@effect-auth/core 0.1.0-alpha.1 → 0.1.0-alpha.13

package/dist/AuthFlow.d.ts

@@ -1,59 +1,447 @@
-import { Context, Effect } from "effect";
-import type { AuthFlowId, UserId } from "./Identifiers.js";
-import type { AuthAssuranceLevel, AuthMethodReference, IssuedSession } from "./Sessions.js";
+import { Context, Data, Duration, Effect, Layer, Redacted } from "effect";
+import { Challenge } from "./Challenge.js";
+import type { ChallengeService } from "./Challenge.js";
+import type { CryptoService } from "./Crypto.js";
+import type { OAuthProviderId, UnixMillis } from "./Identifiers.js";
+import { AuthFlowId, ChallengeId, Email, UserId } from "./Identifiers.js";
+import { LoginApprovalReview } from "./LoginApproval.js";
+import type { LoginApprovalChannel, LoginApprovalFlowService, LoginApprovalFlowStartError, LoginApprovalIntent, LoginApprovalPolicyService, LoginApprovalReason, LoginApprovalReviewError, LoginApprovalReviewService, LoginApprovalSessionBinding, LoginDeviceContext } from "./LoginApproval.js";
+import type { LoginNotificationService } from "./LoginNotification.js";
+import type { LoginRequestContext, LoginRiskContext, LoginRiskEngineService, LoginRiskError } from "./LoginRisk.js";
+import { Sessions } from "./Sessions.js";
+import type { AuthAssuranceLevel, AuthMethodReference, IssuedSession, SessionCreateError, SessionClaims, SessionsService } from "./Sessions.js";
+import type { TrustedDeviceError, TrustedDeviceService } from "./TrustedDevice.js";
 export type AuthMethod = "password" | "email-otp" | "magic-link" | "passkey" | "oauth" | "totp" | "backup-code" | (string & {});
-export type AuthDenyReason = "invalid-credentials" | "account-disabled" | "rate-limited" | "policy-denied" | "requires-explicit-linking" | (string & {});
+export type EmailVerificationSessionMode = "allow-unverified" | "limited-session";
+export declare const defaultLoginApprovalSameDeviceSecretBytes = 32;
+export interface EmailVerificationSessionPolicyOptions {
+    readonly mode?: EmailVerificationSessionMode;
+}
+export interface EmailVerificationSessionPolicyInput {
+    readonly claims?: SessionClaims;
+}
+export type EmailVerificationSessionPolicyDecision = {
+    readonly _tag: "CreateSession";
+    readonly claims?: SessionClaims;
+};
+export interface EmailVerificationSessionPolicyService {
+    readonly decide: (input: EmailVerificationSessionPolicyInput) => Effect.Effect<EmailVerificationSessionPolicyDecision>;
+}
+declare const EmailVerificationSessionPolicy_base: Context.ServiceClass<EmailVerificationSessionPolicy, "auth/EmailVerificationSessionPolicy", EmailVerificationSessionPolicyService>;
+export declare class EmailVerificationSessionPolicy extends EmailVerificationSessionPolicy_base {
+}
+export declare namespace EmailVerificationSessionPolicy {
+    const make: (service: EmailVerificationSessionPolicyService) => EmailVerificationSessionPolicyService;
+}
+export declare const makeEmailVerificationSessionPolicy: (options?: EmailVerificationSessionPolicyOptions) => EmailVerificationSessionPolicyService;
+export declare const EmailVerificationSessionPolicyLive: (options?: EmailVerificationSessionPolicyOptions) => Layer.Layer<EmailVerificationSessionPolicy, never, never>;
 export interface MfaFactor {
     readonly type: "totp" | "backup-code" | "passkey" | (string & {});
 }
-export interface PrimaryFactorResult {
+export interface PrimaryFactorResult<Method extends AuthMethod = AuthMethod> {
     readonly userId: UserId;
-    readonly method: AuthMethod;
-    readonly amr: ReadonlyArray<AuthMethodReference>;
+    readonly email?: Email;
+    readonly intent?: LoginApprovalIntent;
+    readonly method: Method;
+    readonly amr: readonly AuthMethodReference[];
     readonly aal: AuthAssuranceLevel;
+    readonly claims?: SessionClaims;
+    readonly device?: LoginDeviceContext;
+    readonly trustedDeviceToken?: Redacted.Redacted<string>;
+    readonly request?: LoginRequestContext;
+    readonly metadata?: Readonly<Record<string, unknown>>;
 }
 export interface MfaCompleteInput {
     readonly flowId: AuthFlowId;
+    readonly userId?: UserId;
     readonly method: AuthMethod;
-    readonly amr: ReadonlyArray<AuthMethodReference>;
-    readonly aal: AuthAssuranceLevel;
+    readonly amr?: readonly AuthMethodReference[];
+    readonly aal?: AuthAssuranceLevel;
+    readonly secret?: Redacted.Redacted<string>;
+    readonly now?: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
 }
-export interface AuthFlowCompleteInput {
+export interface AuthFlowCompleteInput<Method extends AuthMethod = AuthMethod> {
     readonly userId: UserId;
-    readonly method: AuthMethod;
-    readonly amr: ReadonlyArray<AuthMethodReference>;
+    readonly email?: Email;
+    readonly intent?: LoginApprovalIntent;
+    readonly method: Method;
+    readonly amr: readonly AuthMethodReference[];
     readonly aal: AuthAssuranceLevel;
+    readonly claims?: SessionClaims;
+    readonly device?: LoginDeviceContext;
+    readonly request?: LoginRequestContext;
+    readonly risk?: LoginRiskContext;
+    readonly mfaVerifiedAt?: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
 }
-export type AuthResult = {
-    readonly type: "authenticated";
-    readonly session: IssuedSession;
-} | {
-    readonly type: "requires-mfa";
-    readonly flowId: AuthFlowId;
-    readonly factors: ReadonlyArray<MfaFactor>;
-} | {
-    readonly type: "requires-email-verification";
-    readonly flowId: AuthFlowId;
-} | {
-    readonly type: "requires-passkey-enrollment";
-    readonly flowId: AuthFlowId;
-} | {
-    readonly type: "denied";
-    readonly reason: AuthDenyReason;
+export type AuthResult = Data.TaggedEnum<{
+    Authenticated: {
+        readonly session: IssuedSession;
+    };
+    RequiresMfa: {
+        readonly flowId: AuthFlowId;
+        readonly factors: readonly MfaFactor[];
+    };
+    RequiresEmailVerification: {
+        readonly flowId: AuthFlowId;
+        readonly userId?: UserId;
+        readonly email?: Email;
+    };
+    RequiresLoginApproval: {
+        readonly flowId: AuthFlowId;
+        readonly approvalChallengeId: ChallengeId;
+        readonly channel: LoginApprovalChannel;
+        readonly sessionBinding: LoginApprovalSessionBinding;
+        readonly sameDeviceRequired: boolean;
+        readonly reason: LoginApprovalReason;
+        readonly expiresAt: UnixMillis;
+        readonly sameDeviceSecret?: Redacted.Redacted<string>;
+    };
+    RequiresPasskeyEnrollment: {
+        readonly flowId: AuthFlowId;
+    };
+    RequiresExplicitLinking: {
+        readonly flowId: AuthFlowId;
+        readonly provider: OAuthProviderId;
+    };
+    InvalidCredentials: {};
+    AccountDisabled: {};
+    PolicyDenied: {
+        readonly reason?: string;
+    };
+}>;
+export declare const AuthResult: {
+    readonly Authenticated: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "Authenticated";
+        readonly session: IssuedSession;
+    }, "_tag">;
+    readonly RequiresMfa: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "RequiresMfa";
+        readonly flowId: AuthFlowId;
+        readonly factors: readonly MfaFactor[];
+    }, "_tag">;
+    readonly RequiresEmailVerification: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "RequiresEmailVerification";
+        readonly flowId: AuthFlowId;
+        readonly userId?: UserId | undefined;
+        readonly email?: Email | undefined;
+    }, "_tag">;
+    readonly RequiresLoginApproval: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "RequiresLoginApproval";
+        readonly flowId: AuthFlowId;
+        readonly approvalChallengeId: ChallengeId;
+        readonly channel: LoginApprovalChannel;
+        readonly sessionBinding: LoginApprovalSessionBinding;
+        readonly sameDeviceRequired: boolean;
+        readonly reason: LoginApprovalReason;
+        readonly expiresAt: UnixMillis;
+        readonly sameDeviceSecret?: Redacted.Redacted<string> | undefined;
+    }, "_tag">;
+    readonly RequiresPasskeyEnrollment: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "RequiresPasskeyEnrollment";
+        readonly flowId: AuthFlowId;
+    }, "_tag">;
+    readonly RequiresExplicitLinking: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "RequiresExplicitLinking";
+        readonly flowId: AuthFlowId;
+        readonly provider: OAuthProviderId;
+    }, "_tag">;
+    readonly InvalidCredentials: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "InvalidCredentials";
+    }, "_tag">;
+    readonly AccountDisabled: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "AccountDisabled";
+    }, "_tag">;
+    readonly PolicyDenied: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "PolicyDenied";
+        readonly reason?: string | undefined;
+    }, "_tag">;
+    readonly $is: <Tag extends "Authenticated" | "RequiresMfa" | "RequiresEmailVerification" | "RequiresLoginApproval" | "RequiresPasskeyEnrollment" | "RequiresExplicitLinking" | "InvalidCredentials" | "AccountDisabled" | "PolicyDenied">(tag: Tag) => (u: unknown) => u is Extract<{
+        readonly _tag: "Authenticated";
+        readonly session: IssuedSession;
+    }, {
+        readonly _tag: Tag;
+    }> | Extract<{
+        readonly _tag: "RequiresMfa";
+        readonly flowId: AuthFlowId;
+        readonly factors: readonly MfaFactor[];
+    }, {
+        readonly _tag: Tag;
+    }> | Extract<{
+        readonly _tag: "RequiresEmailVerification";
+        readonly flowId: AuthFlowId;
+        readonly userId?: UserId | undefined;
+        readonly email?: Email | undefined;
+    }, {
+        readonly _tag: Tag;
+    }> | Extract<{
+        readonly _tag: "RequiresLoginApproval";
+        readonly flowId: AuthFlowId;
+        readonly approvalChallengeId: ChallengeId;
+        readonly channel: LoginApprovalChannel;
+        readonly sessionBinding: LoginApprovalSessionBinding;
+        readonly sameDeviceRequired: boolean;
+        readonly reason: LoginApprovalReason;
+        readonly expiresAt: UnixMillis;
+        readonly sameDeviceSecret?: Redacted.Redacted<string> | undefined;
+    }, {
+        readonly _tag: Tag;
+    }> | Extract<{
+        readonly _tag: "RequiresPasskeyEnrollment";
+        readonly flowId: AuthFlowId;
+    }, {
+        readonly _tag: Tag;
+    }> | Extract<{
+        readonly _tag: "RequiresExplicitLinking";
+        readonly flowId: AuthFlowId;
+        readonly provider: OAuthProviderId;
+    }, {
+        readonly _tag: Tag;
+    }> | Extract<{
+        readonly _tag: "InvalidCredentials";
+    }, {
+        readonly _tag: Tag;
+    }> | Extract<{
+        readonly _tag: "AccountDisabled";
+    }, {
+        readonly _tag: Tag;
+    }> | Extract<{
+        readonly _tag: "PolicyDenied";
+        readonly reason?: string | undefined;
+    }, {
+        readonly _tag: Tag;
+    }>;
+    readonly $match: {
+        <Cases extends {
+            readonly Authenticated: (args: {
+                readonly _tag: "Authenticated";
+                readonly session: IssuedSession;
+            }) => any;
+            readonly RequiresMfa: (args: {
+                readonly _tag: "RequiresMfa";
+                readonly flowId: AuthFlowId;
+                readonly factors: readonly MfaFactor[];
+            }) => any;
+            readonly RequiresEmailVerification: (args: {
+                readonly _tag: "RequiresEmailVerification";
+                readonly flowId: AuthFlowId;
+                readonly userId?: UserId | undefined;
+                readonly email?: Email | undefined;
+            }) => any;
+            readonly RequiresLoginApproval: (args: {
+                readonly _tag: "RequiresLoginApproval";
+                readonly flowId: AuthFlowId;
+                readonly approvalChallengeId: ChallengeId;
+                readonly channel: LoginApprovalChannel;
+                readonly sessionBinding: LoginApprovalSessionBinding;
+                readonly sameDeviceRequired: boolean;
+                readonly reason: LoginApprovalReason;
+                readonly expiresAt: UnixMillis;
+                readonly sameDeviceSecret?: Redacted.Redacted<string> | undefined;
+            }) => any;
+            readonly RequiresPasskeyEnrollment: (args: {
+                readonly _tag: "RequiresPasskeyEnrollment";
+                readonly flowId: AuthFlowId;
+            }) => any;
+            readonly RequiresExplicitLinking: (args: {
+                readonly _tag: "RequiresExplicitLinking";
+                readonly flowId: AuthFlowId;
+                readonly provider: OAuthProviderId;
+            }) => any;
+            readonly InvalidCredentials: (args: {
+                readonly _tag: "InvalidCredentials";
+            }) => any;
+            readonly AccountDisabled: (args: {
+                readonly _tag: "AccountDisabled";
+            }) => any;
+            readonly PolicyDenied: (args: {
+                readonly _tag: "PolicyDenied";
+                readonly reason?: string | undefined;
+            }) => any;
+        }>(cases: Cases): (value: {
+            readonly _tag: "Authenticated";
+            readonly session: IssuedSession;
+        } | {
+            readonly _tag: "RequiresMfa";
+            readonly flowId: AuthFlowId;
+            readonly factors: readonly MfaFactor[];
+        } | {
+            readonly _tag: "RequiresEmailVerification";
+            readonly flowId: AuthFlowId;
+            readonly userId?: UserId | undefined;
+            readonly email?: Email | undefined;
+        } | {
+            readonly _tag: "RequiresLoginApproval";
+            readonly flowId: AuthFlowId;
+            readonly approvalChallengeId: ChallengeId;
+            readonly channel: LoginApprovalChannel;
+            readonly sessionBinding: LoginApprovalSessionBinding;
+            readonly sameDeviceRequired: boolean;
+            readonly reason: LoginApprovalReason;
+            readonly expiresAt: UnixMillis;
+            readonly sameDeviceSecret?: Redacted.Redacted<string> | undefined;
+        } | {
+            readonly _tag: "RequiresPasskeyEnrollment";
+            readonly flowId: AuthFlowId;
+        } | {
+            readonly _tag: "RequiresExplicitLinking";
+            readonly flowId: AuthFlowId;
+            readonly provider: OAuthProviderId;
+        } | {
+            readonly _tag: "InvalidCredentials";
+        } | {
+            readonly _tag: "AccountDisabled";
+        } | {
+            readonly _tag: "PolicyDenied";
+            readonly reason?: string | undefined;
+        }) => import("effect/Unify").Unify<ReturnType<Cases["Authenticated" | "RequiresMfa" | "RequiresEmailVerification" | "RequiresLoginApproval" | "RequiresPasskeyEnrollment" | "RequiresExplicitLinking" | "InvalidCredentials" | "AccountDisabled" | "PolicyDenied"]>>;
+        <Cases extends {
+            readonly Authenticated: (args: {
+                readonly _tag: "Authenticated";
+                readonly session: IssuedSession;
+            }) => any;
+            readonly RequiresMfa: (args: {
+                readonly _tag: "RequiresMfa";
+                readonly flowId: AuthFlowId;
+                readonly factors: readonly MfaFactor[];
+            }) => any;
+            readonly RequiresEmailVerification: (args: {
+                readonly _tag: "RequiresEmailVerification";
+                readonly flowId: AuthFlowId;
+                readonly userId?: UserId | undefined;
+                readonly email?: Email | undefined;
+            }) => any;
+            readonly RequiresLoginApproval: (args: {
+                readonly _tag: "RequiresLoginApproval";
+                readonly flowId: AuthFlowId;
+                readonly approvalChallengeId: ChallengeId;
+                readonly channel: LoginApprovalChannel;
+                readonly sessionBinding: LoginApprovalSessionBinding;
+                readonly sameDeviceRequired: boolean;
+                readonly reason: LoginApprovalReason;
+                readonly expiresAt: UnixMillis;
+                readonly sameDeviceSecret?: Redacted.Redacted<string> | undefined;
+            }) => any;
+            readonly RequiresPasskeyEnrollment: (args: {
+                readonly _tag: "RequiresPasskeyEnrollment";
+                readonly flowId: AuthFlowId;
+            }) => any;
+            readonly RequiresExplicitLinking: (args: {
+                readonly _tag: "RequiresExplicitLinking";
+                readonly flowId: AuthFlowId;
+                readonly provider: OAuthProviderId;
+            }) => any;
+            readonly InvalidCredentials: (args: {
+                readonly _tag: "InvalidCredentials";
+            }) => any;
+            readonly AccountDisabled: (args: {
+                readonly _tag: "AccountDisabled";
+            }) => any;
+            readonly PolicyDenied: (args: {
+                readonly _tag: "PolicyDenied";
+                readonly reason?: string | undefined;
+            }) => any;
+        }>(value: {
+            readonly _tag: "Authenticated";
+            readonly session: IssuedSession;
+        } | {
+            readonly _tag: "RequiresMfa";
+            readonly flowId: AuthFlowId;
+            readonly factors: readonly MfaFactor[];
+        } | {
+            readonly _tag: "RequiresEmailVerification";
+            readonly flowId: AuthFlowId;
+            readonly userId?: UserId | undefined;
+            readonly email?: Email | undefined;
+        } | {
+            readonly _tag: "RequiresLoginApproval";
+            readonly flowId: AuthFlowId;
+            readonly approvalChallengeId: ChallengeId;
+            readonly channel: LoginApprovalChannel;
+            readonly sessionBinding: LoginApprovalSessionBinding;
+            readonly sameDeviceRequired: boolean;
+            readonly reason: LoginApprovalReason;
+            readonly expiresAt: UnixMillis;
+            readonly sameDeviceSecret?: Redacted.Redacted<string> | undefined;
+        } | {
+            readonly _tag: "RequiresPasskeyEnrollment";
+            readonly flowId: AuthFlowId;
+        } | {
+            readonly _tag: "RequiresExplicitLinking";
+            readonly flowId: AuthFlowId;
+            readonly provider: OAuthProviderId;
+        } | {
+            readonly _tag: "InvalidCredentials";
+        } | {
+            readonly _tag: "AccountDisabled";
+        } | {
+            readonly _tag: "PolicyDenied";
+            readonly reason?: string | undefined;
+        }, cases: Cases): import("effect/Unify").Unify<ReturnType<Cases["Authenticated" | "RequiresMfa" | "RequiresEmailVerification" | "RequiresLoginApproval" | "RequiresPasskeyEnrollment" | "RequiresExplicitLinking" | "InvalidCredentials" | "AccountDisabled" | "PolicyDenied"]>>;
+    };
 };
-declare const AuthFlowError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
-    readonly _tag: "AuthFlowError";
+export type AuthResultOf<Tag extends AuthResult["_tag"]> = Extract<AuthResult, {
+    readonly _tag: Tag;
+}>;
+export type AuthenticatedResult = AuthResultOf<"Authenticated">;
+type CommonPrimaryFactorResult = AuthResultOf<"Authenticated" | "RequiresMfa" | "RequiresEmailVerification" | "RequiresLoginApproval" | "RequiresPasskeyEnrollment" | "PolicyDenied">;
+export type AuthFlowPrimaryFactorResult<Method extends AuthMethod = AuthMethod> = CommonPrimaryFactorResult | (Method extends "oauth" ? AuthResultOf<"RequiresExplicitLinking"> : never);
+export type AuthFlowMfaResult = AuthResultOf<"Authenticated" | "PolicyDenied">;
+declare const AuthFlowStateError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "AuthFlowStateError";
 } & Readonly<A>;
-export declare class AuthFlowError extends AuthFlowError_base<{
+export declare class AuthFlowStateError extends AuthFlowStateError_base<{
     readonly message: string;
     readonly cause?: unknown;
 }> {
 }
+export interface AuthFlowStateStartInput<Method extends AuthMethod = AuthMethod> extends AuthFlowCompleteInput<Method> {
+    readonly ttl?: Duration.Duration;
+    readonly secret?: Redacted.Redacted<string>;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface StartedAuthFlowState {
+    readonly flowId: AuthFlowId;
+    readonly userId: UserId;
+    readonly expiresAt: UnixMillis;
+}
+export interface ConsumedAuthFlowState<Method extends AuthMethod = AuthMethod> extends AuthFlowCompleteInput<Method> {
+    readonly flowId: AuthFlowId;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface InspectedAuthFlowState<Method extends AuthMethod = AuthMethod> extends ConsumedAuthFlowState<Method> {
+    readonly expiresAt: UnixMillis;
+}
+export interface AuthFlowStateService {
+    readonly start: <Method extends AuthMethod>(input: AuthFlowStateStartInput<Method>) => Effect.Effect<StartedAuthFlowState, AuthFlowStateError>;
+    readonly inspect: (flowId: AuthFlowId, secret?: Redacted.Redacted<string>) => Effect.Effect<InspectedAuthFlowState, AuthFlowStateError>;
+    readonly consume: (flowId: AuthFlowId, secret?: Redacted.Redacted<string>) => Effect.Effect<ConsumedAuthFlowState, AuthFlowStateError>;
+}
+declare const AuthFlowState_base: Context.ServiceClass<AuthFlowState, "auth/AuthFlowState", AuthFlowStateService>;
+export declare class AuthFlowState extends AuthFlowState_base {
+}
+export declare namespace AuthFlowState {
+    const make: (service: AuthFlowStateService) => AuthFlowStateService;
+}
+export interface AuthFlowStateOptions {
+    readonly ttl?: Duration.Duration;
+}
+export interface AuthFlowStateDependencies extends AuthFlowStateOptions {
+    readonly challenge: ChallengeService;
+}
+export declare const defaultAuthFlowStateTtl: Duration.Duration;
+export declare const makeAuthFlowState: (dependencies: AuthFlowStateDependencies) => AuthFlowStateService;
+export declare const AuthFlowStateLive: (options?: AuthFlowStateOptions) => Layer.Layer<AuthFlowState, never, Challenge>;
+export type AuthFlowCompleteError = SessionCreateError;
+export type AuthFlowMfaError = AuthFlowStateError | AuthFlowCompleteError;
+export type AuthFlowPrimaryFactorError = AuthFlowCompleteError | TrustedDeviceError | LoginRiskError | AuthFlowStateError | LoginApprovalReviewError | LoginApprovalFlowStartError;
+export type AuthFlowError = AuthFlowPrimaryFactorError;
 export interface AuthFlowService {
-    readonly startPrimaryFactor: (input: PrimaryFactorResult) => Effect.Effect<AuthResult, AuthFlowError>;
-    readonly completePrimaryFactor: (input: PrimaryFactorResult) => Effect.Effect<AuthResult, AuthFlowError>;
-    readonly completeMfa: (input: MfaCompleteInput) => Effect.Effect<AuthResult, AuthFlowError>;
-    readonly complete: (input: AuthFlowCompleteInput) => Effect.Effect<AuthResult, AuthFlowError>;
+    readonly startPrimaryFactor: <Method extends AuthMethod>(input: PrimaryFactorResult<Method>) => Effect.Effect<AuthFlowPrimaryFactorResult<Method>, AuthFlowPrimaryFactorError>;
+    readonly completePrimaryFactor: <Method extends AuthMethod>(input: PrimaryFactorResult<Method>) => Effect.Effect<AuthFlowPrimaryFactorResult<Method>, AuthFlowPrimaryFactorError>;
+    readonly completeMfa: (input: MfaCompleteInput) => Effect.Effect<AuthFlowMfaResult, AuthFlowMfaError>;
+    readonly complete: <Method extends AuthMethod>(input: AuthFlowCompleteInput<Method>) => Effect.Effect<AuthenticatedResult, AuthFlowCompleteError>;
 }
 declare const AuthFlow_base: Context.ServiceClass<AuthFlow, "auth/AuthFlow", AuthFlowService>;
 export declare class AuthFlow extends AuthFlow_base {
@@ -61,6 +449,44 @@ export declare class AuthFlow extends AuthFlow_base {
 export declare namespace AuthFlow {
     const make: (service: AuthFlowService) => AuthFlowService;
 }
-export declare const denied: (reason: AuthDenyReason) => AuthResult;
+export interface LoginApprovalFinalizeInput {
+    readonly flowId: AuthFlowId;
+    readonly approvalChallengeId: ChallengeId;
+    readonly sameDeviceSecret?: Redacted.Redacted<string>;
+}
+export type LoginApprovalFinalizeResult = AuthenticatedResult | AuthResultOf<"PolicyDenied">;
+export type LoginApprovalFinalizeError = LoginApprovalReviewError | AuthFlowStateError | AuthFlowCompleteError;
+export interface LoginApprovalFinalizeService {
+    readonly complete: (input: LoginApprovalFinalizeInput) => Effect.Effect<LoginApprovalFinalizeResult, LoginApprovalFinalizeError>;
+}
+declare const LoginApprovalFinalize_base: Context.ServiceClass<LoginApprovalFinalize, "auth/LoginApprovalFinalize", LoginApprovalFinalizeService>;
+export declare class LoginApprovalFinalize extends LoginApprovalFinalize_base {
+}
+export declare namespace LoginApprovalFinalize {
+    const make: (service: LoginApprovalFinalizeService) => LoginApprovalFinalizeService;
+}
+export interface LoginApprovalFinalizeDependencies {
+    readonly loginApprovalReview: LoginApprovalReviewService;
+    readonly authFlowState: AuthFlowStateService;
+    readonly authFlow: AuthFlowService;
+}
+export declare const makeLoginApprovalFinalize: (dependencies: LoginApprovalFinalizeDependencies) => LoginApprovalFinalizeService;
+export declare const LoginApprovalFinalizeLive: Layer.Layer<LoginApprovalFinalize, never, LoginApprovalReview | AuthFlowState | AuthFlow>;
+export interface AuthFlowDependencies {
+    readonly sessions: SessionsService;
+    readonly emailVerificationSessionPolicy?: EmailVerificationSessionPolicyService;
+    readonly loginApprovalPolicy?: LoginApprovalPolicyService;
+    readonly loginApprovalFlow?: LoginApprovalFlowService;
+    readonly authFlowState?: AuthFlowStateService;
+    readonly crypto?: CryptoService;
+    readonly trustedDevice?: TrustedDeviceService;
+    readonly loginRiskEngine?: LoginRiskEngineService;
+    readonly loginApprovalReview?: LoginApprovalReviewService;
+    readonly loginNotification?: LoginNotificationService;
+    readonly loginApprovalSameDeviceSecretBytes?: number;
+}
+export declare const makeAuthFlow: (dependencies: AuthFlowDependencies) => AuthFlowService;
+export declare const AuthFlowLive: Layer.Layer<AuthFlow, never, Sessions>;
+export declare const AuthFlowLiveWithEmailVerificationPolicy: (options?: EmailVerificationSessionPolicyOptions) => Layer.Layer<AuthFlow, never, Sessions>;
 export {};
 //# sourceMappingURL=AuthFlow.d.ts.map

package/dist/AuthFlow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthFlow.d.ts","sourceRoot":"","sources":["../src/AuthFlow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAQ,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAC1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAE3F,MAAM,MAAM,UAAU,GAClB,UAAU,GACV,WAAW,GACX,YAAY,GACZ,SAAS,GACT,OAAO,GACP,MAAM,GACN,aAAa,GACb,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;AAEjB,MAAM,MAAM,cAAc,GACtB,qBAAqB,GACrB,kBAAkB,GAClB,cAAc,GACd,eAAe,GACf,2BAA2B,GAC3B,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;AAEjB,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;CAClE;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAA;IAChD,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAA;CACjC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAA;IAChD,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAA;CACjC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAA;IAChD,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAA;CACjC;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GACnE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,CAAA;CAAE,GAC1G;IAAE,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GAC7E;IAAE,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GAC7E;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;CAAE,CAAA;;;;AAEhE,qBAAa,aAAc,SAAQ,mBAAkC;IACnE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB,CAAC;CAAG;AAEL,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,kBAAkB,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;IACrG,QAAQ,CAAC,qBAAqB,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;IACxG,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;IAC3F,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;CAC9F;;AAED,qBAAa,QAAS,SAAQ,aAA6D;CAAG;AAE9F,yBAAiB,QAAQ,CAAC;IACjB,MAAM,IAAI,GAAI,SAAS,eAAe,KAAG,eAAuC,CAAA;CACxF;AAED,eAAO,MAAM,MAAM,GAAI,QAAQ,cAAc,KAAG,UAG9C,CAAA"}
+{"version":3,"file":"AuthFlow.d.ts","sourceRoot":"","sources":["../src/AuthFlow.ts"],"names":[],"mappings":"AACA,OAAO,EACL,OAAO,EACP,IAAI,EACJ,QAAQ,EACR,MAAM,EACN,KAAK,EAEL,QAAQ,EACT,MAAM,QAAQ,CAAC;AAGhB,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1E,OAAO,EAGL,mBAAmB,EAGpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EACV,oBAAoB,EACpB,wBAAwB,EACxB,2BAA2B,EAC3B,mBAAmB,EACnB,0BAA0B,EAC1B,mBAAmB,EACnB,wBAAwB,EACxB,0BAA0B,EAC1B,2BAA2B,EAC3B,kBAAkB,EACnB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EACV,wBAAwB,EAEzB,MAAM,wBAAwB,CAAC;AAMhC,OAAO,KAAK,EACV,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,QAAQ,EAA6B,MAAM,eAAe,CAAC;AACpE,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EACb,kBAAkB,EAClB,aAAa,EAEb,eAAe,EAChB,MAAM,eAAe,CAAC;AAEvB,OAAO,KAAK,EACV,kBAAkB,EAClB,oBAAoB,EACrB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,MAAM,UAAU,GAClB,UAAU,GACV,WAAW,GACX,YAAY,GACZ,SAAS,GACT,OAAO,GACP,MAAM,GACN,aAAa,GACb,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,MAAM,MAAM,4BAA4B,GACpC,kBAAkB,GAClB,iBAAiB,CAAC;AAEtB,eAAO,MAAM,yCAAyC,KAAK,CAAC;AAE5D,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,IAAI,CAAC,EAAE,4BAA4B,CAAC;CAC9C;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;CACjC;AAED,MAAM,MAAM,sCAAsC,GAAG;IACnD,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;CACjC,CAAC;AAEF,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,MAAM,EAAE,CACf,KAAK,EAAE,mCAAmC,KACvC,MAAM,CAAC,MAAM,CAAC,sCAAsC,CAAC,CAAC;CAC5D;;AAED,qBAAa,8BAA+B,SAAQ,mCAGV;CAAG;AAE7C,yBAAiB,8BAA8B,CAAC;IACvC,MAAM,IAAI,GACf,SAAS,qCAAqC,KAC7C,qCACyC,CAAC;CAC9C;AA2CD,eAAO,MAAM,kCAAkC,GAC7C,UAAS,qCAA0C,KAClD,qCAmCF,CAAC;AAEF,eAAO,MAAM,kCAAkC,GAC7C,UAAU,qCAAqC,8DAI9C,CAAC;AAEJ,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;CACnE;AAED,MAAM,WAAW,mBAAmB,CAAC,MAAM,SAAS,UAAU,GAAG,UAAU;IACzE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC7C,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxD,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC9C,QAAQ,CAAC,GAAG,CAAC,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5C,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,qBAAqB,CAAC,MAAM,SAAS,UAAU,GAAG,UAAU;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC7C,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACjC,QAAQ,CAAC,aAAa,CAAC,EAAE,UAAU,CAAC;IACpC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACvC,aAAa,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;KAAE,CAAC;IACnD,WAAW,EAAE;QACX,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;QAC5B,QAAQ,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,CAAC;KACxC,CAAC;IACF,yBAAyB,EAAE;QACzB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;QAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;KACxB,CAAC;IACF,qBAAqB,EAAE;QACrB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;QAC5B,QAAQ,CAAC,mBAAmB,EAAE,WAAW,CAAC;QAC1C,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;QACvC,QAAQ,CAAC,cAAc,EAAE,2BAA2B,CAAC;QACrD,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;QACrC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;QACrC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;QAC/B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;KACvD,CAAC;IACF,yBAAyB,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC;IAC3D,uBAAuB,EAAE;QACvB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;QAC5B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;KACpC,CAAC;IACF,kBAAkB,EAAE,EAAE,CAAC;IACvB,eAAe,EAAE,EAAE,CAAC;IACpB,YAAY,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5C,CAAC,CAAC;AAEH,eAAO,MAAM,UAAU;;;0BA9Bc,aAAa;;;;yBAE7B,UAAU;0BACT,SAAS,SAAS,EAAE;;;;yBAGrB,UAAU;0BACT,MAAM;yBACP,KAAK;;;;yBAGL,UAAU;sCACG,WAAW;0BACvB,oBAAoB;iCACb,2BAA2B;qCACvB,OAAO;yBACnB,mBAAmB;4BAChB,UAAU;oCACF,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;;;;yBAET,UAAU;;;;yBAErC,UAAU;2BACR,eAAe;;;;;;;;;;0BAIF,MAAM;;;;0BA3BL,aAAa;;;;;yBAE7B,UAAU;0BACT,SAAS,SAAS,EAAE;;;;;yBAGrB,UAAU;0BACT,MAAM;yBACP,KAAK;;;;;yBAGL,UAAU;sCACG,WAAW;0BACvB,oBAAoB;iCACb,2BAA2B;qCACvB,OAAO;yBACnB,mBAAmB;4BAChB,UAAU;oCACF,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;;;;;yBAET,UAAU;;;;;yBAErC,UAAU;2BACR,eAAe;;;;;;;;;;;;;0BAIF,MAAM;;;;;;;;kCA3BL,aAAa;;;;iCAE7B,UAAU;kCACT,SAAS,SAAS,EAAE;;;;iCAGrB,UAAU;kCACT,MAAM;iCACP,KAAK;;;;iCAGL,UAAU;8CACG,WAAW;kCACvB,oBAAoB;yCACb,2BAA2B;6CACvB,OAAO;iCACnB,mBAAmB;oCAChB,UAAU;4CACF,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;;;;iCAET,UAAU;;;;iCAErC,UAAU;mCACR,eAAe;;;;;;;;;;kCAIF,MAAM;;;;8BA3BL,aAAa;;;6BAE7B,UAAU;8BACT,SAAS,SAAS,EAAE;;;6BAGrB,UAAU;8BACT,MAAM;6BACP,KAAK;;;6BAGL,UAAU;0CACG,WAAW;8BACvB,oBAAoB;qCACb,2BAA2B;yCACvB,OAAO;6BACnB,mBAAmB;gCAChB,UAAU;wCACF,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;;;6BAET,UAAU;;;6BAErC,UAAU;+BACR,eAAe;;;;;;;8BAIF,MAAM;;;;;kCA3BL,aAAa;;;;iCAE7B,UAAU;kCACT,SAAS,SAAS,EAAE;;;;iCAGrB,UAAU;kCACT,MAAM;iCACP,KAAK;;;;iCAGL,UAAU;8CACG,WAAW;kCACvB,oBAAoB;yCACb,2BAA2B;6CACvB,OAAO;iCACnB,mBAAmB;oCAChB,UAAU;4CACF,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;;;;iCAET,UAAU;;;;iCAErC,UAAU;mCACR,eAAe;;;;;;;;;;kCAIF,MAAM;;;;8BA3BL,aAAa;;;6BAE7B,UAAU;8BACT,SAAS,SAAS,EAAE;;;6BAGrB,UAAU;8BACT,MAAM;6BACP,KAAK;;;6BAGL,UAAU;0CACG,WAAW;8BACvB,oBAAoB;qCACb,2BAA2B;yCACvB,OAAO;6BACnB,mBAAmB;gCAChB,UAAU;wCACF,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;;;6BAET,UAAU;;;6BAErC,UAAU;+BACR,eAAe;;;;;;;8BAIF,MAAM;;;CAGa,CAAC;AAExD,MAAM,MAAM,YAAY,CAAC,GAAG,SAAS,UAAU,CAAC,MAAM,CAAC,IAAI,OAAO,CAChE,UAAU,EACV;IAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAA;CAAE,CACvB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AAEhE,KAAK,yBAAyB,GAAG,YAAY,CACzC,eAAe,GACf,aAAa,GACb,2BAA2B,GAC3B,uBAAuB,GACvB,2BAA2B,GAC3B,cAAc,CACjB,CAAC;AAEF,MAAM,MAAM,2BAA2B,CACrC,MAAM,SAAS,UAAU,GAAG,UAAU,IAEpC,yBAAyB,GACzB,CAAC,MAAM,SAAS,OAAO,GAAG,YAAY,CAAC,yBAAyB,CAAC,GAAG,KAAK,CAAC,CAAC;AAE/E,MAAM,MAAM,iBAAiB,GAAG,YAAY,CAAC,eAAe,GAAG,cAAc,CAAC,CAAC;;;;AAE/E,qBAAa,kBAAmB,SAAQ,wBAAuC;IAC7E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AAEL,MAAM,WAAW,uBAAuB,CACtC,MAAM,SAAS,UAAU,GAAG,UAAU,CACtC,SAAQ,qBAAqB,CAAC,MAAM,CAAC;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;CAChC;AAED,MAAM,WAAW,qBAAqB,CACpC,MAAM,SAAS,UAAU,GAAG,UAAU,CACtC,SAAQ,qBAAqB,CAAC,MAAM,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,sBAAsB,CACrC,MAAM,SAAS,UAAU,GAAG,UAAU,CACtC,SAAQ,qBAAqB,CAAC,MAAM,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;CAChC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,CAAC,MAAM,SAAS,UAAU,EACxC,KAAK,EAAE,uBAAuB,CAAC,MAAM,CAAC,KACnC,MAAM,CAAC,MAAM,CAAC,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;IAC7D,QAAQ,CAAC,OAAO,EAAE,CAChB,MAAM,EAAE,UAAU,EAClB,MAAM,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,KAC/B,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE,kBAAkB,CAAC,CAAC;IAC/D,QAAQ,CAAC,OAAO,EAAE,CAChB,MAAM,EAAE,UAAU,EAClB,MAAM,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,KAC/B,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,CAAC;CAC/D;;AAED,qBAAa,aAAc,SAAQ,kBAGV;CAAG;AAE5B,yBAAiB,aAAa,CAAC;IACtB,MAAM,IAAI,GAAI,SAAS,oBAAoB,KAAG,oBAC1B,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC;CAClC;AAED,MAAM,WAAW,yBAA0B,SAAQ,oBAAoB;IACrE,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;CACtC;AAED,eAAO,MAAM,uBAAuB,mBAAuB,CAAC;AAoL5D,eAAO,MAAM,iBAAiB,GAC5B,cAAc,yBAAyB,KACtC,oBA+EF,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,UAAU,oBAAoB,iDAU7D,CAAC;AAEJ,MAAM,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AACvD,MAAM,MAAM,gBAAgB,GAAG,kBAAkB,GAAG,qBAAqB,CAAC;AAC1E,MAAM,MAAM,0BAA0B,GAClC,qBAAqB,GACrB,kBAAkB,GAClB,cAAc,GACd,kBAAkB,GAClB,wBAAwB,GACxB,2BAA2B,CAAC;AAChC,MAAM,MAAM,aAAa,GAAG,0BAA0B,CAAC;AAEvD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,kBAAkB,EAAE,CAAC,MAAM,SAAS,UAAU,EACrD,KAAK,EAAE,mBAAmB,CAAC,MAAM,CAAC,KAC/B,MAAM,CAAC,MAAM,CAChB,2BAA2B,CAAC,MAAM,CAAC,EACnC,0BAA0B,CAC3B,CAAC;IACF,QAAQ,CAAC,qBAAqB,EAAE,CAAC,MAAM,SAAS,UAAU,EACxD,KAAK,EAAE,mBAAmB,CAAC,MAAM,CAAC,KAC/B,MAAM,CAAC,MAAM,CAChB,2BAA2B,CAAC,MAAM,CAAC,EACnC,0BAA0B,CAC3B,CAAC;IACF,QAAQ,CAAC,WAAW,EAAE,CACpB,KAAK,EAAE,gBAAgB,KACpB,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;IACxD,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,SAAS,UAAU,EAC3C,KAAK,EAAE,qBAAqB,CAAC,MAAM,CAAC,KACjC,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;CAChE;;AAED,qBAAa,QAAS,SAAQ,aAE7B;CAAG;AAEJ,yBAAiB,QAAQ,CAAC;IACjB,MAAM,IAAI,GAAI,SAAS,eAAe,KAAG,eAC1B,CAAC;CACxB;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,mBAAmB,EAAE,WAAW,CAAC;IAC1C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;CACvD;AAED,MAAM,MAAM,2BAA2B,GACnC,mBAAmB,GACnB,YAAY,CAAC,cAAc,CAAC,CAAC;AACjC,MAAM,MAAM,0BAA0B,GAClC,wBAAwB,GACxB,kBAAkB,GAClB,qBAAqB,CAAC;AAE1B,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,QAAQ,EAAE,CACjB,KAAK,EAAE,0BAA0B,KAC9B,MAAM,CAAC,MAAM,CAAC,2BAA2B,EAAE,0BAA0B,CAAC,CAAC;CAC7E;;AAED,qBAAa,qBAAsB,SAAQ,0BAGV;CAAG;AAEpC,yBAAiB,qBAAqB,CAAC;IAC9B,MAAM,IAAI,GACf,SAAS,4BAA4B,KACpC,4BAAiE,CAAC;CACtE;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,mBAAmB,EAAE,0BAA0B,CAAC;IACzD,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAC7C,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;CACpC;AAKD,eAAO,MAAM,yBAAyB,GACpC,cAAc,iCAAiC,KAC9C,4BAgDC,CAAC;AAEL,eAAO,MAAM,yBAAyB,2FAYrC,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,8BAA8B,CAAC,EAAE,qCAAqC,CAAC;IAChF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,CAAC;IAC1D,QAAQ,CAAC,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAC;IAC9C,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAC;IAC9C,QAAQ,CAAC,eAAe,CAAC,EAAE,sBAAsB,CAAC;IAClD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,CAAC;IAC1D,QAAQ,CAAC,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,kCAAkC,CAAC,EAAE,MAAM,CAAC;CACtD;AA0KD,eAAO,MAAM,YAAY,GACvB,cAAc,oBAAoB,KACjC,eAwSF,CAAC;AAEF,eAAO,MAAM,YAAY,wCAexB,CAAC;AAEF,eAAO,MAAM,uCAAuC,GAClD,UAAU,qCAAqC,2CAe9C,CAAC"}