@yielded/auth 0.1.0-beta.3 → 0.1.0-beta.5

package/dist/drizzle/oauth-registration.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-registration.mjs","names":[],"sources":["../../src/drizzle/oauth-registration.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- private owner kernel preserves Registration at the exported constructor. */\nimport { eq, sql } from \"drizzle-orm\";\nimport { Effect, Schema } from \"effect\";\n\nimport {\n  OAuthRegistrationAccess,\n  OAuthRegistrationDecision,\n  OAuthRegistrationFingerprint,\n  OAuthRegistrationInspection,\n  OAuthRegistrationIntent,\n} from \"../oauth/registrationModels\";\nimport {\n  OAuthCredentialSnapshot,\n  OAuthSignInTransactionContext,\n  type OAuthExternalIdentity,\n} from \"../oauth/signInModels\";\nimport { snapshotOAuthSync } from \"../oauth/signInSnapshot\";\nimport type { SecurityRevision } from \"../sessions/models\";\nimport type { DrizzleMappingError, SubjectIdCodec } from \"./model\";\nimport { discoverOwned, exactClaim, resolveOwned, terminalFlow } from \"./oauth-flow\";\nimport type { OAuthRegistrationBase } from \"./oauth-model\";\nimport { both, col, equal, matchesNativeRow, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { invariant, oauthIdentityKey, sameIdentity, storage } from \"./oauth-state\";\n\nexport const intentStorage = storage(OAuthRegistrationIntent);\nconst decisionStorage = storage(OAuthRegistrationDecision);\nconst contextStorage = storage(OAuthSignInTransactionContext);\n\nconst reservationStorage = storage(\n  Schema.Struct({\n    moduleId: Schema.String,\n    reference: Schema.String,\n    commandId: Schema.String,\n    fingerprint: Schema.String,\n    provisioningIdentity: Schema.String,\n  }),\n);\n\nexport const readTuple = (ownership: any, identity: typeof OAuthExternalIdentity.Type) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const t = ownership.tuple,\n        key = oauthIdentityKey(identity);\n\n      const where = { [t.identityKey]: key };\n      const observed = yield* owner.read(t.table, equal(t.table, where), { limit: 1 });\n\n      if (observed.rows.length === 0) {\n        const values = {\n          ...t.encodeInsert({ identityKey: key, identity }),\n          ...where,\n          [t.provider]: identity.provider,\n          [t.issuer]: identity.issuer,\n          [t.externalSubject]: identity.subject,\n          [t.state]: \"Unowned\",\n          [t.version]: owner.marker,\n          [t.subjectId]: null,\n          [t.reservation]: null,\n        };\n\n        const inserted = yield* owner.insert(t.table, values, where, true);\n\n        observed.rows = inserted.rows;\n      }\n      const row = observed.rows[0]!;\n\n      invariant(\n        row[t.provider] === identity.provider &&\n          row[t.issuer] === identity.issuer &&\n          row[t.externalSubject] === identity.subject &&\n          [\"Unowned\", \"Reserved\", \"Owned\"].includes(row[t.state]),\n      );\n      invariant(\n        row[t.state] === \"Owned\"\n          ? row[t.subjectId] !== null\n          : row[t.subjectId] === null &&\n              (row[t.state] === \"Reserved\"\n                ? typeof row[t.reservation] === \"string\"\n                : row[t.reservation] === null),\n      );\n      if (ownership.mode === \"separate\") {\n        const o = ownership.external;\n\n        const external = yield* owner.read(o.table, equal(o.table, { [o.identityKey]: key }), {\n          limit: 1,\n        });\n\n        if (row[t.state] === \"Owned\") {\n          const linked = external.rows[0];\n\n          invariant(\n            linked !== undefined &&\n              linked[o.provider] === identity.provider &&\n              linked[o.issuer] === identity.issuer &&\n              linked[o.externalSubject] === identity.subject &&\n              matchesNativeRow(o.table, linked, { [o.subjectId]: row[t.subjectId] }),\n          );\n          const owned = sql`exists(select 1 from ${o.table} where ${both(equal(o.table, { [o.identityKey]: key }), o.ownedCondition)})`;\n\n          invariant(yield* owner.check(owned));\n          owner.postconditions.push(owned);\n        } else invariant(external.rows.length === 0);\n      }\n\n      return { observed, row, key };\n    }),\n  );\n\nexport const acquireTuple = (\n  ownership: any,\n  identity: typeof OAuthExternalIdentity.Type,\n  key: string,\n  subjectId: unknown,\n) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const t = ownership.tuple;\n\n      yield* owner.update(\n        t.table,\n        { [t.identityKey]: key },\n        {\n          [t.state]: \"Owned\",\n          [t.subjectId]: subjectId,\n          [t.reservation]: null,\n          [t.version]: owner.marker,\n        },\n      );\n      if (ownership.mode === \"separate\") {\n        const o = ownership.external;\n\n        const values = {\n          ...o.encodeInsert({ identity, identityKey: key, subjectId }),\n          [o.identityKey]: key,\n          [o.provider]: identity.provider,\n          [o.issuer]: identity.issuer,\n          [o.externalSubject]: identity.subject,\n          [o.subjectId]: subjectId,\n        };\n\n        yield* owner.insert(o.table, values, { [o.identityKey]: key });\n      }\n    }),\n  );\n\nexport const settleRegistrationIntent = (mapping: any, input: any) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const identity = input.identity.identity,\n        context = input.claim.flow.context;\n\n      invariant(identity.provider === context.provider && identity.issuer === context.issuer);\n      const found = yield* discoverOwned(mapping.signIn, identity);\n      const tuple = found.owned ? undefined : yield* readTuple(mapping.ownership, identity);\n      const exact = yield* exactClaim(mapping.signIn, input.claim, \"sign-in\");\n\n      if (exact === undefined) return { _tag: \"Rejected\" } as const;\n      const credential = resolveOwned(mapping.signIn, context.moduleId, identity, found);\n\n      if (credential !== undefined) {\n        yield* terminalFlow(mapping.signIn, input.claim.flow, \"Verified\");\n\n        return { _tag: \"Verified\", credential } as const;\n      }\n      let decision: any = { _tag: \"Rejected\" };\n\n      if (\n        !found.owned &&\n        tuple?.row[mapping.ownership.tuple.state] === \"Unowned\" &&\n        input.intent !== undefined\n      ) {\n        const intent = snapshotOAuthSync(OAuthRegistrationIntent, input.intent);\n        const c = intent.context;\n\n        invariant(\n          sameIdentity(intent.identity, identity) &&\n            intent.claimId === input.claim.claimId &&\n            intent.claimedAtMillis === input.claim.claimedAtMillis &&\n            contextStorage.encode(c) === contextStorage.encode(context),\n        );\n\n        const allowed =\n          intent.issuedAtMillis >= intent.claimedAtMillis &&\n          intent.verifiedAtMillis <= intent.issuedAtMillis &&\n          intent.issuedAtMillis <= exact.now &&\n          exact.now < intent.expiresAtMillis &&\n          intent.expiresAtMillis <= c.requestBindingExpiresAtMillis &&\n          intent.retentionUntilMillis >= intent.expiresAtMillis &&\n          (yield* owner.check(mapping.eligibility.condition({ intent })));\n\n        if (allowed) {\n          const i = mapping.intent,\n            encode = mapping.signIn.clock.encodeInstant;\n\n          const key = { [i.moduleId]: c.moduleId, [i.reference]: intent.reference };\n\n          const values = {\n            ...i.encodeInsert(snapshotOAuthSync(OAuthRegistrationIntent, intent)),\n            ...key,\n            [i.flowId]: c.flowId,\n            [i.claimId]: intent.claimId,\n            [i.identityKey]: tuple.key,\n            [i.version]: owner.marker,\n            [i.state]: \"Unbound\",\n            [i.snapshot]: intentStorage.encode(intent),\n            [i.commandId]: null,\n            [i.fingerprint]: null,\n            [i.pendingReference]: null,\n            [i.expiresAt]: encode(intent.expiresAtMillis),\n            [i.retentionUntil]: encode(intent.retentionUntilMillis),\n          };\n\n          yield* owner.insert(i.table, values, key);\n          owner.postconditions.push(\n            mapping.eligibility.condition({ intent }),\n            sql`${mapping.signIn.clock.engineNowMillis} >= ${intent.issuedAtMillis} and\n            ${mapping.signIn.clock.engineNowMillis} < ${intent.expiresAtMillis}`,\n          );\n          decision = { _tag: \"RegistrationIssued\", intent };\n        }\n      }\n      yield* terminalFlow(mapping.signIn, input.claim.flow, decision._tag);\n\n      return decision;\n    }),\n  );\n\nexport const inspectIntent = (\n  mapping: any,\n  original: typeof OAuthRegistrationAccess.Type,\n  discovery = false,\n) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const access = snapshotOAuthSync(OAuthRegistrationAccess, original),\n        i = mapping.intent;\n\n      const observed = yield* owner.read(\n        i.table,\n        equal(i.table, {\n          [i.moduleId]: access.moduleId,\n          [i.reference]: access.reference,\n        }),\n        { limit: 1, ...(discovery ? { lock: false, observe: false } : {}) },\n      );\n\n      const row = observed.rows[0];\n\n      if (row === undefined) return undefined;\n\n      const intent = intentStorage.decode(row[i.snapshot]),\n        c = intent.context,\n        now = yield* owner.now(mapping.clock);\n\n      invariant(\n        row[i.moduleId] === c.moduleId &&\n          row[i.reference] === intent.reference &&\n          row[i.flowId] === c.flowId &&\n          row[i.claimId] === intent.claimId &&\n          row[i.identityKey] === oauthIdentityKey(intent.identity) &&\n          mapping.clock.decodeInstant(row[i.expiresAt]) === intent.expiresAtMillis &&\n          mapping.clock.decodeInstant(row[i.retentionUntil]) === intent.retentionUntilMillis,\n      );\n      if (\n        access.moduleId !== c.moduleId ||\n        access.reference !== intent.reference ||\n        access.flowId !== c.flowId ||\n        access.requestBindingVerifier !== c.requestBindingVerifier ||\n        access.requestBindingExpiresAtMillis !== c.requestBindingExpiresAtMillis ||\n        access.credentialDigest !== intent.credentialDigest ||\n        now < intent.issuedAtMillis ||\n        now >= intent.expiresAtMillis\n      )\n        return undefined;\n      let application: any;\n\n      if (row[i.state] === \"Unbound\") {\n        invariant(\n          row[i.commandId] === null &&\n            row[i.fingerprint] === null &&\n            row[i.pendingReference] === null,\n        );\n        application = { _tag: \"Unbound\" };\n      } else {\n        application = {\n          _tag: row[i.state],\n          commandId: row[i.commandId],\n          fingerprint: row[i.fingerprint],\n          ...(row[i.state] === \"ProvisioningPending\" ? { reference: row[i.pendingReference] } : {}),\n        };\n      }\n      const inspection = snapshotOAuthSync(OAuthRegistrationInspection, { intent, application });\n\n      owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${intent.issuedAtMillis} and\n      ${mapping.clock.engineNowMillis} < ${intent.expiresAtMillis}`);\n\n      return { observed, row, inspection };\n    }),\n  );\n\nexport interface RegistrationResources {\n  readonly provisioningIdentity: string;\n  readonly pendingReference?: string;\n  readonly subjectId?: unknown;\n  readonly credentialId?: string;\n  readonly revision?: string;\n}\n\n/** Public mapping callbacks are closed Effects; erasing native row shapes must\n * not erase their error or requirements channels. */\nexport type RegistrationCallbacks<Registration> = Pick<\n  OAuthRegistrationBase<Registration, any, any, any, any, unknown>,\n  \"snapshot\" | \"snapshotSync\" | \"inspect\" | \"inspectSync\"\n>;\n\nexport const registrationResources = (mapping: any) =>\n  Effect.gen(function* () {\n    const provisioningIdentity = yield* mapping.allocateProvisioningIdentity as Effect.Effect<\n      string,\n      DrizzleMappingError\n    >;\n\n    invariant(\n      typeof provisioningIdentity === \"string\" &&\n        provisioningIdentity.length > 0 &&\n        provisioningIdentity.length <= 256,\n    );\n    if (mapping.mode === \"pending\") {\n      const pendingReference = yield* mapping.allocatePendingReference as Effect.Effect<\n        string,\n        DrizzleMappingError\n      >;\n\n      invariant(\n        typeof pendingReference === \"string\" &&\n          pendingReference.length > 0 &&\n          pendingReference.length <= 256,\n      );\n\n      return { provisioningIdentity, pendingReference } as RegistrationResources;\n    }\n\n    const subjectId = yield* mapping.allocateSubjectId as Effect.Effect<\n      unknown,\n      DrizzleMappingError\n    >;\n\n    const publicId = yield* (mapping.subjectId as SubjectIdCodec<unknown>).toSubject(subjectId);\n\n    invariant(\n      mapping.subjectId.equals(\n        subjectId,\n        yield* (mapping.subjectId as SubjectIdCodec<unknown>).toNative(publicId),\n      ),\n    );\n\n    const credentialId = snapshotOAuthSync(\n      OAuthCredentialSnapshot.fields.credentialId,\n      yield* mapping.allocateCredentialId as Effect.Effect<string, DrizzleMappingError>,\n    );\n\n    const revision = snapshotOAuthSync(\n      OAuthCredentialSnapshot.fields.credentialRevision,\n      yield* mapping.allocateRevision as Effect.Effect<SecurityRevision, DrizzleMappingError>,\n    );\n\n    return { provisioningIdentity, subjectId, credentialId, revision } as RegistrationResources;\n  });\n\nexport const registrationData = <Registration>(\n  mapping: any,\n  input: {\n    readonly intent: OAuthRegistrationIntent;\n    readonly registration: Registration;\n    readonly fingerprint: string;\n  },\n  bound: boolean,\n) =>\n  Effect.gen(function* () {\n    const snapshot = bound\n      ? (invariant(mapping.snapshotSync !== undefined), mapping.snapshotSync(input.registration))\n      : yield* (mapping as RegistrationCallbacks<Registration>).snapshot(input.registration);\n\n    const encoded = mapping.application.encode(snapshot);\n\n    invariant(typeof encoded === \"string\" && new TextEncoder().encode(encoded).length <= 1048576);\n    const detached = mapping.application.decode(encoded);\n\n    invariant(mapping.application.encode(detached) === encoded);\n\n    const checked = bound\n      ? (invariant(mapping.inspectSync !== undefined),\n        mapping.inspectSync({\n          intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent),\n          registration: mapping.application.decode(encoded),\n        }))\n      : yield* (mapping as RegistrationCallbacks<Registration>).inspect({\n          intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent),\n          registration: mapping.application.decode(encoded),\n        });\n\n    const fingerprint = snapshotOAuthSync(OAuthRegistrationFingerprint, checked.fingerprint);\n\n    invariant(typeof checked.eligible === \"boolean\");\n\n    return {\n      encoded,\n      registration: detached as Registration,\n      fingerprint,\n      eligible: checked.eligible && fingerprint === input.fingerprint,\n    };\n  });\n\nexport const register = (\n  mapping: any,\n  input: any,\n  data: { readonly encoded: string; readonly fingerprint: string; readonly eligible: boolean },\n  resources: RegistrationResources,\n) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const intent = snapshotOAuthSync(OAuthRegistrationIntent, input.intent),\n        c = intent.context;\n\n      const discovered = yield* inspectIntent(mapping, input.access, true);\n\n      if (\n        discovered === undefined ||\n        intentStorage.encode(discovered.inspection.intent) !== intentStorage.encode(intent)\n      )\n        return { _tag: \"Rejected\" } as const;\n      const nativeSubjectId = resources.subjectId;\n\n      const policyInput = () => ({\n        intent: snapshotOAuthSync(OAuthRegistrationIntent, intent),\n        registration: mapping.application.decode(data.encoded),\n        ...(mapping.mode === \"atomic\" ? { nativeSubjectId } : {}),\n      });\n\n      invariant((mapping.eligibility.guards?.length ?? 0) <= 32);\n      for (const guard of mapping.eligibility.guards ?? []) {\n        const locked = yield* owner.read(guard.table, guard.condition(policyInput()), {\n          orderBy: col(guard.table, guard.orderBy),\n          admissionOnly: true,\n        });\n\n        invariant(locked.rows.length > 0);\n      }\n      const tuple = yield* readTuple(mapping.ownership, intent.identity);\n      const inspected = yield* inspectIntent(mapping, input.access);\n\n      if (\n        inspected === undefined ||\n        intentStorage.encode(inspected.inspection.intent) !== intentStorage.encode(intent)\n      )\n        return { _tag: \"Rejected\" } as const;\n\n      const r = mapping.command,\n        i = mapping.intent,\n        t = mapping.ownership.tuple;\n\n      const commandKey = { [r.moduleId]: c.moduleId, [r.commandId]: input.commandId };\n      const command = yield* owner.read(r.table, equal(r.table, commandKey), { limit: 1 });\n      const previous = command.rows[0];\n\n      if (previous !== undefined) {\n        if (\n          previous[r.reference] !== intent.reference ||\n          previous[r.identityKey] !== tuple.key ||\n          previous[r.fingerprint] !== data.fingerprint ||\n          previous[r.intentSnapshot] !== intentStorage.encode(intent) ||\n          previous[r.applicationSnapshot] !== data.encoded\n        )\n          return { _tag: \"Conflict\" } as const;\n        invariant(\n          mapping.application.encode(\n            mapping.application.decode(previous[r.applicationSnapshot]),\n          ) === data.encoded,\n        );\n        const old = decisionStorage.decode(previous[r.decision]);\n\n        invariant(inspected.inspection.application._tag === old._tag);\n\n        return old._tag === \"Registered\" || old._tag === \"ProvisioningPending\"\n          ? { ...old, replayed: true }\n          : old;\n      }\n      if (inspected.inspection.application._tag !== \"Unbound\" || tuple.row[t.state] !== \"Unowned\")\n        return { _tag: \"Conflict\" } as const;\n      if (data.fingerprint !== input.fingerprint) return { _tag: \"Rejected\" } as const;\n\n      const admitted =\n        data.eligible && (yield* owner.check(mapping.eligibility.admission(policyInput())));\n\n      let decision: typeof OAuthRegistrationDecision.Type;\n\n      if (!admitted) decision = { _tag: \"Rejected\" };\n      else if (mapping.mode === \"pending\") {\n        invariant(resources.pendingReference !== undefined);\n\n        const reservation = reservationStorage.encode({\n          moduleId: c.moduleId,\n          reference: intent.reference,\n          commandId: input.commandId,\n          fingerprint: data.fingerprint,\n          provisioningIdentity: resources.provisioningIdentity,\n        });\n\n        yield* owner.update(\n          t.table,\n          { [t.identityKey]: tuple.key },\n          {\n            [t.state]: \"Reserved\",\n            [t.version]: owner.marker,\n            [t.reservation]: reservation,\n          },\n        );\n        decision = {\n          _tag: \"ProvisioningPending\",\n          reference: resources.pendingReference,\n          replayed: false,\n        };\n      } else {\n        invariant(resources.credentialId !== undefined && resources.revision !== undefined);\n\n        const s = mapping.subject,\n          cr = mapping.credential,\n          a = mapping.authority;\n\n        const subjectValues = {\n          ...mapping.encodeSubjectInsert(policyInput(), {\n            subjectId: nativeSubjectId,\n            securityRevision: resources.revision,\n          }),\n          [s.id]: nativeSubjectId,\n          [s.securityRevision]: resources.revision,\n        };\n\n        yield* owner.insert(s.table, subjectValues, { [s.id]: nativeSubjectId });\n\n        const credentialValues = {\n          ...cr.encodeInsert({\n            moduleId: c.moduleId,\n            subjectId: nativeSubjectId,\n            identityKey: tuple.key,\n            credentialId: resources.credentialId,\n            credentialRevision: resources.revision,\n          }),\n          [cr.moduleId]: c.moduleId,\n          [cr.subjectId]: nativeSubjectId,\n          [cr.identityKey]: tuple.key,\n          [cr.credentialId]: resources.credentialId,\n          [cr.credentialRevision]: resources.revision,\n        };\n\n        invariant(\n          cr.isActiveStatus(credentialValues[cr.status]) &&\n            s.isActiveStatus(subjectValues[s.status]),\n        );\n        yield* owner.insert(cr.table, credentialValues, {\n          [cr.credentialId]: resources.credentialId,\n        });\n\n        const authorityValues = {\n          ...a.encodeInsert({\n            subjectId: nativeSubjectId,\n            credentialId: resources.credentialId,\n            revision: resources.revision,\n          }),\n          [a.subjectId]: nativeSubjectId,\n          [a.credentialId]: resources.credentialId,\n          [a.revision]: resources.revision,\n        };\n\n        invariant(a.isActiveStatus(authorityValues[a.status]));\n        yield* owner.insert(a.table, authorityValues, {\n          [a.subjectId]: nativeSubjectId,\n          [a.credentialId]: resources.credentialId,\n        });\n        yield* acquireTuple(mapping.ownership, intent.identity, tuple.key, nativeSubjectId);\n        owner.postconditions.push(\n          sql`exists(select 1 from ${s.table} where ${both(\n            eq(col(s.table, s.id), nativeSubjectId),\n            s.activeCondition,\n          )})`,\n          sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.credentialId), resources.credentialId), cr.activeCondition)})`,\n          sql`exists(select 1 from ${a.table} where ${both(\n            eq(col(a.table, a.credentialId), resources.credentialId),\n            eq(col(a.table, a.subjectId), nativeSubjectId),\n            a.activeCondition,\n          )})`,\n        );\n        decision = { _tag: \"Registered\", replayed: false };\n      }\n      const now = yield* owner.now(mapping.clock);\n\n      invariant(Number.isSafeInteger(mapping.retentionMillis) && mapping.retentionMillis >= 120000);\n\n      const values = {\n        ...r.encodeInsert({\n          intent: snapshotOAuthSync(OAuthRegistrationIntent, intent),\n          commandId: input.commandId,\n          fingerprint: data.fingerprint,\n          registration: mapping.application.decode(data.encoded),\n          provisioningIdentity: resources.provisioningIdentity,\n        }),\n        ...commandKey,\n        [r.reference]: intent.reference,\n        [r.identityKey]: tuple.key,\n        [r.fingerprint]: data.fingerprint,\n        [r.intentSnapshot]: intentStorage.encode(intent),\n        [r.applicationSnapshot]: data.encoded,\n        [r.provisioningIdentity]: resources.provisioningIdentity,\n        [r.decision]: decisionStorage.encode(decision),\n        [r.retentionUntil]: mapping.clock.encodeInstant(\n          Math.max(intent.retentionUntilMillis, now + mapping.retentionMillis),\n        ),\n      };\n\n      const inserted = yield* owner.insert(r.table, values, commandKey);\n\n      command.rows = inserted.rows;\n      yield* owner.update(\n        i.table,\n        { [i.moduleId]: c.moduleId, [i.reference]: intent.reference },\n        {\n          [i.state]: decision._tag,\n          [i.commandId]: input.commandId,\n          [i.fingerprint]: data.fingerprint,\n          [i.version]: owner.marker,\n          [i.pendingReference]: decision._tag === \"ProvisioningPending\" ? decision.reference : null,\n        },\n      );\n      if (admitted) owner.postconditions.push(mapping.eligibility.postcondition(policyInput()));\n\n      return decision;\n    }),\n  );\n"],"mappings":";;;;;;;;;;AAwBA,MAAa,gBAAgB,QAAQ,uBAAuB;AAC5D,MAAM,kBAAkB,QAAQ,yBAAyB;AACzD,MAAM,iBAAiB,QAAQ,6BAA6B;AAE5D,MAAM,qBAAqB,QACzB,OAAO,OAAO;CACZ,UAAU,OAAO;CACjB,WAAW,OAAO;CAClB,WAAW,OAAO;CAClB,aAAa,OAAO;CACpB,sBAAsB,OAAO;AAC/B,CAAC,CACH;AAEA,MAAa,aAAa,WAAgB,aACxC,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,IAAI,UAAU,OAClB,MAAM,iBAAiB,QAAQ;CAEjC,MAAM,QAAQ,GAAG,EAAE,cAAc,IAAI;CACrC,MAAM,WAAW,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC;CAE/E,IAAI,SAAS,KAAK,WAAW,GAAG;EAC9B,MAAM,SAAS;GACb,GAAG,EAAE,aAAa;IAAE,aAAa;IAAK;GAAS,CAAC;GAChD,GAAG;IACF,EAAE,WAAW,SAAS;IACtB,EAAE,SAAS,SAAS;IACpB,EAAE,kBAAkB,SAAS;IAC7B,EAAE,QAAQ;IACV,EAAE,UAAU,MAAM;IAClB,EAAE,YAAY;IACd,EAAE,cAAc;EACnB;EAIA,SAAS,QAAO,OAFQ,MAAM,OAAO,EAAE,OAAO,QAAQ,OAAO,IAAI,EAAA,CAExC;CAC3B;CACA,MAAM,MAAM,SAAS,KAAK;CAE1B,UACE,IAAI,EAAE,cAAc,SAAS,YAC3B,IAAI,EAAE,YAAY,SAAS,UAC3B,IAAI,EAAE,qBAAqB,SAAS,WACpC;EAAC;EAAW;EAAY;CAAO,CAAC,CAAC,SAAS,IAAI,EAAE,MAAM,CAC1D;CACA,UACE,IAAI,EAAE,WAAW,UACb,IAAI,EAAE,eAAe,OACrB,IAAI,EAAE,eAAe,SAClB,IAAI,EAAE,WAAW,aACd,OAAO,IAAI,EAAE,iBAAiB,WAC9B,IAAI,EAAE,iBAAiB,KACnC;CACA,IAAI,UAAU,SAAS,YAAY;EACjC,MAAM,IAAI,UAAU;EAEpB,MAAM,WAAW,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,cAAc,IAAI,CAAC,GAAG,EACpF,OAAO,EACT,CAAC;EAED,IAAI,IAAI,EAAE,WAAW,SAAS;GAC5B,MAAM,SAAS,SAAS,KAAK;GAE7B,UACE,WAAW,KAAA,KACT,OAAO,EAAE,cAAc,SAAS,YAChC,OAAO,EAAE,YAAY,SAAS,UAC9B,OAAO,EAAE,qBAAqB,SAAS,WACvC,iBAAiB,EAAE,OAAO,QAAQ,GAAG,EAAE,YAAY,IAAI,EAAE,WAAW,CAAC,CACzE;GACA,MAAM,QAAQ,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,MAAM,EAAE,OAAO,GAAG,EAAE,cAAc,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE;GAE3H,UAAU,OAAO,MAAM,MAAM,KAAK,CAAC;GACnC,MAAM,eAAe,KAAK,KAAK;EACjC,OAAO,UAAU,SAAS,KAAK,WAAW,CAAC;CAC7C;CAEA,OAAO;EAAE;EAAU;EAAK;CAAI;AAC9B,CAAC,CACH;AAEF,MAAa,gBACX,WACA,UACA,KACA,cAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,IAAI,UAAU;CAEpB,OAAO,MAAM,OACX,EAAE,OACF,GAAG,EAAE,cAAc,IAAI,GACvB;GACG,EAAE,QAAQ;GACV,EAAE,YAAY;GACd,EAAE,cAAc;GAChB,EAAE,UAAU,MAAM;CACrB,CACF;CACA,IAAI,UAAU,SAAS,YAAY;EACjC,MAAM,IAAI,UAAU;EAEpB,MAAM,SAAS;GACb,GAAG,EAAE,aAAa;IAAE;IAAU,aAAa;IAAK;GAAU,CAAC;IAC1D,EAAE,cAAc;IAChB,EAAE,WAAW,SAAS;IACtB,EAAE,SAAS,SAAS;IACpB,EAAE,kBAAkB,SAAS;IAC7B,EAAE,YAAY;EACjB;EAEA,OAAO,MAAM,OAAO,EAAE,OAAO,QAAQ,GAAG,EAAE,cAAc,IAAI,CAAC;CAC/D;AACF,CAAC,CACH;AAEF,MAAa,4BAA4B,SAAc,UACrD,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,MAAM,SAAS,UAC9B,UAAU,MAAM,MAAM,KAAK;CAE7B,UAAU,SAAS,aAAa,QAAQ,YAAY,SAAS,WAAW,QAAQ,MAAM;CACtF,MAAM,QAAQ,OAAO,cAAc,QAAQ,QAAQ,QAAQ;CAC3D,MAAM,QAAQ,MAAM,QAAQ,KAAA,IAAY,OAAO,UAAU,QAAQ,WAAW,QAAQ;CACpF,MAAM,QAAQ,OAAO,WAAW,QAAQ,QAAQ,MAAM,OAAO,SAAS;CAEtE,IAAI,UAAU,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CACnD,MAAM,aAAa,aAAa,QAAQ,QAAQ,QAAQ,UAAU,UAAU,KAAK;CAEjF,IAAI,eAAe,KAAA,GAAW;EAC5B,OAAO,aAAa,QAAQ,QAAQ,MAAM,MAAM,MAAM,UAAU;EAEhE,OAAO;GAAE,MAAM;GAAY;EAAW;CACxC;CACA,IAAI,WAAgB,EAAE,MAAM,WAAW;CAEvC,IACE,CAAC,MAAM,SACP,OAAO,IAAI,QAAQ,UAAU,MAAM,WAAW,aAC9C,MAAM,WAAW,KAAA,GACjB;EACA,MAAM,SAAS,kBAAkB,yBAAyB,MAAM,MAAM;EACtE,MAAM,IAAI,OAAO;EAEjB,UACE,aAAa,OAAO,UAAU,QAAQ,KACpC,OAAO,YAAY,MAAM,MAAM,WAC/B,OAAO,oBAAoB,MAAM,MAAM,mBACvC,eAAe,OAAO,CAAC,MAAM,eAAe,OAAO,OAAO,CAC9D;EAWA,IARE,OAAO,kBAAkB,OAAO,mBAChC,OAAO,oBAAoB,OAAO,kBAClC,OAAO,kBAAkB,MAAM,OAC/B,MAAM,MAAM,OAAO,mBACnB,OAAO,mBAAmB,EAAE,iCAC5B,OAAO,wBAAwB,OAAO,oBACrC,OAAO,MAAM,MAAM,QAAQ,YAAY,UAAU,EAAE,OAAO,CAAC,CAAC,IAElD;GACX,MAAM,IAAI,QAAQ,QAChB,SAAS,QAAQ,OAAO,MAAM;GAEhC,MAAM,MAAM;KAAG,EAAE,WAAW,EAAE;KAAW,EAAE,YAAY,OAAO;GAAU;GAExE,MAAM,SAAS;IACb,GAAG,EAAE,aAAa,kBAAkB,yBAAyB,MAAM,CAAC;IACpE,GAAG;KACF,EAAE,SAAS,EAAE;KACb,EAAE,UAAU,OAAO;KACnB,EAAE,cAAc,MAAM;KACtB,EAAE,UAAU,MAAM;KAClB,EAAE,QAAQ;KACV,EAAE,WAAW,cAAc,OAAO,MAAM;KACxC,EAAE,YAAY;KACd,EAAE,cAAc;KAChB,EAAE,mBAAmB;KACrB,EAAE,YAAY,OAAO,OAAO,eAAe;KAC3C,EAAE,iBAAiB,OAAO,OAAO,oBAAoB;GACxD;GAEA,OAAO,MAAM,OAAO,EAAE,OAAO,QAAQ,GAAG;GACxC,MAAM,eAAe,KACnB,QAAQ,YAAY,UAAU,EAAE,OAAO,CAAC,GACxC,GAAG,GAAG,QAAQ,OAAO,MAAM,gBAAgB,MAAM,OAAO,eAAe;cACrE,QAAQ,OAAO,MAAM,gBAAgB,KAAK,OAAO,iBACrD;GACA,WAAW;IAAE,MAAM;IAAsB;GAAO;EAClD;CACF;CACA,OAAO,aAAa,QAAQ,QAAQ,MAAM,MAAM,MAAM,SAAS,IAAI;CAEnE,OAAO;AACT,CAAC,CACH;AAEF,MAAa,iBACX,SACA,UACA,YAAY,UAEZ,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,SAAS,kBAAkB,yBAAyB,QAAQ,GAChE,IAAI,QAAQ;CAEd,MAAM,WAAW,OAAO,MAAM,KAC5B,EAAE,OACF,MAAM,EAAE,OAAO;GACZ,EAAE,WAAW,OAAO;GACpB,EAAE,YAAY,OAAO;CACxB,CAAC,GACD;EAAE,OAAO;EAAG,GAAI,YAAY;GAAE,MAAM;GAAO,SAAS;EAAM,IAAI,CAAC;CAAG,CACpE;CAEA,MAAM,MAAM,SAAS,KAAK;CAE1B,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAE9B,MAAM,SAAS,cAAc,OAAO,IAAI,EAAE,SAAS,GACjD,IAAI,OAAO,SACX,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAEtC,UACE,IAAI,EAAE,cAAc,EAAE,YACpB,IAAI,EAAE,eAAe,OAAO,aAC5B,IAAI,EAAE,YAAY,EAAE,UACpB,IAAI,EAAE,aAAa,OAAO,WAC1B,IAAI,EAAE,iBAAiB,iBAAiB,OAAO,QAAQ,KACvD,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,MAAM,OAAO,mBACzD,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,MAAM,OAAO,oBAClE;CACA,IACE,OAAO,aAAa,EAAE,YACtB,OAAO,cAAc,OAAO,aAC5B,OAAO,WAAW,EAAE,UACpB,OAAO,2BAA2B,EAAE,0BACpC,OAAO,kCAAkC,EAAE,iCAC3C,OAAO,qBAAqB,OAAO,oBACnC,MAAM,OAAO,kBACb,OAAO,OAAO,iBAEd,OAAO,KAAA;CACT,IAAI;CAEJ,IAAI,IAAI,EAAE,WAAW,WAAW;EAC9B,UACE,IAAI,EAAE,eAAe,QACnB,IAAI,EAAE,iBAAiB,QACvB,IAAI,EAAE,sBAAsB,IAChC;EACA,cAAc,EAAE,MAAM,UAAU;CAClC,OACE,cAAc;EACZ,MAAM,IAAI,EAAE;EACZ,WAAW,IAAI,EAAE;EACjB,aAAa,IAAI,EAAE;EACnB,GAAI,IAAI,EAAE,WAAW,wBAAwB,EAAE,WAAW,IAAI,EAAE,kBAAkB,IAAI,CAAC;CACzF;CAEF,MAAM,aAAa,kBAAkB,6BAA6B;EAAE;EAAQ;CAAY,CAAC;CAEzF,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,OAAO,eAAe;QACxF,QAAQ,MAAM,gBAAgB,KAAK,OAAO,iBAAiB;CAE7D,OAAO;EAAE;EAAU;EAAK;CAAW;AACrC,CAAC,CACH;AAiBF,MAAa,yBAAyB,YACpC,OAAO,IAAI,aAAa;CACtB,MAAM,uBAAuB,OAAO,QAAQ;CAK5C,UACE,OAAO,yBAAyB,YAC9B,qBAAqB,SAAS,KAC9B,qBAAqB,UAAU,GACnC;CACA,IAAI,QAAQ,SAAS,WAAW;EAC9B,MAAM,mBAAmB,OAAO,QAAQ;EAKxC,UACE,OAAO,qBAAqB,YAC1B,iBAAiB,SAAS,KAC1B,iBAAiB,UAAU,GAC/B;EAEA,OAAO;GAAE;GAAsB;EAAiB;CAClD;CAEA,MAAM,YAAY,OAAO,QAAQ;CAKjC,MAAM,WAAW,OAAQ,QAAQ,UAAsC,UAAU,SAAS;CAE1F,UACE,QAAQ,UAAU,OAChB,WACA,OAAQ,QAAQ,UAAsC,SAAS,QAAQ,CACzE,CACF;CAYA,OAAO;EAAE;EAAsB;EAAW,cAVrB,kBACnB,wBAAwB,OAAO,cAC/B,OAAO,QAAQ,oBAQoC;EAAG,UALvC,kBACf,wBAAwB,OAAO,oBAC/B,OAAO,QAAQ,gBAG8C;CAAE;AACnE,CAAC;AAEH,MAAa,oBACX,SACA,OAKA,UAEA,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,SACZ,UAAU,QAAQ,iBAAiB,KAAA,CAAS,GAAG,QAAQ,aAAa,MAAM,YAAY,KACvF,OAAQ,QAAgD,SAAS,MAAM,YAAY;CAEvF,MAAM,UAAU,QAAQ,YAAY,OAAO,QAAQ;CAEnD,UAAU,OAAO,YAAY,YAAY,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,UAAU,OAAO;CAC5F,MAAM,WAAW,QAAQ,YAAY,OAAO,OAAO;CAEnD,UAAU,QAAQ,YAAY,OAAO,QAAQ,MAAM,OAAO;CAE1D,MAAM,UAAU,SACX,UAAU,QAAQ,gBAAgB,KAAA,CAAS,GAC5C,QAAQ,YAAY;EAClB,QAAQ,kBAAkB,yBAAyB,MAAM,MAAM;EAC/D,cAAc,QAAQ,YAAY,OAAO,OAAO;CAClD,CAAC,KACD,OAAQ,QAAgD,QAAQ;EAC9D,QAAQ,kBAAkB,yBAAyB,MAAM,MAAM;EAC/D,cAAc,QAAQ,YAAY,OAAO,OAAO;CAClD,CAAC;CAEL,MAAM,cAAc,kBAAkB,8BAA8B,QAAQ,WAAW;CAEvF,UAAU,OAAO,QAAQ,aAAa,SAAS;CAE/C,OAAO;EACL;EACA,cAAc;EACd;EACA,UAAU,QAAQ,YAAY,gBAAgB,MAAM;CACtD;AACF,CAAC;AAEH,MAAa,YACX,SACA,OACA,MACA,cAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,SAAS,kBAAkB,yBAAyB,MAAM,MAAM,GACpE,IAAI,OAAO;CAEb,MAAM,aAAa,OAAO,cAAc,SAAS,MAAM,QAAQ,IAAI;CAEnE,IACE,eAAe,KAAA,KACf,cAAc,OAAO,WAAW,WAAW,MAAM,MAAM,cAAc,OAAO,MAAM,GAElF,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,kBAAkB,UAAU;CAElC,MAAM,qBAAqB;EACzB,QAAQ,kBAAkB,yBAAyB,MAAM;EACzD,cAAc,QAAQ,YAAY,OAAO,KAAK,OAAO;EACrD,GAAI,QAAQ,SAAS,WAAW,EAAE,gBAAgB,IAAI,CAAC;CACzD;CAEA,WAAW,QAAQ,YAAY,QAAQ,UAAU,MAAM,EAAE;CACzD,KAAK,MAAM,SAAS,QAAQ,YAAY,UAAU,CAAC,GAAG;EACpD,MAAM,SAAS,OAAO,MAAM,KAAK,MAAM,OAAO,MAAM,UAAU,YAAY,CAAC,GAAG;GAC5E,SAAS,IAAI,MAAM,OAAO,MAAM,OAAO;GACvC,eAAe;EACjB,CAAC;EAED,UAAU,OAAO,KAAK,SAAS,CAAC;CAClC;CACA,MAAM,QAAQ,OAAO,UAAU,QAAQ,WAAW,OAAO,QAAQ;CACjE,MAAM,YAAY,OAAO,cAAc,SAAS,MAAM,MAAM;CAE5D,IACE,cAAc,KAAA,KACd,cAAc,OAAO,UAAU,WAAW,MAAM,MAAM,cAAc,OAAO,MAAM,GAEjF,OAAO,EAAE,MAAM,WAAW;CAE5B,MAAM,IAAI,QAAQ,SAChB,IAAI,QAAQ,QACZ,IAAI,QAAQ,UAAU;CAExB,MAAM,aAAa;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,YAAY,MAAM;CAAU;CAC9E,MAAM,UAAU,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,UAAU,GAAG,EAAE,OAAO,EAAE,CAAC;CACnF,MAAM,WAAW,QAAQ,KAAK;CAE9B,IAAI,aAAa,KAAA,GAAW;EAC1B,IACE,SAAS,EAAE,eAAe,OAAO,aACjC,SAAS,EAAE,iBAAiB,MAAM,OAClC,SAAS,EAAE,iBAAiB,KAAK,eACjC,SAAS,EAAE,oBAAoB,cAAc,OAAO,MAAM,KAC1D,SAAS,EAAE,yBAAyB,KAAK,SAEzC,OAAO,EAAE,MAAM,WAAW;EAC5B,UACE,QAAQ,YAAY,OAClB,QAAQ,YAAY,OAAO,SAAS,EAAE,oBAAoB,CAC5D,MAAM,KAAK,OACb;EACA,MAAM,MAAM,gBAAgB,OAAO,SAAS,EAAE,SAAS;EAEvD,UAAU,UAAU,WAAW,YAAY,SAAS,IAAI,IAAI;EAE5D,OAAO,IAAI,SAAS,gBAAgB,IAAI,SAAS,wBAC7C;GAAE,GAAG;GAAK,UAAU;EAAK,IACzB;CACN;CACA,IAAI,UAAU,WAAW,YAAY,SAAS,aAAa,MAAM,IAAI,EAAE,WAAW,WAChF,OAAO,EAAE,MAAM,WAAW;CAC5B,IAAI,KAAK,gBAAgB,MAAM,aAAa,OAAO,EAAE,MAAM,WAAW;CAEtE,MAAM,WACJ,KAAK,aAAa,OAAO,MAAM,MAAM,QAAQ,YAAY,UAAU,YAAY,CAAC,CAAC;CAEnF,IAAI;CAEJ,IAAI,CAAC,UAAU,WAAW,EAAE,MAAM,WAAW;MACxC,IAAI,QAAQ,SAAS,WAAW;EACnC,UAAU,UAAU,qBAAqB,KAAA,CAAS;EAElD,MAAM,cAAc,mBAAmB,OAAO;GAC5C,UAAU,EAAE;GACZ,WAAW,OAAO;GAClB,WAAW,MAAM;GACjB,aAAa,KAAK;GAClB,sBAAsB,UAAU;EAClC,CAAC;EAED,OAAO,MAAM,OACX,EAAE,OACF,GAAG,EAAE,cAAc,MAAM,IAAI,GAC7B;IACG,EAAE,QAAQ;IACV,EAAE,UAAU,MAAM;IAClB,EAAE,cAAc;EACnB,CACF;EACA,WAAW;GACT,MAAM;GACN,WAAW,UAAU;GACrB,UAAU;EACZ;CACF,OAAO;EACL,UAAU,UAAU,iBAAiB,KAAA,KAAa,UAAU,aAAa,KAAA,CAAS;EAElF,MAAM,IAAI,QAAQ,SAChB,KAAK,QAAQ,YACb,IAAI,QAAQ;EAEd,MAAM,gBAAgB;GACpB,GAAG,QAAQ,oBAAoB,YAAY,GAAG;IAC5C,WAAW;IACX,kBAAkB,UAAU;GAC9B,CAAC;IACA,EAAE,KAAK;IACP,EAAE,mBAAmB,UAAU;EAClC;EAEA,OAAO,MAAM,OAAO,EAAE,OAAO,eAAe,GAAG,EAAE,KAAK,gBAAgB,CAAC;EAEvE,MAAM,mBAAmB;GACvB,GAAG,GAAG,aAAa;IACjB,UAAU,EAAE;IACZ,WAAW;IACX,aAAa,MAAM;IACnB,cAAc,UAAU;IACxB,oBAAoB,UAAU;GAChC,CAAC;IACA,GAAG,WAAW,EAAE;IAChB,GAAG,YAAY;IACf,GAAG,cAAc,MAAM;IACvB,GAAG,eAAe,UAAU;IAC5B,GAAG,qBAAqB,UAAU;EACrC;EAEA,UACE,GAAG,eAAe,iBAAiB,GAAG,OAAO,KAC3C,EAAE,eAAe,cAAc,EAAE,OAAO,CAC5C;EACA,OAAO,MAAM,OAAO,GAAG,OAAO,kBAAkB,GAC7C,GAAG,eAAe,UAAU,aAC/B,CAAC;EAED,MAAM,kBAAkB;GACtB,GAAG,EAAE,aAAa;IAChB,WAAW;IACX,cAAc,UAAU;IACxB,UAAU,UAAU;GACtB,CAAC;IACA,EAAE,YAAY;IACd,EAAE,eAAe,UAAU;IAC3B,EAAE,WAAW,UAAU;EAC1B;EAEA,UAAU,EAAE,eAAe,gBAAgB,EAAE,OAAO,CAAC;EACrD,OAAO,MAAM,OAAO,EAAE,OAAO,iBAAiB;IAC3C,EAAE,YAAY;IACd,EAAE,eAAe,UAAU;EAC9B,CAAC;EACD,OAAO,aAAa,QAAQ,WAAW,OAAO,UAAU,MAAM,KAAK,eAAe;EAClF,MAAM,eAAe,KACnB,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAC1C,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,eAAe,GACtC,EAAE,eACJ,EAAE,IACF,GAAG,wBAAwB,GAAG,MAAM,SAAS,KAAK,GAAG,IAAI,GAAG,OAAO,GAAG,YAAY,GAAG,UAAU,YAAY,GAAG,GAAG,eAAe,EAAE,IAClI,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAC1C,GAAG,IAAI,EAAE,OAAO,EAAE,YAAY,GAAG,UAAU,YAAY,GACvD,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,eAAe,GAC7C,EAAE,eACJ,EAAE,EACJ;EACA,WAAW;GAAE,MAAM;GAAc,UAAU;EAAM;CACnD;CACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,UAAU,OAAO,cAAc,QAAQ,eAAe,KAAK,QAAQ,mBAAmB,IAAM;CAE5F,MAAM,SAAS;EACb,GAAG,EAAE,aAAa;GAChB,QAAQ,kBAAkB,yBAAyB,MAAM;GACzD,WAAW,MAAM;GACjB,aAAa,KAAK;GAClB,cAAc,QAAQ,YAAY,OAAO,KAAK,OAAO;GACrD,sBAAsB,UAAU;EAClC,CAAC;EACD,GAAG;GACF,EAAE,YAAY,OAAO;GACrB,EAAE,cAAc,MAAM;GACtB,EAAE,cAAc,KAAK;GACrB,EAAE,iBAAiB,cAAc,OAAO,MAAM;GAC9C,EAAE,sBAAsB,KAAK;GAC7B,EAAE,uBAAuB,UAAU;GACnC,EAAE,WAAW,gBAAgB,OAAO,QAAQ;GAC5C,EAAE,iBAAiB,QAAQ,MAAM,cAChC,KAAK,IAAI,OAAO,sBAAsB,MAAM,QAAQ,eAAe,CACrE;CACF;CAIA,QAAQ,QAAO,OAFS,MAAM,OAAO,EAAE,OAAO,QAAQ,UAAU,EAAA,CAExC;CACxB,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,YAAY,OAAO;CAAU,GAC5D;GACG,EAAE,QAAQ,SAAS;GACnB,EAAE,YAAY,MAAM;GACpB,EAAE,cAAc,KAAK;GACrB,EAAE,UAAU,MAAM;GAClB,EAAE,mBAAmB,SAAS,SAAS,wBAAwB,SAAS,YAAY;CACvF,CACF;CACA,IAAI,UAAU,MAAM,eAAe,KAAK,QAAQ,YAAY,cAAc,YAAY,CAAC,CAAC;CAExF,OAAO;AACT,CAAC,CACH"}
+{"version":3,"file":"oauth-registration.mjs","names":[],"sources":["../../src/drizzle/oauth-registration.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- private owner kernel preserves Registration at the exported constructor. */\nimport { eq, sql } from \"drizzle-orm\";\nimport { Effect, Schema } from \"effect\";\n\nimport {\n  OAuthRegistrationAccess,\n  OAuthRegistrationDecision,\n  OAuthRegistrationFingerprint,\n  OAuthRegistrationInspection,\n  OAuthRegistrationIntent,\n} from \"../oauth/registrationModels\";\nimport {\n  OAuthCredentialSnapshot,\n  OAuthDisplayProfile,\n  OAuthSignInTransactionContext,\n  type OAuthExternalIdentity,\n} from \"../oauth/signInModels\";\nimport { snapshotOAuthSync } from \"../oauth/signInSnapshot\";\nimport type { SecurityRevision } from \"../sessions/models\";\nimport type { DrizzleMappingError, SubjectIdCodec } from \"./model\";\nimport { discoverOwned, exactClaim, resolveOwned, terminalFlow } from \"./oauth-flow\";\nimport type { OAuthRegistrationBase } from \"./oauth-model\";\nimport { both, col, equal, matchesNativeRow, CurrentOAuthTransaction } from \"./oauth-owner\";\nimport { invariant, oauthIdentityKey, sameIdentity, storage } from \"./oauth-state\";\n\nexport const intentStorage = storage(OAuthRegistrationIntent);\nconst decisionStorage = storage(OAuthRegistrationDecision);\nconst contextStorage = storage(OAuthSignInTransactionContext);\nconst profileStorage = storage(Schema.NullOr(OAuthDisplayProfile));\n\nconst reservationStorage = storage(\n  Schema.Struct({\n    moduleId: Schema.String,\n    reference: Schema.String,\n    commandId: Schema.String,\n    fingerprint: Schema.String,\n    provisioningIdentity: Schema.String,\n  }),\n);\n\nexport const readTuple = (ownership: any, identity: typeof OAuthExternalIdentity.Type) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const t = ownership.tuple,\n        key = oauthIdentityKey(identity);\n\n      const where = { [t.identityKey]: key };\n      const observed = yield* owner.read(t.table, equal(t.table, where), { limit: 1 });\n\n      if (observed.rows.length === 0) {\n        const values = {\n          ...t.encodeInsert({ identityKey: key, identity }),\n          ...where,\n          [t.provider]: identity.provider,\n          [t.issuer]: identity.issuer,\n          [t.externalSubject]: identity.subject,\n          [t.state]: \"Unowned\",\n          [t.version]: owner.marker,\n          [t.subjectId]: null,\n          [t.reservation]: null,\n        };\n\n        const inserted = yield* owner.insert(t.table, values, where, true);\n\n        observed.rows = inserted.rows;\n      }\n      const row = observed.rows[0]!;\n\n      invariant(\n        row[t.provider] === identity.provider &&\n          row[t.issuer] === identity.issuer &&\n          row[t.externalSubject] === identity.subject &&\n          [\"Unowned\", \"Reserved\", \"Owned\"].includes(row[t.state]),\n      );\n      invariant(\n        row[t.state] === \"Owned\"\n          ? row[t.subjectId] !== null\n          : row[t.subjectId] === null &&\n              (row[t.state] === \"Reserved\"\n                ? typeof row[t.reservation] === \"string\"\n                : row[t.reservation] === null),\n      );\n      if (ownership.mode === \"separate\") {\n        const o = ownership.external;\n\n        const external = yield* owner.read(o.table, equal(o.table, { [o.identityKey]: key }), {\n          limit: 1,\n        });\n\n        if (row[t.state] === \"Owned\") {\n          const linked = external.rows[0];\n\n          invariant(\n            linked !== undefined &&\n              linked[o.provider] === identity.provider &&\n              linked[o.issuer] === identity.issuer &&\n              linked[o.externalSubject] === identity.subject &&\n              matchesNativeRow(o.table, linked, { [o.subjectId]: row[t.subjectId] }),\n          );\n          const owned = sql`exists(select 1 from ${o.table} where ${both(equal(o.table, { [o.identityKey]: key }), o.ownedCondition)})`;\n\n          invariant(yield* owner.check(owned));\n          owner.postconditions.push(owned);\n        } else invariant(external.rows.length === 0);\n      }\n\n      return { observed, row, key };\n    }),\n  );\n\nexport const acquireTuple = (\n  ownership: any,\n  identity: typeof OAuthExternalIdentity.Type,\n  key: string,\n  subjectId: unknown,\n) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const t = ownership.tuple;\n\n      yield* owner.update(\n        t.table,\n        { [t.identityKey]: key },\n        {\n          [t.state]: \"Owned\",\n          [t.subjectId]: subjectId,\n          [t.reservation]: null,\n          [t.version]: owner.marker,\n        },\n      );\n      if (ownership.mode === \"separate\") {\n        const o = ownership.external;\n\n        const values = {\n          ...o.encodeInsert({ identity, identityKey: key, subjectId }),\n          [o.identityKey]: key,\n          [o.provider]: identity.provider,\n          [o.issuer]: identity.issuer,\n          [o.externalSubject]: identity.subject,\n          [o.subjectId]: subjectId,\n        };\n\n        yield* owner.insert(o.table, values, { [o.identityKey]: key });\n      }\n    }),\n  );\n\nexport const settleRegistrationIntent = (mapping: any, input: any) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const identity = input.identity.identity,\n        context = input.claim.flow.context;\n\n      invariant(identity.provider === context.provider && identity.issuer === context.issuer);\n      const found = yield* discoverOwned(mapping.signIn, identity);\n      const tuple = found.owned ? undefined : yield* readTuple(mapping.ownership, identity);\n      const exact = yield* exactClaim(mapping.signIn, input.claim, \"sign-in\");\n\n      if (exact === undefined) return { _tag: \"Rejected\" } as const;\n      const credential = resolveOwned(mapping.signIn, context.moduleId, identity, found);\n\n      if (credential !== undefined) {\n        yield* terminalFlow(mapping.signIn, input.claim.flow, \"Verified\");\n\n        return { _tag: \"Verified\", credential } as const;\n      }\n      let decision: any = { _tag: \"Rejected\" };\n\n      if (\n        !found.owned &&\n        tuple?.row[mapping.ownership.tuple.state] === \"Unowned\" &&\n        input.intent !== undefined\n      ) {\n        const intent = snapshotOAuthSync(OAuthRegistrationIntent, input.intent);\n        const c = intent.context;\n\n        invariant(\n          sameIdentity(intent.identity, identity) &&\n            profileStorage.encode(intent.profile ?? null) ===\n              profileStorage.encode(input.identity.profile ?? null) &&\n            intent.claimId === input.claim.claimId &&\n            intent.claimedAtMillis === input.claim.claimedAtMillis &&\n            contextStorage.encode(c) === contextStorage.encode(context),\n        );\n\n        const allowed =\n          intent.issuedAtMillis >= intent.claimedAtMillis &&\n          intent.verifiedAtMillis <= intent.issuedAtMillis &&\n          intent.issuedAtMillis <= exact.now &&\n          exact.now < intent.expiresAtMillis &&\n          intent.expiresAtMillis <= c.requestBindingExpiresAtMillis &&\n          intent.retentionUntilMillis >= intent.expiresAtMillis &&\n          (yield* owner.check(mapping.eligibility.condition({ intent })));\n\n        if (allowed) {\n          const i = mapping.intent,\n            encode = mapping.signIn.clock.encodeInstant;\n\n          const key = { [i.moduleId]: c.moduleId, [i.reference]: intent.reference };\n\n          const values = {\n            ...i.encodeInsert(snapshotOAuthSync(OAuthRegistrationIntent, intent)),\n            ...key,\n            [i.flowId]: c.flowId,\n            [i.claimId]: intent.claimId,\n            [i.identityKey]: tuple.key,\n            [i.version]: owner.marker,\n            [i.state]: \"Unbound\",\n            [i.snapshot]: intentStorage.encode(intent),\n            [i.commandId]: null,\n            [i.fingerprint]: null,\n            [i.pendingReference]: null,\n            [i.expiresAt]: encode(intent.expiresAtMillis),\n            [i.retentionUntil]: encode(intent.retentionUntilMillis),\n          };\n\n          yield* owner.insert(i.table, values, key);\n          owner.postconditions.push(\n            mapping.eligibility.condition({ intent }),\n            sql`${mapping.signIn.clock.engineNowMillis} >= ${intent.issuedAtMillis} and\n            ${mapping.signIn.clock.engineNowMillis} < ${intent.expiresAtMillis}`,\n          );\n          decision = { _tag: \"RegistrationIssued\", intent };\n        }\n      }\n      yield* terminalFlow(mapping.signIn, input.claim.flow, decision._tag);\n\n      return decision;\n    }),\n  );\n\nexport const inspectIntent = (\n  mapping: any,\n  original: typeof OAuthRegistrationAccess.Type,\n  discovery = false,\n) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const access = snapshotOAuthSync(OAuthRegistrationAccess, original),\n        i = mapping.intent;\n\n      const observed = yield* owner.read(\n        i.table,\n        equal(i.table, {\n          [i.moduleId]: access.moduleId,\n          [i.reference]: access.reference,\n        }),\n        { limit: 1, ...(discovery ? { lock: false, observe: false } : {}) },\n      );\n\n      const row = observed.rows[0];\n\n      if (row === undefined) return undefined;\n\n      const intent = intentStorage.decode(row[i.snapshot]),\n        c = intent.context,\n        now = yield* owner.now(mapping.clock);\n\n      invariant(\n        row[i.moduleId] === c.moduleId &&\n          row[i.reference] === intent.reference &&\n          row[i.flowId] === c.flowId &&\n          row[i.claimId] === intent.claimId &&\n          row[i.identityKey] === oauthIdentityKey(intent.identity) &&\n          mapping.clock.decodeInstant(row[i.expiresAt]) === intent.expiresAtMillis &&\n          mapping.clock.decodeInstant(row[i.retentionUntil]) === intent.retentionUntilMillis,\n      );\n      if (\n        access.moduleId !== c.moduleId ||\n        access.reference !== intent.reference ||\n        access.flowId !== c.flowId ||\n        access.requestBindingVerifier !== c.requestBindingVerifier ||\n        access.requestBindingExpiresAtMillis !== c.requestBindingExpiresAtMillis ||\n        access.credentialDigest !== intent.credentialDigest ||\n        now < intent.issuedAtMillis ||\n        now >= intent.expiresAtMillis\n      )\n        return undefined;\n      let application: any;\n\n      if (row[i.state] === \"Unbound\") {\n        invariant(\n          row[i.commandId] === null &&\n            row[i.fingerprint] === null &&\n            row[i.pendingReference] === null,\n        );\n        application = { _tag: \"Unbound\" };\n      } else {\n        application = {\n          _tag: row[i.state],\n          commandId: row[i.commandId],\n          fingerprint: row[i.fingerprint],\n          ...(row[i.state] === \"ProvisioningPending\" ? { reference: row[i.pendingReference] } : {}),\n        };\n      }\n      const inspection = snapshotOAuthSync(OAuthRegistrationInspection, { intent, application });\n\n      owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${intent.issuedAtMillis} and\n      ${mapping.clock.engineNowMillis} < ${intent.expiresAtMillis}`);\n\n      return { observed, row, inspection };\n    }),\n  );\n\nexport interface RegistrationResources {\n  readonly provisioningIdentity: string;\n  readonly pendingReference?: string;\n  readonly subjectId?: unknown;\n  readonly credentialId?: string;\n  readonly revision?: string;\n}\n\n/** Public mapping callbacks are closed Effects; erasing native row shapes must\n * not erase their error or requirements channels. */\nexport type RegistrationCallbacks<Registration> = Pick<\n  OAuthRegistrationBase<Registration, any, any, any, any, unknown>,\n  \"snapshot\" | \"snapshotSync\" | \"inspect\" | \"inspectSync\"\n>;\n\nexport const registrationResources = (mapping: any) =>\n  Effect.gen(function* () {\n    const provisioningIdentity = yield* mapping.allocateProvisioningIdentity as Effect.Effect<\n      string,\n      DrizzleMappingError\n    >;\n\n    invariant(\n      typeof provisioningIdentity === \"string\" &&\n        provisioningIdentity.length > 0 &&\n        provisioningIdentity.length <= 256,\n    );\n    if (mapping.mode === \"pending\") {\n      const pendingReference = yield* mapping.allocatePendingReference as Effect.Effect<\n        string,\n        DrizzleMappingError\n      >;\n\n      invariant(\n        typeof pendingReference === \"string\" &&\n          pendingReference.length > 0 &&\n          pendingReference.length <= 256,\n      );\n\n      return { provisioningIdentity, pendingReference } as RegistrationResources;\n    }\n\n    const subjectId = yield* mapping.allocateSubjectId as Effect.Effect<\n      unknown,\n      DrizzleMappingError\n    >;\n\n    const publicId = yield* (mapping.subjectId as SubjectIdCodec<unknown>).toSubject(subjectId);\n\n    invariant(\n      mapping.subjectId.equals(\n        subjectId,\n        yield* (mapping.subjectId as SubjectIdCodec<unknown>).toNative(publicId),\n      ),\n    );\n\n    const credentialId = snapshotOAuthSync(\n      OAuthCredentialSnapshot.fields.credentialId,\n      yield* mapping.allocateCredentialId as Effect.Effect<string, DrizzleMappingError>,\n    );\n\n    const revision = snapshotOAuthSync(\n      OAuthCredentialSnapshot.fields.credentialRevision,\n      yield* mapping.allocateRevision as Effect.Effect<SecurityRevision, DrizzleMappingError>,\n    );\n\n    return { provisioningIdentity, subjectId, credentialId, revision } as RegistrationResources;\n  });\n\nexport const registrationData = <Registration>(\n  mapping: any,\n  input: {\n    readonly intent: OAuthRegistrationIntent;\n    readonly registration: Registration;\n    readonly fingerprint: string;\n  },\n  bound: boolean,\n) =>\n  Effect.gen(function* () {\n    const snapshot = bound\n      ? (invariant(mapping.snapshotSync !== undefined), mapping.snapshotSync(input.registration))\n      : yield* (mapping as RegistrationCallbacks<Registration>).snapshot(input.registration);\n\n    const encoded = mapping.application.encode(snapshot);\n\n    invariant(typeof encoded === \"string\" && new TextEncoder().encode(encoded).length <= 1048576);\n    const detached = mapping.application.decode(encoded);\n\n    invariant(mapping.application.encode(detached) === encoded);\n\n    const checked = bound\n      ? (invariant(mapping.inspectSync !== undefined),\n        mapping.inspectSync({\n          intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent),\n          registration: mapping.application.decode(encoded),\n        }))\n      : yield* (mapping as RegistrationCallbacks<Registration>).inspect({\n          intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent),\n          registration: mapping.application.decode(encoded),\n        });\n\n    const fingerprint = snapshotOAuthSync(OAuthRegistrationFingerprint, checked.fingerprint);\n\n    invariant(typeof checked.eligible === \"boolean\");\n\n    return {\n      encoded,\n      registration: detached as Registration,\n      fingerprint,\n      eligible: checked.eligible && fingerprint === input.fingerprint,\n    };\n  });\n\nexport const register = (\n  mapping: any,\n  input: any,\n  data: { readonly encoded: string; readonly fingerprint: string; readonly eligible: boolean },\n  resources: RegistrationResources,\n) =>\n  Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n    Effect.gen(function* () {\n      const intent = snapshotOAuthSync(OAuthRegistrationIntent, input.intent),\n        c = intent.context;\n\n      const discovered = yield* inspectIntent(mapping, input.access, true);\n\n      if (\n        discovered === undefined ||\n        intentStorage.encode(discovered.inspection.intent) !== intentStorage.encode(intent)\n      )\n        return { _tag: \"Rejected\" } as const;\n      const nativeSubjectId = resources.subjectId;\n\n      const policyInput = () => ({\n        intent: snapshotOAuthSync(OAuthRegistrationIntent, intent),\n        registration: mapping.application.decode(data.encoded),\n        ...(mapping.mode === \"atomic\" ? { nativeSubjectId } : {}),\n      });\n\n      invariant((mapping.eligibility.guards?.length ?? 0) <= 32);\n      for (const guard of mapping.eligibility.guards ?? []) {\n        const locked = yield* owner.read(guard.table, guard.condition(policyInput()), {\n          orderBy: col(guard.table, guard.orderBy),\n          admissionOnly: true,\n        });\n\n        invariant(locked.rows.length > 0);\n      }\n      const tuple = yield* readTuple(mapping.ownership, intent.identity);\n      const inspected = yield* inspectIntent(mapping, input.access);\n\n      if (\n        inspected === undefined ||\n        intentStorage.encode(inspected.inspection.intent) !== intentStorage.encode(intent)\n      )\n        return { _tag: \"Rejected\" } as const;\n\n      const r = mapping.command,\n        i = mapping.intent,\n        t = mapping.ownership.tuple;\n\n      const commandKey = { [r.moduleId]: c.moduleId, [r.commandId]: input.commandId };\n      const command = yield* owner.read(r.table, equal(r.table, commandKey), { limit: 1 });\n      const previous = command.rows[0];\n\n      if (previous !== undefined) {\n        if (\n          previous[r.reference] !== intent.reference ||\n          previous[r.identityKey] !== tuple.key ||\n          previous[r.fingerprint] !== data.fingerprint ||\n          previous[r.intentSnapshot] !== intentStorage.encode(intent) ||\n          previous[r.applicationSnapshot] !== data.encoded\n        )\n          return { _tag: \"Conflict\" } as const;\n        invariant(\n          mapping.application.encode(\n            mapping.application.decode(previous[r.applicationSnapshot]),\n          ) === data.encoded,\n        );\n        const old = decisionStorage.decode(previous[r.decision]);\n\n        invariant(inspected.inspection.application._tag === old._tag);\n\n        return old._tag === \"Registered\" || old._tag === \"ProvisioningPending\"\n          ? { ...old, replayed: true }\n          : old;\n      }\n      if (inspected.inspection.application._tag !== \"Unbound\" || tuple.row[t.state] !== \"Unowned\")\n        return { _tag: \"Conflict\" } as const;\n      if (data.fingerprint !== input.fingerprint) return { _tag: \"Rejected\" } as const;\n\n      const admitted =\n        data.eligible && (yield* owner.check(mapping.eligibility.admission(policyInput())));\n\n      let decision: typeof OAuthRegistrationDecision.Type;\n\n      if (!admitted) decision = { _tag: \"Rejected\" };\n      else if (mapping.mode === \"pending\") {\n        invariant(resources.pendingReference !== undefined);\n\n        const reservation = reservationStorage.encode({\n          moduleId: c.moduleId,\n          reference: intent.reference,\n          commandId: input.commandId,\n          fingerprint: data.fingerprint,\n          provisioningIdentity: resources.provisioningIdentity,\n        });\n\n        yield* owner.update(\n          t.table,\n          { [t.identityKey]: tuple.key },\n          {\n            [t.state]: \"Reserved\",\n            [t.version]: owner.marker,\n            [t.reservation]: reservation,\n          },\n        );\n        decision = {\n          _tag: \"ProvisioningPending\",\n          reference: resources.pendingReference,\n          replayed: false,\n        };\n      } else {\n        invariant(resources.credentialId !== undefined && resources.revision !== undefined);\n\n        const s = mapping.subject,\n          cr = mapping.credential,\n          a = mapping.authority;\n\n        const subjectValues = {\n          ...mapping.encodeSubjectInsert(policyInput(), {\n            subjectId: nativeSubjectId,\n            securityRevision: resources.revision,\n          }),\n          [s.id]: nativeSubjectId,\n          [s.securityRevision]: resources.revision,\n        };\n\n        yield* owner.insert(s.table, subjectValues, { [s.id]: nativeSubjectId });\n\n        const credentialValues = {\n          ...cr.encodeInsert({\n            moduleId: c.moduleId,\n            subjectId: nativeSubjectId,\n            identityKey: tuple.key,\n            credentialId: resources.credentialId,\n            credentialRevision: resources.revision,\n          }),\n          [cr.moduleId]: c.moduleId,\n          [cr.subjectId]: nativeSubjectId,\n          [cr.identityKey]: tuple.key,\n          [cr.credentialId]: resources.credentialId,\n          [cr.credentialRevision]: resources.revision,\n        };\n\n        invariant(\n          cr.isActiveStatus(credentialValues[cr.status]) &&\n            s.isActiveStatus(subjectValues[s.status]),\n        );\n        yield* owner.insert(cr.table, credentialValues, {\n          [cr.credentialId]: resources.credentialId,\n        });\n\n        const authorityValues = {\n          ...a.encodeInsert({\n            subjectId: nativeSubjectId,\n            credentialId: resources.credentialId,\n            revision: resources.revision,\n          }),\n          [a.subjectId]: nativeSubjectId,\n          [a.credentialId]: resources.credentialId,\n          [a.revision]: resources.revision,\n        };\n\n        invariant(a.isActiveStatus(authorityValues[a.status]));\n        yield* owner.insert(a.table, authorityValues, {\n          [a.subjectId]: nativeSubjectId,\n          [a.credentialId]: resources.credentialId,\n        });\n        yield* acquireTuple(mapping.ownership, intent.identity, tuple.key, nativeSubjectId);\n        owner.postconditions.push(\n          sql`exists(select 1 from ${s.table} where ${both(\n            eq(col(s.table, s.id), nativeSubjectId),\n            s.activeCondition,\n          )})`,\n          sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.credentialId), resources.credentialId), cr.activeCondition)})`,\n          sql`exists(select 1 from ${a.table} where ${both(\n            eq(col(a.table, a.credentialId), resources.credentialId),\n            eq(col(a.table, a.subjectId), nativeSubjectId),\n            a.activeCondition,\n          )})`,\n        );\n        decision = { _tag: \"Registered\", replayed: false };\n      }\n      const now = yield* owner.now(mapping.clock);\n\n      invariant(Number.isSafeInteger(mapping.retentionMillis) && mapping.retentionMillis >= 120000);\n\n      const values = {\n        ...r.encodeInsert({\n          intent: snapshotOAuthSync(OAuthRegistrationIntent, intent),\n          commandId: input.commandId,\n          fingerprint: data.fingerprint,\n          registration: mapping.application.decode(data.encoded),\n          provisioningIdentity: resources.provisioningIdentity,\n        }),\n        ...commandKey,\n        [r.reference]: intent.reference,\n        [r.identityKey]: tuple.key,\n        [r.fingerprint]: data.fingerprint,\n        [r.intentSnapshot]: intentStorage.encode(intent),\n        [r.applicationSnapshot]: data.encoded,\n        [r.provisioningIdentity]: resources.provisioningIdentity,\n        [r.decision]: decisionStorage.encode(decision),\n        [r.retentionUntil]: mapping.clock.encodeInstant(\n          Math.max(intent.retentionUntilMillis, now + mapping.retentionMillis),\n        ),\n      };\n\n      const inserted = yield* owner.insert(r.table, values, commandKey);\n\n      command.rows = inserted.rows;\n      yield* owner.update(\n        i.table,\n        { [i.moduleId]: c.moduleId, [i.reference]: intent.reference },\n        {\n          [i.state]: decision._tag,\n          [i.commandId]: input.commandId,\n          [i.fingerprint]: data.fingerprint,\n          [i.version]: owner.marker,\n          [i.pendingReference]: decision._tag === \"ProvisioningPending\" ? decision.reference : null,\n        },\n      );\n      if (admitted) owner.postconditions.push(mapping.eligibility.postcondition(policyInput()));\n\n      return decision;\n    }),\n  );\n"],"mappings":";;;;;;;;;;AAyBA,MAAa,gBAAgB,QAAQ,uBAAuB;AAC5D,MAAM,kBAAkB,QAAQ,yBAAyB;AACzD,MAAM,iBAAiB,QAAQ,6BAA6B;AAC5D,MAAM,iBAAiB,QAAQ,OAAO,OAAO,mBAAmB,CAAC;AAEjE,MAAM,qBAAqB,QACzB,OAAO,OAAO;CACZ,UAAU,OAAO;CACjB,WAAW,OAAO;CAClB,WAAW,OAAO;CAClB,aAAa,OAAO;CACpB,sBAAsB,OAAO;AAC/B,CAAC,CACH;AAEA,MAAa,aAAa,WAAgB,aACxC,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,IAAI,UAAU,OAClB,MAAM,iBAAiB,QAAQ;CAEjC,MAAM,QAAQ,GAAG,EAAE,cAAc,IAAI;CACrC,MAAM,WAAW,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC;CAE/E,IAAI,SAAS,KAAK,WAAW,GAAG;EAC9B,MAAM,SAAS;GACb,GAAG,EAAE,aAAa;IAAE,aAAa;IAAK;GAAS,CAAC;GAChD,GAAG;IACF,EAAE,WAAW,SAAS;IACtB,EAAE,SAAS,SAAS;IACpB,EAAE,kBAAkB,SAAS;IAC7B,EAAE,QAAQ;IACV,EAAE,UAAU,MAAM;IAClB,EAAE,YAAY;IACd,EAAE,cAAc;EACnB;EAIA,SAAS,QAAO,OAFQ,MAAM,OAAO,EAAE,OAAO,QAAQ,OAAO,IAAI,EAAA,CAExC;CAC3B;CACA,MAAM,MAAM,SAAS,KAAK;CAE1B,UACE,IAAI,EAAE,cAAc,SAAS,YAC3B,IAAI,EAAE,YAAY,SAAS,UAC3B,IAAI,EAAE,qBAAqB,SAAS,WACpC;EAAC;EAAW;EAAY;CAAO,CAAC,CAAC,SAAS,IAAI,EAAE,MAAM,CAC1D;CACA,UACE,IAAI,EAAE,WAAW,UACb,IAAI,EAAE,eAAe,OACrB,IAAI,EAAE,eAAe,SAClB,IAAI,EAAE,WAAW,aACd,OAAO,IAAI,EAAE,iBAAiB,WAC9B,IAAI,EAAE,iBAAiB,KACnC;CACA,IAAI,UAAU,SAAS,YAAY;EACjC,MAAM,IAAI,UAAU;EAEpB,MAAM,WAAW,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,cAAc,IAAI,CAAC,GAAG,EACpF,OAAO,EACT,CAAC;EAED,IAAI,IAAI,EAAE,WAAW,SAAS;GAC5B,MAAM,SAAS,SAAS,KAAK;GAE7B,UACE,WAAW,KAAA,KACT,OAAO,EAAE,cAAc,SAAS,YAChC,OAAO,EAAE,YAAY,SAAS,UAC9B,OAAO,EAAE,qBAAqB,SAAS,WACvC,iBAAiB,EAAE,OAAO,QAAQ,GAAG,EAAE,YAAY,IAAI,EAAE,WAAW,CAAC,CACzE;GACA,MAAM,QAAQ,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,MAAM,EAAE,OAAO,GAAG,EAAE,cAAc,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE;GAE3H,UAAU,OAAO,MAAM,MAAM,KAAK,CAAC;GACnC,MAAM,eAAe,KAAK,KAAK;EACjC,OAAO,UAAU,SAAS,KAAK,WAAW,CAAC;CAC7C;CAEA,OAAO;EAAE;EAAU;EAAK;CAAI;AAC9B,CAAC,CACH;AAEF,MAAa,gBACX,WACA,UACA,KACA,cAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,IAAI,UAAU;CAEpB,OAAO,MAAM,OACX,EAAE,OACF,GAAG,EAAE,cAAc,IAAI,GACvB;GACG,EAAE,QAAQ;GACV,EAAE,YAAY;GACd,EAAE,cAAc;GAChB,EAAE,UAAU,MAAM;CACrB,CACF;CACA,IAAI,UAAU,SAAS,YAAY;EACjC,MAAM,IAAI,UAAU;EAEpB,MAAM,SAAS;GACb,GAAG,EAAE,aAAa;IAAE;IAAU,aAAa;IAAK;GAAU,CAAC;IAC1D,EAAE,cAAc;IAChB,EAAE,WAAW,SAAS;IACtB,EAAE,SAAS,SAAS;IACpB,EAAE,kBAAkB,SAAS;IAC7B,EAAE,YAAY;EACjB;EAEA,OAAO,MAAM,OAAO,EAAE,OAAO,QAAQ,GAAG,EAAE,cAAc,IAAI,CAAC;CAC/D;AACF,CAAC,CACH;AAEF,MAAa,4BAA4B,SAAc,UACrD,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,MAAM,SAAS,UAC9B,UAAU,MAAM,MAAM,KAAK;CAE7B,UAAU,SAAS,aAAa,QAAQ,YAAY,SAAS,WAAW,QAAQ,MAAM;CACtF,MAAM,QAAQ,OAAO,cAAc,QAAQ,QAAQ,QAAQ;CAC3D,MAAM,QAAQ,MAAM,QAAQ,KAAA,IAAY,OAAO,UAAU,QAAQ,WAAW,QAAQ;CACpF,MAAM,QAAQ,OAAO,WAAW,QAAQ,QAAQ,MAAM,OAAO,SAAS;CAEtE,IAAI,UAAU,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CACnD,MAAM,aAAa,aAAa,QAAQ,QAAQ,QAAQ,UAAU,UAAU,KAAK;CAEjF,IAAI,eAAe,KAAA,GAAW;EAC5B,OAAO,aAAa,QAAQ,QAAQ,MAAM,MAAM,MAAM,UAAU;EAEhE,OAAO;GAAE,MAAM;GAAY;EAAW;CACxC;CACA,IAAI,WAAgB,EAAE,MAAM,WAAW;CAEvC,IACE,CAAC,MAAM,SACP,OAAO,IAAI,QAAQ,UAAU,MAAM,WAAW,aAC9C,MAAM,WAAW,KAAA,GACjB;EACA,MAAM,SAAS,kBAAkB,yBAAyB,MAAM,MAAM;EACtE,MAAM,IAAI,OAAO;EAEjB,UACE,aAAa,OAAO,UAAU,QAAQ,KACpC,eAAe,OAAO,OAAO,WAAW,IAAI,MAC1C,eAAe,OAAO,MAAM,SAAS,WAAW,IAAI,KACtD,OAAO,YAAY,MAAM,MAAM,WAC/B,OAAO,oBAAoB,MAAM,MAAM,mBACvC,eAAe,OAAO,CAAC,MAAM,eAAe,OAAO,OAAO,CAC9D;EAWA,IARE,OAAO,kBAAkB,OAAO,mBAChC,OAAO,oBAAoB,OAAO,kBAClC,OAAO,kBAAkB,MAAM,OAC/B,MAAM,MAAM,OAAO,mBACnB,OAAO,mBAAmB,EAAE,iCAC5B,OAAO,wBAAwB,OAAO,oBACrC,OAAO,MAAM,MAAM,QAAQ,YAAY,UAAU,EAAE,OAAO,CAAC,CAAC,IAElD;GACX,MAAM,IAAI,QAAQ,QAChB,SAAS,QAAQ,OAAO,MAAM;GAEhC,MAAM,MAAM;KAAG,EAAE,WAAW,EAAE;KAAW,EAAE,YAAY,OAAO;GAAU;GAExE,MAAM,SAAS;IACb,GAAG,EAAE,aAAa,kBAAkB,yBAAyB,MAAM,CAAC;IACpE,GAAG;KACF,EAAE,SAAS,EAAE;KACb,EAAE,UAAU,OAAO;KACnB,EAAE,cAAc,MAAM;KACtB,EAAE,UAAU,MAAM;KAClB,EAAE,QAAQ;KACV,EAAE,WAAW,cAAc,OAAO,MAAM;KACxC,EAAE,YAAY;KACd,EAAE,cAAc;KAChB,EAAE,mBAAmB;KACrB,EAAE,YAAY,OAAO,OAAO,eAAe;KAC3C,EAAE,iBAAiB,OAAO,OAAO,oBAAoB;GACxD;GAEA,OAAO,MAAM,OAAO,EAAE,OAAO,QAAQ,GAAG;GACxC,MAAM,eAAe,KACnB,QAAQ,YAAY,UAAU,EAAE,OAAO,CAAC,GACxC,GAAG,GAAG,QAAQ,OAAO,MAAM,gBAAgB,MAAM,OAAO,eAAe;cACrE,QAAQ,OAAO,MAAM,gBAAgB,KAAK,OAAO,iBACrD;GACA,WAAW;IAAE,MAAM;IAAsB;GAAO;EAClD;CACF;CACA,OAAO,aAAa,QAAQ,QAAQ,MAAM,MAAM,MAAM,SAAS,IAAI;CAEnE,OAAO;AACT,CAAC,CACH;AAEF,MAAa,iBACX,SACA,UACA,YAAY,UAEZ,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,SAAS,kBAAkB,yBAAyB,QAAQ,GAChE,IAAI,QAAQ;CAEd,MAAM,WAAW,OAAO,MAAM,KAC5B,EAAE,OACF,MAAM,EAAE,OAAO;GACZ,EAAE,WAAW,OAAO;GACpB,EAAE,YAAY,OAAO;CACxB,CAAC,GACD;EAAE,OAAO;EAAG,GAAI,YAAY;GAAE,MAAM;GAAO,SAAS;EAAM,IAAI,CAAC;CAAG,CACpE;CAEA,MAAM,MAAM,SAAS,KAAK;CAE1B,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAE9B,MAAM,SAAS,cAAc,OAAO,IAAI,EAAE,SAAS,GACjD,IAAI,OAAO,SACX,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAEtC,UACE,IAAI,EAAE,cAAc,EAAE,YACpB,IAAI,EAAE,eAAe,OAAO,aAC5B,IAAI,EAAE,YAAY,EAAE,UACpB,IAAI,EAAE,aAAa,OAAO,WAC1B,IAAI,EAAE,iBAAiB,iBAAiB,OAAO,QAAQ,KACvD,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU,MAAM,OAAO,mBACzD,QAAQ,MAAM,cAAc,IAAI,EAAE,eAAe,MAAM,OAAO,oBAClE;CACA,IACE,OAAO,aAAa,EAAE,YACtB,OAAO,cAAc,OAAO,aAC5B,OAAO,WAAW,EAAE,UACpB,OAAO,2BAA2B,EAAE,0BACpC,OAAO,kCAAkC,EAAE,iCAC3C,OAAO,qBAAqB,OAAO,oBACnC,MAAM,OAAO,kBACb,OAAO,OAAO,iBAEd,OAAO,KAAA;CACT,IAAI;CAEJ,IAAI,IAAI,EAAE,WAAW,WAAW;EAC9B,UACE,IAAI,EAAE,eAAe,QACnB,IAAI,EAAE,iBAAiB,QACvB,IAAI,EAAE,sBAAsB,IAChC;EACA,cAAc,EAAE,MAAM,UAAU;CAClC,OACE,cAAc;EACZ,MAAM,IAAI,EAAE;EACZ,WAAW,IAAI,EAAE;EACjB,aAAa,IAAI,EAAE;EACnB,GAAI,IAAI,EAAE,WAAW,wBAAwB,EAAE,WAAW,IAAI,EAAE,kBAAkB,IAAI,CAAC;CACzF;CAEF,MAAM,aAAa,kBAAkB,6BAA6B;EAAE;EAAQ;CAAY,CAAC;CAEzF,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,OAAO,eAAe;QACxF,QAAQ,MAAM,gBAAgB,KAAK,OAAO,iBAAiB;CAE7D,OAAO;EAAE;EAAU;EAAK;CAAW;AACrC,CAAC,CACH;AAiBF,MAAa,yBAAyB,YACpC,OAAO,IAAI,aAAa;CACtB,MAAM,uBAAuB,OAAO,QAAQ;CAK5C,UACE,OAAO,yBAAyB,YAC9B,qBAAqB,SAAS,KAC9B,qBAAqB,UAAU,GACnC;CACA,IAAI,QAAQ,SAAS,WAAW;EAC9B,MAAM,mBAAmB,OAAO,QAAQ;EAKxC,UACE,OAAO,qBAAqB,YAC1B,iBAAiB,SAAS,KAC1B,iBAAiB,UAAU,GAC/B;EAEA,OAAO;GAAE;GAAsB;EAAiB;CAClD;CAEA,MAAM,YAAY,OAAO,QAAQ;CAKjC,MAAM,WAAW,OAAQ,QAAQ,UAAsC,UAAU,SAAS;CAE1F,UACE,QAAQ,UAAU,OAChB,WACA,OAAQ,QAAQ,UAAsC,SAAS,QAAQ,CACzE,CACF;CAYA,OAAO;EAAE;EAAsB;EAAW,cAVrB,kBACnB,wBAAwB,OAAO,cAC/B,OAAO,QAAQ,oBAQoC;EAAG,UALvC,kBACf,wBAAwB,OAAO,oBAC/B,OAAO,QAAQ,gBAG8C;CAAE;AACnE,CAAC;AAEH,MAAa,oBACX,SACA,OAKA,UAEA,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,SACZ,UAAU,QAAQ,iBAAiB,KAAA,CAAS,GAAG,QAAQ,aAAa,MAAM,YAAY,KACvF,OAAQ,QAAgD,SAAS,MAAM,YAAY;CAEvF,MAAM,UAAU,QAAQ,YAAY,OAAO,QAAQ;CAEnD,UAAU,OAAO,YAAY,YAAY,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,UAAU,OAAO;CAC5F,MAAM,WAAW,QAAQ,YAAY,OAAO,OAAO;CAEnD,UAAU,QAAQ,YAAY,OAAO,QAAQ,MAAM,OAAO;CAE1D,MAAM,UAAU,SACX,UAAU,QAAQ,gBAAgB,KAAA,CAAS,GAC5C,QAAQ,YAAY;EAClB,QAAQ,kBAAkB,yBAAyB,MAAM,MAAM;EAC/D,cAAc,QAAQ,YAAY,OAAO,OAAO;CAClD,CAAC,KACD,OAAQ,QAAgD,QAAQ;EAC9D,QAAQ,kBAAkB,yBAAyB,MAAM,MAAM;EAC/D,cAAc,QAAQ,YAAY,OAAO,OAAO;CAClD,CAAC;CAEL,MAAM,cAAc,kBAAkB,8BAA8B,QAAQ,WAAW;CAEvF,UAAU,OAAO,QAAQ,aAAa,SAAS;CAE/C,OAAO;EACL;EACA,cAAc;EACd;EACA,UAAU,QAAQ,YAAY,gBAAgB,MAAM;CACtD;AACF,CAAC;AAEH,MAAa,YACX,SACA,OACA,MACA,cAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;CACtB,MAAM,SAAS,kBAAkB,yBAAyB,MAAM,MAAM,GACpE,IAAI,OAAO;CAEb,MAAM,aAAa,OAAO,cAAc,SAAS,MAAM,QAAQ,IAAI;CAEnE,IACE,eAAe,KAAA,KACf,cAAc,OAAO,WAAW,WAAW,MAAM,MAAM,cAAc,OAAO,MAAM,GAElF,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,kBAAkB,UAAU;CAElC,MAAM,qBAAqB;EACzB,QAAQ,kBAAkB,yBAAyB,MAAM;EACzD,cAAc,QAAQ,YAAY,OAAO,KAAK,OAAO;EACrD,GAAI,QAAQ,SAAS,WAAW,EAAE,gBAAgB,IAAI,CAAC;CACzD;CAEA,WAAW,QAAQ,YAAY,QAAQ,UAAU,MAAM,EAAE;CACzD,KAAK,MAAM,SAAS,QAAQ,YAAY,UAAU,CAAC,GAAG;EACpD,MAAM,SAAS,OAAO,MAAM,KAAK,MAAM,OAAO,MAAM,UAAU,YAAY,CAAC,GAAG;GAC5E,SAAS,IAAI,MAAM,OAAO,MAAM,OAAO;GACvC,eAAe;EACjB,CAAC;EAED,UAAU,OAAO,KAAK,SAAS,CAAC;CAClC;CACA,MAAM,QAAQ,OAAO,UAAU,QAAQ,WAAW,OAAO,QAAQ;CACjE,MAAM,YAAY,OAAO,cAAc,SAAS,MAAM,MAAM;CAE5D,IACE,cAAc,KAAA,KACd,cAAc,OAAO,UAAU,WAAW,MAAM,MAAM,cAAc,OAAO,MAAM,GAEjF,OAAO,EAAE,MAAM,WAAW;CAE5B,MAAM,IAAI,QAAQ,SAChB,IAAI,QAAQ,QACZ,IAAI,QAAQ,UAAU;CAExB,MAAM,aAAa;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,YAAY,MAAM;CAAU;CAC9E,MAAM,UAAU,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,UAAU,GAAG,EAAE,OAAO,EAAE,CAAC;CACnF,MAAM,WAAW,QAAQ,KAAK;CAE9B,IAAI,aAAa,KAAA,GAAW;EAC1B,IACE,SAAS,EAAE,eAAe,OAAO,aACjC,SAAS,EAAE,iBAAiB,MAAM,OAClC,SAAS,EAAE,iBAAiB,KAAK,eACjC,SAAS,EAAE,oBAAoB,cAAc,OAAO,MAAM,KAC1D,SAAS,EAAE,yBAAyB,KAAK,SAEzC,OAAO,EAAE,MAAM,WAAW;EAC5B,UACE,QAAQ,YAAY,OAClB,QAAQ,YAAY,OAAO,SAAS,EAAE,oBAAoB,CAC5D,MAAM,KAAK,OACb;EACA,MAAM,MAAM,gBAAgB,OAAO,SAAS,EAAE,SAAS;EAEvD,UAAU,UAAU,WAAW,YAAY,SAAS,IAAI,IAAI;EAE5D,OAAO,IAAI,SAAS,gBAAgB,IAAI,SAAS,wBAC7C;GAAE,GAAG;GAAK,UAAU;EAAK,IACzB;CACN;CACA,IAAI,UAAU,WAAW,YAAY,SAAS,aAAa,MAAM,IAAI,EAAE,WAAW,WAChF,OAAO,EAAE,MAAM,WAAW;CAC5B,IAAI,KAAK,gBAAgB,MAAM,aAAa,OAAO,EAAE,MAAM,WAAW;CAEtE,MAAM,WACJ,KAAK,aAAa,OAAO,MAAM,MAAM,QAAQ,YAAY,UAAU,YAAY,CAAC,CAAC;CAEnF,IAAI;CAEJ,IAAI,CAAC,UAAU,WAAW,EAAE,MAAM,WAAW;MACxC,IAAI,QAAQ,SAAS,WAAW;EACnC,UAAU,UAAU,qBAAqB,KAAA,CAAS;EAElD,MAAM,cAAc,mBAAmB,OAAO;GAC5C,UAAU,EAAE;GACZ,WAAW,OAAO;GAClB,WAAW,MAAM;GACjB,aAAa,KAAK;GAClB,sBAAsB,UAAU;EAClC,CAAC;EAED,OAAO,MAAM,OACX,EAAE,OACF,GAAG,EAAE,cAAc,MAAM,IAAI,GAC7B;IACG,EAAE,QAAQ;IACV,EAAE,UAAU,MAAM;IAClB,EAAE,cAAc;EACnB,CACF;EACA,WAAW;GACT,MAAM;GACN,WAAW,UAAU;GACrB,UAAU;EACZ;CACF,OAAO;EACL,UAAU,UAAU,iBAAiB,KAAA,KAAa,UAAU,aAAa,KAAA,CAAS;EAElF,MAAM,IAAI,QAAQ,SAChB,KAAK,QAAQ,YACb,IAAI,QAAQ;EAEd,MAAM,gBAAgB;GACpB,GAAG,QAAQ,oBAAoB,YAAY,GAAG;IAC5C,WAAW;IACX,kBAAkB,UAAU;GAC9B,CAAC;IACA,EAAE,KAAK;IACP,EAAE,mBAAmB,UAAU;EAClC;EAEA,OAAO,MAAM,OAAO,EAAE,OAAO,eAAe,GAAG,EAAE,KAAK,gBAAgB,CAAC;EAEvE,MAAM,mBAAmB;GACvB,GAAG,GAAG,aAAa;IACjB,UAAU,EAAE;IACZ,WAAW;IACX,aAAa,MAAM;IACnB,cAAc,UAAU;IACxB,oBAAoB,UAAU;GAChC,CAAC;IACA,GAAG,WAAW,EAAE;IAChB,GAAG,YAAY;IACf,GAAG,cAAc,MAAM;IACvB,GAAG,eAAe,UAAU;IAC5B,GAAG,qBAAqB,UAAU;EACrC;EAEA,UACE,GAAG,eAAe,iBAAiB,GAAG,OAAO,KAC3C,EAAE,eAAe,cAAc,EAAE,OAAO,CAC5C;EACA,OAAO,MAAM,OAAO,GAAG,OAAO,kBAAkB,GAC7C,GAAG,eAAe,UAAU,aAC/B,CAAC;EAED,MAAM,kBAAkB;GACtB,GAAG,EAAE,aAAa;IAChB,WAAW;IACX,cAAc,UAAU;IACxB,UAAU,UAAU;GACtB,CAAC;IACA,EAAE,YAAY;IACd,EAAE,eAAe,UAAU;IAC3B,EAAE,WAAW,UAAU;EAC1B;EAEA,UAAU,EAAE,eAAe,gBAAgB,EAAE,OAAO,CAAC;EACrD,OAAO,MAAM,OAAO,EAAE,OAAO,iBAAiB;IAC3C,EAAE,YAAY;IACd,EAAE,eAAe,UAAU;EAC9B,CAAC;EACD,OAAO,aAAa,QAAQ,WAAW,OAAO,UAAU,MAAM,KAAK,eAAe;EAClF,MAAM,eAAe,KACnB,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAC1C,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,eAAe,GACtC,EAAE,eACJ,EAAE,IACF,GAAG,wBAAwB,GAAG,MAAM,SAAS,KAAK,GAAG,IAAI,GAAG,OAAO,GAAG,YAAY,GAAG,UAAU,YAAY,GAAG,GAAG,eAAe,EAAE,IAClI,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAC1C,GAAG,IAAI,EAAE,OAAO,EAAE,YAAY,GAAG,UAAU,YAAY,GACvD,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,eAAe,GAC7C,EAAE,eACJ,EAAE,EACJ;EACA,WAAW;GAAE,MAAM;GAAc,UAAU;EAAM;CACnD;CACA,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,UAAU,OAAO,cAAc,QAAQ,eAAe,KAAK,QAAQ,mBAAmB,IAAM;CAE5F,MAAM,SAAS;EACb,GAAG,EAAE,aAAa;GAChB,QAAQ,kBAAkB,yBAAyB,MAAM;GACzD,WAAW,MAAM;GACjB,aAAa,KAAK;GAClB,cAAc,QAAQ,YAAY,OAAO,KAAK,OAAO;GACrD,sBAAsB,UAAU;EAClC,CAAC;EACD,GAAG;GACF,EAAE,YAAY,OAAO;GACrB,EAAE,cAAc,MAAM;GACtB,EAAE,cAAc,KAAK;GACrB,EAAE,iBAAiB,cAAc,OAAO,MAAM;GAC9C,EAAE,sBAAsB,KAAK;GAC7B,EAAE,uBAAuB,UAAU;GACnC,EAAE,WAAW,gBAAgB,OAAO,QAAQ;GAC5C,EAAE,iBAAiB,QAAQ,MAAM,cAChC,KAAK,IAAI,OAAO,sBAAsB,MAAM,QAAQ,eAAe,CACrE;CACF;CAIA,QAAQ,QAAO,OAFS,MAAM,OAAO,EAAE,OAAO,QAAQ,UAAU,EAAA,CAExC;CACxB,OAAO,MAAM,OACX,EAAE,OACF;GAAG,EAAE,WAAW,EAAE;GAAW,EAAE,YAAY,OAAO;CAAU,GAC5D;GACG,EAAE,QAAQ,SAAS;GACnB,EAAE,YAAY,MAAM;GACpB,EAAE,cAAc,KAAK;GACrB,EAAE,UAAU,MAAM;GAClB,EAAE,mBAAmB,SAAS,SAAS,wBAAwB,SAAS,YAAY;CACvF,CACF;CACA,IAAI,UAAU,MAAM,eAAe,KAAK,QAAQ,YAAY,cAAc,YAAY,CAAC,CAAC;CAExF,OAAO;AACT,CAAC,CACH"}

package/dist/oauth/OAuthConnectedRevocations.d.mts

@@ -57,6 +57,11 @@ declare const OAuthConnectedRevocationClaim: Schema.Struct<{
           readonly profile: Schema.optionalKey<Schema.Struct<{
             readonly displayName: Schema.optionalKey<Schema.String>;
             readonly handle: Schema.optionalKey<Schema.String>;
+            readonly avatarUrl: Schema.optionalKey<Schema.String>;
+            readonly profileUrl: Schema.optionalKey<Schema.String>;
+            readonly email: Schema.optionalKey<Schema.String>;
+            readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+            readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
           }>>;
         }>;
       }>;
@@ -127,6 +132,11 @@ declare const OAuthConnectedRevocationDecision: Schema.Union<readonly [Schema.Ta
             readonly profile: Schema.optionalKey<Schema.Struct<{
               readonly displayName: Schema.optionalKey<Schema.String>;
               readonly handle: Schema.optionalKey<Schema.String>;
+              readonly avatarUrl: Schema.optionalKey<Schema.String>;
+              readonly profileUrl: Schema.optionalKey<Schema.String>;
+              readonly email: Schema.optionalKey<Schema.String>;
+              readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+              readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
             }>>;
           }>;
         }>;

package/dist/oauth/OAuthRegistrationIntents.d.mts

@@ -56,6 +56,15 @@ declare const OAuthRegistrationSettlement: Schema.Union<readonly [Schema.Union<r
       readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
       readonly subject: Schema.NonEmptyString;
     }>;
+    readonly profile: Schema.optionalKey<Schema.Struct<{
+      readonly displayName: Schema.optionalKey<Schema.String>;
+      readonly handle: Schema.optionalKey<Schema.String>;
+      readonly avatarUrl: Schema.optionalKey<Schema.String>;
+      readonly profileUrl: Schema.optionalKey<Schema.String>;
+      readonly email: Schema.optionalKey<Schema.String>;
+      readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+      readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
+    }>>;
     readonly verifiedAtMillis: Schema.Int;
     readonly credentialDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
     readonly issuedAtMillis: Schema.Int;

package/dist/oauth/accountsModels.d.mts

@@ -391,6 +391,11 @@ declare const OAuthLinkOutcome: Schema.Union<readonly [Schema.TaggedStruct<"Veri
     readonly profile: Schema.optionalKey<Schema.Struct<{
       readonly displayName: Schema.optionalKey<Schema.String>;
       readonly handle: Schema.optionalKey<Schema.String>;
+      readonly avatarUrl: Schema.optionalKey<Schema.String>;
+      readonly profileUrl: Schema.optionalKey<Schema.String>;
+      readonly email: Schema.optionalKey<Schema.String>;
+      readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+      readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
     }>>;
   }>;
 }>, Schema.TaggedStruct<"Cancelled", {}>, Schema.TaggedStruct<"Rejected", {}>, Schema.TaggedStruct<"Ambiguous", {}>]>;

package/dist/oauth/connected.d.mts

@@ -228,6 +228,11 @@ declare const makeOAuthConnected: <const Id extends string>(moduleId: Id, config
         readonly profile: Schema.optionalKey<Schema.Struct<{
           readonly displayName: Schema.optionalKey<Schema.String>;
           readonly handle: Schema.optionalKey<Schema.String>;
+          readonly avatarUrl: Schema.optionalKey<Schema.String>;
+          readonly profileUrl: Schema.optionalKey<Schema.String>;
+          readonly email: Schema.optionalKey<Schema.String>;
+          readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+          readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
         }>>;
         readonly remoteRevocation: Schema.Literals<readonly ["Pending", "Confirmed", "Unsupported", "Unknown"]>;
       }>>;
@@ -250,6 +255,11 @@ declare const makeOAuthConnected: <const Id extends string>(moduleId: Id, config
           readonly profile: Schema.optionalKey<Schema.Struct<{
             readonly displayName: Schema.optionalKey<Schema.String>;
             readonly handle: Schema.optionalKey<Schema.String>;
+            readonly avatarUrl: Schema.optionalKey<Schema.String>;
+            readonly profileUrl: Schema.optionalKey<Schema.String>;
+            readonly email: Schema.optionalKey<Schema.String>;
+            readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+            readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
           }>>;
           readonly remoteRevocation: Schema.Literals<readonly ["Pending", "Confirmed", "Unsupported", "Unknown"]>;
         }>>;
@@ -360,6 +370,13 @@ declare const makeOAuthConnected: <const Id extends string>(moduleId: Id, config
       readonly profile?: {
         readonly displayName?: string | undefined;
         readonly handle?: string | undefined;
+        readonly avatarUrl?: string | undefined;
+        readonly profileUrl?: string | undefined;
+        readonly email?: string | undefined;
+        readonly emailVerified?: boolean | undefined;
+        readonly providerData?: {
+          readonly [x: string]: Schema.Json;
+        } | undefined;
       } | undefined;
       readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
     }[];
@@ -431,6 +448,11 @@ declare const makeOAuthConnected: <const Id extends string>(moduleId: Id, config
       readonly profile: Schema.optionalKey<Schema.Struct<{
         readonly displayName: Schema.optionalKey<Schema.String>;
         readonly handle: Schema.optionalKey<Schema.String>;
+        readonly avatarUrl: Schema.optionalKey<Schema.String>;
+        readonly profileUrl: Schema.optionalKey<Schema.String>;
+        readonly email: Schema.optionalKey<Schema.String>;
+        readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+        readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
       }>>;
       readonly remoteRevocation: Schema.Literals<readonly ["Pending", "Confirmed", "Unsupported", "Unknown"]>;
     }>>;

package/dist/oauth/connectedModels.d.mts

@@ -544,6 +544,11 @@ declare const OAuthConnectedGrantResponse: Schema.Struct<{
   readonly profile: Schema.optionalKey<Schema.Struct<{
     readonly displayName: Schema.optionalKey<Schema.String>;
     readonly handle: Schema.optionalKey<Schema.String>;
+    readonly avatarUrl: Schema.optionalKey<Schema.String>;
+    readonly profileUrl: Schema.optionalKey<Schema.String>;
+    readonly email: Schema.optionalKey<Schema.String>;
+    readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+    readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
   }>>;
   readonly scopes: Schema.$Array<Schema.String>;
   readonly resources: Schema.$Array<Schema.NonEmptyString>;
@@ -572,6 +577,11 @@ declare const OAuthConnectedTokenMetadata: Schema.Struct<{
   readonly profile: Schema.optionalKey<Schema.Struct<{
     readonly displayName: Schema.optionalKey<Schema.String>;
     readonly handle: Schema.optionalKey<Schema.String>;
+    readonly avatarUrl: Schema.optionalKey<Schema.String>;
+    readonly profileUrl: Schema.optionalKey<Schema.String>;
+    readonly email: Schema.optionalKey<Schema.String>;
+    readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+    readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
   }>>;
 }>;
 declare const OAuthConnectedTokenContext: Schema.Struct<{
@@ -622,6 +632,11 @@ declare const OAuthConnectedTokenContext: Schema.Struct<{
     readonly profile: Schema.optionalKey<Schema.Struct<{
       readonly displayName: Schema.optionalKey<Schema.String>;
       readonly handle: Schema.optionalKey<Schema.String>;
+      readonly avatarUrl: Schema.optionalKey<Schema.String>;
+      readonly profileUrl: Schema.optionalKey<Schema.String>;
+      readonly email: Schema.optionalKey<Schema.String>;
+      readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+      readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
     }>>;
   }>;
 }>;
@@ -677,6 +692,11 @@ declare const OAuthConnectedRevocationContext: Schema.Struct<{
       readonly profile: Schema.optionalKey<Schema.Struct<{
         readonly displayName: Schema.optionalKey<Schema.String>;
         readonly handle: Schema.optionalKey<Schema.String>;
+        readonly avatarUrl: Schema.optionalKey<Schema.String>;
+        readonly profileUrl: Schema.optionalKey<Schema.String>;
+        readonly email: Schema.optionalKey<Schema.String>;
+        readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+        readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
       }>>;
     }>;
   }>;
@@ -730,6 +750,11 @@ declare const OAuthConnectedProtectionContext: Schema.Union<readonly [Schema.Str
     readonly profile: Schema.optionalKey<Schema.Struct<{
       readonly displayName: Schema.optionalKey<Schema.String>;
       readonly handle: Schema.optionalKey<Schema.String>;
+      readonly avatarUrl: Schema.optionalKey<Schema.String>;
+      readonly profileUrl: Schema.optionalKey<Schema.String>;
+      readonly email: Schema.optionalKey<Schema.String>;
+      readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+      readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
     }>>;
   }>;
 }>, Schema.Struct<{
@@ -783,6 +808,11 @@ declare const OAuthConnectedProtectionContext: Schema.Union<readonly [Schema.Str
       readonly profile: Schema.optionalKey<Schema.Struct<{
         readonly displayName: Schema.optionalKey<Schema.String>;
         readonly handle: Schema.optionalKey<Schema.String>;
+        readonly avatarUrl: Schema.optionalKey<Schema.String>;
+        readonly profileUrl: Schema.optionalKey<Schema.String>;
+        readonly email: Schema.optionalKey<Schema.String>;
+        readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+        readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
       }>>;
     }>;
   }>;
@@ -844,6 +874,11 @@ declare const OAuthConnectedStoredGrant: Schema.Struct<{
       readonly profile: Schema.optionalKey<Schema.Struct<{
         readonly displayName: Schema.optionalKey<Schema.String>;
         readonly handle: Schema.optionalKey<Schema.String>;
+        readonly avatarUrl: Schema.optionalKey<Schema.String>;
+        readonly profileUrl: Schema.optionalKey<Schema.String>;
+        readonly email: Schema.optionalKey<Schema.String>;
+        readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+        readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
       }>>;
     }>;
   }>;
@@ -904,6 +939,11 @@ declare const OAuthConnectedDisconnectGrant: Schema.Struct<{
       readonly profile: Schema.optionalKey<Schema.Struct<{
         readonly displayName: Schema.optionalKey<Schema.String>;
         readonly handle: Schema.optionalKey<Schema.String>;
+        readonly avatarUrl: Schema.optionalKey<Schema.String>;
+        readonly profileUrl: Schema.optionalKey<Schema.String>;
+        readonly email: Schema.optionalKey<Schema.String>;
+        readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+        readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
       }>>;
     }>;
   }>;
@@ -967,6 +1007,11 @@ declare const OAuthConnectedRevocationJob: Schema.Struct<{
         readonly profile: Schema.optionalKey<Schema.Struct<{
           readonly displayName: Schema.optionalKey<Schema.String>;
           readonly handle: Schema.optionalKey<Schema.String>;
+          readonly avatarUrl: Schema.optionalKey<Schema.String>;
+          readonly profileUrl: Schema.optionalKey<Schema.String>;
+          readonly email: Schema.optionalKey<Schema.String>;
+          readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+          readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
         }>>;
       }>;
     }>;
@@ -1029,6 +1074,11 @@ declare const OAuthConnectedRefreshClaim: Schema.Struct<{
         readonly profile: Schema.optionalKey<Schema.Struct<{
           readonly displayName: Schema.optionalKey<Schema.String>;
           readonly handle: Schema.optionalKey<Schema.String>;
+          readonly avatarUrl: Schema.optionalKey<Schema.String>;
+          readonly profileUrl: Schema.optionalKey<Schema.String>;
+          readonly email: Schema.optionalKey<Schema.String>;
+          readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+          readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
         }>>;
       }>;
     }>;
@@ -1057,6 +1107,11 @@ declare const OAuthConnectedSummary: Schema.Struct<{
   readonly profile: Schema.optionalKey<Schema.Struct<{
     readonly displayName: Schema.optionalKey<Schema.String>;
     readonly handle: Schema.optionalKey<Schema.String>;
+    readonly avatarUrl: Schema.optionalKey<Schema.String>;
+    readonly profileUrl: Schema.optionalKey<Schema.String>;
+    readonly email: Schema.optionalKey<Schema.String>;
+    readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+    readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
   }>>;
   readonly remoteRevocation: Schema.Literals<readonly ["Pending", "Confirmed", "Unsupported", "Unknown"]>;
 }>;
@@ -1073,6 +1128,11 @@ declare const OAuthConnectedListResult: Schema.Struct<{
     readonly profile: Schema.optionalKey<Schema.Struct<{
       readonly displayName: Schema.optionalKey<Schema.String>;
       readonly handle: Schema.optionalKey<Schema.String>;
+      readonly avatarUrl: Schema.optionalKey<Schema.String>;
+      readonly profileUrl: Schema.optionalKey<Schema.String>;
+      readonly email: Schema.optionalKey<Schema.String>;
+      readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+      readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
     }>>;
     readonly remoteRevocation: Schema.Literals<readonly ["Pending", "Confirmed", "Unsupported", "Unknown"]>;
   }>>;
@@ -1351,6 +1411,11 @@ declare const OAuthConnectedOutcome: Schema.Union<readonly [Schema.TaggedStruct<
         readonly profile: Schema.optionalKey<Schema.Struct<{
           readonly displayName: Schema.optionalKey<Schema.String>;
           readonly handle: Schema.optionalKey<Schema.String>;
+          readonly avatarUrl: Schema.optionalKey<Schema.String>;
+          readonly profileUrl: Schema.optionalKey<Schema.String>;
+          readonly email: Schema.optionalKey<Schema.String>;
+          readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+          readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
         }>>;
       }>;
     }>;
@@ -1413,6 +1478,11 @@ declare const OAuthConnectedOutcome: Schema.Union<readonly [Schema.TaggedStruct<
           readonly profile: Schema.optionalKey<Schema.Struct<{
             readonly displayName: Schema.optionalKey<Schema.String>;
             readonly handle: Schema.optionalKey<Schema.String>;
+            readonly avatarUrl: Schema.optionalKey<Schema.String>;
+            readonly profileUrl: Schema.optionalKey<Schema.String>;
+            readonly email: Schema.optionalKey<Schema.String>;
+            readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+            readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
           }>>;
         }>;
       }>;
@@ -1474,6 +1544,11 @@ declare const OAuthConnectedOutcome: Schema.Union<readonly [Schema.TaggedStruct<
         readonly profile: Schema.optionalKey<Schema.Struct<{
           readonly displayName: Schema.optionalKey<Schema.String>;
           readonly handle: Schema.optionalKey<Schema.String>;
+          readonly avatarUrl: Schema.optionalKey<Schema.String>;
+          readonly profileUrl: Schema.optionalKey<Schema.String>;
+          readonly email: Schema.optionalKey<Schema.String>;
+          readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+          readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
         }>>;
       }>;
     }>;
@@ -1536,6 +1611,11 @@ declare const OAuthConnectedOutcome: Schema.Union<readonly [Schema.TaggedStruct<
           readonly profile: Schema.optionalKey<Schema.Struct<{
             readonly displayName: Schema.optionalKey<Schema.String>;
             readonly handle: Schema.optionalKey<Schema.String>;
+            readonly avatarUrl: Schema.optionalKey<Schema.String>;
+            readonly profileUrl: Schema.optionalKey<Schema.String>;
+            readonly email: Schema.optionalKey<Schema.String>;
+            readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+            readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
           }>>;
         }>;
       }>;
@@ -1599,6 +1679,11 @@ declare const OAuthConnectedSettlementDecision: Schema.Union<readonly [Schema.Ta
         readonly profile: Schema.optionalKey<Schema.Struct<{
           readonly displayName: Schema.optionalKey<Schema.String>;
           readonly handle: Schema.optionalKey<Schema.String>;
+          readonly avatarUrl: Schema.optionalKey<Schema.String>;
+          readonly profileUrl: Schema.optionalKey<Schema.String>;
+          readonly email: Schema.optionalKey<Schema.String>;
+          readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+          readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
         }>>;
       }>;
     }>;
@@ -1660,6 +1745,11 @@ declare const OAuthConnectedDisconnectInspection: Schema.Union<readonly [Schema.
         readonly profile: Schema.optionalKey<Schema.Struct<{
           readonly displayName: Schema.optionalKey<Schema.String>;
           readonly handle: Schema.optionalKey<Schema.String>;
+          readonly avatarUrl: Schema.optionalKey<Schema.String>;
+          readonly profileUrl: Schema.optionalKey<Schema.String>;
+          readonly email: Schema.optionalKey<Schema.String>;
+          readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+          readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
         }>>;
       }>;
     }>;
@@ -1742,6 +1832,11 @@ declare const OAuthConnectedAccessInspection: Schema.Union<readonly [Schema.Tagg
         readonly profile: Schema.optionalKey<Schema.Struct<{
           readonly displayName: Schema.optionalKey<Schema.String>;
           readonly handle: Schema.optionalKey<Schema.String>;
+          readonly avatarUrl: Schema.optionalKey<Schema.String>;
+          readonly profileUrl: Schema.optionalKey<Schema.String>;
+          readonly email: Schema.optionalKey<Schema.String>;
+          readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+          readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
         }>>;
       }>;
     }>;
@@ -1804,6 +1899,11 @@ declare const OAuthConnectedRefreshDecision: Schema.Union<readonly [Schema.Tagge
           readonly profile: Schema.optionalKey<Schema.Struct<{
             readonly displayName: Schema.optionalKey<Schema.String>;
             readonly handle: Schema.optionalKey<Schema.String>;
+            readonly avatarUrl: Schema.optionalKey<Schema.String>;
+            readonly profileUrl: Schema.optionalKey<Schema.String>;
+            readonly email: Schema.optionalKey<Schema.String>;
+            readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+            readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
           }>>;
         }>;
       }>;
@@ -1870,6 +1970,11 @@ declare const OAuthConnectedRefreshOutcome: Schema.Union<readonly [Schema.Tagged
         readonly profile: Schema.optionalKey<Schema.Struct<{
           readonly displayName: Schema.optionalKey<Schema.String>;
           readonly handle: Schema.optionalKey<Schema.String>;
+          readonly avatarUrl: Schema.optionalKey<Schema.String>;
+          readonly profileUrl: Schema.optionalKey<Schema.String>;
+          readonly email: Schema.optionalKey<Schema.String>;
+          readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+          readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
         }>>;
       }>;
     }>;
@@ -1932,6 +2037,11 @@ declare const OAuthConnectedRefreshOutcome: Schema.Union<readonly [Schema.Tagged
           readonly profile: Schema.optionalKey<Schema.Struct<{
             readonly displayName: Schema.optionalKey<Schema.String>;
             readonly handle: Schema.optionalKey<Schema.String>;
+            readonly avatarUrl: Schema.optionalKey<Schema.String>;
+            readonly profileUrl: Schema.optionalKey<Schema.String>;
+            readonly email: Schema.optionalKey<Schema.String>;
+            readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+            readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
           }>>;
         }>;
       }>;
@@ -1995,6 +2105,11 @@ declare const OAuthConnectedRefreshSettlement: Schema.Union<readonly [Schema.Tag
         readonly profile: Schema.optionalKey<Schema.Struct<{
           readonly displayName: Schema.optionalKey<Schema.String>;
           readonly handle: Schema.optionalKey<Schema.String>;
+          readonly avatarUrl: Schema.optionalKey<Schema.String>;
+          readonly profileUrl: Schema.optionalKey<Schema.String>;
+          readonly email: Schema.optionalKey<Schema.String>;
+          readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+          readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
         }>>;
       }>;
     }>;