@atlasauth/nextjs 0.1.3 → 0.2.0

package/CHANGELOG.md

@@ -0,0 +1,45 @@
+# @atlasauth/nextjs changelog
+
+## 0.2.0
+
+### Added
+- **Next.js 16 `proxy.ts` support.** `atlasProxy(options)` returns `(request) => Promise<Response | null>`. It resolves to a `Response` when Atlas must act (the sign-in redirect, the cross-property handshake, or a JSON 401 for `/api/*`) and to `null` to let the rest of the proxy run. It takes the same options and makes the same decisions as `atlasMiddleware`. It uses only Web-standard APIs, so it runs on both the Node.js runtime (the Next 16 default) and the Edge runtime.
+- `withAtlasHeaders(request, response, auth?)` forwards the verified session to the app as request headers: `x-atlas-auth-status`, `x-atlas-user-id`, `x-atlas-session-id`, `x-atlas-org-id` and `x-atlas-org-role`. It works on a `NextResponse.next()` or a rewrite produced by any later step, such as next-intl, and merges with request-header overrides already set. It always drops `x-atlas-*` headers sent by the client.
+- `readAtlasHeaders(headers)` returns the forwarded session as a `ForwardedAuth` (`{ signedIn, userId, sessionId, orgId, orgRole }`). `proxyAuth(request)` returns the `AuthState` the proxy resolved for a request. `ATLAS_AUTH_HEADERS` names the header constants.
+- New types: `AtlasProxy`, `ProxyRequest`, `HeaderCarryingResponse`, `ForwardedAuth`.
+- **Locale-prefixed routes.** Route patterns accept whole-segment `:name` parameters (`/:locale/dashboard(.*)`). The new `MiddlewareConfig` fields `locales` and `defaultLocale` restrict a `:locale` segment to the listed locales and fill in a `signInUrl` such as `/:locale/sign-in` from the request. New exports: `localizeSignInUrl` and the `PatternOptions` type. `matchesPattern`, `matchesAny` and `createRouteMatcher` take an optional `PatternOptions` argument.
+- `createAtlasDecider(options)` exposes the runtime-neutral decision engine behind both `atlasMiddleware` and `atlasProxy`. It resolves to an `AtlasDecision` (`continue`, `redirect` with cookies, or `unauthorized`). New types: `AtlasDecision`, `AtlasCookie`. New constant: `UNAUTHENTICATED_BODY`.
+- A package README.
+
+### Changed
+- `atlasMiddleware` / `authMiddleware` now render the shared decision engine. Their behaviour and signature are unchanged.
+- Patterns without a `:name` segment keep their exact previous meaning.
+
+## 0.1.4
+
+### Added
+- New `@atlasauth/nextjs/server` entry with pre-bound, zero-argument `auth()` and `currentUser()`. They read the ambient request through `next/headers` and their config from `ATLAS_JWKS_URL` / `ATLAS_ISSUER` (or the `NEXT_PUBLIC_` forms). The base entry still doesn't need `next` installed.
+- `atlasClient()`: a configured `@atlasauth/backend` client built from `ATLAS_SECRET_KEY` (and `ATLAS_API_URL`, if set).
+- `configFromEnv()`, `backendConfigFromEnv()`, `buildEdgeRequest()`, and the `ServerAuth`, `CookieStoreLike` and `HeaderStoreLike` types.
+
+## 0.1.3
+
+### Added
+- `createRouteMatcher(patterns)`. It returns a predicate over a `NextRequest`, a `{ nextUrl }` / `{ url }` object, or a path string, using the same `(.*)` pattern engine as the middleware.
+
+## 0.1.2
+
+### Added
+- The middleware honours the durable signed-in hint (`__atlas_uat`, or the same-origin `__atlas_rt` cookie). A signed-in user whose short-lived `__session` has lapsed between refreshes is let through instead of being redirected to sign-in. Exported as `hasSignedInHint(request)`.
+- `authMiddleware`, an alias of `atlasMiddleware`.
+- `createCurrentUserHelper(options)` returns `currentUser(request)`. It gives a `CurrentUser` (`id`, `orgId`, `orgRole`, `email`, `name`, `firstName`, `lastName`), read from the verified session claims without a network call.
+
+## 0.1.1
+
+First release published under the `@atlasauth` scope.
+
+### Added
+- `atlasMiddleware(options)`: verifies the session JWT locally (JWKS cached in-process), protects routes by default (`publicRoutes` / `protectedRoutes`, where protected wins), returns a 401 JSON response for `/api/*`, skips static assets, and validates `redirect_url` (`safeRedirect`).
+- `createAuthHelper(options)` returns `auth(request)`, with `has(condition)` and `protect(condition)` over the full permission/role condition set shared with the other Atlas SDKs.
+- Cross-property SSO: `handshake: true` (with `publishableKey`, and optionally `fapiOrigin`) bounces a signed-out visitor through the Atlas handshake once, PKCE-bound and loop-guarded. A cross-domain return redeems the nonce and sets first-party `__session` / `__atlas_rt` cookies.
+- Exports: `resolveAuth`, `SIGNED_OUT`, `decideRoute`, `matchesPattern`, `matchesAny`, `isStaticAsset`, `DEFAULT_SIGN_IN_URL`, and the `AuthState`, `EdgeRequest`, `EdgeResponse`, `EdgeRedirect`, `EdgeCookies`, `MiddlewareConfig` and `RouteDecision` types.

package/README.md

@@ -0,0 +1,103 @@
+# @atlasauth/nextjs
+
+Atlas authentication for Next.js (App Router). It covers route protection in `middleware.ts` (Next 14/15) or `proxy.ts` (Next 16), plus `auth()` and `currentUser()` in server components and route handlers. Session tokens are verified locally against your instance's JWKS, so a warm instance makes no network call.
+
+```bash
+npm install @atlasauth/nextjs
+```
+
+`next` is an optional peer dependency (`>=13.4`, including 16).
+
+## Next.js 16: `proxy.ts`
+
+```ts
+// proxy.ts
+import { NextResponse, type NextRequest } from 'next/server';
+import { atlasProxy, withAtlasHeaders } from '@atlasauth/nextjs';
+
+const atlas = atlasProxy({
+  jwksUrl: 'https://auth.example.com/.well-known/jwks.json',
+  issuer: 'https://auth.example.com',
+  publicRoutes: ['/', '/sign-in(.*)', '/sign-up(.*)'],
+});
+
+export async function proxy(request: NextRequest) {
+  return (await atlas(request)) ?? withAtlasHeaders(request, NextResponse.next());
+}
+
+export const config = { matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'] };
+```
+
+- `atlas(request)` resolves to a `Response` when Atlas has to act (a sign-in redirect, the cross-property handshake, or a JSON 401 for `/api/*`). Otherwise it resolves to `null` and your proxy carries on.
+- `withAtlasHeaders(request, response)` forwards the verified session to your app on whatever response the rest of your proxy returns, as `x-atlas-auth-status`, `x-atlas-user-id`, `x-atlas-session-id`, `x-atlas-org-id` and `x-atlas-org-role` request headers. It merges with request-header overrides that other steps have already set, and it always drops `x-atlas-*` headers sent by the client. Read them in a server component with `readAtlasHeaders(await headers())`.
+- `proxyAuth(request)` returns the auth state the proxy already resolved, for extra checks inside `proxy.ts`.
+
+**Why `Response | null`?** In Next 16 the proxy is usually a chain (auth, then i18n, then your own logic), so Atlas returns a response only when it must and otherwise steps aside. The session is attached to the final response with `withAtlasHeaders`, and the token is verified only once.
+
+It uses only Web-standard APIs, so it runs on both the Node.js runtime (the Next 16 default) and the Edge runtime.
+
+### With next-intl
+
+```ts
+import createMiddleware from 'next-intl/middleware';
+import type { NextRequest } from 'next/server';
+import { atlasProxy, withAtlasHeaders } from '@atlasauth/nextjs';
+import { routing } from './i18n/routing';
+
+const intl = createMiddleware(routing);
+const atlas = atlasProxy({
+  jwksUrl: 'https://auth.example.com/.well-known/jwks.json',
+  issuer: 'https://auth.example.com',
+  locales: routing.locales,
+  defaultLocale: routing.defaultLocale,
+  publicRoutes: ['/', '/:locale', '/:locale/sign-in(.*)'],
+  protectedRoutes: ['/:locale/dashboard(.*)'],
+  signInUrl: '/:locale/sign-in', // /de/dashboard → /de/sign-in?redirect_url=…
+});
+
+export async function proxy(request: NextRequest) {
+  return (await atlas(request)) ?? withAtlasHeaders(request, intl(request));
+}
+```
+
+A `:locale` segment matches only the configured `locales`. Any other `:name` segment matches any single path segment.
+
+## Next.js 14/15: `middleware.ts`
+
+```ts
+import { authMiddleware } from '@atlasauth/nextjs';
+import { NextResponse, type NextRequest } from 'next/server';
+
+const middleware = authMiddleware({
+  jwksUrl: 'https://auth.example.com/.well-known/jwks.json',
+  issuer: 'https://auth.example.com',
+  publicRoutes: ['/', '/sign-in(.*)'],
+});
+
+export default function (request: NextRequest) {
+  return middleware(request, NextResponse);
+}
+```
+
+`atlasMiddleware` is the same function as `authMiddleware`.
+
+## Server components and route handlers
+
+```ts
+import { auth, currentUser } from '@atlasauth/nextjs/server';
+
+const { userId, protect } = await auth();
+const user = await currentUser(); // from the verified session claims, no network call
+```
+
+These read `ATLAS_JWKS_URL` and `ATLAS_ISSUER` (or their `NEXT_PUBLIC_` forms) from the environment.
+
+## Routing rules
+
+- Routes are protected unless they match `publicRoutes`. `protectedRoutes` wins over `publicRoutes`.
+- Patterns support a trailing `(.*)` and whole-segment `:name` parameters. They aren't regular expressions.
+- A signed-in user whose short-lived `__session` cookie has expired is let through on the durable signed-in hint, so the client can refresh it. It doesn't bounce to sign-in.
+
+## Changelog
+
+See [CHANGELOG.md](./CHANGELOG.md).

package/dist/index.d.ts

@@ -1,2 +1,3 @@
 export * from './matcher';
 export * from './middleware';
+export * from './proxy';

package/dist/index.js

@@ -16,4 +16,5 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./matcher"), exports);
 __exportStar(require("./middleware"), exports);
+__exportStar(require("./proxy"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAA0B;AAC1B,+CAA6B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAA0B;AAC1B,+CAA6B;AAC7B,0CAAwB"}

package/dist/matcher.d.ts

@@ -12,15 +12,26 @@
  * which is a loud failure rather than a silent breach.
  */
 /**
- * Patterns support one wildcard form: `(.*)` at the end, matching Next.js's own
- * matcher syntax so a developer writes one dialect rather than two.
+ * Patterns support two forms, both from Next.js's own matcher dialect so a
+ * developer writes one dialect rather than two:
+ *
+ * - `(.*)` at the end — matches the rest of the path (`/admin(.*)`).
+ * - `:name` as a whole segment — matches exactly one non-empty segment
+ *   (`/:locale/dashboard`). This is what makes locale-prefixed routing
+ *   (next-intl and friends) expressible. When {@link PatternOptions.locales} is
+ *   given, a `:locale` segment matches ONLY those values, so
+ *   `/:locale/sign-in` can't make `/admin/sign-in` public by accident.
  *
  * Deliberately NOT a general regex. A customer-authored regex in an
  * authorization path is a catastrophic-backtracking outage waiting to happen,
  * and `/admin(.*)` covers what anyone actually needs.
  */
-export declare function matchesPattern(pathname: string, pattern: string): boolean;
-export declare function matchesAny(pathname: string, patterns: readonly string[]): boolean;
+export interface PatternOptions {
+    /** The app's locales. Restricts what a `:locale` pattern segment matches. */
+    locales?: readonly string[];
+}
+export declare function matchesPattern(pathname: string, pattern: string, options?: PatternOptions): boolean;
+export declare function matchesAny(pathname: string, patterns: readonly string[], options?: PatternOptions): boolean;
 /**
  * §10.1 Clerk-parity `createRouteMatcher(patterns)` — the idiom integrators write
  * at the top of `middleware.ts` (`const isProtected = createRouteMatcher(['/dashboard(.*)'])`).
@@ -30,7 +41,7 @@ export declare function matchesAny(pathname: string, patterns: readonly string[]
  * matcher written here and the middleware's own routing agree exactly (no second
  * dialect, no customer regex in the auth path).
  */
-export declare function createRouteMatcher(patterns: readonly string[]): (input: string | {
+export declare function createRouteMatcher(patterns: readonly string[], options?: PatternOptions): (input: string | {
     nextUrl?: {
         pathname?: string;
     };
@@ -45,7 +56,23 @@ export interface MiddlewareConfig {
     signInUrl?: string;
     /** Exact origins a `redirect_url` may point at (§13.1). */
     allowedOrigins?: readonly string[];
+    /**
+     * The app's locales, for locale-prefixed routing (next-intl and similar). A
+     * `:locale` segment in `publicRoutes`/`protectedRoutes` then matches only
+     * these values, and a `signInUrl` containing `/:locale` is filled in from the
+     * request's own locale prefix.
+     */
+    locales?: readonly string[];
+    /** Locale used for a `/:locale` sign-in URL when the request carries none. When
+     *  absent, the `/:locale` segment is dropped and the i18n layer picks one. */
+    defaultLocale?: string;
 }
+/**
+ * Fill a `signInUrl` like `/:locale/sign-in` from the request path's locale
+ * prefix, so a signed-out visitor on `/de/dashboard` lands on `/de/sign-in`
+ * rather than bouncing through the i18n layer's own redirect.
+ */
+export declare function localizeSignInUrl(signInUrl: string, pathname: string, config?: Pick<MiddlewareConfig, 'locales' | 'defaultLocale'>): string;
 export declare const DEFAULT_SIGN_IN_URL = "/sign-in";
 export type RouteDecision = {
     action: 'skip';

package/dist/matcher.js

@@ -18,28 +18,51 @@ exports.matchesPattern = matchesPattern;
 exports.matchesAny = matchesAny;
 exports.createRouteMatcher = createRouteMatcher;
 exports.isStaticAsset = isStaticAsset;
+exports.localizeSignInUrl = localizeSignInUrl;
 exports.decideRoute = decideRoute;
 exports.safeRedirect = safeRedirect;
-/**
- * Patterns support one wildcard form: `(.*)` at the end, matching Next.js's own
- * matcher syntax so a developer writes one dialect rather than two.
- *
- * Deliberately NOT a general regex. A customer-authored regex in an
- * authorization path is a catastrophic-backtracking outage waiting to happen,
- * and `/admin(.*)` covers what anyone actually needs.
- */
-function matchesPattern(pathname, pattern) {
+function segmentMatches(actual, pattern, options) {
+    if (!pattern.startsWith(':'))
+        return actual === pattern;
+    if (actual === '')
+        return false;
+    if (pattern === ':locale' && options.locales)
+        return options.locales.includes(actual);
+    return true;
+}
+function matchesPattern(pathname, pattern, options = {}) {
     if (pattern === pathname)
         return true;
     const wildcard = pattern.indexOf('(.*)');
-    if (wildcard === -1)
-        return false;
     // Anything after the wildcard is meaningless — `(.*)` already matched it.
-    const prefix = pattern.slice(0, wildcard);
-    return pathname.startsWith(prefix);
+    const prefix = wildcard === -1 ? pattern : pattern.slice(0, wildcard);
+    // No `:param` segment: the original string semantics, unchanged.
+    if (!prefix.includes('/:')) {
+        return wildcard !== -1 && pathname.startsWith(prefix);
+    }
+    const want = prefix.split('/');
+    const have = pathname.split('/');
+    if (wildcard === -1) {
+        return (want.length === have.length &&
+            want.every((segment, i) => segmentMatches(have[i], segment, options)));
+    }
+    // Wildcard: every segment but the last matches whole; the last one keeps the
+    // string-prefix semantics (`/:locale/dash(.*)` matches `/en/dashboard`), and a
+    // trailing `:param` must still be present.
+    if (have.length < want.length)
+        return false;
+    const last = want.length - 1;
+    for (let i = 0; i < last; i++) {
+        if (!segmentMatches(have[i], want[i], options))
+            return false;
+    }
+    const tail = want[last];
+    return tail.startsWith(':')
+        ? segmentMatches(have[last], tail, options)
+        : have[last].startsWith(tail);
 }
-function matchesAny(pathname, patterns) {
-    return patterns.some((pattern) => matchesPattern(pathname, pattern));
+function matchesAny(pathname, patterns, options = {}) {
+    return patterns.some((pattern) => matchesPattern(pathname, pattern, options));
 }
 /**
  * §10.1 Clerk-parity `createRouteMatcher(patterns)` — the idiom integrators write
@@ -50,7 +73,7 @@ function matchesAny(pathname, patterns) {
  * matcher written here and the middleware's own routing agree exactly (no second
  * dialect, no customer regex in the auth path).
  */
-function createRouteMatcher(patterns) {
+function createRouteMatcher(patterns, options = {}) {
     return (input) => {
         let pathname;
         if (typeof input === 'string') {
@@ -61,7 +84,7 @@ function createRouteMatcher(patterns) {
             pathname =
                 input.nextUrl?.pathname ?? (input.url ? new URL(input.url, 'http://x').pathname : '');
         }
-        return matchesAny(pathname, patterns);
+        return matchesAny(pathname, patterns, options);
     };
 }
 /**
@@ -79,6 +102,20 @@ function isStaticAsset(pathname) {
     const last = pathname.split('/').pop() ?? '';
     return last.includes('.');
 }
+/**
+ * Fill a `signInUrl` like `/:locale/sign-in` from the request path's locale
+ * prefix, so a signed-out visitor on `/de/dashboard` lands on `/de/sign-in`
+ * rather than bouncing through the i18n layer's own redirect.
+ */
+function localizeSignInUrl(signInUrl, pathname, config = {}) {
+    if (!signInUrl.includes('/:locale'))
+        return signInUrl;
+    const first = pathname.split('/')[1] ?? '';
+    const locale = config.locales?.includes(first) ? first : config.defaultLocale;
+    return locale
+        ? signInUrl.replace('/:locale', `/${locale}`)
+        : signInUrl.replace('/:locale', '') || '/';
+}
 exports.DEFAULT_SIGN_IN_URL = '/sign-in';
 /**
  * Decide what to do with a request.
@@ -92,8 +129,9 @@ function decideRoute(input) {
     const config = input.config ?? {};
     if (isStaticAsset(input.pathname))
         return { action: 'skip' };
-    const explicitlyProtected = matchesAny(input.pathname, config.protectedRoutes ?? []);
-    const isPublic = !explicitlyProtected && matchesAny(input.pathname, config.publicRoutes ?? []);
+    const patternOptions = { locales: config.locales };
+    const explicitlyProtected = matchesAny(input.pathname, config.protectedRoutes ?? [], patternOptions);
+    const isPublic = !explicitlyProtected && matchesAny(input.pathname, config.publicRoutes ?? [], patternOptions);
     if (isPublic || input.signedIn)
         return { action: 'allow' };
     /**
@@ -103,7 +141,7 @@ function decideRoute(input) {
      */
     if (input.isApiRoute)
         return { action: 'unauthorized' };
-    const signInUrl = config.signInUrl ?? exports.DEFAULT_SIGN_IN_URL;
+    const signInUrl = localizeSignInUrl(config.signInUrl ?? exports.DEFAULT_SIGN_IN_URL, input.pathname, config);
     return {
         action: 'redirect',
         to: `${signInUrl}?redirect_url=${encodeURIComponent(input.pathname)}`,

package/dist/matcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"matcher.js","sourceRoot":"","sources":["../src/matcher.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAUH,wCASC;AAED,gCAEC;AAWD,gDAcC;AAWD,sCAKC;AA4BD,kCA4BC;AASD,oCAiBC;AAhJD;;;;;;;GAOG;AACH,SAAgB,cAAc,CAAC,QAAgB,EAAE,OAAe;IAC9D,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAElC,0EAA0E;IAC1E,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC1C,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED,SAAgB,UAAU,CAAC,QAAgB,EAAE,QAA2B;IACtE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,kBAAkB,CAChC,QAA2B;IAE3B,OAAO,CAAC,KAAK,EAAE,EAAE;QACf,IAAI,QAAgB,CAAC;QACrB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,oCAAoC;YACpC,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,QAAQ;gBACN,KAAK,CAAC,OAAO,EAAE,QAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACxC,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;AAEnG,SAAgB,aAAa,CAAC,QAAgB;IAC5C,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,gDAAgD;IAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAC7C,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAYY,QAAA,mBAAmB,GAAG,UAAU,CAAC;AAQ9C;;;;;;;GAOG;AACH,SAAgB,WAAW,CAAC,KAM3B;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;IAElC,IAAI,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAE7D,MAAM,mBAAmB,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;IACrF,MAAM,QAAQ,GAAG,CAAC,mBAAmB,IAAI,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IAE/F,IAAI,QAAQ,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAE3D;;;;OAIG;IACH,IAAI,KAAK,CAAC,UAAU;QAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAExD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,2BAAmB,CAAC;IAC1D,OAAO;QACL,MAAM,EAAE,UAAU;QAClB,EAAE,EAAE,GAAG,SAAS,iBAAiB,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;KACtE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,YAAY,CAC1B,WAAsC,EACtC,iBAAoC,EAAE,EACtC,QAAQ,GAAG,GAAG;IAEd,IAAI,CAAC,WAAW;QAAE,OAAO,QAAQ,CAAC;IAElC,yEAAyE;IACzE,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAClD,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,WAAW,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,OAAO,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC"}
+{"version":3,"file":"matcher.js","sourceRoot":"","sources":["../src/matcher.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AA6BH,wCAqCC;AAED,gCAMC;AAWD,gDAeC;AAWD,sCAKC;AA2BD,8CAWC;AAkBD,kCAkCC;AASD,oCAiBC;AAlND,SAAS,cAAc,CAAC,MAAc,EAAE,OAAe,EAAE,OAAuB;IAC9E,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,KAAK,OAAO,CAAC;IACxD,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,cAAc,CAC5B,QAAgB,EAChB,OAAe,EACf,UAA0B,EAAE;IAE5B,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,0EAA0E;IAC1E,MAAM,MAAM,GAAG,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAEtE,iEAAiE;IACjE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,QAAQ,KAAK,CAAC,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,OAAO,CACL,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;YAC3B,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CACvE,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,+EAA+E;IAC/E,2CAA2C;IAC3C,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,CAAC,CAAE,EAAE,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;IACjE,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAE,CAAC;IACzB,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAE,EAAE,IAAI,EAAE,OAAO,CAAC;QAC5C,CAAC,CAAC,IAAI,CAAC,IAAI,CAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED,SAAgB,UAAU,CACxB,QAAgB,EAChB,QAA2B,EAC3B,UAA0B,EAAE;IAE5B,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,kBAAkB,CAChC,QAA2B,EAC3B,UAA0B,EAAE;IAE5B,OAAO,CAAC,KAAK,EAAE,EAAE;QACf,IAAI,QAAgB,CAAC;QACrB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,oCAAoC;YACpC,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,QAAQ;gBACN,KAAK,CAAC,OAAO,EAAE,QAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;AAEnG,SAAgB,aAAa,CAAC,QAAgB;IAC5C,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,gDAAgD;IAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAC7C,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAsBD;;;;GAIG;AACH,SAAgB,iBAAiB,CAC/B,SAAiB,EACjB,QAAgB,EAChB,SAA8D,EAAE;IAEhE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC;IAC9E,OAAO,MAAM;QACX,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,MAAM,EAAE,CAAC;QAC7C,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;AAC/C,CAAC;AAEY,QAAA,mBAAmB,GAAG,UAAU,CAAC;AAQ9C;;;;;;;GAOG;AACH,SAAgB,WAAW,CAAC,KAM3B;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;IAElC,IAAI,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAE7D,MAAM,cAAc,GAAmB,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACnE,MAAM,mBAAmB,GAAG,UAAU,CACpC,KAAK,CAAC,QAAQ,EACd,MAAM,CAAC,eAAe,IAAI,EAAE,EAC5B,cAAc,CACf,CAAC;IACF,MAAM,QAAQ,GACZ,CAAC,mBAAmB,IAAI,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE,EAAE,cAAc,CAAC,CAAC;IAEhG,IAAI,QAAQ,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAE3D;;;;OAIG;IACH,IAAI,KAAK,CAAC,UAAU;QAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAExD,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,SAAS,IAAI,2BAAmB,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrG,OAAO;QACL,MAAM,EAAE,UAAU;QAClB,EAAE,EAAE,GAAG,SAAS,iBAAiB,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;KACtE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,YAAY,CAC1B,WAAsC,EACtC,iBAAoC,EAAE,EACtC,QAAQ,GAAG,GAAG;IAEd,IAAI,CAAC,WAAW;QAAE,OAAO,QAAQ,CAAC;IAElC,yEAAyE;IACzE,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAClD,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,WAAW,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,OAAO,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/middleware.d.ts

@@ -95,6 +95,48 @@ export declare function hasSignedInHint(request: EdgeRequest): boolean;
  * user needs anyway.
  */
 export declare function resolveAuth(backend: AtlasBackend, request: EdgeRequest): Promise<AuthState>;
+/** A first-party cookie Atlas wants set on the response it returns. */
+export interface AtlasCookie {
+    name: string;
+    value: string;
+    options: {
+        path?: string;
+        httpOnly?: boolean;
+        sameSite?: 'lax' | 'strict' | 'none';
+        secure?: boolean;
+        maxAge?: number;
+    };
+}
+/**
+ * What Atlas decided for one request, before it is rendered into any particular
+ * response type. `atlasMiddleware` renders it through Next's `NextResponse`
+ * helpers; `atlasProxy` renders it as a standard Web `Response`. Keeping the
+ * decision in one place means the two can never disagree about who is let in.
+ */
+export type AtlasDecision = {
+    kind: 'continue';
+    auth: AuthState;
+} | {
+    kind: 'redirect';
+    location: string;
+    cookies: AtlasCookie[];
+    auth: AuthState;
+} | {
+    kind: 'unauthorized';
+    auth: AuthState;
+};
+/**
+ * The runtime-neutral decision engine behind {@link atlasMiddleware} and
+ * `atlasProxy`. Uses only Web-standard APIs (`URL`, `fetch`, Web Crypto), so it
+ * runs unchanged on the Edge runtime and on Node.
+ */
+export declare function createAtlasDecider(options: AtlasMiddlewareOptions): (request: EdgeRequest) => Promise<AtlasDecision>;
+/** The JSON body Atlas answers an unauthenticated API request with. */
+export declare const UNAUTHENTICATED_BODY: {
+    readonly errors: readonly [{
+        readonly code: "UNAUTHENTICATED";
+    }];
+};
 export declare function atlasMiddleware(options: AtlasMiddlewareOptions): (request: EdgeRequest, response: EdgeResponse) => Promise<unknown>;
 /**
  * The `auth()` helper for server components and route handlers.

package/dist/middleware.js

@@ -1,8 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.safeRedirect = exports.authMiddleware = exports.SIGNED_OUT = void 0;
+exports.safeRedirect = exports.authMiddleware = exports.UNAUTHENTICATED_BODY = exports.SIGNED_OUT = void 0;
 exports.hasSignedInHint = hasSignedInHint;
 exports.resolveAuth = resolveAuth;
+exports.createAtlasDecider = createAtlasDecider;
 exports.atlasMiddleware = atlasMiddleware;
 exports.createAuthHelper = createAuthHelper;
 exports.createCurrentUserHelper = createCurrentUserHelper;
@@ -79,14 +80,19 @@ async function resolveAuth(backend, request) {
         claims: result.claims,
     };
 }
-function atlasMiddleware(options) {
+/**
+ * The runtime-neutral decision engine behind {@link atlasMiddleware} and
+ * `atlasProxy`. Uses only Web-standard APIs (`URL`, `fetch`, Web Crypto), so it
+ * runs unchanged on the Edge runtime and on Node.
+ */
+function createAtlasDecider(options) {
     const backend = new backend_1.AtlasBackend({
         jwksUrl: options.jwksUrl,
         issuer: options.issuer,
         authorizedParties: options.authorizedParties,
         fetchImpl: options.fetchImpl,
     });
-    return async function middleware(request, response) {
+    return async function decide(request) {
         /**
          * Cross-domain satellite RETURN: the handshake endpoint bounced the browser
          * back with `?__atlas_hs=ok&__atlas_hu=<userId>&__atlas_hn=<nonce>`. Exchange
@@ -123,17 +129,21 @@ function atlasMiddleware(options) {
                 for (const k of ['__atlas_hs', '__atlas_hu', '__atlas_hn'])
                     clean.searchParams.delete(k);
                 if (session) {
-                    const res = response.redirect(clean.toString());
-                    res.cookies?.set('__session', session.jwt, { path: '/', sameSite: 'lax', secure: true });
-                    res.cookies?.set('__atlas_rt', session.refreshToken, {
-                        path: '/',
-                        httpOnly: true,
-                        sameSite: 'lax',
-                        secure: true,
-                    });
-                    // The verifier is spent — clear it so it can't be reused or leak.
-                    res.cookies?.set('__atlas_hv', '', { path: '/', maxAge: 0 });
-                    return res;
+                    return {
+                        kind: 'redirect',
+                        location: clean.toString(),
+                        auth: exports.SIGNED_OUT,
+                        cookies: [
+                            { name: '__session', value: session.jwt, options: { path: '/', sameSite: 'lax', secure: true } },
+                            {
+                                name: '__atlas_rt',
+                                value: session.refreshToken,
+                                options: { path: '/', httpOnly: true, sameSite: 'lax', secure: true },
+                            },
+                            // The verifier is spent — clear it so it can't be reused or leak.
+                            { name: '__atlas_hv', value: '', options: { path: '/', maxAge: 0 } },
+                        ],
+                    };
                 }
                 // A bad/expired/replayed nonce, a rejected PKCE proof, or no verifier →
                 // no session. Carry a SPENT marker (__atlas_hs=failed) instead of a clean
@@ -141,9 +151,12 @@ function atlasMiddleware(options) {
                 // URL here would bounce straight back to the handshake forever. With the
                 // marker, normal routing takes over and sends the user to sign-in.
                 clean.searchParams.set('__atlas_hs', 'failed');
-                const res = response.redirect(clean.toString());
-                res.cookies?.set('__atlas_hv', '', { path: '/', maxAge: 0 });
-                return res;
+                return {
+                    kind: 'redirect',
+                    location: clean.toString(),
+                    auth: exports.SIGNED_OUT,
+                    cookies: [{ name: '__atlas_hv', value: '', options: { path: '/', maxAge: 0 } }],
+                };
             }
         }
         const auth = await resolveAuth(backend, request);
@@ -156,9 +169,9 @@ function atlasMiddleware(options) {
         switch (decision.action) {
             case 'skip':
             case 'allow':
-                return response.next();
+                return { kind: 'continue', auth };
             case 'unauthorized':
-                return response.json({ errors: [{ code: 'UNAUTHENTICATED' }] }, { status: 401 });
+                return { kind: 'unauthorized', auth };
             case 'redirect': {
                 /**
                  * §R3.1 FIRST, don't bounce a user who is actually signed in here but
@@ -171,7 +184,7 @@ function atlasMiddleware(options) {
                  * common "same-property, token just expired" case never leaves the app.
                  */
                 if (hasSignedInHint(request))
-                    return response.next();
+                    return { kind: 'continue', auth };
                 /**
                  * Cross-property handshake: before sending a signed-out user to the
                  * sign-in page, try the Atlas handshake ONCE — they may already have a
@@ -193,15 +206,24 @@ function atlasMiddleware(options) {
                         hs.searchParams.set('publishable_key', options.publishableKey);
                         hs.searchParams.set('redirect_url', current.toString());
                         hs.searchParams.set('code_challenge', challenge);
-                        const res = response.redirect(hs.toString());
-                        res.cookies?.set('__atlas_hv', verifier, {
-                            path: '/',
-                            httpOnly: true,
-                            sameSite: 'lax',
-                            secure: true,
-                            maxAge: 300, // the handshake round trip is seconds; don't linger
-                        });
-                        return res;
+                        return {
+                            kind: 'redirect',
+                            location: hs.toString(),
+                            auth,
+                            cookies: [
+                                {
+                                    name: '__atlas_hv',
+                                    value: verifier,
+                                    options: {
+                                        path: '/',
+                                        httpOnly: true,
+                                        sameSite: 'lax',
+                                        secure: true,
+                                        maxAge: 300, // the handshake round trip is seconds; don't linger
+                                    },
+                                },
+                            ],
+                        };
                     }
                 }
                 /**
@@ -211,7 +233,28 @@ function atlasMiddleware(options) {
                  * would otherwise be carried forward unchecked (§13.1).
                  */
                 const base = request.url ? new URL(request.url).origin : '';
-                return response.redirect(`${base}${decision.to}`);
+                return { kind: 'redirect', location: `${base}${decision.to}`, auth, cookies: [] };
+            }
+        }
+    };
+}
+/** The JSON body Atlas answers an unauthenticated API request with. */
+exports.UNAUTHENTICATED_BODY = { errors: [{ code: 'UNAUTHENTICATED' }] };
+function atlasMiddleware(options) {
+    const decide = createAtlasDecider(options);
+    return async function middleware(request, response) {
+        const decision = await decide(request);
+        switch (decision.kind) {
+            case 'continue':
+                return response.next();
+            case 'unauthorized':
+                return response.json(exports.UNAUTHENTICATED_BODY, { status: 401 });
+            case 'redirect': {
+                const res = response.redirect(decision.location);
+                for (const cookie of decision.cookies) {
+                    res.cookies?.set(cookie.name, cookie.value, cookie.options);
+                }
+                return res;
             }
         }
     };

package/dist/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":";;;AAgHA,0CAMC;AAUD,kCAkBC;AAED,0CA+IC;AASD,4CAsCC;AA6BD,0DAqBC;AApYD,gDAS4B;AAC5B,uCAA6E;AA4XpE,6FA5Xa,sBAAY,OA4Xb;AA1TR,QAAA,UAAU,GAAc;IACnC,MAAM,EAAE,IAAI;IACZ,SAAS,EAAE,IAAI;IACf,KAAK,EAAE,IAAI;IACX,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,IAAI;CACb,CAAC;AAEF,SAAS,UAAU,CAAC,MAAqB,EAAE,IAAY;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,eAAe,CAAC,OAAoB;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC9C,IAAI,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,2EAA2E;IAC3E,OAAO,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,WAAW,CAAC,OAAqB,EAAE,OAAoB;IAC3E,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;IAEtE,MAAM,KAAK,GAAG,MAAM,IAAI,MAAM,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,kBAAU,CAAC;IAE9B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,kBAAU,CAAC;IAElC,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG;QACzB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG;QAC5B,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI;QACnC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC;AACJ,CAAC;AAED,SAAgB,eAAe,CAAC,OAA+B;IAC7D,MAAM,OAAO,GAAG,IAAI,sBAAY,CAAC;QAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;IAEH,OAAO,KAAK,UAAU,UAAU,CAAC,OAAoB,EAAE,QAAsB;QAC3E;;;;;;;;;;WAUG;QACH,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,EAAE,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACjD,IAAI,EAAE,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;gBACnC,uEAAuE;gBACvE,wEAAwE;gBACxE,uEAAuE;gBACvE,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,CAAC;gBAC7E,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;gBACzE,MAAM,OAAO,GAAG,YAAY;oBAC1B,CAAC,CAAC,MAAM,IAAA,yBAAe,EAAC;wBACpB,UAAU;wBACV,cAAc,EAAE,OAAO,CAAC,cAAc;wBACtC,MAAM;wBACN,KAAK;wBACL,YAAY;wBACZ,SAAS,EAAE,OAAO,CAAC,SAAS;qBAC7B,CAAC;oBACJ,CAAC,CAAC,IAAI,CAAC;gBAET,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACtC,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,EAAE,YAAY,CAAC;oBAAE,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAEzF,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;oBAChD,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;oBACzF,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE;wBACnD,IAAI,EAAE,GAAG;wBACT,QAAQ,EAAE,IAAI;wBACd,QAAQ,EAAE,KAAK;wBACf,MAAM,EAAE,IAAI;qBACb,CAAC,CAAC;oBACH,kEAAkE;oBAClE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;oBAC7D,OAAO,GAAG,CAAC;gBACb,CAAC;gBAED,wEAAwE;gBACxE,0EAA0E;gBAC1E,0EAA0E;gBAC1E,yEAAyE;gBACzE,mEAAmE;gBACnE,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;gBAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAChD,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC7D,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAEjD,MAAM,QAAQ,GAAG,IAAA,qBAAW,EAAC;YAC3B,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ;YAClC,QAAQ,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI;YAC9B,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;SACzD,CAAC,CAAC;QAEH,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YACxB,KAAK,MAAM,CAAC;YACZ,KAAK,OAAO;gBACV,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;YAEzB,KAAK,cAAc;gBACjB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAEnF,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB;;;;;;;;;mBASG;gBACH,IAAI,eAAe,CAAC,OAAO,CAAC;oBAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACrD;;;;;;;;mBAQG;gBACH,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;oBAC/D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBACrC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;wBAC5C,gEAAgE;wBAChE,6DAA6D;wBAC7D,iEAAiE;wBACjE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,IAAA,wBAAc,GAAE,CAAC;wBACvD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;wBACzE,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,sBAAsB,EAAE,UAAU,CAAC,CAAC;wBACvD,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;wBAC/D,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;wBACxD,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;wBACjD,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;wBAC7C,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,EAAE,QAAQ,EAAE;4BACvC,IAAI,EAAE,GAAG;4BACT,QAAQ,EAAE,IAAI;4BACd,QAAQ,EAAE,KAAK;4BACf,MAAM,EAAE,IAAI;4BACZ,MAAM,EAAE,GAAG,EAAE,oDAAoD;yBAClE,CAAC,CAAC;wBACH,OAAO,GAAG,CAAC;oBACb,CAAC;gBACH,CAAC;gBACD;;;;;mBAKG;gBACH,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,GAAG,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAAC,OAA+B;IAC9D,MAAM,OAAO,GAAG,IAAI,sBAAY,CAAC;QAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;IAEH,OAAO,KAAK,UAAU,IAAI,CAAC,OAAoB;QAiB7C,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAElD,OAAO;YACL,GAAG,KAAK;YACR,GAAG,CAAC,SAAS,GAAG,EAAE;gBAChB,OAAO,IAAA,uBAAa,EAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAChD,CAAC;YACD,OAAO,CAAC,YAA8B,EAAE;gBACtC,MAAM,OAAO,GAAG,IAAA,kBAAQ,EAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;gBAClD,IAAI,CAAC,OAAO,CAAC,OAAO;oBAAE,MAAM,IAAI,wBAAc,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC5E,CAAC;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACU,QAAA,cAAc,GAAG,eAAe,CAAC;AAe9C;;;;;GAKG;AACH,SAAgB,uBAAuB,CAAC,OAA+B;IACrE,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACvC,OAAO,KAAK,UAAU,WAAW,CAAC,OAAoB;QACpD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAChD,MAAM,CAAC,GAAG,KAAK,CAAC,MAKf,CAAC;QACF,OAAO;YACL,EAAE,EAAE,KAAK,CAAC,MAAM;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI;YACpB,SAAS,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;YAC/B,QAAQ,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;SAChC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":";;;AAgHA,0CAMC;AAUD,kCAkBC;AA+BD,gDA+JC;AAKD,0CAmBC;AASD,4CAsCC;AA6BD,0DAqBC;AAzcD,gDAS4B;AAC5B,uCAA6E;AAicpE,6FAjca,sBAAY,OAicb;AA/XR,QAAA,UAAU,GAAc;IACnC,MAAM,EAAE,IAAI;IACZ,SAAS,EAAE,IAAI;IACf,KAAK,EAAE,IAAI;IACX,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,IAAI;CACb,CAAC;AAEF,SAAS,UAAU,CAAC,MAAqB,EAAE,IAAY;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,eAAe,CAAC,OAAoB;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC9C,IAAI,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,2EAA2E;IAC3E,OAAO,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,WAAW,CAAC,OAAqB,EAAE,OAAoB;IAC3E,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;IAEtE,MAAM,KAAK,GAAG,MAAM,IAAI,MAAM,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,kBAAU,CAAC;IAE9B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,kBAAU,CAAC;IAElC,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG;QACzB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG;QAC5B,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI;QACnC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC;AACJ,CAAC;AA0BD;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,OAA+B;IAChE,MAAM,OAAO,GAAG,IAAI,sBAAY,CAAC;QAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;IAEH,OAAO,KAAK,UAAU,MAAM,CAAC,OAAoB;QAC/C;;;;;;;;;;WAUG;QACH,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,EAAE,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACjD,IAAI,EAAE,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;gBACnC,uEAAuE;gBACvE,wEAAwE;gBACxE,uEAAuE;gBACvE,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,CAAC;gBAC7E,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;gBACzE,MAAM,OAAO,GAAG,YAAY;oBAC1B,CAAC,CAAC,MAAM,IAAA,yBAAe,EAAC;wBACpB,UAAU;wBACV,cAAc,EAAE,OAAO,CAAC,cAAc;wBACtC,MAAM;wBACN,KAAK;wBACL,YAAY;wBACZ,SAAS,EAAE,OAAO,CAAC,SAAS;qBAC7B,CAAC;oBACJ,CAAC,CAAC,IAAI,CAAC;gBAET,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACtC,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,EAAE,YAAY,CAAC;oBAAE,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAEzF,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO;wBACL,IAAI,EAAE,UAAU;wBAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;wBAC1B,IAAI,EAAE,kBAAU;wBAChB,OAAO,EAAE;4BACP,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;4BAChG;gCACE,IAAI,EAAE,YAAY;gCAClB,KAAK,EAAE,OAAO,CAAC,YAAY;gCAC3B,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;6BACtE;4BACD,kEAAkE;4BAClE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE;yBACrE;qBACF,CAAC;gBACJ,CAAC;gBAED,wEAAwE;gBACxE,0EAA0E;gBAC1E,0EAA0E;gBAC1E,yEAAyE;gBACzE,mEAAmE;gBACnE,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;gBAC/C,OAAO;oBACL,IAAI,EAAE,UAAU;oBAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;oBAC1B,IAAI,EAAE,kBAAU;oBAChB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;iBAChF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAEjD,MAAM,QAAQ,GAAG,IAAA,qBAAW,EAAC;YAC3B,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ;YAClC,QAAQ,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI;YAC9B,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;SACzD,CAAC,CAAC;QAEH,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YACxB,KAAK,MAAM,CAAC;YACZ,KAAK,OAAO;gBACV,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;YAEpC,KAAK,cAAc;gBACjB,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;YAExC,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB;;;;;;;;;mBASG;gBACH,IAAI,eAAe,CAAC,OAAO,CAAC;oBAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;gBAChE;;;;;;;;mBAQG;gBACH,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;oBAC/D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBACrC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;wBAC5C,gEAAgE;wBAChE,6DAA6D;wBAC7D,iEAAiE;wBACjE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,IAAA,wBAAc,GAAE,CAAC;wBACvD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;wBACzE,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,sBAAsB,EAAE,UAAU,CAAC,CAAC;wBACvD,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;wBAC/D,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;wBACxD,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;wBACjD,OAAO;4BACL,IAAI,EAAE,UAAU;4BAChB,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE;4BACvB,IAAI;4BACJ,OAAO,EAAE;gCACP;oCACE,IAAI,EAAE,YAAY;oCAClB,KAAK,EAAE,QAAQ;oCACf,OAAO,EAAE;wCACP,IAAI,EAAE,GAAG;wCACT,QAAQ,EAAE,IAAI;wCACd,QAAQ,EAAE,KAAK;wCACf,MAAM,EAAE,IAAI;wCACZ,MAAM,EAAE,GAAG,EAAE,oDAAoD;qCAClE;iCACF;6BACF;yBACF,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD;;;;;mBAKG;gBACH,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YACpF,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,uEAAuE;AAC1D,QAAA,oBAAoB,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAW,CAAC;AAEvF,SAAgB,eAAe,CAAC,OAA+B;IAC7D,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAE3C,OAAO,KAAK,UAAU,UAAU,CAAC,OAAoB,EAAE,QAAsB;QAC3E,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;QACvC,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;YACtB,KAAK,UAAU;gBACb,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;YACzB,KAAK,cAAc;gBACjB,OAAO,QAAQ,CAAC,IAAI,CAAC,4BAAoB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9D,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACjD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACtC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC9D,CAAC;gBACD,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAAC,OAA+B;IAC9D,MAAM,OAAO,GAAG,IAAI,sBAAY,CAAC;QAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;IAEH,OAAO,KAAK,UAAU,IAAI,CAAC,OAAoB;QAiB7C,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAElD,OAAO;YACL,GAAG,KAAK;YACR,GAAG,CAAC,SAAS,GAAG,EAAE;gBAChB,OAAO,IAAA,uBAAa,EAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAChD,CAAC;YACD,OAAO,CAAC,YAA8B,EAAE;gBACtC,MAAM,OAAO,GAAG,IAAA,kBAAQ,EAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;gBAClD,IAAI,CAAC,OAAO,CAAC,OAAO;oBAAE,MAAM,IAAI,wBAAc,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC5E,CAAC;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACU,QAAA,cAAc,GAAG,eAAe,CAAC;AAe9C;;;;;GAKG;AACH,SAAgB,uBAAuB,CAAC,OAA+B;IACrE,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACvC,OAAO,KAAK,UAAU,WAAW,CAAC,OAAoB;QACpD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAChD,MAAM,CAAC,GAAG,KAAK,CAAC,MAKf,CAAC;QACF,OAAO;YACL,EAAE,EAAE,KAAK,CAAC,MAAM;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI;YACpB,SAAS,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;YAC/B,QAAQ,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;SAChC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}