@effect-auth/core 0.1.0-alpha.1 → 0.1.0-alpha.2

package/dist/HttpApi/Security.d.ts

@@ -0,0 +1,147 @@
+import { Context, Duration, Effect, Layer } from "effect";
+import { HttpServerRequest } from "effect/unstable/http";
+import { HttpApiMiddleware } from "effect/unstable/httpapi";
+import type { HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi";
+import type { EmailVerificationIssueInput } from "../EmailVerification.js";
+import type { IpAddress } from "../Identifiers.js";
+import type { PasswordSignInInput, PasswordSignUpInput } from "../Password.js";
+import { Privacy } from "../Privacy.js";
+import type { PrivacyError } from "../Privacy.js";
+import { RateLimiter } from "../RateLimiter.js";
+import type { RateLimitError, RateLimitPolicy as RateLimitPolicyShape } from "../RateLimiter.js";
+import { AuthInternalError, AuthRateLimitedError, AuthRequestRejectedError } from "./Errors.js";
+export interface AuthOriginCheckOptions {
+    readonly allowedOrigins?: string | readonly string[];
+    readonly allowMissingOrigin?: boolean;
+}
+export interface AuthCsrfOptions {
+    readonly cookieName?: string;
+    readonly headerName?: string;
+}
+export interface AuthRequestMetadataOptions {
+    readonly trustProxyHeaders?: boolean;
+}
+export interface AuthRequestMetadataShape {
+    readonly method: string;
+    readonly url: string;
+    readonly ipAddress?: IpAddress;
+    readonly userAgent?: string;
+    readonly origin?: string;
+    readonly referer?: string;
+}
+export interface AuthRateLimitPolicyInput {
+    readonly metadata: AuthRequestMetadataShape;
+    readonly endpoint: HttpApiEndpoint.Any;
+    readonly group: HttpApiGroup.Any;
+}
+export type AuthRateLimitPolicy = (input: AuthRateLimitPolicyInput) => Effect.Effect<RateLimitPolicyShape | undefined, PrivacyError, Privacy>;
+export interface AuthRateLimitByIpOptions {
+    readonly id: string;
+    readonly window: Duration.Duration;
+    readonly limit: number;
+    readonly tokens?: number;
+}
+export interface AuthApiRateLimitRuleOptions {
+    readonly window?: Duration.Duration;
+    readonly limit?: number;
+    readonly tokens?: number;
+}
+export type AuthApiRateLimitRuleConfig = AuthApiRateLimitRuleOptions | boolean;
+export interface AuthApiEndpointRateLimitOptions {
+    readonly byIp?: AuthApiRateLimitRuleConfig;
+    readonly byEmail?: AuthApiRateLimitRuleConfig;
+}
+export type AuthApiEndpointRateLimitConfig = AuthApiEndpointRateLimitOptions | boolean;
+export interface AuthApiRateLimitOptions {
+    readonly trustProxyHeaders?: boolean;
+    readonly passwordSignIn?: AuthApiEndpointRateLimitConfig;
+    readonly passwordSignUp?: AuthApiEndpointRateLimitConfig;
+    readonly emailVerificationStart?: AuthApiEndpointRateLimitConfig;
+}
+export type AuthApiRateLimitConfigValue = AuthApiRateLimitOptions | boolean;
+export interface AuthHttpApiConfigValue {
+    readonly rateLimit?: AuthApiRateLimitConfigValue;
+    readonly originCheck?: AuthOriginCheckOptions;
+}
+export type AuthRateLimitEndpointKey = `${string}.${string}`;
+export type AuthRateLimitEndpointPolicyMap = Readonly<Record<AuthRateLimitEndpointKey, AuthRateLimitPolicy | undefined>>;
+export interface AuthApiRateLimitService {
+    readonly request: (input: AuthRateLimitPolicyInput) => Effect.Effect<void, RateLimitError | PrivacyError>;
+    readonly passwordSignIn: (input: PasswordSignInInput) => Effect.Effect<void, RateLimitError | PrivacyError>;
+    readonly passwordSignUp: (input: PasswordSignUpInput) => Effect.Effect<void, RateLimitError | PrivacyError>;
+    readonly emailVerificationStart: (input: EmailVerificationIssueInput) => Effect.Effect<void, RateLimitError | PrivacyError>;
+}
+declare const AuthApiRateLimit_base: Context.ServiceClass<AuthApiRateLimit, "auth/AuthApiRateLimit", AuthApiRateLimitService>;
+export declare class AuthApiRateLimit extends AuthApiRateLimit_base {
+}
+export declare namespace AuthApiRateLimit {
+    const make: (service: AuthApiRateLimitService) => AuthApiRateLimitService;
+}
+declare const AuthHttpApiConfig_base: Context.ServiceClass<AuthHttpApiConfig, "auth/AuthHttpApiConfig", AuthHttpApiConfigValue>;
+export declare class AuthHttpApiConfig extends AuthHttpApiConfig_base {
+}
+export declare namespace AuthHttpApiConfig {
+    const make: (config: AuthHttpApiConfigValue) => AuthHttpApiConfigValue;
+}
+declare const AuthRequestMetadata_base: Context.ServiceClass<AuthRequestMetadata, "auth/AuthRequestMetadata", AuthRequestMetadataShape>;
+export declare class AuthRequestMetadata extends AuthRequestMetadata_base {
+}
+export declare namespace AuthRequestMetadata {
+    const make: (metadata: AuthRequestMetadataShape) => AuthRequestMetadataShape;
+}
+declare const AuthOriginCheckMiddleware_base: HttpApiMiddleware.ServiceClass<AuthOriginCheckMiddleware, "auth/AuthOriginCheckMiddleware", {
+    requires: never;
+    provides: never;
+    error: typeof AuthRequestRejectedError;
+    clientError: never;
+    requiredForClient: false;
+    security: never;
+}, HttpApiMiddleware.HttpApiMiddleware<never, typeof AuthRequestRejectedError, never>>;
+export declare class AuthOriginCheckMiddleware extends AuthOriginCheckMiddleware_base {
+}
+declare const AuthRequestMetadataMiddleware_base: HttpApiMiddleware.ServiceClass<AuthRequestMetadataMiddleware, "auth/AuthRequestMetadataMiddleware", {
+    requires: never;
+    provides: AuthRequestMetadata;
+    error: never;
+    clientError: never;
+    requiredForClient: false;
+    security: never;
+}, HttpApiMiddleware.HttpApiMiddleware<AuthRequestMetadata, never, never>>;
+export declare class AuthRequestMetadataMiddleware extends AuthRequestMetadataMiddleware_base {
+}
+declare const AuthRateLimitMiddleware_base: HttpApiMiddleware.ServiceClass<AuthRateLimitMiddleware, "auth/AuthRateLimitMiddleware", {
+    requires: never;
+    provides: never;
+    error: readonly [typeof AuthRateLimitedError, typeof AuthInternalError];
+    clientError: never;
+    requiredForClient: false;
+    security: never;
+}, HttpApiMiddleware.HttpApiMiddleware<never, readonly [typeof AuthRateLimitedError, typeof AuthInternalError], never>>;
+export declare class AuthRateLimitMiddleware extends AuthRateLimitMiddleware_base {
+}
+declare const AuthCsrfMiddleware_base: HttpApiMiddleware.ServiceClass<AuthCsrfMiddleware, "auth/AuthCsrfMiddleware", {
+    requires: never;
+    provides: never;
+    error: typeof AuthRequestRejectedError;
+    clientError: never;
+    requiredForClient: false;
+    security: never;
+}, HttpApiMiddleware.HttpApiMiddleware<never, typeof AuthRequestRejectedError, never>>;
+export declare class AuthCsrfMiddleware extends AuthCsrfMiddleware_base {
+}
+export declare const makeAuthRequestMetadata: (request: HttpServerRequest.HttpServerRequest, options?: AuthRequestMetadataOptions) => AuthRequestMetadataShape;
+export declare const AuthRateLimitPolicy: {
+    readonly fixedWindowByIp: (options: AuthRateLimitByIpOptions) => AuthRateLimitPolicy;
+    readonly byEndpoint: (policies: AuthRateLimitEndpointPolicyMap) => AuthRateLimitPolicy;
+};
+export declare const AuthHttpApiConfigLive: (config: AuthHttpApiConfigValue) => Layer.Layer<AuthHttpApiConfig, never, never>;
+export declare const AuthApiRateLimitMiddlewareLive: Layer.Layer<AuthRateLimitMiddleware, never, AuthApiRateLimit>;
+export declare const AuthApiRateLimitLive: Layer.Layer<AuthApiRateLimit | AuthRateLimitMiddleware, never, Privacy | RateLimiter>;
+export declare const AuthApiRateLimitNoopLive: Layer.Layer<AuthApiRateLimit | AuthRateLimitMiddleware>;
+export declare const AuthOriginCheckMiddlewareLive: (options?: AuthOriginCheckOptions) => Layer.Layer<AuthOriginCheckMiddleware, never, never>;
+export declare const AuthOriginCheckMiddlewareConfigLive: Layer.Layer<AuthOriginCheckMiddleware, never, never>;
+export declare const AuthRequestMetadataMiddlewareLive: (options?: AuthRequestMetadataOptions) => Layer.Layer<AuthRequestMetadataMiddleware, never, never>;
+export declare const AuthRateLimitMiddlewareLive: (policy: AuthRateLimitPolicy, metadataOptions?: AuthRequestMetadataOptions) => Layer.Layer<AuthRateLimitMiddleware, never, Privacy | RateLimiter>;
+export declare const AuthCsrfMiddlewareLive: (options?: AuthCsrfOptions) => Layer.Layer<AuthCsrfMiddleware, never, never>;
+export {};
+//# sourceMappingURL=Security.d.ts.map

package/dist/HttpApi/Security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Security.d.ts","sourceRoot":"","sources":["../../src/HttpApi/Security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAU,MAAM,QAAQ,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE7E,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,YAAY,EAAkB,MAAM,eAAe,CAAC;AAClE,OAAO,EAAgB,WAAW,EAAmB,MAAM,mBAAmB,CAAC;AAC/E,OAAO,KAAK,EAEV,cAAc,EACd,eAAe,IAAI,oBAAoB,EACxC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,wBAAwB,EACzB,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IACrD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CACvC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACtC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,GAAG,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC;CAClC;AAED,MAAM,MAAM,mBAAmB,GAAG,CAChC,KAAK,EAAE,wBAAwB,KAC5B,MAAM,CAAC,MAAM,CAAC,oBAAoB,GAAG,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;AAE5E,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,0BAA0B,GAAG,2BAA2B,GAAG,OAAO,CAAC;AAE/E,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,IAAI,CAAC,EAAE,0BAA0B,CAAC;IAC3C,QAAQ,CAAC,OAAO,CAAC,EAAE,0BAA0B,CAAC;CAC/C;AAED,MAAM,MAAM,8BAA8B,GACtC,+BAA+B,GAC/B,OAAO,CAAC;AAEZ,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,8BAA8B,CAAC;IACzD,QAAQ,CAAC,cAAc,CAAC,EAAE,8BAA8B,CAAC;IACzD,QAAQ,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC;CAClE;AAED,MAAM,MAAM,2BAA2B,GAAG,uBAAuB,GAAG,OAAO,CAAC;AAE5E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,2BAA2B,CAAC;IACjD,QAAQ,CAAC,WAAW,CAAC,EAAE,sBAAsB,CAAC;CAC/C;AAED,MAAM,MAAM,wBAAwB,GAAG,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC;AAE7D,MAAM,MAAM,8BAA8B,GAAG,QAAQ,CACnD,MAAM,CAAC,wBAAwB,EAAE,mBAAmB,GAAG,SAAS,CAAC,CAClE,CAAC;AAEF,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,CAChB,KAAK,EAAE,wBAAwB,KAC5B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,GAAG,YAAY,CAAC,CAAC;IACxD,QAAQ,CAAC,cAAc,EAAE,CACvB,KAAK,EAAE,mBAAmB,KACvB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,GAAG,YAAY,CAAC,CAAC;IACxD,QAAQ,CAAC,cAAc,EAAE,CACvB,KAAK,EAAE,mBAAmB,KACvB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,GAAG,YAAY,CAAC,CAAC;IACxD,QAAQ,CAAC,sBAAsB,EAAE,CAC/B,KAAK,EAAE,2BAA2B,KAC/B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,GAAG,YAAY,CAAC,CAAC;CACzD;;AAED,qBAAa,gBAAiB,SAAQ,qBAGV;CAAG;AAE/B,yBAAiB,gBAAgB,CAAC;IACzB,MAAM,IAAI,GACf,SAAS,uBAAuB,KAC/B,uBAAuD,CAAC;CAC5D;;AAED,qBAAa,iBAAkB,SAAQ,sBAGV;CAAG;AAEhC,yBAAiB,iBAAiB,CAAC;IAC1B,MAAM,IAAI,GACf,QAAQ,sBAAsB,KAC7B,sBAAsD,CAAC;CAC3D;;AAED,qBAAa,mBAAoB,SAAQ,wBAGV;CAAG;AAElC,yBAAiB,mBAAmB,CAAC;IAC5B,MAAM,IAAI,GACf,UAAU,wBAAwB,KACjC,wBAA4D,CAAC;CACjE;;;;;;;;;AAED,qBAAa,yBAA0B,SAAQ,8BAG9C;CAAG;;;;;;;;;AAEJ,qBAAa,6BAA8B,SAAQ,kCAGV;CAAG;;;;;;;;;AAE5C,qBAAa,uBAAwB,SAAQ,4BAG5C;CAAG;;;;;;;;;AAEJ,qBAAa,kBAAmB,SAAQ,uBAGvC;CAAG;AA4EJ,eAAO,MAAM,uBAAuB,GAClC,SAAS,iBAAiB,CAAC,iBAAiB,EAC5C,UAAS,0BAA+B,KACvC,wBAaF,CAAC;AAoFF,eAAO,MAAM,mBAAmB;wCAElB,wBAAwB,KAAG,mBAAmB;oCAoB7C,8BAA8B,KAAG,mBAAmB;CAIzD,CAAC;AAiTX,eAAO,MAAM,qBAAqB,GAAI,QAAQ,sBAAsB,iDACF,CAAC;AAiBnE,eAAO,MAAM,8BAA8B,+DA6B1C,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,KAAK,CAAC,KAAK,CAC5C,gBAAgB,GAAG,uBAAuB,EAC1C,KAAK,EACL,OAAO,GAAG,WAAW,CAMtB,CAAC;AAEF,eAAO,MAAM,wBAAwB,EAAE,KAAK,CAAC,KAAK,CAChD,gBAAgB,GAAG,uBAAuB,CAI3C,CAAC;AAEF,eAAO,MAAM,6BAA6B,GACxC,UAAS,sBAA2B,yDAwBrC,CAAC;AAEF,eAAO,MAAM,mCAAmC,sDAS/C,CAAC;AAEF,eAAO,MAAM,iCAAiC,GAC5C,UAAS,0BAA+B,6DAavC,CAAC;AAEJ,eAAO,MAAM,2BAA2B,GACtC,QAAQ,mBAAmB,EAC3B,kBAAiB,0BAA+B,uEAkD/C,CAAC;AAEJ,eAAO,MAAM,sBAAsB,GAAI,UAAS,eAAoB,kDAoBnE,CAAC"}

package/dist/HttpApi/Security.js

@@ -0,0 +1,439 @@
+import { Context, Duration, Effect, Layer, Option } from "effect";
+import { HttpServerRequest } from "effect/unstable/http";
+import { HttpApiMiddleware } from "effect/unstable/httpapi";
+import { IpAddress as makeIpAddress } from "../Identifiers.js";
+import { Privacy } from "../Privacy.js";
+import { RateLimitKey, RateLimiter, RateLimitPolicy } from "../RateLimiter.js";
+import { AuthInternalError, AuthRateLimitedError, AuthRequestRejectedError, } from "./Errors.js";
+export class AuthApiRateLimit extends Context.Service()("auth/AuthApiRateLimit") {
+}
+(function (AuthApiRateLimit) {
+    AuthApiRateLimit.make = (service) => AuthApiRateLimit.of(service);
+})(AuthApiRateLimit || (AuthApiRateLimit = {}));
+export class AuthHttpApiConfig extends Context.Service()("auth/AuthHttpApiConfig") {
+}
+(function (AuthHttpApiConfig) {
+    AuthHttpApiConfig.make = (config) => AuthHttpApiConfig.of(config);
+})(AuthHttpApiConfig || (AuthHttpApiConfig = {}));
+export class AuthRequestMetadata extends Context.Service()("auth/AuthRequestMetadata") {
+}
+(function (AuthRequestMetadata) {
+    AuthRequestMetadata.make = (metadata) => AuthRequestMetadata.of(metadata);
+})(AuthRequestMetadata || (AuthRequestMetadata = {}));
+export class AuthOriginCheckMiddleware extends HttpApiMiddleware.Service()("auth/AuthOriginCheckMiddleware", { error: AuthRequestRejectedError }) {
+}
+export class AuthRequestMetadataMiddleware extends HttpApiMiddleware.Service()("auth/AuthRequestMetadataMiddleware") {
+}
+export class AuthRateLimitMiddleware extends HttpApiMiddleware.Service()("auth/AuthRateLimitMiddleware", { error: [AuthRateLimitedError, AuthInternalError] }) {
+}
+export class AuthCsrfMiddleware extends HttpApiMiddleware.Service()("auth/AuthCsrfMiddleware", { error: AuthRequestRejectedError }) {
+}
+const unsafeMethods = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+const normalizeOrigin = (value) => {
+    try {
+        return new URL(value).origin;
+    }
+    catch {
+        return undefined;
+    }
+};
+const allowedOriginValues = (allowedOrigins) => {
+    if (allowedOrigins === undefined) {
+        return [];
+    }
+    return (Array.isArray(allowedOrigins) ? allowedOrigins : [allowedOrigins])
+        .flatMap((origin) => origin.split(","))
+        .map((origin) => origin.trim())
+        .filter((origin) => origin.length > 0);
+};
+const firstHeaderValue = (value) => {
+    const first = value?.split(",", 1)[0]?.trim();
+    return first === "" ? undefined : first;
+};
+const cookieValue = (header, name) => {
+    if (header === undefined) {
+        return undefined;
+    }
+    for (const part of header.split(";")) {
+        const trimmed = part.trim();
+        const separator = trimmed.indexOf("=");
+        if (separator <= 0 || trimmed.slice(0, separator) !== name) {
+            continue;
+        }
+        try {
+            return decodeURIComponent(trimmed.slice(separator + 1));
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return undefined;
+};
+const firstForwardedIp = (value) => firstHeaderValue(value)?.split(",", 1)[0]?.trim();
+const ipFromHeaders = (headers, options) => {
+    if (!options.trustProxyHeaders) {
+        return undefined;
+    }
+    const ip = firstHeaderValue(headers["cf-connecting-ip"]) ??
+        firstHeaderValue(headers["true-client-ip"]) ??
+        firstForwardedIp(headers["x-forwarded-for"]) ??
+        firstHeaderValue(headers["x-real-ip"]);
+    return ip === undefined || ip === "" ? undefined : makeIpAddress(ip);
+};
+export const makeAuthRequestMetadata = (request, options = {}) => {
+    const resolved = {
+        trustProxyHeaders: options.trustProxyHeaders ?? false,
+    };
+    return AuthRequestMetadata.make({
+        method: request.method,
+        url: request.originalUrl,
+        ipAddress: ipFromHeaders(request.headers, resolved),
+        userAgent: firstHeaderValue(request.headers["user-agent"]),
+        origin: firstHeaderValue(request.headers.origin),
+        referer: firstHeaderValue(request.headers.referer),
+    });
+};
+const originFromReferer = (referer) => referer === undefined ? undefined : normalizeOrigin(referer);
+const requestOriginCandidates = (request) => {
+    const originalOrigin = normalizeOrigin(request.originalUrl);
+    if (originalOrigin !== undefined) {
+        return new Set([originalOrigin]);
+    }
+    const host = firstHeaderValue(request.headers["x-forwarded-host"]) ??
+        firstHeaderValue(request.headers.host);
+    if (host === undefined) {
+        return new Set();
+    }
+    const forwardedProto = firstHeaderValue(request.headers["x-forwarded-proto"]);
+    const protocols = forwardedProto === undefined ? ["http", "https"] : [forwardedProto];
+    return new Set(protocols.flatMap((protocol) => {
+        const origin = normalizeOrigin(`${protocol}://${host}`);
+        return origin === undefined ? [] : [origin];
+    }));
+};
+const originAllowed = (request, allowedOrigins, allowMissingOrigin) => {
+    if (!unsafeMethods.has(request.method)) {
+        return true;
+    }
+    const originHeader = request.headers.origin;
+    const refererHeader = request.headers.referer;
+    if (originHeader === undefined && refererHeader === undefined) {
+        return allowMissingOrigin;
+    }
+    const origin = originHeader !== undefined
+        ? normalizeOrigin(originHeader)
+        : originFromReferer(refererHeader);
+    if (origin === undefined) {
+        return false;
+    }
+    return (requestOriginCandidates(request).has(origin) || allowedOrigins.has(origin));
+};
+const csrfAllowed = (request, options) => {
+    if (!unsafeMethods.has(request.method)) {
+        return true;
+    }
+    const fromCookie = cookieValue(request.headers.cookie, options.cookieName);
+    const fromHeader = firstHeaderValue(request.headers[options.headerName.toLowerCase()]);
+    return (fromCookie !== undefined &&
+        fromCookie.length > 0 &&
+        fromCookie === fromHeader);
+};
+export const AuthRateLimitPolicy = {
+    fixedWindowByIp: (options) => (input) => Effect.gen(function* () {
+        const privacy = yield* Privacy;
+        const key = input.metadata.ipAddress === undefined
+            ? RateLimitKey.customHash("ip", "missing")
+            : RateLimitKey.ipHash(yield* privacy.ipHash(input.metadata.ipAddress));
+        return RateLimitPolicy.fixedWindow({
+            id: options.id,
+            key,
+            limit: options.limit,
+            tokens: options.tokens,
+            window: options.window,
+        });
+    }),
+    byEndpoint: (policies) => (input) => policies[`${input.group.identifier}.${input.endpoint.name}`]?.(input) ??
+        Effect.succeed(undefined),
+};
+const authApiRateLimitDefaults = {
+    trustProxyHeaders: false,
+    passwordSignIn: {
+        byIp: {
+            id: "auth.password.sign_in.ip",
+            limit: 20,
+            window: Duration.minutes(10),
+        },
+        byEmail: {
+            id: "auth.password.sign_in.email",
+            limit: 5,
+            window: Duration.minutes(10),
+        },
+    },
+    passwordSignUp: {
+        byIp: {
+            id: "auth.password.sign_up.ip",
+            limit: 10,
+            window: Duration.hours(1),
+        },
+        byEmail: {
+            id: "auth.password.sign_up.email",
+            limit: 3,
+            window: Duration.hours(1),
+        },
+    },
+    emailVerificationStart: {
+        byIp: {
+            id: "auth.email_verification.start.ip",
+            limit: 10,
+            window: Duration.minutes(10),
+        },
+        byEmail: {
+            id: "auth.email_verification.start.email",
+            limit: 3,
+            window: Duration.minutes(10),
+        },
+    },
+};
+const resolveAuthApiRateLimitRule = (defaults, config) => {
+    if (config === false) {
+        return undefined;
+    }
+    if (config === undefined || config === true) {
+        return defaults;
+    }
+    return {
+        id: defaults.id,
+        limit: config.limit ?? defaults.limit,
+        tokens: config.tokens ?? defaults.tokens,
+        window: config.window ?? defaults.window,
+    };
+};
+const resolveAuthApiEndpointRateLimit = (defaults, config) => {
+    if (config === false) {
+        return undefined;
+    }
+    if (config === undefined || config === true) {
+        return defaults;
+    }
+    const byIp = defaults.byIp === undefined
+        ? undefined
+        : resolveAuthApiRateLimitRule(defaults.byIp, config.byIp);
+    const byEmail = defaults.byEmail === undefined
+        ? undefined
+        : resolveAuthApiRateLimitRule(defaults.byEmail, config.byEmail);
+    return byIp === undefined && byEmail === undefined
+        ? undefined
+        : { byIp, byEmail };
+};
+const resolveAuthApiRateLimitConfig = (config) => {
+    if (config === false) {
+        return undefined;
+    }
+    if (config === true) {
+        return authApiRateLimitDefaults;
+    }
+    return {
+        trustProxyHeaders: config.trustProxyHeaders ?? authApiRateLimitDefaults.trustProxyHeaders,
+        passwordSignIn: resolveAuthApiEndpointRateLimit(authApiRateLimitDefaults.passwordSignIn, config.passwordSignIn),
+        passwordSignUp: resolveAuthApiEndpointRateLimit(authApiRateLimitDefaults.passwordSignUp, config.passwordSignUp),
+        emailVerificationStart: resolveAuthApiEndpointRateLimit(authApiRateLimitDefaults.emailVerificationStart, config.emailVerificationStart),
+    };
+};
+const makeRateLimitPolicy = (rule, key) => RateLimitPolicy.fixedWindow({
+    id: rule.id,
+    key,
+    limit: rule.limit,
+    tokens: rule.tokens,
+    window: rule.window,
+});
+const endpointKey = (input) => `${input.group.identifier}.${input.endpoint.name}`;
+const requestIpRule = (config, input) => {
+    switch (endpointKey(input)) {
+        case "password.signIn": {
+            return config?.passwordSignIn?.byIp;
+        }
+        case "password.signUp": {
+            return config?.passwordSignUp?.byIp;
+        }
+        case "emailVerification.start": {
+            return config?.emailVerificationStart?.byIp;
+        }
+        default: {
+            return undefined;
+        }
+    }
+};
+const ipRateLimitKey = (privacy, metadata) => metadata.ipAddress === undefined
+    ? Effect.succeed(RateLimitKey.customHash("ip", "missing"))
+    : Effect.map(privacy.ipHash(metadata.ipAddress), RateLimitKey.ipHash);
+const consumeRule = (rateLimiter, rule, key) => rateLimiter.require(makeRateLimitPolicy(rule, key));
+const authApiRateLimitConfig = Effect.gen(function* () {
+    const configOption = yield* Effect.serviceOption(AuthHttpApiConfig);
+    const config = Option.isSome(configOption)
+        ? (configOption.value.rateLimit ?? true)
+        : true;
+    return resolveAuthApiRateLimitConfig(config);
+});
+const noopAuthApiRateLimit = AuthApiRateLimit.make({
+    request: () => Effect.void,
+    passwordSignIn: () => Effect.void,
+    passwordSignUp: () => Effect.void,
+    emailVerificationStart: () => Effect.void,
+});
+const makeAuthApiRateLimit = (config, dependencies) => {
+    if (config === undefined) {
+        return noopAuthApiRateLimit;
+    }
+    return AuthApiRateLimit.make({
+        request: (input) => Effect.gen(function* () {
+            const rule = requestIpRule(config, input);
+            if (rule === undefined) {
+                return;
+            }
+            const key = yield* ipRateLimitKey(dependencies.privacy, input.metadata);
+            yield* consumeRule(dependencies.rateLimiter, rule, key);
+        }),
+        passwordSignIn: (input) => Effect.gen(function* () {
+            const rule = config.passwordSignIn?.byEmail;
+            if (rule === undefined) {
+                return;
+            }
+            const emailHash = yield* dependencies.privacy.emailHash(input.email);
+            yield* consumeRule(dependencies.rateLimiter, rule, RateLimitKey.emailHash(emailHash));
+        }),
+        passwordSignUp: (input) => Effect.gen(function* () {
+            const rule = config.passwordSignUp?.byEmail;
+            if (rule === undefined) {
+                return;
+            }
+            const emailHash = yield* dependencies.privacy.emailHash(input.email);
+            yield* consumeRule(dependencies.rateLimiter, rule, RateLimitKey.emailHash(emailHash));
+        }),
+        emailVerificationStart: (input) => Effect.gen(function* () {
+            const rule = config.emailVerificationStart?.byEmail;
+            if (rule === undefined) {
+                return;
+            }
+            const emailHash = yield* dependencies.privacy.emailHash(input.email);
+            yield* consumeRule(dependencies.rateLimiter, rule, RateLimitKey.emailHash(emailHash));
+        }),
+    });
+};
+const rateLimitMiddlewareError = (effect) => effect.pipe(Effect.catchTag("RateLimitExceededError", (error) => Effect.fail(new AuthRateLimitedError({
+    code: "rate_limited",
+    message: "Too many requests",
+    retryAfter: error.retryAfter,
+}))), Effect.catchTag("RateLimitStoreError", () => Effect.fail(new AuthInternalError({
+    code: "internal_error",
+    message: "Failed to consume rate limit",
+}))), Effect.catchTag("PrivacyError", () => Effect.fail(new AuthInternalError({
+    code: "internal_error",
+    message: "Failed to build rate limit key",
+}))));
+export const AuthHttpApiConfigLive = (config) => Layer.succeed(AuthHttpApiConfig, AuthHttpApiConfig.make(config));
+const AuthApiRateLimitServiceLive = Layer.effect(AuthApiRateLimit)(Effect.gen(function* () {
+    const config = yield* authApiRateLimitConfig;
+    if (config === undefined) {
+        return noopAuthApiRateLimit;
+    }
+    const privacy = yield* Privacy;
+    const rateLimiter = yield* RateLimiter;
+    return makeAuthApiRateLimit(config, { privacy, rateLimiter });
+}));
+export const AuthApiRateLimitMiddlewareLive = Layer.effect(AuthRateLimitMiddleware)(Effect.gen(function* () {
+    const config = yield* authApiRateLimitConfig;
+    const authApiRateLimit = yield* AuthApiRateLimit;
+    if (config === undefined) {
+        return (httpEffect) => httpEffect;
+    }
+    return (httpEffect, options) => Effect.gen(function* () {
+        const request = yield* HttpServerRequest.HttpServerRequest;
+        const metadata = makeAuthRequestMetadata(request, {
+            trustProxyHeaders: config.trustProxyHeaders,
+        });
+        yield* rateLimitMiddlewareError(authApiRateLimit.request({
+            metadata,
+            endpoint: options.endpoint,
+            group: options.group,
+        }));
+        return yield* httpEffect;
+    });
+}));
+export const AuthApiRateLimitLive = Layer.merge(AuthApiRateLimitServiceLive, AuthApiRateLimitMiddlewareLive.pipe(Layer.provide(AuthApiRateLimitServiceLive)));
+export const AuthApiRateLimitNoopLive = Layer.merge(Layer.succeed(AuthApiRateLimit, noopAuthApiRateLimit), Layer.succeed(AuthRateLimitMiddleware, (httpEffect) => httpEffect));
+export const AuthOriginCheckMiddlewareLive = (options = {}) => {
+    const allowedOrigins = new Set(allowedOriginValues(options.allowedOrigins).flatMap((origin) => {
+        const normalized = normalizeOrigin(origin);
+        return normalized === undefined ? [] : [normalized];
+    }));
+    const allowMissingOrigin = options.allowMissingOrigin ?? true;
+    return Layer.succeed(AuthOriginCheckMiddleware, (httpEffect) => Effect.gen(function* () {
+        const request = yield* HttpServerRequest.HttpServerRequest;
+        if (!originAllowed(request, allowedOrigins, allowMissingOrigin)) {
+            return yield* new AuthRequestRejectedError({
+                code: "request_rejected",
+                message: "Request origin is not allowed",
+            });
+        }
+        return yield* httpEffect;
+    }));
+};
+export const AuthOriginCheckMiddlewareConfigLive = Layer.unwrap(Effect.gen(function* () {
+    const configOption = yield* Effect.serviceOption(AuthHttpApiConfig);
+    const options = Option.isSome(configOption)
+        ? configOption.value.originCheck
+        : undefined;
+    return AuthOriginCheckMiddlewareLive(options);
+}));
+export const AuthRequestMetadataMiddlewareLive = (options = {}) => Layer.succeed(AuthRequestMetadataMiddleware, (httpEffect) => Effect.gen(function* () {
+    const request = yield* HttpServerRequest.HttpServerRequest;
+    const metadata = makeAuthRequestMetadata(request, options);
+    return yield* Effect.provideService(httpEffect, AuthRequestMetadata, metadata);
+}));
+export const AuthRateLimitMiddlewareLive = (policy, metadataOptions = {}) => Layer.effect(AuthRateLimitMiddleware, Effect.gen(function* () {
+    const rateLimiter = yield* RateLimiter;
+    const privacy = yield* Privacy;
+    return (httpEffect, options) => Effect.gen(function* () {
+        const request = yield* HttpServerRequest.HttpServerRequest;
+        const metadata = makeAuthRequestMetadata(request, metadataOptions);
+        const rateLimitPolicy = yield* policy({
+            metadata,
+            endpoint: options.endpoint,
+            group: options.group,
+        }).pipe(Effect.provideService(Privacy, privacy), Effect.mapError(() => new AuthInternalError({
+            code: "internal_error",
+            message: "Failed to build rate limit policy",
+        })));
+        if (rateLimitPolicy !== undefined) {
+            const decision = yield* rateLimiter.consume(rateLimitPolicy).pipe(Effect.mapError(() => new AuthInternalError({
+                code: "internal_error",
+                message: "Failed to consume rate limit",
+            })));
+            if (decision.type === "denied") {
+                return yield* new AuthRateLimitedError({
+                    code: "rate_limited",
+                    message: "Too many requests",
+                    retryAfter: decision.retryAfter,
+                });
+            }
+        }
+        return yield* httpEffect;
+    });
+}));
+export const AuthCsrfMiddlewareLive = (options = {}) => {
+    const resolved = {
+        cookieName: options.cookieName ?? "__Host-csrf",
+        headerName: options.headerName ?? "x-csrf-token",
+    };
+    return Layer.succeed(AuthCsrfMiddleware, (httpEffect) => Effect.gen(function* () {
+        const request = yield* HttpServerRequest.HttpServerRequest;
+        if (!csrfAllowed(request, resolved)) {
+            return yield* new AuthRequestRejectedError({
+                code: "request_rejected",
+                message: "CSRF token is invalid",
+            });
+        }
+        return yield* httpEffect;
+    }));
+};
+//# sourceMappingURL=Security.js.map

package/dist/HttpApi/Security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Security.js","sourceRoot":"","sources":["../../src/HttpApi/Security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAK5D,OAAO,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAE/D,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAM/E,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AA8FrB,MAAM,OAAO,gBAAiB,SAAQ,OAAO,CAAC,OAAO,EAGlD,CAAC,uBAAuB,CAAC;CAAG;AAE/B,WAAiB,gBAAgB;IAClB,qBAAI,GAAG,CAClB,OAAgC,EACP,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AAC7D,CAAC,EAJgB,gBAAgB,KAAhB,gBAAgB,QAIhC;AAED,MAAM,OAAO,iBAAkB,SAAQ,OAAO,CAAC,OAAO,EAGnD,CAAC,wBAAwB,CAAC;CAAG;AAEhC,WAAiB,iBAAiB;IACnB,sBAAI,GAAG,CAClB,MAA8B,EACN,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;AAC5D,CAAC,EAJgB,iBAAiB,KAAjB,iBAAiB,QAIjC;AAED,MAAM,OAAO,mBAAoB,SAAQ,OAAO,CAAC,OAAO,EAGrD,CAAC,0BAA0B,CAAC;CAAG;AAElC,WAAiB,mBAAmB;IACrB,wBAAI,GAAG,CAClB,QAAkC,EACR,EAAE,CAAC,mBAAmB,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;AAClE,CAAC,EAJgB,mBAAmB,KAAnB,mBAAmB,QAInC;AAED,MAAM,OAAO,yBAA0B,SAAQ,iBAAiB,CAAC,OAAO,EAA6B,CACnG,gCAAgC,EAChC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CACpC;CAAG;AAEJ,MAAM,OAAO,6BAA8B,SAAQ,iBAAiB,CAAC,OAAO,EAGzE,CAAC,oCAAoC,CAAC;CAAG;AAE5C,MAAM,OAAO,uBAAwB,SAAQ,iBAAiB,CAAC,OAAO,EAA2B,CAC/F,8BAA8B,EAC9B,EAAE,KAAK,EAAE,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,EAAE,CACrD;CAAG;AAEJ,MAAM,OAAO,kBAAmB,SAAQ,iBAAiB,CAAC,OAAO,EAAsB,CACrF,yBAAyB,EACzB,EAAE,KAAK,EAAE,wBAAwB,EAAE,CACpC;CAAG;AAEJ,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAElE,MAAM,eAAe,GAAG,CAAC,KAAa,EAAsB,EAAE;IAC5D,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAC1B,cAAwD,EACrC,EAAE;IACrB,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;SACvE,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SACtC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;SAC9B,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,KAAyB,EAAsB,EAAE;IACzE,MAAM,KAAK,GAAG,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC9C,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AAC1C,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAClB,MAA0B,EAC1B,IAAY,EACQ,EAAE;IACtB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEvC,IAAI,SAAS,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;YAC3D,SAAS;QACX,CAAC;QAED,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,KAAyB,EAAsB,EAAE,CACzE,gBAAgB,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AAEpD,MAAM,aAAa,GAAG,CACpB,OAAqD,EACrD,OAA6C,EACtB,EAAE;IACzB,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,EAAE,GACN,gBAAgB,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC7C,gBAAgB,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC3C,gBAAgB,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC5C,gBAAgB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IAEzC,OAAO,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;AACvE,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,OAA4C,EAC5C,UAAsC,EAAE,EACd,EAAE;IAC5B,MAAM,QAAQ,GAAyC;QACrD,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,KAAK;KACtD,CAAC;IAEF,OAAO,mBAAmB,CAAC,IAAI,CAAC;QAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,EAAE,OAAO,CAAC,WAAW;QACxB,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC;QACnD,SAAS,EAAE,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,EAAE,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;QAChD,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;KACnD,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,OAA2B,EAAsB,EAAE,CAC5E,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;AAE/D,MAAM,uBAAuB,GAAG,CAC9B,OAA4C,EACvB,EAAE;IACvB,MAAM,cAAc,GAAG,eAAe,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAE5D,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,IAAI,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,IAAI,GACR,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACrD,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IAED,MAAM,cAAc,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC9E,MAAM,SAAS,GACb,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IAEtE,OAAO,IAAI,GAAG,CACZ,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,QAAQ,MAAM,IAAI,EAAE,CAAC,CAAC;QACxD,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CACpB,OAA4C,EAC5C,cAAmC,EACnC,kBAA2B,EAClB,EAAE;IACX,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;IAC5C,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;IAE9C,IAAI,YAAY,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAC9D,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GACV,YAAY,KAAK,SAAS;QACxB,CAAC,CAAC,eAAe,CAAC,YAAY,CAAC;QAC/B,CAAC,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;IAEvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CACL,uBAAuB,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAC3E,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAClB,OAA4C,EAC5C,OAAkC,EACzB,EAAE;IACX,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3E,MAAM,UAAU,GAAG,gBAAgB,CACjC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAClD,CAAC;IAEF,OAAO,CACL,UAAU,KAAK,SAAS;QACxB,UAAU,CAAC,MAAM,GAAG,CAAC;QACrB,UAAU,KAAK,UAAU,CAC1B,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,eAAe,EACb,CAAC,OAAiC,EAAuB,EAAE,CAC3D,CAAC,KAAK,EAAE,EAAE,CACR,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC;QAC/B,MAAM,GAAG,GACP,KAAK,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS;YACpC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC;YAC1C,CAAC,CAAC,YAAY,CAAC,MAAM,CACjB,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAChD,CAAC;QAER,OAAO,eAAe,CAAC,WAAW,CAAC;YACjC,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,GAAG;YACH,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;IACL,CAAC,CAAC;IACN,UAAU,EACR,CAAC,QAAwC,EAAuB,EAAE,CAClE,CAAC,KAAK,EAAE,EAAE,CACR,QAAQ,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QACrE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;CACrB,CAAC;AAqBX,MAAM,wBAAwB,GAAG;IAC/B,iBAAiB,EAAE,KAAK;IACxB,cAAc,EAAE;QACd,IAAI,EAAE;YACJ,EAAE,EAAE,0BAA0B;YAC9B,KAAK,EAAE,EAAE;YACT,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;SAC7B;QACD,OAAO,EAAE;YACP,EAAE,EAAE,6BAA6B;YACjC,KAAK,EAAE,CAAC;YACR,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;SAC7B;KACF;IACD,cAAc,EAAE;QACd,IAAI,EAAE;YACJ,EAAE,EAAE,0BAA0B;YAC9B,KAAK,EAAE,EAAE;YACT,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;SAC1B;QACD,OAAO,EAAE;YACP,EAAE,EAAE,6BAA6B;YACjC,KAAK,EAAE,CAAC;YACR,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;SAC1B;KACF;IACD,sBAAsB,EAAE;QACtB,IAAI,EAAE;YACJ,EAAE,EAAE,kCAAkC;YACtC,KAAK,EAAE,EAAE;YACT,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;SAC7B;QACD,OAAO,EAAE;YACP,EAAE,EAAE,qCAAqC;YACzC,KAAK,EAAE,CAAC;YACR,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;SAC7B;KACF;CACgD,CAAC;AAEpD,MAAM,2BAA2B,GAAG,CAClC,QAAsC,EACtC,MAA8C,EACJ,EAAE;IAC5C,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK;QACrC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM;QACxC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM;KACzC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,+BAA+B,GAAG,CACtC,QAA0C,EAC1C,MAAkD,EACJ,EAAE;IAChD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GACR,QAAQ,CAAC,IAAI,KAAK,SAAS;QACzB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,2BAA2B,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9D,MAAM,OAAO,GACX,QAAQ,CAAC,OAAO,KAAK,SAAS;QAC5B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,2BAA2B,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAEpE,OAAO,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;QAChD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACxB,CAAC,CAAC;AAEF,MAAM,6BAA6B,GAAG,CACpC,MAAmC,EACS,EAAE;IAC9C,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,wBAAwB,CAAC;IAClC,CAAC;IAED,OAAO;QACL,iBAAiB,EACf,MAAM,CAAC,iBAAiB,IAAI,wBAAwB,CAAC,iBAAiB;QACxE,cAAc,EAAE,+BAA+B,CAC7C,wBAAwB,CAAC,cAAc,EACvC,MAAM,CAAC,cAAc,CACtB;QACD,cAAc,EAAE,+BAA+B,CAC7C,wBAAwB,CAAC,cAAc,EACvC,MAAM,CAAC,cAAc,CACtB;QACD,sBAAsB,EAAE,+BAA+B,CACrD,wBAAwB,CAAC,sBAAsB,EAC/C,MAAM,CAAC,sBAAsB,CAC9B;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAC1B,IAAkC,EAClC,GAAiB,EACK,EAAE,CACxB,eAAe,CAAC,WAAW,CAAC;IAC1B,EAAE,EAAE,IAAI,CAAC,EAAE;IACX,GAAG;IACH,KAAK,EAAE,IAAI,CAAC,KAAK;IACjB,MAAM,EAAE,IAAI,CAAC,MAAM;IACnB,MAAM,EAAE,IAAI,CAAC,MAAM;CACpB,CAAC,CAAC;AAEL,MAAM,WAAW,GAAG,CAClB,KAA+B,EACL,EAAE,CAC5B,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;AAErD,MAAM,aAAa,GAAG,CACpB,MAAkD,EAClD,KAA+B,EACW,EAAE;IAC5C,QAAQ,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,OAAO,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC;QACtC,CAAC;QACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,OAAO,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC;QACtC,CAAC;QACD,KAAK,yBAAyB,CAAC,CAAC,CAAC;YAC/B,OAAO,MAAM,EAAE,sBAAsB,EAAE,IAAI,CAAC;QAC9C,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CACrB,OAAuB,EACvB,QAAkC,EACS,EAAE,CAC7C,QAAQ,CAAC,SAAS,KAAK,SAAS;IAC9B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC1D,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;AAE1E,MAAM,WAAW,GAAG,CAClB,WAA+B,EAC/B,IAAkC,EAClC,GAAiB,EACjB,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;AAEzD,MAAM,sBAAsB,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACjD,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;QACxC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC;IAET,OAAO,6BAA6B,CAAC,MAAM,CAAC,CAAC;AAC/C,CAAC,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,IAAI,CAAC;IACjD,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI;IAC1B,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI;IACjC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI;IACjC,sBAAsB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI;CAC1C,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAC3B,MAAkD,EAClD,YAGC,EACwB,EAAE;IAC3B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,OAAO,gBAAgB,CAAC,IAAI,CAAC;QAC3B,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAE1C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO;YACT,CAAC;YAED,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YACxE,KAAK,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC1D,CAAC,CAAC;QACJ,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CACxB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC;YAE5C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO;YACT,CAAC;YAED,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACrE,KAAK,CAAC,CAAC,WAAW,CAChB,YAAY,CAAC,WAAW,EACxB,IAAI,EACJ,YAAY,CAAC,SAAS,CAAC,SAAS,CAAC,CAClC,CAAC;QACJ,CAAC,CAAC;QACJ,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CACxB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC;YAE5C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO;YACT,CAAC;YAED,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACrE,KAAK,CAAC,CAAC,WAAW,CAChB,YAAY,CAAC,WAAW,EACxB,IAAI,EACJ,YAAY,CAAC,SAAS,CAAC,SAAS,CAAC,CAClC,CAAC;QACJ,CAAC,CAAC;QACJ,sBAAsB,EAAE,CAAC,KAAK,EAAE,EAAE,CAChC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,IAAI,GAAG,MAAM,CAAC,sBAAsB,EAAE,OAAO,CAAC;YAEpD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO;YACT,CAAC;YAED,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACrE,KAAK,CAAC,CAAC,WAAW,CAChB,YAAY,CAAC,WAAW,EACxB,IAAI,EACJ,YAAY,CAAC,SAAS,CAAC,SAAS,CAAC,CAClC,CAAC;QACJ,CAAC,CAAC;KACL,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,wBAAwB,GAAG,CAC/B,MAA0D,EAC1D,EAAE,CACF,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,QAAQ,CAAC,wBAAwB,EAAE,CAAC,KAAK,EAAE,EAAE,CAClD,MAAM,CAAC,IAAI,CACT,IAAI,oBAAoB,CAAC;IACvB,IAAI,EAAE,cAAc;IACpB,OAAO,EAAE,mBAAmB;IAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;CAC7B,CAAC,CACH,CACF,EACD,MAAM,CAAC,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAC1C,MAAM,CAAC,IAAI,CACT,IAAI,iBAAiB,CAAC;IACpB,IAAI,EAAE,gBAAgB;IACtB,OAAO,EAAE,8BAA8B;CACxC,CAAC,CACH,CACF,EACD,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE,CACnC,MAAM,CAAC,IAAI,CACT,IAAI,iBAAiB,CAAC;IACpB,IAAI,EAAE,gBAAgB;IACtB,OAAO,EAAE,gCAAgC;CAC1C,CAAC,CACH,CACF,CACF,CAAC;AAEJ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,MAA8B,EAAE,EAAE,CACtE,KAAK,CAAC,OAAO,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAEnE,MAAM,2BAA2B,GAAG,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAChE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,sBAAsB,CAAC;IAE7C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC;IAC/B,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;IAEvC,OAAO,oBAAoB,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;AAChE,CAAC,CAAC,CACH,CAAC;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAAG,KAAK,CAAC,MAAM,CACxD,uBAAuB,CACxB,CACC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,sBAAsB,CAAC;IAC7C,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC;IAEjD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC;IACpC,CAAC;IAED,OAAO,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,CAC7B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;QAC3D,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,EAAE;YAChD,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;SAC5C,CAAC,CAAC;QAEH,KAAK,CAAC,CAAC,wBAAwB,CAC7B,gBAAgB,CAAC,OAAO,CAAC;YACvB,QAAQ;YACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CACH,CAAC;QAEF,OAAO,KAAK,CAAC,CAAC,UAAU,CAAC;IAC3B,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CACH,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAI7B,KAAK,CAAC,KAAK,CACb,2BAA2B,EAC3B,8BAA8B,CAAC,IAAI,CACjC,KAAK,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAC3C,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAEjC,KAAK,CAAC,KAAK,CACb,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,EACrD,KAAK,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,CACnE,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC3C,UAAkC,EAAE,EACpC,EAAE;IACF,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,mBAAmB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;QAC7D,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAC3C,OAAO,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACtD,CAAC,CAAC,CACH,CAAC;IACF,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC;IAE9D,OAAO,KAAK,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC,UAAU,EAAE,EAAE,CAC7D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;QAE3D,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,cAAc,EAAE,kBAAkB,CAAC,EAAE,CAAC;YAChE,OAAO,KAAK,CAAC,CAAC,IAAI,wBAAwB,CAAC;gBACzC,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,+BAA+B;aACzC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,KAAK,CAAC,CAAC,UAAU,CAAC;IAC3B,CAAC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mCAAmC,GAAG,KAAK,CAAC,MAAM,CAC7D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;QACzC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW;QAChC,CAAC,CAAC,SAAS,CAAC;IAEd,OAAO,6BAA6B,CAAC,OAAO,CAAC,CAAC;AAChD,CAAC,CAAC,CACH,CAAC;AAEF,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAC/C,UAAsC,EAAE,EACxC,EAAE,CACF,KAAK,CAAC,OAAO,CAAC,6BAA6B,EAAE,CAAC,UAAU,EAAE,EAAE,CAC1D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;IAC3D,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAE3D,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CACjC,UAAU,EACV,mBAAmB,EACnB,QAAQ,CACT,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEJ,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,MAA2B,EAC3B,kBAA8C,EAAE,EAChD,EAAE,CACF,KAAK,CAAC,MAAM,CACV,uBAAuB,EACvB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC;IAE/B,OAAO,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,CAC7B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;QAC3D,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACnE,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC;YACpC,QAAQ;YACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,EACvC,MAAM,CAAC,QAAQ,CACb,GAAG,EAAE,CACH,IAAI,iBAAiB,CAAC;YACpB,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,mCAAmC;SAC7C,CAAC,CACL,CACF,CAAC;QAEF,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,IAAI,CAC/D,MAAM,CAAC,QAAQ,CACb,GAAG,EAAE,CACH,IAAI,iBAAiB,CAAC;gBACpB,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,8BAA8B;aACxC,CAAC,CACL,CACF,CAAC;YAEF,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC/B,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC;oBACrC,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,mBAAmB;oBAC5B,UAAU,EAAE,QAAQ,CAAC,UAAU;iBAChC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,CAAC,UAAU,CAAC;IAC3B,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CACH,CAAC;AAEJ,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,UAA2B,EAAE,EAAE,EAAE;IACtE,MAAM,QAAQ,GAA8B;QAC1C,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,aAAa;QAC/C,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,cAAc;KACjD,CAAC;IAEF,OAAO,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,UAAU,EAAE,EAAE,CACtD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;QAE3D,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC,CAAC,IAAI,wBAAwB,CAAC;gBACzC,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,uBAAuB;aACjC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,KAAK,CAAC,CAAC,UAAU,CAAC;IAC3B,CAAC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC"}

package/dist/HttpApi/Transport.d.ts

@@ -0,0 +1,31 @@
+import { Context, Effect, Layer } from "effect";
+import { HttpServerResponse } from "effect/unstable/http";
+import type { PasswordSignInResult, PasswordSignUpResult } from "../Password.js";
+import { SessionCookie } from "../Sessions.js";
+import type { IssuedSession, SessionCookieService, ValidatedSession } from "../Sessions.js";
+import { AuthInternalError, AuthInvalidCredentialsError, AuthPolicyDeniedError } from "./Errors.js";
+export type Json = null | boolean | number | string | readonly Json[] | {
+    readonly [key: string]: Json;
+};
+export type PasswordSignInHttpError = AuthInvalidCredentialsError | AuthPolicyDeniedError | AuthInternalError;
+export type PasswordSignUpHttpError = AuthPolicyDeniedError | AuthInternalError;
+export interface AuthHttpService {
+    readonly commitPasswordSignInResult: (result: PasswordSignInResult) => Effect.Effect<HttpServerResponse.HttpServerResponse, PasswordSignInHttpError>;
+    readonly commitPasswordSignUpResult: (result: PasswordSignUpResult) => Effect.Effect<HttpServerResponse.HttpServerResponse, PasswordSignUpHttpError>;
+    readonly commitCurrentSession: (session: ValidatedSession) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError>;
+    readonly commitSessionRefreshed: (session: IssuedSession) => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError>;
+    readonly commitSessionCleared: () => Effect.Effect<HttpServerResponse.HttpServerResponse, AuthInternalError>;
+}
+declare const AuthHttp_base: Context.ServiceClass<AuthHttp, "auth/AuthHttp", AuthHttpService>;
+export declare class AuthHttp extends AuthHttp_base {
+}
+export declare namespace AuthHttp {
+    const make: (service: AuthHttpService) => AuthHttpService;
+}
+export interface AuthHttpDependencies {
+    readonly sessionCookie: SessionCookieService;
+}
+export declare const makeAuthHttp: (dependencies: AuthHttpDependencies) => AuthHttpService;
+export declare const AuthHttpTransportLive: Layer.Layer<AuthHttp, never, SessionCookie>;
+export {};
+//# sourceMappingURL=Transport.d.ts.map