@effect-auth/core 0.1.0-alpha.1 → 0.1.0-alpha.13

package/dist/IncidentAction.js

@@ -0,0 +1,158 @@
+import { Context, Data, Effect, Layer } from "effect";
+import { ApiKeyManagement, } from "./ApiKey.js";
+import { RefreshTokenManagement, } from "./RefreshToken.js";
+import { currentUnixMillis } from "./Internal.js";
+import { Sessions, } from "./Sessions.js";
+import { TrustedDeviceStore, } from "./TrustedDevice.js";
+export class IncidentActionError extends Data.TaggedError("IncidentActionError") {
+}
+export class IncidentAction extends Context.Service()("auth/IncidentAction") {
+}
+(function (IncidentAction) {
+    IncidentAction.make = (service) => IncidentAction.of(service);
+})(IncidentAction || (IncidentAction = {}));
+const incidentActionError = (operation, message, cause) => new IncidentActionError({
+    operation,
+    message,
+    ...(cause === undefined ? {} : { cause }),
+});
+const requireDependency = (dependency, operation, name) => dependency === undefined
+    ? Effect.fail(incidentActionError(operation, `${name} dependency is not available`))
+    : Effect.succeed(dependency);
+const actionNow = (input) => input.now === undefined ? currentUnixMillis : Effect.succeed(input.now);
+const resultBase = (input) => ({
+    userId: input.userId,
+    ...(input.reason === undefined ? {} : { reason: input.reason }),
+});
+const unique = (items) => [...new Set(items)];
+export const makeIncidentAction = (dependencies) => {
+    const revokeSessionsSummary = Effect.fn("auth.incident_action.revoke_sessions")(function* (input) {
+        const sessions = yield* requireDependency(dependencies.sessions, "revoke_sessions", "Sessions");
+        const activeSessions = yield* sessions.listForUser({ userId: input.userId }).pipe(Effect.mapError((cause) => incidentActionError("revoke_sessions", "Failed to list user sessions before incident action", cause)));
+        yield* sessions.revokeAllForUser(input.userId).pipe(Effect.mapError((cause) => incidentActionError("revoke_sessions", "Failed to revoke user sessions", cause)));
+        return {
+            revokedAll: true,
+            activeBefore: activeSessions.length,
+            sessionIds: activeSessions.map((session) => session.sessionId),
+        };
+    });
+    const revokeTrustedDevicesSummary = Effect.fn("auth.incident_action.revoke_trusted_devices")(function* (input) {
+        const trustedDevices = yield* requireDependency(dependencies.trustedDevices, "revoke_trusted_devices", "TrustedDeviceStore");
+        const now = yield* actionNow(input);
+        const devices = yield* trustedDevices
+            .listForUser({ userId: input.userId, now })
+            .pipe(Effect.mapError((cause) => incidentActionError("revoke_trusted_devices", "Failed to list trusted devices before incident action", cause)));
+        yield* Effect.forEach(devices, (device) => trustedDevices
+            .revokeForUser({ userId: input.userId, tokenHash: device.tokenHash })
+            .pipe(Effect.mapError((cause) => incidentActionError("revoke_trusted_devices", "Failed to revoke trusted device", cause))), { discard: true });
+        return {
+            revoked: devices.length,
+            deviceIds: devices.map((device) => device.tokenHash),
+        };
+    });
+    const revokeApiKeysSummary = Effect.fn("auth.incident_action.revoke_api_keys")(function* (input) {
+        const apiKeys = yield* requireDependency(dependencies.apiKeys, "revoke_api_keys", "ApiKeyManagement");
+        const now = yield* actionNow(input);
+        const keys = yield* apiKeys
+            .listForUser({ userId: input.userId, includeRevoked: false })
+            .pipe(Effect.mapError((cause) => incidentActionError("revoke_api_keys", "Failed to list API keys before incident action", cause)));
+        yield* Effect.forEach(keys, (key) => apiKeys
+            .revokeForUser({
+            userId: input.userId,
+            keyId: key.id,
+            revokedAt: now,
+            reason: input.reason,
+        })
+            .pipe(Effect.mapError((cause) => incidentActionError("revoke_api_keys", "Failed to revoke API key", cause))), { discard: true });
+        return {
+            revoked: keys.length,
+            keyIds: keys.map((key) => key.id),
+        };
+    });
+    const revokeRefreshTokensSummary = Effect.fn("auth.incident_action.revoke_refresh_tokens")(function* (input) {
+        const refreshTokens = yield* requireDependency(dependencies.refreshTokens, "revoke_refresh_tokens", "RefreshTokenManagement");
+        const now = yield* actionNow(input);
+        const tokens = yield* refreshTokens
+            .listForUser({ userId: input.userId, includeRevoked: false })
+            .pipe(Effect.mapError((cause) => incidentActionError("revoke_refresh_tokens", "Failed to list refresh tokens before incident action", cause)));
+        const familyIds = unique(tokens.map((token) => token.familyId));
+        yield* Effect.forEach(familyIds, (familyId) => refreshTokens
+            .revokeFamilyForUser({
+            userId: input.userId,
+            familyId,
+            revokedAt: now,
+            reason: input.reason,
+        })
+            .pipe(Effect.mapError((cause) => incidentActionError("revoke_refresh_tokens", "Failed to revoke refresh token family", cause))), { discard: true });
+        return {
+            revokedFamilies: familyIds.length,
+            activeBefore: tokens.length,
+            tokenIds: tokens.map((token) => token.id),
+            familyIds,
+        };
+    });
+    return IncidentAction.make({
+        revokeUserSessions: Effect.fn("auth.incident_action.result.revoke_sessions")(function* (input) {
+            const sessions = yield* revokeSessionsSummary(input);
+            return { ...resultBase(input), sessions };
+        }),
+        revokeTrustedDevices: Effect.fn("auth.incident_action.result.revoke_trusted_devices")(function* (input) {
+            const trustedDevices = yield* revokeTrustedDevicesSummary(input);
+            return {
+                ...resultBase(input),
+                trustedDevices,
+            };
+        }),
+        revokeApiKeys: Effect.fn("auth.incident_action.result.revoke_api_keys")(function* (input) {
+            const apiKeys = yield* revokeApiKeysSummary(input);
+            return { ...resultBase(input), apiKeys };
+        }),
+        revokeRefreshTokens: Effect.fn("auth.incident_action.result.revoke_refresh_tokens")(function* (input) {
+            const refreshTokens = yield* revokeRefreshTokensSummary(input);
+            return { ...resultBase(input), refreshTokens };
+        }),
+        containUser: Effect.fn("auth.incident_action.contain_user")(function* (input) {
+            const { actions } = input;
+            if (actions.revokeSessions !== true &&
+                actions.revokeTrustedDevices !== true &&
+                actions.revokeApiKeys !== true &&
+                actions.revokeRefreshTokens !== true) {
+                return yield* Effect.fail(incidentActionError("contain_user", "No incident actions selected"));
+            }
+            const sessions = actions.revokeSessions === true
+                ? yield* revokeSessionsSummary(input)
+                : undefined;
+            const trustedDevices = actions.revokeTrustedDevices === true
+                ? yield* revokeTrustedDevicesSummary(input)
+                : undefined;
+            const apiKeys = actions.revokeApiKeys === true ? yield* revokeApiKeysSummary(input) : undefined;
+            const refreshTokens = actions.revokeRefreshTokens === true
+                ? yield* revokeRefreshTokensSummary(input)
+                : undefined;
+            return {
+                ...resultBase(input),
+                ...(sessions === undefined ? {} : { sessions }),
+                ...(trustedDevices === undefined ? {} : { trustedDevices }),
+                ...(apiKeys === undefined ? {} : { apiKeys }),
+                ...(refreshTokens === undefined ? {} : { refreshTokens }),
+            };
+        }),
+    });
+};
+export const IncidentActionLive = Layer.effect(IncidentAction)(Effect.gen(function* () {
+    const sessions = yield* Effect.serviceOption(Sessions);
+    const trustedDevices = yield* Effect.serviceOption(TrustedDeviceStore);
+    const apiKeys = yield* Effect.serviceOption(ApiKeyManagement);
+    const refreshTokens = yield* Effect.serviceOption(RefreshTokenManagement);
+    return makeIncidentAction({
+        ...(sessions._tag === "Some" ? { sessions: sessions.value } : {}),
+        ...(trustedDevices._tag === "Some"
+            ? { trustedDevices: trustedDevices.value }
+            : {}),
+        ...(apiKeys._tag === "Some" ? { apiKeys: apiKeys.value } : {}),
+        ...(refreshTokens._tag === "Some"
+            ? { refreshTokens: refreshTokens.value }
+            : {}),
+    });
+}));
+//# sourceMappingURL=IncidentAction.js.map

package/dist/IncidentAction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IncidentAction.js","sourceRoot":"","sources":["../src/IncidentAction.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAEtD,OAAO,EACL,gBAAgB,GAKjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,sBAAsB,GAMvB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EACL,QAAQ,GAIT,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,kBAAkB,GAInB,MAAM,oBAAoB,CAAC;AAS5B,MAAM,OAAO,mBAAoB,SAAQ,IAAI,CAAC,WAAW,CACvD,qBAAqB,CAKrB;CAAG;AAqEL,MAAM,OAAO,cAAe,SAAQ,OAAO,CAAC,OAAO,EAGhD,CAAC,qBAAqB,CAAC;CAAG;AAE7B,WAAiB,cAAc;IAChB,mBAAI,GAAG,CAAC,OAA8B,EAAyB,EAAE,CAC5E,cAAc,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC,EAHgB,cAAc,KAAd,cAAc,QAG9B;AASD,MAAM,mBAAmB,GAAG,CAC1B,SAAkC,EAClC,OAAe,EACf,KAAe,EACM,EAAE,CACvB,IAAI,mBAAmB,CAAC;IACtB,SAAS;IACT,OAAO;IACP,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;CAC1C,CAAC,CAAC;AAEL,MAAM,iBAAiB,GAAG,CACxB,UAAyB,EACzB,SAAkC,EAClC,IAAY,EAC2B,EAAE,CACzC,UAAU,KAAK,SAAS;IACtB,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,mBAAmB,CAAC,SAAS,EAAE,GAAG,IAAI,8BAA8B,CAAC,CACtE;IACH,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AAEjC,MAAM,SAAS,GAAG,CAChB,KAA8B,EACH,EAAE,CAC7B,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAE1E,MAAM,UAAU,GAAG,CAAC,KAA8B,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,EAAE,KAAK,CAAC,MAAM;IACpB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;CAChE,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,CAAI,KAAmB,EAAgB,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAE7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,YAAwC,EACjB,EAAE;IACzB,MAAM,qBAAqB,GAAG,MAAM,CAAC,EAAE,CACrC,sCAAsC,CACvC,CAAC,QAAQ,CAAC,EAAE,KAA8B;QACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,iBAAiB,CACvC,YAAY,CAAC,QAAQ,EACrB,iBAAiB,EACjB,UAAU,CACX,CAAC;QACF,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAC/E,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAuB,EAAE,EAAE,CAC1C,mBAAmB,CACjB,iBAAiB,EACjB,qDAAqD,EACrD,KAAK,CACN,CACF,CACF,CAAC;QAEF,KAAK,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CACjD,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAyB,EAAE,EAAE,CAC5C,mBAAmB,CACjB,iBAAiB,EACjB,gCAAgC,EAChC,KAAK,CACN,CACF,CACF,CAAC;QAEF,OAAO;YACL,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,cAAc,CAAC,MAAM;YACnC,UAAU,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;SACxB,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,MAAM,2BAA2B,GAAG,MAAM,CAAC,EAAE,CAC3C,6CAA6C,CAC9C,CAAC,QAAQ,CAAC,EAAE,KAA8B;QACzC,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAC7C,YAAY,CAAC,cAAc,EAC3B,wBAAwB,EACxB,oBAAoB,CACrB,CAAC;QACF,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,cAAc;aAClC,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC;aAC1C,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAyB,EAAE,EAAE,CAC5C,mBAAmB,CACjB,wBAAwB,EACxB,uDAAuD,EACvD,KAAK,CACN,CACF,CACF,CAAC;QAEJ,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACnB,OAAO,EACP,CAAC,MAA2B,EAAE,EAAE,CAC9B,cAAc;aACX,aAAa,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;aACpE,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAyB,EAAE,EAAE,CAC5C,mBAAmB,CACjB,wBAAwB,EACxB,iCAAiC,EACjC,KAAK,CACN,CACF,CACF,EACL,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,OAAO,CAAC,MAAM;YACvB,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;SACR,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,MAAM,oBAAoB,GAAG,MAAM,CAAC,EAAE,CACpC,sCAAsC,CACvC,CAAC,QAAQ,CAAC,EAAE,KAA8B;QACzC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CACtC,YAAY,CAAC,OAAO,EACpB,iBAAiB,EACjB,kBAAkB,CACnB,CAAC;QACF,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO;aACxB,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;aAC5D,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,CAAC,KAA4B,EAAE,EAAE,CAC/C,mBAAmB,CACjB,iBAAiB,EACjB,gDAAgD,EAChD,KAAK,CACN,CACF,CACF,CAAC;QAEJ,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACnB,IAAI,EACJ,CAAC,GAAe,EAAE,EAAE,CAClB,OAAO;aACJ,aAAa,CAAC;YACb,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,GAAG,CAAC,EAAE;YACb,SAAS,EAAE,GAAG;YACd,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC;aACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,CAAC,KAA4B,EAAE,EAAE,CAC/C,mBAAmB,CACjB,iBAAiB,EACjB,0BAA0B,EAC1B,KAAK,CACN,CACF,CACF,EACL,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;SACI,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,MAAM,0BAA0B,GAAG,MAAM,CAAC,EAAE,CAC1C,4CAA4C,CAC7C,CAAC,QAAQ,CAAC,EAAE,KAA8B;QACzC,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAC5C,YAAY,CAAC,aAAa,EAC1B,uBAAuB,EACvB,wBAAwB,CACzB,CAAC;QACF,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,aAAa;aAChC,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;aAC5D,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAkC,EAAE,EAAE,CACrD,mBAAmB,CACjB,uBAAuB,EACvB,sDAAsD,EACtD,KAAK,CACN,CACF,CACF,CAAC;QACJ,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEhE,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACnB,SAAS,EACT,CAAC,QAA8B,EAAE,EAAE,CACjC,aAAa;aACV,mBAAmB,CAAC;YACnB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ;YACR,SAAS,EAAE,GAAG;YACd,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC;aACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAkC,EAAE,EAAE,CACrD,mBAAmB,CACjB,uBAAuB,EACvB,uCAAuC,EACvC,KAAK,CACN,CACF,CACF,EACL,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC;QAEF,OAAO;YACL,eAAe,EAAE,SAAS,CAAC,MAAM;YACjC,YAAY,EAAE,MAAM,CAAC,MAAM;YAC3B,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAuB,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3D,SAAS;SACkC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,OAAO,cAAc,CAAC,IAAI,CAAC;QACzB,kBAAkB,EAAE,MAAM,CAAC,EAAE,CAC3B,6CAA6C,CAC9C,CAAC,QAAQ,CAAC,EAAE,KAAK;YAChB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;YAErD,OAAO,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAiC,CAAC;QAC3E,CAAC,CAAC;QACF,oBAAoB,EAAE,MAAM,CAAC,EAAE,CAC7B,oDAAoD,CACrD,CAAC,QAAQ,CAAC,EAAE,KAAK;YAChB,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,2BAA2B,CAAC,KAAK,CAAC,CAAC;YAEjE,OAAO;gBACL,GAAG,UAAU,CAAC,KAAK,CAAC;gBACpB,cAAc;aACgB,CAAC;QACnC,CAAC,CAAC;QACF,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC,6CAA6C,CAAC,CACrE,QAAQ,CAAC,EAAE,KAAK;YACd,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAEnD,OAAO,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,OAAO,EAAiC,CAAC;QAC1E,CAAC,CACF;QACD,mBAAmB,EAAE,MAAM,CAAC,EAAE,CAC5B,mDAAmD,CACpD,CAAC,QAAQ,CAAC,EAAE,KAAK;YAChB,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC;YAE/D,OAAO,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,aAAa,EAAiC,CAAC;QAChF,CAAC,CAAC;QACF,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,mCAAmC,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK;YAC1E,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;YAE1B,IACE,OAAO,CAAC,cAAc,KAAK,IAAI;gBAC/B,OAAO,CAAC,oBAAoB,KAAK,IAAI;gBACrC,OAAO,CAAC,aAAa,KAAK,IAAI;gBAC9B,OAAO,CAAC,mBAAmB,KAAK,IAAI,EACpC,CAAC;gBACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,mBAAmB,CAAC,cAAc,EAAE,8BAA8B,CAAC,CACpE,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GACZ,OAAO,CAAC,cAAc,KAAK,IAAI;gBAC7B,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC;gBACrC,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,cAAc,GAClB,OAAO,CAAC,oBAAoB,KAAK,IAAI;gBACnC,CAAC,CAAC,KAAK,CAAC,CAAC,2BAA2B,CAAC,KAAK,CAAC;gBAC3C,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,OAAO,GACX,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAClF,MAAM,aAAa,GACjB,OAAO,CAAC,mBAAmB,KAAK,IAAI;gBAClC,CAAC,CAAC,KAAK,CAAC,CAAC,0BAA0B,CAAC,KAAK,CAAC;gBAC1C,CAAC,CAAC,SAAS,CAAC;YAEhB,OAAO;gBACL,GAAG,UAAU,CAAC,KAAK,CAAC;gBACpB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;gBAC/C,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;gBAC3D,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;gBAC7C,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;aAC3B,CAAC;QACnC,CAAC,CAAC;KACH,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAC5D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAC9D,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;IAE1E,OAAO,kBAAkB,CAAC;QACxB,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,cAAc,CAAC,IAAI,KAAK,MAAM;YAChC,CAAC,CAAC,EAAE,cAAc,EAAE,cAAc,CAAC,KAAK,EAAE;YAC1C,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,aAAa,CAAC,IAAI,KAAK,MAAM;YAC/B,CAAC,CAAC,EAAE,aAAa,EAAE,aAAa,CAAC,KAAK,EAAE;YACxC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;AACL,CAAC,CAAC,CACH,CAAC"}

package/dist/Internal.d.ts

@@ -0,0 +1,7 @@
+import { Effect } from "effect";
+import type { CryptoService } from "./Crypto.js";
+import { UnixMillis } from "./Identifiers.js";
+export declare const currentUnixMillis: Effect.Effect<UnixMillis>;
+export declare const addMillis: (value: UnixMillis, millis: number) => UnixMillis;
+export declare const timingSafeEqualString: (crypto: CryptoService, left: string, right: string) => Effect.Effect<boolean, import("./Crypto.js").CryptoError, never>;
+//# sourceMappingURL=Internal.d.ts.map

package/dist/Internal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Internal.d.ts","sourceRoot":"","sources":["../src/Internal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAS,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEvC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAI9C,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAGvD,CAAC;AAEF,eAAO,MAAM,SAAS,GAAI,OAAO,UAAU,EAAE,QAAQ,MAAM,KAAG,UAC1B,CAAC;AAErC,eAAO,MAAM,qBAAqB,GAChC,QAAQ,aAAa,EACrB,MAAM,MAAM,EACZ,OAAO,MAAM,qEAOY,CAAC"}

package/dist/Internal.js

@@ -0,0 +1,12 @@
+import { Clock, Effect } from "effect";
+import { UnixMillis } from "./Identifiers.js";
+const textEncoder = new TextEncoder();
+export const currentUnixMillis = Effect.map(Clock.currentTimeMillis, UnixMillis);
+export const addMillis = (value, millis) => UnixMillis(Number(value) + millis);
+export const timingSafeEqualString = (crypto, left, right) => left.length === right.length
+    ? crypto.timingSafeEqual({
+        left: textEncoder.encode(left),
+        right: textEncoder.encode(right),
+    })
+    : Effect.succeed(false);
+//# sourceMappingURL=Internal.js.map

package/dist/Internal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Internal.js","sourceRoot":"","sources":["../src/Internal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGvC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AAEtC,MAAM,CAAC,MAAM,iBAAiB,GAA8B,MAAM,CAAC,GAAG,CACpE,KAAK,CAAC,iBAAiB,EACvB,UAAU,CACX,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAiB,EAAE,MAAc,EAAc,EAAE,CACzE,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC;AAErC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,MAAqB,EACrB,IAAY,EACZ,KAAa,EACb,EAAE,CACF,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;IAC1B,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC;QACrB,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC;QAC9B,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC;KACjC,CAAC;IACJ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC"}

package/dist/Jwt.d.ts

@@ -0,0 +1,281 @@
+import { Brand, Context, Duration, Effect, Layer, Redacted } from "effect";
+import type * as OptionTypes from "effect/Option";
+import { Crypto } from "./Crypto.js";
+import type { CryptoKey, CryptoService } from "./Crypto.js";
+import { UnixMillis } from "./Identifiers.js";
+export type JwtKeyId = Brand.Branded<string, "auth/JwtKeyId">;
+export declare const JwtKeyId: Brand.Constructor<JwtKeyId>;
+export type JwtToken = Brand.Branded<string, "auth/JwtToken">;
+export declare const JwtToken: Brand.Constructor<JwtToken>;
+export declare const JwtAlgorithms: readonly ["HS256", "RS256", "ES256", "EdDSA"];
+export type JwtAlgorithm = (typeof JwtAlgorithms)[number];
+export type JwtKeyStatus = "active" | "retired" | "disabled";
+export type JwtAudience = string | readonly string[];
+export interface JwtClaims extends Readonly<Record<string, unknown>> {
+    readonly iss?: string;
+    readonly sub?: string;
+    readonly aud?: JwtAudience;
+    readonly exp?: number;
+    readonly nbf?: number;
+    readonly iat?: number;
+    readonly jti?: string;
+}
+export interface JwtHeader extends Readonly<Record<string, unknown>> {
+    readonly typ: "JWT";
+    readonly alg: JwtAlgorithm;
+    readonly kid: JwtKeyId;
+}
+export interface JwtPublicJwk extends Readonly<Record<string, unknown>> {
+    readonly kty: string;
+    readonly kid?: string;
+    readonly use?: string;
+    readonly key_ops?: readonly string[];
+    readonly alg?: string;
+}
+export interface JwtPrivateJwk extends JwtPublicJwk {
+}
+export interface JwksDocument {
+    readonly keys: readonly JwtPublicJwk[];
+}
+export interface JwtKeyRecord {
+    readonly id: JwtKeyId;
+    readonly alg: JwtAlgorithm;
+    readonly status: JwtKeyStatus;
+    readonly secret?: CryptoKey;
+    readonly publicJwk?: JwtPublicJwk;
+    readonly privateJwk?: JwtPrivateJwk;
+    readonly createdAt?: UnixMillis;
+    readonly expiresAt?: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface JwtKeyInfo {
+    readonly id: JwtKeyId;
+    readonly alg: JwtAlgorithm;
+    readonly status: JwtKeyStatus;
+    readonly createdAt?: UnixMillis;
+    readonly expiresAt?: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface JwtSelectSigningKeyInput {
+    readonly alg?: JwtAlgorithm;
+    readonly now?: UnixMillis;
+}
+export interface JwtFindVerificationKeyInput extends JwtSelectSigningKeyInput {
+    readonly kid: JwtKeyId;
+}
+export interface JwtListPublicJwksInput {
+    readonly now?: UnixMillis;
+}
+export type JwtOperation = "issue" | "verify" | "keys" | "jwks" | "revocation" | "signature";
+declare const JwtError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "JwtError";
+} & Readonly<A>;
+export declare class JwtError extends JwtError_base<{
+    readonly operation: JwtOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface JwtKeysService {
+    readonly selectSigningKey: (input?: JwtSelectSigningKeyInput) => Effect.Effect<OptionTypes.Option<JwtKeyRecord>, JwtError>;
+    readonly findVerificationKey: (input: JwtFindVerificationKeyInput) => Effect.Effect<OptionTypes.Option<JwtKeyRecord>, JwtError>;
+    readonly listPublicJwks: (input?: JwtListPublicJwksInput) => Effect.Effect<readonly JwtPublicJwk[], JwtError>;
+}
+declare const JwtKeys_base: Context.ServiceClass<JwtKeys, "auth/JwtKeys", JwtKeysService>;
+export declare class JwtKeys extends JwtKeys_base {
+}
+export declare namespace JwtKeys {
+    const make: (service: JwtKeysService) => JwtKeysService;
+}
+export interface JwtIssueInput {
+    readonly alg?: JwtAlgorithm;
+    readonly issuer?: string;
+    readonly subject?: string;
+    readonly audience?: JwtAudience;
+    readonly expiresAt?: UnixMillis;
+    readonly expiresIn?: Duration.Duration;
+    readonly notBefore?: UnixMillis;
+    readonly issuedAt?: UnixMillis;
+    readonly jwtId?: string;
+    readonly claims?: Readonly<Record<string, unknown>>;
+}
+export interface IssuedJwt {
+    readonly token: Redacted.Redacted<JwtToken>;
+    readonly header: JwtHeader;
+    readonly claims: JwtClaims;
+    readonly key: JwtKeyInfo;
+}
+export interface JwtIssuerService {
+    readonly issue: (input: JwtIssueInput) => Effect.Effect<IssuedJwt, JwtError>;
+}
+declare const JwtIssuer_base: Context.ServiceClass<JwtIssuer, "auth/JwtIssuer", JwtIssuerService>;
+export declare class JwtIssuer extends JwtIssuer_base {
+}
+export declare namespace JwtIssuer {
+    const make: (service: JwtIssuerService) => JwtIssuerService;
+}
+export type JwtVerificationFailureReason = "malformed" | "unsupported_alg" | "unknown_key" | "invalid_signature" | "expired" | "not_yet_valid" | "issuer_mismatch" | "audience_mismatch";
+export interface JwtVerifyInput {
+    readonly token: Redacted.Redacted<string>;
+    readonly issuer?: string;
+    readonly audience?: JwtAudience;
+    readonly now?: UnixMillis;
+    readonly clockTolerance?: Duration.Duration;
+}
+export type JwtVerificationResult = {
+    readonly valid: true;
+    readonly header: JwtHeader;
+    readonly claims: JwtClaims;
+    readonly key: JwtKeyInfo;
+} | {
+    readonly valid: false;
+    readonly reason: JwtVerificationFailureReason;
+};
+export interface JwtVerifierService {
+    readonly verify: (input: JwtVerifyInput) => Effect.Effect<JwtVerificationResult, JwtError>;
+}
+declare const JwtVerifier_base: Context.ServiceClass<JwtVerifier, "auth/JwtVerifier", JwtVerifierService>;
+export declare class JwtVerifier extends JwtVerifier_base {
+}
+export declare namespace JwtVerifier {
+    const make: (service: JwtVerifierService) => JwtVerifierService;
+}
+export interface JwtSignatureKeyInput {
+    readonly alg: JwtAlgorithm;
+    readonly key: JwtKeyRecord;
+}
+export interface JwtSignatureSignInput extends JwtSignatureKeyInput {
+    readonly signingInput: string;
+}
+export interface JwtSignatureVerifyInput extends JwtSignatureSignInput {
+    readonly signature: string;
+}
+export interface JwtSignatureService {
+    readonly supports: (alg: JwtAlgorithm) => boolean;
+    readonly canSign: (input: JwtSignatureKeyInput) => boolean;
+    readonly canVerify: (input: JwtSignatureKeyInput) => boolean;
+    readonly sign: (input: JwtSignatureSignInput) => Effect.Effect<string, JwtError>;
+    readonly verify: (input: JwtSignatureVerifyInput) => Effect.Effect<boolean, JwtError>;
+}
+declare const JwtSignature_base: Context.ServiceClass<JwtSignature, "auth/JwtSignature", JwtSignatureService>;
+export declare class JwtSignature extends JwtSignature_base {
+}
+export declare namespace JwtSignature {
+    const make: (service: JwtSignatureService) => JwtSignatureService;
+}
+export interface JwksService {
+    readonly document: (input?: JwtListPublicJwksInput) => Effect.Effect<JwksDocument, JwtError>;
+}
+declare const Jwks_base: Context.ServiceClass<Jwks, "auth/Jwks", JwksService>;
+export declare class Jwks extends Jwks_base {
+}
+export declare namespace Jwks {
+    const make: (service: JwksService) => JwksService;
+}
+export interface JwtRevocationRecord {
+    readonly jwtId: string;
+    readonly revokedAt: UnixMillis;
+    readonly expiresAt?: UnixMillis;
+    readonly reason?: string;
+}
+export interface JwtRevocationStoreService {
+    readonly revoke: (record: JwtRevocationRecord) => Effect.Effect<void, JwtError>;
+    readonly find: (jwtId: string) => Effect.Effect<OptionTypes.Option<JwtRevocationRecord>, JwtError>;
+}
+declare const JwtRevocationStore_base: Context.ServiceClass<JwtRevocationStore, "auth/JwtRevocationStore", JwtRevocationStoreService>;
+export declare class JwtRevocationStore extends JwtRevocationStore_base {
+}
+export declare namespace JwtRevocationStore {
+    const make: (service: JwtRevocationStoreService) => JwtRevocationStoreService;
+}
+export interface JwtRevokeJwtIdInput {
+    readonly jwtId: string;
+    readonly revokedAt?: UnixMillis;
+    readonly expiresAt?: UnixMillis;
+    readonly reason?: string;
+}
+export interface JwtIsRevokedInput {
+    readonly jwtId: string;
+    readonly now?: UnixMillis;
+}
+export type JwtIntrospectionInactiveReason = JwtVerificationFailureReason | "revoked";
+export type JwtIntrospectionResult = {
+    readonly active: true;
+    readonly header: JwtHeader;
+    readonly claims: JwtClaims;
+    readonly key: JwtKeyInfo;
+    readonly jwtId?: string;
+    readonly expiresAt?: UnixMillis;
+    readonly revoked: false;
+} | {
+    readonly active: false;
+    readonly reason: JwtIntrospectionInactiveReason;
+    readonly jwtId?: string;
+    readonly expiresAt?: UnixMillis;
+    readonly revokedAt?: UnixMillis;
+    readonly revokedReason?: string;
+};
+export interface JwtRevocationService {
+    readonly revokeJwtId: (input: JwtRevokeJwtIdInput) => Effect.Effect<JwtRevocationRecord, JwtError>;
+    readonly isRevoked: (input: JwtIsRevokedInput) => Effect.Effect<boolean, JwtError>;
+    readonly introspect: (input: JwtVerifyInput) => Effect.Effect<JwtIntrospectionResult, JwtError>;
+}
+declare const JwtRevocation_base: Context.ServiceClass<JwtRevocation, "auth/JwtRevocation", JwtRevocationService>;
+export declare class JwtRevocation extends JwtRevocation_base {
+}
+export declare namespace JwtRevocation {
+    const make: (service: JwtRevocationService) => JwtRevocationService;
+}
+export type JwtServiceDependencies = {
+    readonly keys: JwtKeysService;
+} & ({
+    readonly crypto: CryptoService;
+    readonly signature?: JwtSignatureService;
+} | {
+    readonly crypto?: CryptoService;
+    readonly signature: JwtSignatureService;
+});
+export interface JwtSignatureDependencies {
+    readonly crypto: CryptoService;
+}
+export interface JwtWebCryptoRs256SignatureOptions {
+    readonly crypto?: typeof globalThis.crypto;
+}
+export interface JwtWebCryptoEs256SignatureOptions {
+    readonly crypto?: typeof globalThis.crypto;
+}
+export interface JwtWebCryptoEdDsaSignatureOptions {
+    readonly crypto?: typeof globalThis.crypto;
+}
+export interface JwtRevocationDependencies {
+    readonly verifier: JwtVerifierService;
+    readonly store: JwtRevocationStoreService;
+}
+export declare const makeJwtKeysMemory: (records: readonly JwtKeyRecord[]) => JwtKeysService;
+export declare const JwtKeysMemoryLive: (records: readonly JwtKeyRecord[]) => Layer.Layer<JwtKeys, never, never>;
+export declare const makeJwtRevocationStoreMemory: () => JwtRevocationStoreService;
+export declare const JwtRevocationStoreMemoryLive: Layer.Layer<JwtRevocationStore, never, never>;
+export declare const makeJwtRevocation: (dependencies: JwtRevocationDependencies) => JwtRevocationService;
+export declare const makeJwtSignature: (dependencies: JwtSignatureDependencies) => JwtSignatureService;
+export declare const makeJwtWebCryptoRs256Signature: (options?: JwtWebCryptoRs256SignatureOptions) => JwtSignatureService;
+export declare const makeJwtWebCryptoEs256Signature: (options?: JwtWebCryptoEs256SignatureOptions) => JwtSignatureService;
+export declare const makeJwtWebCryptoEdDsaSignature: (options?: JwtWebCryptoEdDsaSignatureOptions) => JwtSignatureService;
+export declare const makeJwtIssuer: (dependencies: JwtServiceDependencies) => JwtIssuerService;
+export declare const makeJwtVerifier: (dependencies: JwtServiceDependencies) => JwtVerifierService;
+export declare const makeJwks: (dependencies: {
+    readonly keys: JwtKeysService;
+}) => JwksService;
+export declare const JwtSignatureLive: Layer.Layer<JwtSignature, never, Crypto>;
+export declare const JwtWebCryptoRs256SignatureLive: (options?: JwtWebCryptoRs256SignatureOptions) => Layer.Layer<JwtSignature, never, never>;
+export declare const JwtWebCryptoEs256SignatureLive: (options?: JwtWebCryptoEs256SignatureOptions) => Layer.Layer<JwtSignature, never, never>;
+export declare const JwtWebCryptoEdDsaSignatureLive: (options?: JwtWebCryptoEdDsaSignatureOptions) => Layer.Layer<JwtSignature, never, never>;
+export declare const JwtIssuerWithSignatureLive: Layer.Layer<JwtIssuer, never, JwtKeys | JwtSignature>;
+export declare const JwtVerifierWithSignatureLive: Layer.Layer<JwtVerifier, never, JwtKeys | JwtSignature>;
+export declare const JwtIssuerLive: Layer.Layer<JwtIssuer, never, Crypto | JwtKeys>;
+export declare const JwtVerifierLive: Layer.Layer<JwtVerifier, never, Crypto | JwtKeys>;
+export declare const JwksLive: Layer.Layer<Jwks, never, JwtKeys>;
+export declare const JwtRevocationLive: Layer.Layer<JwtRevocation, never, JwtVerifier | JwtRevocationStore>;
+export declare const JwtWithSignatureLive: Layer.Layer<JwtIssuer | JwtVerifier | Jwks, never, JwtKeys | JwtSignature>;
+export declare const JwtLive: Layer.Layer<JwtIssuer | JwtVerifier | Jwks, never, Crypto | JwtKeys>;
+export {};
+//# sourceMappingURL=Jwt.d.ts.map

package/dist/Jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Jwt.d.ts","sourceRoot":"","sources":["../src/Jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,OAAO,EAEP,QAAQ,EACR,MAAM,EAEN,KAAK,EAEL,QAAQ,EAET,MAAM,QAAQ,CAAC;AAChB,OAAO,KAAK,KAAK,WAAW,MAAM,eAAe,CAAC;AAElD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG9C,MAAM,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AAC9D,eAAO,MAAM,QAAQ,6BAA4B,CAAC;AAElD,MAAM,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AAC9D,eAAO,MAAM,QAAQ,6BAA4B,CAAC;AAElD,eAAO,MAAM,aAAa,+CAAgD,CAAC;AAC3E,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAC1D,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC;AAE7D,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;AAErD,MAAM,WAAW,SAAU,SAAQ,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,SAAU,SAAQ,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClE,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;CACxB;AAED,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,aAAc,SAAQ,YAAY;CAAG;AAEtD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,SAAS,YAAY,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC;IAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;CAC3B;AAED,MAAM,WAAW,2BAA4B,SAAQ,wBAAwB;IAC3E,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;CAC3B;AAED,MAAM,MAAM,YAAY,GACpB,OAAO,GACP,QAAQ,GACR,MAAM,GACN,MAAM,GACN,YAAY,GACZ,WAAW,CAAC;;;;AAEhB,qBAAa,QAAS,SAAQ,cAA6B;IACzD,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AAEL,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,gBAAgB,EAAE,CACzB,KAAK,CAAC,EAAE,wBAAwB,KAC7B,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC/D,QAAQ,CAAC,mBAAmB,EAAE,CAC5B,KAAK,EAAE,2BAA2B,KAC/B,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC/D,QAAQ,CAAC,cAAc,EAAE,CACvB,KAAK,CAAC,EAAE,sBAAsB,KAC3B,MAAM,CAAC,MAAM,CAAC,SAAS,YAAY,EAAE,EAAE,QAAQ,CAAC,CAAC;CACvD;;AAED,qBAAa,OAAQ,SAAQ,YAE5B;CAAG;AAEJ,yBAAiB,OAAO,CAAC;IAChB,MAAM,IAAI,GAAI,SAAS,cAAc,KAAG,cAC1B,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;CAC9E;;AAED,qBAAa,SAAU,SAAQ,cAE9B;CAAG;AAEJ,yBAAiB,SAAS,CAAC;IAClB,MAAM,IAAI,GAAI,SAAS,gBAAgB,KAAG,gBAC1B,CAAC;CACzB;AAED,MAAM,MAAM,4BAA4B,GACpC,WAAW,GACX,iBAAiB,GACjB,aAAa,GACb,mBAAmB,GACnB,SAAS,GACT,eAAe,GACf,iBAAiB,GACjB,mBAAmB,CAAC;AAExB,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC;CAC7C;AAED,MAAM,MAAM,qBAAqB,GAC7B;IACE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;CAC1B,GACD;IACE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,4BAA4B,CAAC;CAC/C,CAAC;AAEN,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,CACf,KAAK,EAAE,cAAc,KAClB,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC;CACrD;;AAED,qBAAa,WAAY,SAAQ,gBAEhC;CAAG;AAEJ,yBAAiB,WAAW,CAAC;IACpB,MAAM,IAAI,GAAI,SAAS,kBAAkB,KAAG,kBAC1B,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAsB,SAAQ,oBAAoB;IACjE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,uBAAwB,SAAQ,qBAAqB;IACpE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,YAAY,KAAK,OAAO,CAAC;IAClD,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC;IAC3D,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC;IAC7D,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACjF,QAAQ,CAAC,MAAM,EAAE,CACf,KAAK,EAAE,uBAAuB,KAC3B,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;CACvC;;AAED,qBAAa,YAAa,SAAQ,iBAGV;CAAG;AAE3B,yBAAiB,YAAY,CAAC;IACrB,MAAM,IAAI,GAAI,SAAS,mBAAmB,KAAG,mBAC1B,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,CACjB,KAAK,CAAC,EAAE,sBAAsB,KAC3B,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;CAC5C;;AAED,qBAAa,IAAK,SAAQ,SAAiD;CAAG;AAE9E,yBAAiB,IAAI,CAAC;IACb,MAAM,IAAI,GAAI,SAAS,WAAW,KAAG,WAA+B,CAAC;CAC7E;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,mBAAmB,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChF,QAAQ,CAAC,IAAI,EAAE,CACb,KAAK,EAAE,MAAM,KACV,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,QAAQ,CAAC,CAAC;CACvE;;AAED,qBAAa,kBAAmB,SAAQ,uBAGV;CAAG;AAEjC,yBAAiB,kBAAkB,CAAC;IAC3B,MAAM,IAAI,GACf,SAAS,yBAAyB,KACjC,yBAA2D,CAAC;CAChE;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;CAC3B;AAED,MAAM,MAAM,8BAA8B,GACtC,4BAA4B,GAC5B,SAAS,CAAC;AAEd,MAAM,MAAM,sBAAsB,GAC9B;IACE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;CACzB,GACD;IACE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAC;IAChD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AAEN,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,CACpB,KAAK,EAAE,mBAAmB,KACvB,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;IAClD,QAAQ,CAAC,SAAS,EAAE,CAClB,KAAK,EAAE,iBAAiB,KACrB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,CACnB,KAAK,EAAE,cAAc,KAClB,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE,QAAQ,CAAC,CAAC;CACtD;;AAED,qBAAa,aAAc,SAAQ,kBAGV;CAAG;AAE5B,yBAAiB,aAAa,CAAC;IACtB,MAAM,IAAI,GAAI,SAAS,oBAAoB,KAAG,oBAC1B,CAAC;CAC7B;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;CAC/B,GAAG,CACA;IACE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,mBAAmB,CAAC;CAC1C,GACD;IACE,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC,CACJ,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;CAChC;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,UAAU,CAAC,MAAM,CAAC;CAC5C;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,UAAU,CAAC,MAAM,CAAC;CAC5C;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,UAAU,CAAC,MAAM,CAAC;CAC5C;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;CAC3C;AAuGD,eAAO,MAAM,iBAAiB,GAC5B,SAAS,SAAS,YAAY,EAAE,KAC/B,cA2BF,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,SAAS,SAAS,YAAY,EAAE,uCACd,CAAC;AAMrD,eAAO,MAAM,4BAA4B,QAAO,yBAiB/C,CAAC;AAEF,eAAO,MAAM,4BAA4B,+CAExC,CAAC;AAwBF,eAAO,MAAM,iBAAiB,GAC5B,cAAc,yBAAyB,KACtC,oBAkEC,CAAC;AAiQL,eAAO,MAAM,gBAAgB,GAC3B,cAAc,wBAAwB,KACrC,mBA0CC,CAAC;AAEL,eAAO,MAAM,8BAA8B,GACzC,UAAU,iCAAiC,KAC1C,mBAsEC,CAAC;AAEL,eAAO,MAAM,8BAA8B,GACzC,UAAU,iCAAiC,KAC1C,mBAiGC,CAAC;AAEL,eAAO,MAAM,8BAA8B,GACzC,UAAU,iCAAiC,KAC1C,mBAsEC,CAAC;AA8EL,eAAO,MAAM,aAAa,GACxB,cAAc,sBAAsB,KACnC,gBAiDF,CAAC;AAEF,eAAO,MAAM,eAAe,GAC1B,cAAc,sBAAsB,KACnC,kBA2EF,CAAC;AAEF,eAAO,MAAM,QAAQ,GAAI,cAAc;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;CAAE,KAAG,WAQvE,CAAC;AAEL,eAAO,MAAM,gBAAgB,0CAM5B,CAAC;AAEF,eAAO,MAAM,8BAA8B,GACzC,UAAU,iCAAiC,4CAC4B,CAAC;AAE1E,eAAO,MAAM,8BAA8B,GACzC,UAAU,iCAAiC,4CAC4B,CAAC;AAE1E,eAAO,MAAM,8BAA8B,GACzC,UAAU,iCAAiC,4CAC4B,CAAC;AAE1E,eAAO,MAAM,0BAA0B,uDAOtC,CAAC;AAEF,eAAO,MAAM,4BAA4B,yDAOxC,CAAC;AAEF,eAAO,MAAM,aAAa,iDAEzB,CAAC;AAEF,eAAO,MAAM,eAAe,mDAE3B,CAAC;AAEF,eAAO,MAAM,QAAQ,mCAMpB,CAAC;AAEF,eAAO,MAAM,iBAAiB,qEAO7B,CAAC;AAEF,eAAO,MAAM,oBAAoB,4EAIhC,CAAC;AAEF,eAAO,MAAM,OAAO,sEAA6D,CAAC"}