@effect-auth/core 0.1.0-alpha.16 → 0.1.0-alpha.18

package/dist/HttpApi/PasswordGuards.js

@@ -0,0 +1,179 @@
+import { Effect, Option, Redacted } from "effect";
+import { HttpServerRequest } from "effect/unstable/http";
+import { BotProtection } from "../AbuseProtection.js";
+import { AuthRateLimit } from "../AuthRateLimit.js";
+import { LoginRiskEnricher } from "../LoginRiskEnrichment.js";
+import { TrustedDeviceCookie } from "../TrustedDevice.js";
+import { AuthInternalError, AuthRateLimitedError, AuthRequestRejectedError, } from "./Errors.js";
+import { authRequestMetadataOptions, loginRequestContextFromRequest, requireRequestSecurity, } from "./RequestGuards.js";
+import { PasswordResetStartBody, PasswordResetVerifyBody, PasswordSignInBody, PasswordSignUpBody, } from "./Schemas.js";
+const passwordPolicy = () => ({
+    rateLimit: AuthRateLimit.defaults(),
+    botProtection: BotProtection.skip(),
+});
+const withPolicy = (defaults, override) => ({ ...defaults, ...override });
+const enrichRisk = (input, enricher) => Effect.gen(function* () {
+    if (enricher === undefined) {
+        return input.request === undefined ? {} : { request: input.request };
+    }
+    const enriched = yield* enricher
+        .enrich({
+        ...(input.request === undefined ? {} : { request: input.request }),
+        ...(input.deviceFingerprint === undefined
+            ? {}
+            : { deviceFingerprint: input.deviceFingerprint }),
+    })
+        .pipe(Effect.mapError(() => new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to enrich login risk context",
+    })));
+    const request = enriched.request ?? input.request;
+    return {
+        ...(request === undefined ? {} : { request }),
+        ...(enriched.deviceKey === undefined
+            ? {}
+            : { deviceKey: enriched.deviceKey }),
+        ...(enriched.locationKey === undefined
+            ? {}
+            : { locationKey: enriched.locationKey }),
+    };
+});
+export const passwordSignInInput = (payload, trustedDeviceToken, riskContext) => {
+    const { deviceFingerprint: _deviceFingerprint, botChallenge: _botChallenge, ...input } = payload;
+    return {
+        ...input,
+        password: Redacted.make(payload.password),
+        ...(trustedDeviceToken === undefined ? {} : { trustedDeviceToken }),
+        ...(riskContext?.request === undefined
+            ? {}
+            : { request: riskContext.request }),
+        ...(riskContext?.deviceKey === undefined
+            ? {}
+            : { deviceKey: riskContext.deviceKey }),
+        ...(riskContext?.locationKey === undefined
+            ? {}
+            : { locationKey: riskContext.locationKey }),
+    };
+};
+export const passwordSignUpInput = (payload, riskContext) => {
+    const { deviceFingerprint: _deviceFingerprint, botChallenge: _botChallenge, ...input } = payload;
+    return {
+        ...input,
+        password: Redacted.make(payload.password),
+        ...(riskContext?.request === undefined
+            ? {}
+            : { request: riskContext.request }),
+        ...(riskContext?.deviceKey === undefined
+            ? {}
+            : { deviceKey: riskContext.deviceKey }),
+        ...(riskContext?.locationKey === undefined
+            ? {}
+            : { locationKey: riskContext.locationKey }),
+    };
+};
+export const passwordResetStartInput = (payload) => {
+    const { secret, botChallenge: _botChallenge, ...input } = payload;
+    return {
+        ...input,
+        ...(secret === undefined ? {} : { secret: Redacted.make(secret) }),
+    };
+};
+export const passwordResetVerifyInput = (payload) => ({
+    challengeId: payload.challengeId,
+    secret: Redacted.make(payload.secret),
+    password: Redacted.make(payload.password),
+});
+const makePasswordSignInGuard = (policy) => Effect.fn("auth.guard.password_sign_in")(function* (request) {
+    yield* requireRequestSecurity({
+        rateLimit: "auth.password.sign_in",
+        botProtection: "sign-in",
+        server: "auth.password.sign_in",
+    }, policy, request);
+    const cookie = yield* Effect.serviceOption(TrustedDeviceCookie);
+    const trustedDeviceToken = Option.isNone(cookie) || request.request === undefined
+        ? Option.none()
+        : yield* cookie.value
+            .read(new Request("http://localhost", {
+            headers: request.request.headers,
+        }))
+            .pipe(Effect.mapError(() => new AuthInternalError({
+            code: "internal_error",
+            message: "Failed to read trusted device cookie",
+        })));
+    const options = yield* authRequestMetadataOptions;
+    const context = loginRequestContextFromRequest(request.request, options);
+    const enricher = yield* Effect.serviceOption(LoginRiskEnricher);
+    const risk = yield* enrichRisk({
+        ...(context === undefined ? {} : { request: context }),
+        ...(request.payload.deviceFingerprint === undefined
+            ? {}
+            : { deviceFingerprint: request.payload.deviceFingerprint }),
+    }, Option.isSome(enricher) ? enricher.value : undefined);
+    return {
+        input: passwordSignInInput(request.payload, Option.isSome(trustedDeviceToken)
+            ? trustedDeviceToken.value
+            : undefined, risk),
+    };
+});
+const makePasswordSignUpGuard = (policy) => Effect.fn("auth.guard.password_sign_up")(function* (request) {
+    yield* requireRequestSecurity({
+        rateLimit: "auth.password.sign_up",
+        botProtection: "sign-up",
+        server: "auth.password.sign_up",
+    }, policy, request);
+    const options = yield* authRequestMetadataOptions;
+    const context = loginRequestContextFromRequest(request.request, options);
+    const enricher = yield* Effect.serviceOption(LoginRiskEnricher);
+    const risk = yield* enrichRisk({
+        ...(context === undefined ? {} : { request: context }),
+        ...(request.payload.deviceFingerprint === undefined
+            ? {}
+            : { deviceFingerprint: request.payload.deviceFingerprint }),
+    }, Option.isSome(enricher) ? enricher.value : undefined);
+    return {
+        input: passwordSignUpInput(request.payload, risk),
+    };
+});
+const makePasswordResetStartGuard = (policy) => Effect.fn("auth.guard.password_reset_start")(function* (request) {
+    yield* requireRequestSecurity({
+        rateLimit: "auth.password.reset_start",
+        botProtection: "password-reset-start",
+        server: "auth.password.reset_start",
+    }, policy, request);
+    return {
+        input: passwordResetStartInput(request.payload),
+    };
+});
+const makePasswordResetVerifyGuard = (policy) => Effect.fn("auth.guard.password_reset_verify")(function* (request) {
+    yield* requireRequestSecurity({
+        rateLimit: "auth.password.reset_verify",
+        botProtection: "password-reset-verify",
+        server: "auth.password.reset_verify",
+    }, policy, request);
+    return {
+        input: passwordResetVerifyInput(request.payload),
+    };
+});
+const signInDefaults = passwordPolicy();
+const signUpDefaults = passwordPolicy();
+const resetStartDefaults = passwordPolicy();
+const resetVerifyDefaults = passwordPolicy();
+const signIn = Object.assign(makePasswordSignInGuard(signInDefaults), {
+    withPolicy: (policy) => makePasswordSignInGuard(withPolicy(signInDefaults, policy)),
+});
+const signUp = Object.assign(makePasswordSignUpGuard(signUpDefaults), {
+    withPolicy: (policy) => makePasswordSignUpGuard(withPolicy(signUpDefaults, policy)),
+});
+const resetStart = Object.assign(makePasswordResetStartGuard(resetStartDefaults), {
+    withPolicy: (policy) => makePasswordResetStartGuard(withPolicy(resetStartDefaults, policy)),
+});
+const resetVerify = Object.assign(makePasswordResetVerifyGuard(resetVerifyDefaults), {
+    withPolicy: (policy) => makePasswordResetVerifyGuard(withPolicy(resetVerifyDefaults, policy)),
+});
+export const PasswordGuards = {
+    signIn,
+    signUp,
+    resetStart,
+    resetVerify,
+};
+//# sourceMappingURL=PasswordGuards.js.map

package/dist/HttpApi/PasswordGuards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordGuards.js","sourceRoot":"","sources":["../../src/HttpApi/PasswordGuards.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAElD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAW9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAK5B,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AA8DtB,MAAM,cAAc,GAAG,GAA0B,EAAE,CAAC,CAAC;IACnD,SAAS,EAAE,aAAa,CAAC,QAAQ,EAAE;IACnC,aAAa,EAAE,aAAa,CAAC,IAAI,EAAE;CACpC,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CACjB,QAA+B,EAC/B,QAAuC,EAChB,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;AAE3D,MAAM,UAAU,GAAG,CACjB,KAGC,EACD,QAA8C,EACa,EAAE,CAC7D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACvE,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ;SAC7B,MAAM,CAAC;QACN,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QAClE,GAAG,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS;YACvC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC;KACpD,CAAC;SACD,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,GAAG,EAAE,CACH,IAAI,iBAAiB,CAAC;QACpB,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,qCAAqC;KAC/C,CAAC,CACL,CACF,CAAC;IACJ,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC;IAElD,OAAO;QACL,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS;YAClC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;QACtC,GAAG,CAAC,QAAQ,CAAC,WAAW,KAAK,SAAS;YACpC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;KAC3C,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,OAAsD,EACtD,kBAA8C,EAC9C,WAAqC,EAChB,EAAE;IACvB,MAAM,EACJ,iBAAiB,EAAE,kBAAkB,EACrC,YAAY,EAAE,aAAa,EAC3B,GAAG,KAAK,EACT,GAAG,OAAO,CAAC;IAEZ,OAAO;QACL,GAAG,KAAK;QACR,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzC,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC;QACnE,GAAG,CAAC,WAAW,EAAE,OAAO,KAAK,SAAS;YACpC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC;QACrC,GAAG,CAAC,WAAW,EAAE,SAAS,KAAK,SAAS;YACtC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC;QACzC,GAAG,CAAC,WAAW,EAAE,WAAW,KAAK,SAAS;YACxC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,OAAsD,EACtD,WAAqC,EAChB,EAAE;IACvB,MAAM,EACJ,iBAAiB,EAAE,kBAAkB,EACrC,YAAY,EAAE,aAAa,EAC3B,GAAG,KAAK,EACT,GAAG,OAAO,CAAC;IAEZ,OAAO;QACL,GAAG,KAAK;QACR,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzC,GAAG,CAAC,WAAW,EAAE,OAAO,KAAK,SAAS;YACpC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC;QACrC,GAAG,CAAC,WAAW,EAAE,SAAS,KAAK,SAAS;YACtC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC;QACzC,GAAG,CAAC,WAAW,EAAE,WAAW,KAAK,SAAS;YACxC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,OAA0D,EACjC,EAAE;IAC3B,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IAElE,OAAO;QACL,GAAG,KAAK;QACR,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;KACnE,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,OAA2D,EACjC,EAAE,CAAC,CAAC;IAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;IAChC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IACrC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;CAC1C,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAG,CAAC,MAA6B,EAAE,EAAE,CAChE,MAAM,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC,QAAQ,CAAC,EAChD,OAAmC;IAEnC,KAAK,CAAC,CAAC,sBAAsB,CAC3B;QACE,SAAS,EAAE,uBAAuB;QAClC,aAAa,EAAE,SAAS;QACxB,MAAM,EAAE,uBAAuB;KAChC,EACD,MAAM,EACN,OAAO,CACR,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC;IAChE,MAAM,kBAAkB,GACtB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QACpD,CAAC,CAAC,MAAM,CAAC,IAAI,EAA6B;QAC1C,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK;aAChB,IAAI,CACH,IAAI,OAAO,CAAC,kBAAkB,EAAE;YAC9B,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO;SACjC,CAAC,CACH;aACA,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,GAAG,EAAE,CACH,IAAI,iBAAiB,CAAC;YACpB,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,sCAAsC;SAChD,CAAC,CACL,CACF,CAAC;IACV,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,0BAA0B,CAAC;IAClD,MAAM,OAAO,GAAG,8BAA8B,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAC5B;QACE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QACtD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,KAAK,SAAS;YACjD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;KAC9D,EACD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CACrD,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,mBAAmB,CACxB,OAAO,CAAC,OAAO,EACf,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC;YAC/B,CAAC,CAAC,kBAAkB,CAAC,KAAK;YAC1B,CAAC,CAAC,SAAS,EACb,IAAI,CACL;KAC8B,CAAC;AACpC,CAAC,CAAC,CAAC;AAEL,MAAM,uBAAuB,GAAG,CAAC,MAA6B,EAAE,EAAE,CAChE,MAAM,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC,QAAQ,CAAC,EAChD,OAAmC;IAEnC,KAAK,CAAC,CAAC,sBAAsB,CAC3B;QACE,SAAS,EAAE,uBAAuB;QAClC,aAAa,EAAE,SAAS;QACxB,MAAM,EAAE,uBAAuB;KAChC,EACD,MAAM,EACN,OAAO,CACR,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,0BAA0B,CAAC;IAClD,MAAM,OAAO,GAAG,8BAA8B,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAC5B;QACE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QACtD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,KAAK,SAAS;YACjD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;KAC9D,EACD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CACrD,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC;KAClB,CAAC;AACpC,CAAC,CAAC,CAAC;AAEL,MAAM,2BAA2B,GAAG,CAAC,MAA6B,EAAE,EAAE,CACpE,MAAM,CAAC,EAAE,CAAC,iCAAiC,CAAC,CAAC,QAAQ,CAAC,EACpD,OAAuC;IAEvC,KAAK,CAAC,CAAC,sBAAsB,CAC3B;QACE,SAAS,EAAE,2BAA2B;QACtC,aAAa,EAAE,sBAAsB;QACrC,MAAM,EAAE,2BAA2B;KACpC,EACD,MAAM,EACN,OAAO,CACR,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC;KACZ,CAAC;AACxC,CAAC,CAAC,CAAC;AAEL,MAAM,4BAA4B,GAAG,CAAC,MAA6B,EAAE,EAAE,CACrE,MAAM,CAAC,EAAE,CAAC,kCAAkC,CAAC,CAAC,QAAQ,CAAC,EACrD,OAAwC;IAExC,KAAK,CAAC,CAAC,sBAAsB,CAC3B;QACE,SAAS,EAAE,4BAA4B;QACvC,aAAa,EAAE,uBAAuB;QACtC,MAAM,EAAE,4BAA4B;KACrC,EACD,MAAM,EACN,OAAO,CACR,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,wBAAwB,CAAC,OAAO,CAAC,OAAO,CAAC;KACZ,CAAC;AACzC,CAAC,CAAC,CAAC;AAEL,MAAM,cAAc,GAAG,cAAc,EAAE,CAAC;AACxC,MAAM,cAAc,GAAG,cAAc,EAAE,CAAC;AACxC,MAAM,kBAAkB,GAAG,cAAc,EAAE,CAAC;AAC5C,MAAM,mBAAmB,GAAG,cAAc,EAAE,CAAC;AAE7C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,cAAc,CAAC,EAAE;IACpE,UAAU,EAAE,CAAC,MAAqC,EAAE,EAAE,CACpD,uBAAuB,CAAC,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;CAC9D,CAAC,CAAC;AACH,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,cAAc,CAAC,EAAE;IACpE,UAAU,EAAE,CAAC,MAAqC,EAAE,EAAE,CACpD,uBAAuB,CAAC,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;CAC9D,CAAC,CAAC;AACH,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAC9B,2BAA2B,CAAC,kBAAkB,CAAC,EAC/C;IACE,UAAU,EAAE,CAAC,MAAqC,EAAE,EAAE,CACpD,2BAA2B,CAAC,UAAU,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;CACtE,CACF,CAAC;AACF,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAC/B,4BAA4B,CAAC,mBAAmB,CAAC,EACjD;IACE,UAAU,EAAE,CAAC,MAAqC,EAAE,EAAE,CACpD,4BAA4B,CAAC,UAAU,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;CACxE,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,MAAM;IACN,MAAM;IACN,UAAU;IACV,WAAW;CACH,CAAC"}

package/dist/HttpApi/RecoveryCodes.d.ts

@@ -0,0 +1,5 @@
+export { recoveryCodeGenerateInput, type RecoveryCodeGenerateHttpOptions, RecoveryCodeHttpConfig, RecoveryCodeHttpConfigLive, recoveryCodeRegenerateInput, recoveryCodeRevokeInput, RecoveryCodesHttpApi, RecoveryCodesHttpApiGroupLive, RecoveryCodesHttpApiLive, RecoveryCodesHttpOperationsLive, recoveryCodeVerifyInput, } from "./Api.js";
+export { RecoveryCodesHttpApiGroup } from "./ClientApi.js";
+export { recoveryCodeGenerateEndpoint, recoveryCodeListEndpoint, recoveryCodeRegenerateEndpoint, recoveryCodeRevokeEndpoint, recoveryCodeVerifyEndpoint, } from "./Endpoints.js";
+export * from "./Operations/RecoveryCodes.js";
+//# sourceMappingURL=RecoveryCodes.d.ts.map

package/dist/HttpApi/RecoveryCodes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RecoveryCodes.d.ts","sourceRoot":"","sources":["../../src/HttpApi/RecoveryCodes.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,KAAK,+BAA+B,EACpC,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,EAC3B,uBAAuB,EACvB,oBAAoB,EACpB,6BAA6B,EAC7B,wBAAwB,EACxB,+BAA+B,EAC/B,uBAAuB,GACxB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,8BAA8B,EAC9B,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC;AACxB,cAAc,+BAA+B,CAAC"}

package/dist/HttpApi/RecoveryCodes.js

@@ -0,0 +1,5 @@
+export { recoveryCodeGenerateInput, RecoveryCodeHttpConfig, RecoveryCodeHttpConfigLive, recoveryCodeRegenerateInput, recoveryCodeRevokeInput, RecoveryCodesHttpApi, RecoveryCodesHttpApiGroupLive, RecoveryCodesHttpApiLive, RecoveryCodesHttpOperationsLive, recoveryCodeVerifyInput, } from "./Api.js";
+export { RecoveryCodesHttpApiGroup } from "./ClientApi.js";
+export { recoveryCodeGenerateEndpoint, recoveryCodeListEndpoint, recoveryCodeRegenerateEndpoint, recoveryCodeRevokeEndpoint, recoveryCodeVerifyEndpoint, } from "./Endpoints.js";
+export * from "./Operations/RecoveryCodes.js";
+//# sourceMappingURL=RecoveryCodes.js.map

package/dist/HttpApi/RecoveryCodes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RecoveryCodes.js","sourceRoot":"","sources":["../../src/HttpApi/RecoveryCodes.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EAEzB,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,EAC3B,uBAAuB,EACvB,oBAAoB,EACpB,6BAA6B,EAC7B,wBAAwB,EACxB,+BAA+B,EAC/B,uBAAuB,GACxB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,8BAA8B,EAC9B,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC;AACxB,cAAc,+BAA+B,CAAC"}

package/dist/HttpApi/RefreshToken.d.ts

@@ -0,0 +1,4 @@
+export { type RefreshTokenAccessTokenHttpInput, RefreshTokenHttpApi, RefreshTokenHttpApiGroup, RefreshTokenHttpApiGroupLive, RefreshTokenHttpApiLive, RefreshTokenHttpConfig, RefreshTokenHttpConfigLive, RefreshTokenHttpOperationsLive, type RefreshTokenRefreshHttpOptions, type RefreshTokenRefreshHttpPolicyInput, refreshTokenRefreshInput, } from "./Api.js";
+export { refreshTokenRefreshEndpoint } from "./Endpoints.js";
+export * from "./Operations/RefreshToken.js";
+//# sourceMappingURL=RefreshToken.d.ts.map

package/dist/HttpApi/RefreshToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RefreshToken.d.ts","sourceRoot":"","sources":["../../src/HttpApi/RefreshToken.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,gCAAgC,EACrC,mBAAmB,EACnB,wBAAwB,EACxB,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,EACtB,0BAA0B,EAC1B,8BAA8B,EAC9B,KAAK,8BAA8B,EACnC,KAAK,kCAAkC,EACvC,wBAAwB,GACzB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAC7D,cAAc,8BAA8B,CAAC"}

package/dist/HttpApi/RefreshToken.js

@@ -0,0 +1,4 @@
+export { RefreshTokenHttpApi, RefreshTokenHttpApiGroup, RefreshTokenHttpApiGroupLive, RefreshTokenHttpApiLive, RefreshTokenHttpConfig, RefreshTokenHttpConfigLive, RefreshTokenHttpOperationsLive, refreshTokenRefreshInput, } from "./Api.js";
+export { refreshTokenRefreshEndpoint } from "./Endpoints.js";
+export * from "./Operations/RefreshToken.js";
+//# sourceMappingURL=RefreshToken.js.map

package/dist/HttpApi/RefreshToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RefreshToken.js","sourceRoot":"","sources":["../../src/HttpApi/RefreshToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,mBAAmB,EACnB,wBAAwB,EACxB,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,EACtB,0BAA0B,EAC1B,8BAA8B,EAG9B,wBAAwB,GACzB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAC7D,cAAc,8BAA8B,CAAC"}

package/dist/HttpApi/RequestGuards.d.ts

@@ -0,0 +1,42 @@
+import { Effect } from "effect";
+import { HttpServerRequest } from "effect/unstable/http";
+import type { BotProtectionDecision, BotProtectionOperation, BotProtectionService } from "../AbuseProtection.js";
+import { AuthRateLimit } from "../AuthRateLimit.js";
+import type { AuthRateLimitOperation, AuthRateLimitPolicy } from "../AuthRateLimit.js";
+import type { UserId } from "../Identifiers.js";
+import type { LoginRequestContext } from "../LoginRisk.js";
+import { AuthInternalError, AuthRequestRejectedError } from "./Errors.js";
+import type { AuthRequestMetadataOptions } from "./Security.js";
+export interface AuthRateLimitGuardRequest {
+    readonly request?: HttpServerRequest.HttpServerRequest;
+    readonly payload?: unknown;
+}
+export interface RequestSecurityPolicy {
+    readonly rateLimit: AuthRateLimitPolicy;
+    readonly botProtection: BotProtectionDecision;
+}
+export type RequestSecurityPolicyOverride = Partial<RequestSecurityPolicy>;
+export declare const RequestSecurity: {
+    readonly noop: () => RequestSecurityPolicy;
+};
+export interface BotProtectedGuardRequest {
+    readonly request?: HttpServerRequest.HttpServerRequest;
+    readonly payload: {
+        readonly botChallenge?: {
+            readonly token: string;
+        };
+    };
+}
+export declare const authRequestMetadataOptions: Effect.Effect<AuthRequestMetadataOptions, never, never>;
+export declare const loginRequestContextFromRequest: (request: HttpServerRequest.HttpServerRequest | undefined, options: AuthRequestMetadataOptions) => LoginRequestContext | undefined;
+export declare const requireAuthRateLimit: (operation: AuthRateLimitOperation, input: AuthRateLimitGuardRequest, userId?: UserId) => Effect.Effect<void, AuthInternalError | import("./Errors.js").AuthRateLimitedError, AuthRateLimit>;
+export declare const requireRequestSecurity: (operations: {
+    readonly rateLimit: AuthRateLimitOperation;
+    readonly botProtection: BotProtectionOperation;
+    readonly server: string;
+}, policy: RequestSecurityPolicy, input: BotProtectedGuardRequest, subject?: {
+    readonly userId?: UserId;
+}) => Effect.Effect<undefined, AuthInternalError | import("./Errors.js").AuthRateLimitedError | AuthRequestRejectedError, AuthRateLimit>;
+export declare const resolveHttpBotProtection: Effect.Effect<BotProtectionService | undefined, never, never>;
+export declare const requireBotProtection: (botProtection: BotProtectionService | undefined, operation: BotProtectionOperation, serverOperation: string, input: BotProtectedGuardRequest) => Effect.Effect<void, AuthInternalError | AuthRequestRejectedError, never>;
+//# sourceMappingURL=RequestGuards.d.ts.map

package/dist/HttpApi/RequestGuards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RequestGuards.d.ts","sourceRoot":"","sources":["../../src/HttpApi/RequestGuards.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAoB,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AASzD,OAAO,KAAK,EACV,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,EACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EACV,sBAAsB,EACtB,mBAAmB,EACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAS,MAAM,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAM1E,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAEhE,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,iBAAiB,CAAC,iBAAiB,CAAC;IACvD,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;CAC/C;AAED,MAAM,MAAM,6BAA6B,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAE3E,eAAO,MAAM,eAAe;aAC1B,IAAI,QAAM,qBAAqB;CAIvB,CAAC;AAEX,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,CAAC,EAAE,iBAAiB,CAAC,iBAAiB,CAAC;IACvD,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,YAAY,CAAC,EAAE;YAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;CAC1E;AAcD,eAAO,MAAM,0BAA0B,yDAIrC,CAAC;AAEH,eAAO,MAAM,8BAA8B,YAChC,iBAAiB,CAAC,iBAAiB,GAAG,SAAS,WAC/C,0BAA0B,KAClC,mBAAmB,GAAG,SAqCxB,CAAC;AAsBF,eAAO,MAAM,oBAAoB,cACpB,sBAAsB,SAC1B,yBAAyB,WACvB,MAAM,uGAkBY,CAAC;AAE9B,eAAO,MAAM,sBAAsB,eACrB;IACV,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAC;IAC3C,QAAQ,CAAC,aAAa,EAAE,sBAAsB,CAAC;IAC/C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,UACO,qBAAqB,SACtB,wBAAwB,YACrB;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,uIAsErC,CAAC;AAEJ,eAAO,MAAM,wBAAwB,+DAwBnC,CAAC;AAEH,eAAO,MAAM,oBAAoB,kBAChB,oBAAoB,GAAG,SAAS,aACpC,sBAAsB,mBAChB,MAAM,SAChB,wBAAwB,6EAgD9B,CAAC"}

package/dist/HttpApi/RequestGuards.js

@@ -0,0 +1,194 @@
+import { Effect, Option, Redacted } from "effect";
+import { HttpServerRequest } from "effect/unstable/http";
+import { AbuseProtectionConfigError, BotChallengeVerifier, BotProtection, BotProtectionPolicy, makeBotProtection, } from "../AbuseProtection.js";
+import { AuthRateLimit } from "../AuthRateLimit.js";
+import { AuthInternalError, AuthRequestRejectedError } from "./Errors.js";
+import { AuthHttpApiConfig, mapAuthGuardErrors, makeAuthRequestMetadata, } from "./Security.js";
+export const RequestSecurity = {
+    noop: () => ({
+        rateLimit: AuthRateLimit.skip(),
+        botProtection: BotProtection.skip(),
+    }),
+};
+const firstHeaderValue = (value) => {
+    const first = value?.split(",", 1)[0]?.trim();
+    return first === "" ? undefined : first;
+};
+const headerNumber = (value) => {
+    const parsed = Number(firstHeaderValue(value));
+    return Number.isFinite(parsed) ? parsed : undefined;
+};
+export const authRequestMetadataOptions = Effect.gen(function* () {
+    const config = yield* Effect.serviceOption(AuthHttpApiConfig);
+    return Option.isSome(config) ? (config.value.requestMetadata ?? {}) : {};
+});
+export const loginRequestContextFromRequest = (request, options) => {
+    if (request === undefined) {
+        return undefined;
+    }
+    const metadata = makeAuthRequestMetadata(request, options);
+    const trustProxyHeaders = options.trustProxyHeaders ?? false;
+    const { headers } = request;
+    const country = trustProxyHeaders
+        ? firstHeaderValue(headers["cf-ipcountry"])
+        : undefined;
+    const region = trustProxyHeaders
+        ? firstHeaderValue(headers["cf-region"])
+        : undefined;
+    const city = trustProxyHeaders
+        ? firstHeaderValue(headers["cf-ipcity"])
+        : undefined;
+    const latitude = trustProxyHeaders
+        ? headerNumber(headers["cf-iplatitude"])
+        : undefined;
+    const longitude = trustProxyHeaders
+        ? headerNumber(headers["cf-iplongitude"])
+        : undefined;
+    const context = {
+        ...(metadata.ipAddress === undefined
+            ? {}
+            : { ip: String(metadata.ipAddress) }),
+        ...(metadata.userAgent === undefined
+            ? {}
+            : { userAgent: metadata.userAgent }),
+        ...(country === undefined ? {} : { country }),
+        ...(region === undefined ? {} : { region }),
+        ...(city === undefined ? {} : { city }),
+        ...(latitude === undefined ? {} : { latitude }),
+        ...(longitude === undefined ? {} : { longitude }),
+    };
+    return Object.keys(context).length === 0 ? undefined : context;
+};
+const payloadEmail = (payload) => {
+    if (typeof payload !== "object" ||
+        payload === null ||
+        !("identity" in payload) ||
+        typeof payload.identity !== "object" ||
+        payload.identity === null) {
+        return undefined;
+    }
+    const identity = payload.identity;
+    return identity.kind === "email" && typeof identity.value === "string"
+        ? identity.value
+        : undefined;
+};
+export const requireAuthRateLimit = (operation, input, userId) => Effect.gen(function* () {
+    const options = yield* authRequestMetadataOptions;
+    const metadata = input.request === undefined
+        ? undefined
+        : makeAuthRequestMetadata(input.request, options);
+    const email = payloadEmail(input.payload);
+    yield* AuthRateLimit.require({
+        operation,
+        ...(metadata?.ipAddress === undefined
+            ? {}
+            : { ipAddress: metadata.ipAddress }),
+        ...(email === undefined ? {} : { email }),
+        ...(userId === undefined ? {} : { userId }),
+    });
+}).pipe(mapAuthGuardErrors);
+export const requireRequestSecurity = (operations, policy, input, subject) => Effect.gen(function* () {
+    const options = yield* authRequestMetadataOptions;
+    const metadata = input.request === undefined
+        ? undefined
+        : makeAuthRequestMetadata(input.request, options);
+    const email = payloadEmail(input.payload);
+    if (policy.rateLimit.type !== "Skip") {
+        yield* AuthRateLimit.requirePolicy(policy.rateLimit, {
+            operation: operations.rateLimit,
+            ...(metadata?.ipAddress === undefined
+                ? {}
+                : { ipAddress: metadata.ipAddress }),
+            ...(email === undefined ? {} : { email }),
+            ...(subject?.userId === undefined ? {} : { userId: subject.userId }),
+        });
+    }
+    if (policy.botProtection.type === "Skip") {
+        return;
+    }
+    const verifier = yield* Effect.serviceOption(BotChallengeVerifier);
+    if (Option.isNone(verifier)) {
+        return yield* new AbuseProtectionConfigError({
+            message: "Bot protection verifier is not configured",
+        });
+    }
+    const botProtection = makeBotProtection({
+        policy: BotProtectionPolicy.of({
+            decide: () => Effect.succeed(policy.botProtection),
+        }),
+        verifier: verifier.value,
+    });
+    yield* botProtection.enforce({
+        operation: operations.botProtection,
+        request: {
+            ...(metadata?.ipAddress === undefined
+                ? {}
+                : { ip: metadata.ipAddress }),
+            ...(metadata?.userAgent === undefined
+                ? {}
+                : { userAgent: metadata.userAgent }),
+            ...(metadata?.origin === undefined ? {} : { origin: metadata.origin }),
+            metadata: { operation: operations.server },
+        },
+        ...(input.payload.botChallenge === undefined
+            ? {}
+            : { proof: Redacted.make(input.payload.botChallenge.token) }),
+    });
+}).pipe(mapAuthGuardErrors, Effect.catchTag("AbuseProtectionDeniedError", () => Effect.fail(new AuthRequestRejectedError({
+    code: "request_rejected",
+    message: "Request rejected",
+}))), Effect.catchTag("AbuseProtectionConfigError", () => Effect.fail(new AuthInternalError({
+    code: "internal_error",
+    message: "Request verification failed",
+}))));
+export const resolveHttpBotProtection = Effect.gen(function* () {
+    const service = yield* Effect.serviceOption(BotProtection);
+    if (Option.isSome(service)) {
+        return service.value;
+    }
+    const policy = yield* Effect.serviceOption(BotProtectionPolicy);
+    if (Option.isNone(policy)) {
+        return undefined;
+    }
+    return BotProtection.of({
+        enforce: (input) => policy.value.decide(input).pipe(Effect.flatMap((decision) => decision.type === "Skip"
+            ? Effect.void
+            : Effect.fail(new AbuseProtectionConfigError({
+                message: "Bot protection verifier is not configured",
+            })))),
+    });
+});
+export const requireBotProtection = (botProtection, operation, serverOperation, input) => Effect.gen(function* () {
+    const options = yield* authRequestMetadataOptions;
+    const metadata = input.request === undefined
+        ? undefined
+        : makeAuthRequestMetadata(input.request, options);
+    const ambient = botProtection === undefined ? yield* resolveHttpBotProtection : undefined;
+    const service = botProtection ?? ambient;
+    if (service === undefined) {
+        return;
+    }
+    yield* service.enforce({
+        operation,
+        request: {
+            ...(metadata?.ipAddress === undefined
+                ? {}
+                : { ip: metadata.ipAddress }),
+            ...(metadata?.userAgent === undefined
+                ? {}
+                : { userAgent: metadata.userAgent }),
+            ...(metadata?.origin === undefined ? {} : { origin: metadata.origin }),
+            metadata: { operation: serverOperation },
+        },
+        ...(input.payload.botChallenge === undefined
+            ? {}
+            : { proof: Redacted.make(input.payload.botChallenge.token) }),
+    });
+}).pipe(Effect.catchTag("AbuseProtectionDeniedError", () => Effect.fail(new AuthRequestRejectedError({
+    code: "request_rejected",
+    message: "Request rejected",
+}))), Effect.catchTag("AbuseProtectionConfigError", () => Effect.fail(new AuthInternalError({
+    code: "internal_error",
+    message: "Request verification failed",
+}))));
+//# sourceMappingURL=RequestGuards.js.map

package/dist/HttpApi/RequestGuards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RequestGuards.js","sourceRoot":"","sources":["../../src/HttpApi/RequestGuards.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,aAAa,EACb,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAOpD,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,eAAe,CAAC;AAevB,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,GAA0B,EAAE,CAAC,CAAC;QAClC,SAAS,EAAE,aAAa,CAAC,IAAI,EAAE;QAC/B,aAAa,EAAE,aAAa,CAAC,IAAI,EAAE;KACpC,CAAC;CACM,CAAC;AAOX,MAAM,gBAAgB,GAAG,CAAC,KAAyB,EAAsB,EAAE;IACzE,MAAM,KAAK,GAAG,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAE9C,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AAC1C,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,KAAyB,EAAsB,EAAE;IACrE,MAAM,MAAM,GAAG,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;IAE/C,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC5D,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;IAE9D,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3E,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAC5C,OAAwD,EACxD,OAAmC,EACF,EAAE;IACnC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,KAAK,CAAC;IAC7D,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC5B,MAAM,OAAO,GAAG,iBAAiB;QAC/B,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC3C,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,MAAM,GAAG,iBAAiB;QAC9B,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACxC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,IAAI,GAAG,iBAAiB;QAC5B,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACxC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,QAAQ,GAAG,iBAAiB;QAChC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACxC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,SAAS,GAAG,iBAAiB;QACjC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACzC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,OAAO,GAAG;QACd,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS;YAClC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS;YAClC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;QACtC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3C,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;KAClD,CAAC;IAEF,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AACjE,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,OAAgB,EAAqB,EAAE;IAC3D,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,KAAK,IAAI;QAChB,CAAC,CAAC,UAAU,IAAI,OAAO,CAAC;QACxB,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ;QACpC,OAAO,CAAC,QAAQ,KAAK,IAAI,EACzB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAGxB,CAAC;IAEF,OAAO,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ;QACpE,CAAC,CAAE,QAAQ,CAAC,KAAe;QAC3B,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,SAAiC,EACjC,KAAgC,EAChC,MAAe,EACf,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,0BAA0B,CAAC;IAClD,MAAM,QAAQ,GACZ,KAAK,CAAC,OAAO,KAAK,SAAS;QACzB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAE1C,KAAK,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC;QAC3B,SAAS;QACT,GAAG,CAAC,QAAQ,EAAE,SAAS,KAAK,SAAS;YACnC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;QACtC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACzC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5C,CAAC,CAAC;AACL,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAE9B,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,UAIC,EACD,MAA6B,EAC7B,KAA+B,EAC/B,OAAsC,EACtC,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,0BAA0B,CAAC;IAClD,MAAM,QAAQ,GACZ,KAAK,CAAC,OAAO,KAAK,SAAS;QACzB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAE1C,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACrC,KAAK,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE;YACnD,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,GAAG,CAAC,QAAQ,EAAE,SAAS,KAAK,SAAS;gBACnC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;YACtC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;YACzC,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;SACrE,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACzC,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC;IACnE,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,CAAC,IAAI,0BAA0B,CAAC;YAC3C,OAAO,EAAE,2CAA2C;SACrD,CAAC,CAAC;IACL,CAAC;IACD,MAAM,aAAa,GAAG,iBAAiB,CAAC;QACtC,MAAM,EAAE,mBAAmB,CAAC,EAAE,CAAC;YAC7B,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC;SACnD,CAAC;QACF,QAAQ,EAAE,QAAQ,CAAC,KAAK;KACzB,CAAC,CAAC;IACH,KAAK,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC;QAC3B,SAAS,EAAE,UAAU,CAAC,aAAa;QACnC,OAAO,EAAE;YACP,GAAG,CAAC,QAAQ,EAAE,SAAS,KAAK,SAAS;gBACnC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,SAAmB,EAAE,CAAC;YACzC,GAAG,CAAC,QAAQ,EAAE,SAAS,KAAK,SAAS;gBACnC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;YACtC,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;YACtE,QAAQ,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,MAAM,EAAE;SAC3C;QACD,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;KAChE,CAAC,CAAC;AACL,CAAC,CAAC,CAAC,IAAI,CACL,kBAAkB,EAClB,MAAM,CAAC,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE,CACjD,MAAM,CAAC,IAAI,CACT,IAAI,wBAAwB,CAAC;IAC3B,IAAI,EAAE,kBAAkB;IACxB,OAAO,EAAE,kBAAkB;CAC5B,CAAC,CACH,CACF,EACD,MAAM,CAAC,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE,CACjD,MAAM,CAAC,IAAI,CACT,IAAI,iBAAiB,CAAC;IACpB,IAAI,EAAE,gBAAgB;IACtB,OAAO,EAAE,6BAA6B;CACvC,CAAC,CACH,CACF,CACF,CAAC;AAEJ,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC1D,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,aAAa,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAC7B,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1B,QAAQ,CAAC,IAAI,KAAK,MAAM;YACtB,CAAC,CAAC,MAAM,CAAC,IAAI;YACb,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,IAAI,0BAA0B,CAAC;gBAC7B,OAAO,EAAE,2CAA2C;aACrD,CAAC,CACH,CACN,CACF;KACJ,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,aAA+C,EAC/C,SAAiC,EACjC,eAAuB,EACvB,KAA+B,EAC/B,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,0BAA0B,CAAC;IAClD,MAAM,QAAQ,GACZ,KAAK,CAAC,OAAO,KAAK,SAAS;QACzB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,OAAO,GACX,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,MAAM,OAAO,GAAG,aAAa,IAAI,OAAO,CAAC;IACzC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IAED,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACrB,SAAS;QACT,OAAO,EAAE;YACP,GAAG,CAAC,QAAQ,EAAE,SAAS,KAAK,SAAS;gBACnC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,SAAmB,EAAE,CAAC;YACzC,GAAG,CAAC,QAAQ,EAAE,SAAS,KAAK,SAAS;gBACnC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;YACtC,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;YACtE,QAAQ,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE;SACzC;QACD,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;KAChE,CAAC,CAAC;AACL,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE,CACjD,MAAM,CAAC,IAAI,CACT,IAAI,wBAAwB,CAAC;IAC3B,IAAI,EAAE,kBAAkB;IACxB,OAAO,EAAE,kBAAkB;CAC5B,CAAC,CACH,CACF,EACD,MAAM,CAAC,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE,CACjD,MAAM,CAAC,IAAI,CACT,IAAI,iBAAiB,CAAC;IACpB,IAAI,EAAE,gBAAgB;IACtB,OAAO,EAAE,6BAA6B;CACvC,CAAC,CACH,CACF,CACF,CAAC"}