAQ,SAAS,CAAC,CAAC,CAC1E;CAEA,IAAI,CAAC,UAAU,OAAO,OAAO,wBAAwB,KAAK,EAAE,QAAQ,SAAS,CAAC;CAE9E,MAAM,uBAAO,IAAI,IAAY,GAC3B,yBAAS,IAAI,IAAY;CAE3B,KAAK,MAAM,WAAW,SAAS,UAAU;EACvC,MAAM,MAAM,QAAQ,MAAM,MAAM,QAAQ;EAExC,IACE,KAAK,IAAI,GAAG,KACX,QAAQ,aAAa,YAAY,OAAO,IAAI,QAAQ,GAAG,KACxD,IAAI,IAAI,QAAQ,MAAM,CAAC,CAAC,SAAS,QAAQ,OAAO,UAChD,IAAI,IAAI,QAAQ,SAAS,CAAC,CAAC,SAAS,QAAQ,UAAU,UACtD,QAAQ,sBAAsB,QAAQ,+BACrC,QAAQ,cAAc,yBACpB,QAAQ,iCAAiC,KAAA,KACxC,QAAQ,YAAY,kBACvB,QAAQ,cAAc,iBAAiB,QAAQ,YAAY,eAE5D,OAAO,OAAO,wBAAwB,KAAK,EAAE,QAAQ,SAAS,CAAC;EACjE,KAAK,IAAI,GAAG;EACZ,IAAI,QAAQ,aAAa,UAAU,OAAO,IAAI,QAAQ,GAAG;CAC3D;CACA,IAAI,OAAO,SAAS,GAAG,OAAO,OAAO,wBAAwB,KAAK,EAAE,QAAQ,SAAS,CAAC;CAEtF,OAAO;EAAE;EAAI,QAAQ;CAAS;AAChC,CAAC;AAED,MAAa,oBACX,QACA,UACG;CACH,MAAM,UAAU,OAAO,SAAS,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,EAAE,aAAa,QAAQ;CAE1F,OACE,YAAY,KAAA,KACZ,cAAcC,uBAAyB,SAAS;EAAE,GAAG;EAAO,UAAU;CAAS,CAAC;AAEpF;AAEA,MAAa,4BAA4B,OAAO,GAAG,iCAAiC,CAAC,CAAC,WACpF,OACA,UACA,WACA,SACA,SACA,YACA;CACA,MAAM,gBAAgB,OAAO,cAAcC,gCAAkC,KAAK;CAClF,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;CAEtD,IACE,cAAc,aAAa,YAC3B,cAAc,SAAS,cAAc,aACrC,cAAc,YAAY,WAC1B,cAAc,YAAY,WAC1B,cAAc,eAAe,cAC7B,cAAc,mBAAmB,OACjC,IAAI,IAAI,cAAc,SAAS,YAAY,KAAK,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,SACrE,cAAc,SAAS,YAAY,QAErC,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;CAExC,OAAO;AACT,CAAC;AAED,MAAa,yBAAyB,aAA4C;CAChF,SAAS,WAAW,SAAS,WAAW;CACxC,IAAI,SAAS,cAAc,SAAS,WAAW,SAAS,YAAY;CACpE,IAAI,SAAS,aAAa,SAAS,UAAU,SAAS,aAAa,OACjE,SAAS,WAAW,SAAS,aAAa,KAAK;AACnD;;AAGA,MAAa,yBAAyB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAC9E,eACA,KACA,iBACA,UAIA;CACA,MAAM,WAAW,OAAO,cAAcC,6BAA+B,GAAG;CACxE,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;CACtD,MAAM,UAAU,cAAc;CAE9B,IACE,SAAS,SAAS,aAAa,cAAc,YAC7C,SAAS,SAAS,WAAW,cAAc,UAC1C,cAAc,aAAa,YAAa,SAAS,SAAS,aAAa,SAAS,WACjF,IAAI,IAAI,SAAS,MAAM,CAAC,CAAC,SAAS,SAAS,OAAO,UAClD,IAAI,IAAI,SAAS,SAAS,CAAC,CAAC,SAAS,SAAS,UAAU,UACxD,CAAC,cACCC,sBACA,CAAC,GAAG,SAAS,MAAM,CAAC,CAAC,KAAK,GAC1B,CAAC,GAAG,QAAQ,MAAM,CAAC,CAAC,KAAK,CAC3B,KACA,CAAC,cACCC,yBACA,CAAC,GAAG,SAAS,SAAS,CAAC,CAAC,KAAK,GAC7B,CAAC,GAAG,QAAQ,SAAS,CAAC,CAAC,KAAK,CAC9B,KACC,SAAS,0BAA0B,KAAA,KAAa,SAAS,yBAAyB,OACnF,kBAAkB,OAClB,kBAAkB,GAElB,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;CACxC,IACE,aACC,CAAC,cAAc,uBAAuB,SAAS,UAAU,SAAS,QAAQ,QAAQ,KACjF,CAAC,cACCC,4BACA,SAAS,SAAS,cAClB,SAAS,SAAS,YACpB,IAEF,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;CAExC,MAAM,kBACJ,QAAQ,cAAc,uBACjB,SAAS,SAAS,gBAAgB,UAAU,SAAS,eACtD,KAAA;CAEN,MAAM,WAAW,kBAAkBC,6BAA+B;EAChE,WAAW,SAAS,SAAS;EAC7B,aAAa,SAAS,SAAS;EAC/B,cAAc,SAAS,SAAS;EAChC,GAAI,oBAAoB,KAAA,IACpB,CAAC,IACD,EAAE,cAAc,SAAS,KAAK,SAAS,MAAM,eAAe,CAAC,EAAE;CACrE,CAAC;CASD,MAAM,YANJ,aAAa,KAAA,MACZ,SAAS,SAAS,iBAAiB,KAAA,KACjC,SAAS,SAAS,iBAAiB,KAAA,KAClC,SAAS,MAAM,SAAS,SAAS,YAAY,MAC3C,SAAS,MAAM,SAAS,SAAS,YAAY,KAGjD,UAAU,QAAQ,SAAS,yBAC3B,KAAA;CAEJ,MAAM,iBACJ,cAAc,KAAA,IACV,SAAS,yBACT,KAAK,IAAI,WAAW,SAAS,0BAA0B,OAAO,gBAAgB;CAEpF,MAAM,kBACJ,oBAAoB,KAAA,IAChB,KAAA,IACA,KAAK,IACH,UAAU,QAAQ,SAAS,yBACzB,mBAAmB,QAAQ,gCAAgC,IAC7D,kBAAkB,OAAO,gBAC3B;CAEN,MAAM,WAAW,KAAK,IACpB,kBAAkB,QAAQ,6BAC1B,SAAS,yBAAyB,OAAO,gBAC3C;CAEA,IAAI,YAAY,OAAQ,oBAAoB,KAAA,KAAa,mBAAmB,KAC1E,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;CAExC,MAAM,WAAW,OAAO,cAAcC,6BAA+B;EACnE,QAAQ,SAAS;EACjB,WAAW,SAAS;EACpB,gBAAgB;EAChB,kBAAkB;EAClB,GAAI,SAAS,0BAA0B,KAAA,IACnC,CAAC,IACD,EAAE,uBAAuB,SAAS,sBAAsB;EAC5D,GAAI,oBAAoB,KAAA,KAAa,mBAAmB,KAAA,IACpD,CAAC,IACD,EAAE,wBAAwB,eAAe;EAC7C,GAAI,oBAAoB,KAAA,IAAY,CAAC,IAAI,EAAE,uBAAuB,gBAAgB;EAClF,GAAI,SAAS,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,SAAS,QAAQ;CACxE,CAAC;CAED,OAAO;EAAE,UAAU,SAAS;EAAU;EAAU;CAAS;AAC3D,CAAC;AAOD,MAAa,4BACX,UACA,kBACG;CACH,MAAM,kBAAkB,QAAQ,QAS9B,CAAC,CAAC,uBAAuB,SAAS,SAAS,MAAM,WAAW,kBAAkB;CAEhF,MAAM,WAAW,uBAAuB,aAAa;CA2TrD,OAAO;EAAE;EAAiB,aAzTN,MAAM,OACxB,iBACA,OAAO,IAAI,aAAa;GACtB,MAAM,EAAE,IAAI,WAAW,OAAO,wBAAwB,UAAU,QAAQ;GACxE,MAAM,EAAE,cAAc,OAAO;GAE7B,MAAM,EAAE,eAAe,cAAc,eAAe,aAClD,OAAO;GAET,MAAM,EAAE,iBAAiB,OAAO;GAChC,MAAM,EAAE,MAAM,SAAS,OAAO;GAC9B,MAAM,EAAE,gBAAgB,OAAO,OAAO;GAEtC,MAAM,SAAS,OAAO,GAAG,6BAA6B,CAAC,CAAC,aAAa;IACnE,MAAM,QAAQ,OAAO,YAAY,EAAE,CAAC,CAAC,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,SAAS,aAAa,KAAK,SAAS,gBAAgB,KAAK,CAAC;IAEhE,MAAM,KAAK,CAAC;IAEZ,OAAO;GACT,CAAC;GAED,MAAM,UAAU,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACxD,OACA,eACA;IACA,MAAM,UAAU,OAAO,OAAO,GAC5B,mBAAmB,iBAAiB,KAAK,OAAO,OAAO,CAAC;IAE1D,OAAO,OAAO,OAAO,qBAAqB,YACxC,OAAO,IAAI,aAAa;KACtB,MAAM,UAAU,OAAO,QACrB,aACE;MACE,OAAO,kBAAkBC,2BAA6B,KAAK;MAC3D;MACA;MACA;MACA,gBAAgB,OAAO;KACzB,IACC,OAAO,YACN,QAAQ,QAAQ,kBAAkBC,+BAAiC,KAAK,CAAC,CAC7E,CACF;KAEA,MAAM,WAAW,OAAO,cAAc,OAAO;KAE7C,IAAI,SAAS,SAAS,QAAQ,OAAO,OAAA,mBAA4B,KAAK,CAAC,CAAC;KACxE,IAAI,SAAS,SAAS,2BACpB,OAAO,OAAA,sCAA+C,KAAK,CAAC,CAAC;KAC/D,IAAI,SAAS,SAAS,WAAW,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;KACpE,MAAM,QAAQ,kBAAkBC,4BAA8B,SAAS,KAAK;KAE5E,IACE,MAAM,YAAY,WAClB,MAAM,qBAAqB,oBAC3B,CAAC,cAAcF,2BAA6B,MAAM,OAAO,KAAK,KAC9D,MAAM,yBACJ,MAAM,kBAAkB,OAAO,8BACjC,MAAM,kBAAkB,SAAS,cAAc,OAAO,SAAS,GAAG,GAElE,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;KAExC,MAAM,WAAW,OAAO,IAAI,aAAa;MACvC,MAAM,WAAW,OAAO,KACtB,kBAAkBA,2BAA6B,KAAK,CACtD,CAAC,CAAC,KAAK,OAAO,SAAS,MAAM,cAAcF,6BAA+B,CAAC,CAAC,CAAC;MAE7E,OAAO,OAAO,OAAO,IAAI,aAAa;OACpC,MAAM,QAAQ,SAAS,cAAc,OAAO,SAAS,GAAG;OAExD,IACE,CAAC,SAAS,gBACV,MAAM,QAAQ,cAAc,QAAQ,YAAY,iBAChD,MAAM,QAAQ,SAAS,0BAA0B,KAAA,KACjD,MAAM,QAAQ,SAAS,yBAAyB,SAChD,SAAS,MAAM,sBAEf,OAAO,OAAA,sCAA+C,KAAK,CAAC,CAAC;OAE/D,MAAM,WAAW,OAAO,aAAa;QACnC,SAAS,kBAAkBK,4BAA8B,MAAM,OAAO;QACtE,UAAU,kBAAkBL,6BAA+B,QAAQ;QACnE,uBAAuB,SAAS,WAAW,KAAK;OAClD,CAAC;OAED,MAAM,YAAY,OAAO,uBACvB,MAAM,QAAQ,eACd,UACA,OACA;QAAE,SAAS,MAAM;QAAS;OAAS,CACrC;OAEA,OAAO,OAAO,OAAO,IAAI,aAAa;QACpC,MAAM,UAAU,kBAAkBK,4BAA8B;SAC9D,GAAG,MAAM;SACT,cAAc;SACd,UAAU,UAAU;QACtB,CAAC;QAED,MAAM,SAAS,OAAO,KAAK;SACzB;SACA,UAAU,kBAAkBL,6BAA+B,UAAU,QAAQ;QAC/E,CAAC;QAED,MAAM,UAAU,kBAAkBE,2BAA6B;SAC7D;SACA;QACF,CAAC;QAED,IAAI;QAEJ,IAAI,QAAQ,cAAc,QAAQ,eAAe,UAAU;SACzD,MAAM,iBAAiB,kBAAkBI,iCAAmC;UAC1E,WAAW;UACX,OAAO,OAAO,OAAO;UACrB,OAAO;SACT,CAAC;SAED,UAAU,kBAAkBC,6BAA+B;UACzD,SAAS;UACT,QAAQ,OAAO,KAAK;WAClB,SAAS;WACT,UAAU,kBACRP,6BACA,UAAU,QACZ;UACF,CAAC;SACH,CAAC;QACH;QAEA,OAAO,kBAAkBQ,8BAAgC;SACvD,MAAM;SACN,OAAO;SACP,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;QAC/B,CAAC;OACH,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,OAAO,WAAW,sBAAsB,UAAU,QAAQ,CAAC,CAAC,CAC9E;MACF,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,OAAO,WAAW,sBAAsB,QAAQ,CAAC,CAAC,CAAC;KAC7E,CAAC;KAED,MAAM,YAAY,KAAK,IACrB,GACA,MAAM,uBAAuB,SAAS,cAAc,OAAO,SAAS,GAAG,CACzE;KAEA,MAAM,YAAY,OAAO,OAAO,KAAK,QAAQ,iBAAiB,UAAU,SAAS,CAAC,CAAC;KAEnF,MAAM,UAA0C,KAAK,UAAU,SAAS,IACpE,UAAU,QACV,EAAE,MAAM,0BAA0B;KAEtC,MAAM,WAAW,OAAO,OAAO,KAC7B,iBACE,cACE;MACE,OAAO;MACP;MACA;KACF,IACC,OAAO,YACN,QAAQ,QAAQ,kBAAkBC,iCAAmC,KAAK,CAAC,CAC/E,GACA,OAAO,uBACT,CACF;KAEA,IAAI,KAAK,UAAU,SAAS,KAAK,MAAM,cAAc,UAAU,KAAK,GAClE,OAAO,OAAO,OAAO;KACvB,IAAI,KAAK,UAAU,QAAQ,GAAG,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;KACpE,MAAM,UAAU,OAAO,cAAc,SAAS,KAAK;KAEnD,IAAI,QAAQ,SAAS,aACnB,OAAO,OAAA,sCAA+C,KAAK,CAAC,CAAC;KAC/D,IACE,QAAQ,SAAS,eACjB,CAAC,cAAcP,2BAA6B,QAAQ,OAAO,QAAQ,KAAK,GAExE,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;KAExC,OAAO,kBAAkBA,2BAA6B,QAAQ,KAAK;IACrE,CAAC,CACH;GACF,CAAC;GAED,MAAM,UAAU,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACxD,YACA,KACA;IACA,MAAM,SAAS,OAAO,gBAAgB,UAAU;IAChD,MAAM,QAAQ,OAAO,cAAcQ,mBAAqB,GAAG;IAE3D,MAAM,gBAAgB,OAAO,0BAC3B,OAAO,UAAU;KACf,YAAY;KACZ,UAAU;KACV,SAAS;KACT,GAAG;IACL,CAAC,GACD,IACA,OAAO,WACP,OACA,MAAM,SACN,MAAM,UACR;IAEA,MAAM,YAAY,OAAO,cAAc;KAAE;KAAe,GAAG;IAAM,CAAC,CAAC,CAAC,KAClE,OAAO,SAAS,MAAM,cAAcC,gCAAkC,CAAC,CAAC,CAC1E;IAEA,IAAI,UAAU,SAAS,QAAQ,OAAO,OAAA,mBAA4B,KAAK,CAAC,CAAC;IACzE,IAAI,UAAU,SAAS,2BACrB,OAAO,OAAA,sCAA+C,KAAK,CAAC,CAAC;IAC/D,IAAI,UAAU,SAAS,UAAU,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;IACpE,IAAI,QAAQ,UAAU;IAEtB,IACE,MAAM,QAAQ,aAAa,MAC3B,MAAM,QAAQ,cAAc,OAAO,aACnC,MAAM,QAAQ,YAAY,MAAM,WAChC,MAAM,QAAQ,cAAc,QAAQ,QAAQ,MAAM,cAClD,CAAC,iBAAiB,QAAQ,MAAM,QAAQ,cAAc,OAAO,GAE7D,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;IACrC,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;IAEtD,IACE,MAAM,QAAQ,cAAc,QAAQ,YAAY,iBAChD,MAAM,QAAQ,SAAS,0BAA0B,KAAA,KACjD,MAAM,QAAQ,SAAS,wBAAwB,OAC/C,MAAM,MAAM,QAAQ,cAAc,QAAQ,sBACxC,MAAM,QAAQ,SAAS,gBAEzB,QAAQ,OAAO,QAAQ,OAAO,aAAa;IAE7C,MAAM,WAAW,OAAO,KAAK,kBAAkBT,2BAA6B,KAAK,CAAC,CAAC,CAAC,KAClF,OAAO,SAAS,MAAM,cAAcF,6BAA+B,CAAC,CAAC,CACvE;IAEA,OAAO,OAAO,OAAO,IAAI,aAAa;KACpC,OAAO,0BACL,eACA,IACA,OAAO,WACP,OACA,MAAM,SACN,MAAM,UACR;KACA,IAAI,SAAS,cAAc,OAAO,SAAS,GAAG,KAAK,MAAM,QAAQ,SAAS,gBACxE,OAAO,OAAA,sCAA+C,KAAK,CAAC,CAAC;KAC/D,MAAM,cAAc,OAAO,OAAO;KAElC,MAAM,UAAU,OAAO,SACrB;MACE,OAAO,kBAAkBE,2BAA6B,KAAK;MAC3D;MACA;MACA,gBAAgB,OAAO;KACzB,IACC,OAAO,YACN,QAAQ,QAAQ,kBAAkBU,4BAA8B,KAAK,CAAC,CAC1E;KAEA,MAAM,WAAW,OAAO,cAAc,OAAO;KAE7C,IAAI,SAAS,SAAS,QAAQ,OAAO,OAAA,mBAA4B,KAAK,CAAC,CAAC;KACxE,IAAI,SAAS,SAAS,2BACpB,OAAO,OAAA,sCAA+C,KAAK,CAAC,CAAC;KAC/D,IAAI,SAAS,SAAS,YAAY,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;KACrE,IACE,SAAS,gBAAgB,eACzB,SAAS,YAAY,MAAM,QAAQ,WACnC,SAAS,iBAAiB,MAAM,QAAQ,gBACxC,SAAS,mBAAmB,SAAS,oBACrC,SAAS,mBAAmB,SAAS,cAAc,OAAO,SAAS,GAAG,KACtE,SAAS,kBACP,KAAK,IACH,SAAS,mBAAmB,OAAO,4BACnC,MAAM,QAAQ,SAAS,gBACvB,cAAc,eAChB,KACF,SAAS,cAAc,OAAO,SAAS,GAAG,KAAK,SAAS,iBAExD,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;KAExC,OAAO;MACL,OAAO,SAAS,KAAK,SAAS,MAAM,SAAS,WAAW,CAAC;MACzD,iBAAiB,SAAS;KAC5B;IACF,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,OAAO,WAAW,sBAAsB,QAAQ,CAAC,CAAC,CAAC;GAC7E,GAAG,aAAa;GAEhB,MAAM,mBACJ,YACA,OACA,QAEA,QAAQ,YAAY,KAAK,CAAC,CAAC,KACzB,OAAO,SAAS,EAAE,OAAO,sBACvB,OAAO,IAAI,aAAa;IACtB,IAAI,SAAS,cAAc,OAAO,SAAS,GAAG,KAAK,iBACjD,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAExC,OAAO,OAAO,OAAO,cAAc,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,aAAa;GAC1E,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,OAAO,WAAW,SAAS,WAAW,KAAK,CAAC,CAAC,CAAC,CACxE,CACF;GAEF,OAAO,gBAAgB,GAAG,EAAE,gBAAgB,CAAC;EAC/C,CAAC,CAGiC;CAAE;AACxC"}

package/dist/oauth/connectedMaintenance.d.mts

@@ -0,0 +1,19 @@
+import "../operations/errors.mjs";
+import "../operations/context.mjs";
+import "../operations/operation.mjs";
+import "../Operations.mjs";
+import "../Auth.mjs";
+import "./signInErrors.mjs";
+import "./connectedModels.mjs";
+import "./OAuthConnectedPersistence.mjs";
+import "./OAuthConnectedProtocol.mjs";
+import "./OAuthConnectedTokenProtector.mjs";
+import { Context, Crypto, Effect, Layer, Schema } from "effect";
+//#region src/oauth/connectedMaintenance.d.ts
+interface MaintenanceModule<Id extends string> {
+  readonly moduleId: Id;
+  readonly kind: "oauth-connected-maintenance";
+}
+//#endregion
+export { MaintenanceModule };
+//# sourceMappingURL=connectedMaintenance.d.mts.map