@effect-auth/core 0.1.0-alpha.1 → 0.1.0-alpha.13

package/dist/Passkey.js

@@ -0,0 +1,422 @@
+import { Brand, Context, Data, Duration, Effect, Layer, Option, Redacted } from "effect";
+import { Challenge } from "./Challenge.js";
+import { Crypto } from "./Crypto.js";
+import { CredentialId } from "./Identifiers.js";
+import { currentUnixMillis } from "./Internal.js";
+export const PasskeyCredentialId = Brand.nominal();
+export const passkeyRegistrationChallengeType = "passkey-registration";
+export const passkeyAuthenticationChallengeType = "passkey-authentication";
+export const defaultPasskeyChallengeBytes = 32;
+export const defaultPasskeyChallengeTtl = Duration.minutes(5);
+export class PasskeyCredentialStoreError extends Data.TaggedError("PasskeyCredentialStoreError") {
+}
+export class PasskeyCredentialStore extends Context.Service()("auth/PasskeyCredentialStore") {
+}
+(function (PasskeyCredentialStore) {
+    PasskeyCredentialStore.make = (service) => PasskeyCredentialStore.of(service);
+})(PasskeyCredentialStore || (PasskeyCredentialStore = {}));
+const cloneCredential = (record) => structuredClone(record);
+export const makePasskeyCredentialStoreMemory = () => {
+    const credentials = new Map();
+    return PasskeyCredentialStore.make({
+        insert: (row) => Effect.sync(() => {
+            credentials.set(row.credentialId, cloneCredential(row));
+        }),
+        findByCredentialId: (credentialId) => Effect.sync(() => {
+            const row = credentials.get(credentialId);
+            return row === undefined ? Option.none() : Option.some(cloneCredential(row));
+        }),
+        listByUser: (input) => Effect.sync(() => [...credentials.values()]
+            .filter((row) => row.userId === input.userId &&
+            (input.includeRevoked === true || row.revokedAt === undefined))
+            .map(cloneCredential)),
+        updateSignCount: (input) => Effect.sync(() => {
+            const row = credentials.get(input.credentialId);
+            if (row === undefined || row.revokedAt !== undefined) {
+                return Option.none();
+            }
+            const updated = {
+                ...row,
+                signCount: input.signCount,
+                lastUsedAt: input.lastUsedAt,
+                metadata: input.metadata ?? row.metadata,
+            };
+            credentials.set(input.credentialId, updated);
+            return Option.some(cloneCredential(updated));
+        }),
+        revoke: (input) => Effect.sync(() => {
+            const row = credentials.get(input.credentialId);
+            if (row !== undefined) {
+                credentials.set(input.credentialId, {
+                    ...row,
+                    revokedAt: input.revokedAt,
+                    metadata: input.reason === undefined
+                        ? row.metadata
+                        : { ...row.metadata, revokeReason: input.reason },
+                });
+            }
+        }),
+    });
+};
+export const PasskeyCredentialStoreMemoryLive = Layer.sync(PasskeyCredentialStore)(makePasskeyCredentialStoreMemory);
+export class PasskeyCredentialManagementError extends Data.TaggedError("PasskeyCredentialManagementError") {
+}
+export class PasskeyCredentialManagement extends Context.Service()("auth/PasskeyCredentialManagement") {
+}
+(function (PasskeyCredentialManagement) {
+    PasskeyCredentialManagement.make = (service) => PasskeyCredentialManagement.of(service);
+})(PasskeyCredentialManagement || (PasskeyCredentialManagement = {}));
+const credentialInfo = (credential) => ({
+    credentialId: credential.credentialId,
+    ...(credential.transports === undefined
+        ? {}
+        : { transports: credential.transports }),
+    ...(credential.backedUp === undefined ? {} : { backedUp: credential.backedUp }),
+    createdAt: credential.createdAt,
+    ...(credential.lastUsedAt === undefined
+        ? {}
+        : { lastUsedAt: credential.lastUsedAt }),
+    ...(credential.revokedAt === undefined
+        ? {}
+        : { revokedAt: credential.revokedAt }),
+    ...(credential.metadata === undefined ? {} : { metadata: credential.metadata }),
+});
+const passkeyCredentialManagementError = (operation, message, cause) => new PasskeyCredentialManagementError({
+    operation,
+    message,
+    ...(cause === undefined ? {} : { cause }),
+});
+export const makePasskeyCredentialManagement = (dependencies) => PasskeyCredentialManagement.make({
+    listForUser: Effect.fn("auth.passkey.credential_management.list")(function* (input) {
+        const credentials = yield* dependencies.credentialStore
+            .listByUser({
+            userId: input.userId,
+            ...(input.includeRevoked === undefined
+                ? {}
+                : { includeRevoked: input.includeRevoked }),
+        })
+            .pipe(Effect.mapError((cause) => passkeyCredentialManagementError("list", "Failed to list passkey credentials", cause)));
+        return credentials.map(credentialInfo);
+    }),
+    revokeForUser: Effect.fn("auth.passkey.credential_management.revoke")(function* (input) {
+        const credential = yield* dependencies.credentialStore
+            .findByCredentialId(input.credentialId)
+            .pipe(Effect.mapError((cause) => passkeyCredentialManagementError("revoke", "Failed to load passkey credential", cause)));
+        if (Option.isNone(credential) || credential.value.userId !== input.userId) {
+            return yield* passkeyCredentialManagementError("revoke", "Passkey credential not found");
+        }
+        if (credential.value.revokedAt !== undefined) {
+            return;
+        }
+        const revokedAt = input.revokedAt ?? (yield* currentUnixMillis);
+        yield* dependencies.credentialStore
+            .revoke({
+            credentialId: input.credentialId,
+            revokedAt,
+            ...(input.reason === undefined ? {} : { reason: input.reason }),
+        })
+            .pipe(Effect.mapError((cause) => passkeyCredentialManagementError("revoke", "Failed to revoke passkey credential", cause)));
+    }),
+});
+export const PasskeyCredentialManagementLive = Layer.effect(PasskeyCredentialManagement)(Effect.gen(function* () {
+    const credentialStore = yield* PasskeyCredentialStore;
+    return makePasskeyCredentialManagement({ credentialStore });
+}));
+export class PasskeyVerifierError extends Data.TaggedError("PasskeyVerifierError") {
+}
+export class PasskeyVerifier extends Context.Service()("auth/PasskeyVerifier") {
+}
+(function (PasskeyVerifier) {
+    PasskeyVerifier.make = (service) => PasskeyVerifier.of(service);
+})(PasskeyVerifier || (PasskeyVerifier = {}));
+export class PasskeyVerificationError extends Data.TaggedError("PasskeyVerificationError") {
+}
+export class PasskeyVerification extends Context.Service()("auth/PasskeyVerification") {
+}
+(function (PasskeyVerification) {
+    PasskeyVerification.make = (service) => PasskeyVerification.of(service);
+})(PasskeyVerification || (PasskeyVerification = {}));
+export class PasskeyOptionsError extends Data.TaggedError("PasskeyOptionsError") {
+}
+export class PasskeyOptions extends Context.Service()("auth/PasskeyOptions") {
+}
+(function (PasskeyOptions) {
+    PasskeyOptions.make = (service) => PasskeyOptions.of(service);
+})(PasskeyOptions || (PasskeyOptions = {}));
+const defaultPubKeyCredParams = [
+    { type: "public-key", alg: -7 },
+    { type: "public-key", alg: -257 },
+];
+const credentialDescriptor = (credential) => ({
+    type: "public-key",
+    id: credential.credentialId,
+    ...(credential.transports === undefined
+        ? {}
+        : { transports: credential.transports }),
+});
+const issuePasskeyChallenge = (dependencies, input) => Effect.gen(function* () {
+    const secret = Redacted.make(yield* dependencies.crypto.randomToken(input.challengeBytes ?? defaultPasskeyChallengeBytes));
+    const issued = yield* dependencies.challenge.issue({
+        type: input.type,
+        subject: input.subject,
+        ttl: input.ttl ?? defaultPasskeyChallengeTtl,
+        secret,
+        metadata: input.metadata,
+    });
+    return {
+        challengeId: issued.id,
+        challenge: Redacted.value(secret),
+        expiresAt: issued.expiresAt,
+    };
+}).pipe(Effect.mapError((cause) => new PasskeyOptionsError({
+    message: "Failed to issue passkey challenge",
+    cause,
+})));
+const userCredentials = (credentialStore, userId) => credentialStore === undefined
+    ? Effect.succeed([])
+    : credentialStore.listByUser({ userId }).pipe(Effect.mapError((cause) => new PasskeyOptionsError({
+        message: "Failed to load passkey credentials",
+        cause,
+    })));
+const nonEmptyDescriptors = (descriptors) => descriptors.length === 0 ? undefined : descriptors;
+const passkeyVerificationError = (operation, message, cause) => new PasskeyVerificationError({
+    operation,
+    message,
+    ...(cause === undefined ? {} : { cause }),
+});
+const mergeMetadata = (...values) => {
+    let merged;
+    for (const value of values) {
+        if (value === undefined) {
+            continue;
+        }
+        merged ??= {};
+        Object.assign(merged, value);
+    }
+    return merged;
+};
+const validateSignCount = (operation, signCount) => Number.isInteger(signCount) && signCount >= 0
+    ? Effect.succeed(signCount)
+    : Effect.fail(passkeyVerificationError(operation, "Invalid passkey sign count"));
+const makeCredentialRecordId = (dependencies, operation) => dependencies.crypto
+    .randomToken(dependencies.credentialRecordIdBytes ?? 16)
+    .pipe(Effect.map(CredentialId), Effect.mapError((cause) => passkeyVerificationError(operation, "Failed to generate passkey credential record id", cause)));
+const verifyStoredPasskeyChallenge = (dependencies, operation, input) => dependencies.challenge
+    .verify({
+    challengeId: input.challengeId,
+    type: input.type,
+    secret: Redacted.make(input.challenge),
+})
+    .pipe(Effect.mapError((cause) => passkeyVerificationError(operation, "Invalid passkey challenge", cause)));
+export const makePasskeyVerification = (dependencies) => PasskeyVerification.make({
+    finishRegistration: Effect.fn("auth.passkey.finish_registration")(function* (input) {
+        const operation = "finish-registration";
+        const verified = yield* dependencies.verifier
+            .verifyRegistration({
+            response: input.response,
+            relyingPartyId: input.relyingPartyId,
+            expectedOrigin: input.expectedOrigin,
+            userId: input.userId,
+            ...(input.requireUserVerification === undefined
+                ? {}
+                : { requireUserVerification: input.requireUserVerification }),
+            ...(input.metadata === undefined ? {} : { metadata: input.metadata }),
+        })
+            .pipe(Effect.mapError((cause) => passkeyVerificationError(operation, "Failed to verify passkey registration response", cause)));
+        const signCount = yield* validateSignCount(operation, verified.signCount);
+        const existingCredential = yield* dependencies.credentialStore
+            .findByCredentialId(verified.credentialId)
+            .pipe(Effect.mapError((cause) => passkeyVerificationError(operation, "Failed to load passkey credential", cause)));
+        if (Option.isSome(existingCredential)) {
+            return yield* passkeyVerificationError(operation, "Passkey credential already exists");
+        }
+        const challenge = yield* verifyStoredPasskeyChallenge(dependencies, operation, {
+            challengeId: input.challengeId,
+            type: passkeyRegistrationChallengeType,
+            challenge: verified.challenge,
+        });
+        if (challenge.subject !== input.userId) {
+            return yield* passkeyVerificationError(operation, "Passkey registration subject mismatch");
+        }
+        const now = input.now ?? (yield* currentUnixMillis);
+        const credentialMetadata = mergeMetadata(input.metadata, verified.metadata);
+        const credential = {
+            id: input.recordId ??
+                (yield* makeCredentialRecordId(dependencies, operation)),
+            userId: input.userId,
+            credentialId: verified.credentialId,
+            publicKey: verified.publicKey,
+            signCount,
+            ...(verified.transports === undefined
+                ? {}
+                : { transports: verified.transports }),
+            ...(verified.backedUp === undefined ? {} : { backedUp: verified.backedUp }),
+            createdAt: now,
+            ...(credentialMetadata === undefined
+                ? {}
+                : { metadata: credentialMetadata }),
+        };
+        yield* dependencies.credentialStore.insert(credential).pipe(Effect.mapError((cause) => passkeyVerificationError(operation, "Failed to store passkey credential", cause)));
+        return {
+            challengeId: challenge.id,
+            userId: input.userId,
+            credential,
+        };
+    }),
+    finishAuthentication: Effect.fn("auth.passkey.finish_authentication")(function* (input) {
+        const operation = "finish-authentication";
+        const credentialId = yield* dependencies.verifier
+            .readAuthenticationCredentialId({ response: input.response })
+            .pipe(Effect.mapError((cause) => passkeyVerificationError(operation, "Failed to read passkey credential id", cause)));
+        const credentialOption = yield* dependencies.credentialStore
+            .findByCredentialId(credentialId)
+            .pipe(Effect.mapError((cause) => passkeyVerificationError(operation, "Failed to load passkey credential", cause)));
+        if (Option.isNone(credentialOption)) {
+            return yield* passkeyVerificationError(operation, "Passkey credential not found");
+        }
+        const credential = credentialOption.value;
+        if (credential.revokedAt !== undefined) {
+            return yield* passkeyVerificationError(operation, "Passkey credential revoked");
+        }
+        if (input.userId !== undefined && credential.userId !== input.userId) {
+            return yield* passkeyVerificationError(operation, "Passkey credential user mismatch");
+        }
+        const verified = yield* dependencies.verifier
+            .verifyAuthentication({
+            response: input.response,
+            credential,
+            relyingPartyId: input.relyingPartyId,
+            expectedOrigin: input.expectedOrigin,
+            ...(input.requireUserVerification === undefined
+                ? {}
+                : { requireUserVerification: input.requireUserVerification }),
+            ...(input.metadata === undefined ? {} : { metadata: input.metadata }),
+        })
+            .pipe(Effect.mapError((cause) => passkeyVerificationError(operation, "Failed to verify passkey authentication response", cause)));
+        const signCount = yield* validateSignCount(operation, verified.newSignCount);
+        if (verified.credentialId !== credential.credentialId) {
+            return yield* passkeyVerificationError(operation, "Passkey authentication credential mismatch");
+        }
+        const challenge = yield* verifyStoredPasskeyChallenge(dependencies, operation, {
+            challengeId: input.challengeId,
+            type: passkeyAuthenticationChallengeType,
+            challenge: verified.challenge,
+        });
+        if (input.userId !== undefined
+            ? challenge.subject !== input.userId
+            : challenge.subject !== credential.userId &&
+                challenge.subject !== input.relyingPartyId) {
+            return yield* passkeyVerificationError(operation, "Passkey authentication subject mismatch");
+        }
+        const now = input.now ?? (yield* currentUnixMillis);
+        const credentialMetadata = mergeMetadata(credential.metadata, input.metadata, verified.metadata);
+        const updatedCredential = yield* dependencies.credentialStore
+            .updateSignCount({
+            credentialId: credential.credentialId,
+            signCount,
+            lastUsedAt: now,
+            ...(credentialMetadata === undefined
+                ? {}
+                : { metadata: credentialMetadata }),
+        })
+            .pipe(Effect.mapError((cause) => passkeyVerificationError(operation, "Failed to update passkey credential", cause)));
+        if (Option.isNone(updatedCredential)) {
+            return yield* passkeyVerificationError(operation, "Passkey credential unavailable");
+        }
+        return {
+            challengeId: challenge.id,
+            userId: updatedCredential.value.userId,
+            credential: updatedCredential.value,
+        };
+    }),
+});
+export const makePasskeyOptions = (dependencies) => PasskeyOptions.make({
+    startRegistration: Effect.fn("auth.passkey.start_registration")(function* (input) {
+        const credentials = yield* userCredentials(dependencies.credentialStore, input.userId);
+        const issued = yield* issuePasskeyChallenge(dependencies, {
+            type: passkeyRegistrationChallengeType,
+            subject: input.userId,
+            ttl: input.ttl,
+            challengeBytes: input.challengeBytes,
+            metadata: input.metadata,
+        });
+        const excludeCredentials = input.excludeCredentials ?? credentials.map(credentialDescriptor);
+        return {
+            challengeId: issued.challengeId,
+            expiresAt: issued.expiresAt,
+            publicKey: {
+                challenge: issued.challenge,
+                rp: input.relyingParty,
+                user: {
+                    id: input.userId,
+                    name: input.userName,
+                    displayName: input.userDisplayName,
+                },
+                pubKeyCredParams: input.pubKeyCredParams ?? defaultPubKeyCredParams,
+                ...(input.timeout === undefined ? {} : { timeout: input.timeout }),
+                ...(nonEmptyDescriptors(excludeCredentials) === undefined
+                    ? {}
+                    : { excludeCredentials }),
+                ...(input.authenticatorSelection === undefined
+                    ? {}
+                    : { authenticatorSelection: input.authenticatorSelection }),
+                ...(input.attestation === undefined ? {} : { attestation: input.attestation }),
+            },
+        };
+    }),
+    startAuthentication: Effect.fn("auth.passkey.start_authentication")(function* (input) {
+        const credentials = input.allowCredentials ??
+            (input.userId === undefined
+                ? []
+                : (yield* userCredentials(dependencies.credentialStore, input.userId)).map(credentialDescriptor));
+        const issued = yield* issuePasskeyChallenge(dependencies, {
+            type: passkeyAuthenticationChallengeType,
+            subject: input.userId ?? input.relyingPartyId,
+            ttl: input.ttl,
+            challengeBytes: input.challengeBytes,
+            metadata: input.metadata,
+        });
+        return {
+            challengeId: issued.challengeId,
+            expiresAt: issued.expiresAt,
+            publicKey: {
+                challenge: issued.challenge,
+                rpId: input.relyingPartyId,
+                ...(input.timeout === undefined ? {} : { timeout: input.timeout }),
+                ...(nonEmptyDescriptors(credentials) === undefined
+                    ? {}
+                    : { allowCredentials: credentials }),
+                ...(input.userVerification === undefined
+                    ? {}
+                    : { userVerification: input.userVerification }),
+            },
+        };
+    }),
+});
+export const PasskeyOptionsLive = Layer.effect(PasskeyOptions)(Effect.gen(function* () {
+    const challenge = yield* Challenge;
+    const crypto = yield* Crypto;
+    const credentialStore = yield* Effect.serviceOption(PasskeyCredentialStore);
+    return makePasskeyOptions({
+        challenge,
+        crypto,
+        ...(Option.isSome(credentialStore)
+            ? { credentialStore: credentialStore.value }
+            : {}),
+    });
+}));
+export const PasskeyVerificationLive = (options) => Layer.effect(PasskeyVerification)(Effect.gen(function* () {
+    const challenge = yield* Challenge;
+    const crypto = yield* Crypto;
+    const credentialStore = yield* PasskeyCredentialStore;
+    const verifier = yield* PasskeyVerifier;
+    return makePasskeyVerification({
+        ...options,
+        challenge,
+        crypto,
+        credentialStore,
+        verifier,
+    });
+}));
+export const PasskeyFeatureLive = PasskeyOptionsLive;
+//# sourceMappingURL=Passkey.js.map

package/dist/Passkey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Passkey.js","sourceRoot":"","sources":["../src/Passkey.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAGzF,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAMlD,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC,OAAO,EAAuB,CAAC;AAexE,MAAM,CAAC,MAAM,gCAAgC,GAAG,sBAA+B,CAAC;AAChF,MAAM,CAAC,MAAM,kCAAkC,GAAG,wBAAiC,CAAC;AACpF,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,CAAC;AAC/C,MAAM,CAAC,MAAM,0BAA0B,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAyC9D,MAAM,OAAO,2BAA4B,SAAQ,IAAI,CAAC,WAAW,CAC/D,6BAA6B,CAK7B;CAAG;AA0BL,MAAM,OAAO,sBAAuB,SAAQ,OAAO,CAAC,OAAO,EAGxD,CAAC,6BAA6B,CAAC;CAAG;AAErC,WAAiB,sBAAsB;IACxB,2BAAI,GAAG,CAClB,OAAsC,EACP,EAAE,CAAC,sBAAsB,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AACzE,CAAC,EAJgB,sBAAsB,KAAtB,sBAAsB,QAItC;AAED,MAAM,eAAe,GAAG,CACtB,MAA+B,EACN,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;AAEtD,MAAM,CAAC,MAAM,gCAAgC,GAAG,GAAkC,EAAE;IAClF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAgD,CAAC;IAE5E,OAAO,sBAAsB,CAAC,IAAI,CAAC;QACjC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CACd,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;YACf,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1D,CAAC,CAAC;QACJ,kBAAkB,EAAE,CAAC,YAAY,EAAE,EAAE,CACnC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;YACf,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC1C,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/E,CAAC,CAAC;QACJ,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CACpB,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CACf,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC;aACtB,MAAM,CACL,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;YAC3B,CAAC,KAAK,CAAC,cAAc,KAAK,IAAI,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CACjE;aACA,GAAG,CAAC,eAAe,CAAC,CACxB;QACH,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE,CACzB,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;YACf,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAEhD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACrD,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;YACvB,CAAC;YAED,MAAM,OAAO,GAAG;gBACd,GAAG,GAAG;gBACN,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;aACP,CAAC;YAEpC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YAE7C,OAAO,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/C,CAAC,CAAC;QACJ,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAChB,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;YACf,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAEhD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE;oBAClC,GAAG,GAAG;oBACN,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,QAAQ,EACN,KAAK,CAAC,MAAM,KAAK,SAAS;wBACxB,CAAC,CAAC,GAAG,CAAC,QAAQ;wBACd,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE;iBACtD,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;KACL,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gCAAgC,GAAG,KAAK,CAAC,IAAI,CACxD,sBAAsB,CACvB,CAAC,gCAAgC,CAAC,CAAC;AA0BpC,MAAM,OAAO,gCAAiC,SAAQ,IAAI,CAAC,WAAW,CACpE,kCAAkC,CAKlC;CAAG;AAWL,MAAM,OAAO,2BAA4B,SAAQ,OAAO,CAAC,OAAO,EAG7D,CAAC,kCAAkC,CAAC;CAAG;AAE1C,WAAiB,2BAA2B;IAC7B,gCAAI,GAAG,CAClB,OAA2C,EACP,EAAE,CACtC,2BAA2B,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AAC5C,CAAC,EALgB,2BAA2B,KAA3B,2BAA2B,QAK3C;AAMD,MAAM,cAAc,GAAG,CACrB,UAAmC,EACZ,EAAE,CAAC,CAAC;IAC3B,YAAY,EAAE,UAAU,CAAC,YAAY;IACrC,GAAG,CAAC,UAAU,CAAC,UAAU,KAAK,SAAS;QACrC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC;IAC1C,GAAG,CAAC,UAAU,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC;IAC/E,SAAS,EAAE,UAAU,CAAC,SAAS;IAC/B,GAAG,CAAC,UAAU,CAAC,UAAU,KAAK,SAAS;QACrC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC;IAC1C,GAAG,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS;QACpC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC;IACxC,GAAG,CAAC,UAAU,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC;CAChF,CAAC,CAAC;AAEH,MAAM,gCAAgC,GAAG,CACvC,SAA+C,EAC/C,OAAe,EACf,KAAe,EACmB,EAAE,CACpC,IAAI,gCAAgC,CAAC;IACnC,SAAS;IACT,OAAO;IACP,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;CAC1C,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAC7C,YAAqD,EACjB,EAAE,CACtC,2BAA2B,CAAC,IAAI,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,yCAAyC,CAAC,CAAC,QAAQ,CAAC,EACzE,KAAK;QAEL,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,eAAe;aACpD,UAAU,CAAC;YACV,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC;SAC9C,CAAC;aACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,gCAAgC,CAC9B,MAAM,EACN,oCAAoC,EACpC,KAAK,CACN,CACF,CACF,CAAC;QAEJ,OAAO,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACzC,CAAC,CAAC;IACF,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC,2CAA2C,CAAC,CACnE,QAAQ,CAAC,EAAE,KAAK;QACd,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,eAAe;aACnD,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC;aACtC,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,gCAAgC,CAC9B,QAAQ,EACR,mCAAmC,EACnC,KAAK,CACN,CACF,CACF,CAAC;QAEJ,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YAC1E,OAAO,KAAK,CAAC,CAAC,gCAAgC,CAC5C,QAAQ,EACR,8BAA8B,CAC/B,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC7C,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAEhE,KAAK,CAAC,CAAC,YAAY,CAAC,eAAe;aAChC,MAAM,CAAC;YACN,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS;YACT,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;SAChE,CAAC;aACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,gCAAgC,CAC9B,QAAQ,EACR,qCAAqC,EACrC,KAAK,CACN,CACF,CACF,CAAC;IACN,CAAC,CACF;CACF,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,+BAA+B,GAAG,KAAK,CAAC,MAAM,CACzD,2BAA2B,CAC5B,CACC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,sBAAsB,CAAC;IAEtD,OAAO,+BAA+B,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC;AAC9D,CAAC,CAAC,CACH,CAAC;AA2IF,MAAM,OAAO,oBAAqB,SAAQ,IAAI,CAAC,WAAW,CACxD,sBAAsB,CAKtB;CAAG;AAcL,MAAM,OAAO,eAAgB,SAAQ,OAAO,CAAC,OAAO,EAGjD,CAAC,sBAAsB,CAAC;CAAG;AAE9B,WAAiB,eAAe;IACjB,oBAAI,GAAG,CAAC,OAA+B,EAA0B,EAAE,CAC9E,eAAe,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC,EAHgB,eAAe,KAAf,eAAe,QAG/B;AAiCD,MAAM,OAAO,wBAAyB,SAAQ,IAAI,CAAC,WAAW,CAC5D,0BAA0B,CAK1B;CAAG;AAWL,MAAM,OAAO,mBAAoB,SAAQ,OAAO,CAAC,OAAO,EAGrD,CAAC,0BAA0B,CAAC;CAAG;AAElC,WAAiB,mBAAmB;IACrB,wBAAI,GAAG,CAClB,OAAmC,EACP,EAAE,CAAC,mBAAmB,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AACnE,CAAC,EAJgB,mBAAmB,KAAnB,mBAAmB,QAInC;AAcD,MAAM,OAAO,mBAAoB,SAAQ,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAG7E;CAAG;AAWL,MAAM,OAAO,cAAe,SAAQ,OAAO,CAAC,OAAO,EAGhD,CAAC,qBAAqB,CAAC;CAAG;AAE7B,WAAiB,cAAc;IAChB,mBAAI,GAAG,CAAC,OAA8B,EAAyB,EAAE,CAC5E,cAAc,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC,EAHgB,cAAc,KAAd,cAAc,QAG9B;AAQD,MAAM,uBAAuB,GAAoD;IAC/E,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE;IAC/B,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE;CAClC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAC3B,UAAmC,EACN,EAAE,CAAC,CAAC;IACjC,IAAI,EAAE,YAAY;IAClB,EAAE,EAAE,UAAU,CAAC,YAAY;IAC3B,GAAG,CAAC,UAAU,CAAC,UAAU,KAAK,SAAS;QACrC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC;CAC3C,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,CAC5B,YAAwC,EACxC,KAMC,EACD,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAC1B,KAAK,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CACpC,KAAK,CAAC,cAAc,IAAI,4BAA4B,CACrD,CACF,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC;QACjD,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,0BAA0B;QAC5C,MAAM;QACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IAEH,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,EAAE;QACtB,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QACjC,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,mBAAmB,CAAC;IACtB,OAAO,EAAE,mCAAmC;IAC5C,KAAK;CACN,CAAC,CACL,CACF,CAAC;AAEJ,MAAM,eAAe,GAAG,CACtB,eAA0D,EAC1D,MAAc,EACd,EAAE,CACF,eAAe,KAAK,SAAS;IAC3B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAwC,CAAC;IAC1D,CAAC,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CACzC,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,mBAAmB,CAAC;QACtB,OAAO,EAAE,oCAAoC;QAC7C,KAAK;KACN,CAAC,CACL,CACF,CAAC;AAER,MAAM,mBAAmB,GAAG,CAC1B,WAAmD,EACC,EAAE,CACtD,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;AAErD,MAAM,wBAAwB,GAAG,CAC/B,SAAuC,EACvC,OAAe,EACf,KAAe,EACW,EAAE,CAC5B,IAAI,wBAAwB,CAAC;IAC3B,SAAS;IACT,OAAO;IACP,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;CAC1C,CAAC,CAAC;AAEL,MAAM,aAAa,GAAG,CACpB,GAAG,MAAkE,EACtB,EAAE;IACjD,IAAI,MAA2C,CAAC;IAEhD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,SAAS;QACX,CAAC;QAED,MAAM,KAAK,EAAE,CAAC;QACd,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CACxB,SAAuC,EACvC,SAAiB,EACgC,EAAE,CACnD,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC;IAC3C,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;IAC3B,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,wBAAwB,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAClE,CAAC;AAER,MAAM,sBAAsB,GAAG,CAC7B,YAA6C,EAC7C,SAAuC,EACgB,EAAE,CACzD,YAAY,CAAC,MAAM;KAChB,WAAW,CAAC,YAAY,CAAC,uBAAuB,IAAI,EAAE,CAAC;KACvD,IAAI,CACH,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,EACxB,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,wBAAwB,CACtB,SAAS,EACT,iDAAiD,EACjD,KAAK,CACN,CACF,CACF,CAAC;AAEN,MAAM,4BAA4B,GAAG,CACnC,YAA6C,EAC7C,SAAuC,EACvC,KAMC,EACD,EAAE,CACF,YAAY,CAAC,SAAS;KACnB,MAAM,CAAC;IACN,WAAW,EAAE,KAAK,CAAC,WAAW;IAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;IAChB,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;CACvC,CAAC;KACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,wBAAwB,CAAC,SAAS,EAAE,2BAA2B,EAAE,KAAK,CAAC,CACxE,CACF,CAAC;AAEN,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,YAA6C,EACjB,EAAE,CAC9B,mBAAmB,CAAC,IAAI,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC,EAAE,CAAC,kCAAkC,CAAC,CAAC,QAAQ,CAAC,EACzE,KAAK;QAEL,MAAM,SAAS,GAAG,qBAA8B,CAAC;QACjD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,QAAQ;aAC1C,kBAAkB,CAAC;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,CAAC,KAAK,CAAC,uBAAuB,KAAK,SAAS;gBAC7C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,uBAAuB,EAAE,KAAK,CAAC,uBAAuB,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;SACtE,CAAC;aACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,wBAAwB,CACtB,SAAS,EACT,gDAAgD,EAChD,KAAK,CACN,CACF,CACF,CAAC;QACJ,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC1E,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,eAAe;aAC3D,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC;aACzC,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,wBAAwB,CACtB,SAAS,EACT,mCAAmC,EACnC,KAAK,CACN,CACF,CACF,CAAC;QAEJ,IAAI,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC,CAAC,wBAAwB,CACpC,SAAS,EACT,mCAAmC,CACpC,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,4BAA4B,CACnD,YAAY,EACZ,SAAS,EACT;YACE,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,IAAI,EAAE,gCAAgC;YACtC,SAAS,EAAE,QAAQ,CAAC,SAAS;SAC9B,CACF,CAAC;QAEF,IAAI,SAAS,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YACvC,OAAO,KAAK,CAAC,CAAC,wBAAwB,CACpC,SAAS,EACT,uCAAuC,CACxC,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACpD,MAAM,kBAAkB,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC5E,MAAM,UAAU,GAAG;YACjB,EAAE,EACA,KAAK,CAAC,QAAQ;gBACd,CAAC,KAAK,CAAC,CAAC,sBAAsB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;YAC1D,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,SAAS;YACT,GAAG,CAAC,QAAQ,CAAC,UAAU,KAAK,SAAS;gBACnC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC;YACxC,GAAG,CAAC,QAAQ,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC3E,SAAS,EAAE,GAAG;YACd,GAAG,CAAC,kBAAkB,KAAK,SAAS;gBAClC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC;SACJ,CAAC;QAEpC,KAAK,CAAC,CAAC,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CACzD,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,wBAAwB,CACtB,SAAS,EACT,oCAAoC,EACpC,KAAK,CACN,CACF,CACF,CAAC;QAEF,OAAO;YACL,WAAW,EAAE,SAAS,CAAC,EAAE;YACzB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU;SAC2B,CAAC;IAC1C,CAAC,CAAC;IACF,oBAAoB,EAAE,MAAM,CAAC,EAAE,CAAC,oCAAoC,CAAC,CACnE,QAAQ,CAAC,EAAE,KAAK;QACd,MAAM,SAAS,GAAG,uBAAgC,CAAC;QACnD,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,QAAQ;aAC9C,8BAA8B,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;aAC5D,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,wBAAwB,CACtB,SAAS,EACT,sCAAsC,EACtC,KAAK,CACN,CACF,CACF,CAAC;QACJ,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,eAAe;aACzD,kBAAkB,CAAC,YAAY,CAAC;aAChC,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,wBAAwB,CACtB,SAAS,EACT,mCAAmC,EACnC,KAAK,CACN,CACF,CACF,CAAC;QAEJ,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC,CAAC,wBAAwB,CACpC,SAAS,EACT,8BAA8B,CAC/B,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC;QAE1C,IAAI,UAAU,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO,KAAK,CAAC,CAAC,wBAAwB,CACpC,SAAS,EACT,4BAA4B,CAC7B,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YACrE,OAAO,KAAK,CAAC,CAAC,wBAAwB,CACpC,SAAS,EACT,kCAAkC,CACnC,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,QAAQ;aAC1C,oBAAoB,CAAC;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU;YACV,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,GAAG,CAAC,KAAK,CAAC,uBAAuB,KAAK,SAAS;gBAC7C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,uBAAuB,EAAE,KAAK,CAAC,uBAAuB,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;SACtE,CAAC;aACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,wBAAwB,CACtB,SAAS,EACT,kDAAkD,EAClD,KAAK,CACN,CACF,CACF,CAAC;QACJ,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,iBAAiB,CACxC,SAAS,EACT,QAAQ,CAAC,YAAY,CACtB,CAAC;QAEF,IAAI,QAAQ,CAAC,YAAY,KAAK,UAAU,CAAC,YAAY,EAAE,CAAC;YACtD,OAAO,KAAK,CAAC,CAAC,wBAAwB,CACpC,SAAS,EACT,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,4BAA4B,CACnD,YAAY,EACZ,SAAS,EACT;YACE,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,IAAI,EAAE,kCAAkC;YACxC,SAAS,EAAE,QAAQ,CAAC,SAAS;SAC9B,CACF,CAAC;QAEF,IACE,KAAK,CAAC,MAAM,KAAK,SAAS;YACxB,CAAC,CAAC,SAAS,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM;YACpC,CAAC,CAAC,SAAS,CAAC,OAAO,KAAK,UAAU,CAAC,MAAM;gBACvC,SAAS,CAAC,OAAO,KAAK,KAAK,CAAC,cAAc,EAC9C,CAAC;YACD,OAAO,KAAK,CAAC,CAAC,wBAAwB,CACpC,SAAS,EACT,yCAAyC,CAC1C,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACpD,MAAM,kBAAkB,GAAG,aAAa,CACtC,UAAU,CAAC,QAAQ,EACnB,KAAK,CAAC,QAAQ,EACd,QAAQ,CAAC,QAAQ,CAClB,CAAC;QACF,MAAM,iBAAiB,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,eAAe;aAC1D,eAAe,CAAC;YACf,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,SAAS;YACT,UAAU,EAAE,GAAG;YACf,GAAG,CAAC,kBAAkB,KAAK,SAAS;gBAClC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC;SACtC,CAAC;aACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,wBAAwB,CACtB,SAAS,EACT,qCAAqC,EACrC,KAAK,CACN,CACF,CACF,CAAC;QAEJ,IAAI,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACrC,OAAO,KAAK,CAAC,CAAC,wBAAwB,CACpC,SAAS,EACT,gCAAgC,CACjC,CAAC;QACJ,CAAC;QAED,OAAO;YACL,WAAW,EAAE,SAAS,CAAC,EAAE;YACzB,MAAM,EAAE,iBAAiB,CAAC,KAAK,CAAC,MAAM;YACtC,UAAU,EAAE,iBAAiB,CAAC,KAAK;SACI,CAAC;IAC5C,CAAC,CACF;CACF,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,YAAwC,EACjB,EAAE,CACzB,cAAc,CAAC,IAAI,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC,EAAE,CAAC,iCAAiC,CAAC,CAAC,QAAQ,CAAC,EACvE,KAAK;QAEL,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,eAAe,CACxC,YAAY,CAAC,eAAe,EAC5B,KAAK,CAAC,MAAM,CACb,CAAC;QACF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,YAAY,EAAE;YACxD,IAAI,EAAE,gCAAgC;YACtC,OAAO,EAAE,KAAK,CAAC,MAAM;YACrB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QACH,MAAM,kBAAkB,GACtB,KAAK,CAAC,kBAAkB,IAAI,WAAW,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAEpE,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE;gBACT,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,EAAE,EAAE,KAAK,CAAC,YAAY;gBACtB,IAAI,EAAE;oBACJ,EAAE,EAAE,KAAK,CAAC,MAAM;oBAChB,IAAI,EAAE,KAAK,CAAC,QAAQ;oBACpB,WAAW,EAAE,KAAK,CAAC,eAAe;iBACnC;gBACD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,uBAAuB;gBACnE,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;gBAClE,GAAG,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,KAAK,SAAS;oBACvD,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC;gBAC3B,GAAG,CAAC,KAAK,CAAC,sBAAsB,KAAK,SAAS;oBAC5C,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,sBAAsB,EAAE,KAAK,CAAC,sBAAsB,EAAE,CAAC;gBAC7D,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;aAC/E;SACmC,CAAC;IACzC,CAAC,CAAC;IACF,mBAAmB,EAAE,MAAM,CAAC,EAAE,CAAC,mCAAmC,CAAC,CAAC,QAAQ,CAAC,EAC3E,KAAK;QAEL,MAAM,WAAW,GACf,KAAK,CAAC,gBAAgB;YACtB,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS;gBACzB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,YAAY,CAAC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CACtE,oBAAoB,CACrB,CAAC,CAAC;QACT,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,YAAY,EAAE;YACxD,IAAI,EAAE,kCAAkC;YACxC,OAAO,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,cAAc;YAC7C,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QAEH,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE;gBACT,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,IAAI,EAAE,KAAK,CAAC,cAAc;gBAC1B,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;gBAClE,GAAG,CAAC,mBAAmB,CAAC,WAAW,CAAC,KAAK,SAAS;oBAChD,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,WAAW,EAAE,CAAC;gBACtC,GAAG,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS;oBACtC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC;aAClD;SACqC,CAAC;IAC3C,CAAC,CAAC;CACH,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAC5D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC;IACnC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC;IAC7B,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;IAE5E,OAAO,kBAAkB,CAAC;QACxB,SAAS;QACT,MAAM;QACN,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;YAChC,CAAC,CAAC,EAAE,eAAe,EAAE,eAAe,CAAC,KAAK,EAAE;YAC5C,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;AACL,CAAC,CAAC,CACH,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,OAAoC,EACpC,EAAE,CACF,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAC/B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC;IACnC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC;IAC7B,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,sBAAsB,CAAC;IACtD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;IAExC,OAAO,uBAAuB,CAAC;QAC7B,GAAG,OAAO;QACV,SAAS;QACT,MAAM;QACN,eAAe;QACf,QAAQ;KACT,CAAC,CAAC;AACL,CAAC,CAAC,CACH,CAAC;AAEJ,MAAM,CAAC,MAAM,kBAAkB,GAAG,kBAAkB,CAAC"}

package/dist/PasskeySimpleWebAuthn.d.ts

@@ -0,0 +1,11 @@
+import { verifyAuthenticationResponse as simpleWebAuthnVerifyAuthenticationResponse, verifyRegistrationResponse as simpleWebAuthnVerifyRegistrationResponse } from "@simplewebauthn/server";
+import { Layer } from "effect";
+import { PasskeyVerifier } from "./Passkey.js";
+import type { PasskeyVerifierService } from "./Passkey.js";
+export interface SimpleWebAuthnPasskeyVerifierOptions {
+    readonly verifyRegistrationResponse?: typeof simpleWebAuthnVerifyRegistrationResponse;
+    readonly verifyAuthenticationResponse?: typeof simpleWebAuthnVerifyAuthenticationResponse;
+}
+export declare const makeSimpleWebAuthnPasskeyVerifier: (options?: SimpleWebAuthnPasskeyVerifierOptions) => PasskeyVerifierService;
+export declare const SimpleWebAuthnPasskeyVerifierLive: Layer.Layer<PasskeyVerifier, never, never>;
+//# sourceMappingURL=PasskeySimpleWebAuthn.d.ts.map

package/dist/PasskeySimpleWebAuthn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasskeySimpleWebAuthn.d.ts","sourceRoot":"","sources":["../src/PasskeySimpleWebAuthn.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,IAAI,0CAA0C,EAC1E,0BAA0B,IAAI,wCAAwC,EACvE,MAAM,wBAAwB,CAAC;AAMhC,OAAO,EAAoB,KAAK,EAAU,MAAM,QAAQ,CAAC;AAEzD,OAAO,EAEL,eAAe,EAEhB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAIV,sBAAsB,EACvB,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,0BAA0B,CAAC,EAAE,OAAO,wCAAwC,CAAC;IACtF,QAAQ,CAAC,4BAA4B,CAAC,EAAE,OAAO,0CAA0C,CAAC;CAC3F;AAkMD,eAAO,MAAM,iCAAiC,GAC5C,UAAS,oCAAyC,KACjD,sBAgHF,CAAC;AAEF,eAAO,MAAM,iCAAiC,4CAG7C,CAAC"}

package/dist/PasskeySimpleWebAuthn.js

@@ -0,0 +1,181 @@
+import { verifyAuthenticationResponse as simpleWebAuthnVerifyAuthenticationResponse, verifyRegistrationResponse as simpleWebAuthnVerifyRegistrationResponse, } from "@simplewebauthn/server";
+import { Effect, Encoding, Layer, Result } from "effect";
+import { PasskeyCredentialId, PasskeyVerifier, PasskeyVerifierError, } from "./Passkey.js";
+const textDecoder = new TextDecoder();
+const verifierError = (operation, message, cause) => new PasskeyVerifierError({
+    operation,
+    message,
+    ...(cause === undefined ? {} : { cause }),
+});
+const responseString = (credential, key, operation) => {
+    const value = credential.response[key];
+    return typeof value === "string"
+        ? Effect.succeed(value)
+        : Effect.fail(verifierError(operation, `Missing ${key}`));
+};
+const optionalResponseString = (credential, key, operation) => {
+    const value = credential.response[key];
+    return value === undefined
+        ? Effect.succeed(undefined)
+        : typeof value === "string"
+            ? Effect.succeed(value)
+            : Effect.fail(verifierError(operation, `Invalid ${key}`));
+};
+const decodeBase64UrlBytes = (value, operation) => Result.match(Encoding.decodeBase64Url(value), {
+    onSuccess: Effect.succeed,
+    onFailure: (cause) => Effect.fail(verifierError(operation, "Invalid base64url value", cause)),
+});
+const clientDataChallenge = (clientDataJSON, operation) => decodeBase64UrlBytes(clientDataJSON, operation).pipe(Effect.flatMap((bytes) => Effect.try({
+    try: () => JSON.parse(textDecoder.decode(bytes)),
+    catch: (cause) => verifierError(operation, "Invalid clientDataJSON", cause),
+})), Effect.flatMap((clientData) => typeof clientData.challenge === "string"
+    ? Effect.succeed(clientData.challenge)
+    : Effect.fail(verifierError(operation, "Missing clientData challenge"))));
+const expectedOrigin = (origin) => typeof origin === "string" ? origin : [...origin];
+const passkeyAuthenticatorAttachment = (credential, operation) => {
+    const attachment = credential.authenticatorAttachment;
+    return attachment === undefined
+        ? Effect.succeed(undefined)
+        : attachment === "cross-platform" || attachment === "platform"
+            ? Effect.succeed(attachment)
+            : Effect.fail(verifierError(operation, "Invalid authenticatorAttachment"));
+};
+const stringArrayResponse = (credential, key, operation) => {
+    const value = credential.response[key];
+    return value === undefined
+        ? Effect.succeed(undefined)
+        : Array.isArray(value) && value.every((item) => typeof item === "string")
+            ? Effect.succeed(value)
+            : Effect.fail(verifierError(operation, `Invalid ${key}`));
+};
+const registrationResponseForSimpleWebAuthn = (credential) => Effect.gen(function* () {
+    const operation = "verify-registration";
+    const clientDataJSON = yield* responseString(credential, "clientDataJSON", operation);
+    const attestationObject = yield* responseString(credential, "attestationObject", operation);
+    const attachment = yield* passkeyAuthenticatorAttachment(credential, operation);
+    const transports = yield* stringArrayResponse(credential, "transports", operation);
+    return {
+        id: credential.id,
+        rawId: credential.rawId ?? credential.id,
+        type: credential.type,
+        response: {
+            clientDataJSON,
+            attestationObject,
+            ...(transports === undefined
+                ? {}
+                : {
+                    transports: transports,
+                }),
+        },
+        ...(attachment === undefined ? {} : { authenticatorAttachment: attachment }),
+        clientExtensionResults: credential.clientExtensionResults ?? {},
+    };
+});
+const authenticationResponseForSimpleWebAuthn = (credential) => Effect.gen(function* () {
+    const operation = "verify-authentication";
+    const clientDataJSON = yield* responseString(credential, "clientDataJSON", operation);
+    const authenticatorData = yield* responseString(credential, "authenticatorData", operation);
+    const signature = yield* responseString(credential, "signature", operation);
+    const userHandle = yield* optionalResponseString(credential, "userHandle", operation);
+    const attachment = yield* passkeyAuthenticatorAttachment(credential, operation);
+    return {
+        id: credential.id,
+        rawId: credential.rawId ?? credential.id,
+        type: credential.type,
+        response: {
+            clientDataJSON,
+            authenticatorData,
+            signature,
+            ...(userHandle === undefined ? {} : { userHandle }),
+        },
+        ...(attachment === undefined ? {} : { authenticatorAttachment: attachment }),
+        clientExtensionResults: credential.clientExtensionResults ?? {},
+    };
+});
+const credentialForSimpleWebAuthn = (credential) => decodeBase64UrlBytes(credential.publicKey, "verify-authentication").pipe(Effect.map((publicKey) => ({
+    id: credential.credentialId,
+    publicKey: new Uint8Array(publicKey),
+    counter: credential.signCount,
+    ...(credential.transports === undefined
+        ? {}
+        : {
+            transports: credential.transports,
+        }),
+})));
+export const makeSimpleWebAuthnPasskeyVerifier = (options = {}) => {
+    const verifyRegistrationResponse = options.verifyRegistrationResponse ?? simpleWebAuthnVerifyRegistrationResponse;
+    const verifyAuthenticationResponse = options.verifyAuthenticationResponse ?? simpleWebAuthnVerifyAuthenticationResponse;
+    return PasskeyVerifier.make({
+        readAuthenticationCredentialId: ({ response }) => Effect.succeed(PasskeyCredentialId(response.id)),
+        verifyRegistration: (input) => Effect.gen(function* () {
+            const response = yield* registrationResponseForSimpleWebAuthn(input.response);
+            const challenge = yield* clientDataChallenge(response.response.clientDataJSON, "verify-registration");
+            const result = yield* Effect.tryPromise({
+                try: () => verifyRegistrationResponse({
+                    response,
+                    expectedChallenge: challenge,
+                    expectedOrigin: expectedOrigin(input.expectedOrigin),
+                    expectedRPID: input.relyingPartyId,
+                    ...(input.requireUserVerification === undefined
+                        ? {}
+                        : { requireUserVerification: input.requireUserVerification }),
+                }),
+                catch: (cause) => verifierError("verify-registration", "Failed to verify registration response", cause),
+            });
+            const info = result.registrationInfo;
+            if (!result.verified || info === undefined) {
+                return yield* verifierError("verify-registration", "Passkey registration was not verified");
+            }
+            return {
+                challenge,
+                credentialId: PasskeyCredentialId(info.credential.id),
+                publicKey: Encoding.encodeBase64Url(info.credential.publicKey),
+                signCount: info.credential.counter,
+                ...(info.credential.transports === undefined
+                    ? {}
+                    : { transports: info.credential.transports }),
+                backedUp: info.credentialBackedUp,
+                metadata: {
+                    credentialDeviceType: info.credentialDeviceType,
+                    origin: info.origin,
+                    ...(info.rpID === undefined ? {} : { rpId: info.rpID }),
+                },
+            };
+        }),
+        verifyAuthentication: (input) => Effect.gen(function* () {
+            const response = yield* authenticationResponseForSimpleWebAuthn(input.response);
+            const challenge = yield* clientDataChallenge(response.response.clientDataJSON, "verify-authentication");
+            const credential = yield* credentialForSimpleWebAuthn(input.credential);
+            const result = yield* Effect.tryPromise({
+                try: () => verifyAuthenticationResponse({
+                    response,
+                    expectedChallenge: challenge,
+                    expectedOrigin: expectedOrigin(input.expectedOrigin),
+                    expectedRPID: input.relyingPartyId,
+                    credential,
+                    ...(input.requireUserVerification === undefined
+                        ? {}
+                        : { requireUserVerification: input.requireUserVerification }),
+                }),
+                catch: (cause) => verifierError("verify-authentication", "Failed to verify authentication response", cause),
+            });
+            const info = result.authenticationInfo;
+            if (!result.verified) {
+                return yield* verifierError("verify-authentication", "Passkey authentication was not verified");
+            }
+            return {
+                challenge,
+                credentialId: PasskeyCredentialId(info.credentialID),
+                newSignCount: info.newCounter,
+                userVerified: info.userVerified,
+                metadata: {
+                    credentialDeviceType: info.credentialDeviceType,
+                    origin: info.origin,
+                    rpId: info.rpID,
+                },
+            };
+        }),
+    });
+};
+export const SimpleWebAuthnPasskeyVerifierLive = Layer.succeed(PasskeyVerifier, makeSimpleWebAuthnPasskeyVerifier());
+//# sourceMappingURL=PasskeySimpleWebAuthn.js.map