@heavybit/shared-lib 1.3.2 → 2.7.0

package/dist/esm/express/auth.js

@@ -1,63 +1,110 @@
 import { hasAllPermissions, hasPermission, hasRole } from '../access/index.js';
-import { safeEqual } from '../common/crypto.js';
-import { errorResponse } from '../common/response.js';
-import { CONTEXT_HEADERS, verifyIdentityHeaders } from '../identity/index.js';
-function resolveIdentity(req, options) {
-    const result = verifyIdentityHeaders(req.headers, options.secret, { maxSkewMs: options.maxSkewMs });
-    if (result.status === 'authenticated') {
-        req.user = result.user;
-        return 'ok';
-    }
-    if (result.status === 'invalid') {
-        options.logger?.warn('Rejected forged or stale gateway identity', { reason: result.reason, path: req.path });
-        return 'invalid';
-    }
-    return 'anonymous';
+import { errorBody } from '../common/response.js';
+import { correlationId } from './middleware.js';
+import { updateRequestContext } from '../context/index.js';
+import { assertGatewaySecret, canonicalPath, verifyGatewayIdentity, } from '../identity/index.js';
+/** Collapses the user's scope id lists into the request context's `key → id` map (lists are comma-joined). */
+function contextScopes(user) {
+    return Object.fromEntries(Object.entries(user.scopes).filter(([, ids]) => ids.length).map(([key, ids]) => [key, ids.join(',')]));
 }
-/** Requires a valid gateway-signed identity; 401 otherwise. */
+function createResolver(options) {
+    const secret = assertGatewaySecret(options.secret ?? process.env.GATEWAY_SIGNING_SECRET);
+    const reject = (req, reason) => {
+        const event = { reason, method: req.method, path: canonicalPath(req.originalUrl), requestId: correlationId(req) };
+        options.logger?.warn('Rejected gateway identity', { reason, method: event.method, path: event.path });
+        if (!options.onRejected)
+            return;
+        Promise.resolve()
+            .then(() => options.onRejected?.(event, req))
+            .catch((error) => options.logger?.error('Identity onRejected hook failed', { error: error.message }));
+    };
+    return (req) => {
+        const result = verifyGatewayIdentity({
+            headers: req.headers, method: req.method, path: req.originalUrl, secret, protocol: options.protocol,
+            maxAgeMs: options.maxAgeMs, maxFutureMs: options.maxFutureMs,
+        });
+        if (result.status === 'authenticated') {
+            req.user = result.user;
+            updateRequestContext({ userId: result.user.id, scopes: contextScopes(result.user) });
+            return 'ok';
+        }
+        if (result.status === 'invalid')
+            reject(req, result.reason);
+        return result.status === 'invalid' ? 'invalid' : 'anonymous';
+    };
+}
+const unauthenticated = (req, res, message = 'Authentication required') => res.status(401).json(errorBody('UNAUTHENTICATED', message, { requestId: correlationId(req) }));
+/**
+ * Requires a valid gateway-signed (v2) identity and sets `req.user`; 401 UNAUTHENTICATED (with `requestId`)
+ * otherwise. Also fills the request context's `userId` and `scopes` so log lines carry them.
+ * Throws at startup when the secret is missing or shorter than 32 characters.
+ *
+ * @param options Protocol, secret, replay window, logger and rejection hook.
+ * @returns Express middleware.
+ * @example router.use(authenticateFromGateway({ protocol, logger, onRejected: publishSecurityEvent }));
+ */
 export function authenticateFromGateway(options) {
+    const resolve = createResolver(options);
     return (req, res, next) => {
-        if (resolveIdentity(req, options) === 'ok')
+        if (resolve(req) === 'ok')
             return next();
-        res.status(401).json(errorResponse('Authentication required', undefined, 'UNAUTHENTICATED'));
+        unauthenticated(req, res);
     };
 }
-/** Attaches `req.user` when a valid identity is present; continues anonymously otherwise. */
+/**
+ * Attaches `req.user` when a valid identity is present and continues anonymously when none is sent,
+ * for public routes that personalise. A forged or stale identity is still rejected with 401, never
+ * downgraded to anonymous.
+ *
+ * @param options Same as {@link authenticateFromGateway}.
+ * @returns Express middleware.
+ * @example router.get('/items', optionalAuthFromGateway({ protocol }), controller.list);
+ */
 export function optionalAuthFromGateway(options) {
+    const resolve = createResolver(options);
     return (req, res, next) => {
-        if (resolveIdentity(req, options) === 'invalid') {
-            res.status(401).json(errorResponse('Invalid identity', undefined, 'UNAUTHENTICATED'));
-            return;
-        }
+        if (resolve(req) === 'invalid')
+            return unauthenticated(req, res, 'Invalid identity');
         next();
     };
 }
 function guard(check, message = 'You do not have permission to perform this action') {
     return (req, res, next) => {
-        if (!req.user) {
-            res.status(401).json(errorResponse('Authentication required', undefined, 'UNAUTHENTICATED'));
-            return;
-        }
+        if (!req.user)
+            return unauthenticated(req, res);
         if (!check(req.user)) {
-            res.status(403).json(errorResponse(message, undefined, 'FORBIDDEN'));
+            res.status(403).json(errorBody('FORBIDDEN', message, { requestId: correlationId(req) }));
             return;
         }
         next();
     };
 }
-/** Allows callers holding any of `permissions`. */
+/**
+ * Allows callers holding any of `permissions` (401 without identity, 403 FORBIDDEN otherwise).
+ * A super admin passes every permission guard.
+ *
+ * @example router.post('/refunds', requirePermission('refunds.create'), controller.create);
+ */
 export const requirePermission = (...permissions) => guard((u) => hasPermission(u, ...permissions));
-/** Allows callers holding every one of `permissions`. */
-export const requireAllPermissions = (...permissions) => guard((u) => hasAllPermissions(u, ...permissions));
-/** Allows callers with any of `roles`. Prefer permissions; roles are for coarse gates only. */
+/**
+ * Allows callers holding every one of `permissions`. Accepts a list or rest arguments.
+ *
+ * @example router.delete('/x/:id', requireAllPermissions('x.read', 'x.delete'), controller.remove);
+ */
+export const requireAllPermissions = (...permissions) => {
+    const required = permissions.flat();
+    return guard((u) => hasAllPermissions(u, ...required));
+};
+/**
+ * Allows callers whose session passed the one-time-code (second factor) check; 403 FORBIDDEN otherwise.
+ *
+ * @example router.post('/security/settings', requireOtpVerified(), controller.update);
+ */
+export const requireOtpVerified = () => guard((u) => u.otpVerified === true, 'One-time code verification is required');
+/**
+ * Allows callers with any of `roles`. Prefer permissions; roles are for coarse gates only.
+ *
+ * @example router.use('/ops', requireRole('platform_admin'));
+ */
 export const requireRole = (...roles) => guard((u) => hasRole(u, ...roles), 'Insufficient role');
-/** Guards `/internal/*` routes: requires the shared service secret header. */
-export function requireInternalServiceSecret(secret) {
-    return (req, res, next) => {
-        const provided = req.headers[CONTEXT_HEADERS.INTERNAL_SECRET];
-        if (typeof provided === 'string' && secret && safeEqual(provided, secret))
-            return next();
-        res.status(401).json(errorResponse('Invalid internal service credentials', undefined, 'UNAUTHENTICATED'));
-    };
-}
 //# sourceMappingURL=auth.js.map

package/dist/esm/express/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/express/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAkB9E,SAAS,eAAe,CAAC,GAAY,EAAE,OAA2B;IAChE,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACpG,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,2CAA2C,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7G,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,uBAAuB,CAAC,OAA2B;IACjE,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,EAAE,CAAC;QAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,yBAAyB,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC/F,CAAC,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,uBAAuB,CAAC,OAA2B;IACjE,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,kBAAkB,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,KAAkC,EAAE,OAAO,GAAG,mDAAmD;IAC9G,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,yBAAyB,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC;YAC7F,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,mDAAmD;AACnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAG,WAAqB,EAAkB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC;AAE9H,yDAAyD;AACzD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,WAAqB,EAAkB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC;AAEtI,+FAA+F;AAC/F,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAG,KAAe,EAAkB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE,mBAAmB,CAAC,CAAC;AAE3H,8EAA8E;AAC9E,MAAM,UAAU,4BAA4B,CAAC,MAAc;IACzD,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;QAC9D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,IAAI,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACzF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,sCAAsC,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC5G,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/express/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,mBAAmB,EAAE,aAAa,EAAE,qBAAqB,GAC1D,MAAM,sBAAsB,CAAC;AAuC9B,8GAA8G;AAC9G,SAAS,aAAa,CAAC,IAAc;IACnC,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACnI,CAAC;AAED,SAAS,cAAc,CAAC,OAA2B;IACjD,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACzF,MAAM,MAAM,GAAG,CAAC,GAAY,EAAE,MAAyB,EAAE,EAAE;QACzD,MAAM,KAAK,GAA0B,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QACzI,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACtG,IAAI,CAAC,OAAO,CAAC,UAAU;YAAE,OAAO;QAChC,OAAO,CAAC,OAAO,EAAE;aACd,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;aAC5C,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,iCAAiC,EAAE,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC9H,CAAC,CAAC;IACF,OAAO,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,MAAM,GAAG,qBAAqB,CAAC;YACnC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ;YACnG,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;SAC7D,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YACtC,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACvB,oBAAoB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACrF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5D,OAAO,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;IAC/D,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,CAAC,GAAY,EAAE,GAAa,EAAE,OAAO,GAAG,yBAAyB,EAAE,EAAE,CAC3F,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AAEjG;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAA2B;IACjE,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,EAAE,CAAC;QACzC,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5B,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAA2B;IACjE,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,OAAO,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACrF,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,KAAkC,EAAE,OAAO,GAAG,mDAAmD;IAC9G,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,CAAC,GAAG,CAAC,IAAI;YAAE,OAAO,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAG,WAAqB,EAAkB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC;AAE9H;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,WAAqC,EAAkB,EAAE;IAChG,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;IACpC,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;AACzD,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAmB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,EAAE,wCAAwC,CAAC,CAAC;AAEvI;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAG,KAAe,EAAkB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE,mBAAmB,CAAC,CAAC"}

package/dist/esm/express/index.js

@@ -2,4 +2,7 @@ export * from './auth.js';
 export * from './middleware.js';
 export * from './health.js';
 export * from './security.js';
+export * from './respond.js';
+export * from './step-up.js';
+export * from './internal-caller.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/express/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/express/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/express/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC"}

package/dist/esm/express/internal-caller.js

@@ -0,0 +1,49 @@
+import { errorBody } from '../common/response.js';
+import { internalServiceAuthConfigFromEnv, verifyInternalCaller } from '../common/internal-service-auth.js';
+import { canonicalPath } from '../identity/index.js';
+import { correlationId } from './middleware.js';
+const isUnderPrefix = (path, prefix) => path === prefix || path.startsWith(`${prefix}/`);
+/**
+ * Builds the internal-caller guard for a service, bound to its internal path prefix and accepted credentials.
+ *
+ * @param options Path prefix, credentials and logger.
+ * @returns `{ requireInternalCaller }`.
+ * @throws Error when the prefix is not an absolute path; ConfigError when env credentials are malformed.
+ * @example
+ * const { requireInternalCaller } = createInternalCallerGuards({ pathPrefix: '/internal', logger });
+ * router.get('/internal/records/:id', requireInternalCaller(['alpha-service']), controller.get);
+ */
+export function createInternalCallerGuards(options) {
+    const prefix = options.pathPrefix.replace(/\/+$/, '');
+    if (!prefix.startsWith('/'))
+        throw new Error('createInternalCallerGuards: pathPrefix must be an absolute path such as /internal');
+    const credentials = options.credentials ?? internalServiceAuthConfigFromEnv().credentials;
+    return {
+        requireInternalCaller(allowed) {
+            if (!allowed.length)
+                throw new Error('requireInternalCaller: list at least one caller');
+            const callers = [...allowed];
+            return (req, res, next) => {
+                const path = canonicalPath(req.originalUrl);
+                const requestId = correlationId(req);
+                if (!isUnderPrefix(path, prefix)) {
+                    options.logger?.warn('Internal guard outside the internal prefix', { path });
+                    res.status(403).json(errorBody('FORBIDDEN', 'Not an internal route', { requestId }));
+                    return;
+                }
+                const verdict = verifyInternalCaller({ headers: req.headers, credentials, allowed: callers });
+                if (verdict.ok) {
+                    req.internalCaller = verdict.caller;
+                    return next();
+                }
+                options.logger?.warn('Rejected internal caller', { reason: verdict.reason, caller: verdict.caller, path });
+                if (verdict.status === 401) {
+                    res.status(401).json(errorBody('UNAUTHENTICATED', 'Invalid internal service credentials', { requestId }));
+                    return;
+                }
+                res.status(403).json(errorBody('FORBIDDEN', 'This service may not call this route', { requestId }));
+            };
+        },
+    };
+}
+//# sourceMappingURL=internal-caller.js.map

package/dist/esm/express/internal-caller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-caller.js","sourceRoot":"","sources":["../../../src/express/internal-caller.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,gCAAgC,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC5G,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAkChD,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,MAAc,EAAW,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;AAElH;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAmC;IAC5E,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;IAClI,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,gCAAgC,EAAE,CAAC,WAAW,CAAC;IAE1F,OAAO;QACL,qBAAqB,CAAC,OAAO;YAC3B,IAAI,CAAC,OAAO,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACxF,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;YAC7B,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;gBACzD,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAC5C,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;gBACrC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;oBACjC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,4CAA4C,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC7E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,uBAAuB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;oBACrF,OAAO;gBACT,CAAC;gBACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC9F,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;oBACf,GAAG,CAAC,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC;oBACpC,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBACD,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3G,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC3B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,sCAAsC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;oBAC1G,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,sCAAsC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;YACtG,CAAC,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/esm/express/middleware.js

@@ -1,84 +1,203 @@
-import { isAppError, publicMessage } from '../common/errors.js';
+import { GENERIC_ERROR_MESSAGE, ValidationError, isAppError, publicMessage } from '../common/errors.js';
 import { newId } from '../common/id.js';
-import { errorResponse } from '../common/response.js';
+import { errorBody } from '../common/response.js';
+import { getRequestContext, runWithContext } from '../context/index.js';
 import { CONTEXT_HEADERS } from '../identity/index.js';
 import { zodIssuesToErrors } from '../validation/index.js';
-/** Ensures every request carries `x-correlation-id` (reused from the gateway when present). */
-export function correlationMiddleware() {
+/** An incoming correlation id is trusted only if it is 8–64 chars of `[A-Za-z0-9-]` (no log injection). */
+export const CORRELATION_ID_PATTERN = /^[A-Za-z0-9-]{8,64}$/;
+/**
+ * Gives every request one correlation id and runs the rest of the request inside a
+ * {@link RequestContext}. A valid incoming `x-correlation-id` (see {@link CORRELATION_ID_PATTERN}) is
+ * kept; anything else is replaced with a new ULID. The id is echoed on the response, written back to
+ * the request header (so outbound calls forward it) and becomes every error body's `requestId`.
+ * Mount it first: correlation → json → routes → notFoundHandler → errorHandler.
+ *
+ * @param serviceName Recorded in the context (and so in log lines written without a service).
+ * @returns Express middleware.
+ * @example app.use(correlationMiddleware('orders'));
+ */
+export function correlationMiddleware(serviceName) {
     return (req, res, next) => {
         const incoming = req.headers[CONTEXT_HEADERS.CORRELATION_ID];
-        const id = typeof incoming === 'string' && incoming.length <= 128 ? incoming : newId();
+        const id = typeof incoming === 'string' && CORRELATION_ID_PATTERN.test(incoming) ? incoming : newId();
         req.headers[CONTEXT_HEADERS.CORRELATION_ID] = id;
         res.setHeader(CONTEXT_HEADERS.CORRELATION_ID, id);
-        next();
+        runWithContext({ correlationId: id, service: serviceName }, next);
     };
 }
+/**
+ * The request's correlation id (the source of every error body's `requestId`): the active request
+ * context's id, else the `x-correlation-id` header.
+ *
+ * @param req Express request.
+ * @returns The id, or undefined when neither is present.
+ * @example logger.info('Order placed', { correlationId: correlationId(req) });
+ */
 export function correlationId(req) {
+    const fromContext = getRequestContext()?.correlationId;
+    if (fromContext)
+        return fromContext;
     const value = req.headers[CONTEXT_HEADERS.CORRELATION_ID];
     return typeof value === 'string' ? value : undefined;
 }
-/** Real client IP: gateway-forwarded header first, then Express's `req.ip`. */
+/**
+ * Real client IP: gateway-forwarded header first, then Express's `req.ip`.
+ *
+ * @param req Express request.
+ * @returns The IP, or null when unknown.
+ * @example const ip = clientIp(req);
+ */
 export function clientIp(req) {
     const forwarded = req.headers[CONTEXT_HEADERS.CLIENT_IP];
     if (typeof forwarded === 'string' && forwarded)
         return forwarded;
     return req.ip ?? null;
 }
+/**
+ * The caller's IANA time zone as forwarded by the gateway.
+ *
+ * @param req Express request.
+ * @returns e.g. `Europe/Paris`, or null when not sent.
+ * @example formatInTimeZone(date, clientTimezone(req) ?? 'UTC');
+ */
 export function clientTimezone(req) {
     const tz = req.headers[CONTEXT_HEADERS.TIMEZONE];
     return typeof tz === 'string' && tz ? tz : null;
 }
+/**
+ * The anonymous visitor id forwarded by the gateway (for anonymous visitor state, rate limits and analytics).
+ *
+ * @param req Express request.
+ * @returns The id, or null when not sent.
+ * @example const visitor = req.user?.id ?? anonId(req);
+ */
 export function anonId(req) {
     const id = req.headers[CONTEXT_HEADERS.ANON_ID];
     return typeof id === 'string' && id ? id : null;
 }
-/** Validates and replaces `req[part]` with the parsed value; 422 with field errors on failure. */
-export function validate(schema, part = 'body') {
-    return (req, res, next) => {
-        const result = schema.safeParse(req[part]);
-        if (!result.success) {
-            res.status(422).json(errorResponse('Validation failed', zodIssuesToErrors(result.error), 'VALIDATION_FAILED'));
+const PART_ORDER = ['params', 'query', 'body'];
+/** Field-error keys: body fields keep their own path; params/query are prefixed (`query.limit`). */
+function prefixErrors(part, errors) {
+    if (part === 'body')
+        return errors;
+    return Object.fromEntries(Object.entries(errors).map(([key, messages]) => [key === '_' ? part : `${part}.${key}`, messages]));
+}
+function isSchema(value) {
+    return typeof value?.safeParse === 'function';
+}
+/**
+ * Validates the request with Zod at the controller boundary. Each given part is parsed and
+ * `req[part]` is replaced with the parsed value, so unknown keys are stripped (or rejected with
+ * `.strict()`) and coercions/defaults apply. Every part is checked before failing, and the combined
+ * field errors are thrown as a 422 {@link ValidationError} for the error handler (body fields keep
+ * their path; params and query fields are prefixed, e.g. `params.id`).
+ *
+ * The older single-schema form `validate(schema, part = 'body')` still works.
+ *
+ * @param schemas `{ params?, query?, body? }`, or one schema.
+ * @param part With a single schema: the part it checks (default `body`).
+ * @returns Express middleware.
+ * @example router.patch('/:id', validate({ params: idParam, body: updateSchema }), controller.update);
+ */
+export function validate(schemas, part = 'body') {
+    const parts = isSchema(schemas) ? { [part]: schemas } : schemas;
+    return (req, _res, next) => {
+        let errors = {};
+        const parsed = {};
+        for (const name of PART_ORDER) {
+            const schema = parts[name];
+            if (!schema)
+                continue;
+            const result = schema.safeParse(req[name]);
+            if (result.success)
+                parsed[name] = result.data;
+            else
+                errors = { ...errors, ...prefixErrors(name, zodIssuesToErrors(result.error)) };
+        }
+        if (Object.keys(errors).length > 0) {
+            next(new ValidationError(errors));
             return;
         }
-        // Express 5 exposes req.query as a getter; redefine to store the parsed value.
-        Object.defineProperty(req, part, { value: result.data, writable: true, configurable: true, enumerable: true });
+        for (const [name, value] of Object.entries(parsed)) {
+            // Express 5 exposes req.query as a getter; redefine to store the parsed value.
+            Object.defineProperty(req, name, { value, writable: true, configurable: true, enumerable: true });
+        }
         next();
     };
 }
-/** Wraps an async handler so rejections reach the error middleware (needed on Express 4). */
+/**
+ * Wraps an async handler so rejections reach the error middleware (needed on Express 4; harmless on 5).
+ *
+ * @param fn Async route handler.
+ * @returns A handler that forwards rejections to `next(err)`.
+ * @example router.get('/:id', asyncHandler(controller.get));
+ */
 export function asyncHandler(fn) {
     return (req, res, next) => {
         fn(req, res, next).catch(next);
     };
 }
-/** Maps AppErrors to their status; everything else becomes a logged 500 with a generic message. */
+/** Zod's error, recognised structurally so a service on another zod copy/version still maps to 422. */
+function isZodError(err) {
+    return err instanceof Error && err.name === 'ZodError' && Array.isArray(err.issues);
+}
+/**
+ * Last error middleware. Every body is `{ success: false, code, message, errors?, requestId }`:
+ * - body-parser failures → 400 BAD_REQUEST / 413 PAYLOAD_TOO_LARGE;
+ * - a thrown ZodError (e.g. from `schema.parse`) → 422 VALIDATION_FAILED with field errors;
+ * - AppError → its status, code and errors; 4xx keep their message, 5xx get a generic one; a
+ *   `retryAfterSeconds` becomes the `Retry-After` header;
+ * - anything else → logged in full, answered 500 INTERNAL_ERROR with a generic message.
+ * `requestId` is the request context's correlation id (set by {@link correlationMiddleware}).
+ *
+ * @param logger Receives 5xx details (message, stack, path, correlation id); never sent to the client.
+ * @returns Express error middleware.
+ * @example app.use(notFoundHandler()); app.use(errorHandler(logger));
+ */
 export function errorHandler(logger) {
-    return (err, req, res, _next) => {
-        if (res.headersSent)
+    return (err, req, res, next) => {
+        if (res.headersSent) {
+            next(err);
             return;
+        }
+        const requestId = correlationId(req);
         const bodyError = err;
         if (bodyError?.type === 'entity.parse.failed') {
-            res.status(400).json(errorResponse('Malformed JSON body', undefined, 'BAD_REQUEST'));
+            res.status(400).json(errorBody('BAD_REQUEST', 'Malformed JSON body', { requestId }));
             return;
         }
         if (bodyError?.type === 'entity.too.large') {
-            res.status(413).json(errorResponse('Request body too large', undefined, 'PAYLOAD_TOO_LARGE'));
+            res.status(413).json(errorBody('PAYLOAD_TOO_LARGE', 'Request body too large', { requestId }));
+            return;
+        }
+        if (isZodError(err)) {
+            res.status(422).json(errorBody('VALIDATION_FAILED', 'Validation failed', { errors: zodIssuesToErrors(err), requestId }));
             return;
         }
         if (isAppError(err)) {
             if (err.statusCode >= 500)
-                logger?.error(err.message, { path: req.path, code: err.code, correlationId: correlationId(req) });
-            res.status(err.statusCode).json(errorResponse(publicMessage(err), err.errors, err.code));
+                logger?.error(err.message, { path: req.path, errorCode: err.code, stack: err.stack, correlationId: requestId });
+            if (err.retryAfterSeconds !== undefined)
+                res.setHeader('Retry-After', String(Math.max(0, Math.ceil(err.retryAfterSeconds))));
+            const errors = err.statusCode < 500 ? err.errors : undefined;
+            res.status(err.statusCode).json(errorBody(err.code, publicMessage(err), { errors, requestId }));
             return;
         }
         const error = err instanceof Error ? err : new Error(String(err));
-        logger?.error('Unhandled error', { error: error.message, stack: error.stack, path: req.path, correlationId: correlationId(req) });
-        res.status(500).json(errorResponse('Internal server error', undefined, 'INTERNAL_ERROR'));
+        logger?.error('Unhandled error', { error: error.message, stack: error.stack, path: req.path, correlationId: requestId });
+        res.status(500).json(errorBody('INTERNAL_ERROR', GENERIC_ERROR_MESSAGE, { requestId }));
     };
 }
+/**
+ * Catch-all for unmatched routes: 404 NOT_FOUND with the request id. Mount after every router.
+ *
+ * @returns Express middleware.
+ * @example app.use(notFoundHandler()); app.use(errorHandler(logger));
+ */
 export function notFoundHandler() {
-    return (_req, res) => {
-        res.status(404).json(errorResponse('Resource not found', undefined, 'NOT_FOUND'));
+    return (req, res) => {
+        res.status(404).json(errorBody('NOT_FOUND', 'Resource not found', { requestId: correlationId(req) }));
     };
 }
 //# sourceMappingURL=middleware.js.map

package/dist/esm/express/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../../src/express/middleware.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,+FAA+F;AAC/F,MAAM,UAAU,qBAAqB;IACnC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC;QAC7D,MAAM,EAAE,GAAG,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QACvF,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC;QACjD,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC;IAC1D,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,QAAQ,CAAC,GAAY;IACnC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IACjE,OAAO,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IACjD,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,GAAY;IACjC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IAChD,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAID,kGAAkG;AAClG,MAAM,UAAU,QAAQ,CAAC,MAAkB,EAAE,OAAoB,MAAM;IACrE,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;YAC/G,OAAO;QACT,CAAC;QACD,+EAA+E;QAC/E,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/G,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,YAAY,CAAgC,EAAqE;IAC/H,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,EAAE,CAAC,GAAU,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,YAAY,CAAC,MAAe;IAC1C,OAAO,CAAC,GAAY,EAAE,GAAY,EAAE,GAAa,EAAE,KAAmB,EAAE,EAAE;QACxE,IAAI,GAAG,CAAC,WAAW;YAAE,OAAO;QAC5B,MAAM,SAAS,GAAG,GAAyC,CAAC;QAC5D,IAAI,SAAS,EAAE,IAAI,KAAK,qBAAqB,EAAE,CAAC;YAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,qBAAqB,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QACD,IAAI,SAAS,EAAE,IAAI,KAAK,kBAAkB,EAAE,CAAC;YAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,wBAAwB,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC,CAAC;YAC9F,OAAO;QACT,CAAC;QACD,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG;gBAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7H,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAClE,MAAM,EAAE,KAAK,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,uBAAuB,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC5F,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,oBAAoB,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IACpF,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../../src/express/middleware.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACxG,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAuB,MAAM,qBAAqB,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,2GAA2G;AAC3G,MAAM,CAAC,MAAM,sBAAsB,GAAG,sBAAsB,CAAC;AAE7D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAAoB;IACxD,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC;QAC7D,MAAM,EAAE,GAAG,OAAO,QAAQ,KAAK,QAAQ,IAAI,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QACtG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC;QACjD,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAClD,cAAc,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,MAAM,WAAW,GAAG,iBAAiB,EAAE,EAAE,aAAa,CAAC;IACvD,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IACpC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC;IAC1D,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAY;IACnC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IACjE,OAAO,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC;AACxB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IACjD,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,MAAM,CAAC,GAAY;IACjC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IAChD,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAOD,MAAM,UAAU,GAA2B,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AAEvE,oGAAoG;AACpG,SAAS,YAAY,CAAC,IAAiB,EAAE,MAAgC;IACvE,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACnC,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;AAChI,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAQ,KAAgC,EAAE,SAAS,KAAK,UAAU,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAoC,EAAE,OAAoB,MAAM;IACvF,MAAM,KAAK,GAAmB,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IAChF,OAAO,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB,EAAE,EAAE;QAC1D,IAAI,MAAM,GAA6B,EAAE,CAAC;QAC1C,MAAM,MAAM,GAA0C,EAAE,CAAC;QACzD,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3C,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC;;gBAC1C,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,EAAE,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACtF,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,+EAA+E;YAC/E,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAgC,EAAqE;IAC/H,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,EAAE,CAAC,GAAU,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,SAAS,UAAU,CAAC,GAAY;IAC9B,OAAO,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,OAAO,CAAE,GAA4B,CAAC,MAAM,CAAC,CAAC;AAChH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,MAAe;IAC1C,OAAO,CAAC,GAAY,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACvE,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YACpB,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,GAAyC,CAAC;QAC5D,IAAI,SAAS,EAAE,IAAI,KAAK,qBAAqB,EAAE,CAAC;YAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,qBAAqB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QACD,IAAI,SAAS,EAAE,IAAI,KAAK,kBAAkB,EAAE,CAAC;YAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,EAAE,wBAAwB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;YAC9F,OAAO;QACT,CAAC;QACD,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,MAAM,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;YACzH,OAAO;QACT,CAAC;QACD,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG;gBAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;YAC3I,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS;gBAAE,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7H,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;YAChG,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAClE,MAAM,EAAE,KAAK,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;QACzH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,qBAAqB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAC1F,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,oBAAoB,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACxG,CAAC,CAAC;AACJ,CAAC"}

package/dist/esm/express/respond.js

@@ -0,0 +1,42 @@
+import { cursorPaginatedResponse, successResponse } from '../common/response.js';
+/**
+ * 200 with the success envelope.
+ *
+ * @param res Express response.
+ * @param data The payload placed under `data`.
+ * @param message Optional human-readable message (default `Success`).
+ * @param meta Optional list metadata.
+ * @returns The Express response.
+ * @example ok(res, product, 'Product updated');
+ */
+export function ok(res, data, message, meta) {
+    const body = successResponse(data, message);
+    return res.status(200).json(meta ? { ...body, meta } : body);
+}
+/**
+ * 201 with the success envelope, for a newly created resource.
+ *
+ * @param res Express response.
+ * @param data The created resource (or its id).
+ * @param message Optional message (default `Created`).
+ * @returns The Express response.
+ *
+ * @example created(res, { id }, 'Shop created');
+ */
+export function created(res, data, message = 'Created') {
+    return res.status(201).json(successResponse(data, message));
+}
+/**
+ * 200 with a cursor-paginated list: `data` is the items, `meta` is `{ limit, nextCursor, hasMore }`.
+ *
+ * @param res Express response.
+ * @param page The page from the service (see `buildCursorPageMeta`).
+ * @param message Optional message.
+ * @returns The Express response.
+ *
+ * @example okPage(res, await service.list(scope, { cursor, limit }));
+ */
+export function okPage(res, page, message) {
+    return res.status(200).json(cursorPaginatedResponse(page, message));
+}
+//# sourceMappingURL=respond.js.map

package/dist/esm/express/respond.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"respond.js","sourceRoot":"","sources":["../../../src/express/respond.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGjF;;;;;;;;;GASG;AACH,MAAM,UAAU,EAAE,CAAI,GAAa,EAAE,IAAO,EAAE,OAAgB,EAAE,IAAsC;IACpG,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,OAAO,CAAI,GAAa,EAAE,IAAO,EAAE,OAAO,GAAG,SAAS;IACpE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,MAAM,CAAI,GAAa,EAAE,IAAmB,EAAE,OAAgB;IAC5E,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;AACtE,CAAC"}

package/dist/esm/express/step-up.js

@@ -0,0 +1,38 @@
+import { errorBody } from '../common/response.js';
+import { DEFAULT_STEP_UP_WINDOW_MS, STEP_UP_REQUIRED_CODE, stepUpStatus, } from '../identity/step-up.js';
+import { correlationId } from './middleware.js';
+/**
+ * Builds the step-up guard for an app's catalogue. Must run after `authenticateFromGateway`, which sets
+ * `req.user.stepUpAt` only from the signed `x-step-up-at` header. Single-use proofs are consumed by the
+ * gateway; the service sees only the verified time. Throws at startup for an unknown scope or a bad window.
+ *
+ * @param options Catalogue, freshness window and clock.
+ * @returns `requireStepUp(scope, route?)` and `declaredStepUpRoutes()`.
+ * @example
+ * const { requireStepUp } = createStepUpGuards({ catalogue: stepUpScopes });
+ * router.post('/refunds/:id', requirePermission('refunds.create'), requireStepUp('refund-large', 'POST /refunds/:id'), controller.refund);
+ */
+export function createStepUpGuards(options) {
+    const windowMs = options.windowMs ?? DEFAULT_STEP_UP_WINDOW_MS;
+    if (!Number.isFinite(windowMs) || windowMs <= 0)
+        throw new Error(`createStepUpGuards: windowMs must be positive (got ${windowMs})`);
+    const now = options.now ?? Date.now;
+    const declared = [];
+    const requireStepUp = (scope, route) => {
+        const rules = options.catalogue[scope];
+        if (!rules)
+            throw new Error(`requireStepUp: unknown step-up scope "${scope}"`);
+        declared.push({ scope, singleUse: rules.singleUse === true, ...(route ? { route } : {}) });
+        return (req, res, next) => {
+            if (!req.user) {
+                res.status(401).json(errorBody('UNAUTHENTICATED', 'Authentication required', { requestId: correlationId(req) }));
+                return;
+            }
+            if (stepUpStatus(req.user.stepUpAt, windowMs, now()) === 'fresh')
+                return next();
+            res.status(403).json({ ...errorBody(STEP_UP_REQUIRED_CODE, 'Please confirm it is you to continue', { requestId: correlationId(req) }), scope });
+        };
+    };
+    return { requireStepUp, declaredStepUpRoutes: () => declared.map((entry) => ({ ...entry })) };
+}
+//# sourceMappingURL=step-up.js.map

package/dist/esm/express/step-up.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up.js","sourceRoot":"","sources":["../../../src/express/step-up.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EACL,yBAAyB,EAAE,qBAAqB,EAAE,YAAY,GAC/D,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AA4BhD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAmB,OAA8B;IACjF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,yBAAyB,CAAC;IAC/D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,QAAQ,GAAG,CAAC,CAAC;IACpI,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,QAAQ,GAAkC,EAAE,CAAC;IAEnD,MAAM,aAAa,GAAG,CAAC,KAAQ,EAAE,KAAc,EAAkB,EAAE;QACjE,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,GAAG,CAAC,CAAC;QAC/E,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3F,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;YACzD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,yBAAyB,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;gBACjH,OAAO;YACT,CAAC;YACD,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,OAAO;gBAAE,OAAO,IAAI,EAAE,CAAC;YAChF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,SAAS,CAAC,qBAAqB,EAAE,sCAAsC,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAClJ,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;AAChG,CAAC"}