@daloyjs/core 0.16.0 → 0.28.0

package/dist/ip-restriction.js

@@ -0,0 +1,203 @@
+/**
+ * Network-layer access control for {@link Hooks}. The {@link ipRestriction}
+ * middleware enforces IPv4 / IPv6 / CIDR allow- and deny-lists. Because the
+ * Web-standard {@link Request} does not expose a peer address, callers must
+ * either provide a trusted resolver or explicitly opt in to trusted proxy
+ * headers.
+ *
+ * @since 0.19.0
+ */
+import { ForbiddenError } from "./errors.js";
+/**
+ * Block or allow requests by source IP / CIDR range. In direct Web-standard
+ * runtimes, pass `resolveIp` from the adapter-specific connection metadata.
+ * Behind a trusted proxy chain, set `trustProxyHeaders: true` to read
+ * `X-Forwarded-For` / `X-Real-IP`.
+ *
+ * @example
+ * ```ts
+ * app.use(ipRestriction({
+ *   allow: ["10.0.0.0/8", "::1"],
+ *   deny: ["10.6.6.0/24"],
+ *   trustProxyHeaders: true,
+ * }));
+ * ```
+ *
+ * On reject the middleware throws a {@link ForbiddenError}, which Daloy
+ * renders as RFC 9457 `application/problem+json`.
+ *
+ * @since 0.19.0
+ */
+export function ipRestriction(opts) {
+    if (!opts.allow?.length && !opts.deny?.length) {
+        throw new Error('ipRestriction(): at least one of "allow" or "deny" must be provided.');
+    }
+    const allow = (opts.allow ?? []).map(compileCidrMatcher);
+    const deny = (opts.deny ?? []).map(compileCidrMatcher);
+    const resolveIp = opts.resolveIp ??
+        (opts.trustProxyHeaders ? forwardedIpResolver : noIpResolver);
+    const message = opts.message ?? "IP address not permitted";
+    return {
+        beforeHandle(ctx) {
+            const raw = resolveIp(ctx);
+            if (!raw)
+                throw new ForbiddenError(message);
+            const parsed = parseIp(raw);
+            if (!parsed)
+                throw new ForbiddenError(message);
+            if (deny.some((m) => matchesMatcher(parsed, m))) {
+                throw new ForbiddenError(message);
+            }
+            if (allow.length > 0 && !allow.some((m) => matchesMatcher(parsed, m))) {
+                throw new ForbiddenError(message);
+            }
+        },
+    };
+}
+function noIpResolver(_ctx) {
+    return undefined;
+}
+function forwardedIpResolver(ctx) {
+    const headers = ctx.request.headers;
+    const forwarded = headers.get("x-forwarded-for");
+    if (forwarded)
+        return forwarded.split(",")[0]?.trim();
+    return headers.get("x-real-ip") ?? undefined;
+}
+function matchesMatcher(ip, m) {
+    const candidate = normalizeFamily(ip, m.family);
+    if (!candidate)
+        return false;
+    const expected = m.bytes;
+    const totalBits = candidate.length * 8;
+    const prefix = Math.min(m.prefix, totalBits);
+    const fullBytes = prefix >> 3;
+    for (let i = 0; i < fullBytes; i++) {
+        if (candidate[i] !== expected[i])
+            return false;
+    }
+    const remaining = prefix - fullBytes * 8;
+    if (remaining === 0)
+        return true;
+    const mask = 0xff << (8 - remaining);
+    return ((candidate[fullBytes] ^ expected[fullBytes]) & mask) === 0;
+}
+function compileCidrMatcher(input) {
+    let addr = input;
+    let prefixStr;
+    if (input.includes("/")) {
+        const slash = input.indexOf("/");
+        addr = input.slice(0, slash);
+        prefixStr = input.slice(slash + 1);
+    }
+    const parsed = parseIp(addr);
+    if (!parsed) {
+        throw new Error(`ipRestriction(): invalid IP address ${JSON.stringify(input)}.`);
+    }
+    const totalBits = parsed.family === 4 ? 32 : 128;
+    let prefix = totalBits;
+    if (prefixStr !== undefined) {
+        if (!/^\d+$/.test(prefixStr)) {
+            throw new Error(`ipRestriction(): invalid CIDR prefix in ${JSON.stringify(input)}.`);
+        }
+        prefix = Number.parseInt(prefixStr, 10);
+        if (!Number.isInteger(prefix) || prefix < 0 || prefix > totalBits) {
+            throw new Error(`ipRestriction(): invalid CIDR prefix in ${JSON.stringify(input)}.`);
+        }
+    }
+    return { family: parsed.family, prefix, bytes: applyPrefixMask(parsed.bytes, prefix) };
+}
+function normalizeFamily(ip, family) {
+    if (ip.family === family)
+        return ip.bytes;
+    if (ip.family === 6 && family === 4) {
+        // IPv4-mapped IPv6 (::ffff:a.b.c.d) — accept as IPv4.
+        const b = ip.bytes;
+        const isMapped = b.slice(0, 10).every((x) => x === 0) && b[10] === 0xff && b[11] === 0xff;
+        if (isMapped)
+            return b.slice(12);
+        return undefined;
+    }
+    return undefined;
+}
+function applyPrefixMask(bytes, prefix) {
+    const out = new Uint8Array(bytes);
+    const fullBytes = prefix >> 3;
+    const remaining = prefix - fullBytes * 8;
+    if (remaining > 0 && fullBytes < out.length) {
+        const mask = 0xff << (8 - remaining);
+        out[fullBytes] = out[fullBytes] & mask;
+    }
+    for (let i = fullBytes + (remaining > 0 ? 1 : 0); i < out.length; i++) {
+        out[i] = 0;
+    }
+    return out;
+}
+function parseIp(input) {
+    const trimmed = input.trim();
+    if (trimmed.includes(":"))
+        return parseIPv6(trimmed);
+    return parseIPv4(trimmed);
+}
+function parseIPv4(input) {
+    const parts = input.split(".");
+    if (parts.length !== 4)
+        return undefined;
+    const bytes = new Uint8Array(4);
+    for (let i = 0; i < 4; i++) {
+        const part = parts[i];
+        if (!/^\d{1,3}$/.test(part))
+            return undefined;
+        const n = Number.parseInt(part, 10);
+        if (n < 0 || n > 255)
+            return undefined;
+        bytes[i] = n;
+    }
+    return { bytes, family: 4 };
+}
+function parseIPv6(input) {
+    // Support IPv4-mapped tail (::ffff:1.2.3.4).
+    let working = input;
+    const lastColon = working.lastIndexOf(":");
+    if (lastColon !== -1 && working.slice(lastColon + 1).includes(".")) {
+        const v4 = parseIPv4(working.slice(lastColon + 1));
+        if (!v4)
+            return undefined;
+        const hi = (v4.bytes[0] << 8) | v4.bytes[1];
+        const lo = (v4.bytes[2] << 8) | v4.bytes[3];
+        working =
+            working.slice(0, lastColon + 1) +
+                hi.toString(16) +
+                ":" +
+                lo.toString(16);
+    }
+    const parts = working.split("::");
+    if (parts.length > 2)
+        return undefined;
+    const headGroups = parts[0] === "" ? [] : parts[0].split(":");
+    const tailGroups = parts.length === 2 && parts[1] !== "" ? parts[1].split(":") : [];
+    const explicit = headGroups.length + tailGroups.length;
+    if (explicit > 8)
+        return undefined;
+    if (parts.length === 1 && explicit !== 8)
+        return undefined;
+    const missing = parts.length === 2 ? 8 - explicit : 0;
+    const groups = [
+        ...headGroups,
+        ...Array.from({ length: missing }, () => "0"),
+        ...tailGroups,
+    ];
+    if (groups.length !== 8)
+        return undefined;
+    const bytes = new Uint8Array(16);
+    for (let index = 0; index < 8; index++) {
+        const group = groups[index];
+        if (!/^[0-9a-fA-F]{1,4}$/.test(group))
+            return undefined;
+        const n = Number.parseInt(group, 16);
+        bytes[index * 2] = (n >> 8) & 0xff;
+        bytes[index * 2 + 1] = n & 0xff;
+    }
+    return { bytes, family: 6 };
+}
+//# sourceMappingURL=ip-restriction.js.map

package/dist/ip-restriction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip-restriction.js","sourceRoot":"","sources":["../src/ip-restriction.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAyD7C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,aAAa,CAAC,IAA0B;IACtD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS;QAC9B,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,0BAA0B,CAAC;IAC3D,OAAO;QACL,YAAY,CAAC,GAAG;YACd,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,MAAM,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;YACpC,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,MAAM,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAA2B;IAC/C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,mBAAmB,CAAC,GAA0B;IACrD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;IACpC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACjD,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACtD,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC;AAC/C,CAAC;AAED,SAAS,cAAc,CAAC,EAAY,EAAE,CAAY;IAChD,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC;IACzB,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACjD,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,GAAG,SAAS,GAAG,CAAC,CAAC;IACzC,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;IACrC,OAAO,CAAC,CAAC,SAAS,CAAC,SAAS,CAAE,GAAG,QAAQ,CAAC,SAAS,CAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,SAA6B,CAAC;IAClC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7B,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,uCAAuC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IACjD,IAAI,MAAM,GAAG,SAAS,CAAC;IACvB,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,2CAA2C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CACpE,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,SAAS,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CACb,2CAA2C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;AACzF,CAAC;AAED,SAAS,eAAe,CAAC,EAAY,EAAE,MAAa;IAClD,IAAI,EAAE,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,CAAC,KAAK,CAAC;IAC1C,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,sDAAsD;QACtD,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;QACnB,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAE,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,CAAE,KAAK,IAAI,CAAC;QAC5F,IAAI,QAAQ;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,KAAiB,EAAE,MAAc;IACxD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,CAAC;IAC9B,MAAM,SAAS,GAAG,MAAM,GAAG,SAAS,GAAG,CAAC,CAAC;IACzC,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;QACrC,GAAG,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,SAAS,CAAE,GAAG,IAAI,CAAC;IAC1C,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,SAAS,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACb,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;IACrD,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9C,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG;YAAE,OAAO,SAAS,CAAC;QACvC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,6CAA6C;IAC7C,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnE,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QAC1B,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;QAC9C,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;QAC9C,OAAO;YACL,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC;gBAC/B,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACf,GAAG;gBACH,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACpB,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IACvD,IAAI,QAAQ,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3D,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG;QACb,GAAG,UAAU;QACb,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC;QAC7C,GAAG,UAAU;KACd,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAE,CAAC;QAC7B,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACxD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QACnC,KAAK,CAAC,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IAClC,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AAC9B,CAAC"}

package/dist/jwk.d.ts

@@ -0,0 +1,82 @@
+import { type JwtAlgorithm } from "./jwt.js";
+import type { BaseContext, Hooks } from "./types.js";
+/** Asymmetric algorithms accepted by {@link jwk}. */
+export type JwkAlgorithm = Exclude<JwtAlgorithm, "HS256" | "HS384" | "HS512">;
+/** Minimal JWKS document shape (RFC 7517 §5). */
+export interface JwkSet {
+    keys: JsonWebKey[];
+}
+/**
+ * Source for the verifier's public keys. Either an in-memory JWKS, a
+ * `https://` URL (fetched with TTL caching), or a custom async resolver.
+ */
+export type JwkSource = JwkSet | string | (() => JwkSet | Promise<JwkSet>);
+/** Per-request payload-revalidation hook (Wave 5 leftover). */
+export type JwkVerifyHook = (payload: Record<string, unknown>, ctx: BaseContext<any, any>) => boolean | void | Promise<boolean | void>;
+/** Options for {@link jwk}. */
+export interface JwkOptions {
+    /** JWKS source (object, URL, or resolver). */
+    jwks: JwkSource;
+    /**
+     * Explicit asymmetric algorithm allowlist. Required and non-empty.
+     * Symmetric `HS*` algorithms are refused at construction time.
+     */
+    algorithms: JwkAlgorithm[];
+    /** Optional expected issuer (string or allowlist). */
+    issuer?: string | string[];
+    /** Optional expected audience (string or allowlist). */
+    audience?: string | string[];
+    /** Clock skew tolerance applied to `exp` / `nbf` / `iat`. Default `0`. */
+    clockSkewSeconds?: number;
+    /** `WWW-Authenticate` realm. Default: `"api"`. */
+    realm?: string;
+    /**
+     * TTL for fetched JWKS responses (seconds). Default `300` (5m). Ignored
+     * when `jwks` is not a URL.
+     */
+    fetchTtlSeconds?: number;
+    /**
+     * Optional `fetch` implementation override (mainly for tests). Defaults
+     * to global `fetch`.
+     */
+    fetch?: typeof fetch;
+    /**
+    * Optional per-request revalidation hook. Returning `false` rejects the
+    * request with `403`; returning `true` or `undefined` accepts. Use for
+    * revocation lists / token-version counters / "user changed password since
+    * this JWT was issued".
+     *
+     * @since 0.22.0
+     */
+    verify?: JwkVerifyHook;
+}
+/**
+ * Bearer-token JWT middleware backed by a JWKS source. Refuses symmetric
+ * algorithms at construction time, requires every token to carry a `kid`
+ * header, matches that `kid` against the JWKS, and cross-checks the JWT
+ * header `alg` against the JWK's own `alg` (when present).
+ *
+ * @example
+ * ```ts
+ * import { App, jwk, requireScopes } from "@daloyjs/core";
+ *
+ * app.use(jwk({
+ *   jwks: "https://login.example.com/.well-known/jwks.json",
+ *   algorithms: ["RS256", "ES256"],
+ *   issuer: "https://login.example.com/",
+ *   audience: "books-api",
+ * }));
+ *
+ * app.route({
+ *   method: "POST",
+ *   path: "/items",
+ *   hooks: requireScopes(["items:write"]),
+ *   responses: { 200: { description: "ok" } },
+ *   handler: () => ({ status: 200 as const, body: { ok: true } }),
+ * });
+ * ```
+ *
+ * @since 0.22.0
+ */
+export declare function jwk(opts: JwkOptions): Hooks;
+//# sourceMappingURL=jwk.d.ts.map

package/dist/jwk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwk.d.ts","sourceRoot":"","sources":["../src/jwk.ts"],"names":[],"mappings":"AA8BA,OAAO,EAGL,KAAK,YAAY,EAGlB,MAAM,UAAU,CAAC;AAClB,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAErD,qDAAqD;AACrD,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC,CAAC;AAS9E,iDAAiD;AACjD,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,UAAU,EAAE,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,MAAM,SAAS,GACjB,MAAM,GACN,MAAM,GACN,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;AAErC,+DAA+D;AAC/D,MAAM,MAAM,aAAa,GAAG,CAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,KACvB,OAAO,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;AAE9C,+BAA+B;AAC/B,MAAM,WAAW,UAAU;IACzB,8CAA8C;IAC9C,IAAI,EAAE,SAAS,CAAC;IAChB;;;OAGG;IACH,UAAU,EAAE,YAAY,EAAE,CAAC;IAC3B,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAyGD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,GAAG,CAAC,IAAI,EAAE,UAAU,GAAG,KAAK,CAuG3C"}

package/dist/jwk.js

@@ -0,0 +1,269 @@
+/**
+ * Wave 5 leftover: first-party `jwk()` Bearer-token middleware that refuses
+ * symmetric algorithms outright and verifies tokens against a JWKS source
+ * (static object or `https://` URL).
+ *
+ * Security defaults that cannot be silenced:
+ *
+ * - Asymmetric-only allowlist (`RS*` / `PS*` / `ES*` / `EdDSA`). Symmetric
+ *   `HS*` algorithms are refused at construction — JWK / JWKS keys are
+ *   public, and accepting `HS256` signed with the RSA public key is the
+ *   classic JWKS confused-deputy attack.
+ * - `kid` header REQUIRED on every token. Matching JWK is selected from the
+ *   JWKS by `kid`. A token without `kid`, or with a `kid` not present in
+ *   the JWKS, is rejected with `401`.
+ * - JWT-header `alg` MUST be in the allowlist. When the JWK declares its own
+ *   `alg`, the two MUST agree (RFC 7517 §4.4 cross-check).
+ * - `exp` / `nbf` / `iat` validated on every verify (Wave 5 leftover plan).
+ * - JWKS URLs MUST be `https://` (refused at construction otherwise).
+ * - Optional `verify(payload, ctx)` revalidation hook (Wave 5 leftover) for
+ *   revocation lists, token-version counters, etc.
+ *
+ * The middleware extracts the Bearer token, runs verification, stamps the
+ * decoded payload on `ctx.state.user` (with the standard `sub` / `scope`
+ * surface that `requireScopes()` already understands), and rejects with
+ * RFC-6750-compliant `WWW-Authenticate: Bearer error="invalid_token"` on
+ * failure.
+ *
+ * @since 0.22.0
+ */
+import { ForbiddenError } from "./errors.js";
+import { createJwtVerifier, JwtError, } from "./jwt.js";
+const ALLOWED_JWK_ALGS = new Set([
+    "RS256", "RS384", "RS512",
+    "PS256", "PS384", "PS512",
+    "ES256", "ES384", "ES512",
+    "EdDSA",
+]);
+function unauthorized(realm, errorCode, description) {
+    const parts = [`Bearer realm="${realm}"`];
+    if (errorCode)
+        parts.push(`error="${errorCode}"`);
+    if (description)
+        parts.push(`error_description="${sanitizeAuthParam(description)}"`);
+    return new Response(JSON.stringify({
+        type: "https://daloyjs.dev/errors/unauthorized",
+        title: "Unauthorized",
+        status: 401,
+        detail: description,
+    }), {
+        status: 401,
+        headers: {
+            "content-type": "application/problem+json",
+            "www-authenticate": parts.join(", "),
+            "cache-control": "no-store",
+        },
+    });
+}
+function sanitizeAuthParam(value) {
+    return value.replace(/[\u0000-\u001f\u007f"\\]/g, "");
+}
+function isJwkSet(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        Array.isArray(value.keys));
+}
+function findJwkByKid(jwks, kid) {
+    for (const k of jwks.keys) {
+        if (typeof k === "object" && k !== null && k.kid === kid) {
+            return k;
+        }
+    }
+    return undefined;
+}
+function makeJwksLoader(source, fetchImpl, ttlSeconds) {
+    if (typeof source === "string") {
+        if (!source.startsWith("https://")) {
+            throw new Error("jwk(): jwks URL must be https:// — refusing plaintext JWKS source.");
+        }
+        let cache;
+        let inflight;
+        return () => {
+            const now = Date.now();
+            if (cache && now - cache.fetchedAt < ttlSeconds * 1000) {
+                return Promise.resolve(cache.jwks);
+            }
+            if (inflight)
+                return inflight;
+            inflight = (async () => {
+                try {
+                    const res = await fetchImpl(source, {
+                        headers: { accept: "application/json" },
+                    });
+                    if (!res.ok) {
+                        throw new Error(`jwk(): JWKS fetch failed with status ${res.status}.`);
+                    }
+                    const body = (await res.json());
+                    if (!isJwkSet(body)) {
+                        throw new Error("jwk(): JWKS response is not a valid JWK Set (missing keys[]).");
+                    }
+                    cache = { jwks: body, fetchedAt: Date.now() };
+                    return body;
+                }
+                finally {
+                    inflight = undefined;
+                }
+            })();
+            return inflight;
+        };
+    }
+    if (typeof source === "function") {
+        return async () => {
+            const result = await source();
+            if (!isJwkSet(result)) {
+                throw new Error("jwk(): resolver returned a value that is not a valid JWK Set.");
+            }
+            return result;
+        };
+    }
+    if (!isJwkSet(source)) {
+        throw new Error("jwk(): jwks option must be a JWK Set, an https:// URL, or a resolver function.");
+    }
+    return () => Promise.resolve(source);
+}
+/**
+ * Bearer-token JWT middleware backed by a JWKS source. Refuses symmetric
+ * algorithms at construction time, requires every token to carry a `kid`
+ * header, matches that `kid` against the JWKS, and cross-checks the JWT
+ * header `alg` against the JWK's own `alg` (when present).
+ *
+ * @example
+ * ```ts
+ * import { App, jwk, requireScopes } from "@daloyjs/core";
+ *
+ * app.use(jwk({
+ *   jwks: "https://login.example.com/.well-known/jwks.json",
+ *   algorithms: ["RS256", "ES256"],
+ *   issuer: "https://login.example.com/",
+ *   audience: "books-api",
+ * }));
+ *
+ * app.route({
+ *   method: "POST",
+ *   path: "/items",
+ *   hooks: requireScopes(["items:write"]),
+ *   responses: { 200: { description: "ok" } },
+ *   handler: () => ({ status: 200 as const, body: { ok: true } }),
+ * });
+ * ```
+ *
+ * @since 0.22.0
+ */
+export function jwk(opts) {
+    if (!opts || typeof opts !== "object") {
+        throw new Error("jwk(): options object is required.");
+    }
+    if (!Array.isArray(opts.algorithms) || opts.algorithms.length === 0) {
+        throw new Error("jwk(): algorithms is a required, non-empty asymmetric-only allowlist.");
+    }
+    for (const alg of opts.algorithms) {
+        if (!ALLOWED_JWK_ALGS.has(alg)) {
+            throw new Error(`jwk(): algorithm "${String(alg)}" is not asymmetric — symmetric (HS*) algorithms are refused by jwk() to close the JWKS confused-deputy attack.`);
+        }
+    }
+    if (opts.fetchTtlSeconds !== undefined) {
+        if (typeof opts.fetchTtlSeconds !== "number" ||
+            !Number.isFinite(opts.fetchTtlSeconds) ||
+            opts.fetchTtlSeconds < 0) {
+            throw new Error("jwk(): fetchTtlSeconds must be a non-negative finite number.");
+        }
+    }
+    const realm = opts.realm ?? "api";
+    if (/["\r\n\0]/.test(realm)) {
+        throw new Error("jwk(): realm must not contain quotes, CR, LF, or NUL bytes.");
+    }
+    const ttl = opts.fetchTtlSeconds ?? 300;
+    const loader = makeJwksLoader(opts.jwks, opts.fetch ?? globalThis.fetch, ttl);
+    const algorithms = [...opts.algorithms];
+    let cachedVerifier;
+    let cachedJwksRef;
+    async function getVerifier() {
+        const jwks = await loader();
+        if (cachedVerifier && cachedJwksRef === jwks)
+            return cachedVerifier;
+        cachedJwksRef = jwks;
+        cachedVerifier = createJwtVerifier({
+            algorithms,
+            issuer: opts.issuer,
+            audience: opts.audience,
+            clockSkewSeconds: opts.clockSkewSeconds,
+            // Resolver picks the JWK by `kid` and enforces the alg cross-check.
+            key: async (header) => {
+                const kid = header.kid;
+                if (typeof kid !== "string" || kid.length === 0) {
+                    throw new JwtError("missing_kid", "jwk(): token header is missing kid.");
+                }
+                const jwkMatch = findJwkByKid(jwks, kid);
+                if (!jwkMatch) {
+                    throw new JwtError("kid_not_found", `jwk(): kid "${kid}" is not present in the JWKS.`);
+                }
+                const headerAlg = header.alg;
+                const jwkAlg = jwkMatch.alg;
+                if (typeof jwkAlg === "string" && jwkAlg !== headerAlg) {
+                    throw new JwtError("alg_mismatch", `jwk(): token alg "${String(headerAlg)}" does not match JWK alg "${jwkAlg}".`);
+                }
+                return jwkMatch;
+            },
+        });
+        return cachedVerifier;
+    }
+    return {
+        async beforeHandle(ctx) {
+            const header = ctx.request.headers.get("authorization") ?? "";
+            const match = /^Bearer\s+(.+)$/i.exec(header);
+            if (!match) {
+                return unauthorized(realm);
+            }
+            let verified;
+            try {
+                const verifier = await getVerifier();
+                verified = await verifier.verify(match[1]);
+            }
+            catch (err) {
+                const message = err instanceof JwtError ? err.message : "JWT verification failed";
+                return unauthorized(realm, "invalid_token", message);
+            }
+            // Stamp a user-shaped view on ctx.state so requireScopes() and handlers
+            // can read it without re-parsing the JWT.
+            const payload = verified.payload;
+            const scopes = extractScopes(payload);
+            ctx.state.user = {
+                sub: payload.sub,
+                scopes,
+                claims: payload,
+            };
+            if (opts.verify) {
+                const ok = await opts.verify(payload, ctx);
+                if (ok === false)
+                    throw new ForbiddenError("Token revoked");
+            }
+            return undefined;
+        },
+    };
+}
+function extractScopes(payload) {
+    // RFC 8693 / OAuth2: `scope` is a space-delimited string; some IdPs emit
+    // `scp` (Azure AD) or `scopes` (custom). Accept all three for ergonomics
+    // while staying strict on shape.
+    const scp = Array.isArray(payload.scp)
+        ? payload.scp.filter((scope) => typeof scope === "string").join(" ")
+        : "";
+    const scopes = Array.isArray(payload.scopes)
+        ? payload.scopes.filter((scope) => typeof scope === "string").join(" ")
+        : "";
+    const raw = (typeof payload.scope === "string" && payload.scope) || scp || scopes || "";
+    if (!raw)
+        return [];
+    const out = [];
+    const seen = new Set();
+    for (const piece of raw.split(/\s+/)) {
+        if (piece.length === 0)
+            continue;
+        if (seen.has(piece))
+            continue;
+        seen.add(piece);
+        out.push(piece);
+    }
+    return out;
+}
+//# sourceMappingURL=jwk.js.map

package/dist/jwk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwk.js","sourceRoot":"","sources":["../src/jwk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,QAAQ,GAIT,MAAM,UAAU,CAAC;AAMlB,MAAM,gBAAgB,GAA8B,IAAI,GAAG,CAAC;IAC1D,OAAO,EAAE,OAAO,EAAE,OAAO;IACzB,OAAO,EAAE,OAAO,EAAE,OAAO;IACzB,OAAO,EAAE,OAAO,EAAE,OAAO;IACzB,OAAO;CACR,CAAC,CAAC;AAiEH,SAAS,YAAY,CAAC,KAAa,EAAE,SAAkB,EAAE,WAAoB;IAC3E,MAAM,KAAK,GAAG,CAAC,iBAAiB,KAAK,GAAG,CAAC,CAAC;IAC1C,IAAI,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,SAAS,GAAG,CAAC,CAAC;IAClD,IAAI,WAAW;QAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB,iBAAiB,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACrF,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;QACb,IAAI,EAAE,yCAAyC;QAC/C,KAAK,EAAE,cAAc;QACrB,MAAM,EAAE,GAAG;QACX,MAAM,EAAE,WAAW;KACpB,CAAC,EACF;QACE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,kBAAkB,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;YACpC,eAAe,EAAE,UAAU;SAC5B;KACF,CACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,OAAO,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,KAAK,CAAC,OAAO,CAAE,KAA4B,CAAC,IAAI,CAAC,CAClD,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,GAAW;IAC7C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAK,CAAuB,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YAChF,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CACrB,MAAiB,EACjB,SAAuB,EACvB,UAAkB;IAElB,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;QACJ,CAAC;QACD,IAAI,KAAiC,CAAC;QACtC,IAAI,QAAqC,CAAC;QAC1C,OAAO,GAAG,EAAE;YACV,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS,GAAG,UAAU,GAAG,IAAI,EAAE,CAAC;gBACvD,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACrC,CAAC;YACD,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAC9B,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE;gBACrB,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE;wBAClC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;qBACxC,CAAC,CAAC;oBACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;wBACZ,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;oBACzE,CAAC;oBACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAY,CAAC;oBAC3C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;wBACpB,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;oBACnF,CAAC;oBACD,KAAK,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBAC9C,OAAO,IAAI,CAAC;gBACd,CAAC;wBAAS,CAAC;oBACT,QAAQ,GAAG,SAAS,CAAC;gBACvB,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;YACL,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,KAAK,IAAI,EAAE;YAChB,MAAM,MAAM,GAAG,MAAM,MAAM,EAAE,CAAC;YAC9B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;YACnF,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,GAAG,CAAC,IAAgB;IAClC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QAClC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,qBAAqB,MAAM,CAAC,GAAG,CAAC,iHAAiH,CAClJ,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACvC,IACE,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ;YACxC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC;YACtC,IAAI,CAAC,eAAe,GAAG,CAAC,EACxB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IAClC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,IAAI,GAAG,CAAC;IACxC,MAAM,MAAM,GAAG,cAAc,CAC3B,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,IAAK,UAAU,CAAC,KAAsB,EAChD,GAAG,CACJ,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAmB,CAAC;IAE1D,IAAI,cAA2E,CAAC;IAChF,IAAI,aAAiC,CAAC;IAEtC,KAAK,UAAU,WAAW;QACxB,MAAM,IAAI,GAAG,MAAM,MAAM,EAAE,CAAC;QAC5B,IAAI,cAAc,IAAI,aAAa,KAAK,IAAI;YAAE,OAAO,cAAc,CAAC;QACpE,aAAa,GAAG,IAAI,CAAC;QACrB,cAAc,GAAG,iBAAiB,CAAC;YACjC,UAAU;YACV,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,oEAAoE;YACpE,GAAG,EAAE,KAAK,EAAE,MAA+B,EAAE,EAAE;gBAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;gBACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAChD,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,qCAAqC,CAAC,CAAC;gBAC3E,CAAC;gBACD,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,eAAe,GAAG,+BAA+B,CAAC,CAAC;gBACzF,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC;gBAC7B,MAAM,MAAM,GAAI,QAA8B,CAAC,GAAG,CAAC;gBACnD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACvD,MAAM,IAAI,QAAQ,CAChB,cAAc,EACd,qBAAqB,MAAM,CAAC,SAAS,CAAC,6BAA6B,MAAM,IAAI,CAC9E,CAAC;gBACJ,CAAC;gBACD,OAAO,QAA0B,CAAC;YACpC,CAAC;SACF,CAAC,CAAC;QACH,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,GAAG;YACpB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;YAC9D,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;YAC7B,CAAC;YACD,IAAI,QAAqB,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,WAAW,EAAE,CAAC;gBACrC,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,GAAG,YAAY,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC;gBAClF,OAAO,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;YACvD,CAAC;YACD,wEAAwE;YACxE,0CAA0C;YAC1C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;YACjC,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YACrC,GAAG,CAAC,KAAiC,CAAC,IAAI,GAAG;gBAC5C,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,MAAM;gBACN,MAAM,EAAE,OAAO;aAChB,CAAC;YACF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;gBAC3C,IAAI,EAAE,KAAK,KAAK;oBAAE,MAAM,IAAI,cAAc,CAAC,eAAe,CAAC,CAAC;YAC9D,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,OAAgC;IACrD,yEAAyE;IACzE,yEAAyE;IACzE,iCAAiC;IACjC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;QACpC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACrF,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;QAC1C,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACxF,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,GAAG,GAAG,CAAC,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,MAAM,IAAI,EAAE,CAAC;IACxF,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QAC9B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}