@opengeni/db 3.4.0-canary.2 → 3.6.0

package/dist/{chunk-O6FTELKH.js → chunk-CDMMSUWJ.js}

@@ -1,11 +1,11 @@
 import {
   withRlsContext
-} from "./chunk-H7MXYG7R.js";
+} from "./chunk-WW7AJ5IC.js";
 import {
   sandboxRetainedProcesses,
   sessionBackgroundCommands,
   sessions
-} from "./chunk-C2AFP7SB.js";
+} from "./chunk-UJ2EW3QI.js";
 
 // src/session-background-commands.ts
 import { and, desc, eq, inArray, sql } from "drizzle-orm";
@@ -513,4 +513,4 @@ export {
   settleSessionBackgroundCommandForRetainedProcess,
   settleConnectedMachineSessionBackgroundCommand
 };
-//# sourceMappingURL=chunk-O6FTELKH.js.map
+//# sourceMappingURL=chunk-CDMMSUWJ.js.map

package/dist/chunk-G3732M3T.js

@@ -0,0 +1,299 @@
+import {
+  nestedPostgresSqlState,
+  rawRows
+} from "./chunk-WW7AJ5IC.js";
+
+// src/managed-auth-session-sets.ts
+import {
+  ManagedAuthLoginTransaction,
+  ManagedAuthLogoutAllReceipt,
+  ManagedAuthSessionSetProjection
+} from "@opengeni/contracts/managed-auth-session-sets";
+import { sql } from "drizzle-orm";
+var DatabaseProjection = ManagedAuthSessionSetProjection.omit({ csrfToken: true });
+var ManagedAuthSessionSetGenerationConflictError = class extends Error {
+  name = "ManagedAuthSessionSetGenerationConflictError";
+  code = "generation_conflict";
+  constructor() {
+    super("The browser session set changed in another request");
+  }
+};
+var ManagedAuthSessionSetOperationReuseError = class extends Error {
+  name = "ManagedAuthSessionSetOperationReuseError";
+  constructor() {
+    super("The browser session-set operation id was reused for different input");
+  }
+};
+var ManagedAuthSessionSetAuthorityError = class extends Error {
+  name = "ManagedAuthSessionSetAuthorityError";
+};
+var ManagedAuthLoginSlotUnavailableError = class extends Error {
+  name = "ManagedAuthLoginSlotUnavailableError";
+};
+var ManagedAuthLoginSlotLimitError = class extends Error {
+  name = "ManagedAuthLoginSlotLimitError";
+};
+var ManagedAuthLoginSlotAlreadyExistsError = class extends Error {
+  name = "ManagedAuthLoginSlotAlreadyExistsError";
+  code = "slot_already_exists";
+};
+var ManagedAuthActorMutationInFlightError = class extends Error {
+  name = "ManagedAuthActorMutationInFlightError";
+  code = "actor_mutation_in_flight";
+};
+var ManagedAuthLoginTransactionRateLimitError = class extends Error {
+  name = "ManagedAuthLoginTransactionRateLimitError";
+  code = "login_transaction_rate_limited";
+};
+function mapSqlError(error) {
+  const state = nestedPostgresSqlState(error);
+  if (state === "40001") throw new ManagedAuthSessionSetGenerationConflictError();
+  if (state === "23505") throw new ManagedAuthSessionSetOperationReuseError();
+  if (state === "P0002") throw new ManagedAuthLoginSlotUnavailableError();
+  if (state === "P0003") throw new ManagedAuthLoginSlotAlreadyExistsError();
+  if (state === "54000") throw new ManagedAuthLoginSlotLimitError();
+  if (state === "55P03") throw new ManagedAuthActorMutationInFlightError();
+  if (state === "P0004") throw new ManagedAuthLoginTransactionRateLimitError();
+  if (state === "42501") {
+    throw new ManagedAuthSessionSetAuthorityError(
+      error instanceof Error ? error.message : "Browser session-set authority denied"
+    );
+  }
+  throw error;
+}
+function jsonValue(value) {
+  return typeof value === "string" ? JSON.parse(value) : value;
+}
+async function oneJson(db, query) {
+  const [row] = await rawRows(db, query);
+  return row ? jsonValue(row.result) : null;
+}
+function projectionFromResult(value) {
+  const projection = value?.projection;
+  return DatabaseProjection.parse(projection);
+}
+async function getManagedAuthSessionSetAuthorityState(db, authorityHash) {
+  try {
+    const [row] = await rawRows(
+      db,
+      sql`select managed_auth_session_set_authority_state(${authorityHash}) as state`
+    );
+    const value = row?.state;
+    if (value === "absent" || value === "active" || value === "retired") return value;
+    throw new ManagedAuthSessionSetAuthorityError("Invalid browser session-set authority state");
+  } catch (error) {
+    mapSqlError(error);
+  }
+}
+async function getManagedAuthSessionSetSnapshot(db, input) {
+  try {
+    const value = await oneJson(
+      db,
+      sql`select managed_auth_session_set_snapshot(
+        ${input.authorityHash}, ${input.mode}, ${input.includeInternal ?? false},
+        ${input.allowRecovery ?? false}, ${input.readOnly ?? false}
+      ) as result`
+    );
+    if (value === null) return null;
+    const snapshot = value;
+    return {
+      projection: DatabaseProjection.parse(snapshot.projection),
+      selected: snapshot.selected ?? null,
+      internalSlots: snapshot.internalSlots ?? []
+    };
+  } catch (error) {
+    mapSqlError(error);
+  }
+}
+async function bootstrapManagedAuthSessionSet(db, input) {
+  try {
+    return projectionFromResult(
+      await oneJson(
+        db,
+        sql`select managed_auth_session_set_bootstrap(
+          ${input.authorityHash}, ${input.csrfHash}, ${input.authSessionId}, ${input.mode},
+          ${input.operationId}::uuid, ${input.requestDigest},
+          ${input.expectedGeneration}::bigint, ${input.expectedActorEpoch}::bigint
+        ) as result`
+      )
+    );
+  } catch (error) {
+    mapSqlError(error);
+  }
+}
+async function beginManagedAuthLoginTransaction(db, input) {
+  try {
+    const value = await oneJson(
+      db,
+      sql`select managed_auth_session_set_begin_transaction(
+          ${input.authorityHash}, ${input.csrfHash},
+          ${input.rateScopeHash ?? input.authorityHash}, ${input.operationId}::uuid,
+          ${input.requestDigest}, ${input.expectedGeneration}::bigint,
+          ${input.transactionId}::uuid, ${input.expectedActorEpoch}::bigint,
+          ${input.transactionSecretHash}, ${input.kind},
+          ${input.targetSlotId}::uuid, ${input.returnIntentId}::uuid,
+          ${input.returnPath}, ${input.expiresAt.toISOString()}::timestamptz
+        ) as result`
+    );
+    return ManagedAuthLoginTransaction.parse({
+      ...value,
+      expiresAt: typeof value?.expiresAt === "string" || value?.expiresAt instanceof Date ? new Date(value.expiresAt).toISOString() : value?.expiresAt
+    });
+  } catch (error) {
+    mapSqlError(error);
+  }
+}
+async function completeManagedAuthLoginTransaction(db, input) {
+  try {
+    const result = await oneJson(
+      db,
+      sql`select managed_auth_session_set_complete_transaction(
+        ${input.authorityHash}, ${input.csrfHash}, ${input.operationId}::uuid,
+        ${input.requestDigest}, ${input.expectedGeneration}::bigint,
+        ${input.expectedActorEpoch}::bigint,
+        ${input.transactionId}::uuid, ${input.transactionSecretHash},
+        ${input.authSessionId}, ${input.mode}
+      ) as result`
+    );
+    return {
+      projection: DatabaseProjection.parse(result.projection),
+      returnIntent: result.returnIntent ?? null
+    };
+  } catch (error) {
+    mapSqlError(error);
+  }
+}
+async function mutateManagedAuthSessionSet(db, input) {
+  try {
+    const result = await oneJson(
+      db,
+      sql`select managed_auth_session_set_mutate(
+        ${input.authorityHash}, ${input.csrfHash}, ${input.operationId}::uuid,
+        ${input.requestDigest}, ${input.expectedGeneration}::bigint,
+        ${input.expectedActorEpoch}::bigint, ${input.operationType},
+        ${input.targetSlotId ?? null}::uuid, ${input.replacementSlotId ?? null}::uuid,
+        ${input.transactionId ?? null}::uuid, ${input.transactionSecretHash ?? null}, ${input.mode}
+      ) as result`
+    );
+    if (input.operationType === "logout_all") return ManagedAuthLogoutAllReceipt.parse(result);
+    return projectionFromResult(result);
+  } catch (error) {
+    mapSqlError(error);
+  }
+}
+async function getManagedAuthSessionSetOperationReceipt(db, input) {
+  const result = await oneJson(
+    db,
+    sql`select managed_auth_session_set_operation_receipt(
+      ${input.authorityHash}, ${input.operationId}::uuid, ${input.requestDigest}, 'complete'
+    ) as result`
+  );
+  if (!result?.projection) return null;
+  return {
+    projection: DatabaseProjection.parse(result.projection),
+    returnIntent: result.returnIntent ?? null
+  };
+}
+async function acquireManagedAuthActorMutationLease(db, input) {
+  try {
+    const [row] = await rawRows(
+      db,
+      sql`select managed_auth_actor_mutation_lease_acquire(
+        ${input.authorityHash}, ${input.actorEpoch}::bigint,
+        ${input.requestId}::uuid, ${input.leaseSeconds}::integer
+      ) as "expiresAt"`
+    );
+    if (!row) throw new ManagedAuthSessionSetAuthorityError("Mutation lease was not acquired");
+    return row.expiresAt instanceof Date ? row.expiresAt : new Date(row.expiresAt);
+  } catch (error) {
+    mapSqlError(error);
+  }
+}
+async function releaseManagedAuthActorMutationLease(db, input) {
+  try {
+    const [row] = await rawRows(
+      db,
+      sql`select managed_auth_actor_mutation_lease_release(
+        ${input.authorityHash}, ${input.requestId}::uuid
+      ) as released`
+    );
+    return row?.released === true;
+  } catch (error) {
+    mapSqlError(error);
+  }
+}
+async function getManagedAuthAdoptedSessionSnapshot(db, authSessionId) {
+  try {
+    const value = await oneJson(
+      db,
+      sql`select managed_auth_adopted_session_snapshot(${authSessionId}) as result`
+    );
+    if (value === null) return null;
+    if (!/^[0-9a-f]{64}$/.test(value.authorityHash) || !/^[1-9][0-9]*$/.test(value.actorEpoch)) {
+      throw new ManagedAuthSessionSetAuthorityError("Invalid adopted-session snapshot");
+    }
+    return value;
+  } catch (error) {
+    mapSqlError(error);
+  }
+}
+async function validateManagedAuthActorMutationLease(db, input) {
+  try {
+    const [row] = await rawRows(
+      db,
+      sql`select managed_auth_actor_mutation_lease_validate(
+        ${input.authorityHash}, ${input.actorEpoch}::bigint, ${input.requestId}::uuid
+      ) as valid`
+    );
+    return row?.valid === true;
+  } catch (error) {
+    mapSqlError(error);
+  }
+}
+async function reapManagedAuthIsolatedSessions(db, limit = 100) {
+  try {
+    const [row] = await rawRows(
+      db,
+      sql`select managed_auth_isolated_session_reap(${limit}::integer) as reaped`
+    );
+    return row?.reaped ?? 0;
+  } catch (error) {
+    mapSqlError(error);
+  }
+}
+async function reapExpiredManagedAuthSessionSets(db, limit = 100) {
+  try {
+    const [row] = await rawRows(
+      db,
+      sql`select managed_auth_expired_session_set_reap(${limit}::integer) as retired`
+    );
+    return row?.retired ?? 0;
+  } catch (error) {
+    mapSqlError(error);
+  }
+}
+
+export {
+  ManagedAuthSessionSetGenerationConflictError,
+  ManagedAuthSessionSetOperationReuseError,
+  ManagedAuthSessionSetAuthorityError,
+  ManagedAuthLoginSlotUnavailableError,
+  ManagedAuthLoginSlotLimitError,
+  ManagedAuthLoginSlotAlreadyExistsError,
+  ManagedAuthActorMutationInFlightError,
+  ManagedAuthLoginTransactionRateLimitError,
+  getManagedAuthSessionSetAuthorityState,
+  getManagedAuthSessionSetSnapshot,
+  bootstrapManagedAuthSessionSet,
+  beginManagedAuthLoginTransaction,
+  completeManagedAuthLoginTransaction,
+  mutateManagedAuthSessionSet,
+  getManagedAuthSessionSetOperationReceipt,
+  acquireManagedAuthActorMutationLease,
+  releaseManagedAuthActorMutationLease,
+  getManagedAuthAdoptedSessionSnapshot,
+  validateManagedAuthActorMutationLease,
+  reapManagedAuthIsolatedSessions,
+  reapExpiredManagedAuthSessionSets
+};
+//# sourceMappingURL=chunk-G3732M3T.js.map

package/dist/chunk-G3732M3T.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/managed-auth-session-sets.ts"],"sourcesContent":["import {\n  ManagedAuthLoginTransaction,\n  ManagedAuthLogoutAllReceipt,\n  ManagedAuthSessionSetProjection,\n  type ManagedAuthLoginTransaction as ManagedAuthLoginTransactionType,\n  type ManagedAuthLogoutAllReceipt as ManagedAuthLogoutAllReceiptType,\n  type ManagedAuthSessionSetMode,\n  type ManagedAuthSessionSetProjection as ManagedAuthSessionSetProjectionType,\n} from \"@opengeni/contracts/managed-auth-session-sets\";\nimport { sql, type SQL } from \"drizzle-orm\";\nimport type { Database } from \"./database\";\nimport { rawRows } from \"./database\";\nimport { nestedPostgresSqlState } from \"./persistence-errors\";\n\nconst DatabaseProjection = ManagedAuthSessionSetProjection.omit({ csrfToken: true });\nexport type ManagedAuthDatabaseProjection = Omit<ManagedAuthSessionSetProjectionType, \"csrfToken\">;\n\nexport type ManagedAuthSelectedSession = {\n  slotId: string;\n  authSessionId: string;\n  authUserId: string;\n  token: string;\n  email: string;\n  name: string;\n  emailVerified: boolean;\n};\n\nexport type ManagedAuthInternalSlot = ManagedAuthSelectedSession;\n\nexport type ManagedAuthAdoptedSessionSnapshot = {\n  authorityHash: string;\n  actorEpoch: string;\n  selected: ManagedAuthSelectedSession | null;\n};\n\nexport class ManagedAuthSessionSetGenerationConflictError extends Error {\n  readonly name = \"ManagedAuthSessionSetGenerationConflictError\";\n  readonly code = \"generation_conflict\";\n  constructor() {\n    super(\"The browser session set changed in another request\");\n  }\n}\n\nexport class ManagedAuthSessionSetOperationReuseError extends Error {\n  readonly name = \"ManagedAuthSessionSetOperationReuseError\";\n  constructor() {\n    super(\"The browser session-set operation id was reused for different input\");\n  }\n}\n\nexport class ManagedAuthSessionSetAuthorityError extends Error {\n  readonly name = \"ManagedAuthSessionSetAuthorityError\";\n}\n\nexport class ManagedAuthLoginSlotUnavailableError extends Error {\n  readonly name = \"ManagedAuthLoginSlotUnavailableError\";\n}\n\nexport class ManagedAuthLoginSlotLimitError extends Error {\n  readonly name = \"ManagedAuthLoginSlotLimitError\";\n}\n\nexport class ManagedAuthLoginSlotAlreadyExistsError extends Error {\n  readonly name = \"ManagedAuthLoginSlotAlreadyExistsError\";\n  readonly code = \"slot_already_exists\";\n}\n\nexport class ManagedAuthActorMutationInFlightError extends Error {\n  readonly name = \"ManagedAuthActorMutationInFlightError\";\n  readonly code = \"actor_mutation_in_flight\";\n}\n\nexport class ManagedAuthLoginTransactionRateLimitError extends Error {\n  readonly name = \"ManagedAuthLoginTransactionRateLimitError\";\n  readonly code = \"login_transaction_rate_limited\";\n}\n\nfunction mapSqlError(error: unknown): never {\n  const state = nestedPostgresSqlState(error);\n  if (state === \"40001\") throw new ManagedAuthSessionSetGenerationConflictError();\n  if (state === \"23505\") throw new ManagedAuthSessionSetOperationReuseError();\n  if (state === \"P0002\") throw new ManagedAuthLoginSlotUnavailableError();\n  if (state === \"P0003\") throw new ManagedAuthLoginSlotAlreadyExistsError();\n  if (state === \"54000\") throw new ManagedAuthLoginSlotLimitError();\n  if (state === \"55P03\") throw new ManagedAuthActorMutationInFlightError();\n  if (state === \"P0004\") throw new ManagedAuthLoginTransactionRateLimitError();\n  if (state === \"42501\") {\n    throw new ManagedAuthSessionSetAuthorityError(\n      error instanceof Error ? error.message : \"Browser session-set authority denied\",\n    );\n  }\n  throw error;\n}\n\nfunction jsonValue(value: unknown): unknown {\n  return typeof value === \"string\" ? JSON.parse(value) : value;\n}\n\nasync function oneJson(db: Database, query: SQL): Promise<unknown> {\n  const [row] = await rawRows<{ result: unknown }>(db, query);\n  return row ? jsonValue(row.result) : null;\n}\n\nfunction projectionFromResult(value: unknown): ManagedAuthDatabaseProjection {\n  const projection = (value as { projection?: unknown } | null)?.projection;\n  return DatabaseProjection.parse(projection);\n}\n\nexport async function getManagedAuthSessionSetAuthorityState(\n  db: Database,\n  authorityHash: string,\n): Promise<\"absent\" | \"active\" | \"retired\"> {\n  try {\n    const [row] = await rawRows<{ state: string }>(\n      db,\n      sql`select managed_auth_session_set_authority_state(${authorityHash}) as state`,\n    );\n    const value = row?.state;\n    if (value === \"absent\" || value === \"active\" || value === \"retired\") return value;\n    throw new ManagedAuthSessionSetAuthorityError(\"Invalid browser session-set authority state\");\n  } catch (error) {\n    mapSqlError(error);\n  }\n}\n\nexport async function getManagedAuthSessionSetSnapshot(\n  db: Database,\n  input: {\n    authorityHash: string;\n    mode: ManagedAuthSessionSetMode;\n    includeInternal?: boolean;\n    allowRecovery?: boolean;\n    readOnly?: boolean;\n  },\n): Promise<{\n  projection: ManagedAuthDatabaseProjection;\n  selected: ManagedAuthSelectedSession | null;\n  internalSlots: ManagedAuthInternalSlot[];\n} | null> {\n  try {\n    const value = await oneJson(\n      db,\n      sql`select managed_auth_session_set_snapshot(\n        ${input.authorityHash}, ${input.mode}, ${input.includeInternal ?? false},\n        ${input.allowRecovery ?? false}, ${input.readOnly ?? false}\n      ) as result`,\n    );\n    if (value === null) return null;\n    const snapshot = value as {\n      projection: unknown;\n      selected?: ManagedAuthSelectedSession | null;\n      internalSlots?: ManagedAuthInternalSlot[];\n    };\n    return {\n      projection: DatabaseProjection.parse(snapshot.projection),\n      selected: snapshot.selected ?? null,\n      internalSlots: snapshot.internalSlots ?? [],\n    };\n  } catch (error) {\n    mapSqlError(error);\n  }\n}\n\nexport async function bootstrapManagedAuthSessionSet(\n  db: Database,\n  input: {\n    authorityHash: string;\n    csrfHash: string;\n    authSessionId: string | null;\n    mode: ManagedAuthSessionSetMode;\n    operationId: string;\n    requestDigest: string;\n    expectedGeneration: string;\n    expectedActorEpoch: string;\n  },\n): Promise<ManagedAuthDatabaseProjection> {\n  try {\n    return projectionFromResult(\n      await oneJson(\n        db,\n        sql`select managed_auth_session_set_bootstrap(\n          ${input.authorityHash}, ${input.csrfHash}, ${input.authSessionId}, ${input.mode},\n          ${input.operationId}::uuid, ${input.requestDigest},\n          ${input.expectedGeneration}::bigint, ${input.expectedActorEpoch}::bigint\n        ) as result`,\n      ),\n    );\n  } catch (error) {\n    mapSqlError(error);\n  }\n}\n\nexport async function beginManagedAuthLoginTransaction(\n  db: Database,\n  input: {\n    authorityHash: string;\n    csrfHash: string;\n    rateScopeHash?: string;\n    operationId: string;\n    requestDigest: string;\n    expectedGeneration: string;\n    expectedActorEpoch: string;\n    transactionId: string;\n    transactionSecretHash: string;\n    kind: \"add\" | \"reauth\";\n    targetSlotId: string | null;\n    returnIntentId: string | null;\n    returnPath: string | null;\n    expiresAt: Date;\n  },\n): Promise<ManagedAuthLoginTransactionType> {\n  try {\n    const value = (await oneJson(\n      db,\n      sql`select managed_auth_session_set_begin_transaction(\n          ${input.authorityHash}, ${input.csrfHash},\n          ${input.rateScopeHash ?? input.authorityHash}, ${input.operationId}::uuid,\n          ${input.requestDigest}, ${input.expectedGeneration}::bigint,\n          ${input.transactionId}::uuid, ${input.expectedActorEpoch}::bigint,\n          ${input.transactionSecretHash}, ${input.kind},\n          ${input.targetSlotId}::uuid, ${input.returnIntentId}::uuid,\n          ${input.returnPath}, ${input.expiresAt.toISOString()}::timestamptz\n        ) as result`,\n    )) as { expiresAt?: unknown } | null;\n    return ManagedAuthLoginTransaction.parse({\n      ...value,\n      expiresAt:\n        typeof value?.expiresAt === \"string\" || value?.expiresAt instanceof Date\n          ? new Date(value.expiresAt).toISOString()\n          : value?.expiresAt,\n    });\n  } catch (error) {\n    mapSqlError(error);\n  }\n}\n\nexport async function completeManagedAuthLoginTransaction(\n  db: Database,\n  input: {\n    authorityHash: string;\n    csrfHash: string;\n    operationId: string;\n    requestDigest: string;\n    expectedGeneration: string;\n    expectedActorEpoch: string;\n    transactionId: string;\n    transactionSecretHash: string;\n    authSessionId: string;\n    mode: ManagedAuthSessionSetMode;\n  },\n): Promise<{ projection: ManagedAuthDatabaseProjection; returnIntent: string | null }> {\n  try {\n    const result = (await oneJson(\n      db,\n      sql`select managed_auth_session_set_complete_transaction(\n        ${input.authorityHash}, ${input.csrfHash}, ${input.operationId}::uuid,\n        ${input.requestDigest}, ${input.expectedGeneration}::bigint,\n        ${input.expectedActorEpoch}::bigint,\n        ${input.transactionId}::uuid, ${input.transactionSecretHash},\n        ${input.authSessionId}, ${input.mode}\n      ) as result`,\n    )) as { projection: unknown; returnIntent?: string | null };\n    return {\n      projection: DatabaseProjection.parse(result.projection),\n      returnIntent: result.returnIntent ?? null,\n    };\n  } catch (error) {\n    mapSqlError(error);\n  }\n}\n\nexport async function mutateManagedAuthSessionSet(\n  db: Database,\n  input: {\n    authorityHash: string;\n    csrfHash: string;\n    operationId: string;\n    requestDigest: string;\n    expectedGeneration: string;\n    expectedActorEpoch: string;\n    operationType: \"cancel_transaction\" | \"select\" | \"logout_one\" | \"logout_all\";\n    targetSlotId?: string | null;\n    replacementSlotId?: string | null;\n    transactionId?: string | null;\n    transactionSecretHash?: string | null;\n    mode: ManagedAuthSessionSetMode;\n  },\n): Promise<ManagedAuthDatabaseProjection | ManagedAuthLogoutAllReceiptType> {\n  try {\n    const result = await oneJson(\n      db,\n      sql`select managed_auth_session_set_mutate(\n        ${input.authorityHash}, ${input.csrfHash}, ${input.operationId}::uuid,\n        ${input.requestDigest}, ${input.expectedGeneration}::bigint,\n        ${input.expectedActorEpoch}::bigint, ${input.operationType},\n        ${input.targetSlotId ?? null}::uuid, ${input.replacementSlotId ?? null}::uuid,\n        ${input.transactionId ?? null}::uuid, ${input.transactionSecretHash ?? null}, ${input.mode}\n      ) as result`,\n    );\n    if (input.operationType === \"logout_all\") return ManagedAuthLogoutAllReceipt.parse(result);\n    return projectionFromResult(result);\n  } catch (error) {\n    mapSqlError(error);\n  }\n}\n\nexport async function getManagedAuthSessionSetOperationReceipt(\n  db: Database,\n  input: { authorityHash: string; operationId: string; requestDigest: string },\n): Promise<{ projection: ManagedAuthDatabaseProjection; returnIntent: string | null } | null> {\n  const result = (await oneJson(\n    db,\n    sql`select managed_auth_session_set_operation_receipt(\n      ${input.authorityHash}, ${input.operationId}::uuid, ${input.requestDigest}, 'complete'\n    ) as result`,\n  )) as { projection?: unknown; returnIntent?: string | null } | null;\n  if (!result?.projection) return null;\n  return {\n    projection: DatabaseProjection.parse(result.projection),\n    returnIntent: result.returnIntent ?? null,\n  };\n}\n\nexport async function acquireManagedAuthActorMutationLease(\n  db: Database,\n  input: {\n    authorityHash: string;\n    actorEpoch: string;\n    requestId: string;\n    leaseSeconds: number;\n  },\n): Promise<Date> {\n  try {\n    const [row] = await rawRows<{ expiresAt: Date | string }>(\n      db,\n      sql`select managed_auth_actor_mutation_lease_acquire(\n        ${input.authorityHash}, ${input.actorEpoch}::bigint,\n        ${input.requestId}::uuid, ${input.leaseSeconds}::integer\n      ) as \"expiresAt\"`,\n    );\n    if (!row) throw new ManagedAuthSessionSetAuthorityError(\"Mutation lease was not acquired\");\n    return row.expiresAt instanceof Date ? row.expiresAt : new Date(row.expiresAt);\n  } catch (error) {\n    mapSqlError(error);\n  }\n}\n\nexport async function releaseManagedAuthActorMutationLease(\n  db: Database,\n  input: { authorityHash: string; requestId: string },\n): Promise<boolean> {\n  try {\n    const [row] = await rawRows<{ released: boolean }>(\n      db,\n      sql`select managed_auth_actor_mutation_lease_release(\n        ${input.authorityHash}, ${input.requestId}::uuid\n      ) as released`,\n    );\n    return row?.released === true;\n  } catch (error) {\n    mapSqlError(error);\n  }\n}\n\n/** Classify a legacy ambient session once it has entered session-set authority. */\nexport async function getManagedAuthAdoptedSessionSnapshot(\n  db: Database,\n  authSessionId: string,\n): Promise<ManagedAuthAdoptedSessionSnapshot | null> {\n  try {\n    const value = (await oneJson(\n      db,\n      sql`select managed_auth_adopted_session_snapshot(${authSessionId}) as result`,\n    )) as ManagedAuthAdoptedSessionSnapshot | null;\n    if (value === null) return null;\n    if (!/^[0-9a-f]{64}$/.test(value.authorityHash) || !/^[1-9][0-9]*$/.test(value.actorEpoch)) {\n      throw new ManagedAuthSessionSetAuthorityError(\"Invalid adopted-session snapshot\");\n    }\n    return value;\n  } catch (error) {\n    mapSqlError(error);\n  }\n}\n\n/** Exact post-handler proof that the request-owned actor lease is still live. */\nexport async function validateManagedAuthActorMutationLease(\n  db: Database,\n  input: { authorityHash: string; actorEpoch: string; requestId: string },\n): Promise<boolean> {\n  try {\n    const [row] = await rawRows<{ valid: boolean }>(\n      db,\n      sql`select managed_auth_actor_mutation_lease_validate(\n        ${input.authorityHash}, ${input.actorEpoch}::bigint, ${input.requestId}::uuid\n      ) as valid`,\n    );\n    return row?.valid === true;\n  } catch (error) {\n    mapSqlError(error);\n  }\n}\n\n/** Bounded cleanup for provider sessions left by a process death before adoption. */\nexport async function reapManagedAuthIsolatedSessions(db: Database, limit = 100): Promise<number> {\n  try {\n    const [row] = await rawRows<{ reaped: number }>(\n      db,\n      sql`select managed_auth_isolated_session_reap(${limit}::integer) as reaped`,\n    );\n    return row?.reaped ?? 0;\n  } catch (error) {\n    mapSqlError(error);\n  }\n}\n\n/** Bounded, lease-aware retirement of expired installation/session-set authority. */\nexport async function reapExpiredManagedAuthSessionSets(\n  db: Database,\n  limit = 100,\n): Promise<number> {\n  try {\n    const [row] = await rawRows<{ retired: number }>(\n      db,\n      sql`select managed_auth_expired_session_set_reap(${limit}::integer) as retired`,\n    );\n    return row?.retired ?? 0;\n  } catch (error) {\n    mapSqlError(error);\n  }\n}\n"],"mappings":";;;;;;AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAKK;AACP,SAAS,WAAqB;AAK9B,IAAM,qBAAqB,gCAAgC,KAAK,EAAE,WAAW,KAAK,CAAC;AAqB5E,IAAM,+CAAN,cAA2D,MAAM;AAAA,EAC7D,OAAO;AAAA,EACP,OAAO;AAAA,EAChB,cAAc;AACZ,UAAM,oDAAoD;AAAA,EAC5D;AACF;AAEO,IAAM,2CAAN,cAAuD,MAAM;AAAA,EACzD,OAAO;AAAA,EAChB,cAAc;AACZ,UAAM,qEAAqE;AAAA,EAC7E;AACF;AAEO,IAAM,sCAAN,cAAkD,MAAM;AAAA,EACpD,OAAO;AAClB;AAEO,IAAM,uCAAN,cAAmD,MAAM;AAAA,EACrD,OAAO;AAClB;AAEO,IAAM,iCAAN,cAA6C,MAAM;AAAA,EAC/C,OAAO;AAClB;AAEO,IAAM,yCAAN,cAAqD,MAAM;AAAA,EACvD,OAAO;AAAA,EACP,OAAO;AAClB;AAEO,IAAM,wCAAN,cAAoD,MAAM;AAAA,EACtD,OAAO;AAAA,EACP,OAAO;AAClB;AAEO,IAAM,4CAAN,cAAwD,MAAM;AAAA,EAC1D,OAAO;AAAA,EACP,OAAO;AAClB;AAEA,SAAS,YAAY,OAAuB;AAC1C,QAAM,QAAQ,uBAAuB,KAAK;AAC1C,MAAI,UAAU,QAAS,OAAM,IAAI,6CAA6C;AAC9E,MAAI,UAAU,QAAS,OAAM,IAAI,yCAAyC;AAC1E,MAAI,UAAU,QAAS,OAAM,IAAI,qCAAqC;AACtE,MAAI,UAAU,QAAS,OAAM,IAAI,uCAAuC;AACxE,MAAI,UAAU,QAAS,OAAM,IAAI,+BAA+B;AAChE,MAAI,UAAU,QAAS,OAAM,IAAI,sCAAsC;AACvE,MAAI,UAAU,QAAS,OAAM,IAAI,0CAA0C;AAC3E,MAAI,UAAU,SAAS;AACrB,UAAM,IAAI;AAAA,MACR,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAC3C;AAAA,EACF;AACA,QAAM;AACR;AAEA,SAAS,UAAU,OAAyB;AAC1C,SAAO,OAAO,UAAU,WAAW,KAAK,MAAM,KAAK,IAAI;AACzD;AAEA,eAAe,QAAQ,IAAc,OAA8B;AACjE,QAAM,CAAC,GAAG,IAAI,MAAM,QAA6B,IAAI,KAAK;AAC1D,SAAO,MAAM,UAAU,IAAI,MAAM,IAAI;AACvC;AAEA,SAAS,qBAAqB,OAA+C;AAC3E,QAAM,aAAc,OAA2C;AAC/D,SAAO,mBAAmB,MAAM,UAAU;AAC5C;AAEA,eAAsB,uCACpB,IACA,eAC0C;AAC1C,MAAI;AACF,UAAM,CAAC,GAAG,IAAI,MAAM;AAAA,MAClB;AAAA,MACA,sDAAsD,aAAa;AAAA,IACrE;AACA,UAAM,QAAQ,KAAK;AACnB,QAAI,UAAU,YAAY,UAAU,YAAY,UAAU,UAAW,QAAO;AAC5E,UAAM,IAAI,oCAAoC,6CAA6C;AAAA,EAC7F,SAAS,OAAO;AACd,gBAAY,KAAK;AAAA,EACnB;AACF;AAEA,eAAsB,iCACpB,IACA,OAWQ;AACR,MAAI;AACF,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,UACI,MAAM,aAAa,KAAK,MAAM,IAAI,KAAK,MAAM,mBAAmB,KAAK;AAAA,UACrE,MAAM,iBAAiB,KAAK,KAAK,MAAM,YAAY,KAAK;AAAA;AAAA,IAE9D;AACA,QAAI,UAAU,KAAM,QAAO;AAC3B,UAAM,WAAW;AAKjB,WAAO;AAAA,MACL,YAAY,mBAAmB,MAAM,SAAS,UAAU;AAAA,MACxD,UAAU,SAAS,YAAY;AAAA,MAC/B,eAAe,SAAS,iBAAiB,CAAC;AAAA,IAC5C;AAAA,EACF,SAAS,OAAO;AACd,gBAAY,KAAK;AAAA,EACnB;AACF;AAEA,eAAsB,+BACpB,IACA,OAUwC;AACxC,MAAI;AACF,WAAO;AAAA,MACL,MAAM;AAAA,QACJ;AAAA,QACA;AAAA,YACI,MAAM,aAAa,KAAK,MAAM,QAAQ,KAAK,MAAM,aAAa,KAAK,MAAM,IAAI;AAAA,YAC7E,MAAM,WAAW,WAAW,MAAM,aAAa;AAAA,YAC/C,MAAM,kBAAkB,aAAa,MAAM,kBAAkB;AAAA;AAAA,MAEnE;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,gBAAY,KAAK;AAAA,EACnB;AACF;AAEA,eAAsB,iCACpB,IACA,OAgB0C;AAC1C,MAAI;AACF,UAAM,QAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,YACM,MAAM,aAAa,KAAK,MAAM,QAAQ;AAAA,YACtC,MAAM,iBAAiB,MAAM,aAAa,KAAK,MAAM,WAAW;AAAA,YAChE,MAAM,aAAa,KAAK,MAAM,kBAAkB;AAAA,YAChD,MAAM,aAAa,WAAW,MAAM,kBAAkB;AAAA,YACtD,MAAM,qBAAqB,KAAK,MAAM,IAAI;AAAA,YAC1C,MAAM,YAAY,WAAW,MAAM,cAAc;AAAA,YACjD,MAAM,UAAU,KAAK,MAAM,UAAU,YAAY,CAAC;AAAA;AAAA,IAE1D;AACA,WAAO,4BAA4B,MAAM;AAAA,MACvC,GAAG;AAAA,MACH,WACE,OAAO,OAAO,cAAc,YAAY,OAAO,qBAAqB,OAChE,IAAI,KAAK,MAAM,SAAS,EAAE,YAAY,IACtC,OAAO;AAAA,IACf,CAAC;AAAA,EACH,SAAS,OAAO;AACd,gBAAY,KAAK;AAAA,EACnB;AACF;AAEA,eAAsB,oCACpB,IACA,OAYqF;AACrF,MAAI;AACF,UAAM,SAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,UACI,MAAM,aAAa,KAAK,MAAM,QAAQ,KAAK,MAAM,WAAW;AAAA,UAC5D,MAAM,aAAa,KAAK,MAAM,kBAAkB;AAAA,UAChD,MAAM,kBAAkB;AAAA,UACxB,MAAM,aAAa,WAAW,MAAM,qBAAqB;AAAA,UACzD,MAAM,aAAa,KAAK,MAAM,IAAI;AAAA;AAAA,IAExC;AACA,WAAO;AAAA,MACL,YAAY,mBAAmB,MAAM,OAAO,UAAU;AAAA,MACtD,cAAc,OAAO,gBAAgB;AAAA,IACvC;AAAA,EACF,SAAS,OAAO;AACd,gBAAY,KAAK;AAAA,EACnB;AACF;AAEA,eAAsB,4BACpB,IACA,OAc0E;AAC1E,MAAI;AACF,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,UACI,MAAM,aAAa,KAAK,MAAM,QAAQ,KAAK,MAAM,WAAW;AAAA,UAC5D,MAAM,aAAa,KAAK,MAAM,kBAAkB;AAAA,UAChD,MAAM,kBAAkB,aAAa,MAAM,aAAa;AAAA,UACxD,MAAM,gBAAgB,IAAI,WAAW,MAAM,qBAAqB,IAAI;AAAA,UACpE,MAAM,iBAAiB,IAAI,WAAW,MAAM,yBAAyB,IAAI,KAAK,MAAM,IAAI;AAAA;AAAA,IAE9F;AACA,QAAI,MAAM,kBAAkB,aAAc,QAAO,4BAA4B,MAAM,MAAM;AACzF,WAAO,qBAAqB,MAAM;AAAA,EACpC,SAAS,OAAO;AACd,gBAAY,KAAK;AAAA,EACnB;AACF;AAEA,eAAsB,yCACpB,IACA,OAC4F;AAC5F,QAAM,SAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,QACI,MAAM,aAAa,KAAK,MAAM,WAAW,WAAW,MAAM,aAAa;AAAA;AAAA,EAE7E;AACA,MAAI,CAAC,QAAQ,WAAY,QAAO;AAChC,SAAO;AAAA,IACL,YAAY,mBAAmB,MAAM,OAAO,UAAU;AAAA,IACtD,cAAc,OAAO,gBAAgB;AAAA,EACvC;AACF;AAEA,eAAsB,qCACpB,IACA,OAMe;AACf,MAAI;AACF,UAAM,CAAC,GAAG,IAAI,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,UACI,MAAM,aAAa,KAAK,MAAM,UAAU;AAAA,UACxC,MAAM,SAAS,WAAW,MAAM,YAAY;AAAA;AAAA,IAElD;AACA,QAAI,CAAC,IAAK,OAAM,IAAI,oCAAoC,iCAAiC;AACzF,WAAO,IAAI,qBAAqB,OAAO,IAAI,YAAY,IAAI,KAAK,IAAI,SAAS;AAAA,EAC/E,SAAS,OAAO;AACd,gBAAY,KAAK;AAAA,EACnB;AACF;AAEA,eAAsB,qCACpB,IACA,OACkB;AAClB,MAAI;AACF,UAAM,CAAC,GAAG,IAAI,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,UACI,MAAM,aAAa,KAAK,MAAM,SAAS;AAAA;AAAA,IAE7C;AACA,WAAO,KAAK,aAAa;AAAA,EAC3B,SAAS,OAAO;AACd,gBAAY,KAAK;AAAA,EACnB;AACF;AAGA,eAAsB,qCACpB,IACA,eACmD;AACnD,MAAI;AACF,UAAM,QAAS,MAAM;AAAA,MACnB;AAAA,MACA,mDAAmD,aAAa;AAAA,IAClE;AACA,QAAI,UAAU,KAAM,QAAO;AAC3B,QAAI,CAAC,iBAAiB,KAAK,MAAM,aAAa,KAAK,CAAC,gBAAgB,KAAK,MAAM,UAAU,GAAG;AAC1F,YAAM,IAAI,oCAAoC,kCAAkC;AAAA,IAClF;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,gBAAY,KAAK;AAAA,EACnB;AACF;AAGA,eAAsB,sCACpB,IACA,OACkB;AAClB,MAAI;AACF,UAAM,CAAC,GAAG,IAAI,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,UACI,MAAM,aAAa,KAAK,MAAM,UAAU,aAAa,MAAM,SAAS;AAAA;AAAA,IAE1E;AACA,WAAO,KAAK,UAAU;AAAA,EACxB,SAAS,OAAO;AACd,gBAAY,KAAK;AAAA,EACnB;AACF;AAGA,eAAsB,gCAAgC,IAAc,QAAQ,KAAsB;AAChG,MAAI;AACF,UAAM,CAAC,GAAG,IAAI,MAAM;AAAA,MAClB;AAAA,MACA,gDAAgD,KAAK;AAAA,IACvD;AACA,WAAO,KAAK,UAAU;AAAA,EACxB,SAAS,OAAO;AACd,gBAAY,KAAK;AAAA,EACnB;AACF;AAGA,eAAsB,kCACpB,IACA,QAAQ,KACS;AACjB,MAAI;AACF,UAAM,CAAC,GAAG,IAAI,MAAM;AAAA,MAClB;AAAA,MACA,mDAAmD,KAAK;AAAA,IAC1D;AACA,WAAO,KAAK,WAAW;AAAA,EACzB,SAAS,OAAO;AACd,gBAAY,KAAK;AAAA,EACnB;AACF;","names":[]}

package/dist/{chunk-TRBOWUG3.js → chunk-IW6O6G7R.js}

@@ -5,7 +5,7 @@ import {
   withWorkspaceRls,
   withWorkspaceSubjectRls,
   withWorkspaceSubjectSessionActivityRls
-} from "./chunk-H7MXYG7R.js";
+} from "./chunk-WW7AJ5IC.js";
 
 // src/session-tenancy.ts
 import { createHash } from "crypto";
@@ -481,4 +481,4 @@ export {
   forkSessionContent,
   replayAppliedSessionFork
 };
-//# sourceMappingURL=chunk-TRBOWUG3.js.map
+//# sourceMappingURL=chunk-IW6O6G7R.js.map

package/dist/{chunk-HY3F5Q4E.js → chunk-Q5YUGQVK.js}

@@ -2,7 +2,7 @@ import {
   rawRows,
   withRlsContext,
   withWorkspaceRls
-} from "./chunk-H7MXYG7R.js";
+} from "./chunk-WW7AJ5IC.js";
 import {
   connections,
   creditLedgerEntries,
@@ -14,7 +14,7 @@ import {
   workspaceVideoGenerationPolicies,
   workspaceVideoGenerationQuotas,
   workspaces
-} from "./chunk-C2AFP7SB.js";
+} from "./chunk-UJ2EW3QI.js";
 
 // src/video-generation.ts
 import {
@@ -992,4 +992,4 @@ export {
   mediaGenerationResultForStoredOperation,
   getVideoGenerationOperationSummary
 };
-//# sourceMappingURL=chunk-HY3F5Q4E.js.map
+//# sourceMappingURL=chunk-Q5YUGQVK.js.map

package/dist/{chunk-V3TRUXFJ.js → chunk-UGDVSQ6U.js}

@@ -1,7 +1,7 @@
 import {
   nestedPostgresSqlState,
   rawRows
-} from "./chunk-H7MXYG7R.js";
+} from "./chunk-WW7AJ5IC.js";
 
 // src/canonical-human-identities.ts
 import { createHash } from "crypto";
@@ -10,6 +10,22 @@ import {
   CanonicalHumanIdentityProjection
 } from "@opengeni/contracts/canonical-human-identities";
 import { sql } from "drizzle-orm";
+async function getCanonicalHumanExactLoginBindingForAuthUser(db, input) {
+  const [row] = await rawRows(
+    db,
+    sql`
+      select get_canonical_human_exact_login_binding(
+        ${input.authUserId}, ${input.providerId}
+      ) as result
+    `
+  );
+  if (!row?.result) {
+    throw new CanonicalHumanIdentityAuthorityError(
+      "Authentication did not prove exactly one canonical login binding"
+    );
+  }
+  return { ...row.result, revision: Number(row.result.revision) };
+}
 var CanonicalHumanIdentityConflictError = class extends Error {
   name = "CanonicalHumanIdentityConflictError";
   code = "CANONICAL_HUMAN_IDENTITY_CONFLICT";
@@ -24,6 +40,13 @@ var CanonicalHumanIdentityOperationReuseError = class extends Error {
     super("The canonical human identity operation id was already used for another request");
   }
 };
+var CanonicalHumanIdentityMutationInFlightError = class extends Error {
+  name = "CanonicalHumanIdentityMutationInFlightError";
+  code = "CANONICAL_HUMAN_IDENTITY_MUTATION_IN_FLIGHT";
+  constructor() {
+    super("Another request is still using this browser actor");
+  }
+};
 var CanonicalHumanIdentityNotFoundError = class extends Error {
   name = "CanonicalHumanIdentityNotFoundError";
   constructor(message = "Canonical human identity was not found") {
@@ -48,6 +71,7 @@ function mapSqlError(error) {
   const state = nestedPostgresSqlState(error);
   if (state === "40001") throw new CanonicalHumanIdentityConflictError();
   if (state === "23505") throw new CanonicalHumanIdentityOperationReuseError();
+  if (state === "55P03") throw new CanonicalHumanIdentityMutationInFlightError();
   if (state === "P0002") throw new CanonicalHumanIdentityNotFoundError();
   if (state === "42501") {
     throw new CanonicalHumanIdentityAuthorityError(
@@ -81,6 +105,17 @@ async function ensureCanonicalHumanIdentity(db, input) {
   }
 }
 async function ensureCanonicalHumanIdentityForAuthUser(db, authUserId) {
+  try {
+    const existing = await getCanonicalHumanIdentityProjection(db, authUserId);
+    return {
+      identityId: existing.activeIdentity.id,
+      identityRevision: existing.activeIdentity.identityRevision,
+      authRevision: existing.activeIdentity.authRevision,
+      identityStatus: existing.activeIdentity.status
+    };
+  } catch (error) {
+    if (!(error instanceof CanonicalHumanIdentityNotFoundError)) throw error;
+  }
   const [user] = await rawRows(
     db,
     sql`
@@ -209,9 +244,31 @@ async function getCanonicalHumanIdentityProjection(db, authUserId) {
 }
 async function applyCanonicalHumanIdentityOperation(db, input) {
   try {
-    const [row] = await rawRows(
-      db,
-      sql`
+    if (input.actorFence) {
+      return await db.transaction(async (tx) => {
+        const txDb = tx;
+        await rawRows(
+          txDb,
+          sql`select managed_auth_actor_mutation_fence(
+            ${input.actorFence.authorityHash}, ${input.actorFence.actorEpoch}::bigint,
+            ${input.actorFence.requestId}::uuid
+          )`
+        );
+        return await applyCanonicalHumanIdentityOperationInner(txDb, input);
+      });
+    }
+    return await applyCanonicalHumanIdentityOperationInner(db, input);
+  } catch (error) {
+    if (error instanceof CanonicalHumanIdentityConflictError || error instanceof CanonicalHumanIdentityOperationReuseError || error instanceof CanonicalHumanIdentityMutationInFlightError || error instanceof CanonicalHumanIdentityNotFoundError || error instanceof CanonicalHumanIdentityAuthorityError) {
+      throw error;
+    }
+    mapSqlError(error);
+  }
+}
+async function applyCanonicalHumanIdentityOperationInner(db, input) {
+  const [row] = await rawRows(
+    db,
+    sql`
         select
           outcome,
           identity_id as "identityId",
@@ -228,25 +285,21 @@ async function applyCanonicalHumanIdentityOperation(db, input) {
           ${input.reason}
         )
       `
-    );
-    if (!row) throw new CanonicalHumanIdentityNotFoundError();
-    const identity = await getCanonicalHumanIdentityProjection(db, input.authUserId);
-    return CanonicalHumanIdentityMutationResponse.parse({
-      outcome: row.outcome,
-      operationId: input.operationId,
-      identity
-    });
-  } catch (error) {
-    if (error instanceof CanonicalHumanIdentityConflictError || error instanceof CanonicalHumanIdentityOperationReuseError || error instanceof CanonicalHumanIdentityNotFoundError || error instanceof CanonicalHumanIdentityAuthorityError) {
-      throw error;
-    }
-    mapSqlError(error);
-  }
+  );
+  if (!row) throw new CanonicalHumanIdentityNotFoundError();
+  const identity = await getCanonicalHumanIdentityProjection(db, input.authUserId);
+  return CanonicalHumanIdentityMutationResponse.parse({
+    outcome: row.outcome,
+    operationId: input.operationId,
+    identity
+  });
 }
 
 export {
+  getCanonicalHumanExactLoginBindingForAuthUser,
   CanonicalHumanIdentityConflictError,
   CanonicalHumanIdentityOperationReuseError,
+  CanonicalHumanIdentityMutationInFlightError,
   CanonicalHumanIdentityNotFoundError,
   CanonicalHumanIdentityAuthorityError,
   ensureCanonicalHumanIdentity,
@@ -256,4 +309,4 @@ export {
   getCanonicalHumanIdentityProjection,
   applyCanonicalHumanIdentityOperation
 };
-//# sourceMappingURL=chunk-V3TRUXFJ.js.map
+//# sourceMappingURL=chunk-UGDVSQ6U.js.map

package/dist/chunk-UGDVSQ6U.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/canonical-human-identities.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport {\n  CanonicalHumanIdentityMutationResponse,\n  CanonicalHumanIdentityProjection,\n  type CanonicalHumanIdentityMutationOutcome,\n  type CanonicalHumanIdentityMutationResponse as CanonicalHumanIdentityMutationResponseType,\n  type CanonicalHumanIdentityProjection as CanonicalHumanIdentityProjectionType,\n} from \"@opengeni/contracts/canonical-human-identities\";\nimport { sql } from \"drizzle-orm\";\nimport type { Database } from \"./database\";\nimport { rawRows } from \"./database\";\nimport { nestedPostgresSqlState } from \"./persistence-errors\";\n\nexport type CanonicalHumanSessionAuthority = {\n  identityId: string;\n  identityRevision: number;\n  authRevision: number;\n  identityStatus: \"active\" | \"recovery_required\" | \"disputed\" | \"disabled\";\n};\n\nexport type CanonicalHumanExactLoginBinding = {\n  id: string;\n  identityId: string;\n  revision: number;\n  status: \"active\" | \"recovery_pending\" | \"stale\" | \"disputed\" | \"revoked\";\n};\n\nexport async function getCanonicalHumanExactLoginBindingForAuthUser(\n  db: Database,\n  input: { authUserId: string; providerId: string },\n): Promise<CanonicalHumanExactLoginBinding> {\n  const [row] = await rawRows<{\n    result:\n      | (Omit<CanonicalHumanExactLoginBinding, \"revision\"> & { revision: number | string })\n      | null;\n  }>(\n    db,\n    sql`\n      select get_canonical_human_exact_login_binding(\n        ${input.authUserId}, ${input.providerId}\n      ) as result\n    `,\n  );\n  if (!row?.result) {\n    throw new CanonicalHumanIdentityAuthorityError(\n      \"Authentication did not prove exactly one canonical login binding\",\n    );\n  }\n  return { ...row.result, revision: Number(row.result.revision) };\n}\n\nexport class CanonicalHumanIdentityConflictError extends Error {\n  readonly name = \"CanonicalHumanIdentityConflictError\";\n  readonly code = \"CANONICAL_HUMAN_IDENTITY_CONFLICT\";\n\n  constructor() {\n    super(\"The canonical human identity changed in another request\");\n  }\n}\n\nexport class CanonicalHumanIdentityOperationReuseError extends Error {\n  readonly name = \"CanonicalHumanIdentityOperationReuseError\";\n  readonly code = \"CANONICAL_HUMAN_IDENTITY_OPERATION_REUSED\";\n\n  constructor() {\n    super(\"The canonical human identity operation id was already used for another request\");\n  }\n}\n\nexport class CanonicalHumanIdentityMutationInFlightError extends Error {\n  readonly name = \"CanonicalHumanIdentityMutationInFlightError\";\n  readonly code = \"CANONICAL_HUMAN_IDENTITY_MUTATION_IN_FLIGHT\";\n\n  constructor() {\n    super(\"Another request is still using this browser actor\");\n  }\n}\n\nexport class CanonicalHumanIdentityNotFoundError extends Error {\n  readonly name = \"CanonicalHumanIdentityNotFoundError\";\n\n  constructor(message = \"Canonical human identity was not found\") {\n    super(message);\n  }\n}\n\nexport class CanonicalHumanIdentityAuthorityError extends Error {\n  readonly name = \"CanonicalHumanIdentityAuthorityError\";\n}\n\nfunction deterministicOperationId(seed: string): string {\n  const bytes = createHash(\"sha256\").update(seed, \"utf8\").digest().subarray(0, 16);\n  bytes[6] = (bytes[6]! & 0x0f) | 0x50;\n  bytes[8] = (bytes[8]! & 0x3f) | 0x80;\n  const hex = bytes.toString(\"hex\");\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;\n}\n\nfunction projectionValue(value: unknown): unknown {\n  if (typeof value === \"string\") return JSON.parse(value);\n  return value;\n}\n\nfunction mapSqlError(error: unknown): never {\n  const state = nestedPostgresSqlState(error);\n  if (state === \"40001\") throw new CanonicalHumanIdentityConflictError();\n  if (state === \"23505\") throw new CanonicalHumanIdentityOperationReuseError();\n  if (state === \"55P03\") throw new CanonicalHumanIdentityMutationInFlightError();\n  if (state === \"P0002\") throw new CanonicalHumanIdentityNotFoundError();\n  if (state === \"42501\") {\n    throw new CanonicalHumanIdentityAuthorityError(\n      error instanceof Error ? error.message : \"Canonical human identity authority denied\",\n    );\n  }\n  throw error;\n}\n\nexport async function ensureCanonicalHumanIdentity(\n  db: Database,\n  input: { authUserId: string; displayName: string },\n): Promise<CanonicalHumanSessionAuthority> {\n  try {\n    const [row] = await rawRows<{\n      identityId: string;\n      identityRevision: number | string;\n      authRevision: number | string;\n      identityStatus: CanonicalHumanSessionAuthority[\"identityStatus\"];\n    }>(\n      db,\n      sql`\n        select\n          identity_id as \"identityId\",\n          identity_revision as \"identityRevision\",\n          auth_revision as \"authRevision\",\n          identity_status as \"identityStatus\"\n        from ensure_canonical_human_identity(${input.authUserId}, ${input.displayName})\n      `,\n    );\n    if (!row) throw new CanonicalHumanIdentityNotFoundError();\n    return {\n      identityId: row.identityId,\n      identityRevision: Number(row.identityRevision),\n      authRevision: Number(row.authRevision),\n      identityStatus: row.identityStatus,\n    };\n  } catch (error) {\n    mapSqlError(error);\n  }\n}\n\nexport async function ensureCanonicalHumanIdentityForAuthUser(\n  db: Database,\n  authUserId: string,\n): Promise<CanonicalHumanSessionAuthority> {\n  try {\n    const existing = await getCanonicalHumanIdentityProjection(db, authUserId);\n    return {\n      identityId: existing.activeIdentity.id,\n      identityRevision: existing.activeIdentity.identityRevision,\n      authRevision: existing.activeIdentity.authRevision,\n      identityStatus: existing.activeIdentity.status,\n    };\n  } catch (error) {\n    if (!(error instanceof CanonicalHumanIdentityNotFoundError)) throw error;\n  }\n  const [user] = await rawRows<{ displayName: string }>(\n    db,\n    sql`\n      select coalesce(nullif(btrim(name), ''), email) as \"displayName\"\n      from auth_users\n      where id = ${authUserId}\n      limit 1\n    `,\n  );\n  if (!user) throw new CanonicalHumanIdentityNotFoundError(\"Authentication user was not found\");\n  return await ensureCanonicalHumanIdentity(db, {\n    authUserId,\n    displayName: user.displayName,\n  });\n}\n\nexport async function synchronizeCanonicalHumanLoginBindings(\n  db: Database,\n  authUserId: string,\n): Promise<CanonicalHumanSessionAuthority> {\n  let authority = await ensureCanonicalHumanIdentityForAuthUser(db, authUserId);\n  const accounts = await rawRows<{\n    id: string;\n    providerId: string;\n    providerAccountId: string;\n  }>(\n    db,\n    sql`\n      select\n        id,\n        lower(provider_id) as \"providerId\",\n        account_id as \"providerAccountId\"\n      from auth_identities\n      where user_id = ${authUserId}\n      order by created_at, id\n    `,\n  );\n\n  for (const account of accounts) {\n    for (let attempt = 0; attempt < 4; attempt += 1) {\n      const projection = await getCanonicalHumanIdentityProjection(db, authUserId);\n      if (projection.activeIdentity.status !== \"active\") {\n        return {\n          identityId: projection.activeIdentity.id,\n          identityRevision: projection.activeIdentity.identityRevision,\n          authRevision: projection.activeIdentity.authRevision,\n          identityStatus: projection.activeIdentity.status,\n        };\n      }\n      const existing = projection.loginBindings.find(\n        (binding) =>\n          binding.providerId === account.providerId &&\n          binding.providerAccountId === account.providerAccountId,\n      );\n      if (existing?.status === \"active\") {\n        authority = {\n          identityId: projection.activeIdentity.id,\n          identityRevision: projection.activeIdentity.identityRevision,\n          authRevision: projection.activeIdentity.authRevision,\n          identityStatus: projection.activeIdentity.status,\n        };\n        break;\n      }\n      try {\n        const result = await applyCanonicalHumanIdentityOperation(db, {\n          operationId: deterministicOperationId(\n            `canonical-human-account-link\\n${account.id}\\n${projection.activeIdentity.identityRevision}`,\n          ),\n          authUserId,\n          expectedIdentityRevision: projection.activeIdentity.identityRevision,\n          operationType: \"link\",\n          providerId: account.providerId,\n          providerAccountId: account.providerAccountId,\n          reason: \"Synchronize verified authentication account\",\n        });\n        authority = {\n          identityId: result.identity.activeIdentity.id,\n          identityRevision: result.identity.activeIdentity.identityRevision,\n          authRevision: result.identity.activeIdentity.authRevision,\n          identityStatus: result.identity.activeIdentity.status,\n        };\n        break;\n      } catch (error) {\n        if (error instanceof CanonicalHumanIdentityConflictError && attempt < 3) continue;\n        if (error instanceof CanonicalHumanIdentityAuthorityError) {\n          const currentProjection = await getCanonicalHumanIdentityProjection(db, authUserId);\n          if (currentProjection.activeIdentity.status !== \"active\") {\n            return {\n              identityId: currentProjection.activeIdentity.id,\n              identityRevision: currentProjection.activeIdentity.identityRevision,\n              authRevision: currentProjection.activeIdentity.authRevision,\n              identityStatus: currentProjection.activeIdentity.status,\n            };\n          }\n        }\n        throw error;\n      }\n    }\n  }\n  return authority;\n}\n\nexport async function validateCanonicalHumanSession(\n  db: Database,\n  input: { authSessionId: string; authUserId: string; allowRecovery?: boolean },\n): Promise<boolean> {\n  try {\n    const [row] = await rawRows<{ valid: boolean }>(\n      db,\n      sql`\n        select validate_canonical_human_session(\n          ${input.authSessionId},\n          ${input.authUserId},\n          ${input.allowRecovery ?? false}\n        ) as valid\n      `,\n    );\n    return row?.valid === true;\n  } catch (error) {\n    mapSqlError(error);\n  }\n}\n\nexport async function getCanonicalHumanIdentityProjection(\n  db: Database,\n  authUserId: string,\n): Promise<CanonicalHumanIdentityProjectionType> {\n  try {\n    const [row] = await rawRows<{ projection: unknown }>(\n      db,\n      sql`\n        select get_canonical_human_identity_projection(${authUserId}) as projection\n      `,\n    );\n    if (row?.projection === null || row?.projection === undefined) {\n      throw new CanonicalHumanIdentityNotFoundError();\n    }\n    return CanonicalHumanIdentityProjection.parse(projectionValue(row.projection));\n  } catch (error) {\n    if (error instanceof CanonicalHumanIdentityNotFoundError) throw error;\n    mapSqlError(error);\n  }\n}\n\nexport type ApplyCanonicalHumanIdentityOperationInput = {\n  operationId: string;\n  authUserId: string;\n  expectedIdentityRevision: number;\n  operationType: \"link\" | \"unlink\" | \"begin_recovery\" | \"recover\";\n  bindingId?: string | null;\n  providerId?: string | null;\n  providerAccountId?: string | null;\n  reason: string;\n  actorFence?: {\n    authorityHash: string;\n    actorEpoch: string;\n    requestId: string;\n  };\n};\n\nexport async function applyCanonicalHumanIdentityOperation(\n  db: Database,\n  input: ApplyCanonicalHumanIdentityOperationInput,\n): Promise<CanonicalHumanIdentityMutationResponseType> {\n  try {\n    if (input.actorFence) {\n      return await db.transaction(async (tx) => {\n        const txDb = tx as unknown as Database;\n        await rawRows(\n          txDb,\n          sql`select managed_auth_actor_mutation_fence(\n            ${input.actorFence!.authorityHash}, ${input.actorFence!.actorEpoch}::bigint,\n            ${input.actorFence!.requestId}::uuid\n          )`,\n        );\n        return await applyCanonicalHumanIdentityOperationInner(txDb, input);\n      });\n    }\n    return await applyCanonicalHumanIdentityOperationInner(db, input);\n  } catch (error) {\n    if (\n      error instanceof CanonicalHumanIdentityConflictError ||\n      error instanceof CanonicalHumanIdentityOperationReuseError ||\n      error instanceof CanonicalHumanIdentityMutationInFlightError ||\n      error instanceof CanonicalHumanIdentityNotFoundError ||\n      error instanceof CanonicalHumanIdentityAuthorityError\n    ) {\n      throw error;\n    }\n    mapSqlError(error);\n  }\n}\n\nasync function applyCanonicalHumanIdentityOperationInner(\n  db: Database,\n  input: ApplyCanonicalHumanIdentityOperationInput,\n): Promise<CanonicalHumanIdentityMutationResponseType> {\n  const [row] = await rawRows<{\n    outcome: CanonicalHumanIdentityMutationOutcome;\n    identityId: string;\n    identityRevision: number | string;\n    authRevision: number | string;\n  }>(\n    db,\n    sql`\n        select\n          outcome,\n          identity_id as \"identityId\",\n          identity_revision as \"identityRevision\",\n          auth_revision as \"authRevision\"\n        from apply_canonical_human_identity_operation(\n          ${input.operationId},\n          ${input.authUserId},\n          ${input.expectedIdentityRevision},\n          ${input.operationType},\n          ${input.bindingId ?? null},\n          ${input.providerId ?? null},\n          ${input.providerAccountId ?? null},\n          ${input.reason}\n        )\n      `,\n  );\n  if (!row) throw new CanonicalHumanIdentityNotFoundError();\n  const identity = await getCanonicalHumanIdentityProjection(db, input.authUserId);\n  return CanonicalHumanIdentityMutationResponse.parse({\n    outcome: row.outcome,\n    operationId: input.operationId,\n    identity,\n  });\n}\n"],"mappings":";;;;;;AAAA,SAAS,kBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,OAIK;AACP,SAAS,WAAW;AAmBpB,eAAsB,8CACpB,IACA,OAC0C;AAC1C,QAAM,CAAC,GAAG,IAAI,MAAM;AAAA,IAKlB;AAAA,IACA;AAAA;AAAA,UAEM,MAAM,UAAU,KAAK,MAAM,UAAU;AAAA;AAAA;AAAA,EAG7C;AACA,MAAI,CAAC,KAAK,QAAQ;AAChB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,GAAG,IAAI,QAAQ,UAAU,OAAO,IAAI,OAAO,QAAQ,EAAE;AAChE;AAEO,IAAM,sCAAN,cAAkD,MAAM;AAAA,EACpD,OAAO;AAAA,EACP,OAAO;AAAA,EAEhB,cAAc;AACZ,UAAM,yDAAyD;AAAA,EACjE;AACF;AAEO,IAAM,4CAAN,cAAwD,MAAM;AAAA,EAC1D,OAAO;AAAA,EACP,OAAO;AAAA,EAEhB,cAAc;AACZ,UAAM,gFAAgF;AAAA,EACxF;AACF;AAEO,IAAM,8CAAN,cAA0D,MAAM;AAAA,EAC5D,OAAO;AAAA,EACP,OAAO;AAAA,EAEhB,cAAc;AACZ,UAAM,mDAAmD;AAAA,EAC3D;AACF;AAEO,IAAM,sCAAN,cAAkD,MAAM;AAAA,EACpD,OAAO;AAAA,EAEhB,YAAY,UAAU,0CAA0C;AAC9D,UAAM,OAAO;AAAA,EACf;AACF;AAEO,IAAM,uCAAN,cAAmD,MAAM;AAAA,EACrD,OAAO;AAClB;AAEA,SAAS,yBAAyB,MAAsB;AACtD,QAAM,QAAQ,WAAW,QAAQ,EAAE,OAAO,MAAM,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE;AAC/E,QAAM,CAAC,IAAK,MAAM,CAAC,IAAK,KAAQ;AAChC,QAAM,CAAC,IAAK,MAAM,CAAC,IAAK,KAAQ;AAChC,QAAM,MAAM,MAAM,SAAS,KAAK;AAChC,SAAO,GAAG,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC;AAC1G;AAEA,SAAS,gBAAgB,OAAyB;AAChD,MAAI,OAAO,UAAU,SAAU,QAAO,KAAK,MAAM,KAAK;AACtD,SAAO;AACT;AAEA,SAAS,YAAY,OAAuB;AAC1C,QAAM,QAAQ,uBAAuB,KAAK;AAC1C,MAAI,UAAU,QAAS,OAAM,IAAI,oCAAoC;AACrE,MAAI,UAAU,QAAS,OAAM,IAAI,0CAA0C;AAC3E,MAAI,UAAU,QAAS,OAAM,IAAI,4CAA4C;AAC7E,MAAI,UAAU,QAAS,OAAM,IAAI,oCAAoC;AACrE,MAAI,UAAU,SAAS;AACrB,UAAM,IAAI;AAAA,MACR,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAC3C;AAAA,EACF;AACA,QAAM;AACR;AAEA,eAAsB,6BACpB,IACA,OACyC;AACzC,MAAI;AACF,UAAM,CAAC,GAAG,IAAI,MAAM;AAAA,MAMlB;AAAA,MACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,+CAMyC,MAAM,UAAU,KAAK,MAAM,WAAW;AAAA;AAAA,IAEjF;AACA,QAAI,CAAC,IAAK,OAAM,IAAI,oCAAoC;AACxD,WAAO;AAAA,MACL,YAAY,IAAI;AAAA,MAChB,kBAAkB,OAAO,IAAI,gBAAgB;AAAA,MAC7C,cAAc,OAAO,IAAI,YAAY;AAAA,MACrC,gBAAgB,IAAI;AAAA,IACtB;AAAA,EACF,SAAS,OAAO;AACd,gBAAY,KAAK;AAAA,EACnB;AACF;AAEA,eAAsB,wCACpB,IACA,YACyC;AACzC,MAAI;AACF,UAAM,WAAW,MAAM,oCAAoC,IAAI,UAAU;AACzE,WAAO;AAAA,MACL,YAAY,SAAS,eAAe;AAAA,MACpC,kBAAkB,SAAS,eAAe;AAAA,MAC1C,cAAc,SAAS,eAAe;AAAA,MACtC,gBAAgB,SAAS,eAAe;AAAA,IAC1C;AAAA,EACF,SAAS,OAAO;AACd,QAAI,EAAE,iBAAiB,qCAAsC,OAAM;AAAA,EACrE;AACA,QAAM,CAAC,IAAI,IAAI,MAAM;AAAA,IACnB;AAAA,IACA;AAAA;AAAA;AAAA,mBAGe,UAAU;AAAA;AAAA;AAAA,EAG3B;AACA,MAAI,CAAC,KAAM,OAAM,IAAI,oCAAoC,mCAAmC;AAC5F,SAAO,MAAM,6BAA6B,IAAI;AAAA,IAC5C;AAAA,IACA,aAAa,KAAK;AAAA,EACpB,CAAC;AACH;AAEA,eAAsB,uCACpB,IACA,YACyC;AACzC,MAAI,YAAY,MAAM,wCAAwC,IAAI,UAAU;AAC5E,QAAM,WAAW,MAAM;AAAA,IAKrB;AAAA,IACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,wBAMoB,UAAU;AAAA;AAAA;AAAA,EAGhC;AAEA,aAAW,WAAW,UAAU;AAC9B,aAAS,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG;AAC/C,YAAM,aAAa,MAAM,oCAAoC,IAAI,UAAU;AAC3E,UAAI,WAAW,eAAe,WAAW,UAAU;AACjD,eAAO;AAAA,UACL,YAAY,WAAW,eAAe;AAAA,UACtC,kBAAkB,WAAW,eAAe;AAAA,UAC5C,cAAc,WAAW,eAAe;AAAA,UACxC,gBAAgB,WAAW,eAAe;AAAA,QAC5C;AAAA,MACF;AACA,YAAM,WAAW,WAAW,cAAc;AAAA,QACxC,CAAC,YACC,QAAQ,eAAe,QAAQ,cAC/B,QAAQ,sBAAsB,QAAQ;AAAA,MAC1C;AACA,UAAI,UAAU,WAAW,UAAU;AACjC,oBAAY;AAAA,UACV,YAAY,WAAW,eAAe;AAAA,UACtC,kBAAkB,WAAW,eAAe;AAAA,UAC5C,cAAc,WAAW,eAAe;AAAA,UACxC,gBAAgB,WAAW,eAAe;AAAA,QAC5C;AACA;AAAA,MACF;AACA,UAAI;AACF,cAAM,SAAS,MAAM,qCAAqC,IAAI;AAAA,UAC5D,aAAa;AAAA,YACX;AAAA,EAAiC,QAAQ,EAAE;AAAA,EAAK,WAAW,eAAe,gBAAgB;AAAA,UAC5F;AAAA,UACA;AAAA,UACA,0BAA0B,WAAW,eAAe;AAAA,UACpD,eAAe;AAAA,UACf,YAAY,QAAQ;AAAA,UACpB,mBAAmB,QAAQ;AAAA,UAC3B,QAAQ;AAAA,QACV,CAAC;AACD,oBAAY;AAAA,UACV,YAAY,OAAO,SAAS,eAAe;AAAA,UAC3C,kBAAkB,OAAO,SAAS,eAAe;AAAA,UACjD,cAAc,OAAO,SAAS,eAAe;AAAA,UAC7C,gBAAgB,OAAO,SAAS,eAAe;AAAA,QACjD;AACA;AAAA,MACF,SAAS,OAAO;AACd,YAAI,iBAAiB,uCAAuC,UAAU,EAAG;AACzE,YAAI,iBAAiB,sCAAsC;AACzD,gBAAM,oBAAoB,MAAM,oCAAoC,IAAI,UAAU;AAClF,cAAI,kBAAkB,eAAe,WAAW,UAAU;AACxD,mBAAO;AAAA,cACL,YAAY,kBAAkB,eAAe;AAAA,cAC7C,kBAAkB,kBAAkB,eAAe;AAAA,cACnD,cAAc,kBAAkB,eAAe;AAAA,cAC/C,gBAAgB,kBAAkB,eAAe;AAAA,YACnD;AAAA,UACF;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAsB,8BACpB,IACA,OACkB;AAClB,MAAI;AACF,UAAM,CAAC,GAAG,IAAI,MAAM;AAAA,MAClB;AAAA,MACA;AAAA;AAAA,YAEM,MAAM,aAAa;AAAA,YACnB,MAAM,UAAU;AAAA,YAChB,MAAM,iBAAiB,KAAK;AAAA;AAAA;AAAA,IAGpC;AACA,WAAO,KAAK,UAAU;AAAA,EACxB,SAAS,OAAO;AACd,gBAAY,KAAK;AAAA,EACnB;AACF;AAEA,eAAsB,oCACpB,IACA,YAC+C;AAC/C,MAAI;AACF,UAAM,CAAC,GAAG,IAAI,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,yDACmD,UAAU;AAAA;AAAA,IAE/D;AACA,QAAI,KAAK,eAAe,QAAQ,KAAK,eAAe,QAAW;AAC7D,YAAM,IAAI,oCAAoC;AAAA,IAChD;AACA,WAAO,iCAAiC,MAAM,gBAAgB,IAAI,UAAU,CAAC;AAAA,EAC/E,SAAS,OAAO;AACd,QAAI,iBAAiB,oCAAqC,OAAM;AAChE,gBAAY,KAAK;AAAA,EACnB;AACF;AAkBA,eAAsB,qCACpB,IACA,OACqD;AACrD,MAAI;AACF,QAAI,MAAM,YAAY;AACpB,aAAO,MAAM,GAAG,YAAY,OAAO,OAAO;AACxC,cAAM,OAAO;AACb,cAAM;AAAA,UACJ;AAAA,UACA;AAAA,cACI,MAAM,WAAY,aAAa,KAAK,MAAM,WAAY,UAAU;AAAA,cAChE,MAAM,WAAY,SAAS;AAAA;AAAA,QAEjC;AACA,eAAO,MAAM,0CAA0C,MAAM,KAAK;AAAA,MACpE,CAAC;AAAA,IACH;AACA,WAAO,MAAM,0CAA0C,IAAI,KAAK;AAAA,EAClE,SAAS,OAAO;AACd,QACE,iBAAiB,uCACjB,iBAAiB,6CACjB,iBAAiB,+CACjB,iBAAiB,uCACjB,iBAAiB,sCACjB;AACA,YAAM;AAAA,IACR;AACA,gBAAY,KAAK;AAAA,EACnB;AACF;AAEA,eAAe,0CACb,IACA,OACqD;AACrD,QAAM,CAAC,GAAG,IAAI,MAAM;AAAA,IAMlB;AAAA,IACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAOQ,MAAM,WAAW;AAAA,YACjB,MAAM,UAAU;AAAA,YAChB,MAAM,wBAAwB;AAAA,YAC9B,MAAM,aAAa;AAAA,YACnB,MAAM,aAAa,IAAI;AAAA,YACvB,MAAM,cAAc,IAAI;AAAA,YACxB,MAAM,qBAAqB,IAAI;AAAA,YAC/B,MAAM,MAAM;AAAA;AAAA;AAAA,EAGtB;AACA,MAAI,CAAC,IAAK,OAAM,IAAI,oCAAoC;AACxD,QAAM,WAAW,MAAM,oCAAoC,IAAI,MAAM,UAAU;AAC/E,SAAO,uCAAuC,MAAM;AAAA,IAClD,SAAS,IAAI;AAAA,IACb,aAAa,MAAM;AAAA,IACnB;AAAA,EACF,CAAC;AACH;","names":[]}