@kindgi/api 0.0.0-bootstrap.0 → 0.1.0

package/dist/middleware/sigv4-verify.js

@@ -0,0 +1,286 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * AWS Signature Version 4 verification for the `/s3/*` surface — pure
+ * functions, no HTTP framework.
+ *
+ * Verification re-derives the signature from exactly what the client
+ * signed:
+ *
+ *   - the timestamp the client signed with (`x-amz-date` header, or the
+ *     `X-Amz-Date` query parameter of a presigned URL) — never the
+ *     server's clock. The server's clock only bounds it: requests more
+ *     than {@link MAX_CLOCK_SKEW_SECONDS} away are rejected
+ *     (`RequestTimeTooSkewed`), presigned URLs past `X-Amz-Expires` are
+ *     rejected (`AccessDenied`);
+ *   - only the headers the client listed in `SignedHeaders`. Anything a
+ *     proxy or HTTP stack adds after signing is ignored;
+ *   - the canonical URI / query exactly as S3 defines them (path
+ *     segments not normalized; query keys sorted, first value only).
+ *
+ * The signature comparison is constant-time.
+ */
+import { createHash, createHmac, timingSafeEqual } from 'node:crypto';
+/** S3's allowed clock skew for signed requests (15 minutes). */
+export const MAX_CLOCK_SKEW_SECONDS = 15 * 60;
+/** S3's maximum presigned-URL lifetime (7 days). */
+export const MAX_PRESIGN_EXPIRES_SECONDS = 7 * 24 * 60 * 60;
+const ALGORITHM = 'AWS4-HMAC-SHA256';
+const AMZ_DATE = /^(\d{8})T\d{6}Z$/;
+const UNSIGNED_PAYLOAD = 'UNSIGNED-PAYLOAD';
+function err(code, message, status) {
+    return { kind: 'err', error: { code, message, status } };
+}
+/**
+ * Parse the signature claim from the `Authorization` header or the
+ * presigned-URL query parameters. Does not verify anything.
+ */
+export function parseSigV4(request) {
+    const query = request.url.searchParams;
+    const presignedAlgorithm = query.get('X-Amz-Algorithm');
+    if (presignedAlgorithm !== null) {
+        if (presignedAlgorithm !== ALGORITHM) {
+            return err('InvalidRequest', `Unsupported presign algorithm "${presignedAlgorithm}"`, 403);
+        }
+        const credential = query.get('X-Amz-Credential');
+        const signature = query.get('X-Amz-Signature');
+        const amzDate = query.get('X-Amz-Date');
+        const signedHeaders = query.get('X-Amz-SignedHeaders');
+        const expires = query.get('X-Amz-Expires');
+        if (credential === null || signature === null || amzDate === null || signedHeaders === null) {
+            return err('AuthorizationQueryParametersError', 'Presigned URL must carry X-Amz-Credential, X-Amz-Date, X-Amz-SignedHeaders and X-Amz-Signature', 400);
+        }
+        const scope = parseCredentialScope(credential);
+        if (scope === null)
+            return err('InvalidRequest', 'Malformed X-Amz-Credential', 403);
+        const expiresSeconds = expires === null ? MAX_PRESIGN_EXPIRES_SECONDS : Number(expires);
+        if (!Number.isInteger(expiresSeconds) ||
+            expiresSeconds < 1 ||
+            expiresSeconds > MAX_PRESIGN_EXPIRES_SECONDS) {
+            return err('AuthorizationQueryParametersError', `X-Amz-Expires must be an integer between 1 and ${MAX_PRESIGN_EXPIRES_SECONDS}`, 400);
+        }
+        return {
+            kind: 'ok',
+            value: {
+                kind: 'presigned',
+                ...scope,
+                signedHeaders: signedHeaders.split(';'),
+                signature,
+                amzDate,
+                expiresSeconds,
+            },
+        };
+    }
+    const authorization = request.headers.get('authorization') ?? '';
+    if (authorization.length === 0)
+        return err('AccessDenied', 'Missing Authorization header', 403);
+    const match = /^AWS4-HMAC-SHA256\s+(.+)$/i.exec(authorization);
+    if (match === null) {
+        return err('InvalidRequest', 'Only AWS4-HMAC-SHA256 signatures are supported', 403);
+    }
+    const fields = new Map();
+    for (const part of match[1].split(',')) {
+        const eq = part.indexOf('=');
+        if (eq > 0)
+            fields.set(part.slice(0, eq).trim(), part.slice(eq + 1).trim());
+    }
+    const credential = fields.get('Credential');
+    const signedHeaders = fields.get('SignedHeaders');
+    const signature = fields.get('Signature');
+    if (credential === undefined || signedHeaders === undefined || signature === undefined) {
+        return err('InvalidRequest', 'Malformed Authorization header (needs Credential, SignedHeaders, Signature)', 403);
+    }
+    const scope = parseCredentialScope(credential);
+    if (scope === null)
+        return err('InvalidRequest', 'Malformed credential scope', 403);
+    const amzDate = request.headers.get('x-amz-date');
+    if (amzDate === null) {
+        return err('AccessDenied', 'Signed requests must carry an x-amz-date header', 403);
+    }
+    return {
+        kind: 'ok',
+        value: {
+            kind: 'header',
+            ...scope,
+            signedHeaders: signedHeaders.split(';'),
+            signature,
+            amzDate,
+        },
+    };
+}
+/**
+ * Check the claim's timestamp and shape against the server clock:
+ * `X-Amz-Date` well-formed and consistent with the credential scope,
+ * within {@link MAX_CLOCK_SKEW_SECONDS} (header auth / presigned not
+ * dated in the future), and — presigned — not expired. Also checks the
+ * signed-header list is sorted, lowercase, and covers what must be
+ * signed.
+ */
+export function checkSigV4Claim(claim, now) {
+    const dateMatch = AMZ_DATE.exec(claim.amzDate);
+    if (dateMatch === null) {
+        return err('AccessDenied', 'X-Amz-Date must be formatted as YYYYMMDDTHHMMSSZ', 403);
+    }
+    if (dateMatch[1] !== claim.scopeDate) {
+        return err('SignatureDoesNotMatch', 'The credential scope date does not match X-Amz-Date', 403);
+    }
+    const signedAt = parseAmzDate(claim.amzDate);
+    const skewSeconds = (now.getTime() - signedAt.getTime()) / 1000;
+    if (skewSeconds < -MAX_CLOCK_SKEW_SECONDS) {
+        return err('RequestTimeTooSkewed', "The difference between the request time and the server's time is too large.", 403);
+    }
+    if (claim.kind === 'header' && skewSeconds > MAX_CLOCK_SKEW_SECONDS) {
+        return err('RequestTimeTooSkewed', "The difference between the request time and the server's time is too large.", 403);
+    }
+    if (claim.kind === 'presigned' && skewSeconds > (claim.expiresSeconds ?? 0)) {
+        return err('AccessDenied', 'Request has expired', 403);
+    }
+    const sorted = [...claim.signedHeaders].sort();
+    if (claim.signedHeaders.some((h, i) => h !== h.toLowerCase() || h !== sorted[i] || h === '') ||
+        new Set(claim.signedHeaders).size !== claim.signedHeaders.length) {
+        return err('InvalidRequest', 'SignedHeaders must be lowercase, sorted and unique', 403);
+    }
+    const required = claim.kind === 'header' ? ['host', 'x-amz-content-sha256', 'x-amz-date'] : ['host'];
+    const missing = required.filter((h) => !claim.signedHeaders.includes(h));
+    if (missing.length > 0) {
+        return err('AccessDenied', `SignedHeaders must include: ${missing.join(', ')}`, 403);
+    }
+    return { kind: 'ok', value: undefined };
+}
+/**
+ * Re-derive the signature from exactly what the client signed and compare
+ * it (constant-time) with the claimed one. `payloadHash` is the header
+ * `x-amz-content-sha256` for header auth (the caller verifies it against
+ * the body); presigned requests always sign `UNSIGNED-PAYLOAD`.
+ */
+export function verifySigV4Signature(request, claim, secretKey) {
+    const canonical = canonicalRequest(request, claim);
+    if (canonical.kind === 'err')
+        return canonical;
+    const scope = `${claim.scopeDate}/${claim.region}/${claim.service}/aws4_request`;
+    const stringToSign = [ALGORITHM, claim.amzDate, scope, sha256Hex(canonical.value)].join('\n');
+    const kDate = hmac(`AWS4${secretKey}`, claim.scopeDate);
+    const kRegion = hmac(kDate, claim.region);
+    const kService = hmac(kRegion, claim.service);
+    const kSigning = hmac(kService, 'aws4_request');
+    const expected = createHmac('sha256', kSigning).update(stringToSign, 'utf8').digest('hex');
+    if (!constantTimeEqual(expected, claim.signature.toLowerCase())) {
+        return err('SignatureDoesNotMatch', 'The request signature we calculated does not match the signature you provided.', 403);
+    }
+    return { kind: 'ok', value: undefined };
+}
+/** The SigV4 canonical request (exported for tests). */
+export function canonicalRequest(request, claim) {
+    const headerLines = [];
+    for (const name of claim.signedHeaders) {
+        const value = name === 'host'
+            ? (request.headers.get('host') ?? request.url.host)
+            : request.headers.get(name);
+        if (value === null) {
+            return err('SignatureDoesNotMatch', `Signed header "${name}" is missing from the request`, 403);
+        }
+        headerLines.push(`${name}:${value.trim().replace(/\s+/g, ' ')}`);
+    }
+    const payloadHash = claim.kind === 'presigned'
+        ? UNSIGNED_PAYLOAD
+        : (request.headers.get('x-amz-content-sha256') ?? UNSIGNED_PAYLOAD);
+    return {
+        kind: 'ok',
+        value: [
+            request.method.toUpperCase(),
+            canonicalUri(request.url.pathname),
+            canonicalQuery(request.url.search, claim.kind === 'presigned'),
+            `${headerLines.join('\n')}\n`,
+            claim.signedHeaders.join(';'),
+            payloadHash,
+        ].join('\n'),
+    };
+}
+// -------------------- canonicalization (S3 rules) --------------------
+/** RFC 3986 encoding: everything but unreserved characters. */
+function encodeRfc3986(value) {
+    return encodeURIComponent(value).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+/** Decode, tolerating stray `%` that is not a valid escape. */
+function safeDecode(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+}
+/**
+ * S3 canonical URI: each path segment decoded, then RFC 3986-encoded;
+ * segments are not normalized (`.` / `..` / `//` are significant for S3
+ * keys) and an encoded slash stays a slash. `+` in the path is read as a
+ * space, matching the common S3 signers.
+ */
+function canonicalUri(rawPath) {
+    if (rawPath === '' || rawPath === '/')
+        return '/';
+    const encoded = rawPath
+        .split('/')
+        .map((segment) => encodeRfc3986(safeDecode(segment.replace(/\+/g, ' '))))
+        .join('/')
+        .replace(/%2F/g, '/');
+    return encoded.startsWith('/') ? encoded : `/${encoded}`;
+}
+/**
+ * S3 canonical query: parameters decoded, re-encoded (RFC 3986), sorted
+ * by key; for a repeated key only its first value counts. A presigned
+ * URL's `X-Amz-Signature` is not part of what was signed.
+ */
+function canonicalQuery(rawSearch, presigned) {
+    const search = rawSearch.startsWith('?') ? rawSearch.slice(1) : rawSearch;
+    if (search === '')
+        return '';
+    const first = new Map();
+    for (const pair of search.split('&')) {
+        if (pair === '')
+            continue;
+        const eq = pair.indexOf('=');
+        const rawKey = eq < 0 ? pair : pair.slice(0, eq);
+        const rawValue = eq < 0 ? '' : pair.slice(eq + 1);
+        const key = safeDecode(rawKey.replace(/\+/g, ' '));
+        if (key === '' || (presigned && key === 'X-Amz-Signature'))
+            continue;
+        const encodedKey = encodeRfc3986(key);
+        if (!first.has(encodedKey)) {
+            first.set(encodedKey, encodeRfc3986(safeDecode(rawValue.replace(/\+/g, ' '))));
+        }
+    }
+    return [...first.keys()]
+        .sort()
+        .map((key) => `${key}=${first.get(key)}`)
+        .join('&');
+}
+// -------------------- helpers --------------------
+function parseCredentialScope(raw) {
+    // <accessKeyId>/<YYYYMMDD>/<region>/<service>/aws4_request
+    const parts = raw.split('/');
+    if (parts.length !== 5 || parts[4] !== 'aws4_request')
+        return null;
+    const [accessKeyId, scopeDate, region, service] = parts;
+    if (accessKeyId === '' || !/^\d{8}$/.test(scopeDate) || region === '' || service === '')
+        return null;
+    return { accessKeyId, scopeDate, region, service };
+}
+function parseAmzDate(amzDate) {
+    const iso = `${amzDate.slice(0, 4)}-${amzDate.slice(4, 6)}-${amzDate.slice(6, 8)}T${amzDate.slice(9, 11)}:${amzDate.slice(11, 13)}:${amzDate.slice(13, 15)}Z`;
+    return new Date(iso);
+}
+function hmac(key, data) {
+    return createHmac('sha256', key).update(data, 'utf8').digest();
+}
+function sha256Hex(data) {
+    return createHash('sha256').update(data, 'utf8').digest('hex');
+}
+export function constantTimeEqual(a, b) {
+    const aBuf = Buffer.from(a, 'utf8');
+    const bBuf = Buffer.from(b, 'utf8');
+    if (aBuf.length !== bBuf.length)
+        return false;
+    return timingSafeEqual(aBuf, bBuf);
+}
+//# sourceMappingURL=sigv4-verify.js.map

package/dist/middleware/sigv4-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigv4-verify.js","sourceRoot":"","sources":["../../src/middleware/sigv4-verify.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEtE,gEAAgE;AAChE,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,CAAC;AAC9C,oDAAoD;AACpD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAE5D,MAAM,SAAS,GAAG,kBAAkB,CAAC;AACrC,MAAM,QAAQ,GAAG,kBAAkB,CAAC;AACpC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAqC5C,SAAS,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,MAAiB;IAC3D,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,OAAqB;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IACvC,MAAM,kBAAkB,GAAG,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACxD,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;QAChC,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,GAAG,CAAC,gBAAgB,EAAE,kCAAkC,kBAAkB,GAAG,EAAE,GAAG,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACxC,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC3C,IAAI,UAAU,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC5F,OAAO,GAAG,CACR,mCAAmC,EACnC,gGAAgG,EAChG,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC,gBAAgB,EAAE,4BAA4B,EAAE,GAAG,CAAC,CAAC;QACpF,MAAM,cAAc,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACxF,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC;YACjC,cAAc,GAAG,CAAC;YAClB,cAAc,GAAG,2BAA2B,EAC5C,CAAC;YACD,OAAO,GAAG,CACR,mCAAmC,EACnC,kDAAkD,2BAA2B,EAAE,EAC/E,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,IAAI;YACV,KAAK,EAAE;gBACL,IAAI,EAAE,WAAW;gBACjB,GAAG,KAAK;gBACR,aAAa,EAAE,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC;gBACvC,SAAS;gBACT,OAAO;gBACP,cAAc;aACf;SACF,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IACjE,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC,cAAc,EAAE,8BAA8B,EAAE,GAAG,CAAC,CAAC;IAChG,MAAM,KAAK,GAAG,4BAA4B,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC/D,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,GAAG,CAAC,gBAAgB,EAAE,gDAAgD,EAAE,GAAG,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,IAAI,IAAK,KAAK,CAAC,CAAC,CAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,GAAG,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1C,IAAI,UAAU,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QACvF,OAAO,GAAG,CACR,gBAAgB,EAChB,6EAA6E,EAC7E,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC,gBAAgB,EAAE,4BAA4B,EAAE,GAAG,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,GAAG,CAAC,cAAc,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAC;IACrF,CAAC;IACD,OAAO;QACL,IAAI,EAAE,IAAI;QACV,KAAK,EAAE;YACL,IAAI,EAAE,QAAQ;YACd,GAAG,KAAK;YACR,aAAa,EAAE,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC;YACvC,SAAS;YACT,OAAO;SACR;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,KAAiB,EAAE,GAAS;IAC1D,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,cAAc,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,GAAG,CAAC,uBAAuB,EAAE,qDAAqD,EAAE,GAAG,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC;IAChE,IAAI,WAAW,GAAG,CAAC,sBAAsB,EAAE,CAAC;QAC1C,OAAO,GAAG,CACR,sBAAsB,EACtB,6EAA6E,EAC7E,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,WAAW,GAAG,sBAAsB,EAAE,CAAC;QACpE,OAAO,GAAG,CACR,sBAAsB,EACtB,6EAA6E,EAC7E,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,WAAW,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,GAAG,CAAC,cAAc,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,IACE,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACxF,IAAI,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,aAAa,CAAC,MAAM,EAChE,CAAC;QACD,OAAO,GAAG,CAAC,gBAAgB,EAAE,oDAAoD,EAAE,GAAG,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,QAAQ,GACZ,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,sBAAsB,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACtF,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,cAAc,EAAE,+BAA+B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAqB,EACrB,KAAiB,EACjB,SAAiB;IAEjB,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACnD,IAAI,SAAS,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IAC/C,MAAM,KAAK,GAAG,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,eAAe,CAAC;IACjF,MAAM,YAAY,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9F,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,SAAS,EAAE,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3F,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAChE,OAAO,GAAG,CACR,uBAAuB,EACvB,gFAAgF,EAChF,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC1C,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,gBAAgB,CAAC,OAAqB,EAAE,KAAiB;IACvE,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACvC,MAAM,KAAK,GACT,IAAI,KAAK,MAAM;YACb,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YACnD,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,GAAG,CACR,uBAAuB,EACvB,kBAAkB,IAAI,+BAA+B,EACrD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,WAAW,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,WAAW,GACf,KAAK,CAAC,IAAI,KAAK,WAAW;QACxB,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,gBAAgB,CAAC,CAAC;IACxE,OAAO;QACL,IAAI,EAAE,IAAI;QACV,KAAK,EAAE;YACL,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;YAC5B,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC;YAC9D,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC7B,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;YAC7B,WAAW;SACZ,CAAC,IAAI,CAAC,IAAI,CAAC;KACb,CAAC;AACJ,CAAC;AAED,wEAAwE;AAExE,+DAA+D;AAC/D,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,OAAO,CACtC,UAAU,EACV,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CACxD,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,OAAe;IACnC,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC;IAClD,MAAM,OAAO,GAAG,OAAO;SACpB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;SACxE,IAAI,CAAC,GAAG,CAAC;SACT,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACxB,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,SAAiB,EAAE,SAAkB;IAC3D,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QAC1B,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QACnD,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,SAAS,IAAI,GAAG,KAAK,iBAAiB,CAAC;YAAE,SAAS;QACrE,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3B,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;SACrB,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;SACxC,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,oDAAoD;AAEpD,SAAS,oBAAoB,CAC3B,GAAW;IAEX,2DAA2D;IAC3D,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IACnE,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,KAAyC,CAAC;IAC5F,IAAI,WAAW,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,MAAM,KAAK,EAAE,IAAI,OAAO,KAAK,EAAE;QACrF,OAAO,IAAI,CAAC;IACd,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC;IAC9J,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,IAAI,CAAC,GAAoB,EAAE,IAAY;IAC9C,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,CAAS,EAAE,CAAS;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC"}

package/dist/middleware/sigv4.d.ts

@@ -0,0 +1,25 @@
+import type { MiddlewareHandler } from 'hono';
+import type { S3CredentialBinding } from '../s3-credential-binding.js';
+import type { AppEnv } from '../types.js';
+/**
+ * AWS SigV4 verification middleware for the `/s3/*` wire surface.
+ * Verifies both header-based auth (`Authorization: AWS4-HMAC-SHA256 ...`)
+ * and presigned URLs (`?X-Amz-Algorithm=...&X-Amz-Signature=...`). On
+ * success sets `tenantId`, `bucket` and `s3AccessKeyId` on the context for
+ * downstream route handlers.
+ *
+ * The signature is re-derived from exactly what the client signed — its
+ * own timestamp and only its `SignedHeaders` (see `./sigv4-verify.ts`);
+ * the server clock only bounds the timestamp (±15 minutes; presigned URLs
+ * until `X-Amz-Expires`). Order: parse → timestamp/scope → credential →
+ * payload hash → signature → bucket.
+ *
+ * ## S3-style errors
+ *
+ * Failures return S3 error XML (not JSON): `AccessDenied`,
+ * `InvalidAccessKeyId`, `SignatureDoesNotMatch`, `RequestTimeTooSkewed`,
+ * `XAmzContentSHA256Mismatch`, `AuthorizationQueryParametersError`,
+ * `InvalidRequest`.
+ */
+export declare function sigv4Middleware(binding: S3CredentialBinding): MiddlewareHandler<AppEnv>;
+//# sourceMappingURL=sigv4.d.ts.map

package/dist/middleware/sigv4.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigv4.d.ts","sourceRoot":"","sources":["../../src/middleware/sigv4.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE9C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAS1C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,mBAAmB,GAAG,iBAAiB,CAAC,MAAM,CAAC,CA4FvF"}

package/dist/middleware/sigv4.js

@@ -0,0 +1,120 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { createHash } from 'node:crypto';
+import { errorXml } from '../xml.js';
+import { checkSigV4Claim, constantTimeEqual, parseSigV4, verifySigV4Signature, } from './sigv4-verify.js';
+/**
+ * AWS SigV4 verification middleware for the `/s3/*` wire surface.
+ * Verifies both header-based auth (`Authorization: AWS4-HMAC-SHA256 ...`)
+ * and presigned URLs (`?X-Amz-Algorithm=...&X-Amz-Signature=...`). On
+ * success sets `tenantId`, `bucket` and `s3AccessKeyId` on the context for
+ * downstream route handlers.
+ *
+ * The signature is re-derived from exactly what the client signed — its
+ * own timestamp and only its `SignedHeaders` (see `./sigv4-verify.ts`);
+ * the server clock only bounds the timestamp (±15 minutes; presigned URLs
+ * until `X-Amz-Expires`). Order: parse → timestamp/scope → credential →
+ * payload hash → signature → bucket.
+ *
+ * ## S3-style errors
+ *
+ * Failures return S3 error XML (not JSON): `AccessDenied`,
+ * `InvalidAccessKeyId`, `SignatureDoesNotMatch`, `RequestTimeTooSkewed`,
+ * `XAmzContentSHA256Mismatch`, `AuthorizationQueryParametersError`,
+ * `InvalidRequest`.
+ */
+export function sigv4Middleware(binding) {
+    return async (c, next) => {
+        const req = c.req.raw;
+        const method = req.method;
+        // Read body once so both hash + downstream reads can access it.
+        // The whole body is buffered — a limitation for large uploads; true
+        // streaming would need to pass the raw stream through after a
+        // header-only signature check.
+        const bodyBytes = method === 'GET' || method === 'HEAD' || method === 'DELETE'
+            ? Buffer.alloc(0)
+            : Buffer.from(await req.arrayBuffer());
+        const url = new URL(req.url);
+        const request = { method, url, headers: req.headers };
+        const claim = parseSigV4(request);
+        if (claim.kind === 'err') {
+            return xmlError(c, claim.error.code, claim.error.message, claim.error.status);
+        }
+        const info = claim.value;
+        const checked = checkSigV4Claim(info, new Date());
+        if (checked.kind === 'err') {
+            return xmlError(c, checked.error.code, checked.error.message, checked.error.status);
+        }
+        const credential = await binding.resolve(info.accessKeyId);
+        if (credential === null) {
+            return xmlError(c, 'InvalidAccessKeyId', `The AWS Access Key Id you provided does not exist: ${info.accessKeyId}`, 403);
+        }
+        if (credential.expiresAt !== undefined && credential.expiresAt.getTime() < Date.now()) {
+            return xmlError(c, 'AccessDenied', 'Credential has expired', 403);
+        }
+        // ------------ payload hash verification ------------
+        // Header auth signs `x-amz-content-sha256`. Cross-check it against
+        // the actual body bytes, or an attacker could swap the body after
+        // signing and the signature would still verify. (Presigned URLs sign
+        // `UNSIGNED-PAYLOAD` by design.)
+        if (info.kind === 'header' && bodyBytes.length > 0) {
+            const declared = c.req.header('x-amz-content-sha256') ?? '';
+            if (declared !== 'UNSIGNED-PAYLOAD' && declared.length > 0) {
+                const actual = createHash('sha256').update(bodyBytes).digest('hex');
+                if (!constantTimeEqual(actual, declared)) {
+                    return xmlError(c, 'XAmzContentSHA256Mismatch', 'The provided x-amz-content-sha256 header does not match the SHA256 of the request body.', 400);
+                }
+            }
+        }
+        // ------------ signature ------------
+        const verified = verifySigV4Signature(request, info, credential.secretKey);
+        if (verified.kind === 'err') {
+            return xmlError(c, verified.error.code, verified.error.message, verified.error.status);
+        }
+        // ------------ bucket authorization ------------
+        // Extract bucket from URL. /s3/<bucket>/<key>. The router mounts
+        // this middleware under /s3, so the first path segment after
+        // stripping the mount is the bucket.
+        const requestedBucket = extractBucket(url.pathname);
+        if (requestedBucket === null) {
+            return xmlError(c, 'InvalidRequest', 'Bucket path segment missing', 400);
+        }
+        if (requestedBucket !== credential.bucket) {
+            return xmlError(c, 'AccessDenied', `Credential is not authorized for bucket "${requestedBucket}"`, 403);
+        }
+        // Buffer the body onto the request for downstream handlers to
+        // re-consume. Hono's Context re-reads req.raw for each parse.
+        rebindBody(c, bodyBytes);
+        c.set('tenantId', credential.tenantId);
+        c.set('bucket', credential.bucket);
+        c.set('s3AccessKeyId', info.accessKeyId);
+        await next();
+        return;
+    };
+}
+function extractBucket(pathname) {
+    // pathname like /s3/<bucket>/<key/with/slashes>. Middleware is
+    // mounted at /s3, so req.url still shows the full pathname.
+    const match = /^\/s3\/([^/?]+)/.exec(pathname);
+    return match === null ? null : match[1];
+}
+// -------------------- comparison + rebind helpers --------------------
+function rebindBody(c, body) {
+    const original = c.req.raw;
+    const rebuilt = new Request(original.url, {
+        method: original.method,
+        headers: original.headers,
+        body: body.length > 0 ? new Uint8Array(body) : undefined,
+        // `duplex: 'half'` is required by undici when a body is present.
+        ...(body.length > 0 && { duplex: 'half' }),
+    });
+    Object.defineProperty(c.req, 'raw', { value: rebuilt, configurable: true });
+}
+// -------------------- XML error response --------------------
+async function xmlError(c, code, message, status) {
+    const xml = errorXml(code, message);
+    return c.body(xml, status, {
+        'Content-Type': 'application/xml',
+    });
+}
+//# sourceMappingURL=sigv4.js.map

package/dist/middleware/sigv4.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigv4.js","sourceRoot":"","sources":["../../src/middleware/sigv4.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAMzC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,UAAU,EACV,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,eAAe,CAAC,OAA4B;IAC1D,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QACtB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC1B,gEAAgE;QAChE,oEAAoE;QACpE,8DAA8D;QAC9D,+BAA+B;QAC/B,MAAM,SAAS,GACb,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,QAAQ;YAC1D,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACjB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QAE3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QAEtD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACzB,OAAO,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QACzB,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC3B,OAAO,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3D,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,QAAQ,CACb,CAAC,EACD,oBAAoB,EACpB,sDAAsD,IAAI,CAAC,WAAW,EAAE,EACxE,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC,SAAS,KAAK,SAAS,IAAI,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACtF,OAAO,QAAQ,CAAC,CAAC,EAAE,cAAc,EAAE,wBAAwB,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC;QAED,sDAAsD;QACtD,mEAAmE;QACnE,kEAAkE;QAClE,qEAAqE;QACrE,iCAAiC;QACjC,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnD,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC;YAC5D,IAAI,QAAQ,KAAK,kBAAkB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3D,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACpE,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;oBACzC,OAAO,QAAQ,CACb,CAAC,EACD,2BAA2B,EAC3B,yFAAyF,EACzF,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,sCAAsC;QACtC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3E,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC5B,OAAO,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACzF,CAAC;QAED,iDAAiD;QACjD,iEAAiE;QACjE,6DAA6D;QAC7D,qCAAqC;QACrC,MAAM,eAAe,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;YAC7B,OAAO,QAAQ,CAAC,CAAC,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,GAAG,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,eAAe,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YAC1C,OAAO,QAAQ,CACb,CAAC,EACD,cAAc,EACd,4CAA4C,eAAe,GAAG,EAC9D,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,8DAA8D;QAC9D,8DAA8D;QAC9D,UAAU,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAEzB,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,IAAI,EAAE,CAAC;QACb,OAAO;IACT,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,+DAA+D;IAC/D,4DAA4D;IAC5D,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/C,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,KAAK,CAAC,CAAC,CAAY,CAAC;AACtD,CAAC;AAED,wEAAwE;AAExE,SAAS,UAAU,CAAC,CAA4B,EAAE,IAAY;IAC5D,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE;QACxC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,IAAI,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;QACxD,iEAAiE;QACjE,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;KAC5B,CAAC,CAAC;IAClB,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,+DAA+D;AAE/D,KAAK,UAAU,QAAQ,CACrB,CAAyB,EACzB,IAAY,EACZ,OAAe,EACf,MAAc;IAEd,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,MAAe,EAAE;QAClC,cAAc,EAAE,iBAAiB;KAClC,CAAC,CAAC;AACL,CAAC"}

package/dist/openapi/generate.d.ts

@@ -0,0 +1,15 @@
+export interface OpenApiInfo {
+    readonly title?: string;
+    readonly version?: string;
+    readonly description?: string;
+}
+export interface OpenApiServer {
+    readonly url: string;
+    readonly description?: string;
+}
+export interface GenerateOptions {
+    readonly info?: OpenApiInfo;
+    readonly servers?: readonly OpenApiServer[];
+}
+export declare function generateOpenApiDocument(opts?: GenerateOptions): Record<string, unknown>;
+//# sourceMappingURL=generate.d.ts.map

package/dist/openapi/generate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/openapi/generate.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;CAC7C;AA0ED,wBAAgB,uBAAuB,CAAC,IAAI,GAAE,eAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAqC3F"}