;; Auto-generated by speckl-compile from OAuth2AuthorizationCode
;; Compile: wat2wasm OAuth2AuthorizationCode.wat -o OAuth2AuthorizationCode.wasm

(module
  ;; Host imports for Map/Set/alloc
  (import "speckl" "map_create" (func $map_create (result i32)))
  (import "speckl" "map_set" (func $map_set (param i32 i32 i32)))
  (import "speckl" "map_get" (func $map_get (param i32 i32) (result i32)))
  (import "speckl" "map_has" (func $map_has (param i32 i32) (result i32)))
  (import "speckl" "map_remove" (func $map_remove (param i32 i32)))
  (import "speckl" "set_create" (func $set_create (result i32)))
  (import "speckl" "set_add" (func $set_add (param i32 i32)))
  (import "speckl" "set_has" (func $set_has (param i32 i32) (result i32)))
  (import "speckl" "set_size" (func $set_size (param i32) (result i32)))
  (import "speckl" "alloc" (func $alloc (param i32) (result i32)))
  (import "speckl" "write_i32" (func $write_i32 (param i32 i32)))
  (import "speckl" "write_f64" (func $write_f64 (param i32 f64)))

  ;; Linear memory (exported so host can read state)
  (memory (export "memory") 1)

  ;; State globals
  

  ;; ---- init ----
  (func $init (export "init")
    
  )

  ;; ---- Actions ----
    ;; action: Authorize
  (func $Authorize (export "Authorize") (param $client i32) (param $redirectUri i32) (param $scope i32) (param $userId i32) (param $sessionId i32) (result i32)
    
    (local $state i32)
    (local $codeVerifier i32)
    (local $codeChallenge i32)
    (local $authCode i32)
    ;; require: client in clients.keys
    ;; Complex guard not compiled: client in clients.keys
    ;; require: redirectUri in clients.client.redirect_uris
    ;; Complex guard not compiled: redirectUri in clients.client.redirect_uris
    ;; require: sessionId in sessions.keys
    ;; Complex guard not compiled: sessionId in sessions.keys
    ;; require: sessions[sessionId].user_id == userId
    ;; Complex guard not compiled: sessions[sessionId].user_id == userId
    (i32.const 0) ;; uncompiled expr: "state_" + hash(client + redirectUri + currentTime)
    (local.set $state)
    (i32.const 0) ;; uncompiled expr: "verifier_" + hash(client + userId + currentTime)
    (local.set $codeVerifier)
    (i32.const 0) ;; uncompiled expr: hash(codeVerifier, "S256")
    (local.set $codeChallenge)
    ;; stateNonces[state] := { client_id: client, redirect_uri: redirectUri }
    ;; Unrecognized assignment target: stateNonces[state]
    ;; pkceChallenges[codeChallenge] := { code_verifier_hash: hash(codeVerifier, "S256"), method: "S256" }
    ;; Unrecognized assignment target: pkceChallenges[codeChallenge]
    (i32.const 0) ;; uncompiled expr: "code_" + hash(client + userId + currentTime)
    (local.set $authCode)
    ;; authorizationCodes[authCode] := {
    ;; Unrecognized assignment target: authorizationCodes[authCode]
    (i32.const 1)
  )

  ;; action: ApproveAuthorization
  (func $ApproveAuthorization (export "ApproveAuthorization") (param $code i32) (param $userId i32) (result i32)
    
    (local $c i32)
    ;; require: code in authorizationCodes.keys
    ;; Complex guard not compiled: code in authorizationCodes.keys
    (i32.const 0) ;; uncompiled expr: authorizationCodes[code]
    (local.set $c)
    ;; require: c.user_id == userId
    ;; Complex guard not compiled: c.user_id == userId
    ;; require: c.used == false
    ;; Complex guard not compiled: c.used == false
    (i32.const 1)
  )

  ;; action: ExchangeCode
  (func $ExchangeCode (export "ExchangeCode") (param $req i32) (result i32)
    
    (local $c i32)
    (local $expectedChallenge i32)
    (local $accessToken i32)
    (local $refreshToken i32)
    (local $expiresAt i32)
    ;; require: req.client_id in clients.keys
    ;; Complex guard not compiled: req.client_id in clients.keys
    ;; require: req.code in authorizationCodes.keys
    ;; Complex guard not compiled: req.code in authorizationCodes.keys
    (i32.const 0) ;; uncompiled expr: authorizationCodes[req.code]
    (local.set $c)
    ;; require: c.used == false
    ;; Complex guard not compiled: c.used == false
    ;; require: c.client_id == req.client_id
    ;; Complex guard not compiled: c.client_id == req.client_id
    ;; require: c.redirect_uri == req.redirect_uri
    ;; Complex guard not compiled: c.redirect_uri == req.redirect_uri
    (i32.const 0) ;; uncompiled expr: hash(req.code_verifier, c.code_challenge_method)
    (local.set $expectedChallenge)
    ;; require: expectedChallenge == c.code_challenge
    ;; Guard on non-scalar not compiled: expectedChallenge == c.code_challenge
    ;; pkceChallenges[c.code_challenge] := null
    ;; Unrecognized assignment target: pkceChallenges[c.code_challenge]
    ;; stateNonces[c.state] := null
    ;; Unrecognized assignment target: stateNonces[c.state]
    (i32.const 0) ;; uncompiled expr: "access_" + hash(req.client_id + c.user_id + currentTime)
    (local.set $accessToken)
    (i32.const 0) ;; uncompiled expr: "refresh_" + hash(req.client_id + c.user_id + currentTime)
    (local.set $refreshToken)
    (i32.add (i32.const NaN) (i32.const 3600))
    (local.set $expiresAt)
    ;; accessTokens[accessToken] := {
    ;; Unrecognized assignment target: accessTokens[accessToken]
    ;; refreshTokens[refreshToken] := {
    ;; Unrecognized assignment target: refreshTokens[refreshToken]
    (i32.const 1)
  )

  ;; action: RefreshToken
  (func $RefreshToken (export "RefreshToken") (param $req i32) (result i32)
    
    (local $r i32)
    (local $newAccessToken i32)
    (local $newRefreshToken i32)
    (local $expiresAt i32)
    ;; require: req.client_id in clients.keys
    ;; Complex guard not compiled: req.client_id in clients.keys
    ;; require: req.refresh_token in refreshTokens.keys
    ;; Complex guard not compiled: req.refresh_token in refreshTokens.keys
    (i32.const 0) ;; uncompiled expr: refreshTokens[req.refresh_token]
    (local.set $r)
    ;; require: r.client_id == req.client_id
    ;; Complex guard not compiled: r.client_id == req.client_id
    ;; accessTokens[r.access_token] := null
    ;; Unrecognized assignment target: accessTokens[r.access_token]
    (i32.const 0) ;; uncompiled expr: "access_" + hash(req.client_id + r.user_id + currentTime)
    (local.set $newAccessToken)
    (i32.const 0) ;; uncompiled expr: "refresh_" + hash(req.client_id + r.user_id + currentTime)
    (local.set $newRefreshToken)
    (i32.add (i32.const NaN) (i32.const 3600))
    (local.set $expiresAt)
    ;; accessTokens[newAccessToken] := {
    ;; Unrecognized assignment target: accessTokens[newAccessToken]
    ;; refreshTokens[newRefreshToken] := {
    ;; Unrecognized assignment target: refreshTokens[newRefreshToken]
    ;; refreshTokens[req.refresh_token] := null
    ;; Unrecognized assignment target: refreshTokens[req.refresh_token]
    (i32.const 1)
  )

  ;; action: RevokeToken
  (func $RevokeToken (export "RevokeToken") (param $client i32) (param $token i32) (param $tokenType i32) (result i32)
    
    (local $t i32)
    (local $r i32)
    ;; require: client in clients.keys
    ;; Complex guard not compiled: client in clients.keys
    ;; require: token in accessTokens.keys
    ;; Complex guard not compiled: token in accessTokens.keys
    (i32.const 0) ;; uncompiled expr: accessTokens[token]
    (local.set $t)
    ;; require: t.client_id == client
    ;; Complex guard not compiled: t.client_id == client
    ;; accessTokens[token] := null
    ;; Unrecognized assignment target: accessTokens[token]
    ;; refreshTokens[t.refresh_token] := null
    ;; Unrecognized assignment target: refreshTokens[t.refresh_token]
    ;; require: token in refreshTokens.keys
    ;; Complex guard not compiled: token in refreshTokens.keys
    (i32.const 0) ;; uncompiled expr: refreshTokens[token]
    (local.set $r)
    ;; require: r.client_id == client
    ;; Complex guard not compiled: r.client_id == client
    ;; refreshTokens[token] := null
    ;; Unrecognized assignment target: refreshTokens[token]
    ;; accessTokens[r.access_token] := null
    ;; Unrecognized assignment target: accessTokens[r.access_token]
    (i32.const 1)
  )

  ;; action: VerifyPKCE
  (func $VerifyPKCE (export "VerifyPKCE") (param $code i32) (param $verifier i32) (result i32)
    
    (local $c i32)
    (local $expectedChallenge i32)
    ;; require: code in authorizationCodes.keys
    ;; Complex guard not compiled: code in authorizationCodes.keys
    (i32.const 0) ;; uncompiled expr: authorizationCodes[code]
    (local.set $c)
    ;; require: c.used == false
    ;; Complex guard not compiled: c.used == false
    (i32.const 0) ;; uncompiled expr: hash(verifier, c.code_challenge_method)
    (local.set $expectedChallenge)
    ;; require: expectedChallenge == c.code_challenge
    ;; Guard on non-scalar not compiled: expectedChallenge == c.code_challenge
    (i32.const 1)
  )

  ;; ---- getState ----
  (func $getState (export "getState") (result i32 i32)
    (i32.const 0)
    (i32.const 0)
  )

  
  ;; checkConstraints — runtime constraint evaluation stub
  (func $checkConstraints (export "checkConstraints") (result i32)
    ;; TODO: evaluate constraint expressions at runtime
    (i32.const 1)
  )
)