@shivaedev/identity 0.0.0 → 0.2.0

package/dist/middleware.d.ts

@@ -0,0 +1,21 @@
+import { Schema } from "effect";
+import { RpcMiddleware } from "effect/rpc";
+import { AuthUnavailable, Forbidden, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
+import type { Identity, OptionalIdentity, RequestId, SessionUser, SessionUserWithProviderAccounts } from "./identity.ts";
+declare const RequestTracing_base: RpcMiddleware.ServiceClass<RequestTracing, "@shivaedev/identity/RequestTracing", RequestId, Schema.Never, never, never, false>;
+export declare class RequestTracing extends RequestTracing_base {
+}
+declare const Authenticated_base: RpcMiddleware.ServiceClass<Authenticated, "@shivaedev/identity/Authenticated", Identity, Schema.Union<readonly [typeof Unauthorized, typeof AuthUnavailable, typeof Forbidden]>, never, never, false>;
+export declare class Authenticated extends Authenticated_base {
+}
+declare const MaybeAuthenticated_base: RpcMiddleware.ServiceClass<MaybeAuthenticated, "@shivaedev/identity/MaybeAuthenticated", OptionalIdentity, Schema.Union<readonly [typeof Unauthorized, typeof AuthUnavailable, typeof Forbidden]>, never, never, false>;
+export declare class MaybeAuthenticated extends MaybeAuthenticated_base {
+}
+declare const AuthenticatedUser_base: RpcMiddleware.ServiceClass<AuthenticatedUser, "@shivaedev/identity/AuthenticatedUser", Identity | SessionUser, Schema.Union<readonly [typeof Unauthorized, typeof AuthUnavailable, typeof Forbidden]>, never, never, false>;
+export declare class AuthenticatedUser extends AuthenticatedUser_base {
+}
+declare const AuthenticatedUserWithProviderAccounts_base: RpcMiddleware.ServiceClass<AuthenticatedUserWithProviderAccounts, "@shivaedev/identity/AuthenticatedUserWithProviderAccounts", Identity | SessionUser | SessionUserWithProviderAccounts, Schema.Union<readonly [typeof Unauthorized, typeof AuthUnavailable, typeof Forbidden]>, never, never, false>;
+export declare class AuthenticatedUserWithProviderAccounts extends AuthenticatedUserWithProviderAccounts_base {
+}
+export {};
+//# sourceMappingURL=middleware.d.ts.map

package/dist/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AACzF,OAAO,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,+BAA+B,EAAE,MAAM,eAAe,CAAC;;AACzH,qBAAa,cAAe,SAAQ,mBAKK;CAAG;;AAC5C,qBAAa,aAAc,SAAQ,kBAOjC;CAAG;;AACL,qBAAa,kBAAmB,SAAQ,uBAK0E;CAAG;;AACrH,qBAAa,iBAAkB,SAAQ,sBAOrC;CAAG;;AACL,qBAAa,qCAAsC,SAAQ,0CAKzD;CAAG"}

package/dist/middleware.js

@@ -0,0 +1,20 @@
+import { Schema } from "effect";
+import { RpcMiddleware } from "effect/rpc";
+import { AuthUnavailable, Forbidden, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
+export class RequestTracing extends RpcMiddleware.Service()("@shivaedev/identity/RequestTracing") {
+}
+export class Authenticated extends RpcMiddleware.Service()("@shivaedev/identity/Authenticated", {
+    error: Schema.Union([Unauthorized, AuthUnavailable, Forbidden]),
+}) {
+}
+export class MaybeAuthenticated extends RpcMiddleware.Service()("@shivaedev/identity/MaybeAuthenticated", { error: Schema.Union([Unauthorized, AuthUnavailable, Forbidden]) }) {
+}
+export class AuthenticatedUser extends RpcMiddleware.Service()("@shivaedev/identity/AuthenticatedUser", {
+    error: Schema.Union([Unauthorized, AuthUnavailable, Forbidden]),
+}) {
+}
+export class AuthenticatedUserWithProviderAccounts extends RpcMiddleware.Service()("@shivaedev/identity/AuthenticatedUserWithProviderAccounts", {
+    error: Schema.Union([Unauthorized, AuthUnavailable, Forbidden]),
+}) {
+}
+//# sourceMappingURL=middleware.js.map

package/dist/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAEzF,MAAM,OAAO,cAAe,SAAQ,aAAa,CAAC,OAAO,EAKtD,CAAC,oCAAoC,CAAC;CAAG;AAC5C,MAAM,OAAO,aAAc,SAAQ,aAAa,CAAC,OAAO,EAKrD,CAAC,mCAAmC,EAAE;IACxC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;CAC/D,CAAC;CAAG;AACL,MAAM,OAAO,kBAAmB,SAAQ,aAAa,CAAC,OAAO,EAK1D,CAAC,wCAAwC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;CAAG;AACrH,MAAM,OAAO,iBAAkB,SAAQ,aAAa,CAAC,OAAO,EAKzD,CAAC,uCAAuC,EAAE;IAC5C,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;CAC/D,CAAC;CAAG;AACL,MAAM,OAAO,qCAAsC,SAAQ,aAAa,CAAC,OAAO,EAG7E,CAAC,2DAA2D,EAAE;IAChE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;CAC/D,CAAC;CAAG"}

package/dist/permission.d.ts

@@ -0,0 +1,11 @@
+import { Effect, Schema } from "effect";
+import { RpcMiddleware } from "effect/rpc";
+import type { Permission } from "@shivaedev/access/permission.ts";
+import { AuthUnavailable, Forbidden, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
+import { type Identity, SessionUser, type SessionUserValue } from "./identity.ts";
+export declare function permissionMiddleware<TSelf>(): <const TName extends string>(name: TName, permission: Permission) => RpcMiddleware.ServiceClass<TSelf, TName, Identity | SessionUser, Schema.Union<readonly [typeof Unauthorized, typeof AuthUnavailable, typeof Forbidden]>, never, never, false> & {
+    permission: Permission;
+};
+export declare function hasPermission(user: Pick<SessionUserValue, "id" | "permissions">, permission: Permission): boolean;
+export declare function requirePermission(permission: Permission): Effect.Effect<SessionUserValue, Forbidden, SessionUser>;
+//# sourceMappingURL=permission.d.ts.map

package/dist/permission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AACzF,OAAO,EAAE,KAAK,QAAQ,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAIlF,wBAAgB,oBAAoB,CAAC,KAAK,MACjC,KAAK,CAAC,KAAK,SAAS,MAAM,QAAQ,KAAK,cAAc,UAAU;;EAEvE;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,GAAG,aAAa,CAAC,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAEjH;AAED,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,UAAU,2DAMvD"}

package/dist/permission.js

@@ -0,0 +1,17 @@
+import { Effect, Schema } from "effect";
+import { RpcMiddleware } from "effect/rpc";
+import { AuthUnavailable, Forbidden, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
+import { SessionUser } from "./identity.js";
+const Failures = Schema.Union([Unauthorized, AuthUnavailable, Forbidden]);
+export function permissionMiddleware() {
+    return (name, permission) => Object.assign(RpcMiddleware.Service()(name, { error: Failures }), { permission });
+}
+export function hasPermission(user, permission) {
+    return user.permissions?.some((grant) => grant.name === permission.name && grant.strength === permission.strength) ?? false;
+}
+export function requirePermission(permission) {
+    return Effect.flatMap(SessionUser, (user) => hasPermission(user, permission)
+        ? Effect.succeed(user)
+        : Effect.fail(new Forbidden({ message: `Permission required: ${permission.name} (${permission.strength})` })));
+}
+//# sourceMappingURL=permission.js.map

package/dist/permission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.js","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AACzF,OAAO,EAAiB,WAAW,EAAyB,MAAM,eAAe,CAAC;AAElF,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC,CAAC;AAE1E,MAAM,UAAU,oBAAoB;IACnC,OAAO,CAA6B,IAAW,EAAE,UAAsB,EAAE,EAAE,CAC1E,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,EAA+C,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;AACjI,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAkD,EAAE,UAAsB;IACvG,OAAO,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC;AAC7H,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,UAAsB;IACvD,OAAO,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAC3C,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC;QAC9B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QACtB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,wBAAwB,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC,CAC9G,CAAC;AACH,CAAC"}

package/dist/server/adapters/betterAuthSessions.d.ts

@@ -0,0 +1,14 @@
+import { Effect } from "effect";
+import { AuthUnavailable, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
+import type { ProviderAccountValue } from "#identity.ts";
+import type { SessionProvider, SessionShape } from "#server/session.ts";
+export type GetSession<TSession extends SessionShape> = (headers: globalThis.Headers) => Promise<TSession | null>;
+export type GetProviderAccounts = (headers: globalThis.Headers) => Promise<readonly ProviderAccountValue[]>;
+export type SessionWithProviderAccounts<TSession extends SessionShape> = TSession & {
+    readonly user: TSession["user"] & {
+        readonly providerAccounts: Effect.Effect<readonly ProviderAccountValue[], AuthUnavailable | Unauthorized>;
+    };
+};
+export declare function betterAuthSessions<TSession extends SessionShape>(getSession: GetSession<TSession>): SessionProvider<TSession>;
+export declare function betterAuthSessions<TSession extends SessionShape>(getSession: GetSession<TSession>, getProviderAccounts: GetProviderAccounts): SessionProvider<SessionWithProviderAccounts<TSession>>;
+//# sourceMappingURL=betterAuthSessions.d.ts.map

package/dist/server/adapters/betterAuthSessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"betterAuthSessions.d.ts","sourceRoot":"","sources":["../../../src/server/adapters/betterAuthSessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAqB,MAAM,QAAQ,CAAC;AAGnD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACxE,MAAM,MAAM,UAAU,CAAC,QAAQ,SAAS,YAAY,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;AAClH,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,KAAK,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAAC;AAC5G,MAAM,MAAM,2BAA2B,CAAC,QAAQ,SAAS,YAAY,IAAI,QAAQ,GAAG;IACnF,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG;QAAE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,oBAAoB,EAAE,EAAE,eAAe,GAAG,YAAY,CAAC,CAAA;KAAE,CAAC;CAChJ,CAAC;AAOF,wBAAgB,kBAAkB,CAAC,QAAQ,SAAS,YAAY,EAAE,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;AAC/H,wBAAgB,kBAAkB,CAAC,QAAQ,SAAS,YAAY,EAC/D,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,EAChC,mBAAmB,EAAE,mBAAmB,GACtC,eAAe,CAAC,2BAA2B,CAAC,QAAQ,CAAC,CAAC,CAAC"}

package/dist/server/adapters/betterAuthSessions.js

@@ -0,0 +1,24 @@
+import { Effect, Option, Predicate } from "effect";
+import { redact } from "@shivaedev/errors/redact.ts";
+import { AuthUnavailable, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
+function unavailable(cause) {
+    return Effect.andThen(Effect.logError("Authentication provider failed", redact(cause)), Effect.fail(new AuthUnavailable({ message: "Authentication is temporarily unavailable" })));
+}
+export function betterAuthSessions(getSession, getProviderAccounts) {
+    const betterAuthSession = Effect.fn("PlatformRpc.betterAuthSession")(function* (headers) {
+        const transport = new globalThis.Headers(headers);
+        const session = yield* Effect.tryPromise(() => getSession(transport)).pipe(Effect.catch((error) => unavailable(error.cause)));
+        if (session === null || getProviderAccounts === undefined) {
+            return Option.fromNullishOr(session);
+        }
+        const providerAccounts = Effect.tryPromise({
+            catch: (cause) => cause,
+            try: () => getProviderAccounts(transport),
+        }).pipe(Effect.catch((cause) => Predicate.hasProperty(cause, "statusCode") && cause.statusCode === 401
+            ? Effect.fail(new Unauthorized({ message: "Authentication required" }))
+            : unavailable(cause)));
+        return Option.some({ ...session, user: { ...session.user, providerAccounts } });
+    });
+    return { get: betterAuthSession };
+}
+//# sourceMappingURL=betterAuthSessions.js.map

package/dist/server/adapters/betterAuthSessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"betterAuthSessions.js","sourceRoot":"","sources":["../../../src/server/adapters/betterAuthSessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAEnD,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAQ9E,SAAS,WAAW,CAAC,KAAc;IAClC,OAAO,MAAM,CAAC,OAAO,CACpB,MAAM,CAAC,QAAQ,CAAC,gCAAgC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAChE,MAAM,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC,CAC1F,CAAC;AACH,CAAC;AAMD,MAAM,UAAU,kBAAkB,CAAgC,UAAgC,EAAE,mBAAyC;IAC5I,MAAM,iBAAiB,GAAG,MAAM,CAAC,EAAE,CAAC,+BAA+B,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAwB;QACvG,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9H,IAAI,OAAO,KAAK,IAAI,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;YAC3D,OAAO,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC;YAC1C,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;YACvB,GAAG,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAC;SACzC,CAAC,CAAC,IAAI,CACN,MAAM,CAAC,KAAK,CACX,CAAC,KAAK,EAAwD,EAAE,CAC/D,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG;YACrE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;YACvE,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CACtB,CACD,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC;AACnC,CAAC"}

package/dist/server/better-auth/allowedAccounts.d.ts

@@ -0,0 +1,10 @@
+import { Config, Schema } from "effect";
+export declare const AllowedAccounts: Schema.decodeTo<Schema.$Array<Schema.decodeTo<Schema.Struct<{
+    readonly accountId: Schema.NonEmptyString;
+    readonly providerId: Schema.NonEmptyString;
+}>, Schema.String, never, never>>, Schema.String, never, never>;
+export declare const allowedAccounts: Config.Config<readonly {
+    readonly accountId: string;
+    readonly providerId: string;
+}[]>;
+//# sourceMappingURL=allowedAccounts.d.ts.map

package/dist/server/better-auth/allowedAccounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowedAccounts.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/allowedAccounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAgB,MAAM,QAAQ,CAAC;AAgBtD,eAAO,MAAM,eAAe;;;+DAU3B,CAAC;AAEF,eAAO,MAAM,eAAe;;;IAA0D,CAAC"}

package/dist/server/better-auth/allowedAccounts.js

@@ -0,0 +1,20 @@
+import { Config, Schema, SchemaGetter } from "effect";
+const ProviderAccount = Schema.Struct({ accountId: Schema.NonEmptyString, providerId: Schema.NonEmptyString });
+const AccountEntry = Schema.String.pipe(Schema.decodeTo(ProviderAccount, {
+    decode: SchemaGetter.transform((entry) => {
+        const separator = entry.indexOf(":");
+        return separator < 0
+            ? { accountId: "", providerId: entry }
+            : { accountId: entry.slice(separator + 1).trim(), providerId: entry.slice(0, separator).trim() };
+    }),
+    encode: SchemaGetter.transform(({ accountId, providerId }) => `${providerId}:${accountId}`),
+}));
+export const AllowedAccounts = Schema.String.pipe(Schema.decodeTo(Schema.Array(AccountEntry).check(Schema.isMinLength(1)), {
+    decode: SchemaGetter.transform((value) => value
+        .split(",")
+        .map((entry) => entry.trim())
+        .filter((entry) => entry.length > 0)),
+    encode: SchemaGetter.transform((entries) => entries.join(",")),
+}));
+export const allowedAccounts = Config.schema(AllowedAccounts, "AUTH_ALLOWED_ACCOUNTS");
+//# sourceMappingURL=allowedAccounts.js.map

package/dist/server/better-auth/allowedAccounts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowedAccounts.js","sourceRoot":"","sources":["../../../src/server/better-auth/allowedAccounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAEtD,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,cAAc,EAAE,UAAU,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;AAE/G,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CACtC,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE;IAChC,MAAM,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE;QACxC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,OAAO,SAAS,GAAG,CAAC;YACnB,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE;YACtC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACnG,CAAC,CAAC;IACF,MAAM,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,GAAG,UAAU,IAAI,SAAS,EAAE,CAAC;CAC3F,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAChD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE;IACxE,MAAM,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CACxC,KAAK;SACH,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CACrC;IACD,MAAM,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;CAC9D,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC"}

package/dist/server/better-auth/bearerSessions.d.ts

@@ -0,0 +1,9 @@
+import type { BetterAuthOptions } from "better-auth";
+export interface BearerSessionsOptions {
+    readonly origins: readonly string[];
+}
+export declare function withBearerSessions<TOptions extends BetterAuthOptions>(options: TOptions, enabled: boolean): TOptions;
+export declare function hasSessionCookie(headers: Headers, cookieName: string): boolean;
+export declare function sessionHeaders(headers: Headers, cookieName: string): Headers;
+export declare function cookieSessionResponse(response: Response): Promise<Response>;
+//# sourceMappingURL=bearerSessions.d.ts.map

package/dist/server/better-auth/bearerSessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearerSessions.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/bearerSessions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGrD,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,SAAS,iBAAiB,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,QAAQ,CAEpH;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAO9E;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAQ5E;AAED,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAmBjF"}

package/dist/server/better-auth/bearerSessions.js

@@ -0,0 +1,38 @@
+import { bearer } from "better-auth/plugins/bearer";
+export function withBearerSessions(options, enabled) {
+    return enabled ? { ...options, plugins: [...(options.plugins ?? []), bearer({ requireSignature: true })] } : options;
+}
+export function hasSessionCookie(headers, cookieName) {
+    return (headers
+        .get("cookie")
+        ?.split(";")
+        .some((cookie) => cookie.trim().startsWith(`${cookieName}=`)) === true);
+}
+export function sessionHeaders(headers, cookieName) {
+    const result = new Headers(headers);
+    if (hasSessionCookie(headers, cookieName)) {
+        result.delete("authorization");
+    }
+    else if (/^bearer\s/iu.test(headers.get("authorization") ?? "")) {
+        result.delete("cookie");
+    }
+    return result;
+}
+export async function cookieSessionResponse(response) {
+    const headers = new Headers(response.headers);
+    headers.delete("set-auth-token");
+    const exposed = headers.get("access-control-expose-headers");
+    if (exposed !== null) {
+        headers.set("access-control-expose-headers", exposed
+            .split(",")
+            .filter((header) => header.trim().toLowerCase() !== "set-auth-token")
+            .join(","));
+    }
+    if (!headers.get("content-type")?.includes("application/json")) {
+        return new Response(response.body, { headers, status: response.status });
+    }
+    const body = JSON.parse(await response.text(), (key, value) => (key === "token" ? undefined : value));
+    headers.delete("content-length");
+    return Response.json(body, { headers, status: response.status });
+}
+//# sourceMappingURL=bearerSessions.js.map

package/dist/server/better-auth/bearerSessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearerSessions.js","sourceRoot":"","sources":["../../../src/server/better-auth/bearerSessions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAMpD,MAAM,UAAU,kBAAkB,CAAqC,OAAiB,EAAE,OAAgB;IACzG,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AACtH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAgB,EAAE,UAAkB;IACpE,OAAO,CACN,OAAO;SACL,GAAG,CAAC,QAAQ,CAAC;QACd,EAAE,KAAK,CAAC,GAAG,CAAC;SACX,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC,KAAK,IAAI,CACvE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAgB,EAAE,UAAkB;IAClE,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,gBAAgB,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAChC,CAAC;SAAM,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACnE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,QAAkB;IAC7D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IAC7D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CACV,+BAA+B,EAC/B,OAAO;aACL,KAAK,CAAC,GAAG,CAAC;aACV,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC;aACpE,IAAI,CAAC,GAAG,CAAC,CACX,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAChE,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,KAAc,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACxH,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjC,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;AAClE,CAAC"}

package/dist/server/better-auth/clientIp.d.ts

@@ -0,0 +1,8 @@
+import type { HttpServerRequest } from "effect/http";
+export declare const PEER_IP_HEADER = "x-platform-client-ip";
+export declare function clientIpHeaders(options: {
+    readonly clientIpHeader: string;
+    readonly ipv6Subnet?: number | undefined;
+    readonly trustedProxy?: string | undefined;
+}): (request: HttpServerRequest.HttpServerRequest, web: Request) => void;
+//# sourceMappingURL=clientIp.d.ts.map

package/dist/server/better-auth/clientIp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientIp.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/clientIp.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGrD,eAAO,MAAM,cAAc,yBAAyB,CAAC;AAErD,wBAAgB,eAAe,CAAC,OAAO,EAAE;IACxC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C,aASiB,iBAAiB,CAAC,iBAAiB,OAAO,OAAO,UAalE"}

package/dist/server/better-auth/clientIp.js

@@ -0,0 +1,28 @@
+import { getIP } from "better-auth/api";
+import { Option } from "effect";
+import { trustedProxyPeer, trustedProxyRanges } from "#server/local.ts";
+export const PEER_IP_HEADER = "x-platform-client-ip";
+export function clientIpHeaders(options) {
+    const trustedPeer = trustedProxyPeer(options.trustedProxy);
+    const advanced = {
+        ipAddress: {
+            ipAddressHeaders: [options.clientIpHeader],
+            ...(options.ipv6Subnet === undefined ? {} : { ipv6Subnet: options.ipv6Subnet }),
+            trustedProxies: trustedProxyRanges(options.trustedProxy),
+        },
+    };
+    return (request, web) => {
+        web.headers.delete(PEER_IP_HEADER);
+        const trusted = Option.exists(request.remoteAddress, trustedPeer);
+        const forwardedIp = trusted ? getIP(web, { advanced }) : null;
+        if (!trusted) {
+            web.headers.delete("x-forwarded-for");
+            web.headers.delete(options.clientIpHeader);
+        }
+        const address = forwardedIp ?? Option.getOrUndefined(request.remoteAddress);
+        if (address !== undefined) {
+            web.headers.set(PEER_IP_HEADER, address);
+        }
+    };
+}
+//# sourceMappingURL=clientIp.js.map

package/dist/server/better-auth/clientIp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientIp.js","sourceRoot":"","sources":["../../../src/server/better-auth/clientIp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAExE,MAAM,CAAC,MAAM,cAAc,GAAG,sBAAsB,CAAC;AAErD,MAAM,UAAU,eAAe,CAAC,OAI/B;IACA,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG;QAChB,SAAS,EAAE;YACV,gBAAgB,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC;YAC1C,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;YAC/E,cAAc,EAAE,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC;SACxD;KACD,CAAC;IACF,OAAO,CAAC,OAA4C,EAAE,GAAY,EAAE,EAAE;QACrE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QAClE,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YACtC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,IAAI,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC5E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3B,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAC1C,CAAC;IACF,CAAC,CAAC;AACH,CAAC"}

package/dist/server/better-auth/memoryRateLimit.d.ts

@@ -0,0 +1,3 @@
+import { Effect } from "effect";
+export declare const memoryRateLimit: Effect.Effect<import("better-auth").BetterAuthRateLimitStorage, never, import("effect/Scope").Scope>;
+//# sourceMappingURL=memoryRateLimit.d.ts.map

package/dist/server/better-auth/memoryRateLimit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memoryRateLimit.d.ts","sourceRoot":"","sources":["../../../src/server/better-auth/memoryRateLimit.ts"],"names":[],"mappings":"AACA,OAAO,EAAS,MAAM,EAAE,MAAM,QAAQ,CAAC;AAUvC,eAAO,MAAM,eAAe,sGA4C1B,CAAC"}

package/dist/server/better-auth/memoryRateLimit.js

@@ -0,0 +1,46 @@
+import { Clock, Effect } from "effect";
+const MAX_ENTRIES = 100_000;
+export const memoryRateLimit = Effect.gen(function* () {
+    const clock = yield* Clock.Clock;
+    const buckets = yield* Effect.acquireRelease(Effect.sync(() => new Map()), (entries) => Effect.sync(() => entries.clear()));
+    let nextExpiry = Number.POSITIVE_INFINITY;
+    function prune(now) {
+        if (now >= nextExpiry) {
+            nextExpiry = Number.POSITIVE_INFINITY;
+            for (const [entryKey, entry] of buckets) {
+                if (now >= entry.expiresAt) {
+                    buckets.delete(entryKey);
+                }
+                else {
+                    nextExpiry = Math.min(nextExpiry, entry.expiresAt);
+                }
+            }
+        }
+    }
+    const storage = {
+        consume(key, rule) {
+            const now = clock.currentTimeMillisUnsafe();
+            prune(now);
+            const bucket = buckets.get(key);
+            const window = rule.window * 1000;
+            if (bucket !== undefined && now - bucket.lastRequest < window && bucket.count >= rule.max) {
+                return Promise.resolve({ allowed: false, retryAfter: Math.ceil((bucket.lastRequest + window - now) / 1000) });
+            }
+            nextExpiry = Math.min(nextExpiry, now + window);
+            buckets.set(key, {
+                count: bucket === undefined || now - bucket.lastRequest >= window ? 1 : bucket.count + 1,
+                expiresAt: now + window,
+                lastRequest: now,
+            });
+            if (buckets.size > MAX_ENTRIES) {
+                for (const oldest of buckets.keys()) {
+                    buckets.delete(oldest);
+                    break;
+                }
+            }
+            return Promise.resolve({ allowed: true, retryAfter: null });
+        },
+    };
+    return storage;
+});
+//# sourceMappingURL=memoryRateLimit.js.map

package/dist/server/better-auth/memoryRateLimit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memoryRateLimit.js","sourceRoot":"","sources":["../../../src/server/better-auth/memoryRateLimit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAQvC,MAAM,WAAW,GAAG,OAAO,CAAC;AAE5B,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;IACjC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAC3C,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,GAAG,EAAkB,CAAC,EAC5C,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAC/C,CAAC;IACF,IAAI,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAC1C,SAAS,KAAK,CAAC,GAAW;QACzB,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;YACvB,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC;YACtC,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;gBACzC,IAAI,GAAG,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;oBAC5B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC1B,CAAC;qBAAM,CAAC;oBACP,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;gBACpD,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IACD,MAAM,OAAO,GAA6D;QACzE,OAAO,CAAC,GAAG,EAAE,IAAI;YAChB,MAAM,GAAG,GAAG,KAAK,CAAC,uBAAuB,EAAE,CAAC;YAC5C,KAAK,CAAC,GAAG,CAAC,CAAC;YACX,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YAClC,IAAI,MAAM,KAAK,SAAS,IAAI,GAAG,GAAG,MAAM,CAAC,WAAW,GAAG,MAAM,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC3F,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,GAAG,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/G,CAAC;YACD,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,GAAG,MAAM,CAAC,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE;gBAChB,KAAK,EAAE,MAAM,KAAK,SAAS,IAAI,GAAG,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC;gBACxF,SAAS,EAAE,GAAG,GAAG,MAAM;gBACvB,WAAW,EAAE,GAAG;aAChB,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,IAAI,GAAG,WAAW,EAAE,CAAC;gBAChC,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;oBACrC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oBACvB,MAAM;gBACP,CAAC;YACF,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;KACD,CAAC;IACF,OAAO,OAAO,CAAC;AAChB,CAAC,CAAC,CAAC"}