effect 4.1.0 → 4.1.2

package/dist/jose/Jws.d.ts

@@ -0,0 +1,177 @@
+/**
+ * Compact JSON Web Signatures.
+ *
+ * The signing algorithm is the key's: {@link sign} writes it into the
+ * protected header and {@link verify} rejects a token whose `alg` differs.
+ * {@link verifyWithKeySet} resolves the key from the `Jwks` service and
+ * requires an allowlist of asymmetric algorithms. Headers with `crit` or `b64`
+ * are rejected.
+ *
+ * Bound untrusted token length before verification; this module does not
+ * impose a token-size limit.
+ *
+ * HMAC signatures run on the `Mac` service. On Node.js and Bun,
+ * `NodeCrypto.layerMac` and `BunCrypto.layerMac` compute them synchronously
+ * with `node:crypto` instead of through Web Crypto for byte-backed keys, such
+ * as those from `Jwk.importSecret`.
+ *
+ * @stability unstable
+ * @since 4.1.1
+ */
+import * as Mac from "../crypto/Mac.ts";
+import * as Signature from "../crypto/Signature.ts";
+import * as Effect from "../Effect.ts";
+import * as Redacted from "../Redacted.ts";
+import * as Schema from "../Schema.ts";
+import * as JoseError from "./JoseError.ts";
+import { AsymmetricAlgorithm, type HmacAlgorithm, type PublicKey, type SecretKey, type SigningKey, type VerificationKey } from "./Jwk.ts";
+import { Jwks } from "./Jwks.ts";
+/**
+ * Schema for an authenticated JWS protected header, including additional
+ * JSON-valued parameters.
+ *
+ * @stability unstable
+ * @category schemas
+ * @since 4.1.1
+ */
+export declare const ProtectedHeader: Schema.StructWithRest<Schema.Struct<{
+    readonly alg: Schema.Literals<readonly ["HS256", "HS384", "HS512", "RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384", "ES512", "EdDSA"]>;
+    readonly kid: Schema.optionalKey<Schema.String>;
+    readonly typ: Schema.optionalKey<Schema.String>;
+    readonly cty: Schema.optionalKey<Schema.String>;
+}>, readonly [Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>]>;
+/**
+ * An authenticated JWS protected header.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.1.1
+ */
+export type ProtectedHeader = typeof ProtectedHeader.Type;
+/**
+ * Standard header parameters to sign. Signing also accepts additional
+ * JSON-valued parameters. `alg` comes from the key and `kid` defaults to the
+ * key's.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.1.1
+ */
+export interface Header {
+    readonly alg?: never;
+    readonly crit?: never;
+    readonly b64?: never;
+    readonly kid?: string | undefined;
+    readonly typ?: string | undefined;
+    readonly cty?: string | undefined;
+}
+/**
+ * The protected header and payload of a verified JWS.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.1.1
+ */
+export interface Verified {
+    readonly protectedHeader: ProtectedHeader;
+    readonly payload: Uint8Array;
+}
+/**
+ * Options for {@link verifyWithKeySet}.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.1.1
+ */
+export interface VerifyWithKeySetOptions {
+    /**
+     * The algorithms a token may use. Must not be empty.
+     */
+    readonly algorithms: ReadonlyArray<AsymmetricAlgorithm>;
+}
+/**
+ * Services required to sign and verify with any key.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.1.1
+ */
+export type Requirements = Mac.Mac | Signature.Signature;
+/**
+ * Services required to sign or verify with a key of type `K`: `Mac` for
+ * HMAC keys and `Signature` for asymmetric keys. A union of key types
+ * requires both.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.1.1
+ */
+export type KeyRequirements<K extends SigningKey | VerificationKey> = K extends SecretKey<HmacAlgorithm> ? Mac.Mac : Signature.Signature;
+/**
+ * Signs a payload as a compact JWS with the key's algorithm.
+ *
+ * **Example** (Signing and verifying a payload)
+ *
+ * ```ts import.meta.vitest
+ * import { Effect, Layer, Redacted } from "effect"
+ * import { Mac, SecureRandom, Signature } from "effect/crypto"
+ * import { Jwk, Jws } from "effect/jose"
+ *
+ * const layer = Layer.mergeAll(Mac.layerWebCrypto, Signature.layerWebCrypto).pipe(
+ *   Layer.provide(SecureRandom.layerWebCrypto)
+ * )
+ *
+ * const payload = await Effect.runPromise(Effect.gen(function*() {
+ *   // Fixed public example material; generate application secrets securely.
+ *   const key = yield* Jwk.importSecret(
+ *     Redacted.make({ kty: "oct", k: "BwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwc" } as const),
+ *     "HS256"
+ *   )
+ *   const token = yield* Jws.sign(new TextEncoder().encode("hello"), key)
+ *   const verified = yield* Jws.verify(token, key)
+ *   return new TextDecoder().decode(verified.payload)
+ * }).pipe(Effect.provide(layer)))
+ * payload // => "hello"
+ * ```
+ *
+ * @see {@link verify}
+ *
+ * @stability unstable
+ * @category cryptography
+ * @since 4.1.1
+ */
+export declare const sign: <K extends SigningKey, H extends object & {
+    readonly [P in keyof H]: Schema.Json | undefined;
+} = Header>(payload: Uint8Array, key: K, header?: Header & H) => Effect.Effect<Redacted.Redacted<string>, JoseError.JoseError, KeyRequirements<K>>;
+/**
+ * Verifies a compact JWS with a key. The token's `alg` must be the key's
+ * algorithm.
+ *
+ * @see {@link sign}
+ * @see {@link verifyWithKeySet} for resolving the key from the `Jwks` service
+ *
+ * @stability unstable
+ * @category cryptography
+ * @since 4.1.1
+ */
+export declare const verify: <K extends VerificationKey>(token: string | Redacted.Redacted<string>, key: K) => Effect.Effect<Verified, JoseError.JoseError, KeyRequirements<K>>;
+/**
+ * Verifies a compact JWS with a public key resolved from the `Jwks` service by
+ * the token's `alg` and `kid`.
+ *
+ * **Details**
+ *
+ * The token's `alg` must be in `algorithms`, which is checked before any key
+ * lookup. The resolved key's algorithm must match the token's. HMAC tokens
+ * are always rejected.
+ *
+ * @see {@link verify} for verifying with a known key
+ *
+ * @stability unstable
+ * @category cryptography
+ * @since 4.1.1
+ */
+export declare const verifyWithKeySet: (token: string | Redacted.Redacted<string>, options: VerifyWithKeySetOptions) => Effect.Effect<Verified & {
+    readonly key: PublicKey;
+}, JoseError.JoseError, Jwks | Signature.Signature>;
+//# sourceMappingURL=Jws.d.ts.map

package/dist/jose/Jws.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Jws.d.ts","sourceRoot":"","sources":["../../src/jose/Jws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,GAAG,MAAM,kBAAkB,CAAA;AACvC,OAAO,KAAK,SAAS,MAAM,wBAAwB,CAAA;AACnD,OAAO,KAAK,MAAM,MAAM,cAAc,CAAA;AAEtC,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAA;AAC1C,OAAO,KAAK,MAAM,MAAM,cAAc,CAAA;AAYtC,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAEL,mBAAmB,EACnB,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,eAAe,EACrB,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;mGAQ3B,CAAA;AAED;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,eAAe,CAAC,IAAI,CAAA;AAEzD;;;;;;;;GAQG;AACH,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,KAAK,CAAA;IACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAA;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,KAAK,CAAA;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAClC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAA;IACzC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAA;CAC7B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACtC;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAA;CACxD;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,GAAG,SAAS,CAAC,SAAS,CAAA;AAExD;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,UAAU,GAAG,eAAe,IAAI,CAAC,SAAS,SAAS,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC,GAAG,GAC9G,SAAS,CAAC,SAAS,CAAA;AAyDvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,IAAI,EAAE,CACjB,CAAC,SAAS,UAAU,EACpB,CAAC,SAAS,MAAM,GAAG;IAAE,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,SAAS;CAAE,GAAG,MAAM,EAEhF,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,CAAC,EACN,MAAM,CAAC,EAAE,MAAM,GAAG,CAAC,KAChB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC,CAiB5E,CAAA;AAET;;;;;;;;;;GAUG;AACH,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,SAAS,eAAe,EAC7C,KAAK,EAAE,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EACzC,GAAG,EAAE,CAAC,KACH,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC,CAY3D,CAAA;AAET;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,gBAAgB;kBAGkB,SAAS;mDAStD,CAAA"}

package/dist/jose/Jws.js

@@ -0,0 +1,183 @@
+/**
+ * Compact JSON Web Signatures.
+ *
+ * The signing algorithm is the key's: {@link sign} writes it into the
+ * protected header and {@link verify} rejects a token whose `alg` differs.
+ * {@link verifyWithKeySet} resolves the key from the `Jwks` service and
+ * requires an allowlist of asymmetric algorithms. Headers with `crit` or `b64`
+ * are rejected.
+ *
+ * Bound untrusted token length before verification; this module does not
+ * impose a token-size limit.
+ *
+ * HMAC signatures run on the `Mac` service. On Node.js and Bun,
+ * `NodeCrypto.layerMac` and `BunCrypto.layerMac` compute them synchronously
+ * with `node:crypto` instead of through Web Crypto for byte-backed keys, such
+ * as those from `Jwk.importSecret`.
+ *
+ * @stability unstable
+ * @since 4.1.1
+ */
+import * as Mac from "../crypto/Mac.js";
+import * as Signature from "../crypto/Signature.js";
+import * as Effect from "../Effect.js";
+import * as Base64Url from "../encoding/Base64Url.js";
+import * as Redacted from "../Redacted.js";
+import * as Schema from "../Schema.js";
+import { cryptoFailure, decodeHeader, decodeSegment, encodeHeader, fail, invalidArgument, invalidToken, split, utf8 } from "./internal/compact.js";
+import * as JoseError from "./JoseError.js";
+import { Algorithm, AsymmetricAlgorithm } from "./Jwk.js";
+import { Jwks } from "./Jwks.js";
+/**
+ * Schema for an authenticated JWS protected header, including additional
+ * JSON-valued parameters.
+ *
+ * @stability unstable
+ * @category schemas
+ * @since 4.1.1
+ */
+export const ProtectedHeader = /*#__PURE__*/Schema.StructWithRest(/*#__PURE__*/Schema.Struct({
+  alg: Algorithm,
+  kid: /*#__PURE__*/Schema.optionalKey(Schema.String),
+  typ: /*#__PURE__*/Schema.optionalKey(Schema.String),
+  cty: /*#__PURE__*/Schema.optionalKey(Schema.String)
+}), [/*#__PURE__*/Schema.Record(Schema.String, Schema.Json)]);
+const decodeProtectedHeader = /*#__PURE__*/Schema.decodeUnknownOption(ProtectedHeader);
+/**
+ * Parses a compact JWS without verifying it.
+ *
+ * @internal
+ */
+export const parse = /*#__PURE__*/Effect.fnUntraced(function* (token) {
+  const [header, payload, signature] = yield* split(token, 3);
+  const protectedHeader = yield* decodeHeader(header, decodeProtectedHeader, ["crit", "b64"]);
+  const payloadBytes = decodeSegment(payload);
+  const signatureBytes = decodeSegment(signature);
+  if (payloadBytes === undefined || signatureBytes === undefined) {
+    return yield* invalidToken("The payload or signature is not base64url");
+  }
+  return {
+    protectedHeader,
+    payload: payloadBytes,
+    signature: signatureBytes,
+    signingInput: utf8(`${header}.${payload}`)
+  };
+});
+const signFailure = /*#__PURE__*/cryptoFailure("Could not sign with the key");
+const verifyFailure = /*#__PURE__*/cryptoFailure("Could not verify with the key");
+const isAsymmetricAlgorithm = /*#__PURE__*/Schema.is(AsymmetricAlgorithm);
+const algorithmNotAllowed = /*#__PURE__*/fail(/*#__PURE__*/new JoseError.AlgorithmNotAllowed());
+const authenticated = (parsed, valid) => valid ? Effect.succeed({
+  protectedHeader: parsed.protectedHeader,
+  payload: parsed.payload
+}) : fail(new JoseError.SignatureVerificationFailed());
+const verifySignature = /*#__PURE__*/Effect.fnUntraced(function* (parsed, key) {
+  const signature = yield* Signature.Signature;
+  const valid = yield* signature.verify(key.key, parsed.signature, parsed.signingInput).pipe(Effect.mapError(verifyFailure));
+  return yield* authenticated(parsed, valid);
+});
+/**
+ * Signs a payload as a compact JWS with the key's algorithm.
+ *
+ * **Example** (Signing and verifying a payload)
+ *
+ * ```ts import.meta.vitest
+ * import { Effect, Layer, Redacted } from "effect"
+ * import { Mac, SecureRandom, Signature } from "effect/crypto"
+ * import { Jwk, Jws } from "effect/jose"
+ *
+ * const layer = Layer.mergeAll(Mac.layerWebCrypto, Signature.layerWebCrypto).pipe(
+ *   Layer.provide(SecureRandom.layerWebCrypto)
+ * )
+ *
+ * const payload = await Effect.runPromise(Effect.gen(function*() {
+ *   // Fixed public example material; generate application secrets securely.
+ *   const key = yield* Jwk.importSecret(
+ *     Redacted.make({ kty: "oct", k: "BwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwc" } as const),
+ *     "HS256"
+ *   )
+ *   const token = yield* Jws.sign(new TextEncoder().encode("hello"), key)
+ *   const verified = yield* Jws.verify(token, key)
+ *   return new TextDecoder().decode(verified.payload)
+ * }).pipe(Effect.provide(layer)))
+ * payload // => "hello"
+ * ```
+ *
+ * @see {@link verify}
+ *
+ * @stability unstable
+ * @category cryptography
+ * @since 4.1.1
+ */
+export const sign = /*#__PURE__*/Effect.fnUntraced(function* (payload, key, header) {
+  const protectedHeader = yield* encodeHeader({
+    alg: key.algorithm
+  }, key.kid, header, ["crit", "b64"]);
+  const signingInput = `${protectedHeader}.${Base64Url.encode(payload)}`;
+  const data = utf8(signingInput);
+  let signature;
+  if (key._tag === "SecretKey") {
+    const mac = yield* Mac.Mac;
+    signature = yield* mac.sign(key.key, data).pipe(Effect.mapError(signFailure));
+  } else {
+    const signer = yield* Signature.Signature;
+    signature = yield* signer.sign(key.key, data).pipe(Effect.mapError(signFailure));
+  }
+  return Redacted.make(`${signingInput}.${Base64Url.encode(signature)}`);
+}); // Each branch uses only the service its key type requires.
+/**
+ * Verifies a compact JWS with a key. The token's `alg` must be the key's
+ * algorithm.
+ *
+ * @see {@link sign}
+ * @see {@link verifyWithKeySet} for resolving the key from the `Jwks` service
+ *
+ * @stability unstable
+ * @category cryptography
+ * @since 4.1.1
+ */
+export const verify = /*#__PURE__*/Effect.fnUntraced(function* (token, key) {
+  const parsed = yield* parse(token);
+  if (parsed.protectedHeader.alg !== key.algorithm) return yield* algorithmNotAllowed;
+  if (key._tag === "PublicKey") return yield* verifySignature(parsed, key);
+  const mac = yield* Mac.Mac;
+  const valid = yield* mac.verify(key.key, parsed.signature, parsed.signingInput).pipe(Effect.mapError(verifyFailure));
+  return yield* authenticated(parsed, valid);
+}); // Each branch uses only the service its key type requires.
+/**
+ * Verifies a compact JWS with a public key resolved from the `Jwks` service by
+ * the token's `alg` and `kid`.
+ *
+ * **Details**
+ *
+ * The token's `alg` must be in `algorithms`, which is checked before any key
+ * lookup. The resolved key's algorithm must match the token's. HMAC tokens
+ * are always rejected.
+ *
+ * @see {@link verify} for verifying with a known key
+ *
+ * @stability unstable
+ * @category cryptography
+ * @since 4.1.1
+ */
+export const verifyWithKeySet = /*#__PURE__*/Effect.fnUntraced(function* (token, options) {
+  if (options.algorithms.length === 0) return yield* invalidArgument("algorithms must not be empty");
+  const parsed = yield* parse(token);
+  const {
+    alg,
+    kid
+  } = parsed.protectedHeader;
+  if (!isAsymmetricAlgorithm(alg) || !options.algorithms.includes(alg)) return yield* algorithmNotAllowed;
+  const jwks = yield* Jwks;
+  const key = yield* jwks.resolve({
+    algorithm: alg,
+    kid,
+    protectedHeader: parsed.protectedHeader
+  });
+  if (key.algorithm !== alg) return yield* algorithmNotAllowed;
+  return {
+    ...(yield* verifySignature(parsed, key)),
+    key
+  };
+});
+//# sourceMappingURL=Jws.js.map

package/dist/jose/Jws.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Jws.js","names":[],"sources":["../../src/jose/Jws.ts"],"sourcesContent":[null],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;AAoBA,OAAO,KAAK,GAAG,MAAM,kBAAkB;AACvC,OAAO,KAAK,SAAS,MAAM,wBAAwB;AACnD,OAAO,KAAK,MAAM,MAAM,cAAc;AACtC,OAAO,KAAK,SAAS,MAAM,0BAA0B;AACrD,OAAO,KAAK,QAAQ,MAAM,gBAAgB;AAC1C,OAAO,KAAK,MAAM,MAAM,cAAc;AACtC,SACE,aAAa,EACb,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,IAAI,EACJ,eAAe,EACf,YAAY,EACZ,KAAK,EACL,IAAI,QACC,uBAAuB;AAC9B,OAAO,KAAK,SAAS,MAAM,gBAAgB;AAC3C,SACE,SAAS,EACT,mBAAmB,QAMd,UAAU;AACjB,SAAS,IAAI,QAAQ,WAAW;AAEhC;;;;;;;;AAQA,OAAO,MAAM,eAAe,gBAAG,MAAM,CAAC,cAAc,cAClD,MAAM,CAAC,MAAM,CAAC;EACZ,GAAG,EAAE,SAAS;EACd,GAAG,eAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;EACtC,GAAG,eAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;EACtC,GAAG,eAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM;CACtC,CAAC,EACF,cAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAC5C;AA4ED,MAAM,qBAAqB,gBAAG,MAAM,CAAC,mBAAmB,CAAC,eAAe,CAAC;AASzE;;;;;AAKA,OAAO,MAAM,KAAK,gBAAG,MAAM,CAAC,UAAU,CAAC,WACrC,KAAyC;EAEzC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;EAC3D,MAAM,eAAe,GAAG,OAAO,YAAY,CAAC,MAAM,EAAE,qBAAqB,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;EAC3F,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC;EAC3C,MAAM,cAAc,GAAG,aAAa,CAAC,SAAS,CAAC;EAC/C,IAAI,YAAY,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS,EAAE;IAC9D,OAAO,OAAO,YAAY,CAAC,2CAA2C,CAAC;EACzE;EACA,OAAO;IACL,eAAe;IACf,OAAO,EAAE,YAAY;IACrB,SAAS,EAAE,cAAc;IACzB,YAAY,EAAE,IAAI,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE;GAC1C;AACH,CAAC,CAAC;AAEF,MAAM,WAAW,gBAAG,aAAa,CAAC,6BAA6B,CAAC;AAChE,MAAM,aAAa,gBAAG,aAAa,CAAC,+BAA+B,CAAC;AAEpE,MAAM,qBAAqB,gBAAG,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC;AAE5D,MAAM,mBAAmB,gBAAG,IAAI,cAAC,IAAI,SAAS,CAAC,mBAAmB,EAAE,CAAC;AAErE,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,KAAc,KACnD,KAAK,GACD,MAAM,CAAC,OAAO,CAAC;EAAE,eAAe,EAAE,MAAM,CAAC,eAAe;EAAE,OAAO,EAAE,MAAM,CAAC;AAAO,CAAE,CAAC,GACpF,IAAI,CAAC,IAAI,SAAS,CAAC,2BAA2B,EAAE,CAAC;AAEvD,MAAM,eAAe,gBAAG,MAAM,CAAC,UAAU,CAAC,WACxC,MAAc,EACd,GAAc;EAEd,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC,SAAS;EAC5C,MAAM,KAAK,GAAG,OAAO,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CACxF,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAC/B;EACD,OAAO,OAAO,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC;AAC5C,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiCA,OAAO,MAAM,IAAI,gBAOwE,MAAM,CAAC,UAAU,CAAC,WACzG,OAAmB,EACnB,GAAe,EACf,MAAe;EAEf,MAAM,eAAe,GAAG,OAAO,YAAY,CAAC;IAAE,GAAG,EAAE,GAAG,CAAC;EAAS,CAAE,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;EACrG,MAAM,YAAY,GAAG,GAAG,eAAe,IAAI,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;EACtE,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC;EAC/B,IAAI,SAAqB;EACzB,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,EAAE;IAC5B,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,GAAG;IAC1B,SAAS,GAAG,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;EAC/E,CAAC,MAAM;IACL,MAAM,MAAM,GAAG,OAAO,SAAS,CAAC,SAAS;IACzC,SAAS,GAAG,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;EAClF;EACA,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,IAAI,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;AACxE,CAAC,CAAQ,EAAC;AAEV;;;;;;;;;;;AAWA,OAAO,MAAM,MAAM,gBAGqD,MAAM,CAAC,UAAU,CAAC,WACxF,KAAyC,EACzC,GAAoB;EAEpB,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,KAAK,CAAC;EAClC,IAAI,MAAM,CAAC,eAAe,CAAC,GAAG,KAAK,GAAG,CAAC,SAAS,EAAE,OAAO,OAAO,mBAAmB;EACnF,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,EAAE,OAAO,OAAO,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC;EACxE,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,GAAG;EAC1B,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAClF,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAC/B;EACD,OAAO,OAAO,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC;AAC5C,CAAC,CAAQ,EAAC;AAEV;;;;;;;;;;;;;;;;AAgBA,OAAO,MAAM,gBAAgB,gBAAG,MAAM,CAAC,UAAU,CAAC,WAChD,KAAyC,EACzC,OAAgC;EAEhC,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,eAAe,CAAC,8BAA8B,CAAC;EAClG,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,KAAK,CAAC;EAClC,MAAM;IAAE,GAAG;IAAE;EAAG,CAAE,GAAG,MAAM,CAAC,eAAe;EAC3C,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,OAAO,mBAAmB;EACvG,MAAM,IAAI,GAAG,OAAO,IAAI;EACxB,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC;IAAE,SAAS,EAAE,GAAG;IAAE,GAAG;IAAE,eAAe,EAAE,MAAM,CAAC;EAAe,CAAE,CAAC;EACjG,IAAI,GAAG,CAAC,SAAS,KAAK,GAAG,EAAE,OAAO,OAAO,mBAAmB;EAC5D,OAAO;IAAE,IAAI,OAAO,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAAE;EAAG,CAAE;AAC1D,CAAC,CAAC","ignoreList":[]}

package/dist/jose/Jwt.d.ts

@@ -0,0 +1,270 @@
+import type * as Aead from "../crypto/Aead.ts";
+import type * as SecureRandom from "../crypto/SecureRandom.ts";
+import type * as Signature from "../crypto/Signature.ts";
+import type * as Duration from "../Duration.ts";
+import * as Effect from "../Effect.ts";
+import type * as Redacted from "../Redacted.ts";
+import * as Schema from "../Schema.ts";
+import * as JoseError from "./JoseError.ts";
+import * as Jwe from "./Jwe.ts";
+import type { PublicKey, SecretKey, SigningKey, VerificationKey } from "./Jwk.ts";
+import type { Jwks } from "./Jwks.ts";
+import * as Jws from "./Jws.ts";
+/**
+ * Schema for the registered claims: string `iss`, `sub`, and `jti`, a string
+ * or string array `aud`, and finite NumericDate `exp`, `nbf`, and `iat`.
+ *
+ * @stability unstable
+ * @category schemas
+ * @since 4.1.1
+ */
+export declare const RegisteredClaims: Schema.Struct<{
+    readonly iss: Schema.optionalKey<Schema.String>;
+    readonly sub: Schema.optionalKey<Schema.String>;
+    readonly aud: Schema.optionalKey<Schema.Union<readonly [Schema.String, Schema.$Array<Schema.String>]>>;
+    readonly exp: Schema.optionalKey<Schema.Finite>;
+    readonly nbf: Schema.optionalKey<Schema.Finite>;
+    readonly iat: Schema.optionalKey<Schema.Finite>;
+    readonly jti: Schema.optionalKey<Schema.String>;
+}>;
+/**
+ * The registered claims of a JWT.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.1.1
+ */
+export type RegisteredClaims = typeof RegisteredClaims.Type;
+/**
+ * The claim validation policy for a signed or encrypted JWT.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.1.1
+ */
+export interface VerifyOptions {
+    /**
+     * Accepted `iss` values.
+     */
+    readonly issuer?: string | ReadonlyArray<string> | undefined;
+    /**
+     * Accepted audiences. The token's `aud` must contain at least one.
+     */
+    readonly audience?: string | ReadonlyArray<string> | undefined;
+    readonly subject?: string | undefined;
+    /**
+     * Expected `typ` header. Media types compare case-insensitively and without
+     * the `application/` prefix.
+     */
+    readonly typ?: string | undefined;
+    /**
+     * Tolerance for `exp`, `nbf`, and `iat`. Defaults to zero; numbers are
+     * milliseconds.
+     */
+    readonly clockTolerance?: Duration.Input | undefined;
+    /**
+     * Maximum age measured from `iat`, which becomes required. Numbers are
+     * milliseconds.
+     */
+    readonly maxTokenAge?: Duration.Input | undefined;
+    readonly requiredClaims?: ReadonlyArray<keyof RegisteredClaims> | undefined;
+}
+/**
+ * Options for {@link verifyWithKeySet}: the verification policy and the
+ * accepted algorithms.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.1.1
+ */
+export interface VerifyWithKeySetOptions extends VerifyOptions, Jws.VerifyWithKeySetOptions {
+}
+/**
+ * A verified JWT: decoded application claims, its registered claims, and the
+ * authenticated protected header.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.1.1
+ */
+export interface Verified<A, H = Jws.ProtectedHeader> {
+    readonly claims: A;
+    readonly registeredClaims: RegisteredClaims;
+    readonly protectedHeader: H;
+}
+/**
+ * A decrypted and validated JWT, with its protected header and decryption key.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.1.1
+ */
+export interface Decrypted<A> extends Verified<A, Jwe.ProtectedHeader> {
+    readonly key: SecretKey<"dir">;
+}
+/**
+ * The protected header and claims of a signed JWT that has not been verified.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.1.1
+ */
+export interface Unverified {
+    readonly protectedHeader: Jws.ProtectedHeader;
+    readonly claims: Readonly<Record<string, Schema.Json>>;
+}
+/**
+ * Failures of JWT operations: JOSE failures, and schema failures while
+ * encoding or decoding the application claims.
+ *
+ * @stability unstable
+ * @category errors
+ * @since 4.1.1
+ */
+export type JwtError = JoseError.JoseError | Schema.SchemaError;
+/**
+ * Encodes claims with a schema and signs them as a compact JWT.
+ *
+ * **Details**
+ *
+ * The encoded claims must be a JSON object whose registered claims match
+ * {@link RegisteredClaims}.
+ *
+ * @see {@link verify}
+ * @see {@link encrypt} for encrypted JWTs
+ *
+ * @stability unstable
+ * @category cryptography
+ * @since 4.1.1
+ */
+export declare const sign: <S extends Schema.Constraint, K extends SigningKey, H extends object & { readonly [P in keyof H]: Schema.Json | undefined; } = Jws.Header>(schema: S, claims: S["Type"], key: K, header?: Jws.Header & H) => Effect.Effect<Redacted.Redacted<string>, JwtError, S["EncodingServices"] | Jws.KeyRequirements<K>>;
+/**
+ * Verifies a compact JWT with a key, checks its claims against the policy, and
+ * decodes the claims with a schema.
+ *
+ * **Example** (Verifying a token)
+ *
+ * ```ts import.meta.vitest
+ * import { Effect, Layer, Redacted, Schema } from "effect"
+ * import { Mac, SecureRandom, Signature } from "effect/crypto"
+ * import { Jwk, Jwt } from "effect/jose"
+ *
+ * const layer = Layer.mergeAll(Mac.layerWebCrypto, Signature.layerWebCrypto).pipe(
+ *   Layer.provide(SecureRandom.layerWebCrypto)
+ * )
+ *
+ * const Claims = Schema.Struct({ sub: Schema.String, iss: Schema.String })
+ *
+ * const claims = await Effect.runPromise(Effect.gen(function*() {
+ *   // Fixed public example material; generate application secrets securely.
+ *   const key = yield* Jwk.importSecret(
+ *     Redacted.make({ kty: "oct", k: "BwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwc" } as const),
+ *     "HS256"
+ *   )
+ *   const token = yield* Jwt.sign(Claims, { sub: "user-123", iss: "example" }, key)
+ *   const verified = yield* Jwt.verify(Claims, token, key, { issuer: "example", requiredClaims: ["sub"] })
+ *   return verified.claims
+ * }).pipe(Effect.provide(layer)))
+ * claims // => ({ sub: "user-123", iss: "example" })
+ * ```
+ *
+ * @see {@link verifyWithKeySet} for resolving the key from the `Jwks` service
+ * @see {@link decrypt} for encrypted JWTs
+ *
+ * @stability unstable
+ * @category cryptography
+ * @since 4.1.1
+ */
+export declare const verify: <S extends Schema.Constraint, K extends VerificationKey>(schema: S, token: string | Redacted.Redacted<string>, key: K, options?: VerifyOptions) => Effect.Effect<Verified<S["Type"]>, JwtError, S["DecodingServices"] | Jws.KeyRequirements<K>>;
+/**
+ * Verifies a compact JWT with a public key resolved from the `Jwks` service,
+ * checks its claims against the policy, and decodes the claims with a schema.
+ *
+ * @see {@link verify} for verifying with a known key
+ *
+ * @stability unstable
+ * @category cryptography
+ * @since 4.1.1
+ */
+export declare const verifyWithKeySet: <S extends Schema.Constraint>(schema: S, token: string | Redacted.Redacted<string>, options: VerifyWithKeySetOptions) => Effect.Effect<Verified<S["Type"]> & {
+    readonly key: PublicKey;
+}, JwtError, S["DecodingServices"] | Jwks | Signature.Signature>;
+/**
+ * Encodes claims with a schema and encrypts them as a compact `dir`/A256GCM
+ * JWT.
+ *
+ * **Details**
+ *
+ * The encoded claims must be a JSON object whose registered claims match
+ * {@link RegisteredClaims}.
+ *
+ * **Example** (Encrypting and validating application claims)
+ *
+ * ```ts import.meta.vitest
+ * import { Effect, Layer, Redacted, Schema } from "effect"
+ * import { Aead, SecureRandom } from "effect/crypto"
+ * import { Jwk, Jwt } from "effect/jose"
+ *
+ * const layer = Aead.layerWebCrypto.pipe(Layer.provideMerge(SecureRandom.layerWebCrypto))
+ * const Claims = Schema.Struct({ sub: Schema.String })
+ *
+ * const claims = await Effect.runPromise(Effect.gen(function*() {
+ *   // Fixed public example material; generate application secrets securely.
+ *   const key = yield* Jwk.importSecret(
+ *     Redacted.make({ kty: "oct", k: "BwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwc" } as const),
+ *     "dir"
+ *   )
+ *   const token = yield* Jwt.encrypt(Claims, { sub: "user-123" }, key, { typ: "session+jwt" })
+ *   const decrypted = yield* Jwt.decrypt(Claims, token, key, { typ: "session+jwt" })
+ *   return decrypted.claims
+ * }).pipe(Effect.provide(layer)))
+ * claims // => ({ sub: "user-123" })
+ * ```
+ *
+ * @see {@link decrypt}
+ * @see {@link sign} for signed JWTs
+ *
+ * @stability unstable
+ * @category cryptography
+ * @since 4.1.1
+ */
+export declare const encrypt: <S extends Schema.Constraint, H extends object & { readonly [P in keyof H]: Schema.Json | undefined; } = Jwe.Header>(schema: S, claims: S["Type"], key: SecretKey<"dir">, header?: Jwe.Header & H) => Effect.Effect<Redacted.Redacted<string>, JwtError, S["EncodingServices"] | Aead.Aead | SecureRandom.SecureRandom>;
+/**
+ * Decrypts a compact `dir`/A256GCM JWT, checks its claims against the policy,
+ * and decodes the claims with a schema.
+ *
+ * **Details**
+ *
+ * Accepts a key or an effectful resolver for key rotation. The same claim
+ * policy as {@link verify} is applied after authenticated decryption and
+ * before the application schema is decoded.
+ *
+ * **Gotchas**
+ *
+ * The resolver receives an unauthenticated header and must use it only for
+ * key selection.
+ *
+ * @see {@link encrypt}
+ * @see {@link verify} for signed JWTs
+ *
+ * @stability unstable
+ * @category cryptography
+ * @since 4.1.1
+ */
+export declare const decrypt: <S extends Schema.Constraint, E = never, R = never>(schema: S, token: string | Redacted.Redacted<string>, key: SecretKey<"dir"> | ((header: Jwe.ProtectedHeader) => Effect.Effect<SecretKey<"dir">, E, R>), options?: VerifyOptions | undefined) => Effect.Effect<Decrypted<S["Type"]>, E | JwtError, R | Aead.Aead | S["DecodingServices"]>;
+/**
+ * Reads the protected header and claims of a signed JWT without verifying it.
+ *
+ * **Gotchas**
+ *
+ * Nothing returned here is authenticated. Use it only to choose how to
+ * verify, never to authorize.
+ *
+ * @see {@link verify}
+ *
+ * @stability unstable
+ * @category decoding
+ * @since 4.1.1
+ */
+export declare const decodeUnverified: (token: string | Redacted.Redacted<string>) => Effect.Effect<Unverified, JoseError.JoseError, never>;
+//# sourceMappingURL=Jwt.d.ts.map

package/dist/jose/Jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Jwt.d.ts","sourceRoot":"","sources":["../../src/jose/Jwt.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,KAAK,IAAI,MAAM,mBAAmB,CAAA;AAC9C,OAAO,KAAK,KAAK,YAAY,MAAM,2BAA2B,CAAA;AAC9D,OAAO,KAAK,KAAK,SAAS,MAAM,wBAAwB,CAAA;AACxD,OAAO,KAAK,KAAK,QAAQ,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,MAAM,MAAM,cAAc,CAAA;AACtC,OAAO,KAAK,KAAK,QAAQ,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,MAAM,MAAM,cAAc,CAAA;AAEtC,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAC3C,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AACjF,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA;AAE/B;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;EAQ3B,CAAA;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,gBAAgB,CAAC,IAAI,CAAA;AAE3D;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IAC5D;;OAEG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IAC9D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACrC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAA;IACpD;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAA;IACjD,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,gBAAgB,CAAC,GAAG,SAAS,CAAA;CAC5E;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAwB,SAAQ,aAAa,EAAE,GAAG,CAAC,uBAAuB;CAAG;AAE9F;;;;;;;GAOG;AACH,MAAM,WAAW,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,eAAe;IAClD,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IAClB,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAA;IAC3C,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAA;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,SAAS,CAAC,CAAC,CAAE,SAAQ,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,eAAe,CAAC;IACpE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,CAAA;CAC/B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC,eAAe,CAAA;IAC7C,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;CACvD;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,GAAG,MAAM,CAAC,WAAW,CAAA;AAuH/D;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,IAAI,GACf,CAAC,SAAS,MAAM,CAAC,UAAU,EAC3B,CAAC,SAAS,UAAU,EACpB,CAAC,SAAS,MAAM,GAAG,EAAE,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,SAAS,GAAE,GAAG,GAAG,CAAC,MAAM,UAE5E,CAAC,UACD,CAAC,CAAC,MAAM,CAAC,OACZ,CAAC,WACG,GAAG,CAAC,MAAM,GAAG,CAAC,KACtB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CACT,CAAA;AAE3F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,SAAS,MAAM,CAAC,UAAU,EAAE,CAAC,SAAS,eAAe,EAC1E,MAAM,EAAE,CAAC,EACT,KAAK,EAAE,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EACzC,GAAG,EAAE,CAAC,EACN,OAAO,CAAC,EAAE,aAAa,KACpB,MAAM,CAAC,MAAM,CAChB,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EACnB,QAAQ,EACR,CAAC,CAAC,kBAAkB,CAAC,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAU9C,CAAA;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,SAAS,MAAM,CAAC,UAAU,EACzD,MAAM,EAAE,CAAC,EACT,KAAK,EAAE,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EACzC,OAAO,EAAE,uBAAuB,KAC7B,MAAM,CAAC,MAAM,CAChB,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;CAAE,EACjD,QAAQ,EACR,CAAC,CAAC,kBAAkB,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC,SAAS,CAgBlD,CAAA;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,eAAO,MAAM,OAAO,GAClB,CAAC,SAAS,MAAM,CAAC,UAAU,EAC3B,CAAC,SAAS,MAAM,GAAG,EAAE,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,SAAS,GAAE,GAAG,GAAG,CAAC,MAAM,UAE5E,CAAC,UACD,CAAC,CAAC,MAAM,CAAC,OACZ,SAAS,CAAC,KAAK,CAAC,WACZ,GAAG,CAAC,MAAM,GAAG,CAAC,KACtB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC,YAAY,CACrB,CAAA;AAE9F;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,OAAO,GAA+B,CAAC,SAAS,MAAM,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,kGAGxD,GAAG,CAAC,eAAe,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,mIAS/F,CAAA;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gBAAgB,sGAO3B,CAAA"}