@yielded/auth 0.1.0-beta.1

package/dist/totp/definition.mjs

@@ -0,0 +1,24 @@
+import { makeTotpModule } from "./module.mjs";
+//#region src/totp/definition.ts
+const captureDefine = (_namespace, input) => {
+	return { options: Object.freeze({ ...input }) };
+};
+const bindDefine = (binding, captured) => {
+	const { options } = captured;
+	return makeTotpModule(binding.namespace, options, binding.sessions);
+};
+const define = (namespace, input) => {
+	const captured = captureDefine(namespace, input);
+	const bind = (binding) => bindDefine(binding, captured);
+	return Object.freeze({
+		namespace,
+		bind
+	});
+};
+function make(options) {
+	return define(options.namespace, options);
+}
+//#endregion
+export { make };
+
+//# sourceMappingURL=definition.mjs.map

package/dist/totp/definition.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"definition.mjs","names":[],"sources":["../../src/totp/definition.ts"],"sourcesContent":["import type {\n  BindingOf,\n  ClaimsCodec,\n  StrategyBinding,\n  StrategyDefinition,\n  StrategyTypeLambda,\n} from \"../auth/definition\";\nimport type { TotpPolicy } from \"./models\";\nimport { makeTotpModule } from \"./module\";\n\nexport type TotpOptions<Namespace extends string | undefined = undefined> = TotpPolicy & {\n  readonly namespace?: Namespace;\n};\n\nconst captureDefine = <const Namespace extends string | undefined>(\n  _namespace: Namespace,\n  input: TotpOptions<Namespace>,\n) => {\n  const options = Object.freeze({ ...input });\n\n  return { options };\n};\n\nconst bindDefine = <\n  const Namespace extends string | undefined,\n  Claims extends ClaimsCodec,\n  const Id extends string,\n  const SessionId extends string,\n>(\n  binding: StrategyBinding<Claims, Id, SessionId>,\n  captured: ReturnType<typeof captureDefine<Namespace>>,\n) => {\n  const { options } = captured;\n\n  return makeTotpModule(binding.namespace, options, binding.sessions);\n};\n\nexport interface DefineStrategy<Namespace extends string | undefined> extends StrategyTypeLambda {\n  readonly type: ReturnType<\n    typeof bindDefine<\n      Namespace,\n      BindingOf<this>[\"claims\"],\n      BindingOf<this>[\"namespace\"],\n      BindingOf<this>[\"sessionNamespace\"]\n    >\n  >;\n}\n\nconst define = <const Namespace extends string | undefined>(\n  namespace: Namespace,\n  input: TotpOptions<Namespace>,\n) => {\n  const captured = captureDefine<Namespace>(namespace, input);\n\n  const bind = <\n    Claims extends ClaimsCodec,\n    const Id extends string,\n    const SessionId extends string,\n  >(\n    binding: StrategyBinding<Claims, Id, SessionId>,\n  ) => bindDefine<Namespace, Claims, Id, SessionId>(binding, captured);\n\n  const definition: StrategyDefinition<DefineStrategy<Namespace>, Namespace> = { namespace, bind };\n\n  return Object.freeze(definition);\n};\n\nexport function make<const Namespace extends string>(\n  options: TotpOptions<Namespace> & { readonly namespace: Namespace },\n): ReturnType<typeof define<Namespace>>;\n\nexport function make<const Namespace extends string | undefined = undefined>(\n  options: TotpOptions<Namespace>,\n): ReturnType<typeof define<Namespace | undefined>>;\n\nexport function make<const Namespace extends string | undefined>(options: TotpOptions<Namespace>) {\n  return define(options.namespace, options);\n}\n"],"mappings":";;AAcA,MAAM,iBACJ,YACA,UACG;CAGH,OAAO,EAAE,SAFO,OAAO,OAAO,EAAE,GAAG,MAAM,CAE1B,EAAE;AACnB;AAEA,MAAM,cAMJ,SACA,aACG;CACH,MAAM,EAAE,YAAY;CAEpB,OAAO,eAAe,QAAQ,WAAW,SAAS,QAAQ,QAAQ;AACpE;AAaA,MAAM,UACJ,WACA,UACG;CACH,MAAM,WAAW,cAAyB,WAAW,KAAK;CAE1D,MAAM,QAKJ,YACG,WAA6C,SAAS,QAAQ;CAInE,OAAO,OAAO,OAAO;EAF0D;EAAW;CAE5D,CAAC;AACjC;AAUA,SAAgB,KAAiD,SAAiC;CAChG,OAAO,OAAO,QAAQ,WAAW,OAAO;AAC1C"}

package/dist/totp/errors.d.mts

@@ -0,0 +1,16 @@
+import { HookDenied } from "../hooks/models.mjs";
+import { Schema } from "effect";
+//#region src/totp/errors.d.ts
+declare const TotpRejected_base: Schema.Class<TotpRejected, Schema.TaggedStruct<"TotpRejected", {}>, import("effect/Cause").YieldableError>;
+declare class TotpRejected extends TotpRejected_base {}
+declare const TotpUnavailable_base: Schema.Class<TotpUnavailable, Schema.TaggedStruct<"TotpUnavailable", {}>, import("effect/Cause").YieldableError>;
+declare class TotpUnavailable extends TotpUnavailable_base {}
+declare const TotpConfigurationError_base: Schema.Class<TotpConfigurationError, Schema.TaggedStruct<"TotpConfigurationError", {}>, import("effect/Cause").YieldableError>;
+declare class TotpConfigurationError extends TotpConfigurationError_base {}
+declare const TotpActionRequired_base: Schema.Class<TotpActionRequired, Schema.TaggedStruct<"TotpActionRequired", {}>, import("effect/Cause").YieldableError>;
+declare class TotpActionRequired extends TotpActionRequired_base {}
+declare const TotpFailure: Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>;
+type TotpFailure = typeof TotpFailure.Type;
+//#endregion
+export { TotpActionRequired, TotpConfigurationError, TotpFailure, TotpRejected, TotpUnavailable };
+//# sourceMappingURL=errors.d.mts.map

package/dist/totp/errors.mjs

@@ -0,0 +1,18 @@
+import { HookDenied } from "../hooks/models.mjs";
+import { Schema } from "effect";
+//#region src/totp/errors.ts
+var TotpRejected = class extends Schema.TaggedError()("TotpRejected", {}) {};
+var TotpUnavailable = class extends Schema.TaggedError()("TotpUnavailable", {}) {};
+var TotpConfigurationError = class extends Schema.TaggedError()("TotpConfigurationError", {}) {};
+var TotpActionRequired = class extends Schema.TaggedError()("TotpActionRequired", {}) {};
+const TotpFailure = Schema.Union([
+	TotpRejected,
+	TotpUnavailable,
+	TotpConfigurationError,
+	TotpActionRequired,
+	HookDenied
+]);
+//#endregion
+export { TotpActionRequired, TotpConfigurationError, TotpFailure, TotpRejected, TotpUnavailable };
+
+//# sourceMappingURL=errors.mjs.map

package/dist/totp/errors.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.mjs","names":[],"sources":["../../src/totp/errors.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nimport { HookDenied } from \"../hooks/models\";\nexport class TotpRejected extends Schema.TaggedError<TotpRejected>()(\"TotpRejected\", {}) {}\nexport class TotpUnavailable extends Schema.TaggedError<TotpUnavailable>()(\"TotpUnavailable\", {}) {}\n\nexport class TotpConfigurationError extends Schema.TaggedError<TotpConfigurationError>()(\n  \"TotpConfigurationError\",\n  {},\n) {}\n\nexport class TotpActionRequired extends Schema.TaggedError<TotpActionRequired>()(\n  \"TotpActionRequired\",\n  {},\n) {}\n\nexport const TotpFailure = Schema.Union([\n  TotpRejected,\n  TotpUnavailable,\n  TotpConfigurationError,\n  TotpActionRequired,\n  HookDenied,\n]);\n\nexport type TotpFailure = typeof TotpFailure.Type;\n"],"mappings":";;;AAGA,IAAa,eAAb,cAAkC,OAAO,YAA0B,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1F,IAAa,kBAAb,cAAqC,OAAO,YAA6B,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;AAEnG,IAAa,yBAAb,cAA4C,OAAO,YAAoC,CAAC,CACtF,0BACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,qBAAb,cAAwC,OAAO,YAAgC,CAAC,CAC9E,sBACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,MAAa,cAAc,OAAO,MAAM;CACtC;CACA;CACA;CACA;CACA;AACF,CAAC"}

package/dist/totp/models.d.mts

@@ -0,0 +1,377 @@
+import { Schema } from "effect";
+//#region src/totp/models.d.ts
+declare const TotpSecretEnvelope: Schema.Struct<{
+  readonly keyId: Schema.NonEmptyString;
+  readonly nonce: Schema.String;
+  readonly ciphertext: Schema.String;
+  readonly revision: Schema.NonEmptyString;
+}>;
+type TotpSecretEnvelope = typeof TotpSecretEnvelope.Type;
+declare const TotpSecretBinding: Schema.Struct<{
+  readonly moduleId: Schema.NonEmptyString;
+  readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+  readonly credentialId: Schema.NonEmptyString;
+  readonly revision: Schema.NonEmptyString;
+}>;
+type TotpSecretBinding = typeof TotpSecretBinding.Type;
+declare const TotpRecord: Schema.Struct<{
+  readonly moduleId: Schema.NonEmptyString;
+  readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+  readonly credentialId: Schema.NonEmptyString;
+  readonly revision: Schema.NonEmptyString;
+  readonly version: Schema.NonEmptyString;
+  readonly secret: Schema.NullOr<Schema.Struct<{
+    readonly keyId: Schema.NonEmptyString;
+    readonly nonce: Schema.String;
+    readonly ciphertext: Schema.String;
+    readonly revision: Schema.NonEmptyString;
+  }>>;
+  readonly pending: Schema.NullOr<Schema.Struct<{
+    readonly revision: Schema.NonEmptyString;
+    readonly enrollmentId: Schema.NonEmptyString;
+    readonly secret: Schema.Struct<{
+      readonly keyId: Schema.NonEmptyString;
+      readonly nonce: Schema.String;
+      readonly ciphertext: Schema.String;
+      readonly revision: Schema.NonEmptyString;
+    }>;
+    readonly expiresAtMillis: Schema.Natural;
+    readonly failedAttempts: Schema.Natural;
+  }>>;
+  readonly recoveryDigests: Schema.$Array<Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">>;
+  readonly acceptedStep: Schema.Int;
+  readonly attemptWindow: Schema.Natural;
+  readonly failedAttempts: Schema.Natural;
+}>;
+type TotpRecord = typeof TotpRecord.Type;
+declare const TotpSnapshot: Schema.Struct<{
+  readonly revision: Schema.Struct<{
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly credentials: Schema.$Array<Schema.Struct<{
+      readonly credentialId: Schema.NonEmptyString;
+      readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    }>>;
+  }>;
+  readonly record: Schema.NullOr<Schema.Struct<{
+    readonly moduleId: Schema.NonEmptyString;
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly credentialId: Schema.NonEmptyString;
+    readonly revision: Schema.NonEmptyString;
+    readonly version: Schema.NonEmptyString;
+    readonly secret: Schema.NullOr<Schema.Struct<{
+      readonly keyId: Schema.NonEmptyString;
+      readonly nonce: Schema.String;
+      readonly ciphertext: Schema.String;
+      readonly revision: Schema.NonEmptyString;
+    }>>;
+    readonly pending: Schema.NullOr<Schema.Struct<{
+      readonly revision: Schema.NonEmptyString;
+      readonly enrollmentId: Schema.NonEmptyString;
+      readonly secret: Schema.Struct<{
+        readonly keyId: Schema.NonEmptyString;
+        readonly nonce: Schema.String;
+        readonly ciphertext: Schema.String;
+        readonly revision: Schema.NonEmptyString;
+      }>;
+      readonly expiresAtMillis: Schema.Natural;
+      readonly failedAttempts: Schema.Natural;
+    }>>;
+    readonly recoveryDigests: Schema.$Array<Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">>;
+    readonly acceptedStep: Schema.Int;
+    readonly attemptWindow: Schema.Natural;
+    readonly failedAttempts: Schema.Natural;
+  }>>;
+}>;
+type TotpSnapshot = typeof TotpSnapshot.Type;
+declare const TotpActionChallenge: Schema.Struct<{
+  readonly moduleId: Schema.NonEmptyString;
+  readonly action: Schema.Literals<readonly ["enroll", "confirm", "disable", "regenerate"]>;
+  readonly commandId: Schema.NonEmptyString;
+  readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+  readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  readonly revision: Schema.Struct<{
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly credentials: Schema.$Array<Schema.Struct<{
+      readonly credentialId: Schema.NonEmptyString;
+      readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    }>>;
+  }>;
+}>;
+type TotpActionChallenge = typeof TotpActionChallenge.Type;
+declare const TotpActionAuthorization: Schema.Struct<{
+  readonly challenge: Schema.Struct<{
+    readonly moduleId: Schema.NonEmptyString;
+    readonly action: Schema.Literals<readonly ["enroll", "confirm", "disable", "regenerate"]>;
+    readonly commandId: Schema.NonEmptyString;
+    readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+    readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+    readonly revision: Schema.Struct<{
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly credentials: Schema.$Array<Schema.Struct<{
+        readonly credentialId: Schema.NonEmptyString;
+        readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      }>>;
+    }>;
+  }>;
+  readonly evidence: Schema.Struct<{
+    readonly revision: Schema.Struct<{
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly credentials: Schema.$Array<Schema.Struct<{
+        readonly credentialId: Schema.NonEmptyString;
+        readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      }>>;
+    }>;
+    readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+    readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+    readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+      readonly method: Schema.NonEmptyString;
+      readonly credentialId: Schema.NonEmptyString;
+      readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+      readonly userVerified: Schema.Boolean;
+      readonly phishingResistant: Schema.Boolean;
+      readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+    }>>;
+  }>;
+  readonly requirement: Schema.Struct<{
+    readonly alternatives: Schema.NonEmptyArray<Schema.Struct<{
+      readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+      readonly userVerified: Schema.Boolean;
+      readonly phishingResistant: Schema.Boolean;
+      readonly minimumCredentials: Schema.Int;
+    }>>;
+    readonly maximumAgeMillis: Schema.Int;
+  }>;
+}>;
+type TotpActionAuthorization = typeof TotpActionAuthorization.Type;
+declare const TotpPolicy: Schema.Struct<{
+  readonly issuer: Schema.NonEmptyString;
+  readonly enrollmentLifetimeMillis: Schema.Int;
+  readonly revealLifetimeMillis: Schema.Int;
+  readonly clockSkewSteps: Schema.Int;
+  readonly attemptLimit: Schema.Int;
+  readonly attemptWindowMillis: Schema.Int;
+  readonly maximumEvidenceAgeMillis: Schema.Int;
+  readonly allowRecoveryCodeForPending: Schema.Boolean;
+  readonly lostFactorRecovery: Schema.Literals<readonly ["deny", "reset-with-recovery-code"]>;
+  readonly requireImmediateInvalidation: Schema.Boolean;
+}>;
+type TotpPolicy = typeof TotpPolicy.Type;
+declare const TotpManagementResult: Schema.Struct<{
+  readonly enabled: Schema.Boolean;
+  readonly invalidation: Schema.Struct<{
+    readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+    readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+    readonly maximumExposureMillis: Schema.Natural;
+    readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+  }>;
+}>;
+declare const TotpEnrollmentStarted: Schema.Struct<{
+  readonly enrollmentId: Schema.NonEmptyString;
+  readonly expiresAtMillis: Schema.Natural;
+}>;
+declare const TotpRecoveryReset: Schema.Struct<{
+  readonly outcome: Schema.Literal<"reauthentication-required">;
+  readonly invalidation: Schema.Struct<{
+    readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+    readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+    readonly maximumExposureMillis: Schema.Natural;
+    readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+  }>;
+}>;
+declare const TotpDecision: Schema.Union<readonly [Schema.TaggedStruct<"Accepted", {
+  readonly record: Schema.Struct<{
+    readonly moduleId: Schema.NonEmptyString;
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly credentialId: Schema.NonEmptyString;
+    readonly revision: Schema.NonEmptyString;
+    readonly version: Schema.NonEmptyString;
+    readonly secret: Schema.NullOr<Schema.Struct<{
+      readonly keyId: Schema.NonEmptyString;
+      readonly nonce: Schema.String;
+      readonly ciphertext: Schema.String;
+      readonly revision: Schema.NonEmptyString;
+    }>>;
+    readonly pending: Schema.NullOr<Schema.Struct<{
+      readonly revision: Schema.NonEmptyString;
+      readonly enrollmentId: Schema.NonEmptyString;
+      readonly secret: Schema.Struct<{
+        readonly keyId: Schema.NonEmptyString;
+        readonly nonce: Schema.String;
+        readonly ciphertext: Schema.String;
+        readonly revision: Schema.NonEmptyString;
+      }>;
+      readonly expiresAtMillis: Schema.Natural;
+      readonly failedAttempts: Schema.Natural;
+    }>>;
+    readonly recoveryDigests: Schema.$Array<Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">>;
+    readonly acceptedStep: Schema.Int;
+    readonly attemptWindow: Schema.Natural;
+    readonly failedAttempts: Schema.Natural;
+  }>;
+}>, Schema.TaggedStruct<"Rejected", {}>]>;
+type TotpDecision = typeof TotpDecision.Type;
+declare const TotpMutation: Schema.Struct<{
+  readonly snapshot: Schema.Struct<{
+    readonly revision: Schema.Struct<{
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly credentials: Schema.$Array<Schema.Struct<{
+        readonly credentialId: Schema.NonEmptyString;
+        readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      }>>;
+    }>;
+    readonly record: Schema.NullOr<Schema.Struct<{
+      readonly moduleId: Schema.NonEmptyString;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly credentialId: Schema.NonEmptyString;
+      readonly revision: Schema.NonEmptyString;
+      readonly version: Schema.NonEmptyString;
+      readonly secret: Schema.NullOr<Schema.Struct<{
+        readonly keyId: Schema.NonEmptyString;
+        readonly nonce: Schema.String;
+        readonly ciphertext: Schema.String;
+        readonly revision: Schema.NonEmptyString;
+      }>>;
+      readonly pending: Schema.NullOr<Schema.Struct<{
+        readonly revision: Schema.NonEmptyString;
+        readonly enrollmentId: Schema.NonEmptyString;
+        readonly secret: Schema.Struct<{
+          readonly keyId: Schema.NonEmptyString;
+          readonly nonce: Schema.String;
+          readonly ciphertext: Schema.String;
+          readonly revision: Schema.NonEmptyString;
+        }>;
+        readonly expiresAtMillis: Schema.Natural;
+        readonly failedAttempts: Schema.Natural;
+      }>>;
+      readonly recoveryDigests: Schema.$Array<Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">>;
+      readonly acceptedStep: Schema.Int;
+      readonly attemptWindow: Schema.Natural;
+      readonly failedAttempts: Schema.Natural;
+    }>>;
+  }>;
+  readonly moduleId: Schema.NonEmptyString;
+  readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+  readonly commandId: Schema.NonEmptyString;
+  readonly policy: Schema.Struct<{
+    readonly issuer: Schema.NonEmptyString;
+    readonly enrollmentLifetimeMillis: Schema.Int;
+    readonly revealLifetimeMillis: Schema.Int;
+    readonly clockSkewSteps: Schema.Int;
+    readonly attemptLimit: Schema.Int;
+    readonly attemptWindowMillis: Schema.Int;
+    readonly maximumEvidenceAgeMillis: Schema.Int;
+    readonly allowRecoveryCodeForPending: Schema.Boolean;
+    readonly lostFactorRecovery: Schema.Literals<readonly ["deny", "reset-with-recovery-code"]>;
+    readonly requireImmediateInvalidation: Schema.Boolean;
+  }>;
+  readonly authorization: Schema.optionalKey<Schema.Struct<{
+    readonly challenge: Schema.Struct<{
+      readonly moduleId: Schema.NonEmptyString;
+      readonly action: Schema.Literals<readonly ["enroll", "confirm", "disable", "regenerate"]>;
+      readonly commandId: Schema.NonEmptyString;
+      readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+      readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+      readonly revision: Schema.Struct<{
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly credentials: Schema.$Array<Schema.Struct<{
+          readonly credentialId: Schema.NonEmptyString;
+          readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        }>>;
+      }>;
+    }>;
+    readonly evidence: Schema.Struct<{
+      readonly revision: Schema.Struct<{
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly credentials: Schema.$Array<Schema.Struct<{
+          readonly credentialId: Schema.NonEmptyString;
+          readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        }>>;
+      }>;
+      readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+      readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+      readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+        readonly method: Schema.NonEmptyString;
+        readonly credentialId: Schema.NonEmptyString;
+        readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+        readonly userVerified: Schema.Boolean;
+        readonly phishingResistant: Schema.Boolean;
+        readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+      }>>;
+    }>;
+    readonly requirement: Schema.Struct<{
+      readonly alternatives: Schema.NonEmptyArray<Schema.Struct<{
+        readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+        readonly userVerified: Schema.Boolean;
+        readonly phishingResistant: Schema.Boolean;
+        readonly minimumCredentials: Schema.Int;
+      }>>;
+      readonly maximumAgeMillis: Schema.Int;
+    }>;
+  }>>;
+  readonly action: Schema.Union<readonly [Schema.TaggedStruct<"Enroll", {
+    readonly record: Schema.Struct<{
+      readonly moduleId: Schema.NonEmptyString;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly credentialId: Schema.NonEmptyString;
+      readonly revision: Schema.NonEmptyString;
+      readonly version: Schema.NonEmptyString;
+      readonly secret: Schema.NullOr<Schema.Struct<{
+        readonly keyId: Schema.NonEmptyString;
+        readonly nonce: Schema.String;
+        readonly ciphertext: Schema.String;
+        readonly revision: Schema.NonEmptyString;
+      }>>;
+      readonly pending: Schema.NullOr<Schema.Struct<{
+        readonly revision: Schema.NonEmptyString;
+        readonly enrollmentId: Schema.NonEmptyString;
+        readonly secret: Schema.Struct<{
+          readonly keyId: Schema.NonEmptyString;
+          readonly nonce: Schema.String;
+          readonly ciphertext: Schema.String;
+          readonly revision: Schema.NonEmptyString;
+        }>;
+        readonly expiresAtMillis: Schema.Natural;
+        readonly failedAttempts: Schema.Natural;
+      }>>;
+      readonly recoveryDigests: Schema.$Array<Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">>;
+      readonly acceptedStep: Schema.Int;
+      readonly attemptWindow: Schema.Natural;
+      readonly failedAttempts: Schema.Natural;
+    }>;
+  }>, Schema.TaggedStruct<"Confirm", {
+    readonly enrollmentId: Schema.NonEmptyString;
+    readonly matchedStep: Schema.NullOr<Schema.Natural>;
+    readonly recoveryDigests: Schema.$Array<Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">>;
+  }>, Schema.TaggedStruct<"Verify", {
+    readonly matchedStep: Schema.NullOr<Schema.Natural>;
+  }>, Schema.TaggedStruct<"Recovery", {
+    readonly digest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+    readonly reset: Schema.Boolean;
+    readonly pending: Schema.optionalKey<Schema.Struct<{
+      readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+      readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+      readonly revision: Schema.Struct<{
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly credentials: Schema.$Array<Schema.Struct<{
+          readonly credentialId: Schema.NonEmptyString;
+          readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        }>>;
+      }>;
+      readonly expiresAtMillis: Schema.Int;
+    }>>;
+  }>, Schema.TaggedStruct<"Disable", {}>, Schema.TaggedStruct<"Regenerate", {
+    readonly recoveryDigests: Schema.$Array<Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">>;
+  }>]>;
+}>;
+type TotpMutation = typeof TotpMutation.Type;
+//#endregion
+export { TotpActionAuthorization, TotpActionChallenge, TotpDecision, TotpEnrollmentStarted, TotpManagementResult, TotpMutation, TotpPolicy, TotpRecord, TotpRecoveryReset, TotpSecretBinding, TotpSecretEnvelope, TotpSnapshot };
+//# sourceMappingURL=models.d.mts.map

package/dist/totp/models.mjs

@@ -0,0 +1,137 @@
+import { SubjectId, TokenDigest } from "../Schema.mjs";
+import { SessionInvalidationWindow } from "../sessions/invalidation.mjs";
+import { AuthenticationEvidence, AuthenticationFlowId, AuthenticationRequirement, AuthenticationRevision } from "../sessions/models.mjs";
+import { PendingAuthenticationContext } from "../sessions/PendingAuthentication.mjs";
+import { Schema } from "effect";
+//#region src/totp/models.ts
+const TotpId = Schema.NonEmptyString.check(Schema.isMaxLength(256));
+const TotpInstant = Schema.Natural.check(Schema.isLessThanOrEqualTo(Number.MAX_SAFE_INTEGER));
+const TotpCode = Schema.RedactedFromValue(Schema.String.check(Schema.isPattern(/^[0-9]{6}$/)));
+const TotpRecoveryCode = Schema.RedactedFromValue(Schema.String.check(Schema.isPattern(/^rc1-[A-F0-9]{8}-[A-F0-9]{8}-[A-F0-9]{8}-[A-F0-9]{8}$/)));
+const TotpCredential = Schema.RedactedFromValue(Schema.NonEmptyString.check(Schema.isMaxLength(16384)));
+const TotpSecretEnvelope = Schema.Struct({
+	keyId: TotpId,
+	nonce: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{16}$/)),
+	ciphertext: Schema.String.check(Schema.isMaxLength(256)),
+	revision: TotpId
+});
+const TotpSecretBinding = Schema.Struct({
+	moduleId: TotpId,
+	subjectId: SubjectId,
+	credentialId: TotpId,
+	revision: TotpId
+});
+const TotpPendingEnrollment = Schema.Struct({
+	revision: TotpId,
+	enrollmentId: TotpId,
+	secret: TotpSecretEnvelope,
+	expiresAtMillis: TotpInstant,
+	failedAttempts: Schema.Natural
+});
+const TotpRecord = Schema.Struct({
+	moduleId: TotpId,
+	subjectId: SubjectId,
+	credentialId: TotpId,
+	revision: TotpId,
+	version: TotpId,
+	secret: Schema.NullOr(TotpSecretEnvelope),
+	pending: Schema.NullOr(TotpPendingEnrollment),
+	recoveryDigests: Schema.Array(TokenDigest).check(Schema.isMaxLength(10)),
+	acceptedStep: Schema.Int.check(Schema.isGreaterThanOrEqualTo(-1)),
+	attemptWindow: TotpInstant,
+	failedAttempts: Schema.Natural
+});
+const TotpSnapshot = Schema.Struct({
+	revision: AuthenticationRevision,
+	record: Schema.NullOr(TotpRecord)
+});
+const TotpAction = Schema.Literals([
+	"enroll",
+	"confirm",
+	"disable",
+	"regenerate"
+]);
+const TotpActionChallenge = Schema.Struct({
+	moduleId: TotpId,
+	action: TotpAction,
+	commandId: TotpId,
+	flowId: AuthenticationFlowId,
+	bindingDigest: TokenDigest,
+	revision: AuthenticationRevision
+});
+const TotpActionAuthorization = Schema.Struct({
+	challenge: TotpActionChallenge,
+	evidence: AuthenticationEvidence,
+	requirement: AuthenticationRequirement
+});
+const TotpPolicy = Schema.Struct({
+	issuer: Schema.NonEmptyString.check(Schema.isMaxLength(128)),
+	enrollmentLifetimeMillis: Schema.Int.check(Schema.isBetween({
+		minimum: 3e4,
+		maximum: 6e5
+	})),
+	revealLifetimeMillis: Schema.Int.check(Schema.isBetween({
+		minimum: 1e3,
+		maximum: 3e5
+	})),
+	clockSkewSteps: Schema.Int.check(Schema.isBetween({
+		minimum: 0,
+		maximum: 1
+	})),
+	attemptLimit: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 10
+	})),
+	attemptWindowMillis: Schema.Int.check(Schema.isBetween({
+		minimum: 3e4,
+		maximum: 36e5
+	})),
+	maximumEvidenceAgeMillis: Schema.Int.check(Schema.isBetween({
+		minimum: 1e3,
+		maximum: 3e5
+	})),
+	allowRecoveryCodeForPending: Schema.Boolean,
+	lostFactorRecovery: Schema.Literals(["deny", "reset-with-recovery-code"]),
+	requireImmediateInvalidation: Schema.Boolean
+});
+const TotpManagementResult = Schema.Struct({
+	enabled: Schema.Boolean,
+	invalidation: SessionInvalidationWindow
+});
+const TotpEnrollmentStarted = Schema.Struct({
+	enrollmentId: TotpId,
+	expiresAtMillis: TotpInstant
+});
+const TotpRecoveryReset = Schema.Struct({
+	outcome: Schema.Literal("reauthentication-required"),
+	invalidation: SessionInvalidationWindow
+});
+const TotpDecision = Schema.Union([Schema.TaggedStruct("Accepted", { record: TotpRecord }), Schema.TaggedStruct("Rejected", {})]);
+const TotpMutation = Schema.Struct({
+	snapshot: TotpSnapshot,
+	moduleId: TotpId,
+	subjectId: SubjectId,
+	commandId: TotpId,
+	policy: TotpPolicy,
+	authorization: Schema.optionalKey(TotpActionAuthorization),
+	action: Schema.Union([
+		Schema.TaggedStruct("Enroll", { record: TotpRecord }),
+		Schema.TaggedStruct("Confirm", {
+			enrollmentId: TotpId,
+			matchedStep: Schema.NullOr(Schema.Natural),
+			recoveryDigests: Schema.Array(TokenDigest).check(Schema.isLengthBetween(10, 10))
+		}),
+		Schema.TaggedStruct("Verify", { matchedStep: Schema.NullOr(Schema.Natural) }),
+		Schema.TaggedStruct("Recovery", {
+			digest: TokenDigest,
+			reset: Schema.Boolean,
+			pending: Schema.optionalKey(PendingAuthenticationContext)
+		}),
+		Schema.TaggedStruct("Disable", {}),
+		Schema.TaggedStruct("Regenerate", { recoveryDigests: Schema.Array(TokenDigest).check(Schema.isLengthBetween(10, 10)) })
+	])
+});
+//#endregion
+export { TotpAction, TotpActionAuthorization, TotpActionChallenge, TotpCode, TotpCredential, TotpDecision, TotpEnrollmentStarted, TotpId, TotpInstant, TotpManagementResult, TotpMutation, TotpPendingEnrollment, TotpPolicy, TotpRecord, TotpRecoveryCode, TotpRecoveryReset, TotpSecretBinding, TotpSecretEnvelope, TotpSnapshot };
+
+//# sourceMappingURL=models.mjs.map

package/dist/totp/models.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.mjs","names":[],"sources":["../../src/totp/models.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nimport { SubjectId, TokenDigest } from \"../Schema\";\nimport { SessionInvalidationWindow } from \"../sessions/invalidation\";\nimport {\n  AuthenticationEvidence,\n  AuthenticationFlowId,\n  AuthenticationRevision,\n  AuthenticationRequirement,\n} from \"../sessions/models\";\nimport { PendingAuthenticationContext } from \"../sessions/PendingAuthentication\";\n\nexport const TotpId = Schema.NonEmptyString.check(Schema.isMaxLength(256));\n\nexport const TotpInstant = Schema.Natural.check(\n  Schema.isLessThanOrEqualTo(Number.MAX_SAFE_INTEGER),\n);\n\nexport const TotpCode = Schema.RedactedFromValue(\n  Schema.String.check(Schema.isPattern(/^[0-9]{6}$/)),\n);\n\nexport const TotpRecoveryCode = Schema.RedactedFromValue(\n  Schema.String.check(Schema.isPattern(/^rc1-[A-F0-9]{8}-[A-F0-9]{8}-[A-F0-9]{8}-[A-F0-9]{8}$/)),\n);\n\nexport const TotpCredential = Schema.RedactedFromValue(\n  Schema.NonEmptyString.check(Schema.isMaxLength(16384)),\n);\n\nexport const TotpSecretEnvelope = Schema.Struct({\n  keyId: TotpId,\n  nonce: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{16}$/)),\n  ciphertext: Schema.String.check(Schema.isMaxLength(256)),\n  revision: TotpId,\n});\n\nexport type TotpSecretEnvelope = typeof TotpSecretEnvelope.Type;\n\nexport const TotpSecretBinding = Schema.Struct({\n  moduleId: TotpId,\n  subjectId: SubjectId,\n  credentialId: TotpId,\n  revision: TotpId,\n});\n\nexport type TotpSecretBinding = typeof TotpSecretBinding.Type;\n\nexport const TotpPendingEnrollment = Schema.Struct({\n  revision: TotpId,\n  enrollmentId: TotpId,\n  secret: TotpSecretEnvelope,\n  expiresAtMillis: TotpInstant,\n  failedAttempts: Schema.Natural,\n});\n\nexport const TotpRecord = Schema.Struct({\n  moduleId: TotpId,\n  subjectId: SubjectId,\n  credentialId: TotpId,\n  revision: TotpId,\n  version: TotpId,\n  secret: Schema.NullOr(TotpSecretEnvelope),\n  pending: Schema.NullOr(TotpPendingEnrollment),\n  recoveryDigests: Schema.Array(TokenDigest).check(Schema.isMaxLength(10)),\n  acceptedStep: Schema.Int.check(Schema.isGreaterThanOrEqualTo(-1)),\n  attemptWindow: TotpInstant,\n  failedAttempts: Schema.Natural,\n});\n\nexport type TotpRecord = typeof TotpRecord.Type;\n\nexport const TotpSnapshot = Schema.Struct({\n  revision: AuthenticationRevision,\n  record: Schema.NullOr(TotpRecord),\n});\n\nexport type TotpSnapshot = typeof TotpSnapshot.Type;\nexport const TotpAction = Schema.Literals([\"enroll\", \"confirm\", \"disable\", \"regenerate\"]);\n\nexport const TotpActionChallenge = Schema.Struct({\n  moduleId: TotpId,\n  action: TotpAction,\n  commandId: TotpId,\n  flowId: AuthenticationFlowId,\n  bindingDigest: TokenDigest,\n  revision: AuthenticationRevision,\n});\n\nexport type TotpActionChallenge = typeof TotpActionChallenge.Type;\n\nexport const TotpActionAuthorization = Schema.Struct({\n  challenge: TotpActionChallenge,\n  evidence: AuthenticationEvidence,\n  requirement: AuthenticationRequirement,\n});\n\nexport type TotpActionAuthorization = typeof TotpActionAuthorization.Type;\n\nexport const TotpPolicy = Schema.Struct({\n  issuer: Schema.NonEmptyString.check(Schema.isMaxLength(128)),\n  enrollmentLifetimeMillis: Schema.Int.check(Schema.isBetween({ minimum: 30000, maximum: 600000 })),\n  revealLifetimeMillis: Schema.Int.check(Schema.isBetween({ minimum: 1000, maximum: 300000 })),\n  clockSkewSteps: Schema.Int.check(Schema.isBetween({ minimum: 0, maximum: 1 })),\n  attemptLimit: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 10 })),\n  attemptWindowMillis: Schema.Int.check(Schema.isBetween({ minimum: 30000, maximum: 3600000 })),\n  maximumEvidenceAgeMillis: Schema.Int.check(Schema.isBetween({ minimum: 1000, maximum: 300000 })),\n  allowRecoveryCodeForPending: Schema.Boolean,\n  lostFactorRecovery: Schema.Literals([\"deny\", \"reset-with-recovery-code\"]),\n  requireImmediateInvalidation: Schema.Boolean,\n});\n\nexport type TotpPolicy = typeof TotpPolicy.Type;\n\nexport const TotpManagementResult = Schema.Struct({\n  enabled: Schema.Boolean,\n  invalidation: SessionInvalidationWindow,\n});\n\nexport const TotpEnrollmentStarted = Schema.Struct({\n  enrollmentId: TotpId,\n  expiresAtMillis: TotpInstant,\n});\n\nexport const TotpRecoveryReset = Schema.Struct({\n  outcome: Schema.Literal(\"reauthentication-required\"),\n  invalidation: SessionInvalidationWindow,\n});\n\nexport const TotpDecision = Schema.Union([\n  Schema.TaggedStruct(\"Accepted\", { record: TotpRecord }),\n  Schema.TaggedStruct(\"Rejected\", {}),\n]);\n\nexport type TotpDecision = typeof TotpDecision.Type;\n\nexport const TotpMutation = Schema.Struct({\n  snapshot: TotpSnapshot,\n  moduleId: TotpId,\n  subjectId: SubjectId,\n  commandId: TotpId,\n  policy: TotpPolicy,\n  authorization: Schema.optionalKey(TotpActionAuthorization),\n  action: Schema.Union([\n    Schema.TaggedStruct(\"Enroll\", { record: TotpRecord }),\n    Schema.TaggedStruct(\"Confirm\", {\n      enrollmentId: TotpId,\n      matchedStep: Schema.NullOr(Schema.Natural),\n      recoveryDigests: Schema.Array(TokenDigest).check(Schema.isLengthBetween(10, 10)),\n    }),\n    Schema.TaggedStruct(\"Verify\", { matchedStep: Schema.NullOr(Schema.Natural) }),\n    Schema.TaggedStruct(\"Recovery\", {\n      digest: TokenDigest,\n      reset: Schema.Boolean,\n      pending: Schema.optionalKey(PendingAuthenticationContext),\n    }),\n    Schema.TaggedStruct(\"Disable\", {}),\n    Schema.TaggedStruct(\"Regenerate\", {\n      recoveryDigests: Schema.Array(TokenDigest).check(Schema.isLengthBetween(10, 10)),\n    }),\n  ]),\n});\n\nexport type TotpMutation = typeof TotpMutation.Type;\n"],"mappings":";;;;;;AAYA,MAAa,SAAS,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;AAEzE,MAAa,cAAc,OAAO,QAAQ,MACxC,OAAO,oBAAoB,OAAO,gBAAgB,CACpD;AAEA,MAAa,WAAW,OAAO,kBAC7B,OAAO,OAAO,MAAM,OAAO,UAAU,YAAY,CAAC,CACpD;AAEA,MAAa,mBAAmB,OAAO,kBACrC,OAAO,OAAO,MAAM,OAAO,UAAU,uDAAuD,CAAC,CAC/F;AAEA,MAAa,iBAAiB,OAAO,kBACnC,OAAO,eAAe,MAAM,OAAO,YAAY,KAAK,CAAC,CACvD;AAEA,MAAa,qBAAqB,OAAO,OAAO;CAC9C,OAAO;CACP,OAAO,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC;CAClE,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC;CACvD,UAAU;AACZ,CAAC;AAID,MAAa,oBAAoB,OAAO,OAAO;CAC7C,UAAU;CACV,WAAW;CACX,cAAc;CACd,UAAU;AACZ,CAAC;AAID,MAAa,wBAAwB,OAAO,OAAO;CACjD,UAAU;CACV,cAAc;CACd,QAAQ;CACR,iBAAiB;CACjB,gBAAgB,OAAO;AACzB,CAAC;AAED,MAAa,aAAa,OAAO,OAAO;CACtC,UAAU;CACV,WAAW;CACX,cAAc;CACd,UAAU;CACV,SAAS;CACT,QAAQ,OAAO,OAAO,kBAAkB;CACxC,SAAS,OAAO,OAAO,qBAAqB;CAC5C,iBAAiB,OAAO,MAAM,WAAW,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC;CACvE,cAAc,OAAO,IAAI,MAAM,OAAO,uBAAuB,EAAE,CAAC;CAChE,eAAe;CACf,gBAAgB,OAAO;AACzB,CAAC;AAID,MAAa,eAAe,OAAO,OAAO;CACxC,UAAU;CACV,QAAQ,OAAO,OAAO,UAAU;AAClC,CAAC;AAGD,MAAa,aAAa,OAAO,SAAS;CAAC;CAAU;CAAW;CAAW;AAAY,CAAC;AAExF,MAAa,sBAAsB,OAAO,OAAO;CAC/C,UAAU;CACV,QAAQ;CACR,WAAW;CACX,QAAQ;CACR,eAAe;CACf,UAAU;AACZ,CAAC;AAID,MAAa,0BAA0B,OAAO,OAAO;CACnD,WAAW;CACX,UAAU;CACV,aAAa;AACf,CAAC;AAID,MAAa,aAAa,OAAO,OAAO;CACtC,QAAQ,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;CAC3D,0BAA0B,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAO,SAAS;CAAO,CAAC,CAAC;CAChG,sBAAsB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAM,SAAS;CAAO,CAAC,CAAC;CAC3F,gBAAgB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAE,CAAC,CAAC;CAC7E,cAAc,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAG,CAAC,CAAC;CAC5E,qBAAqB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAO,SAAS;CAAQ,CAAC,CAAC;CAC5F,0BAA0B,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAM,SAAS;CAAO,CAAC,CAAC;CAC/F,6BAA6B,OAAO;CACpC,oBAAoB,OAAO,SAAS,CAAC,QAAQ,0BAA0B,CAAC;CACxE,8BAA8B,OAAO;AACvC,CAAC;AAID,MAAa,uBAAuB,OAAO,OAAO;CAChD,SAAS,OAAO;CAChB,cAAc;AAChB,CAAC;AAED,MAAa,wBAAwB,OAAO,OAAO;CACjD,cAAc;CACd,iBAAiB;AACnB,CAAC;AAED,MAAa,oBAAoB,OAAO,OAAO;CAC7C,SAAS,OAAO,QAAQ,2BAA2B;CACnD,cAAc;AAChB,CAAC;AAED,MAAa,eAAe,OAAO,MAAM,CACvC,OAAO,aAAa,YAAY,EAAE,QAAQ,WAAW,CAAC,GACtD,OAAO,aAAa,YAAY,CAAC,CAAC,CACpC,CAAC;AAID,MAAa,eAAe,OAAO,OAAO;CACxC,UAAU;CACV,UAAU;CACV,WAAW;CACX,WAAW;CACX,QAAQ;CACR,eAAe,OAAO,YAAY,uBAAuB;CACzD,QAAQ,OAAO,MAAM;EACnB,OAAO,aAAa,UAAU,EAAE,QAAQ,WAAW,CAAC;EACpD,OAAO,aAAa,WAAW;GAC7B,cAAc;GACd,aAAa,OAAO,OAAO,OAAO,OAAO;GACzC,iBAAiB,OAAO,MAAM,WAAW,CAAC,CAAC,MAAM,OAAO,gBAAgB,IAAI,EAAE,CAAC;EACjF,CAAC;EACD,OAAO,aAAa,UAAU,EAAE,aAAa,OAAO,OAAO,OAAO,OAAO,EAAE,CAAC;EAC5E,OAAO,aAAa,YAAY;GAC9B,QAAQ;GACR,OAAO,OAAO;GACd,SAAS,OAAO,YAAY,4BAA4B;EAC1D,CAAC;EACD,OAAO,aAAa,WAAW,CAAC,CAAC;EACjC,OAAO,aAAa,cAAc,EAChC,iBAAiB,OAAO,MAAM,WAAW,CAAC,CAAC,MAAM,OAAO,gBAAgB,IAAI,EAAE,CAAC,EACjF,CAAC;CACH,CAAC;AACH,CAAC"}