@devorash/node 0.1.0

package/dist/scope-config.js

@@ -0,0 +1,199 @@
+/**
+ * Scope configuration fetching and caching for backend SDK
+ *
+ * Fetches centrally managed whitelist and blacklist configuration from the Devora platform
+ * and caches it with automatic refresh.
+ *
+ * @module @devorash/node
+ */
+import { SDK_DEFAULTS, createLogger } from "@devorash/core";
+import { controlPlaneFetch, readBoundedJsonObject } from "./transport.js";
+/** Largest accepted policy: entries per list, and the longest pattern. */
+const MAX_POLICY_ENTRIES = 1000;
+const MAX_PATTERN_LENGTH = 500;
+/** A server-sent cache horizon is never trusted beyond this. */
+const MAX_POLICY_TTL_MS = 60 * 60 * 1000;
+function readEndpoints(value) {
+    if (!Array.isArray(value) || value.length > MAX_POLICY_ENTRIES)
+        return null;
+    const endpoints = [];
+    for (const entry of value) {
+        const method = entry?.method;
+        const pattern = entry?.pattern;
+        if (typeof method !== "string" ||
+            !/^(\*|[A-Z]{3,7})(?![\s\S])/.test(method) ||
+            typeof pattern !== "string" ||
+            !pattern ||
+            pattern.length > MAX_PATTERN_LENGTH)
+            return null;
+        endpoints.push({ method, pattern });
+    }
+    return endpoints;
+}
+/** Validate a policy response; `null` when any part is malformed (fail closed). */
+function readPolicy(data, now) {
+    if (!data || typeof data !== "object" || Array.isArray(data))
+        return null;
+    const source = data;
+    const safeReadEndpoints = readEndpoints(source.safeReadEndpoints);
+    const blockedEndpoints = readEndpoints(source.blockedEndpoints);
+    const version = source.version;
+    const requested = source.cachedUntil;
+    // Missing policy fields must not become an empty deny list. The server
+    // always sends all four fields, including an explicit version zero.
+    if (!safeReadEndpoints ||
+        !blockedEndpoints ||
+        typeof version !== "number" ||
+        !Number.isSafeInteger(version) ||
+        version < 0 ||
+        typeof requested !== "number" ||
+        !Number.isSafeInteger(requested) ||
+        requested <= 0)
+        return null;
+    return {
+        safeReadEndpoints,
+        blockedEndpoints,
+        version: version,
+        cachedUntil: Math.min(Math.max(requested, now), now + MAX_POLICY_TTL_MS),
+    };
+}
+/** How long a cached policy may be served past its window during an outage. */
+export const STALE_GRACE_MS = 5 * 60 * 1000;
+const DEFAULT_CACHE_TTL_MS = 5 * 60 * 1000;
+/**
+ * Create a scope config fetcher
+ *
+ * Handles fetching scope configuration from Devora API with caching
+ * and automatic background refresh.
+ */
+export function createScopeConfigFetcher(options) {
+    const { signRequest, apiUrl = SDK_DEFAULTS.API_URL, debug = false, cacheTtlMs = DEFAULT_CACHE_TTL_MS, } = options;
+    if (!Number.isSafeInteger(cacheTtlMs) || cacheTtlMs <= 0 || cacheTtlMs > MAX_POLICY_TTL_MS)
+        throw new Error("Devora SDK: cacheTtlMs must be an integer between 1 and 3600000");
+    const logger = createLogger("Devora ScopeConfig", debug);
+    let cachedConfig = null;
+    let refreshTimer = null;
+    let pendingFetch = null;
+    let etag = null;
+    let staleUntil = 0;
+    /**
+     * Fetch scope config from Devora API
+     */
+    async function fetchConfig() {
+        if (pendingFetch)
+            return pendingFetch;
+        pendingFetch = (async () => {
+            try {
+                const response = await controlPlaneFetch(`${apiUrl}/api/sdk/scope-config`, {
+                    method: "GET",
+                    headers: {
+                        ...signRequest(),
+                        ...(etag ? { "If-None-Match": etag } : {}),
+                    },
+                });
+                if (response.status === 304 && cachedConfig) {
+                    // A 304 re-validates the whole server window. Using a shorter TTL
+                    // here would multiply request volume against the per-key rate limit.
+                    const cachedUntil = Date.now() + cacheTtlMs;
+                    cachedConfig = { ...cachedConfig, cachedUntil };
+                    staleUntil = cachedUntil + STALE_GRACE_MS;
+                    return cachedConfig;
+                }
+                if (!response.ok) {
+                    logger.warn("Failed to fetch scope config:", response.status);
+                    return cachedConfig && Date.now() < staleUntil ? cachedConfig : null;
+                }
+                const result = await readBoundedJsonObject(response);
+                const config = result.success === true ? readPolicy(result.data, Date.now()) : null;
+                if (!config) {
+                    logger.warn("Invalid scope config response");
+                    return cachedConfig && Date.now() < staleUntil ? cachedConfig : null;
+                }
+                const previousVersion = cachedConfig?.version;
+                etag = response.headers.get("etag");
+                cachedConfig = config;
+                staleUntil = config.cachedUntil + STALE_GRACE_MS;
+                if (previousVersion === undefined || config.version !== previousVersion) {
+                    logger.log("Scope config updated", {
+                        version: config.version,
+                        whitelist: config.safeReadEndpoints.length,
+                        blacklist: config.blockedEndpoints.length,
+                    });
+                }
+                return cachedConfig;
+            }
+            catch (e) {
+                logger.warn("Error fetching scope config:", e);
+                return cachedConfig && Date.now() < staleUntil ? cachedConfig : null;
+            }
+            finally {
+                pendingFetch = null;
+            }
+        })();
+        return pendingFetch;
+    }
+    /**
+     * Schedule background refresh
+     */
+    function scheduleRefresh() {
+        if (refreshTimer) {
+            clearTimeout(refreshTimer);
+        }
+        // Refresh 30s before expiry. The floor must stay below the window or the
+        // timer can never keep the cache warm and requests pay a synchronous fetch.
+        const refreshIn = cachedConfig?.cachedUntil
+            ? Math.max(cachedConfig.cachedUntil - Date.now() - 30_000, Math.min(cacheTtlMs / 2, 60_000))
+            : cacheTtlMs;
+        refreshTimer = setTimeout(async () => {
+            await fetchConfig();
+            scheduleRefresh();
+        }, refreshIn);
+        // Don't let the background refresh loop keep a process (script, test, serverless
+        // invocation) alive on its own.
+        refreshTimer.unref?.();
+    }
+    /**
+     * Get config (fetch if not cached or expired)
+     */
+    async function getConfig() {
+        // Return cached if still valid
+        if (cachedConfig && Date.now() < cachedConfig.cachedUntil) {
+            return cachedConfig;
+        }
+        // Fetch fresh config
+        const config = await fetchConfig();
+        // Schedule background refresh
+        if (config && !refreshTimer) {
+            scheduleRefresh();
+        }
+        return config;
+    }
+    /**
+     * Get cached config without fetching
+     */
+    function getCachedConfig() {
+        return cachedConfig;
+    }
+    /**
+     * Force refresh config
+     */
+    async function refresh() {
+        return fetchConfig();
+    }
+    /**
+     * Stop background refresh
+     */
+    function stop() {
+        if (refreshTimer) {
+            clearTimeout(refreshTimer);
+            refreshTimer = null;
+        }
+    }
+    return {
+        getConfig,
+        getCachedConfig,
+        refresh,
+        stop,
+    };
+}
+//# sourceMappingURL=scope-config.js.map

package/dist/scope-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-config.js","sourceRoot":"","sources":["../src/scope-config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAE,YAAY,EAAe,MAAM,gBAAgB,CAAA;AACxE,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AAEzE,0EAA0E;AAC1E,MAAM,kBAAkB,GAAG,IAAI,CAAA;AAC/B,MAAM,kBAAkB,GAAG,GAAG,CAAA;AAC9B,gEAAgE;AAChE,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAExC,SAAS,aAAa,CAAC,KAAc;IACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB;QAAE,OAAO,IAAI,CAAA;IAC3E,MAAM,SAAS,GAAoB,EAAE,CAAA;IACrC,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAI,KAAqC,EAAE,MAAM,CAAA;QAC7D,MAAM,OAAO,GAAI,KAAsC,EAAE,OAAO,CAAA;QAChE,IACC,OAAO,MAAM,KAAK,QAAQ;YAC1B,CAAC,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC;YAC1C,OAAO,OAAO,KAAK,QAAQ;YAC3B,CAAC,OAAO;YACR,OAAO,CAAC,MAAM,GAAG,kBAAkB;YAEnC,OAAO,IAAI,CAAA;QACZ,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;IACpC,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAED,mFAAmF;AACnF,SAAS,UAAU,CAAC,IAAa,EAAE,GAAW;IAC7C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACzE,MAAM,MAAM,GAAG,IAA+B,CAAA;IAC9C,MAAM,iBAAiB,GAAG,aAAa,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAA;IACjE,MAAM,gBAAgB,GAAG,aAAa,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;IAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;IAC9B,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAA;IACpC,uEAAuE;IACvE,oEAAoE;IACpE,IACC,CAAC,iBAAiB;QAClB,CAAC,gBAAgB;QACjB,OAAO,OAAO,KAAK,QAAQ;QAC3B,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;QAC9B,OAAO,GAAG,CAAC;QACX,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC;QAChC,SAAS,IAAI,CAAC;QAEd,OAAO,IAAI,CAAA;IACZ,OAAO;QACN,iBAAiB;QACjB,gBAAgB;QAChB,OAAO,EAAE,OAAiB;QAC1B,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,GAAG,GAAG,iBAAiB,CAAC;KACxE,CAAA;AACF,CAAC;AAgDD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAC3C,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAE1C;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAkC;IAM1E,MAAM,EACL,WAAW,EACX,MAAM,GAAG,YAAY,CAAC,OAAO,EAC7B,KAAK,GAAG,KAAK,EACb,UAAU,GAAG,oBAAoB,GACjC,GAAG,OAAO,CAAA;IACX,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,IAAI,UAAU,GAAG,iBAAiB;QACzF,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;IAEnF,MAAM,MAAM,GAAW,YAAY,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAA;IAEhE,IAAI,YAAY,GAAuB,IAAI,CAAA;IAC3C,IAAI,YAAY,GAAyC,IAAI,CAAA;IAC7D,IAAI,YAAY,GAAuC,IAAI,CAAA;IAC3D,IAAI,IAAI,GAAkB,IAAI,CAAA;IAC9B,IAAI,UAAU,GAAG,CAAC,CAAA;IAElB;;OAEG;IACH,KAAK,UAAU,WAAW;QACzB,IAAI,YAAY;YAAE,OAAO,YAAY,CAAA;QACrC,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,IAAI,CAAC;gBACJ,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,GAAG,MAAM,uBAAuB,EAAE;oBAC1E,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE;wBACR,GAAG,WAAW,EAAE;wBAChB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC1C;iBACD,CAAC,CAAA;gBACF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;oBAC7C,kEAAkE;oBAClE,qEAAqE;oBACrE,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAA;oBAC3C,YAAY,GAAG,EAAE,GAAG,YAAY,EAAE,WAAW,EAAE,CAAA;oBAC/C,UAAU,GAAG,WAAW,GAAG,cAAc,CAAA;oBACzC,OAAO,YAAY,CAAA;gBACpB,CAAC;gBAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBAClB,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;oBAC7D,OAAO,YAAY,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAA;gBACrE,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAA;gBACpD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;gBACnF,IAAI,CAAC,MAAM,EAAE,CAAC;oBACb,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAA;oBAC5C,OAAO,YAAY,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAA;gBACrE,CAAC;gBAED,MAAM,eAAe,GAAG,YAAY,EAAE,OAAO,CAAA;gBAC7C,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;gBACnC,YAAY,GAAG,MAAM,CAAA;gBACrB,UAAU,GAAG,MAAM,CAAC,WAAW,GAAG,cAAc,CAAA;gBAChD,IAAI,eAAe,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;oBACzE,MAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE;wBAClC,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,SAAS,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;wBAC1C,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC,MAAM;qBACzC,CAAC,CAAA;gBACH,CAAC;gBAED,OAAO,YAAY,CAAA;YACpB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACZ,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,CAAC,CAAC,CAAA;gBAC9C,OAAO,YAAY,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAA;YACrE,CAAC;oBAAS,CAAC;gBACV,YAAY,GAAG,IAAI,CAAA;YACpB,CAAC;QACF,CAAC,CAAC,EAAE,CAAA;QACJ,OAAO,YAAY,CAAA;IACpB,CAAC;IAED;;OAEG;IACH,SAAS,eAAe;QACvB,IAAI,YAAY,EAAE,CAAC;YAClB,YAAY,CAAC,YAAY,CAAC,CAAA;QAC3B,CAAC;QAED,yEAAyE;QACzE,4EAA4E;QAC5E,MAAM,SAAS,GAAG,YAAY,EAAE,WAAW;YAC1C,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;YAC5F,CAAC,CAAC,UAAU,CAAA;QAEb,YAAY,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE;YACpC,MAAM,WAAW,EAAE,CAAA;YACnB,eAAe,EAAE,CAAA;QAClB,CAAC,EAAE,SAAS,CAAC,CAAA;QACb,iFAAiF;QACjF,gCAAgC;QAChC,YAAY,CAAC,KAAK,EAAE,EAAE,CAAA;IACvB,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,SAAS;QACvB,+BAA+B;QAC/B,IAAI,YAAY,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC;YAC3D,OAAO,YAAY,CAAA;QACpB,CAAC;QAED,qBAAqB;QACrB,MAAM,MAAM,GAAG,MAAM,WAAW,EAAE,CAAA;QAElC,8BAA8B;QAC9B,IAAI,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAC7B,eAAe,EAAE,CAAA;QAClB,CAAC;QAED,OAAO,MAAM,CAAA;IACd,CAAC;IAED;;OAEG;IACH,SAAS,eAAe;QACvB,OAAO,YAAY,CAAA;IACpB,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,OAAO;QACrB,OAAO,WAAW,EAAE,CAAA;IACrB,CAAC;IAED;;OAEG;IACH,SAAS,IAAI;QACZ,IAAI,YAAY,EAAE,CAAC;YAClB,YAAY,CAAC,YAAY,CAAC,CAAA;YAC1B,YAAY,GAAG,IAAI,CAAA;QACpB,CAAC;IACF,CAAC;IAED,OAAO;QACN,SAAS;QACT,eAAe;QACf,OAAO;QACP,IAAI;KACJ,CAAA;AACF,CAAC"}

package/dist/sdk.d.ts

@@ -0,0 +1,11 @@
+import type { DevoraBackendSDK, NodeBackendSDKConfig, DevoraEnvironment } from "./types.js";
+/**
+ * Create a Devora Backend SDK instance
+ *
+ * Security: The SDK authenticates requests using HMAC-SHA256 signatures.
+ * The secret key is unique per organization, so valid HMAC = authenticated request.
+ */
+/** Explicit option first, then DEVORA_ENV / NODE_ENV as hints, else production. */
+export declare function resolveEnvironment(explicit?: DevoraEnvironment): DevoraEnvironment;
+export declare function devoraSDK(config: NodeBackendSDKConfig): DevoraBackendSDK;
+//# sourceMappingURL=sdk.d.ts.map

package/dist/sdk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk.d.ts","sourceRoot":"","sources":["../src/sdk.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EACX,gBAAgB,EAEhB,oBAAoB,EAMpB,iBAAiB,EACjB,MAAM,YAAY,CAAA;AA4CnB;;;;;GAKG;AACH,mFAAmF;AACnF,wBAAgB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,iBAAiB,GAAG,iBAAiB,CAKlF;AAED,wBAAgB,SAAS,CAAC,MAAM,EAAE,oBAAoB,GAAG,gBAAgB,CA8ZxE"}

package/dist/sdk.js

@@ -0,0 +1,416 @@
+/**
+ * Main Devora Backend SDK implementation
+ * @module @devorash/node
+ */
+import { DEVORA_ENDPOINTS, ENDPOINT_METHODS, PROTECTED_ENDPOINTS, SDK_DEFAULTS, SDK_PACKAGES, SDK_VERSION, validateTimestamp, SIGNING, SIGNED_HEADER_PATTERNS, buildCanonicalString, hasIdentityContentEncoding, isValidSignedPath, isValidSignedQuery, parseSignatureHeaders, replayExpiresAtMs, replayNamespace, assertTimestampTolerance, isValidTimestampTolerance, createSDKInfo, createLogger, BROWSER_SESSION_BRIDGE, } from "@devorash/core";
+import { sha256Hex, signatureMatches, signRequest } from "./hmac.js";
+import { controlPlaneFetch, readBoundedJsonObject } from "./transport.js";
+import { createScopeConfigFetcher } from "./scope-config.js";
+import { InMemoryReplayStore } from "./replay-store.js";
+/**
+ * Validate secret key format
+ * Expected format: sk_server_live_xxx
+ */
+function validateSecretKeyFormat(secretKey) {
+    return SIGNED_HEADER_PATTERNS.secretKey.test(secretKey)
+        ? { valid: true }
+        : {
+            valid: false,
+            error: "Invalid secret key format. Expected sk_server_live_ followed by 64 characters",
+        };
+}
+/**
+ * Resolve and validate the Devora API origin.
+ * Only https origins are accepted (http for localhost/127.0.0.1 development).
+ */
+function resolveApiUrl(override) {
+    if (!override)
+        return SDK_DEFAULTS.API_URL;
+    let parsed;
+    try {
+        parsed = new URL(override);
+    }
+    catch {
+        throw new Error(`Devora SDK: apiUrl is not a valid URL: ${override}`);
+    }
+    const isLocalhost = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+    if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && isLocalhost)) {
+        throw new Error("Devora SDK: apiUrl must use https (http is allowed for localhost only)");
+    }
+    if (parsed.username ||
+        parsed.password ||
+        (parsed.pathname && parsed.pathname !== "/") ||
+        parsed.search ||
+        parsed.hash) {
+        throw new Error("Devora SDK: apiUrl must be an origin without path, query, or credentials");
+    }
+    return parsed.origin;
+}
+/**
+ * Create a Devora Backend SDK instance
+ *
+ * Security: The SDK authenticates requests using HMAC-SHA256 signatures.
+ * The secret key is unique per organization, so valid HMAC = authenticated request.
+ */
+/** Explicit option first, then DEVORA_ENV / NODE_ENV as hints, else production. */
+export function resolveEnvironment(explicit) {
+    const raw = (explicit ?? process.env.DEVORA_ENV ?? process.env.NODE_ENV ?? "production")
+        .toString()
+        .toLowerCase();
+    return raw === "development" || raw === "test" ? raw : "production";
+}
+export function devoraSDK(config) {
+    // Runtime allowlist: unknown capture/preferences are ignored in JavaScript too.
+    config = {
+        apiKey: config.apiKey,
+        secretKey: config.secretKey,
+        orgId: config.orgId,
+        apiUrl: config.apiUrl,
+        debug: config.debug,
+        timestampTolerance: config.timestampTolerance,
+        logRequests: config.logRequests,
+        logger: config.logger,
+        collectStats: config.collectStats,
+        replayStore: config.replayStore,
+        environment: config.environment,
+    };
+    // Validate configuration
+    if (!config.secretKey) {
+        throw new Error("Devora SDK: secretKey is required");
+    }
+    if (!SIGNED_HEADER_PATTERNS.keyId.test(config.apiKey ?? "")) {
+        throw new Error("Devora SDK: apiKey must be a server key identifier (pk_server_live_*)");
+    }
+    if (!config.orgId?.trim()) {
+        throw new Error("Devora SDK: orgId is required");
+    }
+    assertTimestampTolerance(config.timestampTolerance);
+    const apiUrl = resolveApiUrl(config.apiUrl);
+    // Fail closed: anything that is not explicitly a development/test runtime is
+    // production, and production must share replay protection across instances.
+    const environment = resolveEnvironment(config.environment);
+    if (environment === "production" && !config.replayStore)
+        throw new Error('Devora SDK: replayStore is required in production. Pass a persistent ReplayStore, or set environment: "development" (InMemoryReplayStore) for local development only.');
+    const replayStore = config.replayStore ?? new InMemoryReplayStore();
+    // Validate secret key format (security check)
+    const secretKeyValidation = validateSecretKeyFormat(config.secretKey);
+    if (!secretKeyValidation.valid) {
+        throw new Error(`Devora SDK: ${secretKeyValidation.error}`);
+    }
+    // Initialize logger - uses global config by default, can be overridden with debug option
+    const logger = createLogger("Devora SDK", config.debug);
+    // SDK info
+    const info = createSDKInfo(SDK_PACKAGES.NODE, "backend", "node");
+    // Statistics
+    const stats = {
+        totalRequests: 0,
+        successfulRequests: 0,
+        failedRequests: 0,
+        securityErrors: 0,
+        requestsByEndpoint: {},
+    };
+    // Registered routes
+    const routes = [];
+    const scopeConfig = createScopeConfigFetcher({
+        apiKey: config.apiKey,
+        signRequest: () => signRequest({
+            secretKey: config.secretKey,
+            direction: SIGNING.CUSTOMER_TO_DEVORA,
+            keyId: config.apiKey,
+            orgId: config.orgId,
+            method: "GET",
+            path: "/api/sdk/scope-config",
+        }),
+        apiUrl,
+        debug: config.debug,
+    });
+    const ready = scopeConfig.getConfig().then((policy) => {
+        if (!policy) {
+            logger.warn("Scope policy could not be loaded; getScopeConfig() may return null until refresh succeeds");
+        }
+    });
+    // Register built-in routes
+    registerBuiltInRoutes();
+    /**
+     * Register built-in /test and /health endpoints
+     */
+    function registerBuiltInRoutes() {
+        // Test endpoint
+        routes.push({
+            path: DEVORA_ENDPOINTS.TEST,
+            method: "GET",
+            isBuiltIn: true,
+            handler: async (req) => {
+                logger.log("Test endpoint called", { orgId: req.orgId, keyId: req.keyId });
+                return {
+                    status: "success",
+                    message: "Devora SDK connection test successful",
+                    timestamp: Date.now(),
+                    orgId: req.orgId,
+                    keyId: req.keyId,
+                    sdk: info,
+                    security: {
+                        hmacValidated: true,
+                        timestampValid: true,
+                    },
+                };
+            },
+        });
+        // Health endpoint
+        routes.push({
+            path: DEVORA_ENDPOINTS.HEALTH,
+            method: "GET",
+            isBuiltIn: true,
+            handler: async () => {
+                const endpointMap = {};
+                for (const route of routes) {
+                    endpointMap[route.path] = route.method;
+                }
+                return {
+                    status: "healthy",
+                    sdk: info,
+                    stats: config.collectStats ? { ...stats } : undefined,
+                    endpoints: endpointMap,
+                };
+            },
+        });
+    }
+    /**
+     * Register a new endpoint handler
+     */
+    function register(path, handler, options) {
+        // Check if path is a predefined endpoint
+        const isPredefined = Object.values(DEVORA_ENDPOINTS).includes(path);
+        // Check if it's a protected endpoint
+        if (PROTECTED_ENDPOINTS.includes(path)) {
+            throw new Error(`Cannot override protected endpoint: ${path}. This endpoint is built into the SDK.`);
+        }
+        // Auto-detect method if using predefined endpoints
+        let method = options?.method ?? "GET";
+        if (isPredefined) {
+            method = ENDPOINT_METHODS[path];
+            logger.log(`Using predefined endpoint: ${path}`, { method });
+        }
+        else if (config.debug) {
+            logger.warn(`Using custom endpoint path: ${path}. Consider using DEVORA_ENDPOINTS constants for consistency.`);
+        }
+        // Check for duplicates (including built-in routes not caught by PROTECTED_ENDPOINTS)
+        const existingRoute = routes.find((r) => r.path === path);
+        if (existingRoute) {
+            const routeType = existingRoute.isBuiltIn ? "built-in" : "custom";
+            throw new Error(`Endpoint already registered: ${path} (existing route is ${routeType})`);
+        }
+        const route = {
+            path,
+            method,
+            handler,
+            isBuiltIn: false,
+        };
+        routes.push(route);
+        logger.log(`Registered endpoint: ${method} ${path}`, {
+            predefined: isPredefined,
+        });
+        return route;
+    }
+    /**
+     * Get all registered routes
+     */
+    function getRoutes() {
+        return [...routes];
+    }
+    /**
+     * Get statistics
+     */
+    function getStats() {
+        return {
+            ...stats,
+            requestsByEndpoint: { ...stats.requestsByEndpoint },
+        };
+    }
+    /**
+     * Record a processed request for statistics.
+     */
+    function recordRequest(endpoint, outcome) {
+        stats.totalRequests++;
+        if (config.collectStats) {
+            stats.requestsByEndpoint[endpoint] = (stats.requestsByEndpoint[endpoint] ?? 0) + 1;
+        }
+        if (outcome === "success") {
+            stats.successfulRequests++;
+            return;
+        }
+        stats.failedRequests++;
+        if (outcome === "security_error") {
+            stats.securityErrors++;
+        }
+    }
+    /**
+     * Verify a signed request from Devora (signature v3) over its exact bytes.
+     * Steps before the replay store never touch it, so unauthenticated traffic
+     * cannot burn request ids.
+     */
+    async function verifyRequest(request, options = {}) {
+        const tolerance = options.timestampTolerance ?? config.timestampTolerance ?? SDK_DEFAULTS.TIMESTAMP_TOLERANCE;
+        if (!isValidTimestampTolerance(tolerance))
+            return { valid: false, error: "Invalid timestamp tolerance", errorCode: "TIMESTAMP_EXPIRED" };
+        const parsed = parseSignatureHeaders(request.headers);
+        if (!parsed.valid)
+            return { valid: false, error: parsed.error, errorCode: parsed.errorCode };
+        const headers = parsed.headers;
+        if (headers.keyId !== config.apiKey || headers.orgId !== config.orgId)
+            return {
+                valid: false,
+                error: "Request key or organization does not match SDK configuration",
+                errorCode: "ORG_MISMATCH",
+            };
+        const sentAt = Number(headers.sentAt);
+        const timestamp = validateTimestamp(sentAt, tolerance);
+        if (!timestamp.valid)
+            return { valid: false, error: timestamp.error, errorCode: "TIMESTAMP_EXPIRED" };
+        if (!SIGNED_HEADER_PATTERNS.method.test(request.method) ||
+            !isValidSignedPath(request.path) ||
+            !isValidSignedQuery(request.query))
+            return { valid: false, error: "Invalid request target", errorCode: "INVALID_REQUEST_TARGET" };
+        if (!hasIdentityContentEncoding(request.headers))
+            return {
+                valid: false,
+                error: "Content-Encoding is not supported",
+                errorCode: "UNSUPPORTED_CONTENT_ENCODING",
+            };
+        const canonical = buildCanonicalString({
+            direction: SIGNING.DEVORA_TO_CUSTOMER,
+            keyId: headers.keyId,
+            orgId: headers.orgId,
+            sentAt: headers.sentAt,
+            requestId: headers.requestId,
+            method: request.method,
+            path: request.path,
+            query: request.query,
+            bodySha256: sha256Hex(request.body),
+        });
+        if (!signatureMatches(config.secretKey, canonical, headers.signature))
+            return { valid: false, error: "Invalid HMAC signature", errorCode: "INVALID_SIGNATURE" };
+        let fresh;
+        try {
+            fresh = await replayStore.consume(replayNamespace(SIGNING.DEVORA_TO_CUSTOMER, headers.keyId), headers.requestId, replayExpiresAtMs(sentAt, Math.floor(Date.now() / 1000), tolerance));
+        }
+        catch {
+            return {
+                valid: false,
+                error: "Replay protection is unavailable",
+                errorCode: "REPLAY_STORE_UNAVAILABLE",
+            };
+        }
+        if (typeof fresh !== "boolean")
+            return {
+                valid: false,
+                error: "Replay store must return a boolean decision",
+                errorCode: "REPLAY_STORE_UNAVAILABLE",
+            };
+        if (!fresh)
+            return { valid: false, error: "Request was already processed", errorCode: "REPLAYED_REQUEST" };
+        return {
+            valid: true,
+            orgId: headers.orgId,
+            keyId: headers.keyId,
+            timestamp: sentAt,
+            requestId: headers.requestId,
+        };
+    }
+    /** POST a signed JSON body to a Devora SDK endpoint and read a bounded JSON object reply. */
+    async function signedDevoraPost(path, payload) {
+        const body = new TextEncoder().encode(JSON.stringify(payload));
+        const response = await controlPlaneFetch(`${apiUrl}${path}`, {
+            method: "POST",
+            headers: signRequest({
+                secretKey: config.secretKey,
+                direction: SIGNING.CUSTOMER_TO_DEVORA,
+                keyId: config.apiKey,
+                orgId: config.orgId,
+                method: "POST",
+                path,
+                body,
+            }),
+            body,
+        });
+        const json = await readBoundedJsonObject(response).catch(() => null);
+        return { status: response.status, ok: response.ok, json };
+    }
+    /**
+     * Check whether a Devora session is still live (server-side liveness check).
+     * Returns null if Devora is unreachable so callers can choose fail-open/closed.
+     */
+    async function getSessionStatus(sessionId) {
+        if (!sessionId || sessionId.length > 128)
+            return null;
+        try {
+            const { status, ok, json } = await signedDevoraPost("/api/sdk/session-status", { sessionId });
+            if (status === 404)
+                return { valid: false, error: "SESSION_NOT_FOUND" };
+            // 429/5xx/other failures are "unavailable", never a liveness verdict.
+            if (!ok || !json || json.success !== true)
+                return null;
+            const data = json.data;
+            if (!data ||
+                typeof data !== "object" ||
+                typeof data.valid !== "boolean")
+                return null;
+            return data;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Server-to-server: mint a one-time browser resume code (signed, customer-to-devora).
+     */
+    async function createBrowserResumeCode(input) {
+        if (!input.sessionId || input.sessionId.length > 128)
+            return { error: "INVALID_SESSION" };
+        if (!BROWSER_SESSION_BRIDGE.TAB_REF_PATTERN.test(input.tabRef))
+            return { error: "INVALID_TAB_REF" };
+        try {
+            const { status, ok, json } = await signedDevoraPost(BROWSER_SESSION_BRIDGE.RESUME_CODE_ENDPOINT, {
+                sessionId: input.sessionId,
+                tabRef: input.tabRef,
+                origin: input.origin,
+            });
+            const data = json?.data;
+            if (ok && json?.success === true && typeof data?.code === "string")
+                return data;
+            if (status >= 500 || status === 429)
+                return null;
+            return {
+                error: typeof json?.error === "string" ? json.error : "RESUME_REJECTED",
+                status,
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+    // Return SDK instance
+    const sdk = {
+        config: Object.freeze({ ...config, secretKey: "[REDACTED]" }),
+        info,
+        ready,
+        register,
+        getRoutes,
+        getStats,
+        getScopeConfig: scopeConfig.getConfig,
+        isPolicyLoaded: () => scopeConfig.getCachedConfig() !== null,
+        getCachedScopeConfig: scopeConfig.getCachedConfig,
+        refreshScopeConfig: scopeConfig.refresh,
+        getSessionStatus,
+        createBrowserResumeCode,
+        destroy: scopeConfig.stop,
+        _recordRequest: recordRequest,
+        verifyRequest,
+    };
+    logger.log("Devora SDK initialized", {
+        version: SDK_VERSION,
+        debug: config.debug,
+    });
+    return sdk;
+}
+//# sourceMappingURL=sdk.js.map

package/dist/sdk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk.js","sourceRoot":"","sources":["../src/sdk.ts"],"names":[],"mappings":"AACA;;;GAGG;AAEH,OAAO,EACN,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,OAAO,EACP,sBAAsB,EACtB,oBAAoB,EACpB,0BAA0B,EAC1B,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,wBAAwB,EACxB,yBAAyB,EACzB,aAAa,EACb,YAAY,EAMZ,sBAAsB,GACtB,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACpE,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAA;AAY5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAEvD;;;GAGG;AACH,SAAS,uBAAuB,CAAC,SAAiB;IACjD,OAAO,sBAAsB,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;QACtD,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE;QACjB,CAAC,CAAC;YACA,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,+EAA+E;SACtF,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,QAA4B;IAClD,IAAI,CAAC,QAAQ;QAAE,OAAO,YAAY,CAAC,OAAO,CAAA;IAC1C,IAAI,MAAW,CAAA;IACf,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,EAAE,CAAC,CAAA;IACtE,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAA;IACtF,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,WAAW,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAA;IAC1F,CAAC;IACD,IACC,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,QAAQ;QACf,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC;QAC5C,MAAM,CAAC,MAAM;QACb,MAAM,CAAC,IAAI,EACV,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAA;IAC5F,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAA;AACrB,CAAC;AAED;;;;;GAKG;AACH,mFAAmF;AACnF,MAAM,UAAU,kBAAkB,CAAC,QAA4B;IAC9D,MAAM,GAAG,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,YAAY,CAAC;SACtF,QAAQ,EAAE;SACV,WAAW,EAAE,CAAA;IACf,OAAO,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAA;AACpE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAA4B;IACrD,gFAAgF;IAChF,MAAM,GAAG;QACR,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;KAC/B,CAAA;IACD,yBAAyB;IACzB,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IACrD,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAA;IACzF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IACjD,CAAC;IACD,wBAAwB,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;IACnD,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3C,6EAA6E;IAC7E,4EAA4E;IAC5E,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IAC1D,IAAI,WAAW,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,WAAW;QACtD,MAAM,IAAI,KAAK,CACd,uKAAuK,CACvK,CAAA;IACF,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,IAAI,mBAAmB,EAAE,CAAA;IAEnE,8CAA8C;IAC9C,MAAM,mBAAmB,GAAG,uBAAuB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACrE,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,eAAe,mBAAmB,CAAC,KAAK,EAAE,CAAC,CAAA;IAC5D,CAAC;IAED,yFAAyF;IACzF,MAAM,MAAM,GAAG,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;IAEvD,WAAW;IACX,MAAM,IAAI,GAAG,aAAa,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;IAEhE,aAAa;IACb,MAAM,KAAK,GAAa;QACvB,aAAa,EAAE,CAAC;QAChB,kBAAkB,EAAE,CAAC;QACrB,cAAc,EAAE,CAAC;QACjB,cAAc,EAAE,CAAC;QACjB,kBAAkB,EAAE,EAAE;KACtB,CAAA;IAED,oBAAoB;IACpB,MAAM,MAAM,GAAe,EAAE,CAAA;IAC7B,MAAM,WAAW,GAAG,wBAAwB,CAAC;QAC5C,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,GAAG,EAAE,CACjB,WAAW,CAAC;YACX,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,OAAO,CAAC,kBAAkB;YACrC,KAAK,EAAE,MAAM,CAAC,MAAM;YACpB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,uBAAuB;SAC7B,CAAC;QACH,MAAM;QACN,KAAK,EAAE,MAAM,CAAC,KAAK;KACnB,CAAC,CAAA;IACF,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QACrD,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CACV,2FAA2F,CAC3F,CAAA;QACF,CAAC;IACF,CAAC,CAAC,CAAA;IAEF,2BAA2B;IAC3B,qBAAqB,EAAE,CAAA;IAEvB;;OAEG;IACH,SAAS,qBAAqB;QAC7B,gBAAgB;QAChB,MAAM,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,MAAM,EAAE,KAAK;YACb,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,KAAK,EAAE,GAAkB,EAAmC,EAAE;gBACtE,MAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAA;gBAC1E,OAAO;oBACN,MAAM,EAAE,SAAS;oBACjB,OAAO,EAAE,uCAAuC;oBAChD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;oBACrB,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,GAAG,EAAE,IAAI;oBACT,QAAQ,EAAE;wBACT,aAAa,EAAE,IAAI;wBACnB,cAAc,EAAE,IAAI;qBACpB;iBACD,CAAA;YACF,CAAC;SACD,CAAC,CAAA;QAEF,kBAAkB;QAClB,MAAM,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,gBAAgB,CAAC,MAAM;YAC7B,MAAM,EAAE,KAAK;YACb,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,KAAK,IAAkC,EAAE;gBACjD,MAAM,WAAW,GAA2B,EAAE,CAAA;gBAC9C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBAC5B,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAA;gBACvC,CAAC;gBAED,OAAO;oBACN,MAAM,EAAE,SAAS;oBACjB,GAAG,EAAE,IAAI;oBACT,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS;oBACrD,SAAS,EAAE,WAAW;iBACtB,CAAA;YACF,CAAC;SACD,CAAC,CAAA;IACH,CAAC;IAED;;OAEG;IACH,SAAS,QAAQ,CAChB,IAAY,EACZ,OAA0C,EAC1C,OAAyB;QAEzB,yCAAyC;QACzC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,IAA0B,CAAC,CAAA;QAEzF,qCAAqC;QACrC,IAAI,mBAAmB,CAAC,QAAQ,CAAC,IAA0B,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CACd,uCAAuC,IAAI,wCAAwC,CACnF,CAAA;QACF,CAAC;QAED,mDAAmD;QACnD,IAAI,MAAM,GAAgD,OAAO,EAAE,MAAM,IAAI,KAAK,CAAA;QAClF,IAAI,YAAY,EAAE,CAAC;YAClB,MAAM,GAAG,gBAAgB,CAAC,IAA0B,CAAkB,CAAA;YACtE,MAAM,CAAC,GAAG,CAAC,8BAA8B,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;QAC7D,CAAC;aAAM,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CACV,+BAA+B,IAAI,8DAA8D,CACjG,CAAA;QACF,CAAC;QAED,qFAAqF;QACrF,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;QACzD,IAAI,aAAa,EAAE,CAAC;YACnB,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAA;YACjE,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,uBAAuB,SAAS,GAAG,CAAC,CAAA;QACzF,CAAC;QAED,MAAM,KAAK,GAAkC;YAC5C,IAAI;YACJ,MAAM;YACN,OAAO;YACP,SAAS,EAAE,KAAK;SAChB,CAAA;QAED,MAAM,CAAC,IAAI,CAAC,KAAiB,CAAC,CAAA;QAE9B,MAAM,CAAC,GAAG,CAAC,wBAAwB,MAAM,IAAI,IAAI,EAAE,EAAE;YACpD,UAAU,EAAE,YAAY;SACxB,CAAC,CAAA;QAEF,OAAO,KAAK,CAAA;IACb,CAAC;IAED;;OAEG;IACH,SAAS,SAAS;QACjB,OAAO,CAAC,GAAG,MAAM,CAAC,CAAA;IACnB,CAAC;IAED;;OAEG;IACH,SAAS,QAAQ;QAChB,OAAO;YACN,GAAG,KAAK;YACR,kBAAkB,EAAE,EAAE,GAAG,KAAK,CAAC,kBAAkB,EAAE;SACnD,CAAA;IACF,CAAC;IAED;;OAEG;IACH,SAAS,aAAa,CACrB,QAAgB,EAChB,OAAiD;QAEjD,KAAK,CAAC,aAAa,EAAE,CAAA;QACrB,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACzB,KAAK,CAAC,kBAAkB,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;QACnF,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3B,KAAK,CAAC,kBAAkB,EAAE,CAAA;YAC1B,OAAM;QACP,CAAC;QACD,KAAK,CAAC,cAAc,EAAE,CAAA;QACtB,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;YAClC,KAAK,CAAC,cAAc,EAAE,CAAA;QACvB,CAAC;IACF,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,aAAa,CAC3B,OAA2B,EAC3B,UAA2C,EAAE;QAE7C,MAAM,SAAS,GACd,OAAO,CAAC,kBAAkB,IAAI,MAAM,CAAC,kBAAkB,IAAI,YAAY,CAAC,mBAAmB,CAAA;QAC5F,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC;YACxC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAA;QAE9F,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACrD,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAA;QAC5F,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;QAC9B,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;YACpE,OAAO;gBACN,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,8DAA8D;gBACrE,SAAS,EAAE,cAAc;aACzB,CAAA;QAEF,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QACrC,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QACtD,IAAI,CAAC,SAAS,CAAC,KAAK;YACnB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAA;QAEhF,IACC,CAAC,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YACnD,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC;YAChC,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC;YAElC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,SAAS,EAAE,wBAAwB,EAAE,CAAA;QAC9F,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,OAAO,CAAC;YAC/C,OAAO;gBACN,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,mCAAmC;gBAC1C,SAAS,EAAE,8BAA8B;aACzC,CAAA;QAEF,MAAM,SAAS,GAAG,oBAAoB,CAAC;YACtC,SAAS,EAAE,OAAO,CAAC,kBAAkB;YACrC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,UAAU,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;SACnC,CAAC,CAAA;QACF,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC;YACpE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAA;QAEzF,IAAI,KAAc,CAAA;QAClB,IAAI,CAAC;YACJ,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,CAChC,eAAe,CAAC,OAAO,CAAC,kBAAkB,EAAE,OAAO,CAAC,KAAK,CAAC,EAC1D,OAAO,CAAC,SAAS,EACjB,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,SAAS,CAAC,CACnE,CAAA;QACF,CAAC;QAAC,MAAM,CAAC;YACR,OAAO;gBACN,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,kCAAkC;gBACzC,SAAS,EAAE,0BAA0B;aACrC,CAAA;QACF,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,SAAS;YAC7B,OAAO;gBACN,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,6CAA6C;gBACpD,SAAS,EAAE,0BAA0B;aACrC,CAAA;QACF,IAAI,CAAC,KAAK;YACT,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAA;QAE/F,OAAO;YACN,KAAK,EAAE,IAAI;YACX,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,MAAM;YACjB,SAAS,EAAE,OAAO,CAAC,SAAS;SAC5B,CAAA;IACF,CAAC;IAED,6FAA6F;IAC7F,KAAK,UAAU,gBAAgB,CAC9B,IAAY,EACZ,OAAgC;QAEhC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;QAC9D,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,EAAE;YAC5D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,WAAW,CAAC;gBACpB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,SAAS,EAAE,OAAO,CAAC,kBAAkB;gBACrC,KAAK,EAAE,MAAM,CAAC,MAAM;gBACpB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,MAAM,EAAE,MAAM;gBACd,IAAI;gBACJ,IAAI;aACJ,CAAC;YACF,IAAI;SACJ,CAAC,CAAA;QACF,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QACpE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,CAAA;IAC1D,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,gBAAgB,CAAC,SAAiB;QAChD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,IAAI,CAAA;QACrD,IAAI,CAAC;YACJ,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,gBAAgB,CAAC,yBAAyB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;YAC7F,IAAI,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAyB,CAAA;YAC9F,sEAAsE;YACtE,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAA;YACtD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;YACtB,IACC,CAAC,IAAI;gBACL,OAAO,IAAI,KAAK,QAAQ;gBACxB,OAAQ,IAA4B,CAAC,KAAK,KAAK,SAAS;gBAExD,OAAO,IAAI,CAAA;YACZ,OAAO,IAA2B,CAAA;QACnC,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,IAAI,CAAA;QACZ,CAAC;IACF,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,uBAAuB,CAAC,KAItC;QACA,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAA;QACzF,IAAI,CAAC,sBAAsB,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YAC7D,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAA;QACpC,IAAI,CAAC;YACJ,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,gBAAgB,CAClD,sBAAsB,CAAC,oBAAoB,EAC3C;gBACC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;aACpB,CACD,CAAA;YACD,MAAM,IAAI,GAAG,IAAI,EAAE,IAA8C,CAAA;YACjE,IAAI,EAAE,IAAI,IAAI,EAAE,OAAO,KAAK,IAAI,IAAI,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ;gBACjE,OAAO,IAAyB,CAAA;YACjC,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAA;YAChD,OAAO;gBACN,KAAK,EAAE,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB;gBACvE,MAAM;aACN,CAAA;QACF,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,IAAI,CAAA;QACZ,CAAC;IACF,CAAC;IAED,sBAAsB;IACtB,MAAM,GAAG,GAAqB;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,CAAyB;QACrF,IAAI;QACJ,KAAK;QACL,QAAQ;QACR,SAAS;QACT,QAAQ;QACR,cAAc,EAAE,WAAW,CAAC,SAAS;QACrC,cAAc,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,eAAe,EAAE,KAAK,IAAI;QAC5D,oBAAoB,EAAE,WAAW,CAAC,eAAe;QACjD,kBAAkB,EAAE,WAAW,CAAC,OAAO;QACvC,gBAAgB;QAChB,uBAAuB;QACvB,OAAO,EAAE,WAAW,CAAC,IAAI;QACzB,cAAc,EAAE,aAAa;QAC7B,aAAa;KACb,CAAA;IAED,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE;QACpC,OAAO,EAAE,WAAW;QACpB,KAAK,EAAE,MAAM,CAAC,KAAK;KACnB,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACX,CAAC"}