@effect-auth/core 0.1.0-alpha.15 → 0.1.0-alpha.18

package/dist/AbuseProtection.d.ts

@@ -0,0 +1,100 @@
+import { Context, Effect, Layer, Redacted } from "effect";
+export type BotProtectionOperation = "sign-up" | "sign-in" | "password-reset-start" | "password-reset-verify" | "email-otp-start" | "email-otp-verify" | "email-auth" | "magic-link-start" | "magic-link-verify" | "email-verification-start" | "identity-availability";
+/** Untrusted browser material. It is redacted so it cannot be logged accidentally. */
+export type BrowserBotProof = Redacted.Redacted<string>;
+/** Request facts populated by trusted server code, never directly from browser input. */
+export interface TrustedBotRequestContext {
+    readonly ip?: string;
+    readonly userAgent?: string;
+    readonly origin?: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface BotChallengeVerifyInput {
+    readonly proof: BrowserBotProof;
+    readonly operation: BotProtectionOperation;
+    readonly request: TrustedBotRequestContext;
+    readonly expectedAction: string;
+    readonly allowedHostnames?: readonly string[];
+}
+export type BotChallengeVerifierResult = {
+    readonly valid: true;
+    readonly action: string;
+    readonly hostname?: string;
+} | {
+    readonly valid: false;
+    readonly reason?: "invalid-token" | "action-mismatch" | "hostname-mismatch";
+};
+declare const BotChallengeProviderError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "BotChallengeProviderError";
+} & Readonly<A>;
+export declare class BotChallengeProviderError extends BotChallengeProviderError_base<{
+    readonly message: string;
+    readonly retryable: boolean;
+    readonly cause?: unknown;
+}> {
+}
+export interface BotChallengeVerifierService {
+    readonly verify: (input: BotChallengeVerifyInput) => Effect.Effect<BotChallengeVerifierResult, BotChallengeProviderError>;
+}
+declare const BotChallengeVerifier_base: Context.ServiceClass<BotChallengeVerifier, "auth/BotChallengeVerifier", BotChallengeVerifierService>;
+export declare class BotChallengeVerifier extends BotChallengeVerifier_base {
+}
+export type BotProtectionOutageMode = "fail-open" | "fail-closed";
+export type BotProtectionDecision = {
+    readonly type: "Skip";
+} | {
+    readonly type: "Verify";
+    readonly action: string;
+    readonly allowedHostnames?: readonly string[];
+    readonly outageMode: BotProtectionOutageMode;
+};
+export interface BotProtectionPolicyInput {
+    readonly operation: BotProtectionOperation;
+    readonly request: TrustedBotRequestContext;
+}
+export interface BotProtectionPolicyService {
+    readonly decide: (input: BotProtectionPolicyInput) => Effect.Effect<BotProtectionDecision>;
+}
+declare const BotProtectionPolicy_base: Context.ServiceClass<BotProtectionPolicy, "auth/BotProtectionPolicy", BotProtectionPolicyService>;
+export declare class BotProtectionPolicy extends BotProtectionPolicy_base {
+}
+declare const AbuseProtectionDeniedError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "AbuseProtectionDeniedError";
+} & Readonly<A>;
+export declare class AbuseProtectionDeniedError extends AbuseProtectionDeniedError_base<{
+    readonly message: string;
+}> {
+}
+declare const AbuseProtectionConfigError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "AbuseProtectionConfigError";
+} & Readonly<A>;
+export declare class AbuseProtectionConfigError extends AbuseProtectionConfigError_base<{
+    readonly message: string;
+}> {
+}
+export interface EnforceBotProtectionInput extends BotProtectionPolicyInput {
+    readonly proof?: BrowserBotProof;
+}
+export interface BotProtectionService {
+    readonly enforce: (input: EnforceBotProtectionInput) => Effect.Effect<void, AbuseProtectionDeniedError | AbuseProtectionConfigError>;
+}
+declare const BotProtection_base: Context.ServiceClass<BotProtection, "auth/BotProtection", BotProtectionService>;
+export declare class BotProtection extends BotProtection_base {
+}
+export declare namespace BotProtection {
+    const skip: () => BotProtectionDecision;
+    const verify: (input: Omit<Extract<BotProtectionDecision, {
+        readonly type: "Verify";
+    }>, "type">) => BotProtectionDecision;
+}
+export declare const makeBotProtection: (dependencies: {
+    readonly policy: BotProtectionPolicyService;
+    readonly verifier: BotChallengeVerifierService;
+}) => BotProtectionService;
+export declare const enforceBotProtection: (input: EnforceBotProtectionInput) => Effect.Effect<void, AbuseProtectionConfigError | AbuseProtectionDeniedError, BotProtection>;
+export declare const BotChallengeVerifierNoopLive: Layer.Layer<BotChallengeVerifier, never, never>;
+export declare const BotProtectionPolicyDefaultLive: Layer.Layer<BotProtectionPolicy, never, never>;
+export declare const BotProtectionNoopLive: Layer.Layer<BotProtection, never, never>;
+export declare const BotProtectionDefaultLive: Layer.Layer<BotProtection, never, BotChallengeVerifier | BotProtectionPolicy>;
+export {};
+//# sourceMappingURL=AbuseProtection.d.ts.map

package/dist/AbuseProtection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AbuseProtection.d.ts","sourceRoot":"","sources":["../src/AbuseProtection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAQ,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAEhE,MAAM,MAAM,sBAAsB,GAC9B,SAAS,GACT,SAAS,GACT,sBAAsB,GACtB,uBAAuB,GACvB,iBAAiB,GACjB,kBAAkB,GAClB,YAAY,GACZ,kBAAkB,GAClB,mBAAmB,GACnB,0BAA0B,GAC1B,uBAAuB,CAAC;AAE5B,sFAAsF;AACtF,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAExD,yFAAyF;AACzF,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAC;IAC3C,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC3C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AAED,MAAM,MAAM,0BAA0B,GAClC;IACE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B,GACD;IACE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EACZ,eAAe,GACf,iBAAiB,GACjB,mBAAmB,CAAC;CACzB,CAAC;;;;AAEN,qBAAa,yBAA0B,SAAQ,+BAE7C;IACA,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AAEL,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,CACf,KAAK,EAAE,uBAAuB,KAC3B,MAAM,CAAC,MAAM,CAAC,0BAA0B,EAAE,yBAAyB,CAAC,CAAC;CAC3E;;AAED,qBAAa,oBAAqB,SAAQ,yBAGV;CAAG;AAEnC,MAAM,MAAM,uBAAuB,GAAG,WAAW,GAAG,aAAa,CAAC;AAClE,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC;CAC9C,CAAC;AAEN,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAC;IAC3C,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;CAC5C;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,CACf,KAAK,EAAE,wBAAwB,KAC5B,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;CAC3C;;AAED,qBAAa,mBAAoB,SAAQ,wBAGV;CAAG;;;;AAElC,qBAAa,0BAA2B,SAAQ,gCAE9C;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;CAAG;;;;AAClC,qBAAa,0BAA2B,SAAQ,gCAE9C;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;CAAG;AAElC,MAAM,WAAW,yBAA0B,SAAQ,wBAAwB;IACzE,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;CAClC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,CAChB,KAAK,EAAE,yBAAyB,KAC7B,MAAM,CAAC,MAAM,CAChB,IAAI,EACJ,0BAA0B,GAAG,0BAA0B,CACxD,CAAC;CACH;;AAED,qBAAa,aAAc,SAAQ,kBAGV;CAAG;AAE5B,yBAAiB,aAAa,CAAC;IACtB,MAAM,IAAI,QAAO,qBAA2C,CAAC;IAE7D,MAAM,MAAM,UACV,IAAI,CACT,OAAO,CAAC,qBAAqB,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC,EAC3D,MAAM,CACP,KACA,qBAAuD,CAAC;CAC5D;AAKD,eAAO,MAAM,iBAAiB,iBAAkB;IAC9C,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,CAAC;CAChD,KAAG,oBAiDA,CAAC;AAEL,eAAO,MAAM,oBAAoB,UAAW,yBAAyB,gGACD,CAAC;AAErE,eAAO,MAAM,4BAA4B,iDAKxC,CAAC;AACF,eAAO,MAAM,8BAA8B,gDAG1C,CAAC;AACF,eAAO,MAAM,qBAAqB,0CAGjC,CAAC;AACF,eAAO,MAAM,wBAAwB,+EAQpC,CAAC"}

package/dist/AbuseProtection.js

@@ -0,0 +1,71 @@
+import { Context, Data, Effect, Layer, Redacted } from "effect";
+export class BotChallengeProviderError extends Data.TaggedError("BotChallengeProviderError") {
+}
+export class BotChallengeVerifier extends Context.Service()("auth/BotChallengeVerifier") {
+}
+export class BotProtectionPolicy extends Context.Service()("auth/BotProtectionPolicy") {
+}
+export class AbuseProtectionDeniedError extends Data.TaggedError("AbuseProtectionDeniedError") {
+}
+export class AbuseProtectionConfigError extends Data.TaggedError("AbuseProtectionConfigError") {
+}
+export class BotProtection extends Context.Service()("auth/BotProtection") {
+}
+(function (BotProtection) {
+    BotProtection.skip = () => ({ type: "Skip" });
+    BotProtection.verify = (input) => ({ type: "Verify", ...input });
+})(BotProtection || (BotProtection = {}));
+const denied = () => new AbuseProtectionDeniedError({ message: "Request could not be verified" });
+export const makeBotProtection = (dependencies) => BotProtection.of({
+    enforce: (input) => Effect.gen(function* () {
+        const decision = yield* dependencies.policy.decide(input);
+        if (decision.type === "Skip") {
+            return;
+        }
+        if (decision.action.trim().length === 0) {
+            return yield* new AbuseProtectionConfigError({
+                message: "Bot protection action is not configured",
+            });
+        }
+        if (input.proof === undefined) {
+            return yield* denied();
+        }
+        const result = yield* dependencies.verifier
+            .verify({
+            proof: input.proof,
+            operation: input.operation,
+            request: input.request,
+            expectedAction: decision.action,
+            allowedHostnames: decision.allowedHostnames,
+        })
+            .pipe(Effect.catchTag("BotChallengeProviderError", (error) => decision.outageMode === "fail-open" && error.retryable
+            ? Effect.succeed(undefined)
+            : Effect.fail(new AbuseProtectionConfigError({
+                message: "Bot challenge verifier failed",
+            }))));
+        if (result === undefined) {
+            return;
+        }
+        if (!result.valid || result.action !== decision.action) {
+            return yield* denied();
+        }
+        if (decision.allowedHostnames !== undefined &&
+            (result.hostname === undefined ||
+                !decision.allowedHostnames.includes(result.hostname))) {
+            return yield* denied();
+        }
+    }),
+});
+export const enforceBotProtection = (input) => Effect.flatMap(BotProtection, (service) => service.enforce(input));
+export const BotChallengeVerifierNoopLive = Layer.succeed(BotChallengeVerifier, BotChallengeVerifier.of({
+    verify: () => Effect.succeed({ valid: false }),
+}));
+export const BotProtectionPolicyDefaultLive = Layer.succeed(BotProtectionPolicy, BotProtectionPolicy.of({ decide: () => Effect.succeed({ type: "Skip" }) }));
+export const BotProtectionNoopLive = Layer.succeed(BotProtection, BotProtection.of({ enforce: () => Effect.void }));
+export const BotProtectionDefaultLive = Layer.effect(BotProtection, Effect.gen(function* () {
+    return makeBotProtection({
+        policy: yield* BotProtectionPolicy,
+        verifier: yield* BotChallengeVerifier,
+    });
+}));
+//# sourceMappingURL=AbuseProtection.js.map

package/dist/AbuseProtection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AbuseProtection.js","sourceRoot":"","sources":["../src/AbuseProtection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAgDhE,MAAM,OAAO,yBAA0B,SAAQ,IAAI,CAAC,WAAW,CAC7D,2BAA2B,CAK3B;CAAG;AAQL,MAAM,OAAO,oBAAqB,SAAQ,OAAO,CAAC,OAAO,EAGtD,CAAC,2BAA2B,CAAC;CAAG;AAuBnC,MAAM,OAAO,mBAAoB,SAAQ,OAAO,CAAC,OAAO,EAGrD,CAAC,0BAA0B,CAAC;CAAG;AAElC,MAAM,OAAO,0BAA2B,SAAQ,IAAI,CAAC,WAAW,CAC9D,4BAA4B,CACC;CAAG;AAClC,MAAM,OAAO,0BAA2B,SAAQ,IAAI,CAAC,WAAW,CAC9D,4BAA4B,CACC;CAAG;AAelC,MAAM,OAAO,aAAc,SAAQ,OAAO,CAAC,OAAO,EAG/C,CAAC,oBAAoB,CAAC;CAAG;AAE5B,WAAiB,aAAa;IACf,kBAAI,GAAG,GAA0B,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAEvD,oBAAM,GAAG,CACpB,KAGC,EACsB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;AAC7D,CAAC,EATgB,aAAa,KAAb,aAAa,QAS7B;AAED,MAAM,MAAM,GAAG,GAAG,EAAE,CAClB,IAAI,0BAA0B,CAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAC;AAE/E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,YAGjC,EAAwB,EAAE,CACzB,aAAa,CAAC,EAAE,CAAC;IACf,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC,CAAC,IAAI,0BAA0B,CAAC;gBAC3C,OAAO,EAAE,yCAAyC;aACnD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QACzB,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,QAAQ;aACxC,MAAM,CAAC;YACN,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,QAAQ,CAAC,MAAM;YAC/B,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;SAC5C,CAAC;aACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,2BAA2B,EAAE,CAAC,KAAK,EAAE,EAAE,CACrD,QAAQ,CAAC,UAAU,KAAK,WAAW,IAAI,KAAK,CAAC,SAAS;YACpD,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;YAC3B,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,IAAI,0BAA0B,CAAC;gBAC7B,OAAO,EAAE,+BAA+B;aACzC,CAAC,CACH,CACN,CACF,CAAC;QACJ,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;YACvD,OAAO,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QACzB,CAAC;QACD,IACE,QAAQ,CAAC,gBAAgB,KAAK,SAAS;YACvC,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS;gBAC5B,CAAC,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EACvD,CAAC;YACD,OAAO,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QACzB,CAAC;IACH,CAAC,CAAC;CACL,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,KAAgC,EAAE,EAAE,CACvE,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AAErE,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC,OAAO,CACvD,oBAAoB,EACpB,oBAAoB,CAAC,EAAE,CAAC;IACtB,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;CAC/C,CAAC,CACH,CAAC;AACF,MAAM,CAAC,MAAM,8BAA8B,GAAG,KAAK,CAAC,OAAO,CACzD,mBAAmB,EACnB,mBAAmB,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAC3E,CAAC;AACF,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC,OAAO,CAChD,aAAa,EACb,aAAa,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CACjD,CAAC;AACF,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC,MAAM,CAClD,aAAa,EACb,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,OAAO,iBAAiB,CAAC;QACvB,MAAM,EAAE,KAAK,CAAC,CAAC,mBAAmB;QAClC,QAAQ,EAAE,KAAK,CAAC,CAAC,oBAAoB;KACtC,CAAC,CAAC;AACL,CAAC,CAAC,CACH,CAAC"}

package/dist/AccessGrant.d.ts

@@ -0,0 +1,344 @@
+import { Brand, Context, Effect, Layer, Redacted, Schema } from "effect";
+import type * as OptionTypes from "effect/Option";
+import { Crypto } from "./Crypto.js";
+import type { UnixMillis } from "./Identifiers.js";
+import { PermissionSubject } from "./Permission.js";
+export type AccessGrantId = Brand.Branded<string, "auth/AccessGrantId">;
+export declare const AccessGrantId: Brand.Constructor<AccessGrantId>;
+export declare const AccessGrantIdSchema: Schema.brand<Schema.String, "auth/AccessGrantId">;
+export type AccessGrantToken = Brand.Branded<string, "auth/AccessGrantToken">;
+export declare const AccessGrantToken: Brand.Constructor<AccessGrantToken>;
+export type AccessGrantTokenHash = Brand.Branded<string, "auth/AccessGrantTokenHash">;
+export declare const AccessGrantTokenHash: Brand.Constructor<AccessGrantTokenHash>;
+export declare const AccessGrantTokenHashSchema: Schema.brand<Schema.String, "auth/AccessGrantTokenHash">;
+export declare const accessGrantTokenVersion: "agr1";
+export declare const accessGrantIdBytes = 16;
+export declare const accessGrantSecretBytes = 32;
+export type AccessGrantTokenOperation = "generate" | "parse" | "hash" | "verify";
+declare const AccessGrantTokenError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "AccessGrantTokenError";
+} & Readonly<A>;
+export declare class AccessGrantTokenError extends AccessGrantTokenError_base<{
+    readonly operation: AccessGrantTokenOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface GeneratedAccessGrantToken {
+    readonly id: AccessGrantId;
+    readonly token: Redacted.Redacted<AccessGrantToken>;
+}
+export interface ParsedAccessGrantToken {
+    readonly id: AccessGrantId;
+}
+export interface AccessGrantTokenHashInput {
+    readonly token: Redacted.Redacted<string>;
+}
+export interface AccessGrantTokenVerifyInput extends AccessGrantTokenHashInput {
+    readonly tokenHash: AccessGrantTokenHash;
+}
+export interface AccessGrantTokensService {
+    readonly generateId: () => Effect.Effect<AccessGrantId, AccessGrantTokenError>;
+    readonly generate: () => Effect.Effect<GeneratedAccessGrantToken, AccessGrantTokenError>;
+    readonly parse: (token: Redacted.Redacted<string>) => Effect.Effect<ParsedAccessGrantToken, AccessGrantTokenError>;
+    readonly hash: (input: AccessGrantTokenHashInput) => Effect.Effect<AccessGrantTokenHash, AccessGrantTokenError>;
+    readonly verify: (input: AccessGrantTokenVerifyInput) => Effect.Effect<boolean, AccessGrantTokenError>;
+}
+declare const AccessGrantTokens_base: Context.ServiceClass<AccessGrantTokens, "auth/AccessGrantTokens", AccessGrantTokensService> & {
+    readonly make: Effect.Effect<AccessGrantTokensService, never, Crypto>;
+};
+export declare class AccessGrantTokens extends AccessGrantTokens_base {
+}
+export declare const AccessGrantTokensSha256Live: Layer.Layer<AccessGrantTokens, never, Crypto>;
+export interface AccessGrantTarget {
+    readonly type: string;
+    readonly id: string;
+}
+export declare const AccessGrantTarget: {
+    readonly make: (type: string, id: string) => AccessGrantTarget;
+};
+export interface AccessGrantBearerBinding {
+    readonly type: "bearer";
+}
+export interface AccessGrantSubjectBinding {
+    readonly type: "subject";
+    readonly subject: PermissionSubject;
+}
+export interface AccessGrantSubjectAndBearerBinding {
+    readonly type: "subject-and-bearer";
+    readonly subject: PermissionSubject;
+}
+export type AccessGrantBinding = AccessGrantBearerBinding | AccessGrantSubjectBinding | AccessGrantSubjectAndBearerBinding;
+export declare const AccessGrantBinding: {
+    readonly bearer: () => AccessGrantBearerBinding;
+    readonly subject: (subject: PermissionSubject) => AccessGrantSubjectBinding;
+    readonly subjectAndBearer: (subject: PermissionSubject) => AccessGrantSubjectAndBearerBinding;
+};
+interface AccessGrantBase {
+    readonly id: AccessGrantId;
+    readonly target: AccessGrantTarget;
+    readonly capabilities: readonly string[];
+    readonly issuer?: PermissionSubject;
+    readonly createdAt: UnixMillis;
+    readonly expiresAt?: UnixMillis;
+    readonly revokedAt?: UnixMillis;
+    readonly supersededAt?: UnixMillis;
+    readonly supersededById?: AccessGrantId;
+    readonly metadata?: Schema.JsonObject;
+}
+export type BearerAccessGrant = AccessGrantBase & {
+    readonly binding: AccessGrantBearerBinding | AccessGrantSubjectAndBearerBinding;
+};
+export type SubjectAccessGrant = AccessGrantBase & {
+    readonly binding: AccessGrantSubjectBinding;
+};
+export type AccessGrant = BearerAccessGrant | SubjectAccessGrant;
+export type AccessGrantBearerRecord = BearerAccessGrant & {
+    readonly tokenHash: AccessGrantTokenHash;
+};
+export type AccessGrantSubjectRecord = SubjectAccessGrant & {
+    readonly tokenHash?: never;
+};
+export type AccessGrantRecord = AccessGrantBearerRecord | AccessGrantSubjectRecord;
+export declare const AccessGrantJsonObjectSchema: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+export declare const AccessGrantTargetSchema: Schema.Struct<{
+    readonly type: Schema.String;
+    readonly id: Schema.String;
+}>;
+export declare const AccessGrantBindingSchema: Schema.Union<readonly [Schema.Struct<{
+    readonly type: Schema.Literal<"bearer">;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"subject">;
+    readonly subject: Schema.Struct<{
+        readonly type: Schema.String;
+        readonly id: Schema.String;
+    }>;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"subject-and-bearer">;
+    readonly subject: Schema.Struct<{
+        readonly type: Schema.String;
+        readonly id: Schema.String;
+    }>;
+}>]>;
+export declare const AccessGrantRecordSchema: Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "auth/AccessGrantId">;
+    readonly target: Schema.Struct<{
+        readonly type: Schema.String;
+        readonly id: Schema.String;
+    }>;
+    readonly capabilities: Schema.$Array<Schema.String>;
+    readonly binding: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"bearer">;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"subject">;
+        readonly subject: Schema.Struct<{
+            readonly type: Schema.String;
+            readonly id: Schema.String;
+        }>;
+    }>, Schema.Struct<{
+        readonly type: Schema.Literal<"subject-and-bearer">;
+        readonly subject: Schema.Struct<{
+            readonly type: Schema.String;
+            readonly id: Schema.String;
+        }>;
+    }>]>;
+    readonly issuer: Schema.optional<Schema.Struct<{
+        readonly type: Schema.String;
+        readonly id: Schema.String;
+    }>>;
+    readonly createdAt: Schema.brand<Schema.Number, "auth/UnixMillis">;
+    readonly expiresAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly tokenHash: Schema.optional<Schema.brand<Schema.String, "auth/AccessGrantTokenHash">>;
+    readonly revokedAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly supersededAt: Schema.optional<Schema.brand<Schema.Number, "auth/UnixMillis">>;
+    readonly supersededById: Schema.optional<Schema.brand<Schema.String, "auth/AccessGrantId">>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
+}>;
+export declare const isAccessGrantRecord: <I>(input: I) => input is I & {
+    readonly id: string & Brand.Brand<"auth/AccessGrantId">;
+    readonly target: Schema.Struct.ReadonlySide<{
+        readonly type: Schema.String;
+        readonly id: Schema.String;
+    }, "Type">;
+    readonly capabilities: readonly string[];
+    readonly binding: Schema.Struct.ReadonlySide<{
+        readonly type: Schema.Literal<"bearer">;
+    }, "Type"> | Schema.Struct.ReadonlySide<{
+        readonly type: Schema.Literal<"subject">;
+        readonly subject: Schema.Struct<{
+            readonly type: Schema.String;
+            readonly id: Schema.String;
+        }>;
+    }, "Type"> | Schema.Struct.ReadonlySide<{
+        readonly type: Schema.Literal<"subject-and-bearer">;
+        readonly subject: Schema.Struct<{
+            readonly type: Schema.String;
+            readonly id: Schema.String;
+        }>;
+    }, "Type">;
+    readonly issuer?: Schema.Struct.ReadonlySide<{
+        readonly type: Schema.String;
+        readonly id: Schema.String;
+    }, "Type"> | undefined;
+    readonly createdAt: number & Brand.Brand<"auth/UnixMillis">;
+    readonly expiresAt?: (number & Brand.Brand<"auth/UnixMillis">) | undefined;
+    readonly tokenHash?: (string & Brand.Brand<"auth/AccessGrantTokenHash">) | undefined;
+    readonly revokedAt?: (number & Brand.Brand<"auth/UnixMillis">) | undefined;
+    readonly supersededAt?: (number & Brand.Brand<"auth/UnixMillis">) | undefined;
+    readonly supersededById?: (string & Brand.Brand<"auth/AccessGrantId">) | undefined;
+    readonly metadata?: {
+        readonly [x: string]: Schema.Json;
+    } | undefined;
+};
+export interface AccessGrantStoreListInput {
+    readonly target?: AccessGrantTarget;
+    readonly issuer?: PermissionSubject;
+    readonly subject?: PermissionSubject;
+}
+export interface AccessGrantStoreRevokeInput {
+    readonly id: AccessGrantId;
+    readonly revokedAt: UnixMillis;
+}
+export interface AccessGrantStoreSupersedeInput {
+    readonly id: AccessGrantId;
+    readonly supersededAt: UnixMillis;
+    readonly replacement: AccessGrantRecord;
+}
+export interface AccessGrantSupersededRecords {
+    readonly previous: AccessGrantRecord;
+    readonly replacement: AccessGrantRecord;
+}
+export type AccessGrantStoreOperation = "insert" | "find" | "list" | "revoke" | "supersede";
+declare const AccessGrantStoreError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "AccessGrantStoreError";
+} & Readonly<A>;
+export declare class AccessGrantStoreError extends AccessGrantStoreError_base<{
+    readonly operation: AccessGrantStoreOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface AccessGrantStoreService {
+    readonly insert: (record: AccessGrantRecord) => Effect.Effect<boolean, AccessGrantStoreError>;
+    readonly findById: (id: AccessGrantId) => Effect.Effect<OptionTypes.Option<AccessGrantRecord>, AccessGrantStoreError>;
+    readonly list: (input?: AccessGrantStoreListInput) => Effect.Effect<readonly AccessGrantRecord[], AccessGrantStoreError>;
+    readonly revoke: (input: AccessGrantStoreRevokeInput) => Effect.Effect<OptionTypes.Option<AccessGrantRecord>, AccessGrantStoreError>;
+    readonly supersede: (input: AccessGrantStoreSupersedeInput) => Effect.Effect<OptionTypes.Option<AccessGrantSupersededRecords>, AccessGrantStoreError>;
+}
+declare const AccessGrantStore_base: Context.ServiceClass<AccessGrantStore, "auth/AccessGrantStore", AccessGrantStoreService>;
+export declare class AccessGrantStore extends AccessGrantStore_base {
+}
+export declare const AccessGrantStoreMemoryLive: Layer.Layer<AccessGrantStore>;
+export type AccessGrantActivity = "active" | "inactive" | "all";
+export interface AccessGrantIssueInput {
+    readonly target: AccessGrantTarget;
+    readonly capabilities: readonly string[];
+    readonly binding: AccessGrantBinding;
+    readonly issuer?: PermissionSubject;
+    readonly expiresAt?: UnixMillis;
+    readonly metadata?: Schema.JsonObject;
+}
+export interface IssuedBearerAccessGrant {
+    readonly grant: BearerAccessGrant;
+    readonly token: Redacted.Redacted<AccessGrantToken>;
+}
+export interface IssuedSubjectAccessGrant {
+    readonly grant: SubjectAccessGrant;
+    readonly token?: never;
+}
+export type IssuedAccessGrant = IssuedBearerAccessGrant | IssuedSubjectAccessGrant;
+export interface AccessGrantManagementListInput extends AccessGrantStoreListInput {
+    readonly activity?: AccessGrantActivity;
+}
+export interface AccessGrantRevokeInput {
+    readonly id: AccessGrantId;
+}
+export interface AccessGrantSupersedeInput {
+    readonly id: AccessGrantId;
+    readonly expiresAt?: UnixMillis;
+    readonly metadata?: Schema.JsonObject;
+}
+export interface SupersededBearerAccessGrant extends IssuedBearerAccessGrant {
+    readonly previous: AccessGrant;
+}
+export interface SupersededSubjectAccessGrant extends IssuedSubjectAccessGrant {
+    readonly previous: AccessGrant;
+}
+export type SupersededAccessGrant = SupersededBearerAccessGrant | SupersededSubjectAccessGrant;
+export type AccessGrantManagementOperation = "issue" | "list" | "get" | "revoke" | "supersede";
+export type AccessGrantManagementErrorReason = "invalid_input" | "not_found" | "inactive" | "conflict" | "token" | "storage";
+declare const AccessGrantManagementError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "AccessGrantManagementError";
+} & Readonly<A>;
+export declare class AccessGrantManagementError extends AccessGrantManagementError_base<{
+    readonly operation: AccessGrantManagementOperation;
+    readonly reason: AccessGrantManagementErrorReason;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface AccessGrantManagementService {
+    readonly issue: (input: AccessGrantIssueInput) => Effect.Effect<IssuedAccessGrant, AccessGrantManagementError>;
+    readonly list: (input?: AccessGrantManagementListInput) => Effect.Effect<readonly AccessGrant[], AccessGrantManagementError>;
+    readonly get: (id: AccessGrantId) => Effect.Effect<OptionTypes.Option<AccessGrant>, AccessGrantManagementError>;
+    readonly revoke: (input: AccessGrantRevokeInput) => Effect.Effect<AccessGrant, AccessGrantManagementError>;
+    readonly supersede: (input: AccessGrantSupersedeInput) => Effect.Effect<SupersededAccessGrant, AccessGrantManagementError>;
+}
+declare const AccessGrantManagement_base: Context.ServiceClass<AccessGrantManagement, "auth/AccessGrantManagement", AccessGrantManagementService> & {
+    readonly make: Effect.Effect<AccessGrantManagementService, never, AccessGrantStore | AccessGrantTokens>;
+};
+export declare class AccessGrantManagement extends AccessGrantManagement_base {
+}
+export declare const AccessGrantManagementLive: Layer.Layer<AccessGrantManagement, never, AccessGrantTokens | AccessGrantStore>;
+export interface AccessGrantCheckInput {
+    readonly grantId?: AccessGrantId;
+    readonly bearerToken?: Redacted.Redacted<string>;
+    readonly target: AccessGrantTarget;
+    readonly action: string;
+}
+export type AccessGrantDenyReason = "grant-id-required" | "malformed-token" | "grant-reference-mismatch" | "grant-not-found" | "invalid-record" | "revoked" | "superseded" | "expired" | "target-mismatch" | "capability-missing" | "bearer-required" | "invalid-bearer" | "subject-required" | "subject-mismatch";
+export interface AccessGrantAllowedDecision {
+    readonly type: "allowed";
+    readonly grant: AccessGrant;
+    readonly principal: PermissionSubject;
+}
+export interface AccessGrantDeniedDecision {
+    readonly type: "denied";
+    readonly reason: AccessGrantDenyReason;
+    readonly grantId?: AccessGrantId;
+}
+export type AccessGrantDecision = AccessGrantAllowedDecision | AccessGrantDeniedDecision;
+export type AccessGrantAuthorizationFailureKind = "store" | "token";
+declare const AccessGrantAuthorizationError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "AccessGrantAuthorizationError";
+} & Readonly<A>;
+export declare class AccessGrantAuthorizationError extends AccessGrantAuthorizationError_base<{
+    readonly operation: "check";
+    readonly kind: AccessGrantAuthorizationFailureKind;
+    readonly message: string;
+    readonly cause: AccessGrantStoreError | AccessGrantTokenError;
+}> {
+}
+declare const AccessGrantDeniedError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "AccessGrantDeniedError";
+} & Readonly<A>;
+/** Expected authorization denials from `require`; operational failures stay separate. */
+export declare class AccessGrantDeniedError extends AccessGrantDeniedError_base<{
+    readonly reason: AccessGrantDenyReason;
+    readonly grantId?: AccessGrantId;
+}> {
+}
+export interface AccessGrantsService {
+    /** Subject bindings read optional `CurrentPrincipal`; never copy a request subject into context. */
+    readonly check: (input: AccessGrantCheckInput) => Effect.Effect<AccessGrantDecision, AccessGrantAuthorizationError>;
+    /** Lifts a denied decision into `AccessGrantDeniedError` without hiding operational errors. */
+    readonly require: (input: AccessGrantCheckInput) => Effect.Effect<AccessGrantAllowedDecision, AccessGrantDeniedError | AccessGrantAuthorizationError>;
+}
+declare const AccessGrants_base: Context.ServiceClass<AccessGrants, "auth/AccessGrants", AccessGrantsService> & {
+    readonly make: Effect.Effect<AccessGrantsService, never, AccessGrantStore | AccessGrantTokens>;
+};
+export declare class AccessGrants extends AccessGrants_base {
+}
+export declare const AccessGrantsLive: Layer.Layer<AccessGrants, never, AccessGrantTokens | AccessGrantStore>;
+export {};
+//# sourceMappingURL=AccessGrant.d.ts.map

package/dist/AccessGrant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessGrant.d.ts","sourceRoot":"","sources":["../src/AccessGrant.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,EACL,OAAO,EAEP,MAAM,EAEN,KAAK,EAGL,QAAQ,EAER,MAAM,EACP,MAAM,QAAQ,CAAC;AAChB,OAAO,KAAK,KAAK,WAAW,MAAM,eAAe,CAAC;AAElD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAGrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAAoB,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEtE,MAAM,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;AACxE,eAAO,MAAM,aAAa,kCAAiC,CAAC;AAC5D,eAAO,MAAM,mBAAmB,mDAEU,CAAC;AAE3C,MAAM,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;AAC9E,eAAO,MAAM,gBAAgB,qCAAoC,CAAC;AAElE,MAAM,MAAM,oBAAoB,GAAG,KAAK,CAAC,OAAO,CAC9C,MAAM,EACN,2BAA2B,CAC5B,CAAC;AACF,eAAO,MAAM,oBAAoB,yCAAwC,CAAC;AAC1E,eAAO,MAAM,0BAA0B,0DAEU,CAAC;AAElD,eAAO,MAAM,uBAAuB,EAAG,MAAe,CAAC;AACvD,eAAO,MAAM,kBAAkB,KAAK,CAAC;AACrC,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAczC,MAAM,MAAM,yBAAyB,GACjC,UAAU,GACV,OAAO,GACP,MAAM,GACN,QAAQ,CAAC;;;;AAEb,qBAAa,qBAAsB,SAAQ,2BAEzC;IACA,QAAQ,CAAC,SAAS,EAAE,yBAAyB,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AAEL,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAC;CAC5B;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,2BAA4B,SAAQ,yBAAyB;IAC5E,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;CAC1C;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,MAAM,CAAC,MAAM,CACtC,aAAa,EACb,qBAAqB,CACtB,CAAC;IACF,QAAQ,CAAC,QAAQ,EAAE,MAAM,MAAM,CAAC,MAAM,CACpC,yBAAyB,EACzB,qBAAqB,CACtB,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE,CACd,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,KAC7B,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE,qBAAqB,CAAC,CAAC;IAClE,QAAQ,CAAC,IAAI,EAAE,CACb,KAAK,EAAE,yBAAyB,KAC7B,MAAM,CAAC,MAAM,CAAC,oBAAoB,EAAE,qBAAqB,CAAC,CAAC;IAChE,QAAQ,CAAC,MAAM,EAAE,CACf,KAAK,EAAE,2BAA2B,KAC/B,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;CACpD;;;;AAmGD,qBAAa,iBAAkB,SAAQ,sBAyFrC;CAAG;AAEL,eAAO,MAAM,2BAA2B,EAAE,KAAK,CAAC,KAAK,CACnD,iBAAiB,EACjB,KAAK,EACL,MAAM,CACmD,CAAC;AAE5D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,iBAAiB;aAC5B,IAAI,SAAS,MAAM,MAAM,MAAM,KAAG,iBAAiB;CAC3C,CAAC;AAEX,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;CACzB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;CACrC;AAED,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;CACrC;AAED,MAAM,MAAM,kBAAkB,GAC1B,wBAAwB,GACxB,yBAAyB,GACzB,kCAAkC,CAAC;AAEvC,eAAO,MAAM,kBAAkB;aAC7B,MAAM,QAAM,wBAAwB;aACpC,OAAO,YAAY,iBAAiB,KAAG,yBAAyB;aAIhE,gBAAgB,YACL,iBAAiB,KACzB,kCAAkC;CAI7B,CAAC;AAEX,UAAU,eAAe;IACvB,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC;IACnC,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC;IACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACvC;AAED,MAAM,MAAM,iBAAiB,GAAG,eAAe,GAAG;IAChD,QAAQ,CAAC,OAAO,EACZ,wBAAwB,GACxB,kCAAkC,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,eAAe,GAAG;IACjD,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAC;CAC7C,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,iBAAiB,GAAG,kBAAkB,CAAC;AAEjE,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GAAG;IACxD,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG,kBAAkB,GAAG;IAC1D,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,iBAAiB,GACzB,uBAAuB,GACvB,wBAAwB,CAAC;AAoB7B,eAAO,MAAM,2BAA2B,qFAGvC,CAAC;AACF,eAAO,MAAM,uBAAuB;;;EAGlC,CAAC;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;IAUnC,CAAC;AASH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwCnC,CAAC;AACF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAqC,CAAC;AAgHtE,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,iBAAiB,CAAC;CACtC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;CAChC;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;CACzC;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;CACzC;AAED,MAAM,MAAM,yBAAyB,GACjC,QAAQ,GACR,MAAM,GACN,MAAM,GACN,QAAQ,GACR,WAAW,CAAC;;;;AAEhB,qBAAa,qBAAsB,SAAQ,2BAEzC;IACA,QAAQ,CAAC,SAAS,EAAE,yBAAyB,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AAEL,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,CACf,MAAM,EAAE,iBAAiB,KACtB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;IACnD,QAAQ,CAAC,QAAQ,EAAE,CACjB,EAAE,EAAE,aAAa,KACd,MAAM,CAAC,MAAM,CAChB,WAAW,CAAC,MAAM,CAAC,iBAAiB,CAAC,EACrC,qBAAqB,CACtB,CAAC;IACF,QAAQ,CAAC,IAAI,EAAE,CACb,KAAK,CAAC,EAAE,yBAAyB,KAC9B,MAAM,CAAC,MAAM,CAAC,SAAS,iBAAiB,EAAE,EAAE,qBAAqB,CAAC,CAAC;IACxE,QAAQ,CAAC,MAAM,EAAE,CACf,KAAK,EAAE,2BAA2B,KAC/B,MAAM,CAAC,MAAM,CAChB,WAAW,CAAC,MAAM,CAAC,iBAAiB,CAAC,EACrC,qBAAqB,CACtB,CAAC;IACF,QAAQ,CAAC,SAAS,EAAE,CAClB,KAAK,EAAE,8BAA8B,KAClC,MAAM,CAAC,MAAM,CAChB,WAAW,CAAC,MAAM,CAAC,4BAA4B,CAAC,EAChD,qBAAqB,CACtB,CAAC;CACH;;AAED,qBAAa,gBAAiB,SAAQ,qBAGV;CAAG;AAiI/B,eAAO,MAAM,0BAA0B,EAAE,KAAK,CAAC,KAAK,CAAC,gBAAgB,CACb,CAAC;AAEzD,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,UAAU,GAAG,KAAK,CAAC;AAEhE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACvC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAED,MAAM,MAAM,iBAAiB,GACzB,uBAAuB,GACvB,wBAAwB,CAAC;AAE7B,MAAM,WAAW,8BAA+B,SAAQ,yBAAyB;IAC/E,QAAQ,CAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CACzC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAC;CAC5B;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACvC;AAED,MAAM,WAAW,2BAA4B,SAAQ,uBAAuB;IAC1E,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;CAChC;AAED,MAAM,WAAW,4BAA6B,SAAQ,wBAAwB;IAC5E,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;CAChC;AAED,MAAM,MAAM,qBAAqB,GAC7B,2BAA2B,GAC3B,4BAA4B,CAAC;AAEjC,MAAM,MAAM,8BAA8B,GACtC,OAAO,GACP,MAAM,GACN,KAAK,GACL,QAAQ,GACR,WAAW,CAAC;AAEhB,MAAM,MAAM,gCAAgC,GACxC,eAAe,GACf,WAAW,GACX,UAAU,GACV,UAAU,GACV,OAAO,GACP,SAAS,CAAC;;;;AAEd,qBAAa,0BAA2B,SAAQ,gCAE9C;IACA,QAAQ,CAAC,SAAS,EAAE,8BAA8B,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,gCAAgC,CAAC;IAClD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AAEL,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,KAAK,EAAE,CACd,KAAK,EAAE,qBAAqB,KACzB,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,0BAA0B,CAAC,CAAC;IAClE,QAAQ,CAAC,IAAI,EAAE,CACb,KAAK,CAAC,EAAE,8BAA8B,KACnC,MAAM,CAAC,MAAM,CAAC,SAAS,WAAW,EAAE,EAAE,0BAA0B,CAAC,CAAC;IACvE,QAAQ,CAAC,GAAG,EAAE,CACZ,EAAE,EAAE,aAAa,KACd,MAAM,CAAC,MAAM,CAChB,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,EAC/B,0BAA0B,CAC3B,CAAC;IACF,QAAQ,CAAC,MAAM,EAAE,CACf,KAAK,EAAE,sBAAsB,KAC1B,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,0BAA0B,CAAC,CAAC;IAC5D,QAAQ,CAAC,SAAS,EAAE,CAClB,KAAK,EAAE,yBAAyB,KAC7B,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,0BAA0B,CAAC,CAAC;CACvE;;;;AA4PD,qBAAa,qBAAsB,SAAQ,0BA8MzC;CAAG;AAEL,eAAO,MAAM,yBAAyB,EAAE,KAAK,CAAC,KAAK,CACjD,qBAAqB,EACrB,KAAK,EACL,iBAAiB,GAAG,gBAAgB,CAC6B,CAAC;AAEpE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjD,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,qBAAqB,GAC7B,mBAAmB,GACnB,iBAAiB,GACjB,0BAA0B,GAC1B,iBAAiB,GACjB,gBAAgB,GAChB,SAAS,GACT,YAAY,GACZ,SAAS,GACT,iBAAiB,GACjB,oBAAoB,GACpB,iBAAiB,GACjB,gBAAgB,GAChB,kBAAkB,GAClB,kBAAkB,CAAC;AAEvB,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;CACvC;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IACvC,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;CAClC;AAED,MAAM,MAAM,mBAAmB,GAC3B,0BAA0B,GAC1B,yBAAyB,CAAC;AAE9B,MAAM,MAAM,mCAAmC,GAAG,OAAO,GAAG,OAAO,CAAC;;;;AAEpE,qBAAa,6BAA8B,SAAQ,mCAEjD;IACA,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,mCAAmC,CAAC;IACnD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,qBAAqB,GAAG,qBAAqB,CAAC;CAC/D,CAAC;CAAG;;;;AAEL,yFAAyF;AACzF,qBAAa,sBAAuB,SAAQ,4BAE1C;IACA,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IACvC,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;CAClC,CAAC;CAAG;AAEL,MAAM,WAAW,mBAAmB;IAClC,oGAAoG;IACpG,QAAQ,CAAC,KAAK,EAAE,CACd,KAAK,EAAE,qBAAqB,KACzB,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,6BAA6B,CAAC,CAAC;IACvE,+FAA+F;IAC/F,QAAQ,CAAC,OAAO,EAAE,CAChB,KAAK,EAAE,qBAAqB,KACzB,MAAM,CAAC,MAAM,CAChB,0BAA0B,EAC1B,sBAAsB,GAAG,6BAA6B,CACvD,CAAC;CACH;;;;AA2CD,qBAAa,YAAa,SAAQ,iBAyGhC;CAAG;AAEL,eAAO,MAAM,gBAAgB,EAAE,KAAK,CAAC,KAAK,CACxC,YAAY,EACZ,KAAK,EACL,iBAAiB,GAAG,gBAAgB,CACW,CAAC"}