@jini-ai/platform 0.1.0

package/dist/asset-cache.js

@@ -0,0 +1,423 @@
+// Local disk cache + same-origin proxy for external images/videos referenced
+// by sandboxed HTML (an iframe preview, an embedded document, etc.) that a
+// host application renders on cross-origin CDNs.
+//
+// Two problems this solves for that sandboxed content:
+//   1. A CSP like `img-src 'self' data: blob:; media-src 'self' ...` blocks
+//      absolute third-party URLs outright inside the sandbox.
+//   2. Even when reachable, those hosts have no nearby edge for many users,
+//      so each render re-pays multi-second cross-border latency per asset.
+//
+// A caller rewrites matching URLs (via `assetCacheRewriteUrl`) to a
+// same-origin route it serves from this cache: fetched once, validated,
+// stored content-addressably on disk, and replayed instantly afterwards.
+//
+// SSRF is the load-bearing risk here: the route fetches a caller-supplied URL.
+// `assertSafePublicUrl` rejects non-http(s) schemes, embedded credentials,
+// localhost, and literal private IPs up-front. The authoritative guard against
+// DNS rebinding / TOCTOU is `createValidatingLookup`: it is installed as the
+// undici Agent's connection-time `lookup`, so the address that is *validated*
+// is the exact address the socket *connects to* — there is no separate
+// validation lookup a rebinding resolver could diverge from.
+import { createHash } from 'node:crypto';
+import { lookup as dnsLookupCb } from 'node:dns';
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { isIP } from 'node:net';
+import path from 'node:path';
+import { Agent } from 'undici';
+/** Media extensions we are willing to cache + proxy. Anything else (HTML,
+ *  CSS, JS, fonts) is intentionally left alone so this surface never becomes a
+ *  general-purpose open proxy. */
+export const CACHEABLE_MEDIA_EXT = /\.(?:png|jpe?g|webp|gif|avif|svg|mp4|webm|mov|m4v|ogg|mp3|wav)(?:$|[?#])/i;
+const EXT_TO_MIME = {
+    '.png': 'image/png',
+    '.jpg': 'image/jpeg',
+    '.jpeg': 'image/jpeg',
+    '.webp': 'image/webp',
+    '.gif': 'image/gif',
+    '.avif': 'image/avif',
+    '.svg': 'image/svg+xml',
+    '.mp4': 'video/mp4',
+    '.webm': 'video/webm',
+    '.mov': 'video/quicktime',
+    '.m4v': 'video/x-m4v',
+    '.ogg': 'audio/ogg',
+    '.mp3': 'audio/mpeg',
+    '.wav': 'audio/wav',
+};
+/** True when `raw` is an absolute http(s) URL pointing at a media file we are
+ *  willing to route through the cache. Pure + side-effect free so the URL
+ *  rewriter and tests can share the exact predicate. */
+export function isCacheableExternalUrl(raw) {
+    if (typeof raw !== 'string')
+        return false;
+    const value = raw.trim();
+    if (!/^https?:\/\//i.test(value))
+        return false;
+    // `String#split` always returns a non-empty array (even `''.split(x)` is
+    // `['']`), so index 0 is never `undefined` — the `!` narrows a
+    // `noUncheckedIndexedAccess` false positive, not a real fallback path.
+    const pathOnly = value.split(/[?#]/)[0];
+    return CACHEABLE_MEDIA_EXT.test(pathOnly) || CACHEABLE_MEDIA_EXT.test(value);
+}
+/** Map a cacheable external URL to its same-origin proxy URL. `routePath`
+ *  defaults to `/api/asset-cache` but is caller-configurable since the route
+ *  is mounted by the host application, not this package. */
+export function assetCacheRewriteUrl(raw, routePath = '/api/asset-cache') {
+    return `${routePath}?url=${encodeURIComponent(raw.trim())}`;
+}
+/** Error carrying the HTTP status the route should surface. */
+export class AssetCacheError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.name = 'AssetCacheError';
+        this.status = status;
+    }
+}
+/** Expand an IPv6 literal (with `::` compression and/or an embedded dotted
+ *  IPv4 tail) into its eight 16-bit groups, or null if it does not parse.
+ *  Node's URL parser normalizes mapped literals to hex (`::ffff:127.0.0.1` →
+ *  `::ffff:7f00:1`), so a string regex can't reliably spot the mapped range —
+ *  we have to canonicalize.
+ *
+ *  Exported (previously module-private) so its parse-failure guards are
+ *  directly unit-testable: `isPrivateAddress`'s only real call site gates
+ *  every call behind `net.isIP(addr) === 6`, and Node's `isIP` already fully
+ *  validates IPv6 syntax (including embedded-IPv4-tail octet ranges) before
+ *  returning 6 — empirically re-verified this session by fuzzing ~10k
+ *  `isIP`-accepted v6 literals through this function's guards with zero
+ *  hits — so none of these guards are reachable through that path. They stay
+ *  as real defense-in-depth (fail closed with `null` rather than trust a
+ *  platform primitive never changing behavior), matching this file's
+ *  "exported for direct unit testing" precedent (see `readBodyCapped`'s
+ *  abort parameter). */
+export function expandIpv6(addr) {
+    // `String#split` always returns a non-empty array, so index 0 is never
+    // `undefined` — the `!` narrows a `noUncheckedIndexedAccess` false
+    // positive, not a real fallback path.
+    let s = addr.toLowerCase().split('%')[0];
+    if (!s.includes(':'))
+        return null;
+    // Fold a trailing dotted IPv4 (`…:1.2.3.4`) into two hex groups.
+    const v4 = /^(.*:)(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/.exec(s);
+    if (v4) {
+        // `v4[2]` is the regex's second (mandatory, non-optional) capture group
+        // of a successful match — always defined.
+        const o = v4[2].split('.').map((n) => Number(n));
+        if (o.length !== 4 || o.some((n) => !Number.isInteger(n) || n < 0 || n > 255))
+            return null;
+        // `o` is now a validated 4-element array — indices 0-3 always defined.
+        const hi = (((o[0] << 8) | o[1])).toString(16);
+        const lo = (((o[2] << 8) | o[3])).toString(16);
+        s = `${v4[1]}${hi}:${lo}`;
+    }
+    const halves = s.split('::');
+    if (halves.length > 2)
+        return null;
+    const parse = (p) => p === '' ? [] : p.split(':').map((g) => (/^[0-9a-f]{1,4}$/.test(g) ? parseInt(g, 16) : Number.NaN));
+    // `halves` always has at least one element (split guarantee).
+    const left = parse(halves[0]);
+    let groups;
+    if (halves.length === 1) {
+        groups = left;
+    }
+    else {
+        // `halves.length === 2` here (the `> 2` case already returned above).
+        const right = parse(halves[1]);
+        const fill = 8 - left.length - right.length;
+        if (fill < 1)
+            return null;
+        groups = [...left, ...new Array(fill).fill(0), ...right];
+    }
+    if (groups.length !== 8 || groups.some((g) => Number.isNaN(g) || g < 0 || g > 0xffff))
+        return null;
+    return groups;
+}
+/** True for any address an external CDN must never resolve to: loopback,
+ *  link-local, private, CGNAT, ULA, multicast, or unspecified. An unparseable
+ *  input is treated as unsafe. */
+export function isPrivateAddress(addr) {
+    const fam = isIP(addr);
+    if (fam === 4) {
+        // `net.isIP(addr) === 4` already guarantees `addr` is a syntactically
+        // valid dotted-quad with four 0-255 decimal octets (no leading-zero
+        // octal ambiguity, no out-of-range component) — empirically re-verified
+        // this session by fuzzing 500k+ candidate strings through `isIP` and
+        // this same re-derivation with zero divergences. `o` is therefore always
+        // a validated 4-element array.
+        const o = addr.split('.').map((n) => Number(n));
+        const a = o[0];
+        const b = o[1];
+        if (a === 0)
+            return true; // "this" network / unspecified
+        if (a === 10)
+            return true; // private
+        if (a === 127)
+            return true; // loopback
+        if (a === 169 && b === 254)
+            return true; // link-local
+        if (a === 172 && b >= 16 && b <= 31)
+            return true; // private
+        if (a === 192 && b === 168)
+            return true; // private
+        if (a === 100 && b >= 64 && b <= 127)
+            return true; // CGNAT
+        if (a >= 224)
+            return true; // multicast + reserved
+        return false;
+    }
+    if (fam === 6) {
+        const groups = expandIpv6(addr);
+        // `net.isIP(addr) === 6` already guarantees `addr` is syntactically valid
+        // IPv6 (Node validates this before classifying the family), and
+        // `expandIpv6` implements the same canonicalization Node's own parser
+        // does, so it never returns `null` for an `isIP`-accepted literal —
+        // empirically re-verified this session by fuzzing ~10k `isIP`-accepted
+        // v6 literals through `expandIpv6` with zero `null` results (see
+        // `expandIpv6`'s doc comment and `source-map.md`'s 2026-07-22 entry).
+        // Kept as a real fail-closed guard (defense-in-depth against a future
+        // change to either parser) rather than asserted away, so it stays
+        // provably-unreachable-but-intentional instead of a forced test.
+        if (!groups)
+            return true; // can't canonicalize a "valid" v6 → refuse
+        // IPv4-mapped (`::ffff:0:0/96`) and the deprecated IPv4-compatible
+        // (`::0:0/96`, excluding :: / ::1) carry an embedded IPv4 — classify it by
+        // its real v4 range so `::ffff:7f00:1` (== 127.0.0.1) is caught.
+        const topZero = groups.slice(0, 5).every((g) => g === 0);
+        if (topZero && (groups[5] === 0xffff || groups[5] === 0)) {
+            // `groups` is a validated 8-element array once non-null — indices 6-7
+            // always defined.
+            const a = groups[6] >> 8;
+            const b = groups[6] & 0xff;
+            const c = groups[7] >> 8;
+            const d = groups[7] & 0xff;
+            if (groups[5] === 0xffff || a !== 0 || b !== 0) {
+                return isPrivateAddress(`${a}.${b}.${c}.${d}`);
+            }
+        }
+        if (groups.every((g) => g === 0))
+            return true; // ::  (unspecified)
+        if (groups.slice(0, 7).every((g) => g === 0) && groups[7] === 1)
+            return true; // ::1 loopback
+        const first = groups[0];
+        if ((first & 0xffc0) === 0xfe80)
+            return true; // link-local fe80::/10 (fe80–febf)
+        if ((first & 0xfe00) === 0xfc00)
+            return true; // unique-local fc00::/7
+        if ((first & 0xff00) === 0xff00)
+            return true; // multicast ff00::/8
+        return false;
+    }
+    return true; // not a literal IP — caller must resolve before trusting it
+}
+/** Cheap up-front rejection: enforce http(s), no embedded credentials, no
+ *  localhost, and no *literal* private IP. This is NOT the DNS-rebinding guard
+ *  (that is `createValidatingLookup`, applied at connection time) — it only
+ *  fast-fails the obvious cases before any socket is opened. */
+export function assertSafePublicUrl(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new AssetCacheError(400, 'invalid url');
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        throw new AssetCacheError(400, 'unsupported url scheme');
+    }
+    if (url.username || url.password) {
+        throw new AssetCacheError(400, 'url credentials are not allowed');
+    }
+    const host = url.hostname.replace(/^\[|\]$/g, '');
+    const lowerHost = host.toLowerCase();
+    if (lowerHost === 'localhost' || lowerHost.endsWith('.localhost')) {
+        throw new AssetCacheError(400, 'localhost is not allowed');
+    }
+    if (isIP(host) && isPrivateAddress(host)) {
+        throw new AssetCacheError(400, 'url points at a private address');
+    }
+    return url;
+}
+/** Wrap a `dns.lookup`-shaped resolver so the resolved address is rejected when
+ *  it is private. Installed as the undici Agent's connection-time `lookup`, so
+ *  the validated address IS the one the socket connects to — closing the
+ *  DNS-rebinding / TOCTOU gap a separate pre-validation lookup would leave open.
+ *  Exported so the guard can be unit-tested without standing up a server. */
+export function createValidatingLookup(lookupImpl = dnsLookupCb) {
+    return function validatingLookup(hostname, options, callback) {
+        const cb = (typeof options === 'function' ? options : callback);
+        const opts = (typeof options === 'function' ? {} : (options ?? {}));
+        lookupImpl(hostname, opts, (err, address, family) => {
+            if (err)
+                return cb(err);
+            const list = Array.isArray(address) ? address : [{ address, family }];
+            for (const entry of list) {
+                const addr = typeof entry === 'string' ? entry : entry.address;
+                if (isPrivateAddress(addr)) {
+                    return cb(new AssetCacheError(400, 'host resolves to a private address'));
+                }
+            }
+            return cb(null, address, family);
+        });
+    };
+}
+/** Build a disk-backed cache for external sandboxed-content media. Concurrent
+ *  requests for the same URL share one in-flight fetch; completed fetches
+ *  persist to `<cacheDir>/<sha256>` (+ `.json` sidecar) and are replayed from
+ *  disk. */
+export function createAssetCache(opts) {
+    const cacheDir = opts.cacheDir;
+    const maxBytes = opts.maxBytes ?? 64 * 1024 * 1024;
+    const timeoutMs = opts.fetchTimeoutMs ?? 15_000;
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    // Pin SSRF validation to the actual outbound connection: the Agent resolves
+    // the host once, and `validatingLookup` rejects the connection if that exact
+    // address is private. No separate pre-validation lookup to rebind around.
+    const dispatcher = new Agent({
+        connect: { lookup: createValidatingLookup(opts.lookupImpl) },
+    });
+    const inflight = new Map();
+    function keyFor(rawUrl) {
+        return createHash('sha256').update(rawUrl).digest('hex');
+    }
+    async function readFromDisk(key) {
+        const blobPath = path.join(cacheDir, key);
+        const metaPath = `${blobPath}.json`;
+        try {
+            const [buf, metaRaw] = await Promise.all([readFile(blobPath), readFile(metaPath, 'utf8')]);
+            const meta = JSON.parse(metaRaw);
+            const contentType = typeof meta.contentType === 'string' && meta.contentType ? meta.contentType : 'application/octet-stream';
+            return { buf, contentType };
+        }
+        catch {
+            return null;
+        }
+    }
+    async function writeToDisk(key, result) {
+        await mkdir(cacheDir, { recursive: true });
+        const blobPath = path.join(cacheDir, key);
+        const tmpPath = `${blobPath}.${process.pid}.tmp`;
+        await writeFile(tmpPath, result.buf);
+        await rename(tmpPath, blobPath);
+        await writeFile(`${blobPath}.json`, JSON.stringify({ contentType: result.contentType }));
+    }
+    function resolveContentType(headerValue, url) {
+        // `(headerValue ?? '')` is reachable (no content-type header at all). The
+        // trailing `?? ''` after the optional-chained `.split(';')[0]?.trim()` is
+        // not: `String#split` always returns a non-empty array, so `[0]` is never
+        // `undefined` and `?.` never short-circuits — kept for
+        // `noUncheckedIndexedAccess`, not a real fallback path.
+        const header = (headerValue ?? '').split(';')[0].trim().toLowerCase();
+        if (/^(?:image|video|audio)\//.test(header))
+            return header;
+        const ext = path.posix.extname(url.pathname).toLowerCase();
+        const guessed = EXT_TO_MIME[ext];
+        if (guessed)
+            return guessed;
+        throw new AssetCacheError(415, `unsupported content-type: ${header || 'unknown'}`);
+    }
+    /** Drain the body, aborting the moment the accumulated size exceeds
+     *  `maxBytes`. A response without a trustworthy Content-Length must never be
+     *  fully buffered first — that would turn this caller-supplied proxy into a
+     *  memory-exhaustion path. */
+    async function readBodyCapped(response, controller) {
+        const body = response.body;
+        if (!body) {
+            const ab = await response.arrayBuffer();
+            if (ab.byteLength > maxBytes)
+                throw new AssetCacheError(413, 'asset exceeds size limit');
+            return Buffer.from(ab);
+        }
+        const reader = body.getReader();
+        const chunks = [];
+        let total = 0;
+        try {
+            for (;;) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                if (!value)
+                    continue;
+                total += value.byteLength;
+                if (total > maxBytes) {
+                    controller.abort(); // stop pulling more bytes from upstream
+                    throw new AssetCacheError(413, 'asset exceeds size limit');
+                }
+                chunks.push(value);
+            }
+        }
+        finally {
+            try {
+                await reader.cancel();
+            }
+            catch {
+                // reader already closed / errored — nothing to release
+            }
+        }
+        return Buffer.concat(chunks);
+    }
+    async function fetchAndStore(rawUrl, key) {
+        const url = assertSafePublicUrl(rawUrl);
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), timeoutMs);
+        try {
+            let response;
+            try {
+                // `dispatcher` carries the connection-time SSRF guard. It is an undici
+                // extension of RequestInit; attach it at runtime to avoid the
+                // undici-types (bundled with @types/node) vs undici@7 Dispatcher version
+                // skew that a typed field would trip over.
+                const init = { redirect: 'error', signal: controller.signal };
+                init.dispatcher = dispatcher;
+                response = await fetchImpl(url, init);
+            }
+            catch (err) {
+                throw new AssetCacheError(502, `fetch failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            if (!response.ok) {
+                throw new AssetCacheError(502, `upstream responded ${response.status}`);
+            }
+            const declaredLength = Number(response.headers.get('content-length') ?? '');
+            if (Number.isFinite(declaredLength) && declaredLength > maxBytes) {
+                throw new AssetCacheError(413, 'asset exceeds size limit');
+            }
+            const contentType = resolveContentType(response.headers.get('content-type'), url);
+            const buf = await readBodyCapped(response, controller);
+            const result = { buf, contentType };
+            try {
+                await writeToDisk(key, result);
+            }
+            catch {
+                // A cache-write failure must not fail the request; serve from memory.
+            }
+            return result;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    async function get(rawUrl) {
+        if (!isCacheableExternalUrl(rawUrl)) {
+            throw new AssetCacheError(400, 'url is not a cacheable external media url');
+        }
+        const key = keyFor(rawUrl.trim());
+        const cached = await readFromDisk(key);
+        if (cached)
+            return cached;
+        const existing = inflight.get(key);
+        if (existing)
+            return existing;
+        const pending = fetchAndStore(rawUrl.trim(), key).finally(() => {
+            inflight.delete(key);
+        });
+        inflight.set(key, pending);
+        return pending;
+    }
+    return { get };
+}
+/** Exposed for tests that need to assert the on-disk key layout. */
+export function assetCacheKey(rawUrl) {
+    return createHash('sha256').update(rawUrl.trim()).digest('hex');
+}
+//# sourceMappingURL=asset-cache.js.map

package/dist/asset-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-cache.js","sourceRoot":"","sources":["../src/asset-cache.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,2EAA2E;AAC3E,iDAAiD;AACjD,EAAE;AACF,uDAAuD;AACvD,4EAA4E;AAC5E,8DAA8D;AAC9D,4EAA4E;AAC5E,2EAA2E;AAC3E,EAAE;AACF,oEAAoE;AACpE,wEAAwE;AACxE,yEAAyE;AACzE,EAAE;AACF,+EAA+E;AAC/E,2EAA2E;AAC3E,+EAA+E;AAC/E,6EAA6E;AAC7E,8EAA8E;AAC9E,uEAAuE;AACvE,6DAA6D;AAE7D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,IAAI,WAAW,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,IAAI,EAAuB,MAAM,UAAU,CAAC;AACrD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAE/B;;kCAEkC;AAClC,MAAM,CAAC,MAAM,mBAAmB,GAC9B,2EAA2E,CAAC;AAE9E,MAAM,WAAW,GAA2B;IAC1C,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,iBAAiB;IACzB,MAAM,EAAE,aAAa;IACrB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,WAAW;CACpB,CAAC;AAEF;;wDAEwD;AACxD,MAAM,UAAU,sBAAsB,CAAC,GAAY;IACjD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,yEAAyE;IACzE,+DAA+D;IAC/D,uEAAuE;IACvE,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,CAAC;IACzC,OAAO,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC/E,CAAC;AAED;;4DAE4D;AAC5D,MAAM,UAAU,oBAAoB,CAAC,GAAW,EAAE,SAAS,GAAG,kBAAkB;IAC9E,OAAO,GAAG,SAAS,QAAQ,kBAAkB,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,+DAA+D;AAC/D,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,MAAM,CAAS;IACxB,YAAY,MAAc,EAAE,OAAe;QACzC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;;;;;;;;;;;;;;wBAgBwB;AACxB,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,uEAAuE;IACvE,mEAAmE;IACnE,sCAAsC;IACtC,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IAC1C,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,iEAAiE;IACjE,MAAM,EAAE,GAAG,6CAA6C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,EAAE,EAAE,CAAC;QACP,wEAAwE;QACxE,0CAA0C;QAC1C,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3F,uEAAuE;QACvE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACjD,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACjD,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,KAAK,GAAG,CAAC,CAAS,EAAY,EAAE,CACpC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACtG,8DAA8D;IAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;IAC/B,IAAI,MAAgB,CAAC;IACrB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;SAAM,CAAC;QACN,sEAAsE;QACtE,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC5C,IAAI,IAAI,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACnG,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;kCAEkC;AAClC,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACd,sEAAsE;QACtE,oEAAoE;QACpE,wEAAwE;QACxE,qEAAqE;QACrE,yEAAyE;QACzE,+BAA+B;QAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QAChB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QAChB,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,+BAA+B;QACzD,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC,CAAC,UAAU;QACrC,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,WAAW;QACvC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,aAAa;QACtD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC,CAAC,UAAU;QAC5D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,UAAU;QACnD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,QAAQ;QAC3D,IAAI,CAAC,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,uBAAuB;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAChC,0EAA0E;QAC1E,gEAAgE;QAChE,sEAAsE;QACtE,oEAAoE;QACpE,uEAAuE;QACvE,iEAAiE;QACjE,sEAAsE;QACtE,sEAAsE;QACtE,kEAAkE;QAClE,iEAAiE;QACjE,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,CAAC,2CAA2C;QACrE,mEAAmE;QACnE,2EAA2E;QAC3E,iEAAiE;QACjE,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACzD,sEAAsE;YACtE,kBAAkB;YAClB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC;YAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC;YAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC;YAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC;YAC5B,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/C,OAAO,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,oBAAoB;QACnE,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,eAAe;QAC7F,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC,CAAC,mCAAmC;QACjF,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC,CAAC,wBAAwB;QACtE,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC,CAAC,qBAAqB;QACnE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,4DAA4D;AAC3E,CAAC;AAED;;;gEAGgE;AAChE,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,SAAS,KAAK,WAAW,IAAI,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAID;;;;6EAI6E;AAC7E,MAAM,UAAU,sBAAsB,CAAC,aAA0B,WAAW;IAC1E,OAAO,SAAS,gBAAgB,CAC9B,QAAgB,EAChB,OAAgB,EAChB,QAA0E;QAE1E,MAAM,EAAE,GAAG,CAAC,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAIrD,CAAC;QACV,MAAM,IAAI,GAAG,CAAC,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAA4B,CAAC;QAC9F,UAAgH,CAC/G,QAAQ,EACR,IAAI,EACJ,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;YACvB,IAAI,GAAG;gBAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;YACxB,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YACtE,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;gBACzB,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,KAA6B,CAAC,OAAO,CAAC;gBACxF,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC3B,OAAO,EAAE,CAAC,IAAI,eAAe,CAAC,GAAG,EAAE,oCAAoC,CAAC,CAAC,CAAC;gBAC5E,CAAC;YACH,CAAC;YACD,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAwBD;;;YAGY;AACZ,MAAM,UAAU,gBAAgB,CAAC,IAAuB;IACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,4EAA4E;IAC5E,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,UAAU,GAAG,IAAI,KAAK,CAAC;QAC3B,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAA8B,EAAE;KAC1F,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAqC,CAAC;IAE9D,SAAS,MAAM,CAAC,MAAc;QAC5B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,GAAW;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,GAAG,QAAQ,OAAO,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;YAC3F,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA8B,CAAC;YAC9D,MAAM,WAAW,GACf,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,0BAA0B,CAAC;YAC3G,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,MAAwB;QAC9D,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;QACjD,MAAM,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChC,MAAM,SAAS,CAAC,GAAG,QAAQ,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED,SAAS,kBAAkB,CAAC,WAA0B,EAAE,GAAQ;QAC9D,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,uDAAuD;QACvD,wDAAwD;QACxD,MAAM,MAAM,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACvE,IAAI,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;QAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,6BAA6B,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;IACrF,CAAC;IAED;;;kCAG8B;IAC9B,KAAK,UAAU,cAAc,CAAC,QAAkB,EAAE,UAA2B;QAC3E,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;YACxC,IAAI,EAAE,CAAC,UAAU,GAAG,QAAQ;gBAAE,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;YACzF,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,CAAC;YACH,SAAS,CAAC;gBACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,IAAI;oBAAE,MAAM;gBAChB,IAAI,CAAC,KAAK;oBAAE,SAAS;gBACrB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;gBAC1B,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;oBACrB,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,wCAAwC;oBAC5D,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;gBAC7D,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,uDAAuD;YACzD,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,GAAW;QACtD,MAAM,GAAG,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,IAAI,QAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,uEAAuE;gBACvE,8DAA8D;gBAC9D,yEAAyE;gBACzE,2CAA2C;gBAC3C,MAAM,IAAI,GAAgB,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;gBAC1E,IAAiC,CAAC,UAAU,GAAG,UAAU,CAAC;gBAC3D,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,iBAAiB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACtG,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,sBAAsB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5E,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,QAAQ,EAAE,CAAC;gBACjE,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;YAC7D,CAAC;YACD,MAAM,WAAW,GAAG,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,GAAG,CAAC,CAAC;YAClF,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YACvD,MAAM,MAAM,GAAqB,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;YACtD,IAAI,CAAC;gBACH,MAAM,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;YACxE,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,KAAK,UAAU,GAAG,CAAC,MAAc;QAC/B,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,2CAA2C,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAC7D,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC3B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,CAAC;AACjB,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC"}

package/dist/aws-sigv4.d.ts

@@ -0,0 +1,51 @@
+/** AWS credentials used to derive a SigV4 signature. */
+export interface SigV4Credentials {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+}
+/** Input to {@link signSigV4}. */
+export interface SignSigV4Input {
+    method: string;
+    /**
+     * Canonical path (URI-encoded but with `/` preserved between segments).
+     * For S3 object keys, the caller must double-encode RFC-3986-reserved
+     * chars beyond the canonical pass.
+     */
+    path: string;
+    /** Already-stringified canonical query (sorted `key=value` join). Pass `''` when the request has no query. */
+    query: string;
+    /** Mutable lower-case header map. The signer adds the four amz headers and the Authorization header. */
+    headers: Record<string, string>;
+    /** Raw body bytes; pass an empty Buffer for no-body requests. */
+    body: Buffer;
+    region: string;
+    service: string;
+    credentials: SigV4Credentials;
+    /** ISO-8601 UTC datetime used for the signature. Defaults to `new Date()`. */
+    now?: Date;
+}
+/** Result of {@link signSigV4} — the same values written into `input.headers`, surfaced directly for convenience. */
+export interface SignSigV4Result {
+    authorization: string;
+    amzDate: string;
+    contentSha256: string;
+}
+/**
+ * Signs an HTTP request per the AWS Signature Version 4 recipe, mutating
+ * `input.headers` in place and returning the same signature fields.
+ *
+ * @param input - Method/path/query/headers/body plus region, service, and credentials.
+ * @returns The `authorization` header value, the `x-amz-date` used, and the body's SHA-256 hex digest.
+ */
+export declare function signSigV4(input: SignSigV4Input): SignSigV4Result;
+/**
+ * URI-encodes a path segment per RFC 3986, with the AWS twist that reserved
+ * chars outside the unreserved set (`!'()*`) get `%HH`-encoded even though
+ * `encodeURIComponent` leaves them alone.
+ *
+ * @param seg - A single path segment (no `/`).
+ * @returns The RFC-3986/AWS-encoded segment.
+ */
+export declare function encodeS3PathSegment(seg: string): string;
+//# sourceMappingURL=aws-sigv4.d.ts.map

package/dist/aws-sigv4.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-sigv4.d.ts","sourceRoot":"","sources":["../src/aws-sigv4.ts"],"names":[],"mappings":"AA2BA,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,kCAAkC;AAClC,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,8GAA8G;IAC9G,KAAK,EAAE,MAAM,CAAC;IACd,wGAAwG;IACxG,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,gBAAgB,CAAC;IAC9B,8EAA8E;IAC9E,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,qHAAqH;AACrH,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,eAAe,CAmDhE;AAoBD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvD"}

package/dist/aws-sigv4.js

@@ -0,0 +1,104 @@
+/**
+ * @module aws-sigv4
+ *
+ * Minimal AWS Signature V4 signer, implementing the spec'd canonical-request /
+ * string-to-sign / signing-key / authorization recipe with only `node:crypto`.
+ * No `@aws-sdk/*` dependency is pulled in — a host daemon that only needs to
+ * sign a handful of S3-compatible requests stays free of an extra 60+ MB of
+ * SDK code on disk.
+ *
+ * References:
+ *   https://docs.aws.amazon.com/general/latest/gr/sigv4_signing.html
+ *   https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-header-based-auth.html
+ *
+ * Caller passes the HTTP method + path + query + headers + body, the region +
+ * service (e.g. `'s3'`) + AWS access key + secret key, an optional
+ * `sessionToken` (for STS-vended creds), and an optional `now` override so
+ * tests can pin deterministic signatures.
+ *
+ * The signer mutates the supplied headers map by adding `authorization`,
+ * `x-amz-date`, `x-amz-content-sha256`, and (when supplied)
+ * `x-amz-security-token`. The caller is responsible for setting `host`.
+ *
+ * Path-style vs virtual-host-style: this signer does not care; the caller
+ * chooses by setting `host` + path appropriately.
+ */
+import { createHash, createHmac } from 'node:crypto';
+/**
+ * Signs an HTTP request per the AWS Signature Version 4 recipe, mutating
+ * `input.headers` in place and returning the same signature fields.
+ *
+ * @param input - Method/path/query/headers/body plus region, service, and credentials.
+ * @returns The `authorization` header value, the `x-amz-date` used, and the body's SHA-256 hex digest.
+ */
+export function signSigV4(input) {
+    const now = input.now ?? new Date();
+    const amzDate = formatAmzDate(now);
+    const dateStamp = amzDate.slice(0, 8);
+    const contentSha256 = sha256Hex(input.body);
+    // Add the required amz headers BEFORE composing the canonical request, since they're part of
+    // the signed-headers list.
+    input.headers['x-amz-date'] = amzDate;
+    input.headers['x-amz-content-sha256'] = contentSha256;
+    if (input.credentials.sessionToken) {
+        input.headers['x-amz-security-token'] = input.credentials.sessionToken;
+    }
+    // Canonical headers: lower-case keys + trim values; sort by key.
+    const headerKeys = Object.keys(input.headers)
+        .map((k) => k.toLowerCase())
+        .sort();
+    const canonicalHeaders = headerKeys
+        .map((k) => `${k}:${trimValue(input.headers[k] ?? input.headers[k.toLowerCase()] ?? '')}\n`)
+        .join('');
+    const signedHeaders = headerKeys.join(';');
+    const canonicalRequest = [
+        input.method.toUpperCase(),
+        input.path,
+        input.query,
+        canonicalHeaders,
+        signedHeaders,
+        contentSha256,
+    ].join('\n');
+    const credentialScope = `${dateStamp}/${input.region}/${input.service}/aws4_request`;
+    const stringToSign = [
+        'AWS4-HMAC-SHA256',
+        amzDate,
+        credentialScope,
+        sha256Hex(Buffer.from(canonicalRequest, 'utf8')),
+    ].join('\n');
+    // Derive the signing key.
+    const kDate = hmac(`AWS4${input.credentials.secretAccessKey}`, dateStamp);
+    const kRegion = hmac(kDate, input.region);
+    const kService = hmac(kRegion, input.service);
+    const kSigning = hmac(kService, 'aws4_request');
+    const signature = createHmac('sha256', kSigning).update(stringToSign).digest('hex');
+    const authorization = `AWS4-HMAC-SHA256 Credential=${input.credentials.accessKeyId}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
+    input.headers['authorization'] = authorization;
+    return { authorization, amzDate, contentSha256 };
+}
+function sha256Hex(body) {
+    return createHash('sha256').update(body).digest('hex');
+}
+function hmac(key, value) {
+    return createHmac('sha256', key).update(value).digest();
+}
+function trimValue(v) {
+    return v.trim().replace(/\s+/g, ' ');
+}
+function formatAmzDate(d) {
+    const iso = d.toISOString().replace(/[-:]/g, '');
+    // ISO is YYYYMMDDTHHmmss.sssZ; AWS expects YYYYMMDDTHHMMSSZ.
+    return `${iso.slice(0, 15)}Z`;
+}
+/**
+ * URI-encodes a path segment per RFC 3986, with the AWS twist that reserved
+ * chars outside the unreserved set (`!'()*`) get `%HH`-encoded even though
+ * `encodeURIComponent` leaves them alone.
+ *
+ * @param seg - A single path segment (no `/`).
+ * @returns The RFC-3986/AWS-encoded segment.
+ */
+export function encodeS3PathSegment(seg) {
+    return encodeURIComponent(seg).replace(/[!'()*]/g, (c) => '%' + c.charCodeAt(0).toString(16).toUpperCase());
+}
+//# sourceMappingURL=aws-sigv4.js.map

package/dist/aws-sigv4.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-sigv4.js","sourceRoot":"","sources":["../src/aws-sigv4.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAsCrD;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,KAAqB;IAC7C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtC,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAE5C,6FAA6F;IAC7F,2BAA2B;IAC3B,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC;IACtC,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,aAAa,CAAC;IACtD,IAAI,KAAK,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QACnC,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC;IACzE,CAAC;IAED,iEAAiE;IACjE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;SAC1C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;SAC3B,IAAI,EAAE,CAAC;IACV,MAAM,gBAAgB,GAAG,UAAU;SAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC;SAC3F,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE3C,MAAM,gBAAgB,GAAG;QACvB,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE;QAC1B,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,KAAK;QACX,gBAAgB;QAChB,aAAa;QACb,aAAa;KACd,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,eAAe,GAAG,GAAG,SAAS,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,eAAe,CAAC;IACrF,MAAM,YAAY,GAAG;QACnB,kBAAkB;QAClB,OAAO;QACP,eAAe;QACf,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;KACjD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,0BAA0B;IAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,KAAK,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,SAAS,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAEhD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpF,MAAM,aAAa,GAAG,+BAA+B,KAAK,CAAC,WAAW,CAAC,WAAW,IAAI,eAAe,mBAAmB,aAAa,eAAe,SAAS,EAAE,CAAC;IAChK,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,aAAa,CAAC;IAE/C,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,IAAI,CAAC,GAAoB,EAAE,KAAa;IAC/C,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,aAAa,CAAC,CAAO;IAC5B,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACjD,6DAA6D;IAC7D,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;AAChC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC9G,CAAC"}