@bepalo/spine 1.0.3

package/dist/auth-middlewares.d.ts

@@ -0,0 +1,119 @@
+import { type Context, type Handler } from "./types.ts";
+/**
+ * Represents an authenticated user.
+ *
+ * @template {Record<string, unknown>} ExtendAuth - Extend Auth Context
+ */
+export type Auth<ExtendAuth extends Record<string, unknown> = Record<string, never>> = {
+    /** Role assigned to the user (e.g., "admin", "user") */
+    role: string;
+} & ExtendAuth;
+/**
+ * Context extension that includes authentication information.
+ *
+ * @template {Record<string, unknown>} ExtendAuth - Extend Auth Context
+ */
+export type CTAuth<ExtendAuth extends Record<string, unknown> = Record<string, never>> = {
+    /** Authenticated user details */
+    auth?: Auth<ExtendAuth>;
+};
+/**
+ * auth context parser for authenticate middleware
+ *
+ * @template {Record<string, unknown>} ExtendAuth - Extend Auth Context
+ * @template {Record<string, unknown>} ExtendContext - Extend Router Context
+ */
+export type ParseAuthFn<ExtendAuth extends Record<string, unknown> = Record<string, never>, ExtendContext extends Record<string, unknown> = Record<string, never>> = (ctx: Context<CTAuth<ExtendAuth> & ExtendContext>) => Promise<Auth<ExtendAuth> | Response | null | undefined> | Auth<ExtendAuth> | Response | null | undefined;
+/**
+ * Middleware to authenticate a request.
+ *
+ * @template {Record<string, unknown>} ExtendAuth - Extend Auth Context
+ * @template {Record<string, unknown>} ExtendContext - Extend Router Context
+ * @param {Object} [options] - Configuration options.
+ * @param {ParseAuthFn}[options.parseAuth] - Function to extract authentication info from the request.
+ *   Should return an `Auth` object if valid, `Error` if invalid, or `null/undefined` if missing.
+ * @param {boolean} [options.breakPipeline=false] - If true, stops only pipeline flow per handler type after success.
+ * @param {boolean} [options.checkOnly=false] - If true, only checks authentication without returning a response.
+ *
+ * @returns {Handler<CTAuth<ExtendAuth> & ExtendContext>} A handler that sets `ctx.auth` if authentication succeeds,
+ *   otherwise returns a `401 Unauthorized` or with error message if available response (unless `checkOnly` is true).
+ */
+export declare const authenticate: <ExtendAuth extends Record<string, unknown> = Record<string, never>, ExtendContext extends Record<string, unknown> = Record<string, never>>({ parseAuth, breakPipeline, checkOnly, }: {
+    parseAuth: ParseAuthFn<ExtendAuth, ExtendContext>;
+    breakPipeline?: boolean;
+    checkOnly?: boolean;
+}) => Handler<CTAuth<ExtendAuth> & ExtendContext>;
+/**
+ * Middleware to authorize a request based on role or permissions.
+ *
+ * @template {Record<string, unknown>} ExtendAuth - Extend Auth Context
+ * @template {Record<string, unknown>} ExtendContext - Extend Router Context
+ * @param {Object} [options] - Configuration options.
+ * @param {(role: string) => boolean}[options.allowRole] - Function to check if a role is allowed.
+ * @param {(role: string) => boolean}[options.forbidRole] - Function to check if a role is forbidden.
+ * @param {string[]}[options.permissions] - List of permissions required for access.
+ * @param {(permission: string,role: string) => boolean|null|undefined}[options.hasPermission] - Function to check if a role has a given permission.
+ *   Required if `permissions` is provided.
+ * @param {boolean} [options.breakPipeline=false] - If true, stops only pipeline flow per handler type after success.
+ *
+ * @returns {Handler<CTAuth & ExtendContext>} A handler that checks `ctx.auth` and enforces role/permission rules.
+ *   Returns `401 Unauthorized` if no auth is present, or `403 Forbidden` if checks fail.
+ *   Throws an error if `permissions` is set without `hasPermission`.
+ *
+ */
+export declare const authorize: <ExtendAuth extends Record<string, unknown> = Record<string, never>, ExtendContext extends Record<string, unknown> = Record<string, never>>({ allowRole, forbidRole, permissions, hasPermission, breakPipeline, }: {
+    allowRole?: (role: string) => boolean;
+    forbidRole?: (role: string) => boolean;
+    permissions?: string[];
+    hasPermission?: (permission: string, role: string) => boolean | null | undefined;
+    breakPipeline?: boolean;
+}) => Handler<CTAuth<ExtendAuth> & ExtendContext>;
+/**
+ * Returns a Basic Authenticator for authenticate middleware.
+ * Supports RFC 7617 Basic Authentication scheme.
+ *
+ * @template {Record<string, unknown>} ExtendAuth - Extend Auth Context
+ * @template {Record<string, unknown>} ExtendContext - Extend Router Context
+ * @param {Object} config - Basic Authentication configuration
+ * @param {(credentials: {username:string;password:string;})=>|Promise<boolean | Response | Auth<ExtendAuth>>|boolean|Response|Auth<ExtendAuth>} config.validateCredentials - Callback to validate credentials
+ * @param {"base64"|"raw"} [config.type="base64"] - Credential encoding type
+ * @param {":"|" "} [config.separator=":"] - Separator between username and password
+ * @param {string} [config.realm="Protected"] - Authentication realm
+ * @param {prop} [config.ctxProp="basicAuth"] - Context property name for auth data
+ * @returns {Function} Middleware function that validates Basic Authentication
+ *
+ * @example
+ * // Simple username/password authentication
+ * const authProtection = authenticate({
+ *     parseAuth: basicAuthParser({
+ *       validateCredentials: ({ username, password }) => {
+ *         const passwordBuffer = new TextEncoder().encode(password);
+ *         const verifyBuffer = new TextEncoder().encode("Admin");
+ *         if (passwordBuffer.length !== verifyBuffer.length)
+ *           return !crypto.timingSafeEqual(verifyBuffer, verifyBuffer);
+ *         return crypto.timingSafeEqual(passwordBuffer, verifyBuffer);
+ *       },
+ *       // type: "base64",
+ *       // separator: ":",
+ *       realm: "Dashboard",
+ *     }),
+ *   })
+ * router.filterGet<CTAuth<{ username: string }>>("/dashboard/.**", [
+ *   authProtection,
+ * ]);
+ */
+export declare const basicAuthParser: <ExtendAuth extends {
+    username: string;
+} & Record<string, unknown> = {
+    username: string;
+}, ExtendContext extends Record<string, unknown> = Record<string, never>>({ validateCredentials, type, separator, realm, defaultRole, }: {
+    validateCredentials: (credentials: {
+        username: string;
+        password: string;
+    }) => Promise<boolean | Response | Auth<ExtendAuth>> | boolean | Response | Auth<ExtendAuth>;
+    type?: "raw" | "base64";
+    separator?: ":" | " ";
+    realm?: string;
+    defaultRole?: string;
+}) => ParseAuthFn<ExtendAuth, ExtendContext>;
+//# sourceMappingURL=auth-middlewares.d.ts.map

package/dist/auth-middlewares.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-middlewares.d.ts","sourceRoot":"","sources":["../src/auth-middlewares.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,OAAO,EACZ,KAAK,OAAO,EACb,MAAM,YAAY,CAAC;AAEpB;;;;GAIG;AACH,MAAM,MAAM,IAAI,CACd,UAAU,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAChE;IACF,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,UAAU,CAAC;AAEf;;;;GAIG;AACH,MAAM,MAAM,MAAM,CAChB,UAAU,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAChE;IACF,iCAAiC;IACjC,IAAI,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;CACzB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,WAAW,CACrB,UAAU,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EAClE,aAAa,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IACnE,CACF,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,aAAa,CAAC,KAE9C,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,IAAI,GAAG,SAAS,CAAC,GACvD,IAAI,CAAC,UAAU,CAAC,GAChB,QAAQ,GACR,IAAI,GACJ,SAAS,CAAC;AAEd;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,YAAY,GACvB,UAAU,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EAClE,aAAa,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EACrE,0CAIC;IACD,SAAS,EAAE,WAAW,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAClD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,KAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,aAAa,CAmB7C,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,SAAS,GACpB,UAAU,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EAClE,aAAa,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EACrE,uEAMC;IACD,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACtC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACvC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,aAAa,CAAC,EAAE,CACd,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,KACT,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC;IAChC,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,KAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,aAAa,CA0B7C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,eAAe,GAC1B,UAAU,SAAS;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAClE,QAAQ,EAAE,MAAM,CAAC;CAClB,EACD,aAAa,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EACrE,+DAMC;IACD,mBAAmB,EAAE,CAAC,WAAW,EAAE;QACjC,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,KACG,OAAO,CAAC,OAAO,GAAG,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,GAC9C,OAAO,GACP,QAAQ,GACR,IAAI,CAAC,UAAU,CAAC,CAAC;IACrB,IAAI,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;IACxB,SAAS,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,KAAG,WAAW,CAAC,UAAU,EAAE,aAAa,CAmCxC,CAAC"}

package/dist/auth-middlewares.js

@@ -0,0 +1,168 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.basicAuthParser = exports.authorize = exports.authenticate = void 0;
+const helpers_ts_1 = require("./helpers.js");
+const types_ts_1 = require("./types.js");
+/**
+ * Middleware to authenticate a request.
+ *
+ * @template {Record<string, unknown>} ExtendAuth - Extend Auth Context
+ * @template {Record<string, unknown>} ExtendContext - Extend Router Context
+ * @param {Object} [options] - Configuration options.
+ * @param {ParseAuthFn}[options.parseAuth] - Function to extract authentication info from the request.
+ *   Should return an `Auth` object if valid, `Error` if invalid, or `null/undefined` if missing.
+ * @param {boolean} [options.breakPipeline=false] - If true, stops only pipeline flow per handler type after success.
+ * @param {boolean} [options.checkOnly=false] - If true, only checks authentication without returning a response.
+ *
+ * @returns {Handler<CTAuth<ExtendAuth> & ExtendContext>} A handler that sets `ctx.auth` if authentication succeeds,
+ *   otherwise returns a `401 Unauthorized` or with error message if available response (unless `checkOnly` is true).
+ */
+const authenticate = ({ parseAuth, breakPipeline = false, checkOnly = false, }) => {
+    return function (ctx) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const auth = yield parseAuth(ctx);
+            if (auth == null) {
+                if (checkOnly) {
+                    return;
+                }
+                return (0, helpers_ts_1.status)(401);
+            }
+            else if (auth instanceof Response) {
+                if (checkOnly) {
+                    return;
+                }
+                return auth;
+            }
+            ctx.auth = auth;
+            if (breakPipeline) {
+                return types_ts_1.Break_Pipeline;
+            }
+        });
+    };
+};
+exports.authenticate = authenticate;
+/**
+ * Middleware to authorize a request based on role or permissions.
+ *
+ * @template {Record<string, unknown>} ExtendAuth - Extend Auth Context
+ * @template {Record<string, unknown>} ExtendContext - Extend Router Context
+ * @param {Object} [options] - Configuration options.
+ * @param {(role: string) => boolean}[options.allowRole] - Function to check if a role is allowed.
+ * @param {(role: string) => boolean}[options.forbidRole] - Function to check if a role is forbidden.
+ * @param {string[]}[options.permissions] - List of permissions required for access.
+ * @param {(permission: string,role: string) => boolean|null|undefined}[options.hasPermission] - Function to check if a role has a given permission.
+ *   Required if `permissions` is provided.
+ * @param {boolean} [options.breakPipeline=false] - If true, stops only pipeline flow per handler type after success.
+ *
+ * @returns {Handler<CTAuth & ExtendContext>} A handler that checks `ctx.auth` and enforces role/permission rules.
+ *   Returns `401 Unauthorized` if no auth is present, or `403 Forbidden` if checks fail.
+ *   Throws an error if `permissions` is set without `hasPermission`.
+ *
+ */
+const authorize = ({ allowRole, forbidRole, permissions, hasPermission, breakPipeline = false, }) => {
+    if (permissions && !hasPermission) {
+        throw new types_ts_1.RouterError("authorize middleware 'permissions' require 'hasPermission'");
+    }
+    return ({ auth }) => {
+        if (auth == null) {
+            return (0, helpers_ts_1.status)(401);
+        }
+        if (allowRole && !allowRole(auth.role)) {
+            return (0, helpers_ts_1.status)(403);
+        }
+        if (forbidRole && forbidRole(auth.role)) {
+            return (0, helpers_ts_1.status)(403);
+        }
+        if (permissions && hasPermission) {
+            const permitted = permissions.some((permission) => hasPermission(permission, auth.role));
+            if (!permitted)
+                return (0, helpers_ts_1.status)(403);
+        }
+        if (breakPipeline) {
+            return types_ts_1.Break_Pipeline;
+        }
+    };
+};
+exports.authorize = authorize;
+/**
+ * Returns a Basic Authenticator for authenticate middleware.
+ * Supports RFC 7617 Basic Authentication scheme.
+ *
+ * @template {Record<string, unknown>} ExtendAuth - Extend Auth Context
+ * @template {Record<string, unknown>} ExtendContext - Extend Router Context
+ * @param {Object} config - Basic Authentication configuration
+ * @param {(credentials: {username:string;password:string;})=>|Promise<boolean | Response | Auth<ExtendAuth>>|boolean|Response|Auth<ExtendAuth>} config.validateCredentials - Callback to validate credentials
+ * @param {"base64"|"raw"} [config.type="base64"] - Credential encoding type
+ * @param {":"|" "} [config.separator=":"] - Separator between username and password
+ * @param {string} [config.realm="Protected"] - Authentication realm
+ * @param {prop} [config.ctxProp="basicAuth"] - Context property name for auth data
+ * @returns {Function} Middleware function that validates Basic Authentication
+ *
+ * @example
+ * // Simple username/password authentication
+ * const authProtection = authenticate({
+ *     parseAuth: basicAuthParser({
+ *       validateCredentials: ({ username, password }) => {
+ *         const passwordBuffer = new TextEncoder().encode(password);
+ *         const verifyBuffer = new TextEncoder().encode("Admin");
+ *         if (passwordBuffer.length !== verifyBuffer.length)
+ *           return !crypto.timingSafeEqual(verifyBuffer, verifyBuffer);
+ *         return crypto.timingSafeEqual(passwordBuffer, verifyBuffer);
+ *       },
+ *       // type: "base64",
+ *       // separator: ":",
+ *       realm: "Dashboard",
+ *     }),
+ *   })
+ * router.filterGet<CTAuth<{ username: string }>>("/dashboard/.**", [
+ *   authProtection,
+ * ]);
+ */
+const basicAuthParser = ({ validateCredentials, type = "base64", separator = ":", realm = "Protected", defaultRole = "user", }) => {
+    return (ctx) => __awaiter(void 0, void 0, void 0, function* () {
+        const { request } = ctx;
+        const authorization = request.headers.get("authorization");
+        ctx.headers.set("WWW-Authenticate", `Basic realm="${realm}", charset="UTF-8"`);
+        if (!authorization)
+            return (0, helpers_ts_1.status)(401);
+        const [scheme, creds] = authorization.split(" ", 2);
+        if (!scheme || !creds || scheme.toLowerCase() !== "basic")
+            return (0, helpers_ts_1.status)(401);
+        let xcreds = creds;
+        if (type === "base64") {
+            try {
+                xcreds = atob(creds);
+            }
+            catch (_a) {
+                return (0, helpers_ts_1.status)(401);
+            }
+        }
+        const [username, password] = xcreds.split(separator, 2);
+        if (!username || !password)
+            return (0, helpers_ts_1.status)(401);
+        const credentials = {
+            username,
+            password,
+        };
+        const credentailsValidation = yield validateCredentials(credentials);
+        if (credentailsValidation instanceof Response) {
+            return credentailsValidation;
+        }
+        if (!credentailsValidation)
+            return (0, helpers_ts_1.status)(401);
+        return credentailsValidation === true
+            ? { username, role: defaultRole }
+            : credentailsValidation;
+    });
+};
+exports.basicAuthParser = basicAuthParser;
+//# sourceMappingURL=auth-middlewares.js.map

package/dist/auth-middlewares.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-middlewares.js","sourceRoot":"","sources":["../src/auth-middlewares.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAAsC;AACtC,yCAKoB;AA4CpB;;;;;;;;;;;;;GAaG;AACI,MAAM,YAAY,GAAG,CAG1B,EACA,SAAS,EACT,aAAa,GAAG,KAAK,EACrB,SAAS,GAAG,KAAK,GAKlB,EAA+C,EAAE;IAChD,OAAO,UAAgB,GAAG;;YACxB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;gBACjB,IAAI,SAAS,EAAE,CAAC;oBACd,OAAO;gBACT,CAAC;gBACD,OAAO,IAAA,mBAAM,EAAC,GAAG,CAAC,CAAC;YACrB,CAAC;iBAAM,IAAI,IAAI,YAAY,QAAQ,EAAE,CAAC;gBACpC,IAAI,SAAS,EAAE,CAAC;oBACd,OAAO;gBACT,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAChB,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO,yBAAc,CAAC;YACxB,CAAC;QACH,CAAC;KAAA,CAAC;AACJ,CAAC,CAAC;AA9BW,QAAA,YAAY,gBA8BvB;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACI,MAAM,SAAS,GAAG,CAGvB,EACA,SAAS,EACT,UAAU,EACV,WAAW,EACX,aAAa,EACb,aAAa,GAAG,KAAK,GAUtB,EAA+C,EAAE;IAChD,IAAI,WAAW,IAAI,CAAC,aAAa,EAAE,CAAC;QAClC,MAAM,IAAI,sBAAW,CACnB,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;QAClB,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;YACjB,OAAO,IAAA,mBAAM,EAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QACD,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,OAAO,IAAA,mBAAM,EAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QACD,IAAI,UAAU,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,OAAO,IAAA,mBAAM,EAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QACD,IAAI,WAAW,IAAI,aAAa,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAChD,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CACrC,CAAC;YACF,IAAI,CAAC,SAAS;gBAAE,OAAO,IAAA,mBAAM,EAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,yBAAc,CAAC;QACxB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC,CAAC;AA5CW,QAAA,SAAS,aA4CpB;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACI,MAAM,eAAe,GAAG,CAK7B,EACA,mBAAmB,EACnB,IAAI,GAAG,QAAQ,EACf,SAAS,GAAG,GAAG,EACf,KAAK,GAAG,WAAW,EACnB,WAAW,GAAG,MAAM,GAcrB,EAA0C,EAAE;IAC3C,OAAO,CAAO,GAAgD,EAAE,EAAE;QAChE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;QACxB,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC3D,GAAG,CAAC,OAAO,CAAC,GAAG,CACb,kBAAkB,EAClB,gBAAgB,KAAK,oBAAoB,CAC1C,CAAC;QACF,IAAI,CAAC,aAAa;YAAE,OAAO,IAAA,mBAAM,EAAC,GAAG,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,OAAO;YACvD,OAAO,IAAA,mBAAM,EAAC,GAAG,CAAC,CAAC;QACrB,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;YAAC,WAAM,CAAC;gBACP,OAAO,IAAA,mBAAM,EAAC,GAAG,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QACD,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAA,mBAAM,EAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAG;YAClB,QAAQ;YACR,QAAQ;SACT,CAAC;QACF,MAAM,qBAAqB,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAC;QACrE,IAAI,qBAAqB,YAAY,QAAQ,EAAE,CAAC;YAC9C,OAAO,qBAAqB,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,qBAAqB;YAAE,OAAO,IAAA,mBAAM,EAAC,GAAG,CAAC,CAAC;QAC/C,OAAO,qBAAqB,KAAK,IAAI;YACnC,CAAC,CAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAuB;YACvD,CAAC,CAAC,qBAAqB,CAAC;IAC5B,CAAC,CAAA,CAAC;AACJ,CAAC,CAAC;AA3DW,QAAA,eAAe,mBA2D1B"}

package/dist/cjs/auth-middlewares.d.ts

@@ -0,0 +1,119 @@
+import { type Context, type Handler } from "./types.ts";
+/**
+ * Represents an authenticated user.
+ *
+ * @template {Record<string, unknown>} ExtendAuth - Extend Auth Context
+ */
+export type Auth<ExtendAuth extends Record<string, unknown> = Record<string, never>> = {
+    /** Role assigned to the user (e.g., "admin", "user") */
+    role: string;
+} & ExtendAuth;
+/**
+ * Context extension that includes authentication information.
+ *
+ * @template {Record<string, unknown>} ExtendAuth - Extend Auth Context
+ */
+export type CTAuth<ExtendAuth extends Record<string, unknown> = Record<string, never>> = {
+    /** Authenticated user details */
+    auth?: Auth<ExtendAuth>;
+};
+/**
+ * auth context parser for authenticate middleware
+ *
+ * @template {Record<string, unknown>} ExtendAuth - Extend Auth Context
+ * @template {Record<string, unknown>} ExtendContext - Extend Router Context
+ */
+export type ParseAuthFn<ExtendAuth extends Record<string, unknown> = Record<string, never>, ExtendContext extends Record<string, unknown> = Record<string, never>> = (ctx: Context<CTAuth<ExtendAuth> & ExtendContext>) => Promise<Auth<ExtendAuth> | Response | null | undefined> | Auth<ExtendAuth> | Response | null | undefined;
+/**
+ * Middleware to authenticate a request.
+ *
+ * @template {Record<string, unknown>} ExtendAuth - Extend Auth Context
+ * @template {Record<string, unknown>} ExtendContext - Extend Router Context
+ * @param {Object} [options] - Configuration options.
+ * @param {ParseAuthFn}[options.parseAuth] - Function to extract authentication info from the request.
+ *   Should return an `Auth` object if valid, `Error` if invalid, or `null/undefined` if missing.
+ * @param {boolean} [options.breakPipeline=false] - If true, stops only pipeline flow per handler type after success.
+ * @param {boolean} [options.checkOnly=false] - If true, only checks authentication without returning a response.
+ *
+ * @returns {Handler<CTAuth<ExtendAuth> & ExtendContext>} A handler that sets `ctx.auth` if authentication succeeds,
+ *   otherwise returns a `401 Unauthorized` or with error message if available response (unless `checkOnly` is true).
+ */
+export declare const authenticate: <ExtendAuth extends Record<string, unknown> = Record<string, never>, ExtendContext extends Record<string, unknown> = Record<string, never>>({ parseAuth, breakPipeline, checkOnly, }: {
+    parseAuth: ParseAuthFn<ExtendAuth, ExtendContext>;
+    breakPipeline?: boolean;
+    checkOnly?: boolean;
+}) => Handler<CTAuth<ExtendAuth> & ExtendContext>;
+/**
+ * Middleware to authorize a request based on role or permissions.
+ *
+ * @template {Record<string, unknown>} ExtendAuth - Extend Auth Context
+ * @template {Record<string, unknown>} ExtendContext - Extend Router Context
+ * @param {Object} [options] - Configuration options.
+ * @param {(role: string) => boolean}[options.allowRole] - Function to check if a role is allowed.
+ * @param {(role: string) => boolean}[options.forbidRole] - Function to check if a role is forbidden.
+ * @param {string[]}[options.permissions] - List of permissions required for access.
+ * @param {(permission: string,role: string) => boolean|null|undefined}[options.hasPermission] - Function to check if a role has a given permission.
+ *   Required if `permissions` is provided.
+ * @param {boolean} [options.breakPipeline=false] - If true, stops only pipeline flow per handler type after success.
+ *
+ * @returns {Handler<CTAuth & ExtendContext>} A handler that checks `ctx.auth` and enforces role/permission rules.
+ *   Returns `401 Unauthorized` if no auth is present, or `403 Forbidden` if checks fail.
+ *   Throws an error if `permissions` is set without `hasPermission`.
+ *
+ */
+export declare const authorize: <ExtendAuth extends Record<string, unknown> = Record<string, never>, ExtendContext extends Record<string, unknown> = Record<string, never>>({ allowRole, forbidRole, permissions, hasPermission, breakPipeline, }: {
+    allowRole?: (role: string) => boolean;
+    forbidRole?: (role: string) => boolean;
+    permissions?: string[];
+    hasPermission?: (permission: string, role: string) => boolean | null | undefined;
+    breakPipeline?: boolean;
+}) => Handler<CTAuth<ExtendAuth> & ExtendContext>;
+/**
+ * Returns a Basic Authenticator for authenticate middleware.
+ * Supports RFC 7617 Basic Authentication scheme.
+ *
+ * @template {Record<string, unknown>} ExtendAuth - Extend Auth Context
+ * @template {Record<string, unknown>} ExtendContext - Extend Router Context
+ * @param {Object} config - Basic Authentication configuration
+ * @param {(credentials: {username:string;password:string;})=>|Promise<boolean | Response | Auth<ExtendAuth>>|boolean|Response|Auth<ExtendAuth>} config.validateCredentials - Callback to validate credentials
+ * @param {"base64"|"raw"} [config.type="base64"] - Credential encoding type
+ * @param {":"|" "} [config.separator=":"] - Separator between username and password
+ * @param {string} [config.realm="Protected"] - Authentication realm
+ * @param {prop} [config.ctxProp="basicAuth"] - Context property name for auth data
+ * @returns {Function} Middleware function that validates Basic Authentication
+ *
+ * @example
+ * // Simple username/password authentication
+ * const authProtection = authenticate({
+ *     parseAuth: basicAuthParser({
+ *       validateCredentials: ({ username, password }) => {
+ *         const passwordBuffer = new TextEncoder().encode(password);
+ *         const verifyBuffer = new TextEncoder().encode("Admin");
+ *         if (passwordBuffer.length !== verifyBuffer.length)
+ *           return !crypto.timingSafeEqual(verifyBuffer, verifyBuffer);
+ *         return crypto.timingSafeEqual(passwordBuffer, verifyBuffer);
+ *       },
+ *       // type: "base64",
+ *       // separator: ":",
+ *       realm: "Dashboard",
+ *     }),
+ *   })
+ * router.filterGet<CTAuth<{ username: string }>>("/dashboard/.**", [
+ *   authProtection,
+ * ]);
+ */
+export declare const basicAuthParser: <ExtendAuth extends {
+    username: string;
+} & Record<string, unknown> = {
+    username: string;
+}, ExtendContext extends Record<string, unknown> = Record<string, never>>({ validateCredentials, type, separator, realm, defaultRole, }: {
+    validateCredentials: (credentials: {
+        username: string;
+        password: string;
+    }) => Promise<boolean | Response | Auth<ExtendAuth>> | boolean | Response | Auth<ExtendAuth>;
+    type?: "raw" | "base64";
+    separator?: ":" | " ";
+    realm?: string;
+    defaultRole?: string;
+}) => ParseAuthFn<ExtendAuth, ExtendContext>;
+//# sourceMappingURL=auth-middlewares.d.ts.map

package/dist/cjs/auth-middlewares.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-middlewares.d.ts","sourceRoot":"","sources":["../../src/auth-middlewares.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,OAAO,EACZ,KAAK,OAAO,EACb,MAAM,YAAY,CAAC;AAEpB;;;;GAIG;AACH,MAAM,MAAM,IAAI,CACd,UAAU,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAChE;IACF,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,UAAU,CAAC;AAEf;;;;GAIG;AACH,MAAM,MAAM,MAAM,CAChB,UAAU,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAChE;IACF,iCAAiC;IACjC,IAAI,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;CACzB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,WAAW,CACrB,UAAU,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EAClE,aAAa,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IACnE,CACF,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,aAAa,CAAC,KAE9C,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,IAAI,GAAG,SAAS,CAAC,GACvD,IAAI,CAAC,UAAU,CAAC,GAChB,QAAQ,GACR,IAAI,GACJ,SAAS,CAAC;AAEd;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,YAAY,GACvB,UAAU,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EAClE,aAAa,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EACrE,0CAIC;IACD,SAAS,EAAE,WAAW,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAClD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,KAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,aAAa,CAmB7C,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,SAAS,GACpB,UAAU,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EAClE,aAAa,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EACrE,uEAMC;IACD,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACtC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACvC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,aAAa,CAAC,EAAE,CACd,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,KACT,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC;IAChC,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,KAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,aAAa,CA0B7C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,eAAe,GAC1B,UAAU,SAAS;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAClE,QAAQ,EAAE,MAAM,CAAC;CAClB,EACD,aAAa,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EACrE,+DAMC;IACD,mBAAmB,EAAE,CAAC,WAAW,EAAE;QACjC,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,KACG,OAAO,CAAC,OAAO,GAAG,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,GAC9C,OAAO,GACP,QAAQ,GACR,IAAI,CAAC,UAAU,CAAC,CAAC;IACrB,IAAI,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;IACxB,SAAS,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,KAAG,WAAW,CAAC,UAAU,EAAE,aAAa,CAmCxC,CAAC"}

package/dist/cjs/auth-middlewares.js

@@ -0,0 +1,168 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.basicAuthParser = exports.authorize = exports.authenticate = void 0;
+const helpers_ts_1 = require("./helpers.js");
+const types_ts_1 = require("./types.js");
+/**
+ * Middleware to authenticate a request.
+ *
+ * @template {Record<string, unknown>} ExtendAuth - Extend Auth Context
+ * @template {Record<string, unknown>} ExtendContext - Extend Router Context
+ * @param {Object} [options] - Configuration options.
+ * @param {ParseAuthFn}[options.parseAuth] - Function to extract authentication info from the request.
+ *   Should return an `Auth` object if valid, `Error` if invalid, or `null/undefined` if missing.
+ * @param {boolean} [options.breakPipeline=false] - If true, stops only pipeline flow per handler type after success.
+ * @param {boolean} [options.checkOnly=false] - If true, only checks authentication without returning a response.
+ *
+ * @returns {Handler<CTAuth<ExtendAuth> & ExtendContext>} A handler that sets `ctx.auth` if authentication succeeds,
+ *   otherwise returns a `401 Unauthorized` or with error message if available response (unless `checkOnly` is true).
+ */
+const authenticate = ({ parseAuth, breakPipeline = false, checkOnly = false, }) => {
+    return function (ctx) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const auth = yield parseAuth(ctx);
+            if (auth == null) {
+                if (checkOnly) {
+                    return;
+                }
+                return (0, helpers_ts_1.status)(401);
+            }
+            else if (auth instanceof Response) {
+                if (checkOnly) {
+                    return;
+                }
+                return auth;
+            }
+            ctx.auth = auth;
+            if (breakPipeline) {
+                return types_ts_1.Break_Pipeline;
+            }
+        });
+    };
+};
+exports.authenticate = authenticate;
+/**
+ * Middleware to authorize a request based on role or permissions.
+ *
+ * @template {Record<string, unknown>} ExtendAuth - Extend Auth Context
+ * @template {Record<string, unknown>} ExtendContext - Extend Router Context
+ * @param {Object} [options] - Configuration options.
+ * @param {(role: string) => boolean}[options.allowRole] - Function to check if a role is allowed.
+ * @param {(role: string) => boolean}[options.forbidRole] - Function to check if a role is forbidden.
+ * @param {string[]}[options.permissions] - List of permissions required for access.
+ * @param {(permission: string,role: string) => boolean|null|undefined}[options.hasPermission] - Function to check if a role has a given permission.
+ *   Required if `permissions` is provided.
+ * @param {boolean} [options.breakPipeline=false] - If true, stops only pipeline flow per handler type after success.
+ *
+ * @returns {Handler<CTAuth & ExtendContext>} A handler that checks `ctx.auth` and enforces role/permission rules.
+ *   Returns `401 Unauthorized` if no auth is present, or `403 Forbidden` if checks fail.
+ *   Throws an error if `permissions` is set without `hasPermission`.
+ *
+ */
+const authorize = ({ allowRole, forbidRole, permissions, hasPermission, breakPipeline = false, }) => {
+    if (permissions && !hasPermission) {
+        throw new types_ts_1.RouterError("authorize middleware 'permissions' require 'hasPermission'");
+    }
+    return ({ auth }) => {
+        if (auth == null) {
+            return (0, helpers_ts_1.status)(401);
+        }
+        if (allowRole && !allowRole(auth.role)) {
+            return (0, helpers_ts_1.status)(403);
+        }
+        if (forbidRole && forbidRole(auth.role)) {
+            return (0, helpers_ts_1.status)(403);
+        }
+        if (permissions && hasPermission) {
+            const permitted = permissions.some((permission) => hasPermission(permission, auth.role));
+            if (!permitted)
+                return (0, helpers_ts_1.status)(403);
+        }
+        if (breakPipeline) {
+            return types_ts_1.Break_Pipeline;
+        }
+    };
+};
+exports.authorize = authorize;
+/**
+ * Returns a Basic Authenticator for authenticate middleware.
+ * Supports RFC 7617 Basic Authentication scheme.
+ *
+ * @template {Record<string, unknown>} ExtendAuth - Extend Auth Context
+ * @template {Record<string, unknown>} ExtendContext - Extend Router Context
+ * @param {Object} config - Basic Authentication configuration
+ * @param {(credentials: {username:string;password:string;})=>|Promise<boolean | Response | Auth<ExtendAuth>>|boolean|Response|Auth<ExtendAuth>} config.validateCredentials - Callback to validate credentials
+ * @param {"base64"|"raw"} [config.type="base64"] - Credential encoding type
+ * @param {":"|" "} [config.separator=":"] - Separator between username and password
+ * @param {string} [config.realm="Protected"] - Authentication realm
+ * @param {prop} [config.ctxProp="basicAuth"] - Context property name for auth data
+ * @returns {Function} Middleware function that validates Basic Authentication
+ *
+ * @example
+ * // Simple username/password authentication
+ * const authProtection = authenticate({
+ *     parseAuth: basicAuthParser({
+ *       validateCredentials: ({ username, password }) => {
+ *         const passwordBuffer = new TextEncoder().encode(password);
+ *         const verifyBuffer = new TextEncoder().encode("Admin");
+ *         if (passwordBuffer.length !== verifyBuffer.length)
+ *           return !crypto.timingSafeEqual(verifyBuffer, verifyBuffer);
+ *         return crypto.timingSafeEqual(passwordBuffer, verifyBuffer);
+ *       },
+ *       // type: "base64",
+ *       // separator: ":",
+ *       realm: "Dashboard",
+ *     }),
+ *   })
+ * router.filterGet<CTAuth<{ username: string }>>("/dashboard/.**", [
+ *   authProtection,
+ * ]);
+ */
+const basicAuthParser = ({ validateCredentials, type = "base64", separator = ":", realm = "Protected", defaultRole = "user", }) => {
+    return (ctx) => __awaiter(void 0, void 0, void 0, function* () {
+        const { request } = ctx;
+        const authorization = request.headers.get("authorization");
+        ctx.headers.set("WWW-Authenticate", `Basic realm="${realm}", charset="UTF-8"`);
+        if (!authorization)
+            return (0, helpers_ts_1.status)(401);
+        const [scheme, creds] = authorization.split(" ", 2);
+        if (!scheme || !creds || scheme.toLowerCase() !== "basic")
+            return (0, helpers_ts_1.status)(401);
+        let xcreds = creds;
+        if (type === "base64") {
+            try {
+                xcreds = atob(creds);
+            }
+            catch (_a) {
+                return (0, helpers_ts_1.status)(401);
+            }
+        }
+        const [username, password] = xcreds.split(separator, 2);
+        if (!username || !password)
+            return (0, helpers_ts_1.status)(401);
+        const credentials = {
+            username,
+            password,
+        };
+        const credentailsValidation = yield validateCredentials(credentials);
+        if (credentailsValidation instanceof Response) {
+            return credentailsValidation;
+        }
+        if (!credentailsValidation)
+            return (0, helpers_ts_1.status)(401);
+        return credentailsValidation === true
+            ? { username, role: defaultRole }
+            : credentailsValidation;
+    });
+};
+exports.basicAuthParser = basicAuthParser;
+//# sourceMappingURL=auth-middlewares.js.map

package/dist/cjs/auth-middlewares.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-middlewares.js","sourceRoot":"","sources":["../../src/auth-middlewares.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAAsC;AACtC,yCAKoB;AA4CpB;;;;;;;;;;;;;GAaG;AACI,MAAM,YAAY,GAAG,CAG1B,EACA,SAAS,EACT,aAAa,GAAG,KAAK,EACrB,SAAS,GAAG,KAAK,GAKlB,EAA+C,EAAE;IAChD,OAAO,UAAgB,GAAG;;YACxB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;gBACjB,IAAI,SAAS,EAAE,CAAC;oBACd,OAAO;gBACT,CAAC;gBACD,OAAO,IAAA,mBAAM,EAAC,GAAG,CAAC,CAAC;YACrB,CAAC;iBAAM,IAAI,IAAI,YAAY,QAAQ,EAAE,CAAC;gBACpC,IAAI,SAAS,EAAE,CAAC;oBACd,OAAO;gBACT,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAChB,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO,yBAAc,CAAC;YACxB,CAAC;QACH,CAAC;KAAA,CAAC;AACJ,CAAC,CAAC;AA9BW,QAAA,YAAY,gBA8BvB;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACI,MAAM,SAAS,GAAG,CAGvB,EACA,SAAS,EACT,UAAU,EACV,WAAW,EACX,aAAa,EACb,aAAa,GAAG,KAAK,GAUtB,EAA+C,EAAE;IAChD,IAAI,WAAW,IAAI,CAAC,aAAa,EAAE,CAAC;QAClC,MAAM,IAAI,sBAAW,CACnB,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;QAClB,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;YACjB,OAAO,IAAA,mBAAM,EAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QACD,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,OAAO,IAAA,mBAAM,EAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QACD,IAAI,UAAU,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,OAAO,IAAA,mBAAM,EAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QACD,IAAI,WAAW,IAAI,aAAa,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAChD,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CACrC,CAAC;YACF,IAAI,CAAC,SAAS;gBAAE,OAAO,IAAA,mBAAM,EAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,yBAAc,CAAC;QACxB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC,CAAC;AA5CW,QAAA,SAAS,aA4CpB;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACI,MAAM,eAAe,GAAG,CAK7B,EACA,mBAAmB,EACnB,IAAI,GAAG,QAAQ,EACf,SAAS,GAAG,GAAG,EACf,KAAK,GAAG,WAAW,EACnB,WAAW,GAAG,MAAM,GAcrB,EAA0C,EAAE;IAC3C,OAAO,CAAO,GAAgD,EAAE,EAAE;QAChE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;QACxB,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC3D,GAAG,CAAC,OAAO,CAAC,GAAG,CACb,kBAAkB,EAClB,gBAAgB,KAAK,oBAAoB,CAC1C,CAAC;QACF,IAAI,CAAC,aAAa;YAAE,OAAO,IAAA,mBAAM,EAAC,GAAG,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,OAAO;YACvD,OAAO,IAAA,mBAAM,EAAC,GAAG,CAAC,CAAC;QACrB,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;YAAC,WAAM,CAAC;gBACP,OAAO,IAAA,mBAAM,EAAC,GAAG,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QACD,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAA,mBAAM,EAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAG;YAClB,QAAQ;YACR,QAAQ;SACT,CAAC;QACF,MAAM,qBAAqB,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAC;QACrE,IAAI,qBAAqB,YAAY,QAAQ,EAAE,CAAC;YAC9C,OAAO,qBAAqB,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,qBAAqB;YAAE,OAAO,IAAA,mBAAM,EAAC,GAAG,CAAC,CAAC;QAC/C,OAAO,qBAAqB,KAAK,IAAI;YACnC,CAAC,CAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAuB;YACvD,CAAC,CAAC,qBAAqB,CAAC;IAC5B,CAAC,CAAA,CAAC;AACJ,CAAC,CAAC;AA3DW,QAAA,eAAe,mBA2D1B"}