@fuzdev/fuz_app 0.139.0 → 0.141.0

package/dist/http/origin.js

@@ -1,7 +1,7 @@
 /**
  * Request source verification middleware for API protection.
  *
- * Verifies requests are coming from expected origins/referers.
+ * Verifies requests carry an `Origin` the server allows, or none.
  * CSRF protection is `SameSite: strict` on session cookies
  * (see `auth/session_middleware.ts`) plus the CORS simple-request refusal
  * (`http/simple_request.ts`) — `SameSite` alone admits same-site pages, which
@@ -10,10 +10,18 @@
  * from making requests as the user browses the web — and is the only gate on
  * the WebSocket upgrade, which is never preflighted.
  *
+ * The allowlist grammar is shared with the Rust spine entry for entry:
+ * `parse_allowed_origins` accepts and refuses the same entries, naming each
+ * refusal with the same `AllowedOriginsErrorKind` string, and an accepted list
+ * matches the same origins. The shared conformance table
+ * (`testing/cross_backend/origin_conformance.json`) pins both.
+ *
  * @module
  */
 import { escape_regexp } from '@fuzdev/fuz_util/regexp.ts';
+import { z } from 'zod';
 import { ERROR_FORBIDDEN_ORIGIN } from './error_schemas.js';
+import { middleware_applies } from './schema_helpers.js';
 /**
  * True when the request looks like it originated from a browser context — it
  * carries an `Origin` or `Referer` header. Browsers attach these
@@ -32,37 +40,134 @@ import { ERROR_FORBIDDEN_ORIGIN } from './error_schemas.js';
  */
 export const is_browser_context = (c) => c.req.header('Origin') !== undefined || c.req.header('Referer') !== undefined;
 /**
- * Parses FUZ_ALLOWED_ORIGINS env var into regex matchers for request source verification.
+ * Why one allowlist entry was refused. The wire names both spines emit — the
+ * Rust spine's `OriginPatternError::kind` returns the same strings.
+ */
+export const OriginPatternErrorKind = z.enum([
+    'empty_entry',
+    'not_printable_ascii',
+    'missing_scheme',
+    'unsupported_scheme',
+    'has_path',
+    'has_userinfo',
+    'missing_host',
+    'invalid_host_char',
+    'unbracketed_ipv6',
+    'partial_wildcard',
+    'non_canonical_ipv4',
+    'unclosed_ipv6',
+    'invalid_ipv6',
+    'invalid_after_ipv6',
+    'invalid_port',
+    'default_port'
+]);
+/** Why an allowlist value was refused: `no_origins` (a blank value) or an entry's kind. */
+export const AllowedOriginsErrorKind = z.enum(['no_origins', ...OriginPatternErrorKind.options]);
+/** The operator-facing reason for each refusal kind. */
+export const ALLOWED_ORIGINS_ERROR_MESSAGES = {
+    no_origins: 'no origins supplied — list at least one',
+    empty_entry: 'it is empty (a stray comma?)',
+    not_printable_ascii: 'an origin is printable ASCII with no spaces (an international hostname is written in its punycode form)',
+    missing_scheme: 'it has no `scheme://`',
+    unsupported_scheme: 'the scheme is neither http nor https',
+    has_path: 'an origin ends at the host or port — no path, query, or fragment, and no trailing slash',
+    has_userinfo: 'an origin carries no userinfo',
+    missing_host: 'it has no host',
+    invalid_host_char: 'a hostname holds none of `%`, `\\`, `^`, `|`, `<`, `>`, `[`, `]` (a browser sends it decoded, with no percent-encoding)',
+    unbracketed_ipv6: 'an IPv6 address is written in brackets, `[::1]`',
+    partial_wildcard: 'a `*` stands for one whole host label, as in `https://*.example.com`',
+    non_canonical_ipv4: 'a host ending in a number is an IPv4 address, which a browser sends as four decimal numbers 0-255 with no leading zeros and no trailing dot',
+    unclosed_ipv6: 'the IPv6 address has no closing `]`',
+    invalid_ipv6: 'the bracketed host is not an IPv6 address written the way a browser sends it: hex groups without leading zeros, the longest run of zero groups as `::`, no dotted-quad tail, no zone',
+    invalid_after_ipv6: 'only `:port` may follow the IPv6 address',
+    invalid_port: 'the port is neither a number in 1-65535 (no leading zeros) nor `*`',
+    default_port: "it names the scheme's default port, which a browser leaves out of `Origin` and `Host` — write it without the port"
+};
+/** The longest excerpt of a refused entry an error message quotes. */
+const ENTRY_EXCERPT_MAX = 200;
+/**
+ * Render one refusal for a boot error — the entry in double quotes with every
+ * character but visible ASCII and the space escaped as `\uXXXX` (and `"` and
+ * `\` backslash-escaped), so an env value can't put a control, bidi, or other
+ * non-printing character in a log, nor close the quotes it is shown in.
+ *
+ * @param error - one of `parse_allowed_origins`'s errors
+ * @returns the reason as one line
+ */
+export const format_allowed_origins_error = (error) => {
+    const reason = ALLOWED_ORIGINS_ERROR_MESSAGES[error.kind];
+    if (error.index === undefined)
+        return reason;
+    const entry = error.entry ?? '';
+    const excerpt = entry.length > ENTRY_EXCERPT_MAX ? entry.slice(0, ENTRY_EXCERPT_MAX) + '...' : entry;
+    return `entry ${error.index} ${quote_ascii(excerpt)} is refused: ${reason}`;
+};
+/** Everything outside visible ASCII and the space, plus the quote and backslash. */
+const NEEDS_ASCII_ESCAPE = /[^\x20-\x7e]|["\\]/g;
+/**
+ * `value` in double quotes, ASCII-only: `"` and `\` backslash-escaped, every
+ * other UTF-16 code unit outside `\x20-\x7e` as `\uXXXX`.
+ */
+const quote_ascii = (value) => '"' +
+    value.replace(NEEDS_ASCII_ESCAPE, (c) => c === '"' || c === '\\' ? '\\' + c : '\\u' + c.charCodeAt(0).toString(16).padStart(4, '0')) +
+    '"';
+/** Printable ASCII without the space. */
+const VISIBLE_ASCII = /^[\x21-\x7e]*$/;
+/** The ASCII whitespace an entry is trimmed of — space, tab, LF, FF, CR. */
+const ASCII_WHITESPACE_EDGES = /^[ \t\n\f\r]+|[ \t\n\f\r]+$/g;
+const trim_ascii_whitespace = (value) => value.replace(ASCII_WHITESPACE_EDGES, '');
+/**
+ * Parses an allowlist value (conventionally the `FUZ_ALLOWED_ORIGINS` env var)
+ * into regex matchers for request source verification.
  * Origin allowlisting for locally-running services — not the CSRF layer
  * (that's `SameSite: strict` on session cookies plus `http/simple_request.ts`).
  *
- * Accepts comma-separated patterns with limited wildcards:
- * - Exact origins: `https://api.fuz.dev`
- * - Wildcard subdomains: `https://*.fuz.dev` (matches exactly one subdomain level)
- * - Multiple wildcards: `https://*.staging.*.fuz.dev` (for deep subdomains)
- * - Wildcard ports: `http://localhost:*` (matches any port or no port)
- * - IPv6 addresses: `http://[::1]:3000`, `https://[2001:db8::1]`
+ * Entries are comma-separated and trimmed of ASCII whitespace. Each is written
+ * the way a browser writes an `Origin` — `scheme://host[:port]` — where a whole
+ * host label or the port may be `*`:
+ * - Exact origins: `https://api.fuz.dev`, `http://localhost:3000`
+ * - Wildcard labels: `https://*.fuz.dev` (each `*` is exactly one label, in any
+ *   position — `api.fuz.dev` matches, `fuz.dev` and `a.b.fuz.dev` don't)
+ * - Wildcard ports: `http://localhost:*` (any port or none)
+ * - IPv6 addresses: `http://[::1]:3000`, `https://[2001:db8::1]` (exact)
  * - Combined: `https://*.fuz.dev:*`
  *
- * Examples:
- * - `http://localhost:3000,https://prod.fuz.dev`
- * - `https://*.api.fuz.dev,http://127.0.0.1:*`
- * - `http://[::1]:*,https://*.*.corp.fuz.dev:*`
+ * Refused, nothing normalized: anything but printable ASCII (punycode an
+ * international hostname), a scheme other than http or https (`null`,
+ * `file://`, `chrome-extension://`), a path, query, fragment or trailing
+ * slash, userinfo, a character no hostname holds, a partial wildcard, an IPv4
+ * address not written as four canonical decimal numbers (`127.1`), an IPv6
+ * address not in the form a browser sends, a port outside `1..=65535` or with
+ * leading zeros, the scheme's default port, and an empty entry. Every refused
+ * entry is reported, not just the first.
  *
- * @throws Error if any individual pattern is invalid (missing protocol, partial wildcards, etc.)
+ * @param raw - the comma-separated allowlist value
+ * @returns the matchers, or every refusal — `no_origins` when the value is blank
  */
-export const parse_allowed_origins = (env_value) => env_value
-    ? env_value
-        .split(',')
-        .map((s) => s.trim())
-        .filter(Boolean)
-        .map(origin_pattern_to_regexp)
-    : [];
+export const parse_allowed_origins = (raw) => {
+    if (trim_ascii_whitespace(raw) === '') {
+        return { ok: false, errors: [{ kind: 'no_origins' }] };
+    }
+    const origins = [];
+    const errors = [];
+    raw.split(',').forEach((part, i) => {
+        const entry = trim_ascii_whitespace(part);
+        const parsed = origin_pattern_to_regexp(entry);
+        if (typeof parsed === 'string') {
+            errors.push({ kind: parsed, index: i + 1, entry });
+        }
+        else {
+            origins.push(parsed);
+        }
+    });
+    return errors.length > 0 ? { ok: false, errors } : { ok: true, origins };
+};
 /**
- * Tests if a request source (origin or referer) matches any of the allowed patterns.
- * Pattern matching is case-insensitive for domains (as per web standards).
+ * Tests if an `Origin` value matches any of the allowed patterns.
+ * Pattern matching is case-insensitive (web hosts and schemes are). A value
+ * that isn't visible ASCII matches nothing — a browser never sends one.
  */
-export const should_allow_origin = (origin, allowed_patterns) => allowed_patterns.some((p) => p.test(origin));
+export const should_allow_origin = (origin, allowed_patterns) => VISIBLE_ASCII.test(origin) && allowed_patterns.some((p) => p.test(origin));
 /**
  * Middleware that verifies the request source against an allowlist.
  *
@@ -70,6 +175,9 @@ export const should_allow_origin = (origin, allowed_patterns) => allowed_pattern
  * plus `http/simple_request.ts`):
  * - Checks the `Origin` header (if present) against the allowlist
  * - Allows requests without an `Origin` header (direct access, curl, etc.)
+ * - Refuses an `Origin` that isn't visible ASCII, and a duplicated one — the
+ *   runtimes join a repeated header into one value (`a, b`), which carries a
+ *   space and so matches nothing
  *
  * Origin-only by design — Fetch spec mandates `Origin` on every unsafe
  * method (POST / PUT / DELETE / PATCH) regardless of `Referrer-Policy`,
@@ -78,126 +186,138 @@ export const should_allow_origin = (origin, allowed_patterns) => allowed_pattern
  * attached session cookies, so CSRF isn't the relevant threat there —
  * auth (bearer / daemon token) is the actual control. A Referer fallback
  * would only widen the accepted-shape envelope without closing a real
- * CSRF hole; mirrors `zzz_server::auth::is_request_origin_allowed`.
+ * CSRF hole. The Rust spine's `origin_layer` is the twin.
+ *
+ * `create_app_server` mounts it on every path (`ORIGIN_MIDDLEWARE_PATH`); a
+ * request whose path a `carve_outs` entry matches passes unchecked — the named,
+ * explicit exception, each with its reason, as the Rust stack's
+ * `origin_carve_out` is.
  *
  * @param allowed_patterns - compiled regex patterns from `parse_allowed_origins`
+ * @param carve_outs - paths the check skips, matched like a middleware path (`middleware_applies`)
  */
-export const verify_request_source = (allowed_patterns) => (c, next) => {
-    // Check origin header (preferred, sent by browsers for CORS requests).
-    // Uses !== undefined so empty-string Origin headers are treated as
-    // present (abnormal, checked against allowlist — empty string never matches).
-    const origin = c.req.header('origin');
-    if (origin !== undefined) {
-        if (!should_allow_origin(origin, allowed_patterns)) {
-            return c.json({ error: ERROR_FORBIDDEN_ORIGIN }, 403);
-        }
+export const verify_request_source = (allowed_patterns, carve_outs = []) => (c, next) => {
+    if (carve_outs.some((carve_out) => middleware_applies(carve_out.path, c.req.path))) {
         return next();
     }
-    // No origin header - direct access (curl, CLI, etc.)
-    // Allow through since token auth is the primary security control.
+    // `!== undefined` so an empty-string Origin is present (abnormal, checked
+    // against the allowlist — the empty string never matches)
+    const origin = c.req.header('origin');
+    if (origin !== undefined && !should_allow_origin(origin, allowed_patterns)) {
+        return c.json({ error: ERROR_FORBIDDEN_ORIGIN }, 403);
+    }
+    // no Origin — direct access (curl, CLI); token auth is the control
     return next();
 };
 /**
- * Converts origin patterns with wildcards to regex patterns.
- *
- * Pattern format: protocol://hostname[:port]
- *
- * Wildcard support:
- * - Subdomain wildcards: `*.fuz.dev` matches `sub.fuz.dev` (NOT `fuz.dev`)
- * - Multiple wildcards: `*.*.fuz.dev` matches `api.staging.fuz.dev`
- * - Port wildcards: `fuz.dev:*` matches any port or no port
- * - IPv6 support: `[::1]`, `[2001:db8::1]` (no wildcards in IPv6)
+ * Validates one trimmed entry and compiles it to a matcher, or names its
+ * refusal. The checks run in a fixed order and the first that fails names the
+ * kind — the Rust spine runs the same order, so both name the same kind.
  *
- * Restrictions:
- * - No paths allowed (origins don't include paths)
- * - Wildcards must be complete labels (`*.fuz.dev`, not `*fuz.dev`)
- * - No wildcards in IPv6 addresses
- * - Port wildcards must be `:*` exactly
- *
- * Note: Patterns are normalized via URL constructor. IPv4-mapped IPv6 addresses
- * like `[::ffff:127.0.0.1]` will be normalized to `[::ffff:7f00:1]`. IPv6 zone
- * identifiers (e.g., `%eth0`) are not supported.
- *
- * @throws Error if pattern format is invalid
+ * The compiled regex is `^scheme://host(:port)?$`, case-insensitive: an exact
+ * label matches itself, a `*` label `[^./:]+` (one non-empty label), a `:*`
+ * port `(:\d+)?`.
  */
-const origin_pattern_to_regexp = (pattern) => {
-    // Quick validation: no paths, query strings, or fragments allowed
-    const protocol_idx = pattern.indexOf('://');
-    if (protocol_idx === -1) {
-        throw new Error(`Invalid origin pattern: ${pattern}`);
-    }
-    const after_protocol = pattern.slice(protocol_idx + 3);
-    if (/[/?#]/.test(after_protocol)) {
-        throw new Error(`Paths not allowed in origin patterns: ${pattern}`);
-    }
-    // Check for wildcards in IPv6 before URL parsing (URL rejects these with unhelpful error)
-    const ipv6_match = /^\[([^\]]+)\]/.exec(after_protocol);
-    if (ipv6_match?.[1]?.includes('*')) {
-        throw new Error(`Wildcards not allowed in IPv6 addresses: ${pattern}`);
-    }
-    // Handle port wildcard - must be at the end
-    let port_wildcard = false;
-    let parse_pattern = pattern;
-    if (pattern.endsWith(':*')) {
-        port_wildcard = true;
-        parse_pattern = pattern.slice(0, -2);
-    }
-    // Parse with URL constructor for robust handling of protocol, hostname, port, IPv6
-    let url;
-    try {
-        url = new URL(parse_pattern);
-    }
-    catch {
-        throw new Error(`Invalid origin pattern: ${pattern}`);
-    }
-    // Validate protocol is http or https
-    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
-        throw new Error(`Invalid origin pattern: ${pattern}`);
-    }
-    const hostname = url.hostname;
-    const is_ipv6 = hostname.startsWith('[');
-    // For regular hostnames, wildcards must be complete labels
-    if (!is_ipv6) {
-        for (const label of hostname.split('.')) {
-            if (label.includes('*') && label !== '*') {
-                throw new Error(`Wildcards must be complete labels (e.g., *.fuz.dev, not *fuz.dev): ${pattern}`);
-            }
+const origin_pattern_to_regexp = (entry) => {
+    if (entry === '')
+        return 'empty_entry';
+    if (!VISIBLE_ASCII.test(entry))
+        return 'not_printable_ascii';
+    const scheme_end = entry.indexOf('://');
+    if (scheme_end === -1)
+        return 'missing_scheme';
+    const scheme = entry.slice(0, scheme_end).toLowerCase();
+    if (scheme !== 'http' && scheme !== 'https')
+        return 'unsupported_scheme';
+    const authority = entry.slice(scheme_end + 3);
+    if (/[/?#]/.test(authority))
+        return 'has_path';
+    if (authority.includes('@'))
+        return 'has_userinfo';
+    let host_source;
+    let port;
+    if (authority.startsWith('[')) {
+        const end = authority.indexOf(']');
+        if (end === -1)
+            return 'unclosed_ipv6';
+        const inner = authority.slice(1, end);
+        if (!is_ipv6_origin_form(inner))
+            return 'invalid_ipv6';
+        const rest = authority.slice(end + 1);
+        if (rest === '') {
+            port = null;
         }
-    }
-    // Build regex pattern
-    let regex_pattern = '^' + escape_regexp(url.protocol) + '//';
-    // Handle hostname
-    if (is_ipv6) {
-        // IPv6 address - URL.hostname includes brackets
-        regex_pattern += escape_regexp(hostname);
+        else if (rest.startsWith(':')) {
+            port = rest.slice(1);
+        }
+        else {
+            return 'invalid_after_ipv6';
+        }
+        host_source = escape_regexp(authority.slice(0, end + 1));
     }
     else {
-        // Regular hostname - process wildcards
-        const labels = hostname.split('.');
-        regex_pattern += labels
+        const colon = authority.lastIndexOf(':');
+        const host = colon === -1 ? authority : authority.slice(0, colon);
+        port = colon === -1 ? null : authority.slice(colon + 1);
+        if (host === '')
+            return 'missing_host';
+        if (host.includes(':'))
+            return 'unbracketed_ipv6';
+        if (/[%\\^|<>[\]]/.test(host))
+            return 'invalid_host_char';
+        const labels = host.split('.');
+        if (labels.some((label) => label.includes('*') && label !== '*'))
+            return 'partial_wildcard';
+        if (!is_canonical_ipv4_or_name(host))
+            return 'non_canonical_ipv4';
+        host_source = labels
             .map((label) => (label === '*' ? '[^./:]+' : escape_regexp(label)))
             .join('\\.');
     }
-    // Handle port
-    if (port_wildcard) {
-        // Optional port (matches both with and without port)
-        regex_pattern += '(:\\d+)?';
+    let port_source = '';
+    if (port === '*') {
+        port_source = '(?::\\d+)?';
     }
-    else {
-        // URL normalizes default ports (80 for HTTP, 443 for HTTPS) away,
-        // so check original pattern for explicit port when url.port is empty
-        let port = url.port;
-        if (!port) {
-            const port_match = /:(\d+)$/.exec(parse_pattern);
-            if (port_match?.[1]) {
-                port = port_match[1];
-            }
-        }
-        if (port) {
-            regex_pattern += ':' + escape_regexp(port);
-        }
+    else if (port !== null) {
+        if (!/^[1-9]\d*$/.test(port) || Number(port) > 65535)
+            return 'invalid_port';
+        if (port === (scheme === 'https' ? '443' : '80'))
+            return 'default_port';
+        port_source = ':' + port;
+    }
+    return new RegExp('^' + escape_regexp(scheme + '://') + host_source + port_source + '$', 'i');
+};
+/**
+ * True when `inner` (a bracketed host without its brackets) is an IPv6 address
+ * written exactly as a browser serializes it — lowercase-insensitive hex groups
+ * without leading zeros, the first longest run of two or more zero groups as
+ * `::`, no dotted-quad tail. The URL parser is the serializer here: an address
+ * it rewrites, or can't read, is refused rather than normalized.
+ */
+const is_ipv6_origin_form = (inner) => {
+    let hostname;
+    try {
+        hostname = new URL(`http://[${inner}]`).hostname;
+    }
+    catch {
+        return false;
     }
-    regex_pattern += '$';
-    // Case-insensitive matching (web standards specify domains are case-insensitive)
-    return new RegExp(regex_pattern, 'i');
+    return hostname === `[${inner.toLowerCase()}]`;
+};
+/**
+ * False when `host` (no brackets, wildcard labels allowed) is one a browser
+ * reads as an IPv4 address and then writes differently. A browser takes any
+ * host whose last label is a number — decimal or `0x` hex, one trailing dot
+ * aside — for an IPv4 address and sends it as four decimal numbers.
+ */
+const is_canonical_ipv4_or_name = (host) => {
+    const name = host.endsWith('.') ? host.slice(0, -1) : host;
+    const last = name.slice(name.lastIndexOf('.') + 1);
+    const is_number = /^0[xX][0-9a-fA-F]*$/.test(last) || /^\d+$/.test(last);
+    if (!is_number)
+        return true;
+    // a trailing dot makes a fifth, empty label
+    const labels = host.split('.');
+    return (labels.length === 4 &&
+        labels.every((label) => label === '*' || (/^(?:0|[1-9]\d{0,2})$/.test(label) && Number(label) <= 255)));
 };

package/dist/http/route_spec.d.ts

@@ -150,6 +150,27 @@ export interface RouteSpec {
      * misleading `null` body.
      */
     raw_body?: boolean;
+    /**
+     * Marks a route that issues a credential — a session cookie — while
+     * declaring no auth itself: login, signup, bootstrap. A forged cross-site
+     * request to one is login CSRF, so it must take the origin check, and
+     * assembly refuses it outside the auth middleware's scope, where no origin
+     * carve-out can reach (`assert_credential_routes_in_auth_scope`). A route
+     * that reads a credential (`auth.account` not `'none'`) is held there
+     * without the mark.
+     */
+    mints_credential?: boolean;
+    /**
+     * Marks a route that reads the resolved credential in its handler while
+     * declaring no auth gate — it answers an anonymous caller itself instead
+     * of taking the dispatcher's `401` (account status, the cell-scoped fact
+     * read, the JSON-RPC endpoint whose dispatcher gates each action).
+     * Outside the auth middleware's scope no session or bearer parsing runs
+     * and it would see every caller as anonymous, so assembly refuses it
+     * there (`assert_credential_routes_in_auth_scope`), as it does a route
+     * whose `auth.account` is not `'none'`.
+     */
+    reads_credential?: boolean;
     /**
      * Rate limit key type — declares what this route's rate limiter is keyed on.
      *

package/dist/http/route_spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route_spec.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/route_spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAW,IAAI,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACtE,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EACN,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAMjB,MAAM,oBAAoB,CAAC;AAU5B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAA0C,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEzF;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,UAAU;IAC1B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC5C,kBAAkB,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;CAC7C;AAED;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,SAAS,KAAK,UAAU,CAAC;AAEhE;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;AAE7F,6CAA6C;AAC7C,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEtE;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC5B;;;OAGG;IACH,EAAE,EAAE,EAAE,CAAC;IACP;;;;;OAKG;IACH,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC;;;;;;;OAOG;IACH,mBAAmB,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;CACvD;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE7F;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACzB,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,YAAY,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACrB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACpB,mEAAmE;IACnE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC;IACjB,oCAAoC;IACpC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC;IAClB;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACxF,wBAAgB,eAAe,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC;AAK5D;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACzF,wBAAgB,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC;AAK7D;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACxF,wBAAgB,eAAe,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC;AAmL5D;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,GAAI,KAAK,IAAI,EAAE,OAAO,KAAK,CAAC,cAAc,CAAC,KAAG,IAIhF,CAAC;AAwFF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,eAAO,MAAM,iBAAiB,GAC7B,KAAK,IAAI,EACT,OAAO,KAAK,CAAC,SAAS,CAAC,EACvB,qBAAqB,iBAAiB,EACtC,KAAK,MAAM,EACX,IAAI,EAAE,EACN,YAAY,oBAAoB,KAC9B,IAsEF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,QAAQ,MAAM,EAAE,OAAO,KAAK,CAAC,SAAS,CAAC,KAAG,KAAK,CAAC,SAAS,CAK3F,CAAC"}
+{"version":3,"file":"route_spec.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/route_spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAW,IAAI,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACtE,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EACN,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAMjB,MAAM,oBAAoB,CAAC;AAU5B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAA0C,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEzF;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,UAAU;IAC1B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC5C,kBAAkB,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;CAC7C;AAED;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,SAAS,KAAK,UAAU,CAAC;AAEhE;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;AAE7F,6CAA6C;AAC7C,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEtE;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC5B;;;OAGG;IACH,EAAE,EAAE,EAAE,CAAC;IACP;;;;;OAKG;IACH,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC;;;;;;;OAOG;IACH,mBAAmB,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;CACvD;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE7F;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACzB,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,YAAY,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACrB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACpB,mEAAmE;IACnE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC;IACjB,oCAAoC;IACpC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC;IAClB;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACxF,wBAAgB,eAAe,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC;AAK5D;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACzF,wBAAgB,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC;AAK7D;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACxF,wBAAgB,eAAe,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC;AAmL5D;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,GAAI,KAAK,IAAI,EAAE,OAAO,KAAK,CAAC,cAAc,CAAC,KAAG,IAIhF,CAAC;AAwFF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,eAAO,MAAM,iBAAiB,GAC7B,KAAK,IAAI,EACT,OAAO,KAAK,CAAC,SAAS,CAAC,EACvB,qBAAqB,iBAAiB,EACtC,KAAK,MAAM,EACX,IAAI,EAAE,EACN,YAAY,oBAAoB,KAC9B,IAsEF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,QAAQ,MAAM,EAAE,OAAO,KAAK,CAAC,SAAS,CAAC,KAAG,KAAK,CAAC,SAAS,CAK3F,CAAC"}

package/dist/http/schema_helpers.d.ts

@@ -106,6 +106,28 @@ export declare const schema_to_surface: (schema: z.ZodType) => unknown;
  * - Exact match: `/health` matches `/health`
  */
 export declare const middleware_applies: (mw_path: string, route_path: string) => boolean;
+/**
+ * Check if two middleware path patterns can match a common route path — the
+ * pattern-against-pattern form of `middleware_applies`, over the same
+ * grammar (`*`, an exact path, or a `/prefix/*` that also matches `/prefix`).
+ *
+ * @param a - one Hono-style pattern
+ * @param b - the other
+ */
+export declare const middleware_paths_overlap: (a: string, b: string) => boolean;
+/**
+ * Check if a middleware layer runs on a route path: its `path` pattern
+ * applies (`middleware_applies`) and none of its `carve_outs` does.
+ *
+ * @param spec - the layer's `path` and optional `carve_outs`
+ * @param route_path - the route path to check
+ */
+export declare const middleware_spec_applies: (spec: {
+    readonly path: string;
+    readonly carve_outs?: ReadonlyArray<{
+        readonly path: string;
+    }> | null;
+}, route_path: string) => boolean;
 /**
  * Merge auto-derived, middleware, and explicit error schemas for a route spec.
  *

package/dist/http/schema_helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/schema_helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAEN,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,MAAM,oBAAoB,CAAC;AAE5B;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,GAAI,QAAQ,CAAC,CAAC,OAAO,KAAG,OAAsC,CAAC;AAE1F;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GAAI,QAAQ,CAAC,CAAC,OAAO,KAAG,OAAsC,CAAC;AAE1F;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,cAAc,GAAI,YAAY,OAAO,KAAG,OAUpD,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,GAAI,OAAO,CAAC,CAAC,OAAO,EAAE,YAAY,OAAO,KAAG,OACA,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,gCAAgC,GAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EACnE,QAAQ,CAAC,EACT,OAAO,OAAO,KACZ,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAclC,CAAC;AAWF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GAAI,QAAQ,CAAC,CAAC,OAAO,KAAG,OACe,CAAC;AAE5E;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,QAAQ,CAAC,CAAC,OAAO,KAAG,OAQrD,CAAC;AAoBF;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,GAAI,SAAS,MAAM,EAAE,YAAY,MAAM,KAAG,OAQxE,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM;IACL,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACrB,KAAK,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACpB,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC3B,EACD,oBAAoB,iBAAiB,GAAG,IAAI,KAC1C,iBAAiB,GAAG,IAWtB,CAAC"}
+{"version":3,"file":"schema_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/schema_helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAEN,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,MAAM,oBAAoB,CAAC;AAE5B;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,GAAI,QAAQ,CAAC,CAAC,OAAO,KAAG,OAAsC,CAAC;AAE1F;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GAAI,QAAQ,CAAC,CAAC,OAAO,KAAG,OAAsC,CAAC;AAE1F;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,cAAc,GAAI,YAAY,OAAO,KAAG,OAUpD,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,GAAI,OAAO,CAAC,CAAC,OAAO,EAAE,YAAY,OAAO,KAAG,OACA,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,gCAAgC,GAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EACnE,QAAQ,CAAC,EACT,OAAO,OAAO,KACZ,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAclC,CAAC;AAWF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GAAI,QAAQ,CAAC,CAAC,OAAO,KAAG,OACe,CAAC;AAE5E;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,QAAQ,CAAC,CAAC,OAAO,KAAG,OAQrD,CAAC;AAoBF;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,GAAI,SAAS,MAAM,EAAE,YAAY,MAAM,KAAG,OAQxE,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,GAAI,GAAG,MAAM,EAAE,GAAG,MAAM,KAAG,OAM/D,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM;IACL,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;CACtE,EACD,YAAY,MAAM,KAChB,OAE0F,CAAC;AAE9F;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM;IACL,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACrB,KAAK,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACpB,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC3B,EACD,oBAAoB,iBAAiB,GAAG,IAAI,KAC1C,iBAAiB,GAAG,IAWtB,CAAC"}

package/dist/http/schema_helpers.js

@@ -179,6 +179,30 @@ export const middleware_applies = (mw_path, route_path) => {
     }
     return false;
 };
+/**
+ * Check if two middleware path patterns can match a common route path — the
+ * pattern-against-pattern form of `middleware_applies`, over the same
+ * grammar (`*`, an exact path, or a `/prefix/*` that also matches `/prefix`).
+ *
+ * @param a - one Hono-style pattern
+ * @param b - the other
+ */
+export const middleware_paths_overlap = (a, b) => {
+    if (a === '*' || b === '*')
+        return true;
+    // a `/prefix/*` pattern's shortest match is the bare `/prefix` (`/*` → ``)
+    const base = (pattern) => pattern.endsWith('/*') ? pattern.slice(0, -2) : pattern;
+    return middleware_applies(a, base(b)) || middleware_applies(b, base(a));
+};
+/**
+ * Check if a middleware layer runs on a route path: its `path` pattern
+ * applies (`middleware_applies`) and none of its `carve_outs` does.
+ *
+ * @param spec - the layer's `path` and optional `carve_outs`
+ * @param route_path - the route path to check
+ */
+export const middleware_spec_applies = (spec, route_path) => middleware_applies(spec.path, route_path) &&
+    !(spec.carve_outs ?? []).some((carve_out) => middleware_applies(carve_out.path, route_path));
 /**
  * Merge auto-derived, middleware, and explicit error schemas for a route spec.
  *

package/dist/http/surface.d.ts

@@ -1,7 +1,7 @@
 /**
  * App surface generation — JSON-serializable attack surface from route and middleware specs.
  *
- * Pure schema helpers (`is_null_schema`, `schema_to_surface`, `middleware_applies`,
+ * Pure schema helpers (`is_null_schema`, `schema_to_surface`, `middleware_applies`, `middleware_spec_applies`,
  * `merge_error_schemas`) live in `http/schema_helpers.ts`.
  *
  * @module
@@ -52,6 +52,11 @@ export interface AppSurfaceMiddleware {
     path: string;
     /** JSON Schema representations of error responses, keyed by HTTP status code. `null` when none. */
     error_schemas: Record<string, unknown> | null;
+    /** Paths under `path` the layer does not run on, each with its reason. Absent when none. */
+    carve_outs?: Array<{
+        path: string;
+        reason: string;
+    }>;
 }
 /** An env var in the generated attack surface (JSON-serializable). */
 export interface AppSurfaceEnv {

package/dist/http/surface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"surface.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/surface.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAQ7E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAKrD,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,WAAW,EAAE,OAAO,CAAC;IACrB,uEAAuE;IACvE,WAAW,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB,oFAAoF;IACpF,cAAc,EAAE,YAAY,GAAG,IAAI,CAAC;IACpC,uFAAuF;IACvF,aAAa,EAAE,OAAO,CAAC;IACvB,8FAA8F;IAC9F,YAAY,EAAE,OAAO,CAAC;IACtB,wFAAwF;IACxF,YAAY,EAAE,OAAO,CAAC;IACtB,iEAAiE;IACjE,aAAa,EAAE,OAAO,CAAC;IACvB,mGAAmG;IACnG,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC9C;AAED,wEAAwE;AACxE,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,mGAAmG;IACnG,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC9C;AAED,sEAAsE;AACtE,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,EAAE,OAAO,CAAC;CAClB;AAED,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;CACvB;AAED,2FAA2F;AAC3F,MAAM,WAAW,mBAAmB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,qFAAqF;IACrF,YAAY,EAAE,OAAO,CAAC;IACtB,uDAAuD;IACvD,aAAa,EAAE,OAAO,CAAC;IACvB,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,cAAc,EAAE,YAAY,GAAG,IAAI,CAAC;CACpC;AAED,2EAA2E;AAC3E,MAAM,WAAW,qBAAqB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC;CACpC;AAED,gGAAgG;AAChG,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,IAAI,EAAE,UAAU,CAAC;IACjB;;;;OAIG;IACH,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;IACvB,kEAAkE;IAClE,YAAY,EAAE,OAAO,CAAC;IACtB,wCAAwC;IACxC,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,gFAAgF;IAChF,cAAc,EAAE,YAAY,GAAG,IAAI,CAAC;CACpC;AAED,gFAAgF;AAChF,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,eAAe,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC;;;;OAIG;IACH,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;CACnC;AAED,uFAAuF;AACvF,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,SAAS,GAAG,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,oDAAoD;AACpD,MAAM,WAAW,UAAU;IAC1B,UAAU,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,MAAM,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IAC/B,aAAa,EAAE,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC5C,YAAY,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC1C,GAAG,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC1B,MAAM,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IAC/B,WAAW,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC;CACzC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,cAAc;IAC9B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IACxC,aAAa,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IACtC,YAAY,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAC;CAC5C;AAED,yDAAyD;AACzD,MAAM,WAAW,eAAe;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;CAC1B;AAED,0CAA0C;AAC1C,MAAM,WAAW,yBAAyB;IACzC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IACxC,UAAU,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACzB,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B,aAAa,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IACvC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,aAAa,CAAC,sBAAsB,CAAC,CAAC;CACrD;AAID;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,GACrC,YAAY,KAAK,CAAC,cAAc,CAAC,EACjC,YAAY,MAAM,KAChB,iBAAiB,GAAG,IAQtB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,QAAQ,CAAC,CAAC,SAAS,KAAG,KAAK,CAAC,aAAa,CAe9E,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,iBAAiB,GAAI,aAAa,KAAK,CAAC,SAAS,CAAC,KAAG,KAAK,CAAC,eAAe,CAOtF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,oBAAoB,GAAI,SAAS,yBAAyB,KAAG,UAqHzE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,uBAAuB,GAAI,SAAS,yBAAyB,KAAG,cAS5E,CAAC"}
+{"version":3,"file":"surface.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/surface.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAQ7E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAKrD,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,WAAW,EAAE,OAAO,CAAC;IACrB,uEAAuE;IACvE,WAAW,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB,oFAAoF;IACpF,cAAc,EAAE,YAAY,GAAG,IAAI,CAAC;IACpC,uFAAuF;IACvF,aAAa,EAAE,OAAO,CAAC;IACvB,8FAA8F;IAC9F,YAAY,EAAE,OAAO,CAAC;IACtB,wFAAwF;IACxF,YAAY,EAAE,OAAO,CAAC;IACtB,iEAAiE;IACjE,aAAa,EAAE,OAAO,CAAC;IACvB,mGAAmG;IACnG,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC9C;AAED,wEAAwE;AACxE,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,mGAAmG;IACnG,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC9C,4FAA4F;IAC5F,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED,sEAAsE;AACtE,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,EAAE,OAAO,CAAC;CAClB;AAED,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;CACvB;AAED,2FAA2F;AAC3F,MAAM,WAAW,mBAAmB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,qFAAqF;IACrF,YAAY,EAAE,OAAO,CAAC;IACtB,uDAAuD;IACvD,aAAa,EAAE,OAAO,CAAC;IACvB,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,cAAc,EAAE,YAAY,GAAG,IAAI,CAAC;CACpC;AAED,2EAA2E;AAC3E,MAAM,WAAW,qBAAqB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC;CACpC;AAED,gGAAgG;AAChG,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,IAAI,EAAE,UAAU,CAAC;IACjB;;;;OAIG;IACH,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;IACvB,kEAAkE;IAClE,YAAY,EAAE,OAAO,CAAC;IACtB,wCAAwC;IACxC,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,gFAAgF;IAChF,cAAc,EAAE,YAAY,GAAG,IAAI,CAAC;CACpC;AAED,gFAAgF;AAChF,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,eAAe,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC;;;;OAIG;IACH,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;CACnC;AAED,uFAAuF;AACvF,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,SAAS,GAAG,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,oDAAoD;AACpD,MAAM,WAAW,UAAU;IAC1B,UAAU,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,MAAM,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IAC/B,aAAa,EAAE,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC5C,YAAY,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC1C,GAAG,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC1B,MAAM,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IAC/B,WAAW,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC;CACzC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,cAAc;IAC9B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IACxC,aAAa,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IACtC,YAAY,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAC;CAC5C;AAED,yDAAyD;AACzD,MAAM,WAAW,eAAe;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;CAC1B;AAED,0CAA0C;AAC1C,MAAM,WAAW,yBAAyB;IACzC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IACxC,UAAU,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACzB,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B,aAAa,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IACvC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,aAAa,CAAC,sBAAsB,CAAC,CAAC;CACrD;AAID;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,GACrC,YAAY,KAAK,CAAC,cAAc,CAAC,EACjC,YAAY,MAAM,KAChB,iBAAiB,GAAG,IAQtB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,QAAQ,CAAC,CAAC,SAAS,KAAG,KAAK,CAAC,aAAa,CAe9E,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,iBAAiB,GAAI,aAAa,KAAK,CAAC,SAAS,CAAC,KAAG,KAAK,CAAC,eAAe,CAOtF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,oBAAoB,GAAI,SAAS,yBAAyB,KAAG,UA4HzE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,uBAAuB,GAAI,SAAS,yBAAyB,KAAG,cAS5E,CAAC"}