@yielded/auth 0.1.0-beta.1

package/dist/sessions/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["EffectArray"],"sources":["../../src/sessions/module.ts"],"sourcesContent":["import {\n  Array as EffectArray,\n  Cause,\n  Context,\n  Crypto,\n  DateTime,\n  Effect,\n  Encoding,\n  Layer,\n  Option,\n  Redacted,\n  Result,\n  Schema,\n  type Scope,\n  type Types,\n} from \"effect\";\n\nimport { cryptoLayer, hooksLayer } from \"../auth/defaults\";\nimport { type PreparedCommit, hasCommitScope, coordinateCommit } from \"../hooks/commit\";\nimport { LifecycleHooks } from \"../hooks/LifecycleHooks\";\nimport type { HookDenied } from \"../hooks/models\";\nimport { LifecycleEventId, lifecycleEvent, lifecycleSnapshot } from \"../hooks/models\";\nimport { reportAuthFailure } from \"../internal/diagnostics\";\nimport {\n  AuthenticationAssurance,\n  type AssuranceRequirement,\n  requireAssurance,\n  requireAuthenticated,\n} from \"../operations/context\";\nimport { type AuthOperationResult } from \"../operations/credentials\";\nimport { TokenDigest } from \"../Schema\";\nimport {\n  assessAuthentication,\n  combineAuthenticationEvidence,\n  snapshotAuthenticationEvidence,\n  snapshotSessionAuthenticationProvenance,\n} from \"./assurance\";\nimport { AuthenticationAuthority } from \"./AuthenticationAuthority\";\nimport { makeSessionContract } from \"./contract\";\nimport { makeSessionSecrets, makeSessionSigningCodec, type SessionSigningKeyring } from \"./crypto\";\nimport type { SessionError } from \"./errors\";\nimport {\n  SessionCapabilityUnsupported,\n  SessionConfigurationError,\n  SessionInvalid,\n  SessionSignOutUnavailable,\n  SessionUnavailable,\n  SessionRenewalTooEarly,\n  SessionStepUpInvalid,\n} from \"./errors\";\nimport { sessionInvalidationWindow } from \"./invalidation\";\nimport {\n  type AuthenticationEvidence,\n  type PendingConsumption,\n  type SessionMetadata,\n  AuthenticationFlowId,\n  AuthenticationRequirement,\n  SessionId,\n  SessionAuthenticationProvenance,\n  SessionCredentialVersion,\n  type SessionCapabilities,\n  type SessionInspection,\n} from \"./models\";\nimport {\n  type PendingAuthentication as PendingPort,\n  type PendingAuthenticationContext,\n  snapshotPendingAuthenticationContext,\n} from \"./PendingAuthentication\";\nimport type {\n  SessionRepository as RepositoryPort,\n  SignedSessionValidity as ValidityPort,\n  StatefulSessionPersistence as PersistencePort,\n} from \"./persistence\";\nimport {\n  type SessionPolicy,\n  stateAssistedCapabilities,\n  statefulCapabilities,\n  statelessCapabilities,\n  validateSessionPolicy,\n  validateSessionTimeline,\n} from \"./policy\";\nimport {\n  type SessionStepUpProfileId,\n  SessionStepUpIntent,\n  SessionStepUpProfile,\n  SessionStepUpRequirement,\n  type StepUpPending,\n  type SessionStepUpCompletionPlan,\n  type SessionStepUpPersistence as StepUpPort,\n  type SessionStepUpReplacement,\n  type SessionStepUpSource,\n} from \"./SessionStepUpPersistence\";\n\nexport interface ModuleService<Id extends string, Kind extends string, Claims> {\n  readonly moduleId: Id;\n  readonly kind: Kind;\n  readonly claims: Types.Invariant<Claims>;\n}\n\nconst reportSignOutFailure = <A, E extends { readonly _tag: string }, R>(\n  effect: Effect.Effect<A, E, R>,\n) =>\n  effect.pipe(\n    Effect.tapCause((cause) =>\n      reportAuthFailure(\n        \"session-sign-out\",\n        Cause.fromReasons(\n          cause.reasons.filter(\n            (reason) =>\n              Cause.isFailReason(reason) &&\n              reason.error._tag !== \"SessionInvalid\" &&\n              reason.error._tag !== \"HookDenied\",\n          ),\n        ),\n      ),\n    ),\n  );\n\n/** Stable module IDs isolate service keys and signed/digested credential namespaces. */\nexport type CompletionLayer<\n  Id extends string,\n  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,\n  R = never,\n> = Layer.Layer<\n  ModuleService<Id, \"completion\", Claims[\"Type\"]>,\n  SessionConfigurationError,\n  | ModuleService<Id, \"strategy\", Claims[\"Type\"]>\n  | Crypto.Crypto\n  | AuthenticationAuthority\n  | Exclude<Claims[\"DecodingServices\"], Scope.Scope>\n  | Exclude<Claims[\"EncodingServices\"], Scope.Scope>\n  | Exclude<R, Scope.Scope>\n>;\n\nexport const makeSessionModule = <\n  const Id extends string,\n  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,\n>(\n  moduleId: Id,\n  claims: Claims,\n) => {\n  const { Session, CompletionResult, operations, group, stepUpOperations, stepUpGroup } =\n    makeSessionContract(moduleId, claims);\n\n  const ClaimsCodec: Schema.Codec<\n    Claims[\"Type\"],\n    Claims[\"Encoded\"],\n    Claims[\"DecodingServices\"],\n    Claims[\"EncodingServices\"]\n  > = Session.fields.claims;\n\n  type Session = typeof Session.Type;\n  type CompletionResult = typeof CompletionResult.Type;\n  type SignOutResult = typeof operations.SignOut.rpc.successSchema.Type;\n  type Failure = SessionError | HookDenied;\n  type Prepared<A, R = never> = Effect.Effect<PreparedCommit<AuthOperationResult<A>>, Failure, R>;\n  type Issuance = {\n    readonly evidence: AuthenticationEvidence;\n    readonly claims: Claims[\"Type\"];\n    readonly pending?: PendingConsumption;\n  };\n  type Inspection = SessionInspection<Claims[\"Type\"]>;\n  type Strategy = {\n    readonly policy: SessionPolicy;\n    readonly capabilities: SessionCapabilities;\n    /** @effect-expect-leaking AuthenticationAuthority -- fresh issuance alone needs identity authority; verification does not. */\n    readonly prepareEstablish: (input: Issuance) => Prepared<Session, AuthenticationAuthority>;\n    /** Trusted method-only authentication source. Never expose through a public RPC. */\n    readonly inspectForStepUp: (\n      credential: Redacted.Redacted<string>,\n    ) => Effect.Effect<SessionStepUpSource<Claims[\"Type\"]>, Failure>;\n    readonly inspect: (credential: Redacted.Redacted<string>) => Effect.Effect<Inspection, Failure>;\n    readonly verify: (credential: Redacted.Redacted<string>) => Effect.Effect<Session, Failure>;\n    readonly prepareRenew: (credential: Redacted.Redacted<string>) => Prepared<Session>;\n    readonly signOut: (\n      credential: Redacted.Redacted<string>,\n    ) => Effect.Effect<AuthOperationResult<SignOutResult>, Failure>;\n    readonly list: (\n      input: Parameters<RepositoryPort[\"list\"]>[0],\n    ) => Effect.Effect<Effect.Success<ReturnType<RepositoryPort[\"list\"]>>, Failure>;\n    readonly revoke: (session: Session, sessionId: SessionId) => Effect.Effect<void, Failure>;\n    readonly revokeAll: (session: Session) => Effect.Effect<void, Failure>;\n  };\n\n  const SessionStrategy = Context.Service<ModuleService<Id, \"strategy\", Claims[\"Type\"]>, Strategy>(\n    `effect-auth/sessions/${moduleId}/Strategy`,\n  );\n\n  // This tag is deliberately not returned by the module: no public precommit signer.\n  const StepUpPlanner = Context.Service<\n    ModuleService<Id, \"step-up-planner\", Claims[\"Type\"]>,\n    {\n      readonly plan: (\n        source: SessionStepUpSource<Claims[\"Type\"]>,\n        evidence: AuthenticationEvidence,\n        assurance: AuthenticationAssurance,\n      ) => Effect.Effect<\n        {\n          readonly replacement: SessionStepUpReplacement<Claims[\"Type\"]>;\n          readonly credential: Redacted.Redacted<string>;\n        },\n        Failure\n      >;\n    }\n  >(`effect-auth/sessions/${moduleId}/StepUpPlanner`);\n\n  const SessionStepUpPersistence = Context.Service<\n    ModuleService<Id, \"step-up-persistence\", Claims[\"Type\"]>,\n    StepUpPort<Claims[\"Type\"]>\n  >(`effect-auth/sessions/${moduleId}/StepUpPersistence`);\n\n  const StatefulSessionPersistence = Context.Service<\n    ModuleService<Id, \"persistence\", Claims[\"Type\"]>,\n    PersistencePort<Claims[\"Type\"]>\n  >(`effect-auth/sessions/${moduleId}/Persistence`);\n\n  const SessionRepository = Context.Service<\n    ModuleService<Id, \"repository\", Claims[\"Type\"]>,\n    RepositoryPort\n  >(`effect-auth/sessions/${moduleId}/Repository`);\n\n  const SignedSessionValidity = Context.Service<\n    ModuleService<Id, \"validity\", Claims[\"Type\"]>,\n    ValidityPort\n  >(`effect-auth/sessions/${moduleId}/Validity`);\n\n  const PendingAuthentication = Context.Service<\n    ModuleService<Id, \"pending\", Claims[\"Type\"]>,\n    PendingPort<Claims[\"Type\"]>\n  >(`effect-auth/sessions/${moduleId}/Pending`);\n\n  const unsupported = (capability: string) =>\n    Effect.fail(SessionCapabilityUnsupported.make({ capability }));\n\n  const checkNoAmbientCommit = Effect.fn(\"Session.checkNoAmbientCommit\")(function* () {\n    if (yield* hasCommitScope)\n      return yield* SessionCapabilityUnsupported.make({\n        capability: \"public-operation-inside-transaction; use prepared completion\",\n      });\n  });\n\n  const checkRenewalDue = (session: SessionMetadata, now: DateTime.Utc, policy: SessionPolicy) => {\n    const retryAt = DateTime.add(session.issuedAt, { milliseconds: policy.renewalIntervalMillis });\n\n    return DateTime.toEpochMillis(now) < DateTime.toEpochMillis(retryAt)\n      ? Effect.fail(SessionRenewalTooEarly.make({ retryAt }))\n      : Effect.void;\n  };\n\n  const readCommitted = <A>(receipt: PreparedCommit<A>) =>\n    receipt.read.pipe(Effect.mapError(() => SessionUnavailable.make({})));\n\n  const prepareHooks = Effect.fn(\"Session.prepareHooks\")(function* (\n    action: \"sign-in\" | \"session-creation\" | \"sign-out\",\n    session?: Pick<SessionMetadata, \"subjectId\" | \"assurance\">,\n  ) {\n    const hooks = yield* LifecycleHooks;\n    const secrets = yield* makeSessionSecrets(moduleId);\n\n    const snapshot = lifecycleSnapshot({\n      action,\n      operation: `${moduleId}/session`,\n      ...(session === undefined\n        ? {}\n        : { subjectId: session.subjectId, method: session.assurance.method }),\n      identifiers: [],\n    });\n\n    yield* hooks.before(snapshot);\n    const id = yield* secrets.generate();\n\n    return lifecycleEvent({\n      id: LifecycleEventId.make(Redacted.value(id)),\n      occurredAtMillis: DateTime.toEpochMillis(yield* DateTime.now),\n      snapshot,\n    });\n  });\n\n  // Detach mutable date/collection declarations as well as projecting declared fields.\n  // Work from the Type view so consumer wire transformations are not replayed.\n  const publicSessionCodec = Schema.toCodecJson(Schema.toType(Session));\n\n  const projectSession = (session: Session) =>\n    Schema.encodeEffect(publicSessionCodec)(session).pipe(\n      Effect.flatMap(Schema.decodeEffect(publicSessionCodec)),\n      Effect.mapError(() => SessionInvalid.make({})),\n    );\n\n  const issue = (\n    session: Session,\n    credential: Redacted.Redacted<string>,\n  ): AuthOperationResult<Session> => ({\n    value: Schema.decodeSync(publicSessionCodec)(Schema.encodeSync(publicSessionCodec)(session)),\n    credentialCommands: [\n      {\n        _tag: \"Issue\",\n        slot: \"session\",\n        credential,\n        expiresAtMillis: DateTime.toEpochMillis(session.expiresAt),\n      },\n    ],\n  });\n\n  const inspectProvenance = Effect.fn(\"Session.inspectProvenance\")(function* (\n    session: Session,\n    input: SessionAuthenticationProvenance,\n    version: SessionCredentialVersion,\n  ) {\n    const provenance = yield* snapshotSessionAuthenticationProvenance(input).pipe(\n      Effect.mapError(() => SessionInvalid.make({})),\n    );\n\n    const credentialVersion = yield* Schema.decodeEffect(SessionCredentialVersion)(version).pipe(\n      Effect.mapError(() => SessionInvalid.make({})),\n    );\n\n    const original = provenance.evidence;\n    const publicProofs = session.assurance.evidence;\n    const ordinals = new Map<string, number>();\n    const revisions = new Set(original.revision.credentials.map((item) => item.credentialId));\n\n    if (\n      revisions.size !== original.revision.credentials.length ||\n      original.proofs.some((proof) => !revisions.has(proof.credentialId))\n    )\n      return yield* SessionInvalid.make({});\n    for (const proof of original.proofs)\n      if (!ordinals.has(proof.credentialId)) ordinals.set(proof.credentialId, ordinals.size);\n    if (\n      session.subjectId !== original.revision.subjectId ||\n      session.securityRevision !== original.revision.securityRevision ||\n      publicProofs === undefined ||\n      publicProofs.length !== original.proofs.length ||\n      original.proofs.some((proof, index) => {\n        const actual = publicProofs[index];\n\n        return (\n          actual.method !== proof.method ||\n          actual.credentialOrdinal !== ordinals.get(proof.credentialId) ||\n          actual.userVerified !== proof.userVerified ||\n          actual.phishingResistant !== proof.phishingResistant ||\n          DateTime.toEpochMillis(actual.verifiedAt) !== DateTime.toEpochMillis(proof.verifiedAt) ||\n          actual.factors.length !== proof.factors.length ||\n          actual.factors.some((factor, i) => factor !== proof.factors[i])\n        );\n      })\n    )\n      return yield* SessionInvalid.make({});\n\n    return Object.freeze({ session, provenance, credentialVersion });\n  });\n\n  const replacementSession = Effect.fn(\"Session.replacementSession\")(function* (\n    source: Session,\n    evidence: AuthenticationEvidence,\n    assurance: AuthenticationAssurance,\n    policy: SessionPolicy,\n    sessionId: SessionId,\n  ) {\n    const now = yield* DateTime.now;\n\n    const session = yield* projectSession({\n      ...source,\n      sessionId,\n      subjectId: evidence.revision.subjectId,\n      securityRevision: evidence.revision.securityRevision,\n      assurance: AuthenticationAssurance.make({\n        ...assurance,\n        authenticatedAt: source.assurance.authenticatedAt,\n      }),\n      issuedAt: now,\n      expiresAt: DateTime.makeUnsafe(\n        Math.min(\n          DateTime.toEpochMillis(source.absoluteExpiresAt),\n          DateTime.toEpochMillis(now) + policy.idleLifetimeMillis,\n        ),\n      ),\n    });\n\n    yield* validateSessionTimeline(source, policy);\n    yield* validateSessionTimeline(session, policy);\n\n    return session;\n  });\n\n  const statefulLayer = (configured: SessionPolicy) =>\n    Layer.effectContext(\n      Effect.gen(function* () {\n        const policy = yield* validateSessionPolicy(configured, statefulCapabilities);\n        const store = yield* StatefulSessionPersistence;\n        const repository = yield* SessionRepository;\n        const secrets = yield* makeSessionSecrets(moduleId);\n\n        const services = yield* Effect.context<\n          | Claims[\"EncodingServices\"]\n          | Claims[\"DecodingServices\"]\n          | LifecycleHooks\n          | Context.Service.Identifier<typeof import(\"effect\").Crypto.Crypto>\n        >();\n\n        const validate = (session: Session) =>\n          projectSession(session).pipe(\n            Effect.provide(services),\n            Effect.flatMap((value) =>\n              validateSessionTimeline(value, policy).pipe(Effect.as(value)),\n            ),\n          );\n\n        const inspectForStepUp = Effect.fn(\"StatefulSession.inspectForStepUp\")(function* (\n          credential: Redacted.Redacted<string>,\n        ) {\n          const digest = yield* secrets.digest(credential, \"bearer\");\n          const record = yield* store.verify({ digest, now: yield* DateTime.now });\n\n          const inspection = yield* inspectProvenance(\n            yield* validate(record),\n            record.provenance,\n            record.credentialVersion,\n          );\n\n          return Object.freeze({\n            inspection,\n            guard: Object.freeze({ _tag: \"Stateful\" as const, digest, rowVersion: record.version }),\n          });\n        });\n\n        const inspect = Effect.fn(\"StatefulSession.inspect\")(\n          (credential: Redacted.Redacted<string>) =>\n            inspectForStepUp(credential).pipe(Effect.map((source) => source.inspection)),\n        );\n\n        const verify = Effect.fn(\"StatefulSession.verify\")(\n          (credential: Redacted.Redacted<string>) =>\n            inspect(credential).pipe(Effect.map((value) => value.session)),\n        );\n\n        const strategy = SessionStrategy.of({\n          policy,\n          capabilities: statefulCapabilities,\n          inspectForStepUp,\n          inspect,\n          verify,\n          prepareEstablish: Effect.fn(\"StatefulSession.prepareEstablish\")(function* (\n            input: Issuance,\n          ) {\n            input = { ...input, evidence: yield* snapshotAuthenticationEvidence(input.evidence) };\n            const authority = yield* AuthenticationAuthority;\n            const requirement = yield* authority.requirements(input.evidence);\n\n            const assessed = yield* assessAuthentication(input.evidence, requirement).pipe(\n              Effect.mapError(() => SessionInvalid.make({})),\n            );\n\n            if (!assessed.satisfied) return yield* SessionInvalid.make({});\n            const now = yield* DateTime.now;\n\n            const absoluteExpiresAt = DateTime.add(assessed.assurance.authenticatedAt, {\n              milliseconds: policy.absoluteLifetimeMillis,\n            });\n\n            const expiresAt = DateTime.makeUnsafe(\n              Math.min(\n                DateTime.toEpochMillis(absoluteExpiresAt),\n                DateTime.toEpochMillis(now) + policy.idleLifetimeMillis,\n              ),\n            );\n\n            const credential = yield* secrets.generate();\n            const digest = yield* secrets.digest(credential, \"bearer\");\n\n            const base = {\n              subjectId: input.evidence.revision.subjectId,\n              securityRevision: input.evidence.revision.securityRevision,\n              assurance: assessed.assurance,\n              issuedAt: now,\n              expiresAt,\n              absoluteExpiresAt,\n              claims: input.claims,\n              digest,\n              provenance: yield* snapshotSessionAuthenticationProvenance({\n                evidence: input.evidence,\n              }),\n              credentialVersion: SessionCredentialVersion.make(\n                Redacted.value(yield* secrets.generate()),\n              ),\n            };\n\n            yield* validateSessionTimeline(base, policy);\n            const event = yield* prepareHooks(\"sign-in\", base).pipe(Effect.provide(services));\n\n            const creation = yield* prepareHooks(\"session-creation\", base).pipe(\n              Effect.provide(services),\n            );\n\n            yield* validateSessionTimeline(base, policy);\n            const commitNow = yield* DateTime.now;\n\n            return yield* store.establish(\n              { session: base, evidence: input.evidence, pending: input.pending, now: commitNow },\n              (record, journal) => {\n                journal.stage(event);\n                journal.stage(creation);\n\n                return journal.prepare(issue(record, credential));\n              },\n            );\n          }),\n          prepareRenew: Effect.fn(\"StatefulSession.prepareRenew\")(function* (\n            credential: Redacted.Redacted<string>,\n          ) {\n            const digest = yield* secrets.digest(credential, \"bearer\");\n            const now = yield* DateTime.now;\n            const record = yield* store.verify({ digest, now });\n\n            const inspected = yield* inspectProvenance(\n              yield* validate(record),\n              record.provenance,\n              record.credentialVersion,\n            );\n\n            const session = inspected.session;\n\n            yield* checkRenewalDue(session, now, policy);\n            const next = yield* secrets.generate();\n            const nextDigest = yield* secrets.digest(next, \"bearer\");\n\n            const nextCredentialVersion = SessionCredentialVersion.make(\n              Redacted.value(yield* secrets.generate()),\n            );\n\n            const event = yield* prepareHooks(\"session-creation\", session).pipe(\n              Effect.provide(services),\n            );\n\n            yield* validateSessionTimeline(session, policy);\n            const commitNow = yield* DateTime.now;\n\n            const nextExpiresAt = DateTime.makeUnsafe(\n              Math.min(\n                DateTime.toEpochMillis(session.absoluteExpiresAt),\n                DateTime.toEpochMillis(now) + policy.idleLifetimeMillis,\n              ),\n            );\n\n            return yield* store.rotate(\n              {\n                sessionId: session.sessionId,\n                expectedDigest: digest,\n                expectedVersion: record.version,\n                expectedSecurityRevision: session.securityRevision,\n                nextDigest,\n                nextCredentialVersion,\n                nextExpiresAt,\n                now: commitNow,\n              },\n              (rotated, journal) => {\n                journal.stage(event);\n\n                return journal.prepare(issue(rotated, next));\n              },\n            );\n          }),\n          signOut: Effect.fn(\"StatefulSession.signOut\")(function* (\n            credential: Redacted.Redacted<string>,\n          ) {\n            const result = yield* Effect.gen(function* () {\n              const digest = yield* secrets.digest(credential, \"bearer\");\n              const event = yield* prepareHooks(\"sign-out\").pipe(Effect.provide(services));\n\n              const receipt = yield* store.revokeDigest(digest, (revoked, journal) => {\n                journal.stage(event);\n\n                return journal.prepare({\n                  clearCredential: true as const,\n                  invalidation: revoked ? (\"revoked\" as const) : (\"already-invalid\" as const),\n                });\n              });\n\n              return yield* readCommitted(receipt);\n            }).pipe(reportSignOutFailure, Effect.result);\n\n            return {\n              value:\n                result._tag === \"Failure\"\n                  ? result.failure._tag === \"SessionInvalid\"\n                    ? { clearCredential: true as const, invalidation: \"already-invalid\" as const }\n                    : SessionSignOutUnavailable.make({ clearCredential: true })\n                  : result.success,\n              credentialCommands: [{ _tag: \"Clear\" as const, slot: \"session\" as const }],\n            };\n          }),\n          list: repository.list,\n          revoke: Effect.fn(\"StatefulSession.revoke\")(function* (session, sessionId) {\n            const event = yield* prepareHooks(\"sign-out\", session).pipe(Effect.provide(services));\n\n            return yield* readCommitted(\n              yield* store.revoke(\n                {\n                  subjectId: session.subjectId,\n                  sessionId,\n                  expectedSecurityRevision: session.securityRevision,\n                },\n                (_, journal) => {\n                  journal.stage(event);\n\n                  return journal.prepare(undefined);\n                },\n              ),\n            );\n          }),\n          revokeAll: Effect.fn(\"StatefulSession.revokeAll\")(function* (session) {\n            const event = yield* prepareHooks(\"sign-out\", session).pipe(Effect.provide(services));\n\n            return yield* readCommitted(\n              yield* store.revokeAll(\n                {\n                  subjectId: session.subjectId,\n                  expectedSecurityRevision: session.securityRevision,\n                },\n                (_, journal) => {\n                  journal.stage(event);\n\n                  return journal.prepare(undefined);\n                },\n              ),\n            );\n          }),\n        });\n\n        const plan = Effect.fn(\"StatefulSession.planStepUpReplacement\")(function* (\n          source: SessionStepUpSource<Claims[\"Type\"]>,\n          evidence: AuthenticationEvidence,\n          assurance: AuthenticationAssurance,\n        ) {\n          if (source.guard._tag !== \"Stateful\") return yield* SessionStepUpInvalid.make({});\n          const credential = yield* secrets.generate();\n          const nextDigest = yield* secrets.digest(credential, \"bearer\");\n\n          const session = yield* replacementSession(\n            source.inspection.session,\n            evidence,\n            assurance,\n            policy,\n            source.inspection.session.sessionId,\n          );\n\n          const inspection = yield* inspectProvenance(\n            session,\n            { evidence },\n            SessionCredentialVersion.make(Redacted.value(yield* secrets.generate())),\n          );\n\n          return {\n            credential,\n            replacement: Object.freeze({\n              _tag: \"Stateful\" as const,\n              inspection,\n              expectedDigest: source.guard.digest,\n              expectedRowVersion: source.guard.rowVersion,\n              nextDigest,\n            }),\n          };\n        });\n\n        return Context.make(SessionStrategy, strategy).pipe(Context.add(StepUpPlanner, { plan }));\n      }),\n    );\n\n  const signedLayer = <Mode extends \"stateless\" | \"state-assisted\">(\n    configured: SessionPolicy,\n    keyring: SessionSigningKeyring,\n    mode: Mode,\n  ) => {\n    const layer = Layer.effectContext(\n      Effect.gen(function* () {\n        const validity =\n          mode === \"state-assisted\"\n            ? Option.some(yield* SignedSessionValidity)\n            : Option.none<ValidityPort>();\n\n        const capabilities = Option.isSome(validity)\n          ? stateAssistedCapabilities\n          : statelessCapabilities;\n\n        const policy = yield* validateSessionPolicy(configured, capabilities);\n        const hooks = yield* LifecycleHooks;\n        const secrets = yield* makeSessionSecrets(moduleId);\n\n        const services = yield* Effect.context<\n          | Claims[\"EncodingServices\"]\n          | Claims[\"DecodingServices\"]\n          | LifecycleHooks\n          | Context.Service.Identifier<typeof import(\"effect\").Crypto.Crypto>\n        >();\n\n        const Envelope = Schema.Struct({\n          version: Schema.Literal(2),\n          moduleId: Schema.Literal(moduleId),\n          issuer: Schema.String,\n          audience: Schema.String,\n          generation: Schema.Natural,\n          session: Session,\n          provenance: SessionAuthenticationProvenance,\n          credentialVersion: SessionCredentialVersion,\n        });\n\n        const signing = yield* makeSessionSigningCodec(Envelope, keyring, policy.maximumTokenBytes);\n\n        const encode = (inspection: Inspection) =>\n          signing.encode({\n            version: 2,\n            moduleId,\n            issuer: policy.issuer,\n            audience: policy.audience,\n            generation: policy.generation,\n            ...inspection,\n          });\n\n        const inspect = Effect.fn(\"SignedSession.inspect\")(function* (\n          credential: Redacted.Redacted<string>,\n        ) {\n          const envelope = yield* signing.decode(credential);\n\n          if (\n            envelope.issuer !== policy.issuer ||\n            envelope.audience !== policy.audience ||\n            envelope.generation !== policy.generation\n          )\n            return yield* SessionInvalid.make({});\n          yield* validateSessionTimeline(envelope.session, policy);\n          if (Option.isSome(validity))\n            yield* validity.value.verify(envelope.session, yield* DateTime.now);\n\n          return yield* inspectProvenance(\n            yield* projectSession(envelope.session),\n            envelope.provenance,\n            envelope.credentialVersion,\n          );\n        });\n\n        const inspectForStepUp = Effect.fn(\"SignedSession.inspectForStepUp\")(function* (\n          credential: Redacted.Redacted<string>,\n        ) {\n          return Object.freeze({\n            inspection: yield* inspect(credential),\n            guard: Object.freeze(\n              Option.isSome(validity)\n                ? { _tag: \"StateAssistedSigned\" as const }\n                : { _tag: \"StatelessSigned\" as const },\n            ),\n          });\n        });\n\n        const verify = Effect.fn(\"SignedSession.verify\")((credential: Redacted.Redacted<string>) =>\n          inspect(credential).pipe(Effect.map((value) => value.session)),\n        );\n\n        const strategy = SessionStrategy.of({\n          policy,\n          capabilities,\n          inspectForStepUp,\n          inspect,\n          verify,\n          prepareEstablish: Effect.fn(\"SignedSession.prepareEstablish\")(function* (\n            input: Issuance,\n          ) {\n            input = { ...input, evidence: yield* snapshotAuthenticationEvidence(input.evidence) };\n            const authority = yield* AuthenticationAuthority;\n            const requirement = yield* authority.requirements(input.evidence);\n\n            const assessed = yield* assessAuthentication(input.evidence, requirement).pipe(\n              Effect.mapError(() => SessionInvalid.make({})),\n            );\n\n            if (!assessed.satisfied) return yield* SessionInvalid.make({});\n            const now = yield* DateTime.now;\n\n            const absoluteExpiresAt = DateTime.add(assessed.assurance.authenticatedAt, {\n              milliseconds: policy.absoluteLifetimeMillis,\n            });\n\n            const session: Session = {\n              sessionId: SessionId.make(Redacted.value(yield* secrets.generate())),\n              subjectId: input.evidence.revision.subjectId,\n              securityRevision: input.evidence.revision.securityRevision,\n              assurance: assessed.assurance,\n              issuedAt: now,\n              expiresAt: DateTime.makeUnsafe(\n                Math.min(\n                  DateTime.toEpochMillis(absoluteExpiresAt),\n                  DateTime.toEpochMillis(now) + policy.idleLifetimeMillis,\n                ),\n              ),\n              absoluteExpiresAt,\n              claims: input.claims,\n            };\n\n            yield* validateSessionTimeline(session, policy);\n\n            const provenance = yield* snapshotSessionAuthenticationProvenance({\n              evidence: input.evidence,\n            });\n\n            const credentialVersion = SessionCredentialVersion.make(\n              Redacted.value(yield* secrets.generate()),\n            );\n\n            const credential = yield* encode({ session, provenance, credentialVersion });\n            const event = yield* prepareHooks(\"sign-in\", session).pipe(Effect.provide(services));\n\n            const creation = yield* prepareHooks(\"session-creation\", session).pipe(\n              Effect.provide(services),\n            );\n\n            yield* validateSessionTimeline(session, policy);\n\n            return yield* authority.approve(\n              {\n                evidence: input.evidence,\n                pending: input.pending,\n                now: yield* DateTime.now,\n                expiresAt: session.expiresAt,\n                absoluteExpiresAt: session.absoluteExpiresAt,\n              },\n              (_, journal) => {\n                journal.stage(event);\n                journal.stage(creation);\n\n                return journal.prepare(issue(session, credential));\n              },\n            );\n          }),\n          prepareRenew: Effect.fn(\"SignedSession.prepareRenew\")(function* (\n            credential: Redacted.Redacted<string>,\n          ) {\n            const source = yield* inspect(credential);\n            const session = source.session;\n            const now = yield* DateTime.now;\n\n            yield* checkRenewalDue(session, now, policy);\n\n            const renewed = {\n              ...session,\n              issuedAt: now,\n              expiresAt: DateTime.makeUnsafe(\n                Math.min(\n                  DateTime.toEpochMillis(session.absoluteExpiresAt),\n                  DateTime.toEpochMillis(now) + policy.idleLifetimeMillis,\n                ),\n              ),\n            };\n\n            const next = yield* encode({\n              session: renewed,\n              provenance: source.provenance,\n              credentialVersion: SessionCredentialVersion.make(\n                Redacted.value(yield* secrets.generate()),\n              ),\n            });\n\n            const event = yield* prepareHooks(\"session-creation\", renewed).pipe(\n              Effect.provide(services),\n            );\n\n            yield* validateSessionTimeline(session, policy);\n            yield* validateSessionTimeline(renewed, policy);\n            if (Option.isSome(validity)) yield* validity.value.verify(session, yield* DateTime.now);\n\n            // Signed renewal has no write/transaction. The original absolute bound and authentication time survive replay.\n            const result = yield* coordinateCommit(\n              (journal) =>\n                Effect.sync(() => {\n                  journal.stage(event);\n\n                  return journal.prepare(issue(renewed, next));\n                }),\n              { mode: \"interactive\" },\n            ).pipe(\n              Effect.provideService(LifecycleHooks, hooks),\n              Effect.mapError(() => SessionUnavailable.make({})),\n            );\n\n            return result.value;\n          }),\n          signOut: Effect.fn(\"SignedSession.signOut\")(function* (\n            credential: Redacted.Redacted<string>,\n          ) {\n            const outcome = yield* Effect.gen(function* () {\n              const event = yield* prepareHooks(\"sign-out\").pipe(Effect.provide(services));\n\n              if (Option.isSome(validity)) {\n                const session = yield* verify(credential);\n\n                const receipt = yield* validity.value.revoke(\n                  {\n                    subjectId: session.subjectId,\n                    sessionId: session.sessionId,\n                    absoluteExpiresAt: session.absoluteExpiresAt,\n                    expectedSecurityRevision: session.securityRevision,\n                  },\n                  (_, journal) => {\n                    journal.stage(event);\n\n                    return journal.prepare({\n                      clearCredential: true as const,\n                      invalidation: \"revoked\" as const,\n                    });\n                  },\n                );\n\n                return yield* readCommitted(receipt);\n              }\n\n              const result = yield* coordinateCommit(\n                (journal) =>\n                  Effect.sync(() => {\n                    journal.stage(event);\n\n                    return journal.prepare({\n                      clearCredential: true as const,\n                      invalidation: \"client-only\" as const,\n                    });\n                  }),\n                { mode: \"interactive\" },\n              ).pipe(\n                Effect.provideService(LifecycleHooks, hooks),\n                Effect.mapError(() => SessionUnavailable.make({})),\n              );\n\n              return yield* readCommitted(result.value);\n            }).pipe(reportSignOutFailure, Effect.result);\n\n            const value: SignOutResult =\n              outcome._tag === \"Failure\"\n                ? outcome.failure._tag === \"SessionInvalid\"\n                  ? { clearCredential: true, invalidation: \"already-invalid\" }\n                  : SessionSignOutUnavailable.make({ clearCredential: true })\n                : outcome.success;\n\n            return {\n              value,\n              credentialCommands: [{ _tag: \"Clear\" as const, slot: \"session\" as const }],\n            };\n          }),\n          list: () => unsupported(\"session-listing\"),\n          revoke: Effect.fn(\"SignedSession.revoke\")(function* (session, sessionId) {\n            if (Option.isNone(validity)) return yield* unsupported(\"per-session-revocation\");\n            const event = yield* prepareHooks(\"sign-out\", session).pipe(Effect.provide(services));\n\n            return yield* readCommitted(\n              yield* validity.value.revoke(\n                {\n                  subjectId: session.subjectId,\n                  sessionId,\n                  absoluteExpiresAt: DateTime.add(yield* DateTime.now, {\n                    milliseconds: policy.maximumIssuedAbsoluteLifetimeMillis,\n                  }),\n                  expectedSecurityRevision: session.securityRevision,\n                },\n                (_, journal) => {\n                  journal.stage(event);\n\n                  return journal.prepare(undefined);\n                },\n              ),\n            );\n          }),\n          revokeAll: Effect.fn(\"SignedSession.revokeAll\")(function* (session) {\n            if (Option.isNone(validity)) return yield* unsupported(\"subject-invalidation\");\n            const event = yield* prepareHooks(\"sign-out\", session).pipe(Effect.provide(services));\n\n            return yield* readCommitted(\n              yield* validity.value.revokeAll(\n                {\n                  subjectId: session.subjectId,\n                  expectedSecurityRevision: session.securityRevision,\n                },\n                (_, journal) => {\n                  journal.stage(event);\n\n                  return journal.prepare(undefined);\n                },\n              ),\n            );\n          }),\n        });\n\n        const plan = Effect.fn(\"SignedSession.planStepUpReplacement\")(function* (\n          source: SessionStepUpSource<Claims[\"Type\"]>,\n          evidence: AuthenticationEvidence,\n          assurance: AuthenticationAssurance,\n        ) {\n          const expectedTag = Option.isSome(validity) ? \"StateAssistedSigned\" : \"StatelessSigned\";\n\n          if (source.guard._tag !== expectedTag) return yield* SessionStepUpInvalid.make({});\n\n          const session = yield* replacementSession(\n            source.inspection.session,\n            evidence,\n            assurance,\n            policy,\n            SessionId.make(Redacted.value(yield* secrets.generate())),\n          );\n\n          const inspection = yield* inspectProvenance(\n            session,\n            { evidence },\n            SessionCredentialVersion.make(Redacted.value(yield* secrets.generate())),\n          );\n\n          const credential = yield* encode(inspection);\n\n          const replacement: SessionStepUpReplacement<Claims[\"Type\"]> = Option.isSome(validity)\n            ? Object.freeze({\n                _tag: \"StateAssistedSigned\",\n                inspection,\n                tombstoneSessionId: source.inspection.session.sessionId,\n                tombstoneUntil: source.inspection.session.absoluteExpiresAt,\n              })\n            : Object.freeze({ _tag: \"StatelessSigned\", inspection });\n\n          return { credential, replacement };\n        });\n\n        return Context.make(SessionStrategy, strategy).pipe(Context.add(StepUpPlanner, { plan }));\n      }),\n    );\n\n    // Mode is the literal selected by the two public constructors below.\n    // @effect-diagnostics-next-line unsafeEffectTypeAssertion:off\n    return layer as Layer.Layer<\n      Layer.Success<typeof layer>,\n      Layer.Error<typeof layer>,\n      | Exclude<\n          Layer.Services<typeof layer>,\n          Context.Service.Identifier<typeof SignedSessionValidity>\n        >\n      | (Mode extends \"state-assisted\"\n          ? Context.Service.Identifier<typeof SignedSessionValidity>\n          : never)\n    >;\n  };\n\n  const statelessLayer = (policy: SessionPolicy, keyring: SessionSigningKeyring) =>\n    signedLayer(policy, keyring, \"stateless\");\n\n  const stateAssistedLayer = (policy: SessionPolicy, keyring: SessionSigningKeyring) =>\n    signedLayer(policy, keyring, \"state-assisted\");\n\n  const AuthenticationCompletion = Context.Service<\n    ModuleService<Id, \"completion\", Claims[\"Type\"]>,\n    {\n      readonly prepare: (input: Issuance) => Prepared<CompletionResult>;\n      /** Internal-only lookup authenticated by the private pending bearer. No claims\n       * or normal session authority; final preparePending still rechecks/consumes. */\n      readonly pendingContext: (\n        credential: Redacted.Redacted<string>,\n      ) => Effect.Effect<PendingAuthenticationContext, Failure>;\n      /** Charge a rejected additional factor without caller-supplied binding data.\n       * Read the returned receipt before reporting the rejection to its caller. */\n      readonly rejectPendingCredential: (\n        credential: Redacted.Redacted<string>,\n      ) => Effect.Effect<PreparedCommit<{ readonly _tag: \"Rejected\" }>, Failure>;\n      /** Only method implementations call this after independently verifying the next proof. */\n      readonly preparePending: (input: {\n        readonly credential: Redacted.Redacted<string>;\n        readonly additional: AuthenticationEvidence;\n      }) => Prepared<CompletionResult>;\n      readonly rejectPending: (input: {\n        readonly credential: Redacted.Redacted<string>;\n        readonly bindingDigest: TokenDigest;\n      }) => Effect.Effect<PreparedCommit<{ readonly _tag: \"Rejected\" }>, Failure>;\n    }\n  >(`effect-auth/sessions/${moduleId}/Completion`);\n\n  type PendingConfiguration = {\n    readonly pendingLifetimeMillis: number;\n    readonly attemptLimit: number;\n  };\n\n  const makeCompletionLayer = <R>(\n    inputConfiguration: PendingConfiguration | undefined,\n    pending: Effect.Effect<Option.Option<PendingPort<Claims[\"Type\"]>>, never, R>,\n  ): CompletionLayer<Id, Claims, R> =>\n    Layer.effect(\n      AuthenticationCompletion,\n      Effect.gen(function* () {\n        const configuration =\n          inputConfiguration === undefined\n            ? undefined\n            : Object.freeze(\n                yield* Schema.decodeEffect(\n                  Schema.Struct({\n                    pendingLifetimeMillis: Schema.Int.check(\n                      Schema.isBetween({ minimum: 1, maximum: 900000 }),\n                    ),\n                    attemptLimit: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 100 })),\n                  }),\n                )(inputConfiguration).pipe(\n                  Effect.mapError(() =>\n                    SessionConfigurationError.make({ reason: \"pending-authentication\" }),\n                  ),\n                ),\n              );\n\n        const pendingPort = yield* pending;\n        const strategy = yield* SessionStrategy;\n        const authority = yield* AuthenticationAuthority;\n        const secrets = yield* makeSessionSecrets(moduleId);\n\n        const claimServices = yield* Effect.context<\n          Claims[\"DecodingServices\"] | Claims[\"EncodingServices\"]\n        >();\n\n        const codec = Schema.toCodecIso(ClaimsCodec);\n\n        const projectClaims = (value: Claims[\"Type\"]) =>\n          Schema.encodeEffect(codec)(value).pipe(\n            Effect.flatMap(Schema.decodeEffect(codec)),\n            Effect.provide(claimServices),\n            Effect.mapError(() => SessionInvalid.make({})),\n          );\n\n        const completed = (\n          receipt: PreparedCommit<AuthOperationResult<Session>>,\n        ): PreparedCommit<AuthOperationResult<CompletionResult>> => ({\n          _tag: \"PreparedCommit\",\n          read: receipt.read.pipe(\n            Effect.map(({ value, credentialCommands }) => ({\n              value: { _tag: \"Authenticated\" as const, session: value },\n              credentialCommands,\n            })),\n          ),\n        });\n\n        const prepare: (input: Issuance) => Prepared<CompletionResult> = Effect.fn(\n          \"AuthenticationCompletion.prepare\",\n        )(function* (input: Issuance) {\n          input = { ...input, evidence: yield* snapshotAuthenticationEvidence(input.evidence) };\n          const checkedClaims = yield* projectClaims(input.claims);\n          const requirement = yield* authority.requirements(input.evidence);\n\n          const assessed = yield* assessAuthentication(input.evidence, requirement).pipe(\n            Effect.mapError(() => SessionInvalid.make({})),\n          );\n\n          if (assessed.satisfied)\n            return completed(\n              yield* strategy\n                .prepareEstablish({ ...input, claims: checkedClaims })\n                .pipe(Effect.provideService(AuthenticationAuthority, authority)),\n            );\n          if (\n            input.pending !== undefined ||\n            configuration === undefined ||\n            Option.isNone(pendingPort)\n          )\n            return yield* SessionCapabilityUnsupported.make({\n              capability: \"required-additional-authentication\",\n            });\n          const now = yield* DateTime.now;\n\n          const expiresAt = DateTime.makeUnsafe(\n            Math.min(\n              DateTime.toEpochMillis(now) + configuration.pendingLifetimeMillis,\n              DateTime.toEpochMillis(assessed.assurance.authenticatedAt) +\n                requirement.maximumAgeMillis,\n            ),\n          );\n\n          const credential = yield* secrets.generate();\n          const digest = yield* secrets.digest(credential, \"pending\");\n\n          return yield* pendingPort.value.create(\n            {\n              digest,\n              evidence: input.evidence,\n              claims: checkedClaims,\n              expiresAt,\n              attemptLimit: configuration.attemptLimit,\n            },\n            now,\n            (record, journal) =>\n              journal.prepare({\n                value: { _tag: \"PendingAuthentication\" as const, expiresAt: record.expiresAt },\n                credentialCommands: [\n                  {\n                    _tag: \"Issue\" as const,\n                    slot: \"pending-proof\" as const,\n                    credential,\n                    expiresAtMillis: DateTime.toEpochMillis(record.expiresAt),\n                  },\n                ],\n              }),\n          );\n        });\n\n        const pendingContext = Effect.fn(\"AuthenticationCompletion.pendingContext\")(function* (\n          credential: Redacted.Redacted<string>,\n        ) {\n          if (Option.isNone(pendingPort))\n            return yield* SessionCapabilityUnsupported.make({\n              capability: \"pending-authentication\",\n            });\n          const digest = yield* secrets.digest(credential, \"pending\");\n\n          return yield* snapshotPendingAuthenticationContext(\n            yield* pendingPort.value.context({\n              digest,\n              now: yield* DateTime.now,\n            }),\n          );\n        });\n\n        return AuthenticationCompletion.of({\n          prepare,\n          pendingContext,\n          rejectPendingCredential: Effect.fn(\"AuthenticationCompletion.rejectPendingCredential\")(\n            function* (credential) {\n              if (Option.isNone(pendingPort))\n                return yield* SessionCapabilityUnsupported.make({\n                  capability: \"pending-authentication\",\n                });\n              const digest = yield* secrets.digest(credential, \"pending\");\n\n              const context = yield* snapshotPendingAuthenticationContext(\n                yield* pendingPort.value.context({ digest, now: yield* DateTime.now }),\n              );\n\n              return yield* pendingPort.value.reject(\n                { digest, bindingDigest: context.bindingDigest, now: yield* DateTime.now },\n                (decision, journal) => journal.prepare(decision),\n              );\n            },\n          ),\n          preparePending: Effect.fn(\"AuthenticationCompletion.preparePending\")(function* (input) {\n            if (Option.isNone(pendingPort))\n              return yield* SessionCapabilityUnsupported.make({\n                capability: \"pending-authentication\",\n              });\n            const digest = yield* secrets.digest(input.credential, \"pending\");\n\n            const record = yield* pendingPort.value.read({\n              digest,\n              bindingDigest: input.additional.bindingDigest,\n              now: yield* DateTime.now,\n            });\n\n            const evidence = yield* combineAuthenticationEvidence(\n              record.evidence,\n              input.additional,\n            );\n\n            const receipt = yield* prepare({\n              evidence,\n              claims: record.claims,\n              pending: {\n                digest,\n                bindingDigest: evidence.bindingDigest,\n                flowId: evidence.flowId,\n                version: record.version,\n              },\n            });\n\n            return {\n              _tag: \"PreparedCommit\" as const,\n              read: receipt.read.pipe(\n                Effect.map((result) => ({\n                  value: result.value,\n                  credentialCommands: [\n                    ...result.credentialCommands,\n                    { _tag: \"Clear\" as const, slot: \"pending-proof\" as const },\n                  ],\n                })),\n              ),\n            };\n          }),\n          rejectPending: Effect.fn(\"AuthenticationCompletion.rejectPending\")(function* (input) {\n            if (Option.isNone(pendingPort))\n              return yield* SessionCapabilityUnsupported.make({\n                capability: \"pending-authentication\",\n              });\n\n            return yield* pendingPort.value.reject(\n              {\n                digest: yield* secrets.digest(input.credential, \"pending\"),\n                bindingDigest: input.bindingDigest,\n                now: yield* DateTime.now,\n              },\n              (decision, journal) => journal.prepare(decision),\n            );\n          }),\n        });\n      }),\n    );\n\n  function completionLayer(): CompletionLayer<Id, Claims>;\n  function completionLayer(\n    configuration: PendingConfiguration,\n  ): CompletionLayer<Id, Claims, ModuleService<Id, \"pending\", Claims[\"Type\"]>>;\n  function completionLayer(configuration?: PendingConfiguration) {\n    const captured = configuration === undefined ? undefined : Object.freeze({ ...configuration });\n\n    return makeCompletionLayer(\n      captured,\n      captured === undefined\n        ? Effect.serviceOption(PendingAuthentication)\n        : Effect.map(PendingAuthentication, Option.some),\n    );\n  }\n\n  const SessionStepUp = Context.Service<\n    ModuleService<Id, \"step-up\", Claims[\"Type\"]>,\n    {\n      readonly prepareBegin: (input: {\n        readonly sourceCredential: Redacted.Redacted<string>;\n        readonly profileId: SessionStepUpProfileId;\n      }) => Prepared<StepUpPending>;\n      readonly context: (\n        credential: Redacted.Redacted<string>,\n      ) => Effect.Effect<PendingAuthenticationContext, Failure>;\n      readonly rejectCredential: (\n        credential: Redacted.Redacted<string>,\n      ) => Effect.Effect<PreparedCommit<{ readonly _tag: \"Rejected\" }>, Failure>;\n      readonly prepareComplete: (input: {\n        readonly sourceCredential: Redacted.Redacted<string>;\n        readonly stepUpCredential: Redacted.Redacted<string>;\n        readonly additional: AuthenticationEvidence;\n      }) => Prepared<Session>;\n    }\n  >(`effect-auth/sessions/${moduleId}/StepUp`);\n\n  const freezeInstant = (input: DateTime.Utc) => {\n    const copy = DateTime.makeUnsafe(DateTime.toEpochMillis(input));\n\n    Object.freeze(DateTime.toPartsUtc(copy));\n\n    return Object.freeze(copy);\n  };\n\n  const snapshotRequirement = (input: AuthenticationRequirement) =>\n    Object.freeze({\n      ...input,\n      alternatives: Object.freeze(\n        EffectArray.map(input.alternatives, (alternative) =>\n          Object.freeze({\n            ...alternative,\n            factors: Object.freeze([...alternative.factors]),\n          }),\n        ),\n      ),\n    });\n\n  const boundedRequirement = (input: AuthenticationRequirement) =>\n    Array.isArray(input?.alternatives) &&\n    input.alternatives.length > 0 &&\n    input.alternatives.length <= 16 &&\n    input.alternatives.every(\n      (alternative) => Array.isArray(alternative?.factors) && alternative.factors.length <= 3,\n    );\n\n  const readRequirement = (input: AuthenticationRequirement) =>\n    boundedRequirement(input)\n      ? Schema.decodeEffect(SessionStepUpRequirement)(input).pipe(\n          Effect.map(snapshotRequirement),\n          Effect.mapError(() => SessionUnavailable.make({})),\n        )\n      : Effect.fail(SessionUnavailable.make({}));\n\n  const intentCodec = Schema.toCodecJson(Schema.toType(SessionStepUpIntent));\n\n  const snapshotIntent = Effect.fn(\"SessionStepUp.snapshotIntent\")(function* (\n    input: SessionStepUpIntent,\n  ) {\n    if (\n      !Array.isArray(input?.revision?.credentials) ||\n      input.revision.credentials.length > 64 ||\n      !boundedRequirement(input?.requirement)\n    )\n      return yield* SessionStepUpInvalid.make({});\n\n    const value = yield* Schema.encodeEffect(intentCodec)(input).pipe(\n      Effect.flatMap(Schema.decodeEffect(intentCodec)),\n      Effect.mapError(() => SessionStepUpInvalid.make({})),\n    );\n\n    return Object.freeze({\n      ...value,\n      revision: Object.freeze({\n        ...value.revision,\n        credentials: Object.freeze(\n          value.revision.credentials.map((item) => Object.freeze({ ...item })),\n        ),\n      }),\n      requirement: snapshotRequirement(value.requirement),\n      sourceAuthenticatedAt: freezeInstant(value.sourceAuthenticatedAt),\n      sourceExpiresAt: freezeInstant(value.sourceExpiresAt),\n      sourceAbsoluteExpiresAt: freezeInstant(value.sourceAbsoluteExpiresAt),\n      expiresAt: freezeInstant(value.expiresAt),\n    });\n  });\n\n  const inspectionCodec = Schema.toCodecJson(\n    Schema.toType(\n      Schema.Struct({\n        session: Session,\n        provenance: SessionAuthenticationProvenance,\n        credentialVersion: SessionCredentialVersion,\n      }),\n    ),\n  );\n\n  // Only detached schema Type values reach this helper. DateTime caches must be\n  // materialized before freezing; consumer collections are detached by the codec.\n  const freezeGraph = <A>(value: A): A => {\n    if (value !== null && typeof value === \"object\") {\n      if (DateTime.isDateTime(value) && DateTime.isUtc(value)) {\n        Object.freeze(DateTime.toPartsUtc(value));\n        Object.freeze(value);\n      } else if (\n        Array.isArray(value) ||\n        Object.getPrototypeOf(value) === Object.prototype ||\n        Object.getPrototypeOf(value) === null ||\n        Schema.is(AuthenticationAssurance)(value)\n      ) {\n        for (const child of Object.values(value)) freezeGraph(child);\n        Object.freeze(value);\n      }\n      // Consumer typed arrays, collections and opaque class instances stay valid\n      // Type values. Detachment, not Object.freeze, isolates their mutable storage.\n    }\n\n    return value;\n  };\n\n  const snapshotInspection = (input: Inspection) =>\n    Schema.encodeEffect(inspectionCodec)(input).pipe(\n      Effect.flatMap(Schema.decodeEffect(inspectionCodec)),\n      Effect.map(freezeGraph),\n      Effect.mapError(() => SessionStepUpInvalid.make({})),\n    );\n\n  const requirementEncoding = Schema.encodeSync(Schema.fromJsonString(AuthenticationRequirement));\n\n  const profileEncoding = Schema.encodeSync(\n    Schema.fromJsonString(\n      Schema.Tuple([\n        Schema.Literal(\"effect-auth/session-step-up/profile/v1\"),\n        Schema.String,\n        SessionStepUpProfile,\n      ]),\n    ),\n  );\n\n  /** Configuration is decoded and detached before asynchronous hashing or Layer building. */\n  const stepUpLayer = (configured: ReadonlyArray<SessionStepUpProfile>) => {\n    const decoded = Schema.decodeResult(\n      Schema.Array(SessionStepUpProfile).check(Schema.isMinLength(1), Schema.isMaxLength(64)),\n    )(\n      Array.isArray(configured) &&\n        configured.length <= 64 &&\n        configured.every((profile) => boundedRequirement(profile?.requirement))\n        ? configured\n        : [],\n    );\n\n    const profiles = Result.isSuccess(decoded)\n      ? Object.freeze(\n          decoded.success.map((profile) =>\n            Object.freeze({\n              ...profile,\n              requirement: snapshotRequirement(profile.requirement),\n            }),\n          ),\n        )\n      : undefined;\n\n    return Layer.effect(\n      SessionStepUp,\n      Effect.gen(function* () {\n        if (\n          profiles === undefined ||\n          new Set(profiles.map((profile) => profile.profileId)).size !== profiles.length\n        )\n          return yield* SessionConfigurationError.make({ reason: \"step-up\" });\n        const store = yield* SessionStepUpPersistence;\n        const strategy = yield* SessionStrategy;\n        const planner = yield* StepUpPlanner;\n        const authority = yield* AuthenticationAuthority;\n        const crypto = yield* Crypto.Crypto;\n        const secrets = yield* makeSessionSecrets(moduleId);\n        const hooks = yield* Effect.context<LifecycleHooks | Crypto.Crypto>();\n\n        const registry = new Map<\n          SessionStepUpProfileId,\n          { readonly profile: SessionStepUpProfile; readonly digest: TokenDigest }\n        >();\n\n        for (const profile of profiles) {\n          const bytes = new TextEncoder().encode(\n            profileEncoding([\"effect-auth/session-step-up/profile/v1\", moduleId, profile]),\n          );\n\n          const digest = yield* crypto\n            .digest(\"SHA-256\", bytes)\n            .pipe(Effect.mapError(() => SessionUnavailable.make({})));\n\n          registry.set(\n            profile.profileId,\n            Object.freeze({ profile, digest: TokenDigest.make(Encoding.encodeBase64Url(digest)) }),\n          );\n        }\n\n        const assess = (evidence: AuthenticationEvidence, requirement: AuthenticationRequirement) =>\n          assessAuthentication(evidence, requirement).pipe(\n            Effect.catchTag(\"SessionConfigurationError\", () =>\n              Effect.fail(SessionUnavailable.make({})),\n            ),\n          );\n\n        const digestCredential = (credential: Redacted.Redacted<string>) =>\n          secrets\n            .digest(credential, \"step-up\")\n            .pipe(\n              Effect.catchTag(\"SessionInvalid\", () => Effect.fail(SessionStepUpInvalid.make({}))),\n            );\n\n        const inspectSource = (credential: Redacted.Redacted<string>) =>\n          strategy.inspectForStepUp(credential).pipe(\n            Effect.flatMap((source) =>\n              snapshotInspection(source.inspection).pipe(\n                Effect.map((inspection) =>\n                  Object.freeze({ inspection, guard: Object.freeze({ ...source.guard }) }),\n                ),\n              ),\n            ),\n            Effect.catchTag(\"SessionInvalid\", () => Effect.fail(SessionStepUpInvalid.make({}))),\n          );\n\n        const readIntent = Effect.fn(\"SessionStepUp.readIntent\")(function* (\n          digest: TokenDigest,\n          bindingDigest: TokenDigest,\n        ) {\n          const intent = yield* snapshotIntent(\n            yield* store.read({ digest, bindingDigest, now: yield* DateTime.now }),\n          );\n\n          const configured = registry.get(intent.profileId);\n          const now = DateTime.toEpochMillis(yield* DateTime.now);\n\n          if (\n            intent.digest !== digest ||\n            intent.bindingDigest !== bindingDigest ||\n            configured === undefined ||\n            intent.profileGeneration !== configured.profile.generation ||\n            intent.profileDigest !== configured.digest ||\n            requirementEncoding(intent.requirement) !==\n              requirementEncoding(configured.profile.requirement) ||\n            intent.attemptLimit !== configured.profile.attemptLimit ||\n            now >= DateTime.toEpochMillis(intent.expiresAt) ||\n            DateTime.toEpochMillis(intent.expiresAt) >\n              DateTime.toEpochMillis(intent.sourceExpiresAt) ||\n            DateTime.toEpochMillis(intent.sourceExpiresAt) >\n              DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt)\n          )\n            return yield* SessionStepUpInvalid.make({});\n\n          return intent;\n        });\n\n        const matchSource = (\n          intent: SessionStepUpIntent,\n          source: SessionStepUpSource<Claims[\"Type\"]>,\n        ) => {\n          const { session, credentialVersion, provenance } = source.inspection;\n          const revision = provenance.evidence.revision;\n\n          const sameRevisions =\n            revision.credentials.length === intent.revision.credentials.length &&\n            revision.credentials.every((item) =>\n              intent.revision.credentials.some(\n                (expected) =>\n                  expected.credentialId === item.credentialId &&\n                  expected.revision === item.revision,\n              ),\n            );\n\n          return (\n            intent.sourceKind === source.guard._tag &&\n            intent.sourceSessionId === session.sessionId &&\n            intent.sourceCredentialVersion === credentialVersion &&\n            intent.revision.subjectId === revision.subjectId &&\n            intent.revision.securityRevision === revision.securityRevision &&\n            sameRevisions &&\n            DateTime.toEpochMillis(intent.sourceAuthenticatedAt) ===\n              DateTime.toEpochMillis(session.assurance.authenticatedAt) &&\n            DateTime.toEpochMillis(intent.sourceExpiresAt) ===\n              DateTime.toEpochMillis(session.expiresAt) &&\n            DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt) ===\n              DateTime.toEpochMillis(session.absoluteExpiresAt)\n          );\n        };\n\n        return SessionStepUp.of({\n          prepareBegin: Effect.fn(\"SessionStepUp.prepareBegin\")(function* (input) {\n            const configured = registry.get(input.profileId);\n\n            if (configured === undefined) return yield* SessionStepUpInvalid.make({});\n            const source = yield* inspectSource(input.sourceCredential);\n            const evidence = source.inspection.provenance.evidence;\n\n            // requirements checks current status/revisions but does not require the\n            // old source proofs to satisfy the new profile before requesting it.\n            yield* readRequirement(yield* authority.requirements(evidence));\n            const credential = yield* secrets.generate();\n            const digest = yield* digestCredential(credential);\n\n            const bindingDigest = yield* secrets.digest(\n              yield* secrets.generate(),\n              \"step-up-binding\",\n            );\n\n            const flowId = AuthenticationFlowId.make(Redacted.value(yield* secrets.generate()));\n            const now = yield* DateTime.now;\n            const session = source.inspection.session;\n\n            yield* validateSessionTimeline(session, strategy.policy);\n\n            const expiresAt = freezeInstant(\n              DateTime.makeUnsafe(\n                Math.min(\n                  DateTime.toEpochMillis(now) + configured.profile.lifetimeMillis,\n                  DateTime.toEpochMillis(session.expiresAt),\n                  DateTime.toEpochMillis(session.absoluteExpiresAt),\n                ),\n              ),\n            );\n\n            const intent: Omit<SessionStepUpIntent, \"version\"> = Object.freeze({\n              _tag: \"SessionStepUpIntent\",\n              digest,\n              flowId,\n              bindingDigest,\n              revision: evidence.revision,\n              sourceKind: source.guard._tag,\n              sourceSessionId: session.sessionId,\n              sourceCredentialVersion: source.inspection.credentialVersion,\n              sourceAuthenticatedAt: freezeInstant(session.assurance.authenticatedAt),\n              sourceExpiresAt: freezeInstant(session.expiresAt),\n              sourceAbsoluteExpiresAt: freezeInstant(session.absoluteExpiresAt),\n              profileId: configured.profile.profileId,\n              profileGeneration: configured.profile.generation,\n              profileDigest: configured.digest,\n              requirement: configured.profile.requirement,\n              expiresAt,\n              attemptLimit: configured.profile.attemptLimit,\n            });\n\n            return yield* store.create(intent, now, (_, journal) =>\n              journal.prepare({\n                value: { _tag: \"StepUpPending\" as const, profileId: intent.profileId, expiresAt },\n                credentialCommands: [\n                  {\n                    _tag: \"Issue\" as const,\n                    slot: \"session-step-up\" as const,\n                    credential,\n                    expiresAtMillis: DateTime.toEpochMillis(expiresAt),\n                  },\n                ],\n              }),\n            );\n          }),\n          context: Effect.fn(\"SessionStepUp.context\")(function* (credential) {\n            const digest = yield* digestCredential(credential);\n\n            return yield* snapshotPendingAuthenticationContext(\n              yield* store.context({ digest, now: yield* DateTime.now }),\n            ).pipe(\n              Effect.catchTag(\"PendingAuthenticationInvalid\", () =>\n                Effect.fail(SessionStepUpInvalid.make({})),\n              ),\n            );\n          }),\n          rejectCredential: Effect.fn(\"SessionStepUp.rejectCredential\")(function* (credential) {\n            const digest = yield* digestCredential(credential);\n\n            return yield* store.reject({ digest, now: yield* DateTime.now }, (decision, journal) =>\n              journal.prepare(decision),\n            );\n          }),\n          prepareComplete: Effect.fn(\"SessionStepUp.prepareComplete\")(function* (input) {\n            const additional = yield* snapshotAuthenticationEvidence(input.additional);\n            const digest = yield* digestCredential(input.stepUpCredential);\n            const intent = yield* readIntent(digest, additional.bindingDigest);\n            const source = yield* inspectSource(input.sourceCredential);\n\n            if (!matchSource(intent, source)) return yield* SessionStepUpInvalid.make({});\n            const original = source.inspection.provenance.evidence;\n\n            const evidence = yield* snapshotAuthenticationEvidence(\n              yield* combineAuthenticationEvidence(\n                {\n                  ...original,\n                  flowId: intent.flowId,\n                  bindingDigest: intent.bindingDigest,\n                },\n                additional,\n              ).pipe(\n                Effect.catchTag(\"PendingAuthenticationInvalid\", () =>\n                  Effect.fail(SessionStepUpInvalid.make({})),\n                ),\n              ),\n            );\n\n            const requirement = yield* readRequirement(yield* authority.requirements(evidence));\n            const base = yield* assess(evidence, requirement);\n            const profile = yield* assess(evidence, intent.requirement);\n\n            if (!base.satisfied || !profile.satisfied) return yield* SessionStepUpInvalid.make({});\n            const generated = yield* planner.plan(source, evidence, base.assurance);\n\n            const replacement = Object.freeze({\n              ...generated.replacement,\n              inspection: yield* snapshotInspection(generated.replacement.inspection),\n            });\n\n            // Retain a separate private output graph: a consumer owner cannot alter\n            // the credential's paired public value through its persistence plan.\n            const output = yield* snapshotInspection(generated.replacement.inspection);\n            const planned = { credential: generated.credential, replacement };\n\n            if (planned.replacement._tag !== intent.sourceKind)\n              return yield* SessionStepUpInvalid.make({});\n\n            const event = yield* prepareHooks(\n              \"session-creation\",\n              planned.replacement.inspection.session,\n            ).pipe(Effect.provide(hooks));\n\n            // Hooks may suspend. Re-read source authority and assess both independent\n            // policies again; the native owner must repeat them at its commit clock.\n            const current = yield* inspectSource(input.sourceCredential);\n\n            if (\n              !matchSource(intent, current) ||\n              (source.guard._tag === \"Stateful\" &&\n                (current.guard._tag !== \"Stateful\" ||\n                  source.guard.digest !== current.guard.digest ||\n                  source.guard.rowVersion !== current.guard.rowVersion))\n            )\n              return yield* SessionStepUpInvalid.make({});\n\n            const currentRequirement = yield* readRequirement(\n              yield* authority.requirements(evidence),\n            );\n\n            if (\n              !(yield* assess(evidence, currentRequirement)).satisfied ||\n              !(yield* assess(evidence, intent.requirement)).satisfied\n            )\n              return yield* SessionStepUpInvalid.make({});\n            yield* validateSessionTimeline(planned.replacement.inspection.session, strategy.policy);\n            const now = yield* DateTime.now;\n\n            if (DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(intent.expiresAt))\n              return yield* SessionStepUpInvalid.make({});\n\n            const plan: SessionStepUpCompletionPlan<Claims[\"Type\"]> = Object.freeze({\n              intent,\n              source: current,\n              evidence,\n              baseRequirement: currentRequirement,\n              profileRequirement: intent.requirement,\n              now: freezeInstant(now),\n              replacement: planned.replacement,\n            });\n\n            return yield* store.complete(plan, (_, journal) => {\n              const result = issue(output.session, planned.credential);\n\n              journal.stage(event);\n\n              return journal.prepare({\n                ...result,\n                credentialCommands: [\n                  ...result.credentialCommands,\n                  { _tag: \"Clear\" as const, slot: \"session-step-up\" as const },\n                ],\n              });\n            });\n          }),\n        });\n      }),\n    );\n  };\n\n  const { Begin: StepUpBegin, Complete: StepUpComplete, Reject: StepUpReject } = stepUpOperations;\n\n  const stepUpHandlersLayer = Layer.mergeAll(\n    StepUpBegin.credentialHandlerLayer(\n      Effect.fn(\"SessionStepUp.Begin\")(function* (input, context) {\n        yield* checkNoAmbientCommit();\n        const caller = yield* requireAuthenticated(context);\n        const source = yield* (yield* SessionStrategy).inspectForStepUp(input.sourceCredential);\n\n        if (\n          caller.subjectId !== source.inspection.session.subjectId ||\n          caller.sessionId !== source.inspection.session.sessionId\n        )\n          return yield* SessionStepUpInvalid.make({});\n\n        return yield* readCommitted(yield* (yield* SessionStepUp).prepareBegin(input));\n      }),\n    ),\n    StepUpComplete.credentialHandlerLayer(\n      Effect.fn(\"SessionStepUp.Complete\")(function* (input) {\n        yield* checkNoAmbientCommit();\n\n        return yield* readCommitted(yield* (yield* SessionStepUp).prepareComplete(input));\n      }),\n    ),\n    StepUpReject.handlerLayer(\n      Effect.fn(\"SessionStepUp.Reject\")(function* (input) {\n        yield* checkNoAmbientCommit();\n\n        return yield* readCommitted(\n          yield* (yield* SessionStepUp).rejectCredential(input.stepUpCredential),\n        );\n      }),\n    ),\n  );\n\n  const {\n    Complete,\n    CompletePending,\n    RejectPending,\n    Capabilities,\n    Verify,\n    Renew,\n    SignOut,\n    List,\n    Revoke,\n    RevokeAll,\n  } = operations;\n\n  const capabilitiesHandlerLayer = Capabilities.handlerLayer(\n    Effect.fn(\"Session.Capabilities\")(function* () {\n      return (yield* SessionStrategy).capabilities;\n    }),\n  );\n\n  /** Verification, renewal and sign-out need no authentication-completion authority. */\n  const sessionHandlersLayer = Layer.mergeAll(\n    Verify.handlerLayer(\n      Effect.fn(\"Session.Verify\")(function* (input) {\n        return yield* (yield* SessionStrategy).verify(input.credential);\n      }),\n    ),\n    Renew.credentialHandlerLayer(\n      Effect.fn(\"Session.Renew\")(function* (input) {\n        yield* checkNoAmbientCommit();\n\n        return yield* readCommitted(yield* (yield* SessionStrategy).prepareRenew(input.credential));\n      }),\n    ),\n    SignOut.credentialHandlerLayer(\n      Effect.fn(\"Session.SignOut\")(function* (input) {\n        yield* checkNoAmbientCommit();\n\n        return yield* (yield* SessionStrategy).signOut(input.credential);\n      }),\n    ),\n  );\n\n  const handlersLayer = (management: AssuranceRequirement) => {\n    management = Object.freeze({\n      ...management,\n      factors:\n        management.factors === undefined ? undefined : Object.freeze([...management.factors]),\n    });\n\n    return Layer.mergeAll(\n      capabilitiesHandlerLayer,\n      Complete.credentialHandlerLayer(\n        Effect.fn(\"Session.Complete\")(function* (input) {\n          yield* checkNoAmbientCommit();\n\n          return yield* readCommitted(yield* (yield* AuthenticationCompletion).prepare(input));\n        }),\n      ),\n      CompletePending.credentialHandlerLayer(\n        Effect.fn(\"Session.CompletePending\")(function* (input) {\n          yield* checkNoAmbientCommit();\n\n          return yield* readCommitted(\n            yield* (yield* AuthenticationCompletion).preparePending(input),\n          );\n        }),\n      ),\n      RejectPending.handlerLayer(\n        Effect.fn(\"Session.RejectPending\")(function* (input) {\n          yield* checkNoAmbientCommit();\n\n          return yield* readCommitted(\n            yield* (yield* AuthenticationCompletion).rejectPending(input),\n          );\n        }),\n      ),\n      sessionHandlersLayer,\n      List.handlerLayer(\n        Effect.fn(\"Session.List\")(function* (input, context) {\n          const caller = yield* requireAuthenticated(context);\n          const strategy = yield* SessionStrategy;\n          const session = yield* strategy.verify(input.credential);\n\n          if (session.subjectId !== caller.subjectId) return yield* SessionInvalid.make({});\n\n          return yield* strategy.list({\n            cursor: input.cursor,\n            limit: input.limit,\n            subjectId: session.subjectId,\n            now: yield* DateTime.now,\n          });\n        }),\n      ),\n      Revoke.handlerLayer(\n        Effect.fn(\"Session.Revoke\")(function* (input, context) {\n          yield* checkNoAmbientCommit();\n          const caller = yield* requireAssurance(context, management);\n          const strategy = yield* SessionStrategy;\n          const session = yield* strategy.verify(input.credential);\n\n          if (session.subjectId !== caller.subjectId) return yield* SessionInvalid.make({});\n\n          return yield* strategy.revoke(session, input.sessionId);\n        }),\n      ),\n      RevokeAll.handlerLayer(\n        Effect.fn(\"Session.RevokeAll\")(function* (input, context) {\n          yield* checkNoAmbientCommit();\n          const caller = yield* requireAssurance(context, management);\n          const strategy = yield* SessionStrategy;\n          const session = yield* strategy.verify(input.credential);\n\n          if (session.subjectId !== caller.subjectId) return yield* SessionInvalid.make({});\n          yield* strategy.revokeAll(session);\n\n          return sessionInvalidationWindow(\n            \"all-session-revocation\",\n            strategy.capabilities,\n            strategy.policy,\n          );\n        }),\n      ),\n    );\n  };\n\n  return Object.freeze({\n    moduleId,\n    claims,\n    /** Stateful sessions and authentication completion with portable defaults. */\n    layer: (policy: SessionPolicy) =>\n      completionLayer().pipe(\n        Layer.provideMerge(statefulLayer(policy)),\n        Layer.provide([cryptoLayer, hooksLayer]),\n      ),\n    Session,\n    CompletionResult,\n    SessionStrategy,\n    SessionStepUp,\n    SessionStepUpPersistence,\n    stepUpLayer,\n    stepUpHandlersLayer,\n    stepUpOperations,\n    stepUpGroup,\n    AuthenticationCompletion,\n    StatefulSessionPersistence,\n    SessionRepository,\n    SignedSessionValidity,\n    PendingAuthentication,\n    statefulLayer,\n    statelessLayer,\n    stateAssistedLayer,\n    completionLayer,\n    capabilitiesHandlerLayer,\n    sessionHandlersLayer,\n    handlersLayer,\n    operations,\n    group,\n  });\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAmGA,MAAM,wBACJ,WAEA,OAAO,KACL,OAAO,UAAU,UACf,kBACE,oBACA,MAAM,YACJ,MAAM,QAAQ,QACX,WACC,MAAM,aAAa,MAAM,KACzB,OAAO,MAAM,SAAS,oBACtB,OAAO,MAAM,SAAS,YAC1B,CACF,CACF,CACF,CACF;AAkBF,MAAa,qBAIX,UACA,WACG;CACH,MAAM,EAAE,SAAS,kBAAkB,YAAY,OAAO,kBAAkB,gBACtE,oBAAoB,UAAU,MAAM;CAEtC,MAAM,cAKF,QAAQ,OAAO;CAmCnB,MAAM,kBAAkB,QAAQ,QAC9B,wBAAwB,SAAS,UACnC;CAGA,MAAM,gBAAgB,QAAQ,QAe5B,wBAAwB,SAAS,eAAe;CAElD,MAAM,2BAA2B,QAAQ,QAGvC,wBAAwB,SAAS,mBAAmB;CAEtD,MAAM,6BAA6B,QAAQ,QAGzC,wBAAwB,SAAS,aAAa;CAEhD,MAAM,oBAAoB,QAAQ,QAGhC,wBAAwB,SAAS,YAAY;CAE/C,MAAM,wBAAwB,QAAQ,QAGpC,wBAAwB,SAAS,UAAU;CAE7C,MAAM,wBAAwB,QAAQ,QAGpC,wBAAwB,SAAS,SAAS;CAE5C,MAAM,eAAe,eACnB,OAAO,KAAK,6BAA6B,KAAK,EAAE,WAAW,CAAC,CAAC;CAE/D,MAAM,uBAAuB,OAAO,GAAG,8BAA8B,CAAC,CAAC,aAAa;EAClF,IAAI,OAAO,gBACT,OAAO,OAAO,6BAA6B,KAAK,EAC9C,YAAY,+DACd,CAAC;CACL,CAAC;CAED,MAAM,mBAAmB,SAA0B,KAAmB,WAA0B;EAC9F,MAAM,UAAU,SAAS,IAAI,QAAQ,UAAU,EAAE,cAAc,OAAO,sBAAsB,CAAC;EAE7F,OAAO,SAAS,cAAc,GAAG,IAAI,SAAS,cAAc,OAAO,IAC/D,OAAO,KAAK,uBAAuB,KAAK,EAAE,QAAQ,CAAC,CAAC,IACpD,OAAO;CACb;CAEA,MAAM,iBAAoB,YACxB,QAAQ,KAAK,KAAK,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CAAC;CAEtE,MAAM,eAAe,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACrD,QACA,SACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,UAAU,OAAO,mBAAmB,QAAQ;EAElD,MAAM,WAAW,kBAAkB;GACjC;GACA,WAAW,GAAG,SAAS;GACvB,GAAI,YAAY,KAAA,IACZ,CAAC,IACD;IAAE,WAAW,QAAQ;IAAW,QAAQ,QAAQ,UAAU;GAAO;GACrE,aAAa,CAAC;EAChB,CAAC;EAED,OAAO,MAAM,OAAO,QAAQ;EAC5B,MAAM,KAAK,OAAO,QAAQ,SAAS;EAEnC,OAAO,eAAe;GACpB,IAAI,iBAAiB,KAAK,SAAS,MAAM,EAAE,CAAC;GAC5C,kBAAkB,SAAS,cAAc,OAAO,SAAS,GAAG;GAC5D;EACF,CAAC;CACH,CAAC;CAID,MAAM,qBAAqB,OAAO,YAAY,OAAO,OAAO,OAAO,CAAC;CAEpE,MAAM,kBAAkB,YACtB,OAAO,aAAa,kBAAkB,CAAC,CAAC,OAAO,CAAC,CAAC,KAC/C,OAAO,QAAQ,OAAO,aAAa,kBAAkB,CAAC,GACtD,OAAO,eAAe,eAAe,KAAK,CAAC,CAAC,CAAC,CAC/C;CAEF,MAAM,SACJ,SACA,gBACkC;EAClC,OAAO,OAAO,WAAW,kBAAkB,CAAC,CAAC,OAAO,WAAW,kBAAkB,CAAC,CAAC,OAAO,CAAC;EAC3F,oBAAoB,CAClB;GACE,MAAM;GACN,MAAM;GACN;GACA,iBAAiB,SAAS,cAAc,QAAQ,SAAS;EAC3D,CACF;CACF;CAEA,MAAM,oBAAoB,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAC/D,SACA,OACA,SACA;EACA,MAAM,aAAa,OAAO,wCAAwC,KAAK,CAAC,CAAC,KACvE,OAAO,eAAe,eAAe,KAAK,CAAC,CAAC,CAAC,CAC/C;EAEA,MAAM,oBAAoB,OAAO,OAAO,aAAa,wBAAwB,CAAC,CAAC,OAAO,CAAC,CAAC,KACtF,OAAO,eAAe,eAAe,KAAK,CAAC,CAAC,CAAC,CAC/C;EAEA,MAAM,WAAW,WAAW;EAC5B,MAAM,eAAe,QAAQ,UAAU;EACvC,MAAM,2BAAW,IAAI,IAAoB;EACzC,MAAM,YAAY,IAAI,IAAI,SAAS,SAAS,YAAY,KAAK,SAAS,KAAK,YAAY,CAAC;EAExF,IACE,UAAU,SAAS,SAAS,SAAS,YAAY,UACjD,SAAS,OAAO,MAAM,UAAU,CAAC,UAAU,IAAI,MAAM,YAAY,CAAC,GAElE,OAAO,OAAO,eAAe,KAAK,CAAC,CAAC;EACtC,KAAK,MAAM,SAAS,SAAS,QAC3B,IAAI,CAAC,SAAS,IAAI,MAAM,YAAY,GAAG,SAAS,IAAI,MAAM,cAAc,SAAS,IAAI;EACvF,IACE,QAAQ,cAAc,SAAS,SAAS,aACxC,QAAQ,qBAAqB,SAAS,SAAS,oBAC/C,iBAAiB,KAAA,KACjB,aAAa,WAAW,SAAS,OAAO,UACxC,SAAS,OAAO,MAAM,OAAO,UAAU;GACrC,MAAM,SAAS,aAAa;GAE5B,OACE,OAAO,WAAW,MAAM,UACxB,OAAO,sBAAsB,SAAS,IAAI,MAAM,YAAY,KAC5D,OAAO,iBAAiB,MAAM,gBAC9B,OAAO,sBAAsB,MAAM,qBACnC,SAAS,cAAc,OAAO,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,KACrF,OAAO,QAAQ,WAAW,MAAM,QAAQ,UACxC,OAAO,QAAQ,MAAM,QAAQ,MAAM,WAAW,MAAM,QAAQ,EAAE;EAElE,CAAC,GAED,OAAO,OAAO,eAAe,KAAK,CAAC,CAAC;EAEtC,OAAO,OAAO,OAAO;GAAE;GAAS;GAAY;EAAkB,CAAC;CACjE,CAAC;CAED,MAAM,qBAAqB,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACjE,QACA,UACA,WACA,QACA,WACA;EACA,MAAM,MAAM,OAAO,SAAS;EAE5B,MAAM,UAAU,OAAO,eAAe;GACpC,GAAG;GACH;GACA,WAAW,SAAS,SAAS;GAC7B,kBAAkB,SAAS,SAAS;GACpC,WAAW,wBAAwB,KAAK;IACtC,GAAG;IACH,iBAAiB,OAAO,UAAU;GACpC,CAAC;GACD,UAAU;GACV,WAAW,SAAS,WAClB,KAAK,IACH,SAAS,cAAc,OAAO,iBAAiB,GAC/C,SAAS,cAAc,GAAG,IAAI,OAAO,kBACvC,CACF;EACF,CAAC;EAED,OAAO,wBAAwB,QAAQ,MAAM;EAC7C,OAAO,wBAAwB,SAAS,MAAM;EAE9C,OAAO;CACT,CAAC;CAED,MAAM,iBAAiB,eACrB,MAAM,cACJ,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,OAAO,sBAAsB,YAAY,oBAAoB;EAC5E,MAAM,QAAQ,OAAO;EACrB,MAAM,aAAa,OAAO;EAC1B,MAAM,UAAU,OAAO,mBAAmB,QAAQ;EAElD,MAAM,WAAW,OAAO,OAAO,QAK7B;EAEF,MAAM,YAAY,YAChB,eAAe,OAAO,CAAC,CAAC,KACtB,OAAO,QAAQ,QAAQ,GACvB,OAAO,SAAS,UACd,wBAAwB,OAAO,MAAM,CAAC,CAAC,KAAK,OAAO,GAAG,KAAK,CAAC,CAC9D,CACF;EAEF,MAAM,mBAAmB,OAAO,GAAG,kCAAkC,CAAC,CAAC,WACrE,YACA;GACA,MAAM,SAAS,OAAO,QAAQ,OAAO,YAAY,QAAQ;GACzD,MAAM,SAAS,OAAO,MAAM,OAAO;IAAE;IAAQ,KAAK,OAAO,SAAS;GAAI,CAAC;GAEvE,MAAM,aAAa,OAAO,kBACxB,OAAO,SAAS,MAAM,GACtB,OAAO,YACP,OAAO,iBACT;GAEA,OAAO,OAAO,OAAO;IACnB;IACA,OAAO,OAAO,OAAO;KAAE,MAAM;KAAqB;KAAQ,YAAY,OAAO;IAAQ,CAAC;GACxF,CAAC;EACH,CAAC;EAED,MAAM,UAAU,OAAO,GAAG,yBAAyB,CAAC,EACjD,eACC,iBAAiB,UAAU,CAAC,CAAC,KAAK,OAAO,KAAK,WAAW,OAAO,UAAU,CAAC,CAC/E;EAEA,MAAM,SAAS,OAAO,GAAG,wBAAwB,CAAC,EAC/C,eACC,QAAQ,UAAU,CAAC,CAAC,KAAK,OAAO,KAAK,UAAU,MAAM,OAAO,CAAC,CACjE;EAEA,MAAM,WAAW,gBAAgB,GAAG;GAClC;GACA,cAAc;GACd;GACA;GACA;GACA,kBAAkB,OAAO,GAAG,kCAAkC,CAAC,CAAC,WAC9D,OACA;IACA,QAAQ;KAAE,GAAG;KAAO,UAAU,OAAO,+BAA+B,MAAM,QAAQ;IAAE;IAEpF,MAAM,cAAc,QAAO,OADF,wBAAA,CACY,aAAa,MAAM,QAAQ;IAEhE,MAAM,WAAW,OAAO,qBAAqB,MAAM,UAAU,WAAW,CAAC,CAAC,KACxE,OAAO,eAAe,eAAe,KAAK,CAAC,CAAC,CAAC,CAC/C;IAEA,IAAI,CAAC,SAAS,WAAW,OAAO,OAAO,eAAe,KAAK,CAAC,CAAC;IAC7D,MAAM,MAAM,OAAO,SAAS;IAE5B,MAAM,oBAAoB,SAAS,IAAI,SAAS,UAAU,iBAAiB,EACzE,cAAc,OAAO,uBACvB,CAAC;IAED,MAAM,YAAY,SAAS,WACzB,KAAK,IACH,SAAS,cAAc,iBAAiB,GACxC,SAAS,cAAc,GAAG,IAAI,OAAO,kBACvC,CACF;IAEA,MAAM,aAAa,OAAO,QAAQ,SAAS;IAC3C,MAAM,SAAS,OAAO,QAAQ,OAAO,YAAY,QAAQ;IAEzD,MAAM,OAAO;KACX,WAAW,MAAM,SAAS,SAAS;KACnC,kBAAkB,MAAM,SAAS,SAAS;KAC1C,WAAW,SAAS;KACpB,UAAU;KACV;KACA;KACA,QAAQ,MAAM;KACd;KACA,YAAY,OAAO,wCAAwC,EACzD,UAAU,MAAM,SAClB,CAAC;KACD,mBAAmB,yBAAyB,KAC1C,SAAS,MAAM,OAAO,QAAQ,SAAS,CAAC,CAC1C;IACF;IAEA,OAAO,wBAAwB,MAAM,MAAM;IAC3C,MAAM,QAAQ,OAAO,aAAa,WAAW,IAAI,CAAC,CAAC,KAAK,OAAO,QAAQ,QAAQ,CAAC;IAEhF,MAAM,WAAW,OAAO,aAAa,oBAAoB,IAAI,CAAC,CAAC,KAC7D,OAAO,QAAQ,QAAQ,CACzB;IAEA,OAAO,wBAAwB,MAAM,MAAM;IAC3C,MAAM,YAAY,OAAO,SAAS;IAElC,OAAO,OAAO,MAAM,UAClB;KAAE,SAAS;KAAM,UAAU,MAAM;KAAU,SAAS,MAAM;KAAS,KAAK;IAAU,IACjF,QAAQ,YAAY;KACnB,QAAQ,MAAM,KAAK;KACnB,QAAQ,MAAM,QAAQ;KAEtB,OAAO,QAAQ,QAAQ,MAAM,QAAQ,UAAU,CAAC;IAClD,CACF;GACF,CAAC;GACD,cAAc,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACtD,YACA;IACA,MAAM,SAAS,OAAO,QAAQ,OAAO,YAAY,QAAQ;IACzD,MAAM,MAAM,OAAO,SAAS;IAC5B,MAAM,SAAS,OAAO,MAAM,OAAO;KAAE;KAAQ;IAAI,CAAC;IAQlD,MAAM,WAAU,OANS,kBACvB,OAAO,SAAS,MAAM,GACtB,OAAO,YACP,OAAO,iBACT,EAAA,CAE0B;IAE1B,OAAO,gBAAgB,SAAS,KAAK,MAAM;IAC3C,MAAM,OAAO,OAAO,QAAQ,SAAS;IACrC,MAAM,aAAa,OAAO,QAAQ,OAAO,MAAM,QAAQ;IAEvD,MAAM,wBAAwB,yBAAyB,KACrD,SAAS,MAAM,OAAO,QAAQ,SAAS,CAAC,CAC1C;IAEA,MAAM,QAAQ,OAAO,aAAa,oBAAoB,OAAO,CAAC,CAAC,KAC7D,OAAO,QAAQ,QAAQ,CACzB;IAEA,OAAO,wBAAwB,SAAS,MAAM;IAC9C,MAAM,YAAY,OAAO,SAAS;IAElC,MAAM,gBAAgB,SAAS,WAC7B,KAAK,IACH,SAAS,cAAc,QAAQ,iBAAiB,GAChD,SAAS,cAAc,GAAG,IAAI,OAAO,kBACvC,CACF;IAEA,OAAO,OAAO,MAAM,OAClB;KACE,WAAW,QAAQ;KACnB,gBAAgB;KAChB,iBAAiB,OAAO;KACxB,0BAA0B,QAAQ;KAClC;KACA;KACA;KACA,KAAK;IACP,IACC,SAAS,YAAY;KACpB,QAAQ,MAAM,KAAK;KAEnB,OAAO,QAAQ,QAAQ,MAAM,SAAS,IAAI,CAAC;IAC7C,CACF;GACF,CAAC;GACD,SAAS,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC5C,YACA;IACA,MAAM,SAAS,OAAO,OAAO,IAAI,aAAa;KAC5C,MAAM,SAAS,OAAO,QAAQ,OAAO,YAAY,QAAQ;KACzD,MAAM,QAAQ,OAAO,aAAa,UAAU,CAAC,CAAC,KAAK,OAAO,QAAQ,QAAQ,CAAC;KAE3E,MAAM,UAAU,OAAO,MAAM,aAAa,SAAS,SAAS,YAAY;MACtE,QAAQ,MAAM,KAAK;MAEnB,OAAO,QAAQ,QAAQ;OACrB,iBAAiB;OACjB,cAAc,UAAW,YAAuB;MAClD,CAAC;KACH,CAAC;KAED,OAAO,OAAO,cAAc,OAAO;IACrC,CAAC,CAAC,CAAC,KAAK,sBAAsB,OAAO,MAAM;IAE3C,OAAO;KACL,OACE,OAAO,SAAS,YACZ,OAAO,QAAQ,SAAS,mBACtB;MAAE,iBAAiB;MAAe,cAAc;KAA2B,IAC3E,0BAA0B,KAAK,EAAE,iBAAiB,KAAK,CAAC,IAC1D,OAAO;KACb,oBAAoB,CAAC;MAAE,MAAM;MAAkB,MAAM;KAAmB,CAAC;IAC3E;GACF,CAAC;GACD,MAAM,WAAW;GACjB,QAAQ,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAAW,SAAS,WAAW;IACzE,MAAM,QAAQ,OAAO,aAAa,YAAY,OAAO,CAAC,CAAC,KAAK,OAAO,QAAQ,QAAQ,CAAC;IAEpF,OAAO,OAAO,cACZ,OAAO,MAAM,OACX;KACE,WAAW,QAAQ;KACnB;KACA,0BAA0B,QAAQ;IACpC,IACC,GAAG,YAAY;KACd,QAAQ,MAAM,KAAK;KAEnB,OAAO,QAAQ,QAAQ,KAAA,CAAS;IAClC,CACF,CACF;GACF,CAAC;GACD,WAAW,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAAW,SAAS;IACpE,MAAM,QAAQ,OAAO,aAAa,YAAY,OAAO,CAAC,CAAC,KAAK,OAAO,QAAQ,QAAQ,CAAC;IAEpF,OAAO,OAAO,cACZ,OAAO,MAAM,UACX;KACE,WAAW,QAAQ;KACnB,0BAA0B,QAAQ;IACpC,IACC,GAAG,YAAY;KACd,QAAQ,MAAM,KAAK;KAEnB,OAAO,QAAQ,QAAQ,KAAA,CAAS;IAClC,CACF,CACF;GACF,CAAC;EACH,CAAC;EAED,MAAM,OAAO,OAAO,GAAG,uCAAuC,CAAC,CAAC,WAC9D,QACA,UACA,WACA;GACA,IAAI,OAAO,MAAM,SAAS,YAAY,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;GAChF,MAAM,aAAa,OAAO,QAAQ,SAAS;GAC3C,MAAM,aAAa,OAAO,QAAQ,OAAO,YAAY,QAAQ;GAE7D,MAAM,UAAU,OAAO,mBACrB,OAAO,WAAW,SAClB,UACA,WACA,QACA,OAAO,WAAW,QAAQ,SAC5B;GAEA,MAAM,aAAa,OAAO,kBACxB,SACA,EAAE,SAAS,GACX,yBAAyB,KAAK,SAAS,MAAM,OAAO,QAAQ,SAAS,CAAC,CAAC,CACzE;GAEA,OAAO;IACL;IACA,aAAa,OAAO,OAAO;KACzB,MAAM;KACN;KACA,gBAAgB,OAAO,MAAM;KAC7B,oBAAoB,OAAO,MAAM;KACjC;IACF,CAAC;GACH;EACF,CAAC;EAED,OAAO,QAAQ,KAAK,iBAAiB,QAAQ,CAAC,CAAC,KAAK,QAAQ,IAAI,eAAe,EAAE,KAAK,CAAC,CAAC;CAC1F,CAAC,CACH;CAEF,MAAM,eACJ,YACA,SACA,SACG;EAsWH,OArWc,MAAM,cAClB,OAAO,IAAI,aAAa;GACtB,MAAM,WACJ,SAAS,mBACL,OAAO,KAAK,OAAO,qBAAqB,IACxC,OAAO,KAAmB;GAEhC,MAAM,eAAe,OAAO,OAAO,QAAQ,IACvC,4BACA;GAEJ,MAAM,SAAS,OAAO,sBAAsB,YAAY,YAAY;GACpE,MAAM,QAAQ,OAAO;GACrB,MAAM,UAAU,OAAO,mBAAmB,QAAQ;GAElD,MAAM,WAAW,OAAO,OAAO,QAK7B;GAEF,MAAM,WAAW,OAAO,OAAO;IAC7B,SAAS,OAAO,QAAQ,CAAC;IACzB,UAAU,OAAO,QAAQ,QAAQ;IACjC,QAAQ,OAAO;IACf,UAAU,OAAO;IACjB,YAAY,OAAO;IACnB,SAAS;IACT,YAAY;IACZ,mBAAmB;GACrB,CAAC;GAED,MAAM,UAAU,OAAO,wBAAwB,UAAU,SAAS,OAAO,iBAAiB;GAE1F,MAAM,UAAU,eACd,QAAQ,OAAO;IACb,SAAS;IACT;IACA,QAAQ,OAAO;IACf,UAAU,OAAO;IACjB,YAAY,OAAO;IACnB,GAAG;GACL,CAAC;GAEH,MAAM,UAAU,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACjD,YACA;IACA,MAAM,WAAW,OAAO,QAAQ,OAAO,UAAU;IAEjD,IACE,SAAS,WAAW,OAAO,UAC3B,SAAS,aAAa,OAAO,YAC7B,SAAS,eAAe,OAAO,YAE/B,OAAO,OAAO,eAAe,KAAK,CAAC,CAAC;IACtC,OAAO,wBAAwB,SAAS,SAAS,MAAM;IACvD,IAAI,OAAO,OAAO,QAAQ,GACxB,OAAO,SAAS,MAAM,OAAO,SAAS,SAAS,OAAO,SAAS,GAAG;IAEpE,OAAO,OAAO,kBACZ,OAAO,eAAe,SAAS,OAAO,GACtC,SAAS,YACT,SAAS,iBACX;GACF,CAAC;GAED,MAAM,mBAAmB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACnE,YACA;IACA,OAAO,OAAO,OAAO;KACnB,YAAY,OAAO,QAAQ,UAAU;KACrC,OAAO,OAAO,OACZ,OAAO,OAAO,QAAQ,IAClB,EAAE,MAAM,sBAA+B,IACvC,EAAE,MAAM,kBAA2B,CACzC;IACF,CAAC;GACH,CAAC;GAED,MAAM,SAAS,OAAO,GAAG,sBAAsB,CAAC,EAAE,eAChD,QAAQ,UAAU,CAAC,CAAC,KAAK,OAAO,KAAK,UAAU,MAAM,OAAO,CAAC,CAC/D;GAEA,MAAM,WAAW,gBAAgB,GAAG;IAClC;IACA;IACA;IACA;IACA;IACA,kBAAkB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WAC5D,OACA;KACA,QAAQ;MAAE,GAAG;MAAO,UAAU,OAAO,+BAA+B,MAAM,QAAQ;KAAE;KACpF,MAAM,YAAY,OAAO;KACzB,MAAM,cAAc,OAAO,UAAU,aAAa,MAAM,QAAQ;KAEhE,MAAM,WAAW,OAAO,qBAAqB,MAAM,UAAU,WAAW,CAAC,CAAC,KACxE,OAAO,eAAe,eAAe,KAAK,CAAC,CAAC,CAAC,CAC/C;KAEA,IAAI,CAAC,SAAS,WAAW,OAAO,OAAO,eAAe,KAAK,CAAC,CAAC;KAC7D,MAAM,MAAM,OAAO,SAAS;KAE5B,MAAM,oBAAoB,SAAS,IAAI,SAAS,UAAU,iBAAiB,EACzE,cAAc,OAAO,uBACvB,CAAC;KAED,MAAM,UAAmB;MACvB,WAAW,UAAU,KAAK,SAAS,MAAM,OAAO,QAAQ,SAAS,CAAC,CAAC;MACnE,WAAW,MAAM,SAAS,SAAS;MACnC,kBAAkB,MAAM,SAAS,SAAS;MAC1C,WAAW,SAAS;MACpB,UAAU;MACV,WAAW,SAAS,WAClB,KAAK,IACH,SAAS,cAAc,iBAAiB,GACxC,SAAS,cAAc,GAAG,IAAI,OAAO,kBACvC,CACF;MACA;MACA,QAAQ,MAAM;KAChB;KAEA,OAAO,wBAAwB,SAAS,MAAM;KAE9C,MAAM,aAAa,OAAO,wCAAwC,EAChE,UAAU,MAAM,SAClB,CAAC;KAED,MAAM,oBAAoB,yBAAyB,KACjD,SAAS,MAAM,OAAO,QAAQ,SAAS,CAAC,CAC1C;KAEA,MAAM,aAAa,OAAO,OAAO;MAAE;MAAS;MAAY;KAAkB,CAAC;KAC3E,MAAM,QAAQ,OAAO,aAAa,WAAW,OAAO,CAAC,CAAC,KAAK,OAAO,QAAQ,QAAQ,CAAC;KAEnF,MAAM,WAAW,OAAO,aAAa,oBAAoB,OAAO,CAAC,CAAC,KAChE,OAAO,QAAQ,QAAQ,CACzB;KAEA,OAAO,wBAAwB,SAAS,MAAM;KAE9C,OAAO,OAAO,UAAU,QACtB;MACE,UAAU,MAAM;MAChB,SAAS,MAAM;MACf,KAAK,OAAO,SAAS;MACrB,WAAW,QAAQ;MACnB,mBAAmB,QAAQ;KAC7B,IACC,GAAG,YAAY;MACd,QAAQ,MAAM,KAAK;MACnB,QAAQ,MAAM,QAAQ;MAEtB,OAAO,QAAQ,QAAQ,MAAM,SAAS,UAAU,CAAC;KACnD,CACF;IACF,CAAC;IACD,cAAc,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACpD,YACA;KACA,MAAM,SAAS,OAAO,QAAQ,UAAU;KACxC,MAAM,UAAU,OAAO;KACvB,MAAM,MAAM,OAAO,SAAS;KAE5B,OAAO,gBAAgB,SAAS,KAAK,MAAM;KAE3C,MAAM,UAAU;MACd,GAAG;MACH,UAAU;MACV,WAAW,SAAS,WAClB,KAAK,IACH,SAAS,cAAc,QAAQ,iBAAiB,GAChD,SAAS,cAAc,GAAG,IAAI,OAAO,kBACvC,CACF;KACF;KAEA,MAAM,OAAO,OAAO,OAAO;MACzB,SAAS;MACT,YAAY,OAAO;MACnB,mBAAmB,yBAAyB,KAC1C,SAAS,MAAM,OAAO,QAAQ,SAAS,CAAC,CAC1C;KACF,CAAC;KAED,MAAM,QAAQ,OAAO,aAAa,oBAAoB,OAAO,CAAC,CAAC,KAC7D,OAAO,QAAQ,QAAQ,CACzB;KAEA,OAAO,wBAAwB,SAAS,MAAM;KAC9C,OAAO,wBAAwB,SAAS,MAAM;KAC9C,IAAI,OAAO,OAAO,QAAQ,GAAG,OAAO,SAAS,MAAM,OAAO,SAAS,OAAO,SAAS,GAAG;KAgBtF,QAAO,OAbe,kBACnB,YACC,OAAO,WAAW;MAChB,QAAQ,MAAM,KAAK;MAEnB,OAAO,QAAQ,QAAQ,MAAM,SAAS,IAAI,CAAC;KAC7C,CAAC,GACH,EAAE,MAAM,cAAc,CACxB,CAAC,CAAC,KACA,OAAO,eAAe,gBAAgB,KAAK,GAC3C,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CACnD,EAAA,CAEc;IAChB,CAAC;IACD,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAC1C,YACA;KACA,MAAM,UAAU,OAAO,OAAO,IAAI,aAAa;MAC7C,MAAM,QAAQ,OAAO,aAAa,UAAU,CAAC,CAAC,KAAK,OAAO,QAAQ,QAAQ,CAAC;MAE3E,IAAI,OAAO,OAAO,QAAQ,GAAG;OAC3B,MAAM,UAAU,OAAO,OAAO,UAAU;OAExC,MAAM,UAAU,OAAO,SAAS,MAAM,OACpC;QACE,WAAW,QAAQ;QACnB,WAAW,QAAQ;QACnB,mBAAmB,QAAQ;QAC3B,0BAA0B,QAAQ;OACpC,IACC,GAAG,YAAY;QACd,QAAQ,MAAM,KAAK;QAEnB,OAAO,QAAQ,QAAQ;SACrB,iBAAiB;SACjB,cAAc;QAChB,CAAC;OACH,CACF;OAEA,OAAO,OAAO,cAAc,OAAO;MACrC;MAEA,MAAM,SAAS,OAAO,kBACnB,YACC,OAAO,WAAW;OAChB,QAAQ,MAAM,KAAK;OAEnB,OAAO,QAAQ,QAAQ;QACrB,iBAAiB;QACjB,cAAc;OAChB,CAAC;MACH,CAAC,GACH,EAAE,MAAM,cAAc,CACxB,CAAC,CAAC,KACA,OAAO,eAAe,gBAAgB,KAAK,GAC3C,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CACnD;MAEA,OAAO,OAAO,cAAc,OAAO,KAAK;KAC1C,CAAC,CAAC,CAAC,KAAK,sBAAsB,OAAO,MAAM;KAS3C,OAAO;MACL,OAPA,QAAQ,SAAS,YACb,QAAQ,QAAQ,SAAS,mBACvB;OAAE,iBAAiB;OAAM,cAAc;MAAkB,IACzD,0BAA0B,KAAK,EAAE,iBAAiB,KAAK,CAAC,IAC1D,QAAQ;MAIZ,oBAAoB,CAAC;OAAE,MAAM;OAAkB,MAAM;MAAmB,CAAC;KAC3E;IACF,CAAC;IACD,YAAY,YAAY,iBAAiB;IACzC,QAAQ,OAAO,GAAG,sBAAsB,CAAC,CAAC,WAAW,SAAS,WAAW;KACvE,IAAI,OAAO,OAAO,QAAQ,GAAG,OAAO,OAAO,YAAY,wBAAwB;KAC/E,MAAM,QAAQ,OAAO,aAAa,YAAY,OAAO,CAAC,CAAC,KAAK,OAAO,QAAQ,QAAQ,CAAC;KAEpF,OAAO,OAAO,cACZ,OAAO,SAAS,MAAM,OACpB;MACE,WAAW,QAAQ;MACnB;MACA,mBAAmB,SAAS,IAAI,OAAO,SAAS,KAAK,EACnD,cAAc,OAAO,oCACvB,CAAC;MACD,0BAA0B,QAAQ;KACpC,IACC,GAAG,YAAY;MACd,QAAQ,MAAM,KAAK;MAEnB,OAAO,QAAQ,QAAQ,KAAA,CAAS;KAClC,CACF,CACF;IACF,CAAC;IACD,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,SAAS;KAClE,IAAI,OAAO,OAAO,QAAQ,GAAG,OAAO,OAAO,YAAY,sBAAsB;KAC7E,MAAM,QAAQ,OAAO,aAAa,YAAY,OAAO,CAAC,CAAC,KAAK,OAAO,QAAQ,QAAQ,CAAC;KAEpF,OAAO,OAAO,cACZ,OAAO,SAAS,MAAM,UACpB;MACE,WAAW,QAAQ;MACnB,0BAA0B,QAAQ;KACpC,IACC,GAAG,YAAY;MACd,QAAQ,MAAM,KAAK;MAEnB,OAAO,QAAQ,QAAQ,KAAA,CAAS;KAClC,CACF,CACF;IACF,CAAC;GACH,CAAC;GAED,MAAM,OAAO,OAAO,GAAG,qCAAqC,CAAC,CAAC,WAC5D,QACA,UACA,WACA;IACA,MAAM,cAAc,OAAO,OAAO,QAAQ,IAAI,wBAAwB;IAEtE,IAAI,OAAO,MAAM,SAAS,aAAa,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;IAEjF,MAAM,UAAU,OAAO,mBACrB,OAAO,WAAW,SAClB,UACA,WACA,QACA,UAAU,KAAK,SAAS,MAAM,OAAO,QAAQ,SAAS,CAAC,CAAC,CAC1D;IAEA,MAAM,aAAa,OAAO,kBACxB,SACA,EAAE,SAAS,GACX,yBAAyB,KAAK,SAAS,MAAM,OAAO,QAAQ,SAAS,CAAC,CAAC,CACzE;IAaA,OAAO;KAAE,YAAA,OAXiB,OAAO,UAAU;KAWtB,aATyC,OAAO,OAAO,QAAQ,IAChF,OAAO,OAAO;MACZ,MAAM;MACN;MACA,oBAAoB,OAAO,WAAW,QAAQ;MAC9C,gBAAgB,OAAO,WAAW,QAAQ;KAC5C,CAAC,IACD,OAAO,OAAO;MAAE,MAAM;MAAmB;KAAW,CAAC;IAExB;GACnC,CAAC;GAED,OAAO,QAAQ,KAAK,iBAAiB,QAAQ,CAAC,CAAC,KAAK,QAAQ,IAAI,eAAe,EAAE,KAAK,CAAC,CAAC;EAC1F,CAAC,CAKQ;CAWb;CAEA,MAAM,kBAAkB,QAAuB,YAC7C,YAAY,QAAQ,SAAS,WAAW;CAE1C,MAAM,sBAAsB,QAAuB,YACjD,YAAY,QAAQ,SAAS,gBAAgB;CAE/C,MAAM,2BAA2B,QAAQ,QAwBvC,wBAAwB,SAAS,YAAY;CAO/C,MAAM,uBACJ,oBACA,YAEA,MAAM,OACJ,0BACA,OAAO,IAAI,aAAa;EACtB,MAAM,gBACJ,uBAAuB,KAAA,IACnB,KAAA,IACA,OAAO,OACL,OAAO,OAAO,aACZ,OAAO,OAAO;GACZ,uBAAuB,OAAO,IAAI,MAChC,OAAO,UAAU;IAAE,SAAS;IAAG,SAAS;GAAO,CAAC,CAClD;GACA,cAAc,OAAO,IAAI,MAAM,OAAO,UAAU;IAAE,SAAS;IAAG,SAAS;GAAI,CAAC,CAAC;EAC/E,CAAC,CACH,CAAC,CAAC,kBAAkB,CAAC,CAAC,KACpB,OAAO,eACL,0BAA0B,KAAK,EAAE,QAAQ,yBAAyB,CAAC,CACrE,CACF,CACF;EAEN,MAAM,cAAc,OAAO;EAC3B,MAAM,WAAW,OAAO;EACxB,MAAM,YAAY,OAAO;EACzB,MAAM,UAAU,OAAO,mBAAmB,QAAQ;EAElD,MAAM,gBAAgB,OAAO,OAAO,QAElC;EAEF,MAAM,QAAQ,OAAO,WAAW,WAAW;EAE3C,MAAM,iBAAiB,UACrB,OAAO,aAAa,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAChC,OAAO,QAAQ,OAAO,aAAa,KAAK,CAAC,GACzC,OAAO,QAAQ,aAAa,GAC5B,OAAO,eAAe,eAAe,KAAK,CAAC,CAAC,CAAC,CAC/C;EAEF,MAAM,aACJ,aAC2D;GAC3D,MAAM;GACN,MAAM,QAAQ,KAAK,KACjB,OAAO,KAAK,EAAE,OAAO,0BAA0B;IAC7C,OAAO;KAAE,MAAM;KAA0B,SAAS;IAAM;IACxD;GACF,EAAE,CACJ;EACF;EAEA,MAAM,UAA2D,OAAO,GACtE,kCACF,CAAC,CAAC,WAAW,OAAiB;GAC5B,QAAQ;IAAE,GAAG;IAAO,UAAU,OAAO,+BAA+B,MAAM,QAAQ;GAAE;GACpF,MAAM,gBAAgB,OAAO,cAAc,MAAM,MAAM;GACvD,MAAM,cAAc,OAAO,UAAU,aAAa,MAAM,QAAQ;GAEhE,MAAM,WAAW,OAAO,qBAAqB,MAAM,UAAU,WAAW,CAAC,CAAC,KACxE,OAAO,eAAe,eAAe,KAAK,CAAC,CAAC,CAAC,CAC/C;GAEA,IAAI,SAAS,WACX,OAAO,UACL,OAAO,SACJ,iBAAiB;IAAE,GAAG;IAAO,QAAQ;GAAc,CAAC,CAAC,CACrD,KAAK,OAAO,eAAe,yBAAyB,SAAS,CAAC,CACnE;GACF,IACE,MAAM,YAAY,KAAA,KAClB,kBAAkB,KAAA,KAClB,OAAO,OAAO,WAAW,GAEzB,OAAO,OAAO,6BAA6B,KAAK,EAC9C,YAAY,qCACd,CAAC;GACH,MAAM,MAAM,OAAO,SAAS;GAE5B,MAAM,YAAY,SAAS,WACzB,KAAK,IACH,SAAS,cAAc,GAAG,IAAI,cAAc,uBAC5C,SAAS,cAAc,SAAS,UAAU,eAAe,IACvD,YAAY,gBAChB,CACF;GAEA,MAAM,aAAa,OAAO,QAAQ,SAAS;GAC3C,MAAM,SAAS,OAAO,QAAQ,OAAO,YAAY,SAAS;GAE1D,OAAO,OAAO,YAAY,MAAM,OAC9B;IACE;IACA,UAAU,MAAM;IAChB,QAAQ;IACR;IACA,cAAc,cAAc;GAC9B,GACA,MACC,QAAQ,YACP,QAAQ,QAAQ;IACd,OAAO;KAAE,MAAM;KAAkC,WAAW,OAAO;IAAU;IAC7E,oBAAoB,CAClB;KACE,MAAM;KACN,MAAM;KACN;KACA,iBAAiB,SAAS,cAAc,OAAO,SAAS;IAC1D,CACF;GACF,CAAC,CACL;EACF,CAAC;EAED,MAAM,iBAAiB,OAAO,GAAG,yCAAyC,CAAC,CAAC,WAC1E,YACA;GACA,IAAI,OAAO,OAAO,WAAW,GAC3B,OAAO,OAAO,6BAA6B,KAAK,EAC9C,YAAY,yBACd,CAAC;GACH,MAAM,SAAS,OAAO,QAAQ,OAAO,YAAY,SAAS;GAE1D,OAAO,OAAO,qCACZ,OAAO,YAAY,MAAM,QAAQ;IAC/B;IACA,KAAK,OAAO,SAAS;GACvB,CAAC,CACH;EACF,CAAC;EAED,OAAO,yBAAyB,GAAG;GACjC;GACA;GACA,yBAAyB,OAAO,GAAG,kDAAkD,CAAC,CACpF,WAAW,YAAY;IACrB,IAAI,OAAO,OAAO,WAAW,GAC3B,OAAO,OAAO,6BAA6B,KAAK,EAC9C,YAAY,yBACd,CAAC;IACH,MAAM,SAAS,OAAO,QAAQ,OAAO,YAAY,SAAS;IAE1D,MAAM,UAAU,OAAO,qCACrB,OAAO,YAAY,MAAM,QAAQ;KAAE;KAAQ,KAAK,OAAO,SAAS;IAAI,CAAC,CACvE;IAEA,OAAO,OAAO,YAAY,MAAM,OAC9B;KAAE;KAAQ,eAAe,QAAQ;KAAe,KAAK,OAAO,SAAS;IAAI,IACxE,UAAU,YAAY,QAAQ,QAAQ,QAAQ,CACjD;GACF,CACF;GACA,gBAAgB,OAAO,GAAG,yCAAyC,CAAC,CAAC,WAAW,OAAO;IACrF,IAAI,OAAO,OAAO,WAAW,GAC3B,OAAO,OAAO,6BAA6B,KAAK,EAC9C,YAAY,yBACd,CAAC;IACH,MAAM,SAAS,OAAO,QAAQ,OAAO,MAAM,YAAY,SAAS;IAEhE,MAAM,SAAS,OAAO,YAAY,MAAM,KAAK;KAC3C;KACA,eAAe,MAAM,WAAW;KAChC,KAAK,OAAO,SAAS;IACvB,CAAC;IAED,MAAM,WAAW,OAAO,8BACtB,OAAO,UACP,MAAM,UACR;IAaA,OAAO;KACL,MAAM;KACN,OAAM,OAbe,QAAQ;MAC7B;MACA,QAAQ,OAAO;MACf,SAAS;OACP;OACA,eAAe,SAAS;OACxB,QAAQ,SAAS;OACjB,SAAS,OAAO;MAClB;KACF,CAAC,EAAA,CAIe,KAAK,KACjB,OAAO,KAAK,YAAY;MACtB,OAAO,OAAO;MACd,oBAAoB,CAClB,GAAG,OAAO,oBACV;OAAE,MAAM;OAAkB,MAAM;MAAyB,CAC3D;KACF,EAAE,CACJ;IACF;GACF,CAAC;GACD,eAAe,OAAO,GAAG,wCAAwC,CAAC,CAAC,WAAW,OAAO;IACnF,IAAI,OAAO,OAAO,WAAW,GAC3B,OAAO,OAAO,6BAA6B,KAAK,EAC9C,YAAY,yBACd,CAAC;IAEH,OAAO,OAAO,YAAY,MAAM,OAC9B;KACE,QAAQ,OAAO,QAAQ,OAAO,MAAM,YAAY,SAAS;KACzD,eAAe,MAAM;KACrB,KAAK,OAAO,SAAS;IACvB,IACC,UAAU,YAAY,QAAQ,QAAQ,QAAQ,CACjD;GACF,CAAC;EACH,CAAC;CACH,CAAC,CACH;CAMF,SAAS,gBAAgB,eAAsC;EAC7D,MAAM,WAAW,kBAAkB,KAAA,IAAY,KAAA,IAAY,OAAO,OAAO,EAAE,GAAG,cAAc,CAAC;EAE7F,OAAO,oBACL,UACA,aAAa,KAAA,IACT,OAAO,cAAc,qBAAqB,IAC1C,OAAO,IAAI,uBAAuB,OAAO,IAAI,CACnD;CACF;CAEA,MAAM,gBAAgB,QAAQ,QAmB5B,wBAAwB,SAAS,QAAQ;CAE3C,MAAM,iBAAiB,UAAwB;EAC7C,MAAM,OAAO,SAAS,WAAW,SAAS,cAAc,KAAK,CAAC;EAE9D,OAAO,OAAO,SAAS,WAAW,IAAI,CAAC;EAEvC,OAAO,OAAO,OAAO,IAAI;CAC3B;CAEA,MAAM,uBAAuB,UAC3B,OAAO,OAAO;EACZ,GAAG;EACH,cAAc,OAAO,OACnBA,QAAY,IAAI,MAAM,eAAe,gBACnC,OAAO,OAAO;GACZ,GAAG;GACH,SAAS,OAAO,OAAO,CAAC,GAAG,YAAY,OAAO,CAAC;EACjD,CAAC,CACH,CACF;CACF,CAAC;CAEH,MAAM,sBAAsB,UAC1B,MAAM,QAAQ,OAAO,YAAY,KACjC,MAAM,aAAa,SAAS,KAC5B,MAAM,aAAa,UAAU,MAC7B,MAAM,aAAa,OAChB,gBAAgB,MAAM,QAAQ,aAAa,OAAO,KAAK,YAAY,QAAQ,UAAU,CACxF;CAEF,MAAM,mBAAmB,UACvB,mBAAmB,KAAK,IACpB,OAAO,aAAa,wBAAwB,CAAC,CAAC,KAAK,CAAC,CAAC,KACnD,OAAO,IAAI,mBAAmB,GAC9B,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CACnD,IACA,OAAO,KAAK,mBAAmB,KAAK,CAAC,CAAC,CAAC;CAE7C,MAAM,cAAc,OAAO,YAAY,OAAO,OAAO,mBAAmB,CAAC;CAEzE,MAAM,iBAAiB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAC/D,OACA;EACA,IACE,CAAC,MAAM,QAAQ,OAAO,UAAU,WAAW,KAC3C,MAAM,SAAS,YAAY,SAAS,MACpC,CAAC,mBAAmB,OAAO,WAAW,GAEtC,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;EAE5C,MAAM,QAAQ,OAAO,OAAO,aAAa,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,KAC3D,OAAO,QAAQ,OAAO,aAAa,WAAW,CAAC,GAC/C,OAAO,eAAe,qBAAqB,KAAK,CAAC,CAAC,CAAC,CACrD;EAEA,OAAO,OAAO,OAAO;GACnB,GAAG;GACH,UAAU,OAAO,OAAO;IACtB,GAAG,MAAM;IACT,aAAa,OAAO,OAClB,MAAM,SAAS,YAAY,KAAK,SAAS,OAAO,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,CACrE;GACF,CAAC;GACD,aAAa,oBAAoB,MAAM,WAAW;GAClD,uBAAuB,cAAc,MAAM,qBAAqB;GAChE,iBAAiB,cAAc,MAAM,eAAe;GACpD,yBAAyB,cAAc,MAAM,uBAAuB;GACpE,WAAW,cAAc,MAAM,SAAS;EAC1C,CAAC;CACH,CAAC;CAED,MAAM,kBAAkB,OAAO,YAC7B,OAAO,OACL,OAAO,OAAO;EACZ,SAAS;EACT,YAAY;EACZ,mBAAmB;CACrB,CAAC,CACH,CACF;CAIA,MAAM,eAAkB,UAAgB;EACtC,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;GAC/C,IAAI,SAAS,WAAW,KAAK,KAAK,SAAS,MAAM,KAAK,GAAG;IACvD,OAAO,OAAO,SAAS,WAAW,KAAK,CAAC;IACxC,OAAO,OAAO,KAAK;GACrB,OAAO,IACL,MAAM,QAAQ,KAAK,KACnB,OAAO,eAAe,KAAK,MAAM,OAAO,aACxC,OAAO,eAAe,KAAK,MAAM,QACjC,OAAO,GAAG,uBAAuB,CAAC,CAAC,KAAK,GACxC;IACA,KAAK,MAAM,SAAS,OAAO,OAAO,KAAK,GAAG,YAAY,KAAK;IAC3D,OAAO,OAAO,KAAK;GACrB;EAGF;EAEA,OAAO;CACT;CAEA,MAAM,sBAAsB,UAC1B,OAAO,aAAa,eAAe,CAAC,CAAC,KAAK,CAAC,CAAC,KAC1C,OAAO,QAAQ,OAAO,aAAa,eAAe,CAAC,GACnD,OAAO,IAAI,WAAW,GACtB,OAAO,eAAe,qBAAqB,KAAK,CAAC,CAAC,CAAC,CACrD;CAEF,MAAM,sBAAsB,OAAO,WAAW,OAAO,eAAe,yBAAyB,CAAC;CAE9F,MAAM,kBAAkB,OAAO,WAC7B,OAAO,eACL,OAAO,MAAM;EACX,OAAO,QAAQ,wCAAwC;EACvD,OAAO;EACP;CACF,CAAC,CACH,CACF;;CAGA,MAAM,eAAe,eAAoD;EACvE,MAAM,UAAU,OAAO,aACrB,OAAO,MAAM,oBAAoB,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,EAAE,CAAC,CACxF,CAAC,CACC,MAAM,QAAQ,UAAU,KACtB,WAAW,UAAU,MACrB,WAAW,OAAO,YAAY,mBAAmB,SAAS,WAAW,CAAC,IACpE,aACA,CAAC,CACP;EAEA,MAAM,WAAW,OAAO,UAAU,OAAO,IACrC,OAAO,OACL,QAAQ,QAAQ,KAAK,YACnB,OAAO,OAAO;GACZ,GAAG;GACH,aAAa,oBAAoB,QAAQ,WAAW;EACtD,CAAC,CACH,CACF,IACA,KAAA;EAEJ,OAAO,MAAM,OACX,eACA,OAAO,IAAI,aAAa;GACtB,IACE,aAAa,KAAA,KACb,IAAI,IAAI,SAAS,KAAK,YAAY,QAAQ,SAAS,CAAC,CAAC,CAAC,SAAS,SAAS,QAExE,OAAO,OAAO,0BAA0B,KAAK,EAAE,QAAQ,UAAU,CAAC;GACpE,MAAM,QAAQ,OAAO;GACrB,MAAM,WAAW,OAAO;GACxB,MAAM,UAAU,OAAO;GACvB,MAAM,YAAY,OAAO;GACzB,MAAM,SAAS,OAAO,OAAO;GAC7B,MAAM,UAAU,OAAO,mBAAmB,QAAQ;GAClD,MAAM,QAAQ,OAAO,OAAO,QAAwC;GAEpE,MAAM,2BAAW,IAAI,IAGnB;GAEF,KAAK,MAAM,WAAW,UAAU;IAC9B,MAAM,QAAQ,IAAI,YAAY,CAAC,CAAC,OAC9B,gBAAgB;KAAC;KAA0C;KAAU;IAAO,CAAC,CAC/E;IAEA,MAAM,SAAS,OAAO,OACnB,OAAO,WAAW,KAAK,CAAC,CACxB,KAAK,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CAAC;IAE1D,SAAS,IACP,QAAQ,WACR,OAAO,OAAO;KAAE;KAAS,QAAQ,YAAY,KAAK,SAAS,gBAAgB,MAAM,CAAC;IAAE,CAAC,CACvF;GACF;GAEA,MAAM,UAAU,UAAkC,gBAChD,qBAAqB,UAAU,WAAW,CAAC,CAAC,KAC1C,OAAO,SAAS,mCACd,OAAO,KAAK,mBAAmB,KAAK,CAAC,CAAC,CAAC,CACzC,CACF;GAEF,MAAM,oBAAoB,eACxB,QACG,OAAO,YAAY,SAAS,CAAC,CAC7B,KACC,OAAO,SAAS,wBAAwB,OAAO,KAAK,qBAAqB,KAAK,CAAC,CAAC,CAAC,CAAC,CACpF;GAEJ,MAAM,iBAAiB,eACrB,SAAS,iBAAiB,UAAU,CAAC,CAAC,KACpC,OAAO,SAAS,WACd,mBAAmB,OAAO,UAAU,CAAC,CAAC,KACpC,OAAO,KAAK,eACV,OAAO,OAAO;IAAE;IAAY,OAAO,OAAO,OAAO,EAAE,GAAG,OAAO,MAAM,CAAC;GAAE,CAAC,CACzE,CACF,CACF,GACA,OAAO,SAAS,wBAAwB,OAAO,KAAK,qBAAqB,KAAK,CAAC,CAAC,CAAC,CAAC,CACpF;GAEF,MAAM,aAAa,OAAO,GAAG,0BAA0B,CAAC,CAAC,WACvD,QACA,eACA;IACA,MAAM,SAAS,OAAO,eACpB,OAAO,MAAM,KAAK;KAAE;KAAQ;KAAe,KAAK,OAAO,SAAS;IAAI,CAAC,CACvE;IAEA,MAAM,aAAa,SAAS,IAAI,OAAO,SAAS;IAChD,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;IAEtD,IACE,OAAO,WAAW,UAClB,OAAO,kBAAkB,iBACzB,eAAe,KAAA,KACf,OAAO,sBAAsB,WAAW,QAAQ,cAChD,OAAO,kBAAkB,WAAW,UACpC,oBAAoB,OAAO,WAAW,MACpC,oBAAoB,WAAW,QAAQ,WAAW,KACpD,OAAO,iBAAiB,WAAW,QAAQ,gBAC3C,OAAO,SAAS,cAAc,OAAO,SAAS,KAC9C,SAAS,cAAc,OAAO,SAAS,IACrC,SAAS,cAAc,OAAO,eAAe,KAC/C,SAAS,cAAc,OAAO,eAAe,IAC3C,SAAS,cAAc,OAAO,uBAAuB,GAEvD,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;IAE5C,OAAO;GACT,CAAC;GAED,MAAM,eACJ,QACA,WACG;IACH,MAAM,EAAE,SAAS,mBAAmB,eAAe,OAAO;IAC1D,MAAM,WAAW,WAAW,SAAS;IAErC,MAAM,gBACJ,SAAS,YAAY,WAAW,OAAO,SAAS,YAAY,UAC5D,SAAS,YAAY,OAAO,SAC1B,OAAO,SAAS,YAAY,MACzB,aACC,SAAS,iBAAiB,KAAK,gBAC/B,SAAS,aAAa,KAAK,QAC/B,CACF;IAEF,OACE,OAAO,eAAe,OAAO,MAAM,QACnC,OAAO,oBAAoB,QAAQ,aACnC,OAAO,4BAA4B,qBACnC,OAAO,SAAS,cAAc,SAAS,aACvC,OAAO,SAAS,qBAAqB,SAAS,oBAC9C,iBACA,SAAS,cAAc,OAAO,qBAAqB,MACjD,SAAS,cAAc,QAAQ,UAAU,eAAe,KAC1D,SAAS,cAAc,OAAO,eAAe,MAC3C,SAAS,cAAc,QAAQ,SAAS,KAC1C,SAAS,cAAc,OAAO,uBAAuB,MACnD,SAAS,cAAc,QAAQ,iBAAiB;GAEtD;GAEA,OAAO,cAAc,GAAG;IACtB,cAAc,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAAW,OAAO;KACtE,MAAM,aAAa,SAAS,IAAI,MAAM,SAAS;KAE/C,IAAI,eAAe,KAAA,GAAW,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;KACxE,MAAM,SAAS,OAAO,cAAc,MAAM,gBAAgB;KAC1D,MAAM,WAAW,OAAO,WAAW,WAAW;KAI9C,OAAO,gBAAgB,OAAO,UAAU,aAAa,QAAQ,CAAC;KAC9D,MAAM,aAAa,OAAO,QAAQ,SAAS;KAC3C,MAAM,SAAS,OAAO,iBAAiB,UAAU;KAEjD,MAAM,gBAAgB,OAAO,QAAQ,OACnC,OAAO,QAAQ,SAAS,GACxB,iBACF;KAEA,MAAM,SAAS,qBAAqB,KAAK,SAAS,MAAM,OAAO,QAAQ,SAAS,CAAC,CAAC;KAClF,MAAM,MAAM,OAAO,SAAS;KAC5B,MAAM,UAAU,OAAO,WAAW;KAElC,OAAO,wBAAwB,SAAS,SAAS,MAAM;KAEvD,MAAM,YAAY,cAChB,SAAS,WACP,KAAK,IACH,SAAS,cAAc,GAAG,IAAI,WAAW,QAAQ,gBACjD,SAAS,cAAc,QAAQ,SAAS,GACxC,SAAS,cAAc,QAAQ,iBAAiB,CAClD,CACF,CACF;KAEA,MAAM,SAA+C,OAAO,OAAO;MACjE,MAAM;MACN;MACA;MACA;MACA,UAAU,SAAS;MACnB,YAAY,OAAO,MAAM;MACzB,iBAAiB,QAAQ;MACzB,yBAAyB,OAAO,WAAW;MAC3C,uBAAuB,cAAc,QAAQ,UAAU,eAAe;MACtE,iBAAiB,cAAc,QAAQ,SAAS;MAChD,yBAAyB,cAAc,QAAQ,iBAAiB;MAChE,WAAW,WAAW,QAAQ;MAC9B,mBAAmB,WAAW,QAAQ;MACtC,eAAe,WAAW;MAC1B,aAAa,WAAW,QAAQ;MAChC;MACA,cAAc,WAAW,QAAQ;KACnC,CAAC;KAED,OAAO,OAAO,MAAM,OAAO,QAAQ,MAAM,GAAG,YAC1C,QAAQ,QAAQ;MACd,OAAO;OAAE,MAAM;OAA0B,WAAW,OAAO;OAAW;MAAU;MAChF,oBAAoB,CAClB;OACE,MAAM;OACN,MAAM;OACN;OACA,iBAAiB,SAAS,cAAc,SAAS;MACnD,CACF;KACF,CAAC,CACH;IACF,CAAC;IACD,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAAW,YAAY;KACjE,MAAM,SAAS,OAAO,iBAAiB,UAAU;KAEjD,OAAO,OAAO,qCACZ,OAAO,MAAM,QAAQ;MAAE;MAAQ,KAAK,OAAO,SAAS;KAAI,CAAC,CAC3D,CAAC,CAAC,KACA,OAAO,SAAS,sCACd,OAAO,KAAK,qBAAqB,KAAK,CAAC,CAAC,CAAC,CAC3C,CACF;IACF,CAAC;IACD,kBAAkB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WAAW,YAAY;KACnF,MAAM,SAAS,OAAO,iBAAiB,UAAU;KAEjD,OAAO,OAAO,MAAM,OAAO;MAAE;MAAQ,KAAK,OAAO,SAAS;KAAI,IAAI,UAAU,YAC1E,QAAQ,QAAQ,QAAQ,CAC1B;IACF,CAAC;IACD,iBAAiB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAAW,OAAO;KAC5E,MAAM,aAAa,OAAO,+BAA+B,MAAM,UAAU;KACzE,MAAM,SAAS,OAAO,iBAAiB,MAAM,gBAAgB;KAC7D,MAAM,SAAS,OAAO,WAAW,QAAQ,WAAW,aAAa;KACjE,MAAM,SAAS,OAAO,cAAc,MAAM,gBAAgB;KAE1D,IAAI,CAAC,YAAY,QAAQ,MAAM,GAAG,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;KAC5E,MAAM,WAAW,OAAO,WAAW,WAAW;KAE9C,MAAM,WAAW,OAAO,+BACtB,OAAO,8BACL;MACE,GAAG;MACH,QAAQ,OAAO;MACf,eAAe,OAAO;KACxB,GACA,UACF,CAAC,CAAC,KACA,OAAO,SAAS,sCACd,OAAO,KAAK,qBAAqB,KAAK,CAAC,CAAC,CAAC,CAC3C,CACF,CACF;KAEA,MAAM,cAAc,OAAO,gBAAgB,OAAO,UAAU,aAAa,QAAQ,CAAC;KAClF,MAAM,OAAO,OAAO,OAAO,UAAU,WAAW;KAChD,MAAM,UAAU,OAAO,OAAO,UAAU,OAAO,WAAW;KAE1D,IAAI,CAAC,KAAK,aAAa,CAAC,QAAQ,WAAW,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;KACrF,MAAM,YAAY,OAAO,QAAQ,KAAK,QAAQ,UAAU,KAAK,SAAS;KAEtE,MAAM,cAAc,OAAO,OAAO;MAChC,GAAG,UAAU;MACb,YAAY,OAAO,mBAAmB,UAAU,YAAY,UAAU;KACxE,CAAC;KAID,MAAM,SAAS,OAAO,mBAAmB,UAAU,YAAY,UAAU;KACzE,MAAM,UAAU;MAAE,YAAY,UAAU;MAAY;KAAY;KAEhE,IAAI,QAAQ,YAAY,SAAS,OAAO,YACtC,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;KAE5C,MAAM,QAAQ,OAAO,aACnB,oBACA,QAAQ,YAAY,WAAW,OACjC,CAAC,CAAC,KAAK,OAAO,QAAQ,KAAK,CAAC;KAI5B,MAAM,UAAU,OAAO,cAAc,MAAM,gBAAgB;KAE3D,IACE,CAAC,YAAY,QAAQ,OAAO,KAC3B,OAAO,MAAM,SAAS,eACpB,QAAQ,MAAM,SAAS,cACtB,OAAO,MAAM,WAAW,QAAQ,MAAM,UACtC,OAAO,MAAM,eAAe,QAAQ,MAAM,aAE9C,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;KAE5C,MAAM,qBAAqB,OAAO,gBAChC,OAAO,UAAU,aAAa,QAAQ,CACxC;KAEA,IACE,EAAE,OAAO,OAAO,UAAU,kBAAkB,EAAA,CAAG,aAC/C,EAAE,OAAO,OAAO,UAAU,OAAO,WAAW,EAAA,CAAG,WAE/C,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;KAC5C,OAAO,wBAAwB,QAAQ,YAAY,WAAW,SAAS,SAAS,MAAM;KACtF,MAAM,MAAM,OAAO,SAAS;KAE5B,IAAI,SAAS,cAAc,GAAG,KAAK,SAAS,cAAc,OAAO,SAAS,GACxE,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;KAE5C,MAAM,OAAoD,OAAO,OAAO;MACtE;MACA,QAAQ;MACR;MACA,iBAAiB;MACjB,oBAAoB,OAAO;MAC3B,KAAK,cAAc,GAAG;MACtB,aAAa,QAAQ;KACvB,CAAC;KAED,OAAO,OAAO,MAAM,SAAS,OAAO,GAAG,YAAY;MACjD,MAAM,SAAS,MAAM,OAAO,SAAS,QAAQ,UAAU;MAEvD,QAAQ,MAAM,KAAK;MAEnB,OAAO,QAAQ,QAAQ;OACrB,GAAG;OACH,oBAAoB,CAClB,GAAG,OAAO,oBACV;QAAE,MAAM;QAAkB,MAAM;OAA2B,CAC7D;MACF,CAAC;KACH,CAAC;IACH,CAAC;GACH,CAAC;EACH,CAAC,CACH;CACF;CAEA,MAAM,EAAE,OAAO,aAAa,UAAU,gBAAgB,QAAQ,iBAAiB;CAE/E,MAAM,sBAAsB,MAAM,SAChC,YAAY,uBACV,OAAO,GAAG,qBAAqB,CAAC,CAAC,WAAW,OAAO,SAAS;EAC1D,OAAO,qBAAqB;EAC5B,MAAM,SAAS,OAAO,qBAAqB,OAAO;EAClD,MAAM,SAAS,QAAQ,OAAO,gBAAA,CAAiB,iBAAiB,MAAM,gBAAgB;EAEtF,IACE,OAAO,cAAc,OAAO,WAAW,QAAQ,aAC/C,OAAO,cAAc,OAAO,WAAW,QAAQ,WAE/C,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;EAE5C,OAAO,OAAO,cAAc,QAAQ,OAAO,cAAA,CAAe,aAAa,KAAK,CAAC;CAC/E,CAAC,CACH,GACA,eAAe,uBACb,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAAW,OAAO;EACpD,OAAO,qBAAqB;EAE5B,OAAO,OAAO,cAAc,QAAQ,OAAO,cAAA,CAAe,gBAAgB,KAAK,CAAC;CAClF,CAAC,CACH,GACA,aAAa,aACX,OAAO,GAAG,sBAAsB,CAAC,CAAC,WAAW,OAAO;EAClD,OAAO,qBAAqB;EAE5B,OAAO,OAAO,cACZ,QAAQ,OAAO,cAAA,CAAe,iBAAiB,MAAM,gBAAgB,CACvE;CACF,CAAC,CACH,CACF;CAEA,MAAM,EACJ,UACA,iBACA,eACA,cACA,QACA,OACA,SACA,MACA,QACA,cACE;CAEJ,MAAM,2BAA2B,aAAa,aAC5C,OAAO,GAAG,sBAAsB,CAAC,CAAC,aAAa;EAC7C,QAAQ,OAAO,gBAAA,CAAiB;CAClC,CAAC,CACH;;CAGA,MAAM,uBAAuB,MAAM,SACjC,OAAO,aACL,OAAO,GAAG,gBAAgB,CAAC,CAAC,WAAW,OAAO;EAC5C,OAAO,QAAQ,OAAO,gBAAA,CAAiB,OAAO,MAAM,UAAU;CAChE,CAAC,CACH,GACA,MAAM,uBACJ,OAAO,GAAG,eAAe,CAAC,CAAC,WAAW,OAAO;EAC3C,OAAO,qBAAqB;EAE5B,OAAO,OAAO,cAAc,QAAQ,OAAO,gBAAA,CAAiB,aAAa,MAAM,UAAU,CAAC;CAC5F,CAAC,CACH,GACA,QAAQ,uBACN,OAAO,GAAG,iBAAiB,CAAC,CAAC,WAAW,OAAO;EAC7C,OAAO,qBAAqB;EAE5B,OAAO,QAAQ,OAAO,gBAAA,CAAiB,QAAQ,MAAM,UAAU;CACjE,CAAC,CACH,CACF;CAEA,MAAM,iBAAiB,eAAqC;EAC1D,aAAa,OAAO,OAAO;GACzB,GAAG;GACH,SACE,WAAW,YAAY,KAAA,IAAY,KAAA,IAAY,OAAO,OAAO,CAAC,GAAG,WAAW,OAAO,CAAC;EACxF,CAAC;EAED,OAAO,MAAM,SACX,0BACA,SAAS,uBACP,OAAO,GAAG,kBAAkB,CAAC,CAAC,WAAW,OAAO;GAC9C,OAAO,qBAAqB;GAE5B,OAAO,OAAO,cAAc,QAAQ,OAAO,yBAAA,CAA0B,QAAQ,KAAK,CAAC;EACrF,CAAC,CACH,GACA,gBAAgB,uBACd,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,OAAO;GACrD,OAAO,qBAAqB;GAE5B,OAAO,OAAO,cACZ,QAAQ,OAAO,yBAAA,CAA0B,eAAe,KAAK,CAC/D;EACF,CAAC,CACH,GACA,cAAc,aACZ,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAAW,OAAO;GACnD,OAAO,qBAAqB;GAE5B,OAAO,OAAO,cACZ,QAAQ,OAAO,yBAAA,CAA0B,cAAc,KAAK,CAC9D;EACF,CAAC,CACH,GACA,sBACA,KAAK,aACH,OAAO,GAAG,cAAc,CAAC,CAAC,WAAW,OAAO,SAAS;GACnD,MAAM,SAAS,OAAO,qBAAqB,OAAO;GAClD,MAAM,WAAW,OAAO;GACxB,MAAM,UAAU,OAAO,SAAS,OAAO,MAAM,UAAU;GAEvD,IAAI,QAAQ,cAAc,OAAO,WAAW,OAAO,OAAO,eAAe,KAAK,CAAC,CAAC;GAEhF,OAAO,OAAO,SAAS,KAAK;IAC1B,QAAQ,MAAM;IACd,OAAO,MAAM;IACb,WAAW,QAAQ;IACnB,KAAK,OAAO,SAAS;GACvB,CAAC;EACH,CAAC,CACH,GACA,OAAO,aACL,OAAO,GAAG,gBAAgB,CAAC,CAAC,WAAW,OAAO,SAAS;GACrD,OAAO,qBAAqB;GAC5B,MAAM,SAAS,OAAO,iBAAiB,SAAS,UAAU;GAC1D,MAAM,WAAW,OAAO;GACxB,MAAM,UAAU,OAAO,SAAS,OAAO,MAAM,UAAU;GAEvD,IAAI,QAAQ,cAAc,OAAO,WAAW,OAAO,OAAO,eAAe,KAAK,CAAC,CAAC;GAEhF,OAAO,OAAO,SAAS,OAAO,SAAS,MAAM,SAAS;EACxD,CAAC,CACH,GACA,UAAU,aACR,OAAO,GAAG,mBAAmB,CAAC,CAAC,WAAW,OAAO,SAAS;GACxD,OAAO,qBAAqB;GAC5B,MAAM,SAAS,OAAO,iBAAiB,SAAS,UAAU;GAC1D,MAAM,WAAW,OAAO;GACxB,MAAM,UAAU,OAAO,SAAS,OAAO,MAAM,UAAU;GAEvD,IAAI,QAAQ,cAAc,OAAO,WAAW,OAAO,OAAO,eAAe,KAAK,CAAC,CAAC;GAChF,OAAO,SAAS,UAAU,OAAO;GAEjC,OAAO,0BACL,0BACA,SAAS,cACT,SAAS,MACX;EACF,CAAC,CACH,CACF;CACF;CAEA,OAAO,OAAO,OAAO;EACnB;EACA;;EAEA,QAAQ,WACN,gBAAgB,CAAC,CAAC,KAChB,MAAM,aAAa,cAAc,MAAM,CAAC,GACxC,MAAM,QAAQ,CAAC,aAAa,UAAU,CAAC,CACzC;EACF;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;AACH"}

package/dist/sessions/persistence.d.mts

@@ -0,0 +1,93 @@
+import { SubjectId, TokenDigest } from "../Schema.mjs";
+import { AuthenticationEvidence, PendingConsumption, SecurityRevision, SessionAuthenticationProvenance, SessionCredentialVersion, SessionId, SessionMetadata } from "./models.mjs";
+import { PreparedCommit } from "../hooks/commit.mjs";
+import { PrepareSessionCommit } from "./commit.mjs";
+import { PendingAuthenticationInvalid, SessionConflict, SessionInvalid, SessionUnavailable, StaleAuthentication } from "./errors.mjs";
+import { DateTime, Effect } from "effect";
+//#region src/sessions/persistence.d.ts
+interface StatefulSessionRecord<Claims> extends SessionMetadata {
+  readonly claims: Claims;
+  readonly digest: TokenDigest;
+  readonly version: SecurityRevision;
+  readonly provenance: SessionAuthenticationProvenance;
+  readonly credentialVersion: SessionCredentialVersion;
+}
+/** Consumer mapping owns IDs, digest uniqueness, native timestamps, and each atomic commit. */
+interface StatefulSessionPersistence<Claims> {
+  /**
+   * Insert only if the subject is active and the SAME revision captured before
+   * credential verification still matches. Duplicate evidence.flowId before absoluteExpiresAt MUST fail SessionConflict.
+   * Interactive owners reject it before prepare. Ordered-batch owners may prepare
+   * a speculative value during a concurrent race, but MUST discard its receipt
+   * and events when the guarded batch loses. Never return an existing row: its digest cannot
+   * recover the original bearer and does not match this attempt's new secret. Pending consumption and insertion
+   * are one commit. Recheck current factor policy, proof freshness and both expiry
+   * bounds against the clock at the conditional commit. Never replace evidence with a newly read revision.
+   */
+  readonly establish: <A>(input: {
+    readonly session: Omit<StatefulSessionRecord<Claims>, "sessionId" | "version">;
+    readonly evidence: AuthenticationEvidence;
+    readonly pending?: PendingConsumption;
+    readonly now: DateTime.Utc;
+  }, prepare: PrepareSessionCommit<StatefulSessionRecord<Claims>, A>) => Effect.Effect<PreparedCommit<A>, StaleAuthentication | PendingAuthenticationInvalid | SessionConflict | SessionUnavailable>;
+  /** Check current digest, active subject/revision, revocation, and expiry authoritatively. */
+  readonly verify: (input: {
+    readonly digest: TokenDigest;
+    readonly now: DateTime.Utc;
+  }) => Effect.Effect<StatefulSessionRecord<Claims>, SessionInvalid | SessionUnavailable>;
+  /** One CAS winner; check live digest/version/revision and both expiry bounds against a fresh clock at the actual commit. Set issuedAt to that clock; preserve authenticatedAt/absoluteExpiresAt and exact private provenance. Rotate credentialVersion from the prepared input independently of the authority-allocated row version. No upsert. */
+  readonly rotate: <A>(input: {
+    readonly sessionId: SessionId;
+    readonly expectedDigest: TokenDigest;
+    readonly expectedVersion: SecurityRevision;
+    readonly expectedSecurityRevision: SecurityRevision;
+    readonly nextDigest: TokenDigest;
+    readonly nextCredentialVersion: SessionCredentialVersion;
+    readonly nextExpiresAt: DateTime.Utc;
+    readonly now: DateTime.Utc;
+  }, prepare: PrepareSessionCommit<StatefulSessionRecord<Claims>, A>) => Effect.Effect<PreparedCommit<A>, SessionConflict | SessionInvalid | SessionUnavailable>;
+  readonly revokeDigest: <A>(digest: TokenDigest, prepare: PrepareSessionCommit<boolean, A>) => Effect.Effect<PreparedCommit<A>, SessionUnavailable>;
+  readonly revoke: <A>(input: {
+    readonly subjectId: SubjectId;
+    readonly sessionId: SessionId;
+    readonly expectedSecurityRevision: SecurityRevision;
+  }, prepare: PrepareSessionCommit<void, A>) => Effect.Effect<PreparedCommit<A>, StaleAuthentication | SessionUnavailable>;
+  /** Bump subject security revision in the SAME authority as revocation and establishment. */
+  readonly revokeAll: <A>(input: {
+    readonly subjectId: SubjectId;
+    readonly expectedSecurityRevision: SecurityRevision;
+  }, prepare: PrepareSessionCommit<void, A>) => Effect.Effect<PreparedCommit<A>, StaleAuthentication | SessionUnavailable>;
+}
+interface SessionRepository {
+  /** Stable owner-scoped pagination; never return bearer digests or application rows. */
+  readonly list: (input: {
+    readonly subjectId: SubjectId;
+    readonly cursor?: string;
+    readonly limit: number;
+    readonly now: DateTime.Utc;
+  }) => Effect.Effect<{
+    readonly sessions: ReadonlyArray<SessionMetadata>;
+    readonly nextCursor?: string;
+  }, SessionUnavailable>;
+}
+/** Explicitly state-assisted signed sessions. No positive validity cache is permitted.
+ * Tombstones MUST be keyed by (subjectId, sessionId), or the authority must prove
+ * target ownership before any global sessionId mutation. The caller session alone
+ * does not prove ownership of an arbitrary management target.
+ */
+interface SignedSessionValidity {
+  readonly verify: (session: SessionMetadata, now: DateTime.Utc) => Effect.Effect<void, SessionInvalid | SessionUnavailable>;
+  readonly revoke: <A>(input: {
+    readonly subjectId: SubjectId;
+    readonly sessionId: SessionId;
+    readonly absoluteExpiresAt: DateTime.Utc;
+    readonly expectedSecurityRevision: SecurityRevision;
+  }, prepare: PrepareSessionCommit<void, A>) => Effect.Effect<PreparedCommit<A>, StaleAuthentication | SessionUnavailable>;
+  readonly revokeAll: <A>(input: {
+    readonly subjectId: SubjectId;
+    readonly expectedSecurityRevision: SecurityRevision;
+  }, prepare: PrepareSessionCommit<void, A>) => Effect.Effect<PreparedCommit<A>, StaleAuthentication | SessionUnavailable>;
+}
+//#endregion
+export { SessionRepository, SignedSessionValidity, StatefulSessionPersistence, StatefulSessionRecord };
+//# sourceMappingURL=persistence.d.mts.map

package/dist/sessions/policy.d.mts

@@ -0,0 +1,80 @@
+import { AuthenticationAssurance } from "../operations/context.mjs";
+import { SessionCapabilities } from "./models.mjs";
+import { SessionConfigurationError, SessionInvalid } from "./errors.mjs";
+import "../Operations.mjs";
+import { DateTime, Effect, Schema } from "effect";
+//#region src/sessions/policy.d.ts
+declare const SessionPolicy: Schema.Struct<{
+  readonly issuer: Schema.NonEmptyString;
+  readonly audience: Schema.NonEmptyString;
+  readonly generation: Schema.Natural;
+  readonly idleLifetimeMillis: Schema.Int;
+  readonly absoluteLifetimeMillis: Schema.Int;
+  readonly renewalIntervalMillis: Schema.Int;
+  /** Deployment-wide upper bound including tokens issued under older policy versions. */
+  readonly maximumIssuedAbsoluteLifetimeMillis: Schema.Int;
+  readonly maximumTokenBytes: Schema.Int;
+  readonly requireImmediateInvalidation: Schema.Boolean;
+}>;
+type SessionPolicy = typeof SessionPolicy.Type;
+declare const validateSessionPolicy: (input: {
+  readonly issuer: string;
+  readonly audience: string;
+  readonly generation: number;
+  readonly idleLifetimeMillis: number;
+  readonly absoluteLifetimeMillis: number;
+  readonly renewalIntervalMillis: number;
+  readonly maximumIssuedAbsoluteLifetimeMillis: number;
+  readonly maximumTokenBytes: number;
+  readonly requireImmediateInvalidation: boolean;
+}, capabilities: {
+  readonly mode: "state-assisted" | "stateful" | "stateless";
+  readonly listing: boolean;
+  readonly perSessionRevocation: boolean;
+  readonly subjectInvalidation: "absolute-expiry" | "immediate";
+  readonly renewal: "replayable" | "single-winner";
+  readonly positiveCacheMillis: 0;
+}) => Effect.Effect<Readonly<{
+  readonly issuer: string;
+  readonly audience: string;
+  readonly generation: number;
+  readonly idleLifetimeMillis: number;
+  readonly absoluteLifetimeMillis: number;
+  readonly renewalIntervalMillis: number;
+  readonly maximumIssuedAbsoluteLifetimeMillis: number;
+  readonly maximumTokenBytes: number;
+  readonly requireImmediateInvalidation: boolean;
+}>, SessionConfigurationError, never>;
+declare const validateSessionTimeline: (session: Pick<{
+  readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+  readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+  readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+  readonly assurance: AuthenticationAssurance;
+  readonly issuedAt: DateTime.Utc;
+  readonly expiresAt: DateTime.Utc;
+  readonly absoluteExpiresAt: DateTime.Utc;
+}, "absoluteExpiresAt" | "assurance" | "expiresAt" | "issuedAt">, policy: {
+  readonly issuer: string;
+  readonly audience: string;
+  readonly generation: number;
+  readonly idleLifetimeMillis: number;
+  readonly absoluteLifetimeMillis: number;
+  readonly renewalIntervalMillis: number;
+  readonly maximumIssuedAbsoluteLifetimeMillis: number;
+  readonly maximumTokenBytes: number;
+  readonly requireImmediateInvalidation: boolean;
+}) => Effect.Effect<Pick<{
+  readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+  readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+  readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+  readonly assurance: AuthenticationAssurance;
+  readonly issuedAt: DateTime.Utc;
+  readonly expiresAt: DateTime.Utc;
+  readonly absoluteExpiresAt: DateTime.Utc;
+}, "absoluteExpiresAt" | "assurance" | "expiresAt" | "issuedAt">, SessionInvalid, never>;
+declare const statefulCapabilities: SessionCapabilities;
+declare const statelessCapabilities: SessionCapabilities;
+declare const stateAssistedCapabilities: SessionCapabilities;
+//#endregion
+export { SessionPolicy, stateAssistedCapabilities, statefulCapabilities, statelessCapabilities, validateSessionPolicy, validateSessionTimeline };
+//# sourceMappingURL=policy.d.mts.map

package/dist/sessions/policy.mjs

@@ -0,0 +1,66 @@
+import { SessionConfigurationError, SessionInvalid } from "./errors.mjs";
+import { DateTime, Effect, Schema } from "effect";
+//#region src/sessions/policy.ts
+const PositiveMillis = Schema.Int.check(Schema.isGreaterThan(0));
+const SessionPolicy = Schema.Struct({
+	issuer: Schema.NonEmptyString,
+	audience: Schema.NonEmptyString,
+	generation: Schema.Natural,
+	idleLifetimeMillis: PositiveMillis,
+	absoluteLifetimeMillis: PositiveMillis,
+	renewalIntervalMillis: PositiveMillis,
+	/** Deployment-wide upper bound including tokens issued under older policy versions. */
+	maximumIssuedAbsoluteLifetimeMillis: PositiveMillis,
+	maximumTokenBytes: Schema.Int.check(Schema.isBetween({
+		minimum: 256,
+		maximum: 1048576
+	})),
+	requireImmediateInvalidation: Schema.Boolean
+});
+const validateSessionPolicy = Effect.fn("validateSessionPolicy")(function* (input, capabilities) {
+	const policy = yield* Schema.decodeEffect(SessionPolicy)(input).pipe(Effect.mapError(() => SessionConfigurationError.make({ reason: "policy" })));
+	if (policy.renewalIntervalMillis >= policy.idleLifetimeMillis || policy.idleLifetimeMillis > policy.absoluteLifetimeMillis || policy.absoluteLifetimeMillis > policy.maximumIssuedAbsoluteLifetimeMillis) return yield* SessionConfigurationError.make({ reason: "policy" });
+	if (policy.requireImmediateInvalidation && capabilities.subjectInvalidation !== "immediate") return yield* SessionConfigurationError.make({ reason: "capability" });
+	return Object.freeze(policy);
+});
+const validateSessionTimeline = Effect.fn("validateSessionTimeline")(function* (session, policy) {
+	const now = DateTime.toEpochMillis(yield* DateTime.now);
+	const authenticatedAt = DateTime.toEpochMillis(session.assurance.authenticatedAt);
+	const issuedAt = DateTime.toEpochMillis(session.issuedAt);
+	const expiresAt = DateTime.toEpochMillis(session.expiresAt);
+	const absoluteExpiresAt = DateTime.toEpochMillis(session.absoluteExpiresAt);
+	const evidence = session.assurance.evidence;
+	if (evidence === void 0 || !evidence.some((proof) => DateTime.toEpochMillis(proof.verifiedAt) === authenticatedAt) || evidence.some((proof) => {
+		return DateTime.toEpochMillis(proof.verifiedAt) > issuedAt;
+	})) return yield* SessionInvalid.make({});
+	if (authenticatedAt > issuedAt || issuedAt > now || now >= expiresAt || expiresAt > absoluteExpiresAt || expiresAt <= issuedAt || absoluteExpiresAt - authenticatedAt > policy.maximumIssuedAbsoluteLifetimeMillis) return yield* SessionInvalid.make({});
+	return session;
+});
+const statefulCapabilities = Object.freeze({
+	mode: "stateful",
+	listing: true,
+	perSessionRevocation: true,
+	subjectInvalidation: "immediate",
+	renewal: "single-winner",
+	positiveCacheMillis: 0
+});
+const statelessCapabilities = Object.freeze({
+	mode: "stateless",
+	listing: false,
+	perSessionRevocation: false,
+	subjectInvalidation: "absolute-expiry",
+	renewal: "replayable",
+	positiveCacheMillis: 0
+});
+const stateAssistedCapabilities = Object.freeze({
+	mode: "state-assisted",
+	listing: false,
+	perSessionRevocation: true,
+	subjectInvalidation: "immediate",
+	renewal: "replayable",
+	positiveCacheMillis: 0
+});
+//#endregion
+export { SessionPolicy, stateAssistedCapabilities, statefulCapabilities, statelessCapabilities, validateSessionPolicy, validateSessionTimeline };
+
+//# sourceMappingURL=policy.mjs.map

package/dist/sessions/policy.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.mjs","names":[],"sources":["../../src/sessions/policy.ts"],"sourcesContent":["import { DateTime, Effect, Schema } from \"effect\";\n\nimport { SessionConfigurationError, SessionInvalid } from \"./errors\";\nimport type { SessionCapabilities, SessionMetadata } from \"./models\";\n\nconst PositiveMillis = Schema.Int.check(Schema.isGreaterThan(0));\n\nexport const SessionPolicy = Schema.Struct({\n  issuer: Schema.NonEmptyString,\n  audience: Schema.NonEmptyString,\n  generation: Schema.Natural,\n  idleLifetimeMillis: PositiveMillis,\n  absoluteLifetimeMillis: PositiveMillis,\n  renewalIntervalMillis: PositiveMillis,\n  /** Deployment-wide upper bound including tokens issued under older policy versions. */\n  maximumIssuedAbsoluteLifetimeMillis: PositiveMillis,\n  maximumTokenBytes: Schema.Int.check(Schema.isBetween({ minimum: 256, maximum: 1048576 })),\n  requireImmediateInvalidation: Schema.Boolean,\n});\n\nexport type SessionPolicy = typeof SessionPolicy.Type;\n\nexport const validateSessionPolicy = Effect.fn(\"validateSessionPolicy\")(function* (\n  input: SessionPolicy,\n  capabilities: SessionCapabilities,\n) {\n  const policy = yield* Schema.decodeEffect(SessionPolicy)(input).pipe(\n    Effect.mapError(() => SessionConfigurationError.make({ reason: \"policy\" })),\n  );\n\n  if (\n    policy.renewalIntervalMillis >= policy.idleLifetimeMillis ||\n    policy.idleLifetimeMillis > policy.absoluteLifetimeMillis ||\n    policy.absoluteLifetimeMillis > policy.maximumIssuedAbsoluteLifetimeMillis\n  )\n    return yield* SessionConfigurationError.make({ reason: \"policy\" });\n  if (policy.requireImmediateInvalidation && capabilities.subjectInvalidation !== \"immediate\") {\n    return yield* SessionConfigurationError.make({ reason: \"capability\" });\n  }\n\n  return Object.freeze(policy);\n});\n\nexport const validateSessionTimeline = Effect.fn(\"validateSessionTimeline\")(function* (\n  session: Pick<SessionMetadata, \"assurance\" | \"issuedAt\" | \"expiresAt\" | \"absoluteExpiresAt\">,\n  policy: SessionPolicy,\n) {\n  const now = DateTime.toEpochMillis(yield* DateTime.now);\n  const authenticatedAt = DateTime.toEpochMillis(session.assurance.authenticatedAt);\n  const issuedAt = DateTime.toEpochMillis(session.issuedAt);\n  const expiresAt = DateTime.toEpochMillis(session.expiresAt);\n  const absoluteExpiresAt = DateTime.toEpochMillis(session.absoluteExpiresAt);\n  const evidence = session.assurance.evidence;\n\n  if (\n    evidence === undefined ||\n    !evidence.some((proof) => DateTime.toEpochMillis(proof.verifiedAt) === authenticatedAt) ||\n    evidence.some((proof) => {\n      const verifiedAt = DateTime.toEpochMillis(proof.verifiedAt);\n\n      return verifiedAt > issuedAt;\n    })\n  )\n    return yield* SessionInvalid.make({});\n  if (\n    authenticatedAt > issuedAt ||\n    issuedAt > now ||\n    now >= expiresAt ||\n    expiresAt > absoluteExpiresAt ||\n    expiresAt <= issuedAt ||\n    absoluteExpiresAt - authenticatedAt > policy.maximumIssuedAbsoluteLifetimeMillis\n  )\n    return yield* SessionInvalid.make({});\n\n  return session;\n});\n\nexport const statefulCapabilities: SessionCapabilities = Object.freeze({\n  mode: \"stateful\",\n  listing: true,\n  perSessionRevocation: true,\n  subjectInvalidation: \"immediate\",\n  renewal: \"single-winner\",\n  positiveCacheMillis: 0,\n});\n\nexport const statelessCapabilities: SessionCapabilities = Object.freeze({\n  mode: \"stateless\",\n  listing: false,\n  perSessionRevocation: false,\n  subjectInvalidation: \"absolute-expiry\",\n  renewal: \"replayable\",\n  positiveCacheMillis: 0,\n});\n\nexport const stateAssistedCapabilities: SessionCapabilities = Object.freeze({\n  mode: \"state-assisted\",\n  listing: false,\n  perSessionRevocation: true,\n  subjectInvalidation: \"immediate\",\n  renewal: \"replayable\",\n  positiveCacheMillis: 0,\n});\n"],"mappings":";;;AAKA,MAAM,iBAAiB,OAAO,IAAI,MAAM,OAAO,cAAc,CAAC,CAAC;AAE/D,MAAa,gBAAgB,OAAO,OAAO;CACzC,QAAQ,OAAO;CACf,UAAU,OAAO;CACjB,YAAY,OAAO;CACnB,oBAAoB;CACpB,wBAAwB;CACxB,uBAAuB;;CAEvB,qCAAqC;CACrC,mBAAmB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAK,SAAS;CAAQ,CAAC,CAAC;CACxF,8BAA8B,OAAO;AACvC,CAAC;AAID,MAAa,wBAAwB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACtE,OACA,cACA;CACA,MAAM,SAAS,OAAO,OAAO,aAAa,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,KAC9D,OAAO,eAAe,0BAA0B,KAAK,EAAE,QAAQ,SAAS,CAAC,CAAC,CAC5E;CAEA,IACE,OAAO,yBAAyB,OAAO,sBACvC,OAAO,qBAAqB,OAAO,0BACnC,OAAO,yBAAyB,OAAO,qCAEvC,OAAO,OAAO,0BAA0B,KAAK,EAAE,QAAQ,SAAS,CAAC;CACnE,IAAI,OAAO,gCAAgC,aAAa,wBAAwB,aAC9E,OAAO,OAAO,0BAA0B,KAAK,EAAE,QAAQ,aAAa,CAAC;CAGvE,OAAO,OAAO,OAAO,MAAM;AAC7B,CAAC;AAED,MAAa,0BAA0B,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC1E,SACA,QACA;CACA,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;CACtD,MAAM,kBAAkB,SAAS,cAAc,QAAQ,UAAU,eAAe;CAChF,MAAM,WAAW,SAAS,cAAc,QAAQ,QAAQ;CACxD,MAAM,YAAY,SAAS,cAAc,QAAQ,SAAS;CAC1D,MAAM,oBAAoB,SAAS,cAAc,QAAQ,iBAAiB;CAC1E,MAAM,WAAW,QAAQ,UAAU;CAEnC,IACE,aAAa,KAAA,KACb,CAAC,SAAS,MAAM,UAAU,SAAS,cAAc,MAAM,UAAU,MAAM,eAAe,KACtF,SAAS,MAAM,UAAU;EAGvB,OAFmB,SAAS,cAAc,MAAM,UAEhC,IAAI;CACtB,CAAC,GAED,OAAO,OAAO,eAAe,KAAK,CAAC,CAAC;CACtC,IACE,kBAAkB,YAClB,WAAW,OACX,OAAO,aACP,YAAY,qBACZ,aAAa,YACb,oBAAoB,kBAAkB,OAAO,qCAE7C,OAAO,OAAO,eAAe,KAAK,CAAC,CAAC;CAEtC,OAAO;AACT,CAAC;AAED,MAAa,uBAA4C,OAAO,OAAO;CACrE,MAAM;CACN,SAAS;CACT,sBAAsB;CACtB,qBAAqB;CACrB,SAAS;CACT,qBAAqB;AACvB,CAAC;AAED,MAAa,wBAA6C,OAAO,OAAO;CACtE,MAAM;CACN,SAAS;CACT,sBAAsB;CACtB,qBAAqB;CACrB,SAAS;CACT,qBAAqB;AACvB,CAAC;AAED,MAAa,4BAAiD,OAAO,OAAO;CAC1E,MAAM;CACN,SAAS;CACT,sBAAsB;CACtB,qBAAqB;CACrB,SAAS;CACT,qBAAqB;AACvB,CAAC"}

package/dist/testing/conformance/AuthStore.d.mts

@@ -0,0 +1,11 @@
+import { AuthStore } from "../../AuthStore.mjs";
+import { Effect } from "effect";
+//#region src/testing/conformance/AuthStore.d.ts
+interface AuthStoreConformanceCase {
+  readonly name: string;
+  readonly run: Effect.Effect<void, never, AuthStore>;
+}
+declare const authStoreConformanceCases: ReadonlyArray<AuthStoreConformanceCase>;
+//#endregion
+export { AuthStoreConformanceCase, authStoreConformanceCases };
+//# sourceMappingURL=AuthStore.d.mts.map