@lovrozagar/honey 0.6.8 → 0.7.0

package/dist/cookie-sign.js

@@ -0,0 +1,104 @@
+const encoder = new TextEncoder();
+/**
+ * Signed value formats:
+ *
+ * - v2 (current): `<value>.~<sig>`, where `sig` is the HMAC-SHA256 of
+ *   `"honey-cookie-v2\0" + name + "\0" + value`. The cookie name is bound into
+ *   the MAC, so a signature cannot be replayed under another cookie that shares
+ *   the secret. `~` is outside the base64url alphabet, so the two formats never
+ *   overlap.
+ * - v1 (legacy): `<value>.<sig>`, the HMAC of the value alone. `verify` accepts
+ *   it while `legacy` is true (the default) so cookies issued before the change
+ *   keep working during a migration window.
+ */
+const V2_MARKER = "~";
+const V2_DOMAIN = "honey-cookie-v2\0";
+/* An HMAC-SHA256 tag is 32 bytes: 43 base64url characters, no padding. */
+const SIG_RE = /^[A-Za-z0-9_-]{43}$/;
+const MAX_CACHED_KEYS = 32;
+const keyCache = new Map();
+function importKey(secret) {
+    let key = keyCache.get(secret);
+    if (key === undefined) {
+        key = crypto.subtle.importKey("raw", encoder.encode(secret), { hash: "SHA-256", name: "HMAC" }, false, [
+            "sign",
+            "verify",
+        ]);
+        if (keyCache.size >= MAX_CACHED_KEYS) {
+            const oldest = keyCache.keys().next().value;
+            if (oldest !== undefined)
+                keyCache.delete(oldest);
+        }
+        keyCache.set(secret, key);
+        /* A rejected import must not stay cached. */
+        key.catch(() => keyCache.delete(secret));
+    }
+    return key;
+}
+function toBase64Url(buffer) {
+    const bytes = new Uint8Array(buffer);
+    let binary = "";
+    for (let i = 0; i < bytes.length; i++) {
+        binary += String.fromCharCode(bytes[i]);
+    }
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+/** Strict decode: the input must be the canonical encoding of a 32-byte tag. */
+function fromBase64Url(str) {
+    if (!SIG_RE.test(str))
+        return null;
+    let binary;
+    try {
+        binary = atob(str.replace(/-/g, "+").replace(/_/g, "/"));
+    }
+    catch {
+        return null;
+    }
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    /* Reject non-zero trailing bits, which would make signatures malleable. */
+    if (toBase64Url(bytes.buffer) !== str)
+        return null;
+    return bytes;
+}
+function v2Payload(name, value) {
+    return encoder.encode(`${V2_DOMAIN}${name}\0${value}`);
+}
+export async function sign(value, secret, opts = {}) {
+    const key = await importKey(secret);
+    const signature = await crypto.subtle.sign("HMAC", key, v2Payload(opts.name ?? "", value));
+    return `${value}.${V2_MARKER}${toBase64Url(signature)}`;
+}
+/** Returns the original value, or `null` when no secret verifies it or the input is malformed. */
+export async function verify(signed, secrets, opts = {}) {
+    if (typeof signed !== "string" || signed.length === 0)
+        return null;
+    const lastDot = signed.lastIndexOf(".");
+    if (lastDot === -1)
+        return null;
+    const value = signed.slice(0, lastDot);
+    let sigText = signed.slice(lastDot + 1);
+    const isV2 = sigText.startsWith(V2_MARKER);
+    if (isV2)
+        sigText = sigText.slice(V2_MARKER.length);
+    else if (opts.legacy === false)
+        return null;
+    const sig = fromBase64Url(sigText);
+    if (sig === null)
+        return null;
+    const payload = isV2 ? v2Payload(opts.name ?? "", value) : encoder.encode(value);
+    for (const secret of secrets) {
+        try {
+            const key = await importKey(secret);
+            if (await crypto.subtle.verify("HMAC", key, sig, payload))
+                return value;
+        }
+        catch {
+            /* An unusable secret never verifies. */
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=cookie-sign.js.map

package/dist/cookie-sign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-sign.js","sourceRoot":"","sources":["../src/cookie-sign.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AAEjC;;;;;;;;;;;GAWG;AACH,MAAM,SAAS,GAAG,GAAG,CAAA;AACrB,MAAM,SAAS,GAAG,mBAAmB,CAAA;AACrC,0EAA0E;AAC1E,MAAM,MAAM,GAAG,qBAAqB,CAAA;AAiBpC,MAAM,eAAe,GAAG,EAAE,CAAA;AAC1B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAA;AAEtD,SAAS,SAAS,CAAC,MAAc;IAChC,IAAI,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAC9B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACvB,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE;YACtG,MAAM;YACN,QAAQ;SACR,CAAC,CAAA;QACF,IAAI,QAAQ,CAAC,IAAI,IAAI,eAAe,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YAC3C,IAAI,MAAM,KAAK,SAAS;gBAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAClD,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACzB,6CAA6C;QAC7C,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IACzC,CAAC;IACD,OAAO,GAAG,CAAA;AACX,CAAC;AAED,SAAS,WAAW,CAAC,MAAmB;IACvC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;IACpC,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACxC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AAC/E,CAAC;AAED,gFAAgF;AAChF,SAAS,aAAa,CAAC,GAAW;IACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,IAAI,MAAc,CAAA;IAClB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;IACzD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAChC,CAAC;IACD,2EAA2E;IAC3E,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAClD,OAAO,KAAK,CAAA;AACb,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,KAAa;IAC7C,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,SAAS,GAAG,IAAI,KAAK,KAAK,EAAE,CAAC,CAAA;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,KAAa,EAAE,MAAc,EAAE,IAAI,GAAgB,EAAE;IAC/E,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAA;IACnC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC,CAAA;IAC1F,OAAO,GAAG,KAAK,IAAI,SAAS,GAAG,WAAW,CAAC,SAAS,CAAC,EAAE,CAAA;AACxD,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,MAAc,EAAE,OAAiB,EAAE,IAAI,GAAkB,EAAE;IACvF,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAClE,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACvC,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAE/B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;IACtC,IAAI,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAA;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;IAC1C,IAAI,IAAI;QAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;SAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IAE3C,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;IAClC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAEhF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAA;YACnC,IAAI,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC;gBAAE,OAAO,KAAK,CAAA;QACxE,CAAC;QAAC,MAAM,CAAC;YACR,wCAAwC;QACzC,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAA;AACZ,CAAC"}

package/dist/cookie.d.ts

@@ -8,5 +8,17 @@ export type CookieOptions = {
     secure?: boolean;
     value: string;
 };
+/**
+ * Decode `%XX` sequences that form valid UTF-8 and keep every other byte as
+ * sent. A stray `%` in a foreign cookie no longer disables decoding for the
+ * whole value.
+ */
+export declare function decodeCookieValue(value: string): string;
+/**
+ * Parse a `Cookie` request header. When a name repeats, the first value wins:
+ * browsers send the cookie with the most specific path first (RFC 6265 §5.4).
+ * Names are trimmed on both sides; empty names and prototype keys are skipped.
+ */
+export declare function parseCookieHeader(header: string): Record<string, string>;
 export declare function serializeCookie(name: string, opts: CookieOptions): string;
 //# sourceMappingURL=cookie.d.ts.map

package/dist/cookie.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cookie.d.ts","sourceRoot":"","sources":["../src/cookie.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,IAAI,CAAA;IACd,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAA;IACpC,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;CACb,CAAA;AA2BD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,MAAM,CAmDzE"}
+{"version":3,"file":"cookie.d.ts","sourceRoot":"","sources":["../src/cookie.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,IAAI,CAAA;IACd,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAA;IACpC,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;CACb,CAAA;AA+BD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAavD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgBxE;AAMD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,MAAM,CAuDzE"}

package/dist/cookie.js

@@ -0,0 +1,138 @@
+const UNSAFE_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+/**
+ * Percent-encode characters outside the RFC 6265 cookie-octet range, plus `%`
+ * itself so the value always decodes back to what was set.
+ * Cookie-octets: 0x21, 0x23-0x2B, 0x2D-0x3A, 0x3C-0x5B, 0x5D-0x7E
+ */
+function encodeCookieValue(value) {
+    let encoded = "";
+    for (const ch of value) {
+        const c = ch.codePointAt(0) ?? 0;
+        if (c !== 0x25 &&
+            (c === 0x21 ||
+                (c >= 0x23 && c <= 0x2b) ||
+                (c >= 0x2d && c <= 0x3a) ||
+                (c >= 0x3c && c <= 0x5b) ||
+                (c >= 0x5d && c <= 0x7e))) {
+            encoded += ch;
+        }
+        else if (c >= 0xd800 && c <= 0xdfff) {
+            throw new TypeError("Cookie value contains a lone surrogate and cannot be encoded");
+        }
+        else {
+            encoded += encodeURIComponent(ch);
+        }
+    }
+    return encoded;
+}
+/**
+ * Decode `%XX` sequences that form valid UTF-8 and keep every other byte as
+ * sent. A stray `%` in a foreign cookie no longer disables decoding for the
+ * whole value.
+ */
+export function decodeCookieValue(value) {
+    if (value.indexOf("%") === -1)
+        return value;
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return value.replace(/(?:%[0-9A-Fa-f]{2})+/g, (run) => {
+            try {
+                return decodeURIComponent(run);
+            }
+            catch {
+                return run;
+            }
+        });
+    }
+}
+/**
+ * Parse a `Cookie` request header. When a name repeats, the first value wins:
+ * browsers send the cookie with the most specific path first (RFC 6265 §5.4).
+ * Names are trimmed on both sides; empty names and prototype keys are skipped.
+ */
+export function parseCookieHeader(header) {
+    const result = {};
+    if (header.length === 0)
+        return result;
+    for (const pair of header.split(";")) {
+        const eqIdx = pair.indexOf("=");
+        if (eqIdx === -1)
+            continue;
+        const name = pair.slice(0, eqIdx).trim();
+        if (name.length === 0 || UNSAFE_KEYS.has(name) || Object.hasOwn(result, name))
+            continue;
+        let value = pair.slice(eqIdx + 1).trim();
+        /* RFC 6265: strip surrounding double quotes before decoding, so an encoded quote survives. */
+        if (value.length >= 2 && value.charCodeAt(0) === 34 && value.charCodeAt(value.length - 1) === 34) {
+            value = value.slice(1, -1);
+        }
+        result[name] = decodeCookieValue(value);
+    }
+    return result;
+}
+const validCookieNameRe = /^[\w!#$%&'*.^`|~+-]+$/;
+/* A host name or IP literal, optionally with a leading dot. */
+const validDomainRe = /^\.?(?:[A-Za-z0-9-]+\.)*[A-Za-z0-9-]+$|^\[[0-9A-Fa-f:.]+\]$/;
+export function serializeCookie(name, opts) {
+    if (!validCookieNameRe.test(name)) {
+        throw new Error(`Invalid cookie name: ${JSON.stringify(name)}`);
+    }
+    let secure = opts.secure;
+    let path = opts.path;
+    /* Browsers match the prefixes case-insensitively (RFC 6265bis §4.1.3). */
+    const lower = name.toLowerCase();
+    if (lower.startsWith("__host-")) {
+        if (!opts.secure)
+            throw new Error("__Host- cookies require secure: true");
+        if (opts.domain)
+            throw new Error("__Host- cookies must not set domain");
+        if (opts.path !== "/" && opts.path !== undefined) {
+            throw new Error("__Host- cookies must have path: '/'");
+        }
+        secure = true;
+        path = path ?? "/";
+    }
+    else if (lower.startsWith("__secure-")) {
+        if (!opts.secure)
+            throw new Error("__Secure- cookies require secure: true");
+        secure = true;
+    }
+    if (opts.sameSite === "none" && !secure) {
+        throw new Error("SameSite=None cookies require secure: true");
+    }
+    if (opts.domain && !validDomainRe.test(opts.domain)) {
+        throw new Error("Cookie domain contains invalid characters");
+    }
+    /* av-value: any CHAR except CTLs or ";" (RFC 6265 §4.1.1). */
+    if (path && /[^\x20-\x3a\x3c-\x7e]/.test(path)) {
+        throw new Error("Cookie path contains invalid characters");
+    }
+    let cookie = `${name}=${encodeCookieValue(opts.value)}`;
+    if (opts.domain)
+        cookie += `; Domain=${opts.domain}`;
+    if (path)
+        cookie += `; Path=${path}`;
+    if (opts.maxAge !== undefined) {
+        if (!Number.isFinite(opts.maxAge) || opts.maxAge < 0) {
+            throw new Error(`Invalid cookie Max-Age: ${opts.maxAge}`);
+        }
+        /* Clamp so the value prints as digits; browsers cap Max-Age at 400 days anyway. */
+        cookie += `; Max-Age=${Math.min(Math.floor(opts.maxAge), Number.MAX_SAFE_INTEGER)}`;
+    }
+    if (opts.expires) {
+        if (Number.isNaN(opts.expires.getTime())) {
+            throw new Error("Invalid cookie Expires: date is invalid");
+        }
+        cookie += `; Expires=${opts.expires.toUTCString()}`;
+    }
+    if (opts.httpOnly)
+        cookie += "; HttpOnly";
+    if (secure)
+        cookie += "; Secure";
+    if (opts.sameSite)
+        cookie += `; SameSite=${opts.sameSite.charAt(0).toUpperCase()}${opts.sameSite.slice(1)}`;
+    return cookie;
+}
+//# sourceMappingURL=cookie.js.map

package/dist/cookie.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie.js","sourceRoot":"","sources":["../src/cookie.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;AAEtE;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,KAAa;IACvC,IAAI,OAAO,GAAG,EAAE,CAAA;IAChB,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAChC,IACC,CAAC,KAAK,IAAI;YACV,CAAC,CAAC,KAAK,IAAI;gBACV,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC;gBACxB,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC;gBACxB,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC;gBACxB,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,EACzB,CAAC;YACF,OAAO,IAAI,EAAE,CAAA;QACd,CAAC;aAAM,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC;YACvC,MAAM,IAAI,SAAS,CAAC,8DAA8D,CAAC,CAAA;QACpF,CAAC;aAAM,CAAC;YACP,OAAO,IAAI,kBAAkB,CAAC,EAAE,CAAC,CAAA;QAClC,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAA;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IAC3C,IAAI,CAAC;QACJ,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC,GAAG,EAAE,EAAE;YACrD,IAAI,CAAC;gBACJ,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAA;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,GAAG,CAAA;YACX,CAAC;QACF,CAAC,CAAC,CAAA;IACH,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC/C,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAA;IACtC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAQ;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAA;QACxC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;YAAE,SAAQ;QACvF,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACxC,8FAA8F;QAC9F,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAClG,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAC3B,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAA;IACxC,CAAC;IACD,OAAO,MAAM,CAAA;AACd,CAAC;AAED,MAAM,iBAAiB,GAAG,uBAAuB,CAAA;AACjD,+DAA+D;AAC/D,MAAM,aAAa,GAAG,6DAA6D,CAAA;AAEnF,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,IAAmB;IAChE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IACxB,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;IAEpB,0EAA0E;IAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IAChC,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;QACzE,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QACvE,IAAI,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QACvD,CAAC;QACD,MAAM,GAAG,IAAI,CAAA;QACb,IAAI,GAAG,IAAI,IAAI,GAAG,CAAA;IACnB,CAAC;SAAM,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;QAC3E,MAAM,GAAG,IAAI,CAAA;IACd,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;IAC9D,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;IAC7D,CAAC;IACD,8DAA8D;IAC9D,IAAI,IAAI,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC3D,CAAC;IAED,IAAI,MAAM,GAAG,GAAG,IAAI,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAA;IACvD,IAAI,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,YAAY,IAAI,CAAC,MAAM,EAAE,CAAA;IACpD,IAAI,IAAI;QAAE,MAAM,IAAI,UAAU,IAAI,EAAE,CAAA;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;QAC1D,CAAC;QACD,mFAAmF;QACnF,MAAM,IAAI,aAAa,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAA;IACpF,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;QAC3D,CAAC;QACD,MAAM,IAAI,aAAa,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAA;IACpD,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,YAAY,CAAA;IACzC,IAAI,MAAM;QAAE,MAAM,IAAI,UAAU,CAAA;IAChC,IAAI,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,cAAc,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;IAC3G,OAAO,MAAM,CAAA;AACd,CAAC"}

package/dist/cors.d.ts

@@ -1,5 +1,6 @@
 import type { MiddlewareFn } from "./middleware.ts";
 export type CORSOptions = {
+    /** Requires an explicit `origin` list, string or predicate; `"*"` or no origin throws. */
     credentials?: boolean;
     exposeHeaders?: string[];
     headers?: string[];

package/dist/cors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../src/cors.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAEnD,MAAM,MAAM,WAAW,GAAG;IACzB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,MAAM,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;CAChE,CAAA;AAaD,wBAAgB,IAAI,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,YAAY,CAAC;IAAE,GAAG,EAAE,OAAO,CAAA;CAAE,EAAE,EAAE,CAAC,CAqE9E"}
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../src/cors.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAGnD,MAAM,MAAM,WAAW,GAAG;IACzB,0FAA0F;IAC1F,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,MAAM,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;CAChE,CAAA;AA8BD,wBAAgB,IAAI,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,YAAY,CAAC;IAAE,GAAG,EAAE,OAAO,CAAA;CAAE,EAAE,EAAE,CAAC,CAoD9E"}

package/dist/cors.js

@@ -0,0 +1,87 @@
+import { namedMiddleware } from "./middleware.js";
+import { withHeaders } from "./with-headers.js";
+const DEFAULT_METHODS = ["GET", "HEAD", "PUT", "PATCH", "POST", "DELETE"];
+const DEFAULT_MAX_AGE = 86400;
+/**
+ * Returns the value for `Access-Control-Allow-Origin`, or null when the origin
+ * is not allowed. The opaque origin `null` (sandboxed iframes, `file:`, some
+ * redirects) is never reflected: any page can produce it.
+ */
+function matchOrigin(origin, config) {
+    if (config === undefined || config === "*")
+        return "*";
+    if (origin === "null")
+        return null;
+    if (typeof config === "string")
+        return config === origin ? origin : null;
+    if (Array.isArray(config))
+        return config.includes(origin) ? origin : null;
+    return config(origin) ? origin : null;
+}
+/** Append `value` to `Vary` unless it is already listed (or `*`). */
+function addVary(headers, value) {
+    const current = headers.get("vary");
+    if (current === null || current.trim() === "") {
+        headers.set("vary", value);
+        return;
+    }
+    const tokens = current.split(",").map((t) => t.trim().toLowerCase());
+    if (tokens.includes("*") || tokens.includes(value.toLowerCase()))
+        return;
+    headers.set("vary", `${current}, ${value}`);
+}
+export function cors(options) {
+    const opts = options ?? {};
+    if (opts.credentials === true && (opts.origin === undefined || opts.origin === "*")) {
+        throw new TypeError("cors: `credentials: true` needs an explicit `origin` (string, list or predicate). A wildcard would let every site make credentialed requests and read the response.");
+    }
+    /* `Vary: Origin` whenever the answer depends on the request's Origin — that is,
+     * on every response unless the policy is a plain wildcard. Without it a shared
+     * cache can serve one origin's ACAO (or its absence) to another. */
+    const varies = !(opts.origin === undefined || opts.origin === "*");
+    const methods = (opts.methods ?? DEFAULT_METHODS).join(", ");
+    const allowHeaders = opts.headers && opts.headers.length > 0 ? opts.headers.join(", ") : null;
+    const exposeHeaders = opts.exposeHeaders && opts.exposeHeaders.length > 0 ? opts.exposeHeaders.join(", ") : null;
+    const maxAge = String(opts.maxAge ?? DEFAULT_MAX_AGE);
+    const mw = async (ctx, next) => {
+        const req = ctx.req;
+        const requestOrigin = req.headers.get("origin");
+        const allowedOrigin = requestOrigin === null ? null : matchOrigin(requestOrigin, opts.origin);
+        if (allowedOrigin !== null && req.method === "OPTIONS" && req.headers.has("access-control-request-method")) {
+            const headers = new Headers();
+            headers.set("access-control-allow-origin", allowedOrigin);
+            headers.set("access-control-allow-methods", methods);
+            if (allowHeaders !== null) {
+                headers.set("access-control-allow-headers", allowHeaders);
+            }
+            else {
+                const requested = req.headers.get("access-control-request-headers");
+                if (requested)
+                    headers.set("access-control-allow-headers", requested);
+                addVary(headers, "Access-Control-Request-Headers");
+            }
+            headers.set("access-control-max-age", maxAge);
+            if (opts.credentials)
+                headers.set("access-control-allow-credentials", "true");
+            if (varies)
+                addVary(headers, "Origin");
+            return new Response(null, { headers, status: 204 });
+        }
+        const response = await next();
+        if (allowedOrigin === null && !varies)
+            return response;
+        return withHeaders(response, (headers) => {
+            if (varies)
+                addVary(headers, "Origin");
+            if (allowedOrigin === null)
+                return;
+            headers.set("access-control-allow-origin", allowedOrigin);
+            if (opts.credentials)
+                headers.set("access-control-allow-credentials", "true");
+            if (exposeHeaders !== null)
+                headers.set("access-control-expose-headers", exposeHeaders);
+        });
+    };
+    return namedMiddleware("cors", mw);
+}
+//# sourceMappingURL=cors.js.map

package/dist/cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../src/cors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAEjD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAY/C,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;AACzE,MAAM,eAAe,GAAG,KAAK,CAAA;AAE7B;;;;GAIG;AACH,SAAS,WAAW,CAAC,MAAc,EAAE,MAA6B;IACjE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,GAAG,CAAA;IACtD,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAA;IAClC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;IACxE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;IACzE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;AACtC,CAAC;AAED,qEAAqE;AACrE,SAAS,OAAO,CAAC,OAAgB,EAAE,KAAa;IAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACnC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QAC1B,OAAM;IACP,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;IACpE,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAAE,OAAM;IACxE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,OAAO,KAAK,KAAK,EAAE,CAAC,CAAA;AAC5C,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,OAAqB;IACzC,MAAM,IAAI,GAAG,OAAO,IAAI,EAAE,CAAA;IAE1B,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,SAAS,CAClB,qKAAqK,CACrK,CAAA;IACF,CAAC;IAED;;wEAEoE;IACpE,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,CAAA;IAClE,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC7F,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAChH,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,CAAA;IAErD,MAAM,EAAE,GAAuC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAClE,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAA;QACnB,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC/C,MAAM,aAAa,GAAG,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QAE7F,IAAI,aAAa,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,EAAE,CAAC;YAC5G,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAA;YAC7B,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,aAAa,CAAC,CAAA;YACzD,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,OAAO,CAAC,CAAA;YACpD,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;gBAC3B,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,YAAY,CAAC,CAAA;YAC1D,CAAC;iBAAM,CAAC;gBACP,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAA;gBACnE,IAAI,SAAS;oBAAE,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,SAAS,CAAC,CAAA;gBACrE,OAAO,CAAC,OAAO,EAAE,gCAAgC,CAAC,CAAA;YACnD,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAA;YAC7C,IAAI,IAAI,CAAC,WAAW;gBAAE,OAAO,CAAC,GAAG,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAA;YAC7E,IAAI,MAAM;gBAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;YACtC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAA;QAC7B,IAAI,aAAa,KAAK,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,QAAQ,CAAA;QACtD,OAAO,WAAW,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE;YACxC,IAAI,MAAM;gBAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;YACtC,IAAI,aAAa,KAAK,IAAI;gBAAE,OAAM;YAClC,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,aAAa,CAAC,CAAA;YACzD,IAAI,IAAI,CAAC,WAAW;gBAAE,OAAO,CAAC,GAAG,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAA;YAC7E,IAAI,aAAa,KAAK,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,aAAa,CAAC,CAAA;QACxF,CAAC,CAAC,CAAA;IACH,CAAC,CAAA;IAED,OAAO,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AACnC,CAAC"}

package/dist/crypto.d.ts

@@ -1,2 +1,7 @@
-export declare function timingSafeEqual(a: string, b: string): Promise<boolean>;
+/**
+ * Constant-time equality. Both sides are MACed with a per-process random key and
+ * the MACs are compared by `crypto.subtle.verify`, so neither content nor length
+ * leaks through timing.
+ */
+export declare function timingSafeEqual(a: string | Uint8Array, b: string | Uint8Array): Promise<boolean>;
 //# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAWA,wBAAsB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAI5E"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAyBA;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,EAAE,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAOtG"}

package/dist/crypto.js

@@ -0,0 +1,38 @@
+let cachedKey = null;
+async function getKey() {
+    if (cachedKey === null) {
+        cachedKey = await crypto.subtle.generateKey({ hash: "SHA-256", name: "HMAC" }, false, ["sign", "verify"]);
+    }
+    return cachedKey;
+}
+/**
+ * Strings are compared by UTF-16 code unit, not by their UTF-8 encoding: UTF-8
+ * replaces every lone surrogate with U+FFFD, so two different strings would
+ * compare equal.
+ */
+function toBytes(value) {
+    if (typeof value !== "string")
+        return new Uint8Array(value);
+    const bytes = new Uint8Array(value.length * 2);
+    for (let i = 0; i < value.length; i++) {
+        const unit = value.charCodeAt(i);
+        bytes[i * 2] = unit >> 8;
+        bytes[i * 2 + 1] = unit & 0xff;
+    }
+    return bytes;
+}
+/**
+ * Constant-time equality. Both sides are MACed with a per-process random key and
+ * the MACs are compared by `crypto.subtle.verify`, so neither content nor length
+ * leaks through timing.
+ */
+export async function timingSafeEqual(a, b) {
+    /* A string never equals bytes: tag the kind so "ab" and its code units differ. */
+    const aIsString = typeof a === "string";
+    if (aIsString !== (typeof b === "string"))
+        return false;
+    const key = await getKey();
+    const sig = await crypto.subtle.sign("HMAC", key, toBytes(a));
+    return crypto.subtle.verify("HMAC", key, sig, toBytes(b));
+}
+//# sourceMappingURL=crypto.js.map

package/dist/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,IAAI,SAAS,GAAqB,IAAI,CAAA;AAEtC,KAAK,UAAU,MAAM;IACpB,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACxB,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;IAC1G,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAS,OAAO,CAAC,KAA0B;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IAC3D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QAChC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAA;QACxB,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;IAC/B,CAAC;IACD,OAAO,KAAK,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,CAAsB,EAAE,CAAsB;IACnF,kFAAkF;IAClF,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAA;IACvC,IAAI,SAAS,KAAK,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAA;IACvD,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAA;IAC1B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;IAC7D,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;AAC1D,CAAC"}

package/dist/csrf.d.ts

@@ -1,7 +1,26 @@
 import type { MiddlewareFn } from "./middleware.ts";
 type CSRFOptions = {
+    /**
+     * Cross-origin callers allowed to make unsafe requests, matched against the
+     * full `Origin` (`https://app.example.com`). Same-origin requests never need
+     * to be listed.
+     */
     origin?: ((origin: string) => boolean) | string | string[];
 };
+/**
+ * Rejects cross-origin unsafe requests, whatever their content type.
+ *
+ * 1. `GET`, `HEAD` and `OPTIONS` pass.
+ * 2. With `Sec-Fetch-Site` (every current browser sends it): `same-origin` and
+ *    `none` (user-initiated) pass. `same-site` and `cross-site` pass only for an
+ *    allow-listed `Origin`. A sibling subdomain is same-site but not trusted.
+ * 3. Without it: no `Origin` passes (curl, server-to-server, old clients that
+ *    cannot be driven cross-site), an `Origin` whose host equals `Host` passes,
+ *    an allow-listed `Origin` passes, anything else is rejected.
+ *
+ * Failure is 403 `forbidden`. This is the algorithm of Go's
+ * `http.CrossOriginProtection`.
+ */
 export declare function csrf(options?: CSRFOptions): MiddlewareFn<{
     req: Request;
 }, {}>;

package/dist/csrf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAGnD,KAAK,WAAW,GAAG;IAClB,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;CAC1D,CAAA;AAYD,wBAAgB,IAAI,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,YAAY,CAAC;IAAE,GAAG,EAAE,OAAO,CAAA;CAAE,EAAE,EAAE,CAAC,CAkC9E"}
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAGnD,KAAK,WAAW,GAAG;IAClB;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;CAC1D,CAAA;AAmCD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,IAAI,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,YAAY,CAAC;IAAE,GAAG,EAAE,OAAO,CAAA;CAAE,EAAE,EAAE,CAAC,CAwB9E"}

package/dist/csrf.js

@@ -0,0 +1,79 @@
+import { namedMiddleware } from "./middleware.js";
+import { HoneyError } from "./error.js";
+import { EK, SK } from "./types.js";
+const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+function matchOrigin(origin, config) {
+    if (config === undefined)
+        return false;
+    if (typeof config === "string")
+        return config === origin;
+    if (Array.isArray(config))
+        return config.includes(origin);
+    return config(origin);
+}
+/** Host of the request as the client addressed it: `Host`, else the URL's host. */
+function requestHost(req) {
+    const host = req.headers.get("host");
+    if (host !== null && host !== "")
+        return host.toLowerCase();
+    try {
+        return new URL(req.url).host.toLowerCase();
+    }
+    catch {
+        return null;
+    }
+}
+function originHost(origin) {
+    if (origin === "null")
+        return null;
+    try {
+        return new URL(origin).host.toLowerCase();
+    }
+    catch {
+        return null;
+    }
+}
+function reject() {
+    throw new HoneyError({ errorKey: EK.forbidden, status: SK.forbidden });
+}
+/**
+ * Rejects cross-origin unsafe requests, whatever their content type.
+ *
+ * 1. `GET`, `HEAD` and `OPTIONS` pass.
+ * 2. With `Sec-Fetch-Site` (every current browser sends it): `same-origin` and
+ *    `none` (user-initiated) pass. `same-site` and `cross-site` pass only for an
+ *    allow-listed `Origin`. A sibling subdomain is same-site but not trusted.
+ * 3. Without it: no `Origin` passes (curl, server-to-server, old clients that
+ *    cannot be driven cross-site), an `Origin` whose host equals `Host` passes,
+ *    an allow-listed `Origin` passes, anything else is rejected.
+ *
+ * Failure is 403 `forbidden`. This is the algorithm of Go's
+ * `http.CrossOriginProtection`.
+ */
+export function csrf(options) {
+    const allow = options?.origin;
+    const mw = (ctx, next) => {
+        const req = ctx.req;
+        if (SAFE_METHODS.has(req.method))
+            return next();
+        const origin = req.headers.get("origin");
+        const site = req.headers.get("sec-fetch-site");
+        if (site !== null) {
+            if (site === "same-origin" || site === "none")
+                return next();
+            if (origin !== null && matchOrigin(origin, allow))
+                return next();
+            return reject();
+        }
+        if (origin === null)
+            return next();
+        const host = originHost(origin);
+        if (host !== null && host === requestHost(req))
+            return next();
+        if (matchOrigin(origin, allow))
+            return next();
+        return reject();
+    };
+    return namedMiddleware("csrf", mw);
+}
+//# sourceMappingURL=csrf.js.map

package/dist/csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAEvC,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,YAAY,CAAA;AAWnC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAA;AAExD,SAAS,WAAW,CAAC,MAAc,EAAE,MAA6B;IACjE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IACtC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,KAAK,MAAM,CAAA;IACxD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACzD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAA;AACtB,CAAC;AAED,mFAAmF;AACnF,SAAS,WAAW,CAAC,GAAY;IAChC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACpC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC,WAAW,EAAE,CAAA;IAC3D,IAAI,CAAC;QACJ,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAA;IAC3C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IACjC,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAA;IAClC,IAAI,CAAC;QACJ,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,SAAS,MAAM;IACd,MAAM,IAAI,UAAU,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC,CAAA;AACvE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,IAAI,CAAC,OAAqB;IACzC,MAAM,KAAK,GAAG,OAAO,EAAE,MAAM,CAAA;IAE7B,MAAM,EAAE,GAAuC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;QAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAA;QACnB,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,EAAE,CAAA;QAE/C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACxC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;QAE9C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,MAAM;gBAAE,OAAO,IAAI,EAAE,CAAA;YAC5D,IAAI,MAAM,KAAK,IAAI,IAAI,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAA;YAChE,OAAO,MAAM,EAAE,CAAA;QAChB,CAAC;QAED,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,EAAE,CAAA;QAClC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;QAC/B,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,EAAE,CAAA;QAC7D,IAAI,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,EAAE,CAAA;QAC7C,OAAO,MAAM,EAAE,CAAA;IAChB,CAAC,CAAA;IAED,OAAO,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AACnC,CAAC"}

package/dist/curl-logger.d.ts

@@ -11,6 +11,8 @@ type CurlLogData = {
     requestId: string | null;
     status: number;
 };
+/** What `skip` sees: everything known before the curl command is built. */
+type CurlSkipData = Pick<CurlLogData, "duration" | "method" | "path" | "requestId" | "status">;
 type CurlLoggerBodyOptions = {
     allowContentTypes?: string[];
     maxBytes?: number;
@@ -19,15 +21,24 @@ type CurlLoggerOptions = {
     body?: boolean | CurlLoggerBodyOptions;
     instance?: LoggerInstance;
     log?: (data: CurlLogData) => void;
+    /**
+     * Return the value to log, or null to drop the header. Replaces the default,
+     * which masks `authorization`, `proxy-authorization`, `cookie`, `set-cookie`
+     * and API-key/token headers. Call `defaultRedactHeader` to keep it and add more.
+     */
     redactHeader?: (name: string, value: string) => string | null;
+    /** Same for query parameters. The default masks token-, key-, secret- and password-like names. */
     redactQueryParam?: (name: string, value: string) => string | null;
-    skip?: (data: CurlLogData) => boolean;
+    /** Runs before the curl command is built; returning true skips all of that work. */
+    skip?: (data: CurlSkipData) => boolean;
 };
+declare function defaultRedactHeader(name: string, value: string): string | null;
+declare function defaultRedactQueryParam(name: string, value: string): string | null;
 declare function buildCurlLogData(request: Request, options?: Pick<CurlLoggerOptions, "body" | "redactHeader" | "redactQueryParam">): Promise<Pick<CurlLogData, "bodyIncluded" | "bodyOmittedReason" | "curl">>;
 declare function curlLogger(options?: CurlLoggerOptions): MiddlewareFn<{
     path: string;
     req: Request;
 }, {}>;
-export { buildCurlLogData, curlLogger };
-export type { BodyOmittedReason, CurlLogData, CurlLoggerBodyOptions, CurlLoggerOptions };
+export { buildCurlLogData, curlLogger, defaultRedactHeader, defaultRedactQueryParam };
+export type { BodyOmittedReason, CurlLogData, CurlLoggerBodyOptions, CurlLoggerOptions, CurlSkipData };
 //# sourceMappingURL=curl-logger.d.ts.map

package/dist/curl-logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"curl-logger.d.ts","sourceRoot":"","sources":["../src/curl-logger.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEjD,KAAK,iBAAiB,GAAG,cAAc,GAAG,UAAU,GAAG,SAAS,GAAG,YAAY,GAAG,WAAW,CAAA;AAE7F,KAAK,WAAW,GAAG;IAClB,YAAY,EAAE,OAAO,CAAA;IACrB,iBAAiB,EAAE,iBAAiB,GAAG,IAAI,CAAA;IAC3C,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,CAAA;CACd,CAAA;AAED,KAAK,qBAAqB,GAAG;IAC5B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,KAAK,iBAAiB,GAAG;IACxB,IAAI,CAAC,EAAE,OAAO,GAAG,qBAAqB,CAAA;IACtC,QAAQ,CAAC,EAAE,cAAc,CAAA;IACzB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,IAAI,CAAA;IACjC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAA;IAC7D,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAA;IACjE,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,CAAA;CACrC,CAAA;AA2FD,iBAAe,gBAAgB,CAC9B,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM,GAAG,cAAc,GAAG,kBAAkB,CAAC,GAC7E,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,GAAG,mBAAmB,GAAG,MAAM,CAAC,CAAC,CAwC3E;AAED,iBAAS,UAAU,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,YAAY,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,OAAO,CAAA;CAAE,EAAE,EAAE,CAAC,CAgDjG;AAED,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAA;AACvC,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,CAAA"}
+{"version":3,"file":"curl-logger.d.ts","sourceRoot":"","sources":["../src/curl-logger.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAGjD,KAAK,iBAAiB,GAAG,cAAc,GAAG,UAAU,GAAG,SAAS,GAAG,YAAY,GAAG,WAAW,CAAA;AAE7F,KAAK,WAAW,GAAG;IAClB,YAAY,EAAE,OAAO,CAAA;IACrB,iBAAiB,EAAE,iBAAiB,GAAG,IAAI,CAAA;IAC3C,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,CAAA;CACd,CAAA;AAED,2EAA2E;AAC3E,KAAK,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAC,CAAA;AAE9F,KAAK,qBAAqB,GAAG;IAC5B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,KAAK,iBAAiB,GAAG;IACxB,IAAI,CAAC,EAAE,OAAO,GAAG,qBAAqB,CAAA;IACtC,QAAQ,CAAC,EAAE,cAAc,CAAA;IACzB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,IAAI,CAAA;IACjC;;;;OAIG;IACH,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAA;IAC7D,kGAAkG;IAClG,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAA;IACjE,oFAAoF;IACpF,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,OAAO,CAAA;CACtC,CAAA;AAsBD,iBAAS,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIvE;AAED,iBAAS,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE3E;AAyHD,iBAAe,gBAAgB,CAC9B,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM,GAAG,cAAc,GAAG,kBAAkB,CAAC,GAC7E,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,GAAG,mBAAmB,GAAG,MAAM,CAAC,CAAC,CAW3E;AAED,iBAAS,UAAU,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,YAAY,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,OAAO,CAAA;CAAE,EAAE,EAAE,CAAC,CA+CjG;AAED,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,CAAA;AACrF,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,YAAY,EAAE,CAAA"}