@kavtuai/guildgate 0.1.0

package/dist/redis.js

@@ -0,0 +1,233 @@
+export function fromNodeRedis(client) {
+    return {
+        get: (key) => client.get(key),
+        async set(key, value, options) {
+            const result = await client.set(key, value, {
+                ...(options?.px ? { PX: options.px } : {}),
+                ...(options?.nx ? { NX: true } : {}),
+            });
+            return result === "OK";
+        },
+        del: (...keys) => client.del(keys),
+        sAdd: (key, ...members) => client.sAdd(key, members),
+        sRem: (key, ...members) => client.sRem(key, members),
+        sMembers: (key) => client.sMembers(key),
+        pTtl: (key) => client.pTTL(key),
+        eval: (script, keys, args) => client.eval(script, { keys, arguments: args }),
+    };
+}
+export function fromIoRedis(client) {
+    return {
+        get: (key) => client.get(key),
+        async set(key, value, options) {
+            const args = [];
+            if (options?.px)
+                args.push("PX", String(options.px));
+            if (options?.nx)
+                args.push("NX");
+            return await client.set(key, value, ...args) === "OK";
+        },
+        del: (...keys) => client.del(...keys),
+        sAdd: (key, ...members) => client.sadd(key, ...members),
+        sRem: (key, ...members) => client.srem(key, ...members),
+        sMembers: (key) => client.smembers(key),
+        pTtl: (key) => client.pttl(key),
+        eval: (script, keys, args) => client.eval(script, keys.length, ...keys, ...args),
+    };
+}
+export function createRedisEphemeralStores(redis, input) {
+    const prefix = input?.prefix ?? "guildgate";
+    const key = (kind, id) => `${prefix}:${kind}:${id}`;
+    const sessions = {
+        async get(idHash) {
+            return parse(await redis.get(key("session", idHash)));
+        },
+        async set(record) {
+            const ttl = Math.max(1, new Date(record.expiresAt).getTime() - Date.now());
+            await redis.set(key("session", record.idHash), JSON.stringify(record), { px: ttl });
+            await redis.sAdd(key("user-sessions", record.userId), record.idHash);
+        },
+        async delete(idHash) {
+            const record = await sessions.get(idHash);
+            await redis.del(key("session", idHash));
+            if (record)
+                await redis.sRem(key("user-sessions", record.userId), idHash);
+        },
+        async listByUser(userId) {
+            const ids = await redis.sMembers(key("user-sessions", userId));
+            const rows = await Promise.all(ids.map((id) => sessions.get(id)));
+            const missing = ids.filter((_, index) => !rows[index]);
+            if (missing.length)
+                await redis.sRem(key("user-sessions", userId), ...missing);
+            return rows.filter((row) => Boolean(row));
+        },
+    };
+    const oauthStates = {
+        async put(record) {
+            const ttl = Math.max(1, new Date(record.expiresAt).getTime() - Date.now());
+            await redis.set(key("oauth-state", record.stateHash), JSON.stringify(record), { px: ttl });
+        },
+        async consume(stateHash, nowIso) {
+            const raw = await redis.eval(GET_AND_DELETE_SCRIPT, [key("oauth-state", stateHash)], []);
+            if (typeof raw !== "string")
+                return null;
+            const record = parse(raw);
+            return record && record.expiresAt > nowIso ? record : null;
+        },
+    };
+    const rateLimits = {
+        async hit(hit) {
+            const result = await redis.eval(RATE_LIMIT_SCRIPT, [key("rate", hit.key)], [
+                String(hit.cost ?? 1),
+                String(hit.limit),
+                String(hit.windowMs),
+            ]);
+            const [allowed, count, ttl] = asNumberArray(result);
+            return {
+                allowed: allowed === 1,
+                limit: hit.limit,
+                remaining: Math.max(0, hit.limit - count),
+                resetAtMs: hit.nowMs + ttl,
+                retryAfterMs: allowed === 1 ? 0 : ttl,
+            };
+        },
+        async reset(rateKey) {
+            await redis.del(key("rate", rateKey));
+        },
+    };
+    const cache = {
+        async get(cacheKey) {
+            return parse(await redis.get(key("cache", cacheKey)));
+        },
+        async set(cacheKey, entry) {
+            const ttl = Math.max(1, (entry.staleUntilMs ?? entry.expiresAtMs) - Date.now());
+            const storageKey = key("cache", cacheKey);
+            await redis.set(storageKey, JSON.stringify(entry), { px: ttl });
+            for (const tag of entry.tags)
+                await redis.sAdd(key("cache-tag", tag), cacheKey);
+        },
+        async delete(cacheKey) {
+            const storageKey = key("cache", cacheKey);
+            const entry = parse(await redis.get(storageKey));
+            await redis.del(storageKey);
+            if (entry) {
+                for (const tag of entry.tags)
+                    await redis.sRem(key("cache-tag", tag), cacheKey);
+            }
+        },
+        async deleteByTags(tags) {
+            const ids = new Set();
+            for (const tag of tags) {
+                for (const id of await redis.sMembers(key("cache-tag", tag)))
+                    ids.add(id);
+            }
+            await Promise.all([...ids].map((id) => cache.delete(id)));
+            await Promise.all(tags.map((tag) => redis.del(key("cache-tag", tag))));
+            return ids.size;
+        },
+    };
+    const idempotency = {
+        async begin(record) {
+            const result = await redis.eval(IDEMPOTENCY_BEGIN_SCRIPT, [key("idempotency", record.key)], [
+                JSON.stringify(record),
+                record.requestHash,
+                String(Math.max(1, record.expiresAtMs - Date.now())),
+            ]);
+            if (!Array.isArray(result))
+                throw new Error("Unexpected Redis idempotency response");
+            const status = String(result[0]);
+            if (status === "started")
+                return { status: "started" };
+            if (status === "inflight")
+                return { status: "inflight" };
+            if (status === "conflict")
+                return { status: "conflict" };
+            if (status === "completed") {
+                const existing = parse(String(result[1]));
+                return { status: "completed", response: existing?.response };
+            }
+            throw new Error(`Unknown idempotency status: ${status}`);
+        },
+        async complete(idempotencyKey, response, expiresAtMs) {
+            const storageKey = key("idempotency", idempotencyKey);
+            const record = parse(await redis.get(storageKey));
+            if (!record)
+                return;
+            await redis.set(storageKey, JSON.stringify({ ...record, state: "completed", response, expiresAtMs }), {
+                px: Math.max(1, expiresAtMs - Date.now()),
+            });
+        },
+        async fail(idempotencyKey) {
+            await redis.del(key("idempotency", idempotencyKey));
+        },
+        async get(idempotencyKey) {
+            return parse(await redis.get(key("idempotency", idempotencyKey)));
+        },
+    };
+    const locks = {
+        async acquire(lockKey, token, ttlMs, waitMs) {
+            const deadline = Date.now() + Math.max(0, waitMs);
+            do {
+                if (await redis.set(key("lock", lockKey), token, { px: ttlMs, nx: true }))
+                    return true;
+                if (waitMs <= 0)
+                    return false;
+                await new Promise((resolve) => setTimeout(resolve, 25));
+            } while (Date.now() <= deadline);
+            return false;
+        },
+        async release(lockKey, token) {
+            await redis.eval(COMPARE_AND_DELETE_SCRIPT, [key("lock", lockKey)], [token]);
+        },
+    };
+    return { sessions, oauthStates, rateLimits, cache, idempotency, locks };
+}
+const GET_AND_DELETE_SCRIPT = `
+local value = redis.call('GET', KEYS[1])
+if value then redis.call('DEL', KEYS[1]) end
+return value
+`;
+const RATE_LIMIT_SCRIPT = `
+local current = redis.call('GET', KEYS[1])
+local count = tonumber(current or '0')
+local cost = tonumber(ARGV[1])
+local limit = tonumber(ARGV[2])
+local window = tonumber(ARGV[3])
+if not current then redis.call('PSETEX', KEYS[1], window, '0') end
+local allowed = 0
+if count + cost <= limit then
+  count = redis.call('INCRBY', KEYS[1], cost)
+  allowed = 1
+end
+local ttl = redis.call('PTTL', KEYS[1])
+if ttl < 0 then redis.call('PEXPIRE', KEYS[1], window); ttl = window end
+return {allowed, count, ttl}
+`;
+const COMPARE_AND_DELETE_SCRIPT = `
+if redis.call('GET', KEYS[1]) == ARGV[1] then
+  return redis.call('DEL', KEYS[1])
+end
+return 0
+`;
+const IDEMPOTENCY_BEGIN_SCRIPT = `
+local existing = redis.call('GET', KEYS[1])
+if not existing then
+  redis.call('PSETEX', KEYS[1], ARGV[3], ARGV[1])
+  return {'started'}
+end
+local decoded = cjson.decode(existing)
+if decoded.requestHash ~= ARGV[2] then return {'conflict'} end
+if decoded.state == 'completed' then return {'completed', existing} end
+return {'inflight'}
+`;
+function parse(value) {
+    if (!value)
+        return null;
+    return JSON.parse(value);
+}
+function asNumberArray(value) {
+    if (!Array.isArray(value) || value.length < 3)
+        throw new Error("Unexpected Redis script response");
+    return [Number(value[0]), Number(value[1]), Number(value[2])];
+}
+//# sourceMappingURL=redis.js.map

package/dist/redis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis.js","sourceRoot":"","sources":["../src/redis.ts"],"names":[],"mappings":"AAsCA,MAAM,UAAU,aAAa,CAAC,MAS7B;IACC,OAAO;QACL,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;QAC7B,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO;YAC3B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE;gBAC1C,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrC,CAAC,CAAC;YACH,OAAO,MAAM,KAAK,IAAI,CAAC;QACzB,CAAC;QACD,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;QAClC,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC;QACpD,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC;QACpD,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QACvC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAC/B,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KAC7E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAS3B;IACC,OAAO;QACL,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;QAC7B,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO;YAC3B,MAAM,IAAI,GAAa,EAAE,CAAC;YAC1B,IAAI,OAAO,EAAE,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YACrD,IAAI,OAAO,EAAE,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,OAAO,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC;QACxD,CAAC;QACD,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;QACrC,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;QACvD,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;QACvD,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QACvC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAC/B,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;KACjF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAA0B,EAAE,KAA2B;IAChG,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,IAAI,WAAW,CAAC;IAC5C,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAU,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;IAEpE,MAAM,QAAQ,GAAiB;QAC7B,KAAK,CAAC,GAAG,CAAC,MAAM;YACd,OAAO,KAAK,CAAgB,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,MAAM;YACd,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC3E,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACpF,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;YACxC,IAAI,MAAM;gBAAE,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAC5E,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,MAAM;YACrB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;YAC/D,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACvD,IAAI,OAAO,CAAC,MAAM;gBAAE,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC;YAC/E,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAwB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAClE,CAAC;KACF,CAAC;IAEF,MAAM,WAAW,GAAoB;QACnC,KAAK,CAAC,GAAG,CAAC,MAAM;YACd,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC3E,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM;YAC7B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACzF,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACzC,MAAM,MAAM,GAAG,KAAK,CAAmB,GAAG,CAAC,CAAC;YAC5C,OAAO,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7D,CAAC;KACF,CAAC;IAEF,MAAM,UAAU,GAAmB;QACjC,KAAK,CAAC,GAAG,CAAC,GAAsB;YAC9B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE;gBACzE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC;gBACrB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;gBACjB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;aACrB,CAAC,CAAC;YACH,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;YACpD,OAAO;gBACL,OAAO,EAAE,OAAO,KAAK,CAAC;gBACtB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;gBACzC,SAAS,EAAE,GAAG,CAAC,KAAK,GAAG,GAAG;gBAC1B,YAAY,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG;aACtC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,OAAO;YACjB,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;IAEF,MAAM,KAAK,GAAe;QACxB,KAAK,CAAC,GAAG,CAAI,QAAgB;YAC3B,OAAO,KAAK,CAAgB,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,CAAC,GAAG,CAAI,QAAgB,EAAE,KAAoB;YACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAChF,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC1C,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAChE,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI;gBAAE,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;QAClF,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,QAAQ;YACnB,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC1C,MAAM,KAAK,GAAG,KAAK,CAAa,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;YAC7D,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC5B,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI;oBAAE,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,IAAI;YACrB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;YAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,KAAK,MAAM,EAAE,IAAI,MAAM,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;oBAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC1D,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACvE,OAAO,GAAG,CAAC,IAAI,CAAC;QAClB,CAAC;KACF,CAAC;IAEF,MAAM,WAAW,GAAqB;QACpC,KAAK,CAAC,KAAK,CAAC,MAAyB;YACnC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE;gBAC1F,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;gBACtB,MAAM,CAAC,WAAW;gBAClB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;aACrD,CAAC,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YACrF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACjC,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACvD,IAAI,MAAM,KAAK,UAAU;gBAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;YACzD,IAAI,MAAM,KAAK,UAAU;gBAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;YACzD,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;gBAC3B,MAAM,QAAQ,GAAG,KAAK,CAAoB,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7D,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;YAC/D,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,cAAc,EAAE,QAAQ,EAAE,WAAW;YAClD,MAAM,UAAU,GAAG,GAAG,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;YACtD,MAAM,MAAM,GAAG,KAAK,CAAoB,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;YACrE,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,EAAE;gBACpG,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;aAC1C,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,cAAc;YACvB,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,cAAc;YACtB,OAAO,KAAK,CAAoB,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;QACvF,CAAC;KACF,CAAC;IAEF,MAAM,KAAK,GAAc;QACvB,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;YACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAClD,GAAG,CAAC;gBACF,IAAI,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACvF,IAAI,MAAM,IAAI,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAC9B,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;YAC1D,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK;YAC1B,MAAM,KAAK,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/E,CAAC;KACF,CAAC;IAEF,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,qBAAqB,GAAG;;;;CAI7B,CAAC;AAEF,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;CAezB,CAAC;AAEF,MAAM,yBAAyB,GAAG;;;;;CAKjC,CAAC;AAEF,MAAM,wBAAwB,GAAG;;;;;;;;;;CAUhC,CAAC;AAEF,SAAS,KAAK,CAAI,KAAoB;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAM,CAAC;AAChC,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACnG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC"}

package/dist/resilience.d.ts

@@ -0,0 +1,23 @@
+export interface RetryOptions {
+    attempts: number;
+    baseDelayMs: number;
+    maximumDelayMs: number;
+    shouldRetry?: (error: unknown, attempt: number) => boolean;
+    delayMs?: (error: unknown, attempt: number) => number | undefined;
+}
+export declare function runWithDeadline<T>(input: {
+    timeoutMs: number;
+    parentSignal?: AbortSignal;
+    retry?: RetryOptions;
+    execute: (signal: AbortSignal, attempt: number) => Promise<T>;
+}): Promise<T>;
+export declare class CircuitBreaker {
+    private readonly input;
+    private readonly states;
+    constructor(input: {
+        failureThreshold: number;
+        resetAfterMs: number;
+    });
+    run<T>(name: string, execute: () => Promise<T>): Promise<T>;
+}
+//# sourceMappingURL=resilience.d.ts.map

package/dist/resilience.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resilience.d.ts","sourceRoot":"","sources":["../src/resilience.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IAC3D,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;CACnE;AAED,wBAAsB,eAAe,CAAC,CAAC,EAAE,KAAK,EAAE;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;CAC/D,GAAG,OAAO,CAAC,CAAC,CAAC,CAkCb;AA4BD,qBAAa,cAAc;IAGb,OAAO,CAAC,QAAQ,CAAC,KAAK;IAFlC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;gBAE7B,KAAK,EAAE;QAAE,gBAAgB,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE;IAEhF,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAelE"}

package/dist/resilience.js

@@ -0,0 +1,85 @@
+import { errors, GuildGateError } from "./errors.js";
+export async function runWithDeadline(input) {
+    const startedAt = Date.now();
+    const attempts = Math.max(1, input.retry?.attempts ?? 1);
+    let lastError;
+    for (let attempt = 1; attempt <= attempts; attempt += 1) {
+        const remaining = input.timeoutMs - (Date.now() - startedAt);
+        if (remaining <= 0)
+            throw errors.timeout();
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(errors.timeout()), remaining);
+        const onParentAbort = () => controller.abort(input.parentSignal?.reason);
+        input.parentSignal?.addEventListener("abort", onParentAbort, { once: true });
+        try {
+            return await input.execute(controller.signal, attempt);
+        }
+        catch (error) {
+            lastError = error;
+            if (controller.signal.aborted && !input.parentSignal?.aborted)
+                throw errors.timeout();
+            const retryable = input.retry?.shouldRetry?.(error, attempt) ?? defaultShouldRetry(error);
+            if (!retryable || attempt >= attempts)
+                throw error;
+            const remainingAfterFailure = input.timeoutMs - (Date.now() - startedAt);
+            if (remainingAfterFailure <= 0)
+                throw errors.timeout();
+            const configuredDelay = input.retry?.delayMs?.(error, attempt);
+            const delay = configuredDelay === undefined
+                ? jitteredDelay(input.retry, attempt)
+                : Math.max(0, configuredDelay);
+            await sleep(Math.min(delay, remainingAfterFailure), input.parentSignal);
+        }
+        finally {
+            clearTimeout(timer);
+            input.parentSignal?.removeEventListener("abort", onParentAbort);
+        }
+    }
+    throw lastError;
+}
+function defaultShouldRetry(error) {
+    if (error instanceof GuildGateError)
+        return error.retryable;
+    return error instanceof TypeError;
+}
+function jitteredDelay(options, attempt) {
+    const exponential = Math.min(options.maximumDelayMs, options.baseDelayMs * 2 ** Math.max(0, attempt - 1));
+    return Math.floor(exponential * (0.5 + Math.random() * 0.5));
+}
+function sleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted)
+            return reject(signal.reason);
+        const timer = setTimeout(resolve, ms);
+        signal?.addEventListener("abort", () => {
+            clearTimeout(timer);
+            reject(signal.reason);
+        }, { once: true });
+    });
+}
+export class CircuitBreaker {
+    input;
+    states = new Map();
+    constructor(input) {
+        this.input = input;
+    }
+    async run(name, execute) {
+        const now = Date.now();
+        const state = this.states.get(name) ?? { failures: 0, openUntilMs: 0 };
+        if (state.openUntilMs > now)
+            throw errors.upstreamUnavailable({ circuit: name, openUntilMs: state.openUntilMs });
+        try {
+            const result = await execute();
+            this.states.delete(name);
+            return result;
+        }
+        catch (error) {
+            state.failures += 1;
+            if (state.failures >= this.input.failureThreshold)
+                state.openUntilMs = now + this.input.resetAfterMs;
+            this.states.set(name, state);
+            throw error;
+        }
+    }
+}
+//# sourceMappingURL=resilience.js.map

package/dist/resilience.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resilience.js","sourceRoot":"","sources":["../src/resilience.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAUrD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAI,KAKxC;IACC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,IAAI,CAAC,CAAC,CAAC;IACzD,IAAI,SAAkB,CAAC;IAEvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,QAAQ,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;QAC7D,IAAI,SAAS,IAAI,CAAC;YAAE,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;QAC9E,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACzE,KAAK,CAAC,YAAY,EAAE,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAE7E,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,GAAG,KAAK,CAAC;YAClB,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO;gBAAE,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;YACtF,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC1F,IAAI,CAAC,SAAS,IAAI,OAAO,IAAI,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACnD,MAAM,qBAAqB,GAAG,KAAK,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;YACzE,IAAI,qBAAqB,IAAI,CAAC;gBAAE,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;YACvD,MAAM,eAAe,GAAG,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC/D,MAAM,KAAK,GAAG,eAAe,KAAK,SAAS;gBACzC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,KAAM,EAAE,OAAO,CAAC;gBACtC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;YACjC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,qBAAqB,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAC1E,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,KAAK,CAAC,YAAY,EAAE,mBAAmB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,MAAM,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,YAAY,cAAc;QAAE,OAAO,KAAK,CAAC,SAAS,CAAC;IAC5D,OAAO,KAAK,YAAY,SAAS,CAAC;AACpC,CAAC;AAED,SAAS,aAAa,CAAC,OAAqB,EAAE,OAAe;IAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1G,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,KAAK,CAAC,EAAU,EAAE,MAAoB;IAC7C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,MAAM,EAAE,OAAO;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACtC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE;YACrC,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAOD,MAAM,OAAO,cAAc;IAGI;IAFZ,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IAE1D,YAA6B,KAAyD;QAAzD,UAAK,GAAL,KAAK,CAAoD;IAAG,CAAC;IAE1F,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,OAAyB;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;QACvE,IAAI,KAAK,CAAC,WAAW,GAAG,GAAG;YAAE,MAAM,MAAM,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QACjH,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC;YACpB,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,gBAAgB;gBAAE,KAAK,CAAC,WAAW,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;YACrG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC7B,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/security.d.ts

@@ -0,0 +1,21 @@
+import type { EnvironmentName, HttpMethod } from "./types.js";
+export declare function isUnsafeMethod(method: HttpMethod): boolean;
+export declare function normalizeOrigin(value: string): string;
+export declare function assertAllowedOrigin(origin: string | undefined, allowedOrigins: Set<string>): void;
+export declare function validateAllowedOrigins(origins: string[], environment: EnvironmentName): Set<string>;
+export interface CsrfService {
+    issue(sessionIdHash: string): string;
+    verify(sessionIdHash: string, token: string | undefined): boolean;
+}
+export declare function createCsrfService(secret: string): CsrfService;
+export interface CookieConfig {
+    name: string;
+    path: string;
+    secure: boolean;
+    sameSite: "Lax" | "Strict";
+    maxAgeSeconds: number;
+}
+export declare function validateCookieConfig(config: CookieConfig): void;
+export declare function serializeSessionCookie(value: string, config: CookieConfig): string;
+export declare function serializeClearedCookie(config: CookieConfig): string;
+//# sourceMappingURL=security.d.ts.map

package/dist/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAI9D,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAE1D;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAQjG;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,eAAe,GAAG,GAAG,CAAC,MAAM,CAAC,CAenG;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC;IACrC,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;CACnE;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,CAc7D;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAW/D;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,MAAM,CAUlF;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAUnE"}

package/dist/security.js

@@ -0,0 +1,94 @@
+import { hmacSha256, randomToken, safeEqualText } from "./crypto.js";
+import { errors } from "./errors.js";
+const unsafeMethods = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+export function isUnsafeMethod(method) {
+    return unsafeMethods.has(method);
+}
+export function normalizeOrigin(value) {
+    const url = new URL(value);
+    return `${url.protocol}//${url.host}`;
+}
+export function assertAllowedOrigin(origin, allowedOrigins) {
+    if (!origin)
+        throw errors.originNotAllowed();
+    try {
+        if (!allowedOrigins.has(normalizeOrigin(origin)))
+            throw errors.originNotAllowed();
+    }
+    catch (error) {
+        if (error instanceof Error && error.name === "GuildGateError")
+            throw error;
+        throw errors.originNotAllowed();
+    }
+}
+export function validateAllowedOrigins(origins, environment) {
+    if (environment === "production" && origins.length === 0) {
+        throw errors.configuration("At least one allowed origin is required in production");
+    }
+    const normalized = origins.map(normalizeOrigin);
+    if (environment === "production") {
+        for (const origin of normalized) {
+            const url = new URL(origin);
+            if (url.protocol !== "https:")
+                throw errors.configuration("Production origins must use HTTPS");
+            if (url.hostname === "localhost" || url.hostname === "127.0.0.1") {
+                throw errors.configuration("Production origins cannot point to localhost");
+            }
+        }
+    }
+    return new Set(normalized);
+}
+export function createCsrfService(secret) {
+    if (Buffer.byteLength(secret) < 32)
+        throw errors.configuration("CSRF secret must contain at least 32 bytes");
+    return {
+        issue(sessionIdHash) {
+            const nonce = randomToken(24);
+            return `${nonce}.${hmacSha256(secret, `${sessionIdHash}.${nonce}`)}`;
+        },
+        verify(sessionIdHash, token) {
+            if (!token)
+                return false;
+            const [nonce, signature] = token.split(".");
+            if (!nonce || !signature)
+                return false;
+            return safeEqualText(signature, hmacSha256(secret, `${sessionIdHash}.${nonce}`));
+        },
+    };
+}
+export function validateCookieConfig(config) {
+    if (!config.name || /[\s;,=]/.test(config.name)) {
+        throw errors.configuration("Session cookie name is invalid");
+    }
+    if (!config.path.startsWith("/"))
+        throw errors.configuration("Session cookie path must start with /");
+    if (config.name.startsWith("__Host-") && (!config.secure || config.path !== "/")) {
+        throw errors.configuration("__Host- cookies require Secure and Path=/");
+    }
+    if (config.name.startsWith("__Secure-") && !config.secure) {
+        throw errors.configuration("__Secure- cookies require Secure");
+    }
+}
+export function serializeSessionCookie(value, config) {
+    validateCookieConfig(config);
+    return [
+        `${config.name}=${encodeURIComponent(value)}`,
+        `Path=${config.path}`,
+        `Max-Age=${config.maxAgeSeconds}`,
+        "HttpOnly",
+        config.secure ? "Secure" : "",
+        `SameSite=${config.sameSite}`,
+    ].filter(Boolean).join("; ");
+}
+export function serializeClearedCookie(config) {
+    validateCookieConfig(config);
+    return [
+        `${config.name}=`,
+        `Path=${config.path}`,
+        "Max-Age=0",
+        "HttpOnly",
+        config.secure ? "Secure" : "",
+        `SameSite=${config.sameSite}`,
+    ].filter(Boolean).join("; ");
+}
+//# sourceMappingURL=security.js.map

package/dist/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAGrC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAa,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE9E,MAAM,UAAU,cAAc,CAAC,MAAkB;IAC/C,OAAO,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAA0B,EAAE,cAA2B;IACzF,IAAI,CAAC,MAAM;QAAE,MAAM,MAAM,CAAC,gBAAgB,EAAE,CAAC;IAC7C,IAAI,CAAC;QACH,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAAE,MAAM,MAAM,CAAC,gBAAgB,EAAE,CAAC;IACpF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB;YAAE,MAAM,KAAK,CAAC;QAC3E,MAAM,MAAM,CAAC,gBAAgB,EAAE,CAAC;IAClC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAiB,EAAE,WAA4B;IACpF,IAAI,WAAW,KAAK,YAAY,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,MAAM,CAAC,aAAa,CAAC,uDAAuD,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAChD,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;QACjC,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;gBAAE,MAAM,MAAM,CAAC,aAAa,CAAC,mCAAmC,CAAC,CAAC;YAC/F,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACjE,MAAM,MAAM,CAAC,aAAa,CAAC,8CAA8C,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;AAC7B,CAAC;AAOD,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE;QAAE,MAAM,MAAM,CAAC,aAAa,CAAC,4CAA4C,CAAC,CAAC;IAC7G,OAAO;QACL,KAAK,CAAC,aAAa;YACjB,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;YAC9B,OAAO,GAAG,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE,GAAG,aAAa,IAAI,KAAK,EAAE,CAAC,EAAE,CAAC;QACvE,CAAC;QACD,MAAM,CAAC,aAAa,EAAE,KAAK;YACzB,IAAI,CAAC,KAAK;gBAAE,OAAO,KAAK,CAAC;YACzB,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS;gBAAE,OAAO,KAAK,CAAC;YACvC,OAAO,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,EAAE,GAAG,aAAa,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;QACnF,CAAC;KACF,CAAC;AACJ,CAAC;AAUD,MAAM,UAAU,oBAAoB,CAAC,MAAoB;IACvD,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,MAAM,CAAC,aAAa,CAAC,gCAAgC,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,MAAM,CAAC,aAAa,CAAC,uCAAuC,CAAC,CAAC;IACtG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACjF,MAAM,MAAM,CAAC,aAAa,CAAC,2CAA2C,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC1D,MAAM,MAAM,CAAC,aAAa,CAAC,kCAAkC,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAa,EAAE,MAAoB;IACxE,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC7B,OAAO;QACL,GAAG,MAAM,CAAC,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE;QAC7C,QAAQ,MAAM,CAAC,IAAI,EAAE;QACrB,WAAW,MAAM,CAAC,aAAa,EAAE;QACjC,UAAU;QACV,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;QAC7B,YAAY,MAAM,CAAC,QAAQ,EAAE;KAC9B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAoB;IACzD,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC7B,OAAO;QACL,GAAG,MAAM,CAAC,IAAI,GAAG;QACjB,QAAQ,MAAM,CAAC,IAAI,EAAE;QACrB,WAAW;QACX,UAAU;QACV,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;QAC7B,YAAY,MAAM,CAAC,QAAQ,EAAE;KAC9B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC"}

package/dist/session.d.ts

@@ -0,0 +1,32 @@
+import type { SessionStore } from "./stores.js";
+import type { Clock, SessionRecord, SessionResolution, SupportedLocale } from "./types.js";
+export interface SessionManagerOptions {
+    store: SessionStore;
+    clock: Clock;
+    ttlMs: number;
+    idleTimeoutMs: number;
+    rotateAfterMs: number;
+    maximumSessionsPerUser: number;
+}
+export interface CreateSessionInput {
+    userId: string;
+    locale: SupportedLocale;
+    metadata?: Record<string, unknown>;
+}
+export declare class SessionManager {
+    private readonly options;
+    constructor(options: SessionManagerOptions);
+    create(input: CreateSessionInput): Promise<{
+        token: string;
+        session: SessionRecord;
+    }>;
+    resolve(token: string | undefined): Promise<SessionResolution>;
+    validate(token: string | undefined): Promise<SessionRecord | null>;
+    revokeToken(token: string): Promise<void>;
+    revokeHash(idHash: string): Promise<void>;
+    revokeAll(userId: string): Promise<number>;
+    list(userId: string): Promise<SessionRecord[]>;
+    private buildRecord;
+    private enforceSessionLimit;
+}
+//# sourceMappingURL=session.d.ts.map

package/dist/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE3F,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,YAAY,CAAC;IACpB,KAAK,EAAE,KAAK,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,sBAAsB,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,eAAe,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,qBAAa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,qBAAqB;IAErD,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,aAAa,CAAA;KAAE,CAAC;IASrF,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA+B9D,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAalE,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzC,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzC,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAM1C,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAIpD,OAAO,CAAC,WAAW;YAcL,mBAAmB;CAQlC"}

package/dist/session.js

@@ -0,0 +1,97 @@
+import { randomToken, sha256 } from "./crypto.js";
+import { errors } from "./errors.js";
+export class SessionManager {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    async create(input) {
+        const now = this.options.clock.now();
+        const token = randomToken();
+        const session = this.buildRecord(token, input, now);
+        await this.options.store.set(session);
+        await this.enforceSessionLimit(input.userId, session.idHash);
+        return { token, session };
+    }
+    async resolve(token) {
+        if (!token)
+            return { session: null };
+        const now = this.options.clock.now();
+        const idHash = sha256(token);
+        const session = await this.options.store.get(idHash);
+        if (!session)
+            return { session: null, clearCookie: true };
+        if (session.revokedAt)
+            throw errors.sessionRevoked();
+        if (new Date(session.expiresAt) <= now || new Date(session.idleExpiresAt) <= now) {
+            await this.options.store.delete(idHash);
+            throw errors.sessionExpired();
+        }
+        if (new Date(session.rotateAfter) <= now) {
+            const replacement = await this.create({
+                userId: session.userId,
+                locale: session.locale,
+                metadata: session.metadata,
+            });
+            await this.options.store.delete(session.idHash);
+            return { session: replacement.session, replacementToken: replacement.token };
+        }
+        const updated = {
+            ...session,
+            lastSeenAt: now.toISOString(),
+            idleExpiresAt: new Date(now.getTime() + this.options.idleTimeoutMs).toISOString(),
+        };
+        await this.options.store.set(updated);
+        return { session: updated };
+    }
+    async validate(token) {
+        if (!token)
+            return null;
+        const now = this.options.clock.now();
+        const idHash = sha256(token);
+        const session = await this.options.store.get(idHash);
+        if (!session)
+            return null;
+        if (session.revokedAt || new Date(session.expiresAt) <= now || new Date(session.idleExpiresAt) <= now) {
+            await this.options.store.delete(idHash);
+            return null;
+        }
+        return session;
+    }
+    async revokeToken(token) {
+        await this.options.store.delete(sha256(token));
+    }
+    async revokeHash(idHash) {
+        await this.options.store.delete(idHash);
+    }
+    async revokeAll(userId) {
+        const rows = await this.options.store.listByUser(userId);
+        await Promise.all(rows.map((row) => this.options.store.delete(row.idHash)));
+        return rows.length;
+    }
+    async list(userId) {
+        return this.options.store.listByUser(userId);
+    }
+    buildRecord(token, input, now) {
+        return {
+            idHash: sha256(token),
+            userId: input.userId,
+            locale: input.locale,
+            createdAt: now.toISOString(),
+            lastSeenAt: now.toISOString(),
+            expiresAt: new Date(now.getTime() + this.options.ttlMs).toISOString(),
+            idleExpiresAt: new Date(now.getTime() + this.options.idleTimeoutMs).toISOString(),
+            rotateAfter: new Date(now.getTime() + this.options.rotateAfterMs).toISOString(),
+            metadata: input.metadata,
+        };
+    }
+    async enforceSessionLimit(userId, keepIdHash) {
+        const rows = await this.options.store.listByUser(userId);
+        const active = rows
+            .filter((row) => row.idHash !== keepIdHash)
+            .sort((a, b) => a.lastSeenAt.localeCompare(b.lastSeenAt));
+        const excess = Math.max(0, active.length + 1 - this.options.maximumSessionsPerUser);
+        await Promise.all(active.slice(0, excess).map((row) => this.options.store.delete(row.idHash)));
+    }
+}
+//# sourceMappingURL=session.js.map

package/dist/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAmBrC,MAAM,OAAO,cAAc;IACI;IAA7B,YAA6B,OAA8B;QAA9B,YAAO,GAAP,OAAO,CAAuB;IAAG,CAAC;IAE/D,KAAK,CAAC,MAAM,CAAC,KAAyB;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7D,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAyB;QACrC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QAC1D,IAAI,OAAO,CAAC,SAAS;YAAE,MAAM,MAAM,CAAC,cAAc,EAAE,CAAC;QACrD,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,GAAG,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,GAAG,EAAE,CAAC;YACjF,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,MAAM,CAAC,cAAc,EAAE,CAAC;QAChC,CAAC;QAED,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,GAAG,EAAE,CAAC;YACzC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;gBACpC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAChD,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,gBAAgB,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC;QAC/E,CAAC;QAED,MAAM,OAAO,GAAkB;YAC7B,GAAG,OAAO;YACV,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE;YAC7B,aAAa,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE;SAClF,CAAC;QACF,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAyB;QACtC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,GAAG,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,GAAG,EAAE,CAAC;YACtG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAAc;QAC5B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAc;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC/C,CAAC;IAEO,WAAW,CAAC,KAAa,EAAE,KAAyB,EAAE,GAAS;QACrE,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC;YACrB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;YAC5B,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE;YAC7B,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;YACrE,aAAa,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE;YACjF,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE;YAC/E,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,MAAc,EAAE,UAAkB;QAClE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI;aAChB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,UAAU,CAAC;aAC1C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;QACpF,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACjG,CAAC;CACF"}