@de-otio/bibcheck 0.1.0

package/dist/http.js

@@ -0,0 +1,543 @@
+/**
+ * HTTP utility for URL verification.
+ *
+ * Provides an HttpClient backed by the native Node 20 fetch API with per-origin
+ * concurrency queuing, jittered-backoff retry on 5xx/network errors, manual
+ * redirect following with SSRF mitigation, and a higher-level headCheck utility
+ * for canonical-edition URL verification.
+ *
+ * Note: The spec calls for undici.request directly, but we use the native Node
+ * global fetch (which is backed by undici internally) because undici is not
+ * separately installed in this project. We use `redirect: 'manual'` to achieve
+ * the same manual redirect-following behaviour.
+ */
+import PQueue from 'p-queue';
+import { lookup as dnsLookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+// ---------------------------------------------------------------------------
+// HttpError
+// ---------------------------------------------------------------------------
+export class HttpError extends Error {
+    name = 'HttpError';
+    status;
+    cause;
+    constructor(message, status, cause) {
+        super(message);
+        this.status = status;
+        this.cause = cause;
+        if (typeof Error.captureStackTrace === 'function') {
+            Error.captureStackTrace(this, HttpError);
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// SSRF helpers
+// ---------------------------------------------------------------------------
+/**
+ * Classify a dotted-quad IPv4 (a.b.c.d, each octet already a number) as private
+ * / non-routable. Covers loopback, RFC 1918, link-local, "this host", and the
+ * CGNAT shared range.
+ */
+function isPrivateIpv4Octets(a, b) {
+    if (a === 0)
+        return true; // 0.0.0.0/8 ("this host")
+    if (a === 127)
+        return true; // 127.0.0.0/8 loopback
+    if (a === 10)
+        return true; // 10.0.0.0/8
+    if (a === 172 && b >= 16 && b <= 31)
+        return true; // 172.16.0.0/12
+    if (a === 192 && b === 168)
+        return true; // 192.168.0.0/16
+    if (a === 169 && b === 254)
+        return true; // 169.254.0.0/16 link-local
+    if (a === 100 && b >= 64 && b <= 127)
+        return true; // 100.64.0.0/10 CGNAT
+    return false;
+}
+/**
+ * Parse a non-dotted IPv4 literal (decimal, octal, or hex) into a 32-bit
+ * number, e.g. "2130706433" or "0x7f000001" → 0x7f000001. Returns null when
+ * the string is not a single-integer IPv4 form. URL/WHATWG parsing already
+ * accepts these as hostnames, so we must classify them too.
+ */
+function parseIntegerIpv4(host) {
+    let n;
+    if (/^0x[0-9a-f]+$/i.test(host)) {
+        n = parseInt(host, 16);
+    }
+    else if (/^0[0-7]+$/.test(host)) {
+        n = parseInt(host, 8);
+    }
+    else if (/^[0-9]+$/.test(host)) {
+        n = parseInt(host, 10);
+    }
+    else {
+        return null;
+    }
+    if (!Number.isFinite(n) || n < 0 || n > 0xffffffff)
+        return null;
+    return n >>> 0;
+}
+export function isPrivateIp(ip) {
+    const lower = ip.toLowerCase();
+    // IPv6 loopback / ULA / link-local.
+    if (lower === '::1')
+        return true;
+    if (/^fc[0-9a-f]{2}:/.test(lower) || /^fd[0-9a-f]{2}:/.test(lower))
+        return true; // fc00::/7
+    if (/^fe[89ab][0-9a-f]:/.test(lower))
+        return true; // fe80::/10
+    // IPv4-mapped / -compatible IPv6 (e.g. ::ffff:127.0.0.1, ::ffff:7f00:1).
+    // Re-classify the embedded IPv4 portion.
+    if (lower.startsWith('::ffff:') || lower.startsWith('::')) {
+        const tail = lower.slice(lower.lastIndexOf(':') + 1);
+        if (/^\d+\.\d+\.\d+\.\d+$/.test(tail)) {
+            return isPrivateIp(tail);
+        }
+    }
+    // Dotted-quad IPv4.
+    if (/^\d+\.\d+\.\d+\.\d+$/.test(lower)) {
+        const parts = lower.split('.').map(Number);
+        const [a, b] = parts;
+        /* c8 ignore next */
+        if (a === undefined || b === undefined)
+            return false; // unreachable: regex guarantees 4 octets
+        return isPrivateIpv4Octets(a, b);
+    }
+    // Single-integer IPv4 (decimal / octal / hex).
+    const n = parseIntegerIpv4(lower);
+    if (n !== null) {
+        const a = (n >>> 24) & 0xff;
+        const b = (n >>> 16) & 0xff;
+        return isPrivateIpv4Octets(a, b);
+    }
+    return false;
+}
+/**
+ * Decide whether a configured API base URL targets a private / loopback host.
+ *
+ * The per-hop SSRF guard exists to stop *untrusted bibliography URLs* reaching
+ * internal addresses. The `[apis] *_base` endpoints, by contrast, are
+ * operator-controlled configuration; pointing them at `http://127.0.0.1:PORT`
+ * (a local stub or dev mirror) is a legitimate, explicit choice. Callers use
+ * this to opt a configured-endpoint client into `allowPrivateHosts` so the
+ * operator's deliberate localhost config is honored without weakening the guard
+ * on bibliography-derived URLs. Returns false for any unparseable / public base.
+ */
+export function isPrivateApiBase(baseUrl) {
+    if (baseUrl == null || baseUrl === '')
+        return false;
+    let host;
+    try {
+        host = new URL(baseUrl).hostname.toLowerCase();
+    }
+    catch {
+        return false;
+    }
+    if (host.startsWith('[') && host.endsWith(']'))
+        host = host.slice(1, -1);
+    if (host === 'localhost')
+        return true;
+    return isPrivateIp(host);
+}
+export function isHostAllowed(host, whitelist) {
+    if (whitelist.length === 0)
+        return false;
+    const h = host.toLowerCase();
+    for (const w of whitelist) {
+        const lw = w.toLowerCase();
+        if (h === lw || h.endsWith('.' + lw))
+            return true;
+    }
+    return false;
+}
+// ---------------------------------------------------------------------------
+// Internal: per-request SSRF guard
+// ---------------------------------------------------------------------------
+/**
+ * Validate a single hop's URL: enforce http/https scheme and reject any
+ * private / non-routable destination. Literal-IP hostnames (dotted-quad,
+ * IPv6, decimal/octal/hex integer, IPv4-mapped) are classified directly; a
+ * DNS name is resolved and every returned address is checked.
+ */
+async function assertNotPrivate(url) {
+    const parsed = new URL(url);
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        throw new HttpError(`rejected: unsupported scheme ${parsed.protocol}`);
+    }
+    // WHATWG URL strips brackets from IPv6 hostnames; isIP handles both families.
+    let hostname = parsed.hostname;
+    if (hostname.startsWith('[') && hostname.endsWith(']')) {
+        hostname = hostname.slice(1, -1);
+    }
+    // If the hostname is itself an address literal (in any form the URL parser
+    // accepts), classify it without a DNS round-trip — DNS would not be consulted
+    // for these at connect time anyway.
+    if (isIP(hostname) !== 0 || /^\d+\.\d+\.\d+\.\d+$/.test(hostname) || parseIntegerIpv4(hostname) !== null) {
+        if (isPrivateIp(hostname)) {
+            throw new HttpError('rejected: private IP');
+        }
+        return;
+    }
+    let addresses;
+    try {
+        addresses = await dnsLookup(hostname, { all: true });
+    }
+    catch (err) {
+        throw new HttpError(`DNS resolution failed for ${hostname}`, undefined, err);
+    }
+    for (const { address } of addresses) {
+        if (isPrivateIp(address)) {
+            throw new HttpError('rejected: private IP');
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Internal: error classification
+// ---------------------------------------------------------------------------
+function isRetryableStatus(status) {
+    // 429 (Too Many Requests) and 503 (Service Unavailable) are explicitly
+    // retryable per the polite-pool etiquette; both commonly carry Retry-After.
+    // All other 5xx are retried too.
+    return status === 429 || status >= 500;
+}
+/**
+ * Parse a Retry-After header value into a delay in milliseconds, or null if it
+ * is absent / unparseable. Accepts delta-seconds ("120") and an HTTP-date.
+ * `now` is injectable for deterministic tests.
+ */
+export function parseRetryAfterMs(value, now = Date.now()) {
+    if (value === undefined)
+        return null;
+    const trimmed = value.trim();
+    if (trimmed === '')
+        return null;
+    if (/^\d+$/.test(trimmed)) {
+        return parseInt(trimmed, 10) * 1000;
+    }
+    const dateMs = Date.parse(trimmed);
+    if (Number.isNaN(dateMs))
+        return null;
+    return Math.max(0, dateMs - now);
+}
+function isNetworkError(err) {
+    if (!(err instanceof Error))
+        return false;
+    const code = err.code;
+    const msg = err.message;
+    return (code === 'ECONNRESET' ||
+        code === 'ECONNREFUSED' ||
+        code === 'ENOTFOUND' ||
+        code === 'ETIMEDOUT' ||
+        code === 'UND_ERR_CONNECT_TIMEOUT' ||
+        msg.includes('ECONNRESET') ||
+        msg.includes('socket hang up') ||
+        msg.includes('UND_ERR') ||
+        msg.includes('fetch failed'));
+}
+function isAbortError(err) {
+    if (!(err instanceof Error))
+        return false;
+    return err.name === 'AbortError' || err.code === 'ABORT_ERR';
+}
+// ---------------------------------------------------------------------------
+// Internal: backoff / sleep
+// ---------------------------------------------------------------------------
+function jitter(baseMs) {
+    return Math.floor(Math.random() * baseMs);
+}
+function backoffMs(attempt, baseMs) {
+    return Math.floor(baseMs * Math.pow(1.5, attempt)) + jitter(baseMs);
+}
+function sleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal.aborted) {
+            reject(signal.reason);
+            return;
+        }
+        const timer = setTimeout(resolve, ms);
+        signal.addEventListener('abort', () => {
+            clearTimeout(timer);
+            reject(signal.reason);
+        }, { once: true });
+    });
+}
+async function dispatchFetch(method, url, extraHeaders, userAgent, signal) {
+    const baseHeaders = {};
+    if (userAgent !== undefined)
+        baseHeaders['user-agent'] = userAgent;
+    const mergedHeaders = { ...baseHeaders, ...extraHeaders };
+    const response = await fetch(url, {
+        method,
+        headers: mergedHeaders,
+        redirect: 'manual',
+        signal,
+    });
+    const headers = {};
+    response.headers.forEach((value, key) => {
+        headers[key.toLowerCase()] = value;
+    });
+    let bodyText = '';
+    if (method === 'GET') {
+        bodyText = await response.text();
+    }
+    else {
+        // Drain the body for HEAD (opaque redirects have empty bodies, but be safe)
+        await response.body?.cancel().catch(() => undefined);
+    }
+    return { status: response.status, headers, bodyText };
+}
+// ---------------------------------------------------------------------------
+// createHttpClient
+// ---------------------------------------------------------------------------
+export function createHttpClient(opts) {
+    const userAgent = opts?.userAgent;
+    const defaultTimeoutMs = opts?.defaultTimeoutMs ?? 10_000;
+    const maxRetries = opts?.maxRetries ?? 2;
+    const retryBaseMs = opts?.retryBaseMs ?? 250;
+    const perOriginConcurrency = opts?.perOriginConcurrency ?? 2;
+    const totalDeadlineMs = opts?.totalDeadlineMs ?? 30_000;
+    const allowPrivateHosts = opts?.allowPrivateHosts === true;
+    // Guard a single hop. The `allowPrivateHosts` test escape hatch bypasses the
+    // private-IP check (so the in-process loopback test server, which only listens
+    // on 127.0.0.1, is reachable across redirects). The scheme restriction is
+    // always enforced, even in test mode. Production callers leave the hatch off,
+    // so every hop — hop 0 and every redirect — is fully guarded.
+    async function guardHop(hopUrl) {
+        if (allowPrivateHosts) {
+            const proto = new URL(hopUrl).protocol;
+            if (proto !== 'http:' && proto !== 'https:') {
+                throw new HttpError(`rejected: unsupported scheme ${proto}`);
+            }
+            return;
+        }
+        await assertNotPrivate(hopUrl);
+    }
+    const queues = new Map();
+    function getQueue(origin) {
+        let q = queues.get(origin);
+        if (q === undefined) {
+            q = new PQueue({ concurrency: perOriginConcurrency });
+            queues.set(origin, q);
+        }
+        return q;
+    }
+    async function withRetry(origin, fn, userSignal, timeoutMs) {
+        const q = getQueue(origin);
+        return q.add(async () => {
+            const startTime = Date.now();
+            let lastError;
+            let lastStatus;
+            // When a retryable response carries Retry-After, prefer it over the
+            // jittered backoff for the *next* sleep.
+            let retryAfterMs = null;
+            for (let attempt = 0; attempt <= maxRetries; attempt++) {
+                if (userSignal !== undefined && userSignal.aborted) {
+                    throw userSignal.reason;
+                }
+                const elapsed = Date.now() - startTime;
+                if (attempt > 0 && elapsed > totalDeadlineMs) {
+                    break;
+                }
+                const signals = [AbortSignal.timeout(timeoutMs)];
+                if (userSignal !== undefined)
+                    signals.push(userSignal);
+                const combined = AbortSignal.any(signals);
+                retryAfterMs = null;
+                try {
+                    const result = await fn(combined);
+                    if (isRetryableStatus(result.status)) {
+                        lastStatus = result.status;
+                        lastError = new HttpError(`HTTP ${result.status}`, result.status);
+                        retryAfterMs = parseRetryAfterMs(result.headers['retry-after']);
+                    }
+                    else {
+                        return result;
+                    }
+                }
+                catch (err) {
+                    if (isAbortError(err)) {
+                        if (userSignal !== undefined && userSignal.aborted)
+                            throw err;
+                        // Per-attempt timeout — retryable
+                        lastError = err;
+                    }
+                    else if (isNetworkError(err)) {
+                        lastError = err;
+                    }
+                    else {
+                        throw err;
+                    }
+                }
+                if (attempt < maxRetries) {
+                    const remaining = Math.max(0, totalDeadlineMs - (Date.now() - startTime));
+                    // Honor Retry-After when present; otherwise use jittered backoff.
+                    // Either way the sleep is capped against the total deadline so a
+                    // hostile/large Retry-After cannot stall the run past its budget.
+                    const baseDelay = retryAfterMs !== null ? retryAfterMs : backoffMs(attempt, retryBaseMs);
+                    const delay = Math.min(baseDelay, remaining);
+                    const sleepSignals = [AbortSignal.timeout(remaining)];
+                    if (userSignal !== undefined)
+                        sleepSignals.push(userSignal);
+                    const sleepSig = AbortSignal.any(sleepSignals);
+                    try {
+                        await sleep(delay, sleepSig);
+                    }
+                    catch {
+                        if (userSignal !== undefined && userSignal.aborted)
+                            throw userSignal.reason;
+                        break;
+                    }
+                }
+            }
+            if (lastError instanceof HttpError)
+                throw lastError;
+            if (lastError !== undefined) {
+                throw new HttpError(`Request failed after ${maxRetries} retries`, lastStatus, lastError);
+            }
+            throw new HttpError(`Request failed: exceeded total deadline`, lastStatus);
+        });
+    }
+    async function get(url, reqOpts) {
+        const timeoutMs = reqOpts?.timeoutMs ?? defaultTimeoutMs;
+        const origin = new URL(url).origin;
+        const result = await withRetry(origin, (signal) => dispatchFetch('GET', url, reqOpts?.headers ?? {}, userAgent, signal), reqOpts?.signal, timeoutMs);
+        const contentType = result.headers['content-type'] ?? '';
+        let body = result.bodyText;
+        if (contentType.includes('application/json')) {
+            try {
+                body = JSON.parse(result.bodyText);
+            }
+            catch {
+                // leave as string
+            }
+        }
+        return { status: result.status, headers: result.headers, body };
+    }
+    async function head(url, headOpts) {
+        const followRedirects = headOpts?.followRedirects !== false;
+        const maxRedirects = headOpts?.maxRedirects ?? 5;
+        const timeoutMs = headOpts?.timeoutMs ?? defaultTimeoutMs;
+        const userSignal = headOpts?.signal;
+        if (!followRedirects) {
+            // SSRF guard on the (only) hop: scheme + private-IP rejection.
+            await guardHop(url);
+            const origin = new URL(url).origin;
+            const result = await withRetry(origin, (signal) => dispatchFetch('HEAD', url, headOpts?.headers ?? {}, userAgent, signal), userSignal, timeoutMs);
+            return { status: result.status, finalUrl: url, redirectChain: [] };
+        }
+        const redirectChain = [];
+        let currentUrl = url;
+        // SSRF guard on hop 0 (the initial URL) — scheme + private-IP rejection —
+        // *before* any request is dispatched.
+        await guardHop(currentUrl);
+        for (;;) {
+            const origin = new URL(currentUrl).origin;
+            const result = await withRetry(origin, (signal) => dispatchFetch('HEAD', currentUrl, headOpts?.headers ?? {}, userAgent, signal), userSignal, timeoutMs);
+            const { status, headers } = result;
+            if (status >= 300 && status < 400) {
+                const location = headers['location'];
+                if (location === undefined || location === '') {
+                    return { status, finalUrl: currentUrl, redirectChain };
+                }
+                if (redirectChain.length >= maxRedirects) {
+                    throw new HttpError(`too-many-redirects: exceeded ${maxRedirects} hops`);
+                }
+                redirectChain.push(currentUrl);
+                const nextUrl = new URL(location, currentUrl).href;
+                // SSRF guard on EVERY redirect hop, regardless of host equality:
+                // scheme + private-IP rejection. Redirect hops are never exempted by
+                // the test escape hatch.
+                await guardHop(nextUrl);
+                currentUrl = nextUrl;
+                continue;
+            }
+            // HEAD returned 4xx but not 404 — try GET+Range fallback
+            if (status >= 400 && status < 500 && status !== 404) {
+                const getHeaders = { ...(headOpts?.headers ?? {}), range: 'bytes=0-0' };
+                const origin2 = new URL(currentUrl).origin;
+                const getResult = await withRetry(origin2, (signal) => dispatchFetch('GET', currentUrl, getHeaders, userAgent, signal), userSignal, timeoutMs);
+                return { status: getResult.status, finalUrl: currentUrl, redirectChain };
+            }
+            return { status, finalUrl: currentUrl, redirectChain };
+        }
+    }
+    return { get, head };
+}
+export async function headCheck(url, opts, signal) {
+    const cacheKey = 'headCheck:' + url;
+    if (opts.cache !== undefined) {
+        const cached = await opts.cache.get(cacheKey, signal);
+        if (cached !== null)
+            return cached;
+    }
+    let result;
+    // SSRF: enforce the trusted-host allowlist on the INPUT host BEFORE
+    // dispatching any request. A bibliography entry pointing at a metadata
+    // endpoint or an untrusted host must never be fetched at all.
+    let inputHost;
+    try {
+        inputHost = new URL(url).hostname.toLowerCase();
+    }
+    catch {
+        const out = { ok: false, reason: 'network-error', details: 'invalid URL' };
+        if (opts.cache !== undefined)
+            await opts.cache.set(cacheKey, out);
+        return out;
+    }
+    if (!isHostAllowed(inputHost, opts.trustedHosts)) {
+        const out = { ok: false, reason: 'wrong-host', details: inputHost };
+        if (opts.cache !== undefined)
+            await opts.cache.set(cacheKey, out);
+        return out;
+    }
+    try {
+        const response = await opts.http.head(url, { signal });
+        const host = new URL(response.finalUrl).hostname.toLowerCase();
+        if (!isHostAllowed(host, opts.trustedHosts)) {
+            result = { ok: false, reason: 'wrong-host', details: host };
+        }
+        else if (response.status >= 400) {
+            result = { ok: false, reason: 'dead-url', details: String(response.status) };
+        }
+        else {
+            result = {
+                ok: true,
+                status: response.status,
+                finalUrl: response.finalUrl,
+                redirectChain: response.redirectChain,
+                host,
+            };
+        }
+    }
+    catch (err) {
+        if (isAbortError(err) && !(err instanceof HttpError)) {
+            throw err;
+        }
+        if (err instanceof HttpError) {
+            const msg = err.message;
+            if (msg.includes('rejected: private IP')) {
+                result = { ok: false, reason: 'wrong-host', details: 'redirect to private IP rejected' };
+            }
+            else if (msg.includes('too-many-redirects')) {
+                result = { ok: false, reason: 'too-many-redirects', details: msg };
+            }
+            else if (isAbortError(err)) {
+                result = { ok: false, reason: 'timeout', details: msg };
+            }
+            else {
+                result = { ok: false, reason: 'network-error', details: msg };
+            }
+        }
+        else {
+            const msg = err instanceof Error ? err.message : String(err);
+            result = { ok: false, reason: 'network-error', details: msg };
+        }
+    }
+    if (opts.cache !== undefined) {
+        await opts.cache.set(cacheKey, result);
+    }
+    return result;
+}
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,MAAM,MAAM,SAAS,CAAC;AAC7B,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAmDhC,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,OAAO,SAAU,SAAQ,KAAK;IACzB,IAAI,GAAG,WAAoB,CAAC;IAC5B,MAAM,CAAqB;IAClB,KAAK,CAAU;IAEjC,YAAY,OAAe,EAAE,MAAe,EAAE,KAAe;QAC3D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,OAAO,KAAK,CAAC,iBAAiB,KAAK,UAAU,EAAE,CAAC;YAClD,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;CACF;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,CAAS,EAAE,CAAS;IAC/C,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAA4B,0BAA0B;IAC/E,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAA0B,uBAAuB;IAC5E,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC,CAA2B,aAAa;IAClE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,CAAI,gBAAgB;IACrE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAa,iBAAiB;IACtE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAa,4BAA4B;IACjF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,CAAG,sBAAsB;IAC3E,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,CAAS,CAAC;IACd,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACzB,CAAC;SAAM,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACxB,CAAC;SAAM,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACzB,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,UAAU;QAAE,OAAO,IAAI,CAAC;IAChE,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAU;IACpC,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAE/B,oCAAoC;IACpC,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,WAAW;IAC5F,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAA+B,YAAY;IAE7F,yEAAyE;IACzE,yCAAyC;IACzC,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,oBAAoB;IACpB,IAAI,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;QACrB,oBAAoB;QACpB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,CAAC,yCAAyC;QAC/F,OAAO,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnC,CAAC;IAED,+CAA+C;IAC/C,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACf,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;QAC5B,OAAO,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAkC;IACjE,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzE,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,SAAmB;IAC7D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,GAAG,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,mCAAmC;AACnC,8EAA8E;AAE9E;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAAC,GAAW;IACzC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,SAAS,CAAC,gCAAgC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,8EAA8E;IAC9E,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC/B,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IAED,2EAA2E;IAC3E,8EAA8E;IAC9E,oCAAoC;IACpC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,gBAAgB,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;QACzG,IAAI,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,SAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CAAC,6BAA6B,QAAQ,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IAC/E,CAAC;IACD,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,SAAS,EAAE,CAAC;QACpC,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E,SAAS,iBAAiB,CAAC,MAAc;IACvC,uEAAuE;IACvE,4EAA4E;IAC5E,iCAAiC;IACjC,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,IAAI,GAAG,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAyB,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IACnF,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC;IACtC,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;IACjD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC;IACxB,OAAO,CACL,IAAI,KAAK,YAAY;QACrB,IAAI,KAAK,cAAc;QACvB,IAAI,KAAK,WAAW;QACpB,IAAI,KAAK,WAAW;QACpB,IAAI,KAAK,yBAAyB;QAClC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC1B,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAC9B,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;QACvB,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAC7B,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,GAAG,CAAC,IAAI,KAAK,YAAY,IAAK,GAA6B,CAAC,IAAI,KAAK,WAAW,CAAC;AAC1F,CAAC;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,SAAS,MAAM,CAAC,MAAc;IAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,SAAS,CAAC,OAAe,EAAE,MAAc;IAChD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,KAAK,CAAC,EAAU,EAAE,MAAmB;IAC5C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACtC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE;YACpC,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAYD,KAAK,UAAU,aAAa,CAC1B,MAAsB,EACtB,GAAW,EACX,YAAoC,EACpC,SAA6B,EAC7B,MAAmB;IAEnB,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,IAAI,SAAS,KAAK,SAAS;QAAE,WAAW,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC;IACnE,MAAM,aAAa,GAAG,EAAE,GAAG,WAAW,EAAE,GAAG,YAAY,EAAE,CAAC;IAE1D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM;QACN,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,QAAQ;QAClB,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACtC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,CAAC;SAAM,CAAC;QACN,4EAA4E;QAC5E,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACxD,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,MAAM,UAAU,gBAAgB,CAAC,IAA8B;IAC7D,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,CAAC;IAClC,MAAM,gBAAgB,GAAG,IAAI,EAAE,gBAAgB,IAAI,MAAM,CAAC;IAC1D,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,IAAI,CAAC,CAAC;IACzC,MAAM,WAAW,GAAG,IAAI,EAAE,WAAW,IAAI,GAAG,CAAC;IAC7C,MAAM,oBAAoB,GAAG,IAAI,EAAE,oBAAoB,IAAI,CAAC,CAAC;IAC7D,MAAM,eAAe,GAAG,IAAI,EAAE,eAAe,IAAI,MAAM,CAAC;IACxD,MAAM,iBAAiB,GAAG,IAAI,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAE3D,6EAA6E;IAC7E,+EAA+E;IAC/E,0EAA0E;IAC1E,8EAA8E;IAC9E,8DAA8D;IAC9D,KAAK,UAAU,QAAQ,CAAC,MAAc;QACpC,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;YACvC,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC5C,MAAM,IAAI,SAAS,CAAC,gCAAgC,KAAK,EAAE,CAAC,CAAC;YAC/D,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEzC,SAAS,QAAQ,CAAC,MAAc;QAC9B,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACpB,CAAC,GAAG,IAAI,MAAM,CAAC,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC,CAAC;YACtD,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,KAAK,UAAU,SAAS,CACtB,MAAc,EACd,EAAoD,EACpD,UAAmC,EACnC,SAAiB;QAEjB,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAE3B,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,IAA6B,EAAE;YAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,IAAI,SAAkB,CAAC;YACvB,IAAI,UAA8B,CAAC;YACnC,oEAAoE;YACpE,yCAAyC;YACzC,IAAI,YAAY,GAAkB,IAAI,CAAC;YAEvC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;gBACvD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;oBACnD,MAAM,UAAU,CAAC,MAAe,CAAC;gBACnC,CAAC;gBAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBACvC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,eAAe,EAAE,CAAC;oBAC7C,MAAM;gBACR,CAAC;gBAED,MAAM,OAAO,GAAkB,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;gBAChE,IAAI,UAAU,KAAK,SAAS;oBAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACvD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAE1C,YAAY,GAAG,IAAI,CAAC;gBACpB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC;oBAElC,IAAI,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;wBACrC,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;wBAC3B,SAAS,GAAG,IAAI,SAAS,CAAC,QAAQ,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;wBAClE,YAAY,GAAG,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;oBAClE,CAAC;yBAAM,CAAC;wBACN,OAAO,MAAM,CAAC;oBAChB,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;wBACtB,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,OAAO;4BAAE,MAAM,GAAG,CAAC;wBAC9D,kCAAkC;wBAClC,SAAS,GAAG,GAAG,CAAC;oBAClB,CAAC;yBAAM,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC/B,SAAS,GAAG,GAAG,CAAC;oBAClB,CAAC;yBAAM,CAAC;wBACN,MAAM,GAAG,CAAC;oBACZ,CAAC;gBACH,CAAC;gBAED,IAAI,OAAO,GAAG,UAAU,EAAE,CAAC;oBACzB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,eAAe,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC;oBAC1E,kEAAkE;oBAClE,iEAAiE;oBACjE,kEAAkE;oBAClE,MAAM,SAAS,GAAG,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;oBACzF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;oBAC7C,MAAM,YAAY,GAAkB,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;oBACrE,IAAI,UAAU,KAAK,SAAS;wBAAE,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBAC5D,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;oBAC/C,IAAI,CAAC;wBACH,MAAM,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;oBAC/B,CAAC;oBAAC,MAAM,CAAC;wBACP,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,OAAO;4BAAE,MAAM,UAAU,CAAC,MAAe,CAAC;wBACrF,MAAM;oBACR,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,SAAS,YAAY,SAAS;gBAAE,MAAM,SAAS,CAAC;YACpD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,IAAI,SAAS,CACjB,wBAAwB,UAAU,UAAU,EAC5C,UAAU,EACV,SAAS,CACV,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,SAAS,CAAC,yCAAyC,EAAE,UAAU,CAAC,CAAC;QAC7E,CAAC,CAA4B,CAAC;IAChC,CAAC;IAED,KAAK,UAAU,GAAG,CAAC,GAAW,EAAE,OAA4B;QAC1D,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,gBAAgB,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QAEnC,MAAM,MAAM,GAAG,MAAM,SAAS,CAC5B,MAAM,EACN,CAAC,MAAM,EAAE,EAAE,CACT,aAAa,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,EACtE,OAAO,EAAE,MAAM,EACf,SAAS,CACV,CAAC;QAEF,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACzD,IAAI,IAAI,GAAY,MAAM,CAAC,QAAQ,CAAC;QACpC,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAY,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,kBAAkB;YACpB,CAAC;QACH,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;IAClE,CAAC;IAED,KAAK,UAAU,IAAI,CAAC,GAAW,EAAE,QAA0B;QACzD,MAAM,eAAe,GAAG,QAAQ,EAAE,eAAe,KAAK,KAAK,CAAC;QAC5D,MAAM,YAAY,GAAG,QAAQ,EAAE,YAAY,IAAI,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,QAAQ,EAAE,SAAS,IAAI,gBAAgB,CAAC;QAC1D,MAAM,UAAU,GAAG,QAAQ,EAAE,MAAM,CAAC;QAEpC,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,+DAA+D;YAC/D,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACpB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;YACnC,MAAM,MAAM,GAAG,MAAM,SAAS,CAC5B,MAAM,EACN,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,EAClF,UAAU,EACV,SAAS,CACV,CAAC;YACF,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;QACrE,CAAC;QAED,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,IAAI,UAAU,GAAG,GAAG,CAAC;QACrB,0EAA0E;QAC1E,sCAAsC;QACtC,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC;QAE3B,SAAS,CAAC;YACR,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;YAC1C,MAAM,MAAM,GAAG,MAAM,SAAS,CAC5B,MAAM,EACN,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,EACzF,UAAU,EACV,SAAS,CACV,CAAC;YAEF,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;YAEnC,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;gBAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;gBACrC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;oBAC9C,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;gBACzD,CAAC;gBACD,IAAI,aAAa,CAAC,MAAM,IAAI,YAAY,EAAE,CAAC;oBACzC,MAAM,IAAI,SAAS,CAAC,gCAAgC,YAAY,OAAO,CAAC,CAAC;gBAC3E,CAAC;gBACD,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC/B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC;gBACnD,iEAAiE;gBACjE,qEAAqE;gBACrE,yBAAyB;gBACzB,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACxB,UAAU,GAAG,OAAO,CAAC;gBACrB,SAAS;YACX,CAAC;YAED,yDAAyD;YACzD,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBACpD,MAAM,UAAU,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;gBACxE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;gBAC3C,MAAM,SAAS,GAAG,MAAM,SAAS,CAC/B,OAAO,EACP,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,EAC3E,UAAU,EACV,SAAS,CACV,CAAC;gBACF,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;YAC3E,CAAC;YAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;QACzD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AACvB,CAAC;AAoBD,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAW,EACX,IAAsB,EACtB,MAAmB;IAEnB,MAAM,QAAQ,GAAG,YAAY,GAAG,GAAG,CAAC;IAEpC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvE,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC;IACrC,CAAC;IAED,IAAI,MAAuB,CAAC;IAE5B,oEAAoE;IACpE,uEAAuE;IACvE,8DAA8D;IAC9D,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,GAAoB,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;QAC5F,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAClE,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACjD,MAAM,GAAG,GAAoB,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QACrF,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAClE,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAE/D,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5C,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC9D,CAAC;aAAM,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAClC,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/E,CAAC;aAAM,CAAC;YACN,MAAM,GAAG;gBACP,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,aAAa,EAAE,QAAQ,CAAC,aAAa;gBACrC,IAAI;aACL,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,YAAY,SAAS,CAAC,EAAE,CAAC;YACrD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,GAAG,YAAY,SAAS,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC;YACxB,IAAI,GAAG,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;gBACzC,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC;YAC3F,CAAC;iBAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBAC9C,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;YACrE,CAAC;iBAAM,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;YAC1D,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;YAChE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAChE,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/identifiers.d.ts

@@ -0,0 +1,44 @@
+/**
+ * bibcheck identifiers — local, offline DOI / ISBN / URL well-formedness checks.
+ *
+ * A pure functional-core module: no I/O, all input passed as arguments. It runs
+ * BEFORE any network call and catches the large class of AI-fabricated citations
+ * that carry a malformed identifier (a transposed ISBN digit, a DOI with stray
+ * punctuation, a non-URL in `url:`) — the cheapest, highest-yield hallucination
+ * signal. Emits the `IdentifiersLayer` from the output schema.
+ *
+ * No runtime dependencies: ISBN check-digit validation and normalization are
+ * hand-rolled (both are small, well-specified algorithms).
+ */
+import type { CslEntry } from './schema/csl.js';
+import type { IdentifiersLayer } from './schema/output.js';
+export interface RunIdentifiersDeps {
+    bibliography: CslEntry[];
+}
+export interface RunIdentifiersResult {
+    entries: Array<{
+        citekey: string;
+        identifiers: IdentifiersLayer;
+    }>;
+}
+/** Validate a DOI string. */
+export declare function validateDoi(doi: string): 'ok' | 'malformed';
+/**
+ * Normalize an ISBN to its bare digit string (hyphens/spaces removed, upper-cased
+ * for a trailing `X`). Returns null when the input is not a 10- or 13-character
+ * ISBN shape. Exposed so callers (e.g. existence cache keys) can key on a
+ * canonical form rather than the raw, variably-hyphenated string.
+ */
+export declare function normalizeIsbn(raw: string): string | null;
+/** Validate an ISBN string (10 or 13). */
+export declare function validateIsbn(isbn: string): 'ok' | 'bad-checksum' | 'malformed';
+/** Validate that a string is a well-formed http/https URL. */
+export declare function validateUrl(url: string): 'ok' | 'malformed';
+/** Compute the identifiers layer for one entry. */
+export declare function identifiersFor(entry: CslEntry): IdentifiersLayer;
+/**
+ * Validate every entry's identifiers. Synchronous, deterministic, no I/O.
+ * Output order matches input order.
+ */
+export declare function runIdentifiers(deps: RunIdentifiersDeps): RunIdentifiersResult;
+//# sourceMappingURL=identifiers.d.ts.map

package/dist/identifiers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identifiers.d.ts","sourceRoot":"","sources":["../src/identifiers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,KAAK,EAAE,gBAAgB,EAAoB,MAAM,oBAAoB,CAAC;AAM7E,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,QAAQ,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAAC;CACpE;AAiBD,6BAA6B;AAC7B,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,WAAW,CAE3D;AAMD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKxD;AAqBD,0CAA0C;AAC1C,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,cAAc,GAAG,WAAW,CAK9E;AAMD,8DAA8D;AAC9D,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,WAAW,CAQ3D;AAWD,mDAAmD;AACnD,wBAAgB,cAAc,CAAC,KAAK,EAAE,QAAQ,GAAG,gBAAgB,CAKhE;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,oBAAoB,CAO7E"}