@effect-auth/core 0.1.0-alpha.1 → 0.1.0-alpha.13

package/dist/MachineAuth.js

@@ -0,0 +1,147 @@
+import { Data, Effect, Redacted } from "effect";
+export class MachineAuthError extends Data.TaggedError("MachineAuthError") {
+}
+export const bearerToken = (headers) => {
+    const authorization = headers.get("authorization");
+    if (authorization === null) {
+        return undefined;
+    }
+    const [scheme, token] = authorization.trim().split(/\s+/, 2);
+    return scheme?.toLowerCase() === "bearer" && token !== undefined && token !== ""
+        ? token
+        : undefined;
+};
+export const apiKeyPrefixFromSecret = (secret) => {
+    const separator = secret.indexOf(".");
+    return separator > 0 ? secret.slice(0, separator) : "malformed";
+};
+export const jwtClaimScopes = (claims) => {
+    const { scope, scopes } = claims;
+    if (typeof scope === "string") {
+        return scope.split(/\s+/).filter((value) => value.length > 0);
+    }
+    return Array.isArray(scopes) &&
+        scopes.every((value) => typeof value === "string")
+        ? scopes
+        : [];
+};
+const nonEmptyStringField = (record, key) => {
+    if (key === undefined) {
+        return undefined;
+    }
+    const value = record?.[key];
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+};
+const machineActorMetadataFields = (record, options, defaults) => {
+    const tenantId = nonEmptyStringField(record, options.tenantIdField ?? defaults.tenantIdField);
+    const serviceAccountId = nonEmptyStringField(record, options.serviceAccountIdField ?? defaults.serviceAccountIdField);
+    return {
+        ...(tenantId === undefined ? {} : { tenantId }),
+        ...(serviceAccountId === undefined ? {} : { serviceAccountId }),
+    };
+};
+export const apiKeyMachineActor = (key, options = {}) => ({
+    kind: "api_key",
+    userId: key.userId,
+    keyId: key.id,
+    scopes: key.scopes,
+    key,
+    ...machineActorMetadataFields(key.metadata, options, {
+        tenantIdField: "tenantId",
+        serviceAccountIdField: "serviceAccountId",
+    }),
+});
+export const jwtMachineActor = (input, options = {}) => {
+    const jwtId = typeof input.claims.jti === "string" && input.claims.jti.length > 0
+        ? input.claims.jti
+        : undefined;
+    return {
+        kind: "jwt",
+        subject: input.claims.sub,
+        scopes: input.scopes ?? jwtClaimScopes(input.claims),
+        claims: input.claims,
+        key: input.key,
+        ...(jwtId === undefined ? {} : { jwtId }),
+        ...machineActorMetadataFields(input.claims, options, {
+            tenantIdField: "tenant_id",
+            serviceAccountIdField: "service_account_id",
+        }),
+    };
+};
+const missingScopes = (actorScopes, requiredScopes) => (requiredScopes ?? []).filter((scope) => !actorScopes.includes(scope));
+export const requireMachineScopes = (input) => {
+    const missing = missingScopes(input.actor.scopes, input.scopes);
+    return missing.length === 0
+        ? Effect.succeed(input.actor)
+        : Effect.fail(new MachineAuthError({
+            reason: "missing_scope",
+            message: "Machine credential is missing a required scope",
+        }));
+};
+export const verifyMachineApiKey = (options) => Effect.gen(function* () {
+    const secret = bearerToken(options.headers);
+    if (secret === undefined) {
+        return yield* new MachineAuthError({
+            reason: "missing_bearer",
+            message: "Missing bearer token",
+        });
+    }
+    const result = yield* options.apiKeyVerification
+        .verify({
+        secret: Redacted.make(secret),
+        ...(options.now === undefined ? {} : { now: options.now }),
+        ...(options.verificationMetadata === undefined
+            ? {}
+            : { metadata: options.verificationMetadata }),
+    })
+        .pipe(Effect.mapError((cause) => new MachineAuthError({
+        reason: "verification_failed",
+        message: "Failed to verify machine API key",
+        cause,
+    })));
+    if (!result.valid || result.key === undefined) {
+        return yield* new MachineAuthError({
+            reason: "invalid_api_key",
+            message: "Invalid API key bearer token",
+        });
+    }
+    return yield* requireMachineScopes({
+        actor: apiKeyMachineActor(result.key, options),
+        scopes: options.requiredScopes ?? [],
+    });
+});
+export const verifyMachineJwt = (options) => Effect.gen(function* () {
+    const token = bearerToken(options.headers);
+    if (token === undefined) {
+        return yield* new MachineAuthError({
+            reason: "missing_bearer",
+            message: "Missing bearer token",
+        });
+    }
+    const result = yield* options.jwtVerifier
+        .verify({
+        token: Redacted.make(token),
+        ...(options.issuer === undefined ? {} : { issuer: options.issuer }),
+        ...(options.audience === undefined ? {} : { audience: options.audience }),
+        ...(options.now === undefined ? {} : { now: options.now }),
+        ...(options.clockTolerance === undefined
+            ? {}
+            : { clockTolerance: options.clockTolerance }),
+    })
+        .pipe(Effect.mapError((cause) => new MachineAuthError({
+        reason: "verification_failed",
+        message: "Failed to verify machine JWT",
+        cause,
+    })));
+    if (!result.valid) {
+        return yield* new MachineAuthError({
+            reason: "invalid_jwt",
+            message: "Invalid JWT bearer token",
+        });
+    }
+    return yield* requireMachineScopes({
+        actor: jwtMachineActor(result, options),
+        scopes: options.requiredScopes ?? [],
+    });
+});
+//# sourceMappingURL=MachineAuth.js.map

package/dist/MachineAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MachineAuth.js","sourceRoot":"","sources":["../src/MachineAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAyBhD,MAAM,OAAO,gBAAiB,SAAQ,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAIvE;CAAG;AAiDL,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAgB,EAAsB,EAAE;IAClE,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAEnD,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAE7D,OAAO,MAAM,EAAE,WAAW,EAAE,KAAK,QAAQ,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QAC9E,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,MAAc,EAAU,EAAE;IAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEtC,OAAO,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;AAClE,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAiB,EAAqB,EAAE;IACrE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAEjC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAC1B,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QACnE,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,EAAE,CAAC;AACT,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAC1B,MAAqD,EACrD,GAAuB,EACH,EAAE;IACtB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;IAE5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC,CAAC;AAEF,MAAM,0BAA0B,GAAG,CACjC,MAAqD,EACrD,OAAiC,EACjC,QAA4C,EAChB,EAAE;IAC9B,MAAM,QAAQ,GAAG,mBAAmB,CAClC,MAAM,EACN,OAAO,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAChD,CAAC;IACF,MAAM,gBAAgB,GAAG,mBAAmB,CAC1C,MAAM,EACN,OAAO,CAAC,qBAAqB,IAAI,QAAQ,CAAC,qBAAqB,CAChE,CAAC;IAEF,OAAO;QACL,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC;KAChE,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,GAAe,EACf,UAAoC,EAAE,EAClB,EAAE,CAAC,CAAC;IACxB,IAAI,EAAE,SAAS;IACf,MAAM,EAAE,GAAG,CAAC,MAAM;IAClB,KAAK,EAAE,GAAG,CAAC,EAAE;IACb,MAAM,EAAE,GAAG,CAAC,MAAM;IAClB,GAAG;IACH,GAAG,0BAA0B,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE;QACnD,aAAa,EAAE,UAAU;QACzB,qBAAqB,EAAE,kBAAkB;KAC1C,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,KAIC,EACD,UAAoC,EAAE,EACrB,EAAE;IACnB,MAAM,KAAK,GACT,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;QACjE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG;QAClB,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACL,IAAI,EAAE,KAAK;QACX,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG;QACzB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACzC,GAAG,0BAA0B,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE;YACnD,aAAa,EAAE,WAAW;YAC1B,qBAAqB,EAAE,oBAAoB;SAC5C,CAAC;KACH,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CACpB,WAA8B,EAC9B,cAA6C,EAC1B,EAAE,CACrB,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AAEzE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAyB,KAG5D,EAAsC,EAAE;IACvC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAEhE,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QAC7B,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,IAAI,gBAAgB,CAAC;YACnB,MAAM,EAAE,eAAe;YACvB,OAAO,EAAE,gDAAgD;SAC1D,CAAC,CACH,CAAC;AACR,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,OAAmC,EACkB,EAAE,CACvD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAE5C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,CAAC,IAAI,gBAAgB,CAAC;YACjC,MAAM,EAAE,gBAAgB;YACxB,OAAO,EAAE,sBAAsB;SAChC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,kBAAkB;SAC7C,MAAM,CAAC;QACN,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;QAC7B,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1D,GAAG,CAAC,OAAO,CAAC,oBAAoB,KAAK,SAAS;YAC5C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,oBAAoB,EAAE,CAAC;KAChD,CAAC;SACD,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,gBAAgB,CAAC;QACnB,MAAM,EAAE,qBAAqB;QAC7B,OAAO,EAAE,kCAAkC;QAC3C,KAAK;KACN,CAAC,CACL,CACF,CAAC;IAEJ,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC,CAAC,IAAI,gBAAgB,CAAC;YACjC,MAAM,EAAE,iBAAiB;YACzB,OAAO,EAAE,8BAA8B;SACxC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,oBAAoB,CAAC;QACjC,KAAK,EAAE,kBAAkB,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC;QAC9C,MAAM,EAAE,OAAO,CAAC,cAAc,IAAI,EAAE;KACrC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,OAAgC,EACkB,EAAE,CACpD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAE3C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC,CAAC,IAAI,gBAAgB,CAAC;YACjC,MAAM,EAAE,gBAAgB;YACxB,OAAO,EAAE,sBAAsB;SAChC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW;SACtC,MAAM,CAAC;QACN,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QAC3B,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACnE,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1D,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS;YACtC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC;KAChD,CAAC;SACD,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,gBAAgB,CAAC;QACnB,MAAM,EAAE,qBAAqB;QAC7B,OAAO,EAAE,8BAA8B;QACvC,KAAK;KACN,CAAC,CACL,CACF,CAAC;IAEJ,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC,CAAC,IAAI,gBAAgB,CAAC;YACjC,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,0BAA0B;SACpC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,oBAAoB,CAAC;QACjC,KAAK,EAAE,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC;QACvC,MAAM,EAAE,OAAO,CAAC,cAAc,IAAI,EAAE;KACrC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/MagicLink.d.ts

@@ -0,0 +1,85 @@
+import { Context, Duration, Effect, Layer, Redacted } from "effect";
+import { AuthFlow } from "./AuthFlow.js";
+import type { AuthFlowPrimaryFactorResult, AuthFlowService, AuthResultOf } from "./AuthFlow.js";
+import { Challenge } from "./Challenge.js";
+import type { ChallengeService } from "./Challenge.js";
+import { Crypto } from "./Crypto.js";
+import type { CryptoService } from "./Crypto.js";
+import type { ChallengeId, UnixMillis } from "./Identifiers.js";
+import { Email } from "./Identifiers.js";
+import type { LoginRequestContext } from "./LoginRisk.js";
+import { AuthMailer } from "./Mailer.js";
+import type { AuthMailerService } from "./Mailer.js";
+import { UserStore } from "./Storage.js";
+import type { UserStoreService } from "./Storage.js";
+export interface MagicLinkStartInput {
+    readonly email: Email;
+    readonly secret?: Redacted.Redacted<string>;
+    readonly ttl?: Duration.Duration;
+    readonly locale?: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface MagicLinkStarted {
+    readonly challengeId: ChallengeId;
+    readonly email: Email;
+    readonly expiresAt: UnixMillis;
+}
+export interface MagicLinkVerifyInput {
+    readonly challengeId: ChallengeId;
+    readonly secret: Redacted.Redacted<string>;
+    readonly trustedDeviceToken?: Redacted.Redacted<string>;
+    readonly request?: LoginRequestContext;
+}
+export interface MagicLinkUrlInput extends MagicLinkStarted {
+    readonly secret: Redacted.Redacted<string>;
+    readonly locale?: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+declare const MagicLinkStartError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "MagicLinkStartError";
+} & Readonly<A>;
+export declare class MagicLinkStartError extends MagicLinkStartError_base<{
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+declare const MagicLinkVerifyError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "MagicLinkVerifyError";
+} & Readonly<A>;
+export declare class MagicLinkVerifyError extends MagicLinkVerifyError_base<{
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export type MagicLinkError = MagicLinkStartError | MagicLinkVerifyError;
+export type MagicLinkVerifyResult = AuthFlowPrimaryFactorResult<"magic-link"> | AuthResultOf<"InvalidCredentials" | "AccountDisabled">;
+export interface MagicLinkLoginService {
+    readonly start: (input: MagicLinkStartInput) => Effect.Effect<MagicLinkStarted, MagicLinkStartError>;
+    readonly verify: (input: MagicLinkVerifyInput) => Effect.Effect<MagicLinkVerifyResult, MagicLinkVerifyError>;
+}
+declare const MagicLinkLogin_base: Context.ServiceClass<MagicLinkLogin, "auth/login/MagicLink", MagicLinkLoginService>;
+export declare class MagicLinkLogin extends MagicLinkLogin_base {
+}
+export declare namespace MagicLinkLogin {
+    const make: (service: MagicLinkLoginService) => MagicLinkLoginService;
+}
+export interface MagicLinkOptions {
+    readonly ttl?: Duration.Duration;
+    readonly secretBytes?: number;
+    readonly userIdBytes?: number;
+    readonly makeUrl: (input: MagicLinkUrlInput) => string;
+}
+export interface MagicLinkDependencies extends MagicLinkOptions {
+    readonly challenge: ChallengeService;
+    readonly users: UserStoreService;
+    readonly crypto: CryptoService;
+    readonly authFlow: AuthFlowService;
+    readonly authMailer: AuthMailerService;
+}
+export declare const defaultMagicLinkTtl: Duration.Duration;
+export declare const defaultMagicLinkSecretBytes = 32;
+export declare const makeMagicLinkLogin: (dependencies: MagicLinkDependencies) => MagicLinkLoginService;
+export declare const MagicLinkLoginLive: (options: MagicLinkOptions) => Layer.Layer<MagicLinkLogin, never, Crypto | UserStore | Challenge | AuthMailer | AuthFlow>;
+export declare const MagicLinkFeatureLive: (options: MagicLinkOptions) => Layer.Layer<MagicLinkLogin, never, Crypto | UserStore | Challenge | AuthMailer | AuthFlow>;
+export {};
+//# sourceMappingURL=MagicLink.d.ts.map

package/dist/MagicLink.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MagicLink.d.ts","sourceRoot":"","sources":["../src/MagicLink.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAQ,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAU,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAElF,OAAO,EAAE,QAAQ,EAAc,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EACV,2BAA2B,EAC3B,eAAe,EACf,YAAY,EACb,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,KAAK,EAAU,MAAM,kBAAkB,CAAC;AAEjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,KAAK,EAAW,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAE9D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5C,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;CAChC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxD,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC;CACxC;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;;;;AAED,qBAAa,mBAAoB,SAAQ,yBAEvC;IACA,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;;;;AAEL,qBAAa,oBAAqB,SAAQ,0BAExC;IACA,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AAEL,MAAM,MAAM,cAAc,GAAG,mBAAmB,GAAG,oBAAoB,CAAC;AAExE,MAAM,MAAM,qBAAqB,GAC7B,2BAA2B,CAAC,YAAY,CAAC,GACzC,YAAY,CAAC,oBAAoB,GAAG,iBAAiB,CAAC,CAAC;AAE3D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,CACd,KAAK,EAAE,mBAAmB,KACvB,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;IAC1D,QAAQ,CAAC,MAAM,EAAE,CACf,KAAK,EAAE,oBAAoB,KACxB,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;CACjE;;AAED,qBAAa,cAAe,SAAQ,mBAGT;CAAG;AAE9B,yBAAiB,cAAc,CAAC;IACvB,MAAM,IAAI,GAAI,SAAS,qBAAqB,KAAG,qBAC1B,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,MAAM,CAAC;CACxD;AAED,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC7D,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;CACxC;AAMD,eAAO,MAAM,mBAAmB,mBAAuB,CAAC;AACxD,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAwJ9C,eAAO,MAAM,kBAAkB,GAC7B,cAAc,qBAAqB,KAClC,qBAwIF,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAAI,SAAS,gBAAgB,+FAkBzD,CAAC;AAEJ,eAAO,MAAM,oBAAoB,YApBW,gBAAgB,+FAoBN,CAAC"}

package/dist/MagicLink.js

@@ -0,0 +1,206 @@
+import { Context, Data, Duration, Effect, Layer, Option, Redacted } from "effect";
+import { AuthFlow, AuthResult } from "./AuthFlow.js";
+import { Challenge } from "./Challenge.js";
+import { Crypto } from "./Crypto.js";
+import { Email, UserId } from "./Identifiers.js";
+import { currentUnixMillis } from "./Internal.js";
+import { AuthMailer } from "./Mailer.js";
+import { UserStore } from "./Storage.js";
+export class MagicLinkStartError extends Data.TaggedError("MagicLinkStartError") {
+}
+export class MagicLinkVerifyError extends Data.TaggedError("MagicLinkVerifyError") {
+}
+export class MagicLinkLogin extends Context.Service()("auth/login/MagicLink") {
+}
+(function (MagicLinkLogin) {
+    MagicLinkLogin.make = (service) => MagicLinkLogin.of(service);
+})(MagicLinkLogin || (MagicLinkLogin = {}));
+export const defaultMagicLinkTtl = Duration.minutes(15);
+export const defaultMagicLinkSecretBytes = 32;
+const verifiedExistingUser = (users, user) => Effect.gen(function* () {
+    if (user.disabledAt !== undefined) {
+        return AuthResult.AccountDisabled();
+    }
+    if (user.emailVerified) {
+        return { _tag: "User", user };
+    }
+    const updatedAt = yield* currentUnixMillis;
+    const updated = yield* users
+        .markEmailVerified({ userId: user.id, updatedAt })
+        .pipe(Effect.mapError((cause) => new MagicLinkVerifyError({
+        message: "Failed to mark email verified",
+        cause,
+    })));
+    if (Option.isNone(updated)) {
+        return yield* new MagicLinkVerifyError({ message: "User not found" });
+    }
+    return { _tag: "User", user: updated.value };
+});
+const findByEmail = (users, email) => users.findByEmail(email).pipe(Effect.mapError((cause) => new MagicLinkVerifyError({
+    message: "Failed to load user by email",
+    cause,
+})));
+const createVerifiedUser = (dependencies, email) => Effect.gen(function* () {
+    const now = yield* currentUnixMillis;
+    const userId = UserId(yield* dependencies.crypto
+        .randomToken(dependencies.userIdBytes ?? 16)
+        .pipe(Effect.mapError((cause) => new MagicLinkVerifyError({
+        message: "Failed to generate user id",
+        cause,
+    }))));
+    const user = {
+        id: userId,
+        email,
+        emailVerified: true,
+        createdAt: now,
+        updatedAt: now,
+    };
+    return yield* dependencies.users.insert(user).pipe(Effect.as({ _tag: "User", user }), Effect.catchTag("StorageError", (cause) => findByEmail(dependencies.users, email).pipe(Effect.flatMap((existing) => Option.isSome(existing)
+        ? verifiedExistingUser(dependencies.users, existing.value)
+        : Effect.fail(new MagicLinkVerifyError({
+            message: "Failed to create user",
+            cause,
+        }))))));
+});
+const findOrCreateVerifiedUser = (dependencies, email) => Effect.gen(function* () {
+    const existing = yield* findByEmail(dependencies.users, email);
+    if (Option.isSome(existing)) {
+        return yield* verifiedExistingUser(dependencies.users, existing.value);
+    }
+    return yield* createVerifiedUser(dependencies, email);
+});
+const invalidateChallenge = (challenge, id) => challenge
+    .consume(id)
+    .pipe(Effect.catchTag("ChallengeConsumeError", () => Effect.void));
+const startSecret = (crypto, input, secretBytes) => {
+    if (input.secret !== undefined) {
+        return Effect.succeed(Redacted.make(Redacted.value(input.secret).trim()));
+    }
+    return crypto.randomToken(secretBytes).pipe(Effect.map(Redacted.make), Effect.mapError((cause) => new MagicLinkStartError({
+        message: "Failed to generate magic link secret",
+        cause,
+    })));
+};
+const makeMagicLinkUrl = (dependencies, input) => Effect.try({
+    try: () => dependencies.makeUrl(input),
+    catch: (cause) => new MagicLinkStartError({
+        message: "Failed to build magic link URL",
+        cause,
+    }),
+});
+const verifySecret = (secret) => Redacted.make(Redacted.value(secret).trim());
+export const makeMagicLinkLogin = (dependencies) => {
+    const ttl = dependencies.ttl ?? defaultMagicLinkTtl;
+    const secretBytes = dependencies.secretBytes ?? defaultMagicLinkSecretBytes;
+    return MagicLinkLogin.make({
+        start: Effect.fn("auth.magic_link.start")(function* (input) {
+            yield* Effect.annotateCurrentSpan("auth.method", "magic-link");
+            const secret = yield* startSecret(dependencies.crypto, input, secretBytes);
+            const issued = yield* dependencies.challenge
+                .issue({
+                type: "magic-link",
+                subject: input.email,
+                ttl: input.ttl ?? ttl,
+                secret,
+                metadata: input.metadata,
+            })
+                .pipe(Effect.mapError((cause) => new MagicLinkStartError({
+                message: "Failed to issue magic link challenge",
+                cause,
+            })));
+            const started = {
+                challengeId: issued.id,
+                email: input.email,
+                expiresAt: issued.expiresAt,
+            };
+            const url = yield* makeMagicLinkUrl(dependencies, {
+                ...started,
+                secret,
+                locale: input.locale,
+                metadata: input.metadata,
+            }).pipe(Effect.matchEffect({
+                onSuccess: Effect.succeed,
+                onFailure: (error) => invalidateChallenge(dependencies.challenge, issued.id).pipe(Effect.flatMap(() => Effect.fail(error))),
+            }));
+            yield* dependencies.authMailer
+                .send({
+                _tag: "MagicLink",
+                to: input.email,
+                challengeId: issued.id,
+                url,
+                expiresAt: issued.expiresAt,
+                locale: input.locale,
+                metadata: input.metadata,
+            })
+                .pipe(Effect.matchEffect({
+                onSuccess: () => Effect.void,
+                onFailure: (cause) => invalidateChallenge(dependencies.challenge, issued.id).pipe(Effect.flatMap(() => Effect.fail(new MagicLinkStartError({
+                    message: "Failed to send magic link",
+                    cause,
+                })))),
+            }));
+            return started;
+        }),
+        verify: Effect.fn("auth.magic_link.verify")(function* (input) {
+            yield* Effect.annotateCurrentSpan("auth.method", "magic-link");
+            const verifiedOption = yield* dependencies.challenge
+                .verify({
+                challengeId: input.challengeId,
+                type: "magic-link",
+                secret: verifySecret(input.secret),
+            })
+                .pipe(Effect.match({
+                onSuccess: Option.some,
+                onFailure: () => Option.none(),
+            }));
+            if (Option.isNone(verifiedOption)) {
+                yield* Effect.annotateCurrentSpan("auth.result", "InvalidCredentials");
+                return AuthResult.InvalidCredentials();
+            }
+            const email = Email(verifiedOption.value.subject);
+            const userResult = yield* findOrCreateVerifiedUser(dependencies, email);
+            if (userResult._tag === "AccountDisabled") {
+                yield* Effect.annotateCurrentSpan("auth.result", "AccountDisabled");
+                return userResult;
+            }
+            return yield* dependencies.authFlow
+                .completePrimaryFactor({
+                userId: userResult.user.id,
+                email: userResult.user.email,
+                intent: "sign-in",
+                method: "magic-link",
+                amr: ["email", "link"],
+                aal: "aal1",
+                claims: { emailVerified: true },
+                ...(input.trustedDeviceToken === undefined
+                    ? {}
+                    : { trustedDeviceToken: input.trustedDeviceToken }),
+                ...(input.request === undefined ? {} : { request: input.request }),
+                ...(verifiedOption.value.metadata === undefined
+                    ? {}
+                    : { metadata: verifiedOption.value.metadata }),
+            })
+                .pipe(Effect.mapError((cause) => new MagicLinkVerifyError({
+                message: "Failed to complete magic link authentication",
+                cause,
+            })));
+        }),
+    });
+};
+export const MagicLinkLoginLive = (options) => Layer.effect(MagicLinkLogin)(Effect.gen(function* () {
+    const challenge = yield* Challenge;
+    const users = yield* UserStore;
+    const crypto = yield* Crypto;
+    const authFlow = yield* AuthFlow;
+    const authMailer = yield* AuthMailer;
+    return makeMagicLinkLogin({
+        ...options,
+        challenge,
+        users,
+        crypto,
+        authFlow,
+        authMailer,
+    });
+}));
+export const MagicLinkFeatureLive = MagicLinkLoginLive;
+//# sourceMappingURL=MagicLink.js.map

package/dist/MagicLink.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MagicLink.js","sourceRoot":"","sources":["../src/MagicLink.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAElF,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAMrD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAGrC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AA8BzC,MAAM,OAAO,mBAAoB,SAAQ,IAAI,CAAC,WAAW,CACvD,qBAAqB,CAIrB;CAAG;AAEL,MAAM,OAAO,oBAAqB,SAAQ,IAAI,CAAC,WAAW,CACxD,sBAAsB,CAItB;CAAG;AAiBL,MAAM,OAAO,cAAe,SAAQ,OAAO,CAAC,OAAO,EAGhD,CAAC,sBAAsB,CAAC;CAAG;AAE9B,WAAiB,cAAc;IAChB,mBAAI,GAAG,CAAC,OAA8B,EAAyB,EAAE,CAC5E,cAAc,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC,EAHgB,cAAc,KAAd,cAAc,QAG9B;AAqBD,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AACxD,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAE9C,MAAM,oBAAoB,GAAG,CAC3B,KAAuB,EACvB,IAAa,EAC+C,EAAE,CAC9D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,UAAU,CAAC,eAAe,EAAE,CAAC;IACtC,CAAC;IAED,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,CAAC;IACzC,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,KAAK;SACzB,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC;SACjD,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,oBAAoB,CAAC;QACvB,OAAO,EAAE,+BAA+B;QACxC,KAAK;KACN,CAAC,CACL,CACF,CAAC;IAEJ,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;AACxD,CAAC,CAAC,CAAC;AAEL,MAAM,WAAW,GAAG,CAAC,KAAuB,EAAE,KAAY,EAAE,EAAE,CAC5D,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CAC3B,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,oBAAoB,CAAC;IACvB,OAAO,EAAE,8BAA8B;IACvC,KAAK;CACN,CAAC,CACL,CACF,CAAC;AAEJ,MAAM,kBAAkB,GAAG,CACzB,YAA6E,EAC7E,KAAY,EACgD,EAAE,CAC9D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,CACnB,KAAK,CAAC,CAAC,YAAY,CAAC,MAAM;SACvB,WAAW,CAAC,YAAY,CAAC,WAAW,IAAI,EAAE,CAAC;SAC3C,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,oBAAoB,CAAC;QACvB,OAAO,EAAE,4BAA4B;QACrC,KAAK;KACN,CAAC,CACL,CACF,CACJ,CAAC;IACF,MAAM,IAAI,GAAY;QACpB,EAAE,EAAE,MAAM;QACV,KAAK;QACL,aAAa,EAAE,IAAI;QACnB,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;KACf,CAAC;IAEF,OAAO,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAChD,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,CAAC,EAC1C,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CACxC,WAAW,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,IAAI,CACzC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QACrB,CAAC,CAAC,oBAAoB,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;QAC1D,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,IAAI,oBAAoB,CAAC;YACvB,OAAO,EAAE,uBAAuB;YAChC,KAAK;SACN,CAAC,CACH,CACN,CACF,CACF,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL,MAAM,wBAAwB,GAAG,CAC/B,YAA6E,EAC7E,KAAY,EACgD,EAAE,CAC9D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAE/D,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,CAAC,oBAAoB,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,kBAAkB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;AACxD,CAAC,CAAC,CAAC;AAEL,MAAM,mBAAmB,GAAG,CAC1B,SAA2B,EAC3B,EAAe,EACM,EAAE,CACvB,SAAS;KACN,OAAO,CAAC,EAAE,CAAC;KACX,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAEvE,MAAM,WAAW,GAAG,CAClB,MAAqB,EACrB,KAA0B,EAC1B,WAAmB,EAC4C,EAAE;IACjE,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,IAAI,CACzC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EACzB,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,mBAAmB,CAAC;QACtB,OAAO,EAAE,sCAAsC;QAC/C,KAAK;KACN,CAAC,CACL,CACF,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CACvB,YAAmC,EACnC,KAAwB,EACoB,EAAE,CAC9C,MAAM,CAAC,GAAG,CAAC;IACT,GAAG,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC;IACtC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,IAAI,mBAAmB,CAAC;QACtB,OAAO,EAAE,gCAAgC;QACzC,KAAK;KACN,CAAC;CACL,CAAC,CAAC;AAEL,MAAM,YAAY,GAAG,CACnB,MAAiC,EACN,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAE7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,YAAmC,EACZ,EAAE;IACzB,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,IAAI,mBAAmB,CAAC;IACpD,MAAM,WAAW,GAAG,YAAY,CAAC,WAAW,IAAI,2BAA2B,CAAC;IAE5E,OAAO,cAAc,CAAC,IAAI,CAAC;QACzB,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,QAAQ,CAAC,EACjD,KAA0B;YAE1B,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;YAE/D,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;YAC3E,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,SAAS;iBACzC,KAAK,CAAC;gBACL,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,KAAK,CAAC,KAAK;gBACpB,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,GAAG;gBACrB,MAAM;gBACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,mBAAmB,CAAC;gBACtB,OAAO,EAAE,sCAAsC;gBAC/C,KAAK;aACN,CAAC,CACL,CACF,CAAC;YACJ,MAAM,OAAO,GAAG;gBACd,WAAW,EAAE,MAAM,CAAC,EAAE;gBACtB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC;YACF,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC,YAAY,EAAE;gBAChD,GAAG,OAAO;gBACV,MAAM;gBACN,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,WAAW,CAAC;gBACjB,SAAS,EAAE,MAAM,CAAC,OAAO;gBACzB,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CACnB,mBAAmB,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CACzD,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CACzC;aACJ,CAAC,CACH,CAAC;YAEF,KAAK,CAAC,CAAC,YAAY,CAAC,UAAU;iBAC3B,IAAI,CAAC;gBACJ,IAAI,EAAE,WAAW;gBACjB,EAAE,EAAE,KAAK,CAAC,KAAK;gBACf,WAAW,EAAE,MAAM,CAAC,EAAE;gBACtB,GAAG;gBACH,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,WAAW,CAAC;gBACjB,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI;gBAC5B,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CACnB,mBAAmB,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CACzD,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAClB,MAAM,CAAC,IAAI,CACT,IAAI,mBAAmB,CAAC;oBACtB,OAAO,EAAE,2BAA2B;oBACpC,KAAK;iBACN,CAAC,CACH,CACF,CACF;aACJ,CAAC,CACH,CAAC;YAEJ,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC,QAAQ,CAAC,EACnD,KAA2B;YAE3B,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;YAE/D,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,SAAS;iBACjD,MAAM,CAAC;gBACN,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,IAAI,EAAE,YAAY;gBAClB,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC;aACnC,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,KAAK,CAAC;gBACX,SAAS,EAAE,MAAM,CAAC,IAAI;gBACtB,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE;aAC/B,CAAC,CACH,CAAC;YAEJ,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;gBAClC,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAC;gBACvE,OAAO,UAAU,CAAC,kBAAkB,EAAE,CAAC;YACzC,CAAC;YAED,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAClD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,wBAAwB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YAExE,IAAI,UAAU,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBAC1C,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;gBACpE,OAAO,UAAU,CAAC;YACpB,CAAC;YAED,OAAO,KAAK,CAAC,CAAC,YAAY,CAAC,QAAQ;iBAChC,qBAAqB,CAAC;gBACrB,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE;gBAC1B,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK;gBAC5B,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,YAAY;gBACpB,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;gBACtB,GAAG,EAAE,MAAM;gBACX,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;gBAC/B,GAAG,CAAC,KAAK,CAAC,kBAAkB,KAAK,SAAS;oBACxC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAC;gBACrD,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;gBAClE,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS;oBAC7C,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;aACjD,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,oBAAoB,CAAC;gBACvB,OAAO,EAAE,8CAA8C;gBACvD,KAAK;aACN,CAAC,CACL,CACF,CAAC;QACN,CAAC,CAAC;KACH,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAyB,EAAE,EAAE,CAC9D,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAC1B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC;IAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC;IAC7B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC;IACjC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC;IAErC,OAAO,kBAAkB,CAAC;QACxB,GAAG,OAAO;QACV,SAAS;QACT,KAAK;QACL,MAAM;QACN,QAAQ;QACR,UAAU;KACX,CAAC,CAAC;AACL,CAAC,CAAC,CACH,CAAC;AAEJ,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC"}

package/dist/Mailer.d.ts

@@ -0,0 +1,147 @@
+import { Context, Effect, Layer, Redacted } from "effect";
+import type { ChallengeId, Email, SessionId, UnixMillis, UserId } from "./Identifiers.js";
+import type { LoginRequestContext } from "./LoginRisk.js";
+export type EmailAddress = Email | {
+    readonly email: Email;
+    readonly name?: string;
+};
+export interface EmailMessage {
+    readonly from?: EmailAddress;
+    readonly to: EmailAddress | readonly EmailAddress[];
+    readonly cc?: EmailAddress | readonly EmailAddress[];
+    readonly bcc?: EmailAddress | readonly EmailAddress[];
+    readonly replyTo?: EmailAddress;
+    readonly subject: string;
+    readonly text?: string;
+    readonly html?: string;
+    readonly headers?: Readonly<Record<string, string>>;
+}
+declare const EmailSendError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "EmailSendError";
+} & Readonly<A>;
+export declare class EmailSendError extends EmailSendError_base<{
+    readonly provider?: string;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface MailerService {
+    readonly send: (message: EmailMessage) => Effect.Effect<void, EmailSendError>;
+}
+declare const Mailer_base: Context.ServiceClass<Mailer, "auth/Mailer", MailerService>;
+export declare class Mailer extends Mailer_base {
+}
+export declare namespace Mailer {
+    const make: (service: MailerService) => MailerService;
+}
+export interface AuthEmailBase {
+    readonly to: Email;
+    readonly locale?: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface AuthEmailOtp extends AuthEmailBase {
+    readonly _tag: "EmailOtp";
+    readonly challengeId: ChallengeId;
+    readonly secret: Redacted.Redacted<string>;
+    readonly expiresAt: UnixMillis;
+}
+export interface AuthMagicLinkEmail extends AuthEmailBase {
+    readonly _tag: "MagicLink";
+    readonly challengeId: ChallengeId;
+    readonly url: string;
+    readonly expiresAt: UnixMillis;
+}
+export interface AuthPasswordResetEmail extends AuthEmailBase {
+    readonly _tag: "PasswordReset";
+    readonly challengeId: ChallengeId;
+    readonly url: string;
+    readonly expiresAt: UnixMillis;
+}
+export interface AuthEmailVerificationEmail extends AuthEmailBase {
+    readonly _tag: "EmailVerification";
+    readonly challengeId: ChallengeId;
+    readonly userId?: UserId;
+    readonly secret?: Redacted.Redacted<string>;
+    readonly url?: string;
+    readonly expiresAt: UnixMillis;
+}
+export interface AuthLoginApprovalEmail extends AuthEmailBase {
+    readonly _tag: "LoginApproval";
+    readonly challengeId: ChallengeId;
+    readonly userId: UserId;
+    readonly secret?: Redacted.Redacted<string>;
+    readonly url?: string;
+    readonly expiresAt: UnixMillis;
+    readonly reason: string;
+    readonly sessionBinding: "originating-device" | "approval-device" | "none";
+    readonly sameDeviceRequired: boolean;
+}
+export interface AuthLoginNotificationEmail extends AuthEmailBase {
+    readonly _tag: "LoginNotification";
+    readonly userId: UserId;
+    readonly sessionId: SessionId;
+    readonly method: string;
+    readonly reason: string;
+    readonly deviceStatus: string;
+    readonly request?: LoginRequestContext;
+    readonly occurredAt: UnixMillis;
+    readonly reportChallengeId?: ChallengeId;
+    readonly reportUrl?: string;
+    readonly reportExpiresAt?: UnixMillis;
+}
+export type AuthEmail = AuthEmailOtp | AuthMagicLinkEmail | AuthPasswordResetEmail | AuthEmailVerificationEmail | AuthLoginApprovalEmail | AuthLoginNotificationEmail;
+export interface RenderedEmail {
+    readonly from?: EmailAddress;
+    readonly subject: string;
+    readonly text?: string;
+    readonly html?: string;
+    readonly headers?: Readonly<Record<string, string>>;
+}
+declare const AuthEmailTemplateError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "AuthEmailTemplateError";
+} & Readonly<A>;
+export declare class AuthEmailTemplateError extends AuthEmailTemplateError_base<{
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface AuthEmailTemplatesService {
+    readonly render: (input: AuthEmail) => Effect.Effect<RenderedEmail, AuthEmailTemplateError>;
+}
+declare const AuthEmailTemplates_base: Context.ServiceClass<AuthEmailTemplates, "auth/AuthEmailTemplates", AuthEmailTemplatesService>;
+export declare class AuthEmailTemplates extends AuthEmailTemplates_base {
+}
+export declare namespace AuthEmailTemplates {
+    const make: (service: AuthEmailTemplatesService) => AuthEmailTemplatesService;
+}
+declare const AuthMailerError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "AuthMailerError";
+} & Readonly<A>;
+export declare class AuthMailerError extends AuthMailerError_base<{
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface AuthMailerService {
+    readonly send: (input: AuthEmail) => Effect.Effect<void, AuthMailerError>;
+}
+declare const AuthMailer_base: Context.ServiceClass<AuthMailer, "auth/AuthMailer", AuthMailerService>;
+export declare class AuthMailer extends AuthMailer_base {
+}
+export declare namespace AuthMailer {
+    const make: (service: AuthMailerService) => AuthMailerService;
+}
+export interface AuthMailerOptions {
+    readonly from?: EmailAddress;
+}
+export interface AuthMailerDependencies extends AuthMailerOptions {
+    readonly mailer: MailerService;
+    readonly templates: AuthEmailTemplatesService;
+}
+export declare const makeDefaultAuthEmailTemplates: () => AuthEmailTemplatesService;
+export declare const AuthEmailTemplatesLive: Layer.Layer<AuthEmailTemplates, never, never>;
+export declare const makeAuthMailer: (dependencies: AuthMailerDependencies) => AuthMailerService;
+export declare const AuthMailerLive: (options?: AuthMailerOptions) => Layer.Layer<AuthMailer, never, Mailer | AuthEmailTemplates>;
+export declare const MailerNoopLive: Layer.Layer<Mailer, never, never>;
+export {};
+//# sourceMappingURL=Mailer.d.ts.map

package/dist/Mailer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Mailer.d.ts","sourceRoot":"","sources":["../src/Mailer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAQ,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAEhE,OAAO,KAAK,EACV,WAAW,EACX,KAAK,EACL,SAAS,EACT,UAAU,EACV,MAAM,EACP,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,MAAM,MAAM,YAAY,GACpB,KAAK,GACL;IACE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEN,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,EAAE,EAAE,YAAY,GAAG,SAAS,YAAY,EAAE,CAAC;IACpD,QAAQ,CAAC,EAAE,CAAC,EAAE,YAAY,GAAG,SAAS,YAAY,EAAE,CAAC;IACrD,QAAQ,CAAC,GAAG,CAAC,EAAE,YAAY,GAAG,SAAS,YAAY,EAAE,CAAC;IACtD,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACrD;;;;AAED,qBAAa,cAAe,SAAQ,oBAAmC;IACrE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AAEL,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;CAC/E;;AAED,qBAAa,MAAO,SAAQ,WAE3B;CAAG;AAEJ,yBAAiB,MAAM,CAAC;IACf,MAAM,IAAI,GAAI,SAAS,aAAa,KAAG,aAC1B,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;CAChC;AAED,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACvD,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;CAChC;AAED,MAAM,WAAW,sBAAuB,SAAQ,aAAa;IAC3D,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;CAChC;AAED,MAAM,WAAW,0BAA2B,SAAQ,aAAa;IAC/D,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;CAChC;AAED,MAAM,WAAW,sBAAuB,SAAQ,aAAa;IAC3D,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,cAAc,EAAE,oBAAoB,GAAG,iBAAiB,GAAG,MAAM,CAAC;IAC3E,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;CACtC;AAED,MAAM,WAAW,0BAA2B,SAAQ,aAAa;IAC/D,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,WAAW,CAAC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,eAAe,CAAC,EAAE,UAAU,CAAC;CACvC;AAED,MAAM,MAAM,SAAS,GACjB,YAAY,GACZ,kBAAkB,GAClB,sBAAsB,GACtB,0BAA0B,GAC1B,sBAAsB,GACtB,0BAA0B,CAAC;AAE/B,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACrD;;;;AAED,qBAAa,sBAAuB,SAAQ,4BAE1C;IACA,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AAEL,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,CACf,KAAK,EAAE,SAAS,KACb,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAC;CAC3D;;AAED,qBAAa,kBAAmB,SAAQ,uBAGV;CAAG;AAEjC,yBAAiB,kBAAkB,CAAC;IAC3B,MAAM,IAAI,GACf,SAAS,yBAAyB,KACjC,yBAA2D,CAAC;CAChE;;;;AAED,qBAAa,eAAgB,SAAQ,qBAAoC;IACvE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AAEL,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;CAC3E;;AAED,qBAAa,UAAW,SAAQ,eAGV;CAAG;AAEzB,yBAAiB,UAAU,CAAC;IACnB,MAAM,IAAI,GAAI,SAAS,iBAAiB,KAAG,iBAC1B,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;CAC9B;AAED,MAAM,WAAW,sBAAuB,SAAQ,iBAAiB;IAC/D,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,yBAAyB,CAAC;CAC/C;AAuED,eAAO,MAAM,6BAA6B,QAAO,yBAyG7C,CAAC;AAEL,eAAO,MAAM,sBAAsB,+CAGlC,CAAC;AAmBF,eAAO,MAAM,cAAc,GACzB,cAAc,sBAAsB,KACnC,iBA2BC,CAAC;AAEL,eAAO,MAAM,cAAc,GAAI,UAAS,iBAAsB,gEAY3D,CAAC;AAEJ,eAAO,MAAM,cAAc,mCAK1B,CAAC"}