bravenlab 0.0.0-stage → 0.1.3

package/dist/auth.js

@@ -0,0 +1,651 @@
+// src/auth.ts
+import {
+  Cause,
+  Console as Console2,
+  Duration as Duration2,
+  Effect as Effect4,
+  Match as Match2,
+  Option as Option4,
+  Ref,
+  Schedule
+} from "effect";
+import { HttpClient as HttpClient2, HttpClientRequest as HttpClientRequest2, HttpClientResponse as HttpClientResponse2 } from "effect/http";
+import * as Schema4 from "effect/Schema";
+import * as Tuple from "effect/Tuple";
+
+// ../identity-store/src/environment.ts
+import { Context, Layer, Match, Option } from "effect";
+import * as Str from "effect/String";
+var Environment = class extends Context.Service()("braven/Environment") {
+};
+
+// ../identity-store/src/errors.ts
+import { Effect } from "effect";
+import * as Schema from "effect/Schema";
+import * as Str2 from "effect/String";
+var EXIT_FAILURE = 1;
+var CliFailure = class extends Schema.TaggedError()("CliFailure", {
+  message: Schema.String,
+  exitCode: Schema.Int
+}) {
+};
+var fail = (message, exitCode = EXIT_FAILURE) => Effect.fail(new CliFailure({ message, exitCode }));
+var oneLine = (value) => Str2.trim(Str2.replace(/\s+/g, " ")(String(value))).slice(0, 300);
+
+// ../identity-store/src/identity.ts
+import { Context as Context2, Effect as Effect2, Layer as Layer2, Option as Option2, pipe } from "effect";
+import * as Arr from "effect/Array";
+import * as R from "effect/Record";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import * as Predicate from "effect/Predicate";
+import * as Schema2 from "effect/Schema";
+import * as Str3 from "effect/String";
+var CONFIG_VERSION = 1;
+var CredentialKind = Schema2.Literals(["session", "apiKey"]);
+var Account = class extends Schema2.Class("Account")({
+  origin: Schema2.String,
+  email: Schema2.String,
+  kind: CredentialKind,
+  label: Schema2.OptionFromOptionalKey(Schema2.String)
+}) {
+};
+var ConfigFile = class extends Schema2.Class("ConfigFile")({
+  version: Schema2.Int.pipe(
+    Schema2.withConstructorDefault(Effect2.succeed(CONFIG_VERSION)),
+    Schema2.withDecodingDefaultKey(Effect2.succeed(CONFIG_VERSION))
+  ),
+  current: Schema2.OptionFromNullishOr(Schema2.String, {
+    onNoneEncoding: null
+  }).pipe(
+    Schema2.withConstructorDefault(Effect2.succeed(Option2.none())),
+    Schema2.withDecodingDefaultKey(Effect2.succeed(null))
+  ),
+  accounts: Schema2.Array(Account).pipe(
+    Schema2.withConstructorDefault(Effect2.succeed([])),
+    Schema2.withDecodingDefaultKey(Effect2.succeed([]))
+  ),
+  defaults: Schema2.Record(Schema2.String, Schema2.Unknown).pipe(
+    Schema2.withConstructorDefault(Effect2.succeed({})),
+    Schema2.withDecodingDefaultKey(Effect2.succeed({}))
+  ),
+  watcher: Schema2.Record(Schema2.String, Schema2.Unknown).pipe(
+    Schema2.withConstructorDefault(Effect2.succeed({})),
+    Schema2.withDecodingDefaultKey(Effect2.succeed({}))
+  )
+}) {
+};
+var ConfigJson = Schema2.fromJsonString(ConfigFile, { space: 2 });
+var StoreConfig = class extends Context2.Service()("braven/StoreConfig") {
+};
+var CREDENTIALS_FILE = "credentials.json";
+var Secrets = class extends Context2.Service()(
+  "braven/Secrets"
+) {
+};
+var SecretsJson = Schema2.fromJsonString(
+  Schema2.Record(Schema2.String, Schema2.String),
+  { space: 2 }
+);
+var credentialsPath = (configPath) => Str3.replace(/config\.json$/, CREDENTIALS_FILE)(configPath);
+var secretsLayer = Layer2.effect(Secrets)(
+  Effect2.gen(function* () {
+    const { path } = yield* StoreConfig;
+    const fs = yield* FileSystem.FileSystem;
+    const pathService = yield* Path.Path;
+    const file = credentialsPath(path);
+    const read = () => Effect2.gen(function* () {
+      if (!(yield* fs.exists(file).pipe(Effect2.mapError(storageFailure("read", file))))) {
+        return {};
+      }
+      const text = yield* fs.readFileString(file).pipe(Effect2.mapError(storageFailure("read", file)));
+      return yield* Schema2.decodeUnknownEffect(SecretsJson)(text).pipe(
+        Effect2.mapError(
+          (cause) => new CliFailure({
+            message: `${file} is not a credentials file: ${oneLine(cause.message)}`,
+            exitCode: EXIT_FAILURE
+          })
+        )
+      );
+    });
+    const write = (secrets) => Effect2.gen(function* () {
+      const text = yield* Schema2.encodeUnknownEffect(SecretsJson)(
+        secrets
+      ).pipe(Effect2.mapError(storageFailure("encode", file)));
+      yield* fs.makeDirectory(pathService.dirname(file), { recursive: true }).pipe(Effect2.mapError(storageFailure("create", file)));
+      const temporary = `${file}.tmp`;
+      yield* fs.writeFileString(temporary, text, { mode: 384 }).pipe(Effect2.mapError(storageFailure("write", file)));
+      yield* fs.chmod(temporary, 384).pipe(Effect2.mapError(storageFailure("write", file)));
+      yield* fs.rename(temporary, file).pipe(Effect2.mapError(storageFailure("write", file)));
+    });
+    const update = (change) => Effect2.gen(function* () {
+      yield* write(change(yield* read()));
+    });
+    return Secrets.of({
+      get: (account) => read().pipe(Effect2.map((all) => Option2.fromNullishOr(all[account]))),
+      set: (account, secret) => update((all) => R.set(all, account, secret)),
+      remove: (account) => update((all) => R.remove(all, account))
+    });
+  })
+);
+var accountKey = (origin, email) => `${normalizeOrigin(origin)}|${email}`;
+var normalizeOrigin = (origin) => Str3.replace(/\/+$/, "")(origin);
+var storageFailure = (action, path) => (cause) => new CliFailure({
+  message: `${action} ${path}: ${oneLine(cause.message)}`,
+  exitCode: EXIT_FAILURE
+});
+var loadConfig = () => Effect2.gen(function* () {
+  const { path } = yield* StoreConfig;
+  const fs = yield* FileSystem.FileSystem;
+  if (!(yield* fs.exists(path).pipe(Effect2.mapError(storageFailure("read", path))))) {
+    return new ConfigFile({});
+  }
+  const text = yield* fs.readFileString(path).pipe(Effect2.mapError(storageFailure("read", path)));
+  const config = yield* Schema2.decodeUnknownEffect(ConfigJson)(text).pipe(
+    Effect2.mapError(
+      (cause) => new CliFailure({
+        message: `${path} is not a version-${CONFIG_VERSION} config: ${oneLine(cause.message)}`,
+        exitCode: EXIT_FAILURE
+      })
+    )
+  );
+  if (config.version !== CONFIG_VERSION) {
+    return yield* fail(
+      `${path} is version ${config.version}, expected ${CONFIG_VERSION}`
+    );
+  }
+  return config;
+});
+var saveConfig = (config) => Effect2.gen(function* () {
+  const { path } = yield* StoreConfig;
+  const fs = yield* FileSystem.FileSystem;
+  const pathService = yield* Path.Path;
+  const text = yield* Schema2.encodeUnknownEffect(ConfigJson)(config).pipe(
+    Effect2.mapError(storageFailure("encode", path))
+  );
+  yield* fs.makeDirectory(pathService.dirname(path), { recursive: true }).pipe(Effect2.mapError(storageFailure("create", path)));
+  const temporary = `${path}.tmp`;
+  yield* fs.writeFileString(temporary, text).pipe(Effect2.mapError(storageFailure("write", path)));
+  yield* fs.rename(temporary, path).pipe(Effect2.mapError(storageFailure("write", path)));
+});
+var storeCredential = (credential, label = Option2.none()) => Effect2.gen(function* () {
+  if (credential.secret.length === 0) {
+    return yield* fail("refusing to store an empty secret");
+  }
+  if (credential.email.length === 0) {
+    return yield* fail("storing a credential needs an email");
+  }
+  const origin = normalizeOrigin(credential.origin);
+  const key = accountKey(origin, credential.email);
+  const secrets = yield* Secrets;
+  yield* secrets.set(key, credential.secret);
+  const config = yield* loadConfig();
+  const account = new Account({
+    origin,
+    email: credential.email,
+    kind: credential.kind,
+    label
+  });
+  yield* saveConfig(
+    new ConfigFile({
+      ...config,
+      accounts: [
+        ...config.accounts.filter(
+          (stored) => accountKey(stored.origin, stored.email) !== key
+        ),
+        account
+      ],
+      current: Option2.some(key)
+    })
+  );
+  return account;
+});
+
+// ../identity-store/src/login.ts
+import open from "open";
+import { createServer } from "node:http";
+import { NodeHttpServer } from "@effect/platform-node";
+import {
+  Console,
+  Context as Context3,
+  Deferred,
+  Duration,
+  Effect as Effect3,
+  Layer as Layer3,
+  Option as Option3,
+  Predicate as Predicate2,
+  Schema as Schema3
+} from "effect";
+import {
+  HttpClient,
+  HttpClientRequest,
+  HttpClientResponse,
+  HttpRouter,
+  HttpServer,
+  HttpServerRequest,
+  HttpServerResponse
+} from "effect/http";
+import "effect/FileSystem";
+import * as NetAddress from "effect/net/NetAddress";
+import "effect/Path";
+import * as Str4 from "effect/String";
+var LOGIN_TIMEOUT = Duration.minutes(5);
+var SignInReason = Schema3.Literals([
+  "timeout",
+  "listener",
+  "browser",
+  "rejected",
+  "storage"
+]);
+var SignInFailure = class extends Schema3.TaggedError()(
+  "SignInFailure",
+  { reason: SignInReason, message: Schema3.String }
+) {
+};
+var Browser = class extends Context3.Service()("braven/Browser") {
+};
+var browserLayer = Layer3.succeed(Browser)({
+  open: (url) => Effect3.tryPromise({
+    try: () => open(url),
+    catch: (cause) => new CliFailure({
+      message: `cannot open a browser for ${url}: ${oneLine(cause)}`,
+      exitCode: EXIT_FAILURE
+    })
+  }).pipe(Effect3.asVoid)
+});
+var Sessions = class extends Context3.Service()("braven/Sessions") {
+};
+var SessionUser = class SessionUser2 extends Schema3.Class(
+  "SessionUser"
+)({ email: Schema3.NonEmptyString }) {
+};
+var SessionBody = class SessionBody2 extends Schema3.Class(
+  "SessionBody"
+)({ user: SessionUser }) {
+};
+var lookupFailure = (origin, cause) => new CliFailure({
+  message: `cannot read a session from ${origin}: ${oneLine(cause.message)}`,
+  exitCode: EXIT_FAILURE
+});
+var lookupEmail = (origin, token) => Effect3.gen(function* () {
+  const client = yield* HttpClient.HttpClient;
+  const response = yield* client.get(`${origin}/api/auth/get-session`, {
+    headers: { authorization: `Bearer ${token}` }
+  }).pipe(Effect3.mapError((cause) => lookupFailure(origin, cause)));
+  if (response.status !== 200) {
+    const detail = yield* response.text.pipe(Effect3.orElseSucceed(() => ""));
+    return yield* fail(
+      `the API rejected that sign-in (${response.status})${detail ? `: ${oneLine(detail)}` : ""} \u2014 run \`braven login\` again`
+    );
+  }
+  const body = yield* HttpClientResponse.schemaBodyJson(SessionBody)(
+    response
+  ).pipe(Effect3.mapError((cause) => lookupFailure(origin, cause)));
+  return body.user.email;
+});
+var revokeSession = (origin, token) => Effect3.gen(function* () {
+  const client = yield* HttpClient.HttpClient;
+  const response = yield* client.execute(
+    HttpClientRequest.post(`${origin}/api/auth/sign-out`).pipe(
+      HttpClientRequest.bearerToken(token),
+      HttpClientRequest.bodyJsonUnsafe({})
+    )
+  ).pipe(
+    Effect3.mapError(
+      (cause) => new CliFailure({
+        message: `cannot reach ${origin} to sign out: ${oneLine(cause.message)}`,
+        exitCode: EXIT_FAILURE
+      })
+    )
+  );
+  if (response.status === 200 || response.status === 401) return;
+  const detail = yield* response.text.pipe(Effect3.orElseSucceed(() => ""));
+  return yield* fail(
+    `the API refused the sign-out (${response.status})${detail ? `: ${oneLine(detail)}` : ""}`
+  );
+});
+var sessionsLayer = Layer3.effect(Sessions)(
+  Effect3.map(HttpClient.HttpClient, (client) => ({
+    emailFor: (origin, token) => lookupEmail(origin, token).pipe(
+      Effect3.provideService(HttpClient.HttpClient, client)
+    ),
+    revoke: (origin, token) => revokeSession(origin, token).pipe(
+      Effect3.provideService(HttpClient.HttpClient, client)
+    )
+  }))
+);
+var tokenOf = (params) => Option3.fromNullishOr(params["token"]).pipe(
+  Option3.flatMap(
+    (value) => Predicate2.isString(value) ? Option3.some(value) : Option3.none()
+  ),
+  Option3.filter(Str4.isNonEmpty)
+);
+var tokenRoute = (tokens) => HttpRouter.add(
+  "GET",
+  "/",
+  Effect3.gen(function* () {
+    const params = yield* HttpServerRequest.ParsedSearchParams;
+    return yield* Option3.match(tokenOf(params), {
+      onNone: () => Effect3.succeed(
+        HttpServerResponse.text("Missing token.", { status: 400 })
+      ),
+      onSome: (token) => Effect3.gen(function* () {
+        yield* Deferred.succeed(tokens, token);
+        return HttpServerResponse.html(
+          "<h1>Authenticated. You can close this window.</h1>"
+        );
+      })
+    });
+  })
+);
+var listenerFailure = (message) => new SignInFailure({ reason: "listener", message });
+var portOf = (address) => NetAddress.isInetAddress(address) ? Effect3.succeed(address.port) : Effect3.fail(
+  listenerFailure("the login listener did not bind a TCP port")
+);
+var openingLines = (url) => `Opening ${url}
+If your browser did not open, visit that URL to finish signing in.`;
+var awaitToken = (options) => Effect3.gen(function* () {
+  const tokens = yield* Deferred.make();
+  const app = HttpRouter.serve(
+    Layer3.mergeAll(
+      tokenRoute(tokens),
+      HttpRouter.add(
+        "*",
+        "*",
+        HttpServerResponse.text("Missing token.", { status: 400 })
+      )
+    ),
+    {
+      disableLogger: true,
+      disableListenLog: true
+    }
+  ).pipe(
+    Layer3.provideMerge(
+      NodeHttpServer.layer(createServer, { host: "127.0.0.1", port: 0 })
+    )
+  );
+  return yield* Effect3.gen(function* () {
+    const server = yield* HttpServer.HttpServer;
+    const port = yield* portOf(server.address);
+    const browser = yield* Browser;
+    const loginUrl = `${options.webOrigin}/cli-login?port=${port}`;
+    yield* Option3.match(Option3.fromNullishOr(options.onLoginUrl), {
+      onNone: () => Console.log(openingLines(loginUrl)),
+      onSome: (report) => report(loginUrl)
+    });
+    yield* browser.open(loginUrl).pipe(
+      Effect3.mapError(
+        (failure) => new SignInFailure({
+          reason: "browser",
+          message: failure.message
+        })
+      )
+    );
+    return { token: yield* Deferred.await(tokens), port };
+  }).pipe(
+    Effect3.timeoutOrElse({
+      duration: options.timeout ?? LOGIN_TIMEOUT,
+      orElse: () => Effect3.fail(
+        new SignInFailure({
+          reason: "timeout",
+          message: "timed out waiting for the browser sign-in (5 minutes) \u2014 run `braven login` again"
+        })
+      )
+    }),
+    Effect3.provide(app),
+    Effect3.catchTag(
+      "ServeError",
+      (cause) => Effect3.fail(
+        listenerFailure(
+          `cannot start the login listener: ${oneLine(cause.message)}`
+        )
+      )
+    )
+  );
+});
+var asSignInFailure = (reason) => (failure) => new SignInFailure({ reason, message: failure.message });
+var rememberSession = (origin, token) => Effect3.gen(function* () {
+  const sessions = yield* Sessions;
+  const email = yield* sessions.emailFor(origin, token).pipe(Effect3.mapError(asSignInFailure("rejected")));
+  return yield* storeCredential({
+    origin,
+    email,
+    kind: "session",
+    secret: token
+  }).pipe(Effect3.mapError(asSignInFailure("storage")));
+});
+var signIn = (options) => Effect3.gen(function* () {
+  const { token } = yield* awaitToken(options);
+  return yield* rememberSession(options.origin, token);
+});
+
+// src/auth.ts
+var DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+var DEVICE_SCOPE = "openid profile email";
+var DEVICE_CODE_LIFETIME = Duration2.minutes(30);
+var DEVICE_POLL_INTERVAL = Duration2.seconds(5);
+var DEVICE_SLOW_DOWN = Duration2.seconds(5);
+var deviceUrl = (origin, endpoint) => `${origin}/api/auth/device/${endpoint}`;
+var DeviceCode = class extends Schema4.Class("DeviceCode")({
+  device_code: Schema4.NonEmptyString,
+  user_code: Schema4.NonEmptyString,
+  verification_uri: Schema4.NonEmptyString,
+  verification_uri_complete: Schema4.OptionFromOptionalKey(Schema4.String),
+  expires_in: Schema4.Int.pipe(
+    Schema4.withConstructorDefault(
+      Effect4.succeed(Duration2.toSeconds(DEVICE_CODE_LIFETIME))
+    ),
+    Schema4.withDecodingDefaultKey(
+      Effect4.succeed(Duration2.toSeconds(DEVICE_CODE_LIFETIME))
+    )
+  ),
+  interval: Schema4.Int.pipe(
+    Schema4.withConstructorDefault(
+      Effect4.succeed(Duration2.toSeconds(DEVICE_POLL_INTERVAL))
+    ),
+    Schema4.withDecodingDefaultKey(
+      Effect4.succeed(Duration2.toSeconds(DEVICE_POLL_INTERVAL))
+    )
+  )
+}) {
+};
+var DeviceToken = class extends Schema4.Class("DeviceToken")({
+  access_token: Schema4.OptionFromOptionalKey(Schema4.String),
+  error: Schema4.OptionFromOptionalKey(Schema4.String),
+  error_description: Schema4.OptionFromOptionalKey(Schema4.String)
+}) {
+};
+var retryLine = "run `braven login --device` again";
+var deviceExpiredFailure = () => new CliFailure({
+  message: `the device code expired before it was approved \u2014 ${retryLine}`,
+  exitCode: EXIT_FAILURE
+});
+var transportFailure = (origin, cause) => new CliFailure({
+  message: `cannot reach the sign-in API at ${origin}: ${oneLine(cause.message)}`,
+  exitCode: EXIT_FAILURE
+});
+var detailOf = (description) => Option4.match(description, {
+  onNone: () => "",
+  onSome: (value) => `: ${oneLine(value)}`
+});
+var refusalFor = (error, description) => Match2.value(error).pipe(
+  Match2.when("expired_token", deviceExpiredFailure),
+  Match2.when(
+    "access_denied",
+    () => new CliFailure({
+      message: `the sign-in was denied in the browser \u2014 ${retryLine}`,
+      exitCode: EXIT_FAILURE
+    })
+  ),
+  Match2.when(
+    "invalid_grant",
+    () => new CliFailure({
+      message: `the device code is no longer valid \u2014 ${retryLine}`,
+      exitCode: EXIT_FAILURE
+    })
+  ),
+  Match2.orElse(
+    (other) => new CliFailure({
+      message: `the device sign-in failed (${other})${detailOf(description)}`,
+      exitCode: EXIT_FAILURE
+    })
+  )
+);
+var refusal = (cause) => ({
+  _tag: "Refused",
+  failure: cause
+});
+var verdictOf = (body) => Option4.match(body.access_token, {
+  onSome: (token) => Effect4.succeed({ _tag: "Granted", token }),
+  onNone: () => Match2.value(Option4.getOrElse(body.error, () => "unknown_error")).pipe(
+    Match2.when(
+      "authorization_pending",
+      () => Effect4.succeed({ _tag: "Pending" })
+    ),
+    Match2.when(
+      "slow_down",
+      () => Effect4.succeed({ _tag: "SlowDown" })
+    ),
+    Match2.orElse(
+      (error) => Effect4.fail(refusalFor(error, body.error_description))
+    )
+  )
+});
+var requestDeviceCode = (origin, clientId) => Effect4.gen(function* () {
+  const client = yield* HttpClient2.HttpClient;
+  const request = yield* HttpClientRequest2.post(
+    deviceUrl(origin, "code")
+  ).pipe(
+    HttpClientRequest2.bodyJson({
+      client_id: clientId,
+      scope: DEVICE_SCOPE
+    }),
+    Effect4.mapError((cause) => transportFailure(origin, cause))
+  );
+  const response = yield* client.execute(request).pipe(Effect4.mapError((cause) => transportFailure(origin, cause)));
+  if (response.status !== 200) {
+    const detail = yield* response.text.pipe(Effect4.orElseSucceed(() => ""));
+    return yield* fail(
+      `the sign-in API refused a device code (${response.status})${detail ? `: ${oneLine(detail)}` : ""} \u2014 ${retryLine}`
+    );
+  }
+  return yield* HttpClientResponse2.schemaBodyJson(DeviceCode)(response).pipe(
+    Effect4.mapError(
+      (cause) => new CliFailure({
+        message: `cannot read a device code from ${origin}: ${oneLine(cause.message)}`,
+        exitCode: EXIT_FAILURE
+      })
+    )
+  );
+});
+var pollDeviceToken = (origin, clientId, deviceCode) => Effect4.gen(function* () {
+  const client = yield* HttpClient2.HttpClient;
+  const response = yield* client.execute(
+    HttpClientRequest2.post(deviceUrl(origin, "token")).pipe(
+      // better-auth's `/device/token` reads JSON only; a form body is 415.
+      HttpClientRequest2.bodyJsonUnsafe({
+        grant_type: DEVICE_GRANT_TYPE,
+        device_code: deviceCode,
+        client_id: clientId
+      })
+    )
+  ).pipe(Effect4.mapError((cause) => transportFailure(origin, cause)));
+  const body = yield* HttpClientResponse2.schemaBodyJson(DeviceToken)(
+    response
+  ).pipe(
+    Effect4.mapError(
+      () => new CliFailure({
+        message: `the sign-in API at ${origin} returned an unreadable device-token answer`,
+        exitCode: EXIT_FAILURE
+      })
+    )
+  );
+  return yield* verdictOf(body);
+}).pipe(
+  // The poll's contract is a verdict, never a failure: a transport or decode
+  // error stops the schedule as `Refused` and surfaces one line later.
+  Effect4.catch((cause) => Effect4.succeed(refusal(cause)))
+);
+var devicePollSchedule = (start) => Schedule.fromStepWithMetadata(
+  Effect4.map(
+    Ref.make(start),
+    (interval) => (metadata) => Match2.value(metadata.input).pipe(
+      Match2.tag("Granted", () => Cause.done(metadata.input)),
+      Match2.tag("Refused", () => Cause.done(metadata.input)),
+      Match2.tag(
+        "Pending",
+        () => Ref.get(interval).pipe(
+          Effect4.map((delay) => Tuple.make(metadata.input, delay))
+        )
+      ),
+      Match2.tag(
+        "SlowDown",
+        () => Ref.updateAndGet(
+          interval,
+          (delay) => Duration2.millis(
+            Duration2.toMillis(delay) + Duration2.toMillis(DEVICE_SLOW_DOWN)
+          )
+        ).pipe(Effect4.map((delay) => Tuple.make(metadata.input, delay)))
+      ),
+      Match2.exhaustive
+    )
+  )
+);
+var deviceLogin = (options) => Effect4.gen(function* () {
+  const code = yield* requestDeviceCode(options.origin, options.clientId);
+  const verification = Option4.getOrElse(
+    code.verification_uri_complete,
+    () => code.verification_uri
+  );
+  yield* Console2.log(
+    `Sign in at ${verification}
+and confirm the code ${code.user_code} in the browser.`
+  );
+  const browser = yield* Browser;
+  yield* browser.open(verification);
+  const interval = Duration2.seconds(code.interval);
+  const poll = pollDeviceToken(
+    options.origin,
+    options.clientId,
+    code.device_code
+  );
+  const untilFirstPoll = yield* Ref.make(true);
+  const outcome = yield* Effect4.suspend(
+    () => Effect4.flatMap(
+      Ref.getAndSet(untilFirstPoll, false),
+      (isFirst) => isFirst ? Effect4.delay(poll, interval) : poll
+    )
+  ).pipe(
+    Effect4.repeat(devicePollSchedule(interval)),
+    Effect4.timeoutOrElse({
+      duration: options.timeout ?? Duration2.seconds(code.expires_in),
+      orElse: () => Effect4.fail(deviceExpiredFailure())
+    })
+  );
+  return yield* Match2.value(outcome).pipe(
+    Match2.tag("Granted", (granted) => Effect4.succeed(granted.token)),
+    Match2.tag("Refused", (refused) => Effect4.fail(refused.failure)),
+    Match2.orElse(() => Effect4.fail(deviceExpiredFailure()))
+  );
+});
+export {
+  Browser,
+  DEVICE_GRANT_TYPE,
+  DEVICE_SCOPE,
+  DeviceCode,
+  DeviceToken,
+  LOGIN_TIMEOUT,
+  Sessions,
+  SignInFailure,
+  SignInReason,
+  awaitToken,
+  browserLayer,
+  deviceLogin,
+  devicePollSchedule,
+  lookupEmail,
+  rememberSession,
+  requestDeviceCode,
+  sessionsLayer,
+  signIn
+};
+//# sourceMappingURL=auth.js.map