@nauth-toolkit/core 0.3.0 → 0.3.2

package/dist/services/api-key.service.js

@@ -0,0 +1,475 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiKeyService = void 0;
+const crypto_1 = require("crypto");
+const nauth_exception_1 = require("../exceptions/nauth.exception");
+const error_codes_enum_1 = require("../enums/error-codes.enum");
+const auth_audit_event_type_enum_1 = require("../enums/auth-audit-event-type.enum");
+const context_storage_1 = require("../utils/context-storage");
+const dto_validator_1 = require("../utils/dto-validator");
+const ip_match_1 = require("../utils/ip-match");
+const api_key_dto_1 = require("../dto/api-key.dto");
+const admin_api_key_dto_1 = require("../dto/admin-api-key.dto");
+/**
+ * API Key Service
+ *
+ * Owns the full API key lifecycle and validation. Keys authenticate **as their owning user**.
+ *
+ * Identity convention (matches the rest of the toolkit):
+ * - **Self-service** methods (`createKey`, `listKeys`, `updateKey`, `revokeKey`, `deleteKey`)
+ *   act on the *currently authenticated* user, resolved from request context. They take no
+ *   user identifier.
+ * - **Admin** methods (`adminCreateKey`, `adminListKeys`, `adminUpdateKey`, `adminRevokeKey`,
+ *   `adminDeleteKey`) act on a target user identified by `sub`. Protect them with admin auth.
+ *
+ * Every public method takes a request DTO and returns a response DTO, and validates the DTO at
+ * runtime (via {@link ensureValidatedDto}) so non-NestJS callers are protected from invalid input.
+ *
+ * Security:
+ * - Only a SHA-256 hash of the key is stored; the plaintext is returned once at creation.
+ * - Presented keys are hashed and looked up by that hash (indexed, unique) — the plaintext never
+ *   leaves the caller and is never compared field-by-field.
+ * - Per-key IP allowlists (optional) restrict which source IPs may use a key.
+ */
+class ApiKeyService {
+    apiKeyRepository;
+    userRepository;
+    config;
+    logger;
+    auditService;
+    constructor(apiKeyRepository, userRepository, config, logger, auditService) {
+        this.apiKeyRepository = apiKeyRepository;
+        this.userRepository = userRepository;
+        this.config = config;
+        this.logger = logger;
+        this.auditService = auditService;
+        this.logger?.log?.('ApiKeyService initialized');
+    }
+    // ==========================================================================
+    // Self-service (acting user resolved from auth context)
+    // ==========================================================================
+    /**
+     * Create an API key for the currently authenticated user.
+     *
+     * @throws {NAuthException} API_KEY_CREATION_DISABLED, API_KEY_LIMIT_REACHED,
+     *   API_KEY_EXPIRY_REQUIRED, API_KEY_INDEFINITE_NOT_ALLOWED, API_KEY_EXPIRY_TOO_LONG,
+     *   VALIDATION_FAILED, FORBIDDEN (not authenticated)
+     */
+    async createKey(dto) {
+        dto = await (0, dto_validator_1.ensureValidatedDto)(api_key_dto_1.CreateApiKeyDTO, dto);
+        const user = this.getCurrentUserOrThrow();
+        return this.createForUser(user.id, dto, false);
+    }
+    /**
+     * List the current user's API keys (sanitized; never includes secrets).
+     */
+    async listKeys() {
+        const user = this.getCurrentUserOrThrow();
+        return this.listForUser(user.id);
+    }
+    /**
+     * Update the current user's key (label and/or IP allowlist). Secret and expiry are immutable.
+     *
+     * @throws {NAuthException} API_KEY_NOT_FOUND, VALIDATION_FAILED, FORBIDDEN
+     */
+    async updateKey(dto) {
+        dto = await (0, dto_validator_1.ensureValidatedDto)(api_key_dto_1.UpdateApiKeyDTO, dto);
+        const user = this.getCurrentUserOrThrow();
+        return this.updateForUser(user.id, dto.keyId, dto.name, dto.allowedIps);
+    }
+    /**
+     * Revoke (soft-delete) one of the current user's keys.
+     *
+     * @throws {NAuthException} API_KEY_NOT_FOUND, FORBIDDEN
+     */
+    async revokeKey(dto) {
+        dto = await (0, dto_validator_1.ensureValidatedDto)(api_key_dto_1.RevokeApiKeyDTO, dto);
+        const user = this.getCurrentUserOrThrow();
+        return this.revokeForUser(user.id, dto.keyId, 'user_revoked');
+    }
+    /**
+     * Permanently delete one of the current user's keys.
+     *
+     * @throws {NAuthException} API_KEY_NOT_FOUND, FORBIDDEN
+     */
+    async deleteKey(dto) {
+        dto = await (0, dto_validator_1.ensureValidatedDto)(api_key_dto_1.DeleteApiKeyDTO, dto);
+        const user = this.getCurrentUserOrThrow();
+        return this.deleteForUser(user.id, dto.keyId);
+    }
+    // ==========================================================================
+    // Admin (target user identified by sub) — protect with admin authentication
+    // ==========================================================================
+    /**
+     * Create an API key on behalf of a user. Bypasses `allowUserCreation`, but still enforces
+     * `maxKeysPerUser`, expiry, and IP-restriction rules.
+     *
+     * @throws {NAuthException} USER_NOT_FOUND, or any API_KEY_* creation error
+     */
+    async adminCreateKey(dto) {
+        dto = await (0, dto_validator_1.ensureValidatedDto)(admin_api_key_dto_1.AdminCreateApiKeyDTO, dto);
+        const userId = await this.resolveUserIdBySub(dto.sub);
+        return this.createForUser(userId, dto, true);
+    }
+    /**
+     * List a user's API keys (admin).
+     *
+     * @throws {NAuthException} USER_NOT_FOUND
+     */
+    async adminListKeys(dto) {
+        dto = await (0, dto_validator_1.ensureValidatedDto)(admin_api_key_dto_1.AdminManageApiKeyDTO, dto);
+        const userId = await this.resolveUserIdBySub(dto.sub);
+        return this.listForUser(userId);
+    }
+    /**
+     * Update a user's key (admin).
+     *
+     * @throws {NAuthException} USER_NOT_FOUND, API_KEY_NOT_FOUND, VALIDATION_FAILED
+     */
+    async adminUpdateKey(dto) {
+        dto = await (0, dto_validator_1.ensureValidatedDto)(admin_api_key_dto_1.AdminUpdateApiKeyDTO, dto);
+        const userId = await this.resolveUserIdBySub(dto.sub);
+        return this.updateForUser(userId, dto.keyId, dto.name, dto.allowedIps);
+    }
+    /**
+     * Revoke (soft-delete) a user's key (admin).
+     *
+     * @throws {NAuthException} USER_NOT_FOUND, API_KEY_NOT_FOUND, VALIDATION_FAILED
+     */
+    async adminRevokeKey(dto) {
+        dto = await (0, dto_validator_1.ensureValidatedDto)(admin_api_key_dto_1.AdminManageApiKeyDTO, dto);
+        const keyId = this.requireKeyId(dto.keyId);
+        const userId = await this.resolveUserIdBySub(dto.sub);
+        return this.revokeForUser(userId, keyId, 'admin_revoked');
+    }
+    /**
+     * Permanently delete a user's key (admin).
+     *
+     * @throws {NAuthException} USER_NOT_FOUND, API_KEY_NOT_FOUND, VALIDATION_FAILED
+     */
+    async adminDeleteKey(dto) {
+        dto = await (0, dto_validator_1.ensureValidatedDto)(admin_api_key_dto_1.AdminManageApiKeyDTO, dto);
+        const keyId = this.requireKeyId(dto.keyId);
+        const userId = await this.resolveUserIdBySub(dto.sub);
+        return this.deleteForUser(userId, keyId);
+    }
+    // ==========================================================================
+    // Validation (internal auth path — called by the handler / guard)
+    // ==========================================================================
+    /**
+     * Validate a presented API key and resolve its owner.
+     *
+     * On any failure this throws a precise {@link NAuthException} (access denied) — callers
+     * MUST NOT fall back to other credentials.
+     *
+     * @param rawKey - The full plaintext key from the request header
+     * @param callerIp - Source IP of the request (for IP-allowlist enforcement + usage tracking)
+     * @throws {NAuthException} API_KEY_INVALID, API_KEY_EXPIRED, API_KEY_IP_NOT_ALLOWED
+     */
+    async validateKey(rawKey, callerIp) {
+        if (typeof rawKey !== 'string' || rawKey.length === 0) {
+            await this.audit(auth_audit_event_type_enum_1.AuthAuditEventType.API_KEY_AUTH_FAILED, null, 'FAILURE', { reason: 'malformed' });
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_INVALID, 'Invalid API key');
+        }
+        // Look up by the hash of the presented key (indexed). A miss means unknown/invalid.
+        const key = await this.apiKeyRepository.findOne({ where: { keyHash: this.hashKey(rawKey) } });
+        if (!key || !key.isActive) {
+            await this.audit(auth_audit_event_type_enum_1.AuthAuditEventType.API_KEY_AUTH_FAILED, key?.userId ?? null, 'FAILURE', { reason: 'invalid' });
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_INVALID, 'Invalid API key');
+        }
+        if (key.isExpired()) {
+            await this.audit(auth_audit_event_type_enum_1.AuthAuditEventType.API_KEY_AUTH_FAILED, key.userId, 'FAILURE', {
+                keyId: key.keyId,
+                reason: 'expired',
+            });
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_EXPIRED, 'API key has expired');
+        }
+        if (!key.isIpAllowed(callerIp, ip_match_1.ipMatchesEntry)) {
+            await this.audit(auth_audit_event_type_enum_1.AuthAuditEventType.API_KEY_AUTH_FAILED, key.userId, 'SUSPICIOUS', {
+                keyId: key.keyId,
+                reason: 'ip_not_allowed',
+            });
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_IP_NOT_ALLOWED, 'API key not permitted from this IP address');
+        }
+        const owner = await this.userRepository.findOne({
+            where: { id: key.userId },
+            select: { id: true, sub: true, isActive: true },
+        });
+        if (!owner || !owner.isActive) {
+            await this.audit(auth_audit_event_type_enum_1.AuthAuditEventType.API_KEY_AUTH_FAILED, key.userId, 'FAILURE', {
+                keyId: key.keyId,
+                reason: 'owner_inactive',
+            });
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_INVALID, 'Invalid API key');
+        }
+        await this.recordUsage(key, callerIp ?? null);
+        return { keyId: key.keyId, sub: owner.sub };
+    }
+    // ==========================================================================
+    // Internal primitives (keyed by internal userId)
+    // ==========================================================================
+    /**
+     * Core key creation for a resolved user.
+     */
+    async createForUser(userId, params, createdByAdmin) {
+        const cfg = this.config.apiKeys ?? {};
+        // Creation-rights gate: only admins may create keys unless user creation is enabled.
+        if (!createdByAdmin && cfg.allowUserCreation !== true) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_CREATION_DISABLED, 'API key creation is disabled for users. Contact an administrator.');
+        }
+        const maxKeys = cfg.maxKeysPerUser ?? 10;
+        const activeCount = await this.apiKeyRepository.count({ where: { userId, isActive: true } });
+        if (activeCount >= maxKeys) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_LIMIT_REACHED, `Maximum of ${maxKeys} active API keys reached.`, {
+                maxKeysPerUser: maxKeys,
+            });
+        }
+        const expiresAt = this.resolveExpiry(params.expiresInDays);
+        const allowedIps = this.normalizeAllowedIps(params.allowedIps);
+        // Server-generated 256-bit secret. The plaintext is returned once; only its hash is stored.
+        const keyId = (0, crypto_1.randomUUID)();
+        const rawKey = (0, crypto_1.randomBytes)(32).toString('base64url');
+        const keyHash = this.hashKey(rawKey);
+        const entity = this.apiKeyRepository.create({
+            keyId,
+            userId,
+            keyHash,
+            name: params.name ?? null,
+            lastFour: rawKey.slice(-4),
+            allowedIps: allowedIps.length > 0 ? allowedIps : null,
+            expiresAt,
+            isActive: true,
+            createdByAdmin,
+            usageCount: 0,
+        });
+        const saved = await this.apiKeyRepository.save(entity);
+        await this.audit(auth_audit_event_type_enum_1.AuthAuditEventType.API_KEY_CREATED, userId, 'SUCCESS', {
+            keyId,
+            createdByAdmin,
+            hasExpiry: expiresAt !== null,
+            ipRestricted: allowedIps.length > 0,
+        });
+        return { key: rawKey, apiKey: this.toResponse(saved) };
+    }
+    /**
+     * List a resolved user's keys.
+     */
+    async listForUser(userId) {
+        const keys = await this.apiKeyRepository.find({ where: { userId }, order: { createdAt: 'DESC' } });
+        return { apiKeys: keys.map((k) => this.toResponse(k)) };
+    }
+    /**
+     * Update a resolved user's key (label / IP allowlist).
+     */
+    async updateForUser(userId, keyId, name, allowedIps) {
+        const key = await this.apiKeyRepository.findOne({ where: { keyId, userId } });
+        if (!key) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_NOT_FOUND, 'API key not found');
+        }
+        if (name !== undefined) {
+            key.name = name ?? null;
+        }
+        if (allowedIps !== undefined) {
+            const normalized = this.normalizeAllowedIps(allowedIps);
+            key.allowedIps = normalized.length > 0 ? normalized : null;
+        }
+        const saved = await this.apiKeyRepository.save(key);
+        await this.audit(auth_audit_event_type_enum_1.AuthAuditEventType.API_KEY_UPDATED, userId, 'INFO', { keyId });
+        return this.toResponse(saved);
+    }
+    /**
+     * Revoke (soft-delete) a resolved user's key.
+     */
+    async revokeForUser(userId, keyId, reason) {
+        const key = await this.apiKeyRepository.findOne({ where: { keyId, userId } });
+        if (!key) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_NOT_FOUND, 'API key not found');
+        }
+        if (key.isActive) {
+            key.isActive = false;
+            key.revokedAt = new Date();
+            key.revokeReason = reason;
+            await this.apiKeyRepository.save(key);
+        }
+        await this.audit(auth_audit_event_type_enum_1.AuthAuditEventType.API_KEY_REVOKED, userId, 'INFO', { keyId });
+        return { success: true };
+    }
+    /**
+     * Permanently delete a resolved user's key.
+     */
+    async deleteForUser(userId, keyId) {
+        const key = await this.apiKeyRepository.findOne({ where: { keyId, userId } });
+        if (!key) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_NOT_FOUND, 'API key not found');
+        }
+        await this.apiKeyRepository.remove(key);
+        await this.audit(auth_audit_event_type_enum_1.AuthAuditEventType.API_KEY_DELETED, userId, 'INFO', { keyId });
+        return { success: true };
+    }
+    // ==========================================================================
+    // Helpers
+    // ==========================================================================
+    /**
+     * Resolve the currently authenticated user from request context.
+     *
+     * @throws {NAuthException} FORBIDDEN when no authenticated user is present
+     */
+    getCurrentUserOrThrow() {
+        const currentUser = context_storage_1.ContextStorage.get('CURRENT_USER');
+        if (!currentUser) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.FORBIDDEN, 'Authentication required');
+        }
+        return currentUser;
+    }
+    /**
+     * Resolve an internal user id from an external sub (UUID).
+     *
+     * @throws {NAuthException} USER_NOT_FOUND
+     */
+    async resolveUserIdBySub(sub) {
+        const user = await this.userRepository.findOne({ where: { sub }, select: { id: true } });
+        if (!user) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.USER_NOT_FOUND, 'User not found');
+        }
+        return user.id;
+    }
+    /**
+     * Ensure a keyId is present for admin revoke/delete operations.
+     */
+    requireKeyId(keyId) {
+        if (!keyId) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VALIDATION_FAILED, 'keyId is required for this operation');
+        }
+        return keyId;
+    }
+    /**
+     * Resolve the mandatory, config-bounded expiry.
+     */
+    resolveExpiry(expiresInDays) {
+        const cfg = this.config.apiKeys ?? {};
+        if (expiresInDays === undefined) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_EXPIRY_REQUIRED, 'An expiry must be specified when creating an API key (a number of days, or null for never).');
+        }
+        if (expiresInDays === null) {
+            if (cfg.allowIndefinite === false) {
+                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_INDEFINITE_NOT_ALLOWED, 'Non-expiring API keys are not allowed. Specify an expiry in days.');
+            }
+            return null;
+        }
+        if (!Number.isInteger(expiresInDays) || expiresInDays < 1) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VALIDATION_FAILED, 'expiresInDays must be a positive integer or null.');
+        }
+        if (typeof cfg.maxExpiryDays === 'number' && expiresInDays > cfg.maxExpiryDays) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_EXPIRY_TOO_LONG, `Expiry exceeds the maximum of ${cfg.maxExpiryDays} days.`, { maxExpiryDays: cfg.maxExpiryDays });
+        }
+        const expiresAt = new Date();
+        expiresAt.setDate(expiresAt.getDate() + expiresInDays);
+        return expiresAt;
+    }
+    /**
+     * Validate and normalize an IP allowlist per configuration.
+     */
+    normalizeAllowedIps(allowedIps) {
+        const cfg = this.config.apiKeys ?? {};
+        const ipCfg = cfg.ipRestrictions ?? {};
+        if (ipCfg.enabled === false) {
+            if (allowedIps && allowedIps.length > 0) {
+                this.logger?.debug?.('[ApiKey] IP restrictions disabled - ignoring provided allowedIps');
+            }
+            return [];
+        }
+        const normalized = (allowedIps ?? []).map((e) => e.trim()).filter((e) => e.length > 0);
+        if (ipCfg.requireForNewKeys === true && normalized.length === 0) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VALIDATION_FAILED, 'An IP allowlist is required for new API keys (apiKeys.ipRestrictions.requireForNewKeys).');
+        }
+        const maxIps = ipCfg.maxIpsPerKey ?? 20;
+        if (normalized.length > maxIps) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VALIDATION_FAILED, `An API key may have at most ${maxIps} IP entries.`, {
+                maxIpsPerKey: maxIps,
+            });
+        }
+        const invalid = normalized.filter((e) => !(0, ip_match_1.isValidIpOrCidr)(e));
+        if (invalid.length > 0) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VALIDATION_FAILED, 'allowedIps contains invalid IP or CIDR entries.', {
+                invalid,
+            });
+        }
+        return normalized;
+    }
+    /**
+     * Compute the SHA-256 hex hash of a key string (used for storage + indexed lookup).
+     */
+    hashKey(rawKey) {
+        return (0, crypto_1.createHash)('sha256').update(rawKey).digest('hex');
+    }
+    /**
+     * Update last-used metadata, throttled to avoid a write on every request.
+     * Never throws — usage tracking must not block authentication.
+     */
+    async recordUsage(key, callerIp) {
+        const cfg = this.config.apiKeys ?? {};
+        const throttleMs = (cfg.lastUsedThrottleSeconds ?? 60) * 1000;
+        const now = Date.now();
+        const last = key.lastUsedAt ? key.lastUsedAt.getTime() : 0;
+        if (last !== 0 && now - last < throttleMs) {
+            return;
+        }
+        try {
+            const update = {
+                lastUsedAt: new Date(now),
+            };
+            if (cfg.trackUsageIp !== false) {
+                update.lastUsedIp = callerIp;
+            }
+            await this.apiKeyRepository.update({ id: key.id }, update);
+            // Atomic increment avoids lost updates under concurrent use (read-modify-write race).
+            await this.apiKeyRepository.increment({ id: key.id }, 'usageCount', 1);
+            await this.audit(auth_audit_event_type_enum_1.AuthAuditEventType.API_KEY_USED, key.userId, 'SUCCESS', { keyId: key.keyId });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'Unknown error';
+            this.logger?.debug?.(`[ApiKey] Failed to record usage for key ${key.keyId}: ${message}`);
+        }
+    }
+    /**
+     * Build a sanitized response DTO from an entity.
+     */
+    toResponse(key) {
+        return {
+            keyId: key.keyId,
+            name: key.name ?? null,
+            lastFour: key.lastFour ?? null,
+            allowedIps: key.allowedIps ?? null,
+            expiresAt: key.expiresAt ?? null,
+            isActive: key.isActive,
+            createdByAdmin: key.createdByAdmin,
+            lastUsedAt: key.lastUsedAt ?? null,
+            lastUsedIp: key.lastUsedIp ?? null,
+            usageCount: key.usageCount ?? 0,
+            createdAt: key.createdAt,
+        };
+    }
+    /**
+     * Record an audit event (no-op when audit logging is disabled). Never throws.
+     */
+    async audit(eventType, userId, eventStatus, metadata) {
+        if (!this.auditService) {
+            return;
+        }
+        try {
+            await this.auditService.recordEvent({
+                userId: userId ?? undefined,
+                eventType,
+                eventStatus,
+                authMethod: 'api-key',
+                metadata,
+            });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'Unknown error';
+            this.logger?.debug?.(`[ApiKey] Failed to record audit event ${eventType}: ${message}`);
+        }
+    }
+}
+exports.ApiKeyService = ApiKeyService;
+//# sourceMappingURL=api-key.service.js.map

package/dist/services/api-key.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.service.js","sourceRoot":"","sources":["../../src/services/api-key.service.ts"],"names":[],"mappings":";;;AACA,mCAA6D;AAM7D,mEAA+D;AAC/D,gEAA0D;AAC1D,oFAAyE;AACzE,8DAA0D;AAC1D,0DAA4D;AAC5D,gDAAoE;AAEpE,oDAU4B;AAC5B,gEAA4G;AAU5G;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAa,aAAa;IAEL;IACA;IACA;IACA;IACA;IALnB,YACmB,gBAAwC,EACxC,cAAoC,EACpC,MAAmB,EACnB,MAAmB,EACnB,YAAuC;QAJvC,qBAAgB,GAAhB,gBAAgB,CAAwB;QACxC,mBAAc,GAAd,cAAc,CAAsB;QACpC,WAAM,GAAN,MAAM,CAAa;QACnB,WAAM,GAAN,MAAM,CAAa;QACnB,iBAAY,GAAZ,YAAY,CAA2B;QAExD,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,2BAA2B,CAAC,CAAC;IAClD,CAAC;IAED,6EAA6E;IAC7E,wDAAwD;IACxD,6EAA6E;IAE7E;;;;;;OAMG;IACH,KAAK,CAAC,SAAS,CAAC,GAAoB;QAClC,GAAG,GAAG,MAAM,IAAA,kCAAkB,EAAC,6BAAe,EAAE,GAAG,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ;QACZ,MAAM,IAAI,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,GAAoB;QAClC,GAAG,GAAG,MAAM,IAAA,kCAAkB,EAAC,6BAAe,EAAE,GAAG,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,GAAoB;QAClC,GAAG,GAAG,MAAM,IAAA,kCAAkB,EAAC,6BAAe,EAAE,GAAG,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAChE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,GAAoB;QAClC,GAAG,GAAG,MAAM,IAAA,kCAAkB,EAAC,6BAAe,EAAE,GAAG,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAE7E;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,GAAyB;QAC5C,GAAG,GAAG,MAAM,IAAA,kCAAkB,EAAC,wCAAoB,EAAE,GAAG,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAAC,GAAyB;QAC3C,GAAG,GAAG,MAAM,IAAA,kCAAkB,EAAC,wCAAoB,EAAE,GAAG,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,GAAyB;QAC5C,GAAG,GAAG,MAAM,IAAA,kCAAkB,EAAC,wCAAoB,EAAE,GAAG,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IACzE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,GAAyB;QAC5C,GAAG,GAAG,MAAM,IAAA,kCAAkB,EAAC,wCAAoB,EAAE,GAAG,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;IAC5D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,GAAyB;QAC5C,GAAG,GAAG,MAAM,IAAA,kCAAkB,EAAC,wCAAoB,EAAE,GAAG,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,6EAA6E;IAC7E,kEAAkE;IAClE,6EAA6E;IAE7E;;;;;;;;;OASG;IACH,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,QAAwB;QACxD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,CAAC,KAAK,CAAC,+CAAkB,CAAC,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YACnG,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QAC7E,CAAC;QAED,oFAAoF;QACpF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9F,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,KAAK,CAAC,+CAAkB,CAAC,mBAAmB,EAAE,GAAG,EAAE,MAAM,IAAI,IAAI,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAChH,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QAC7E,CAAC;QAED,IAAI,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,KAAK,CAAC,+CAAkB,CAAC,mBAAmB,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE;gBAC9E,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,MAAM,EAAE,SAAS;aAClB,CAAC,CAAC;YACH,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;QACjF,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,EAAE,yBAAc,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,CAAC,KAAK,CAAC,+CAAkB,CAAC,mBAAmB,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE;gBACjF,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;YACH,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,sBAAsB,EAAE,4CAA4C,CAAC,CAAC;QAC/G,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;YAC9C,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE;YACzB,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;SAChD,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,KAAK,CAAC,+CAAkB,CAAC,mBAAmB,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE;gBAC9E,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;YACH,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC;QAE9C,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IAC9C,CAAC;IAED,6EAA6E;IAC7E,iDAAiD;IACjD,6EAA6E;IAE7E;;OAEG;IACK,KAAK,CAAC,aAAa,CACzB,MAAc,EACd,MAA+E,EAC/E,cAAuB;QAEvB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QAEtC,qFAAqF;QACrF,IAAI,CAAC,cAAc,IAAI,GAAG,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YACtD,MAAM,IAAI,gCAAc,CACtB,gCAAa,CAAC,yBAAyB,EACvC,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC7F,IAAI,WAAW,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,qBAAqB,EAAE,cAAc,OAAO,2BAA2B,EAAE;gBAC9G,cAAc,EAAE,OAAO;aACxB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAE/D,4FAA4F;QAC5F,MAAM,KAAK,GAAG,IAAA,mBAAU,GAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAErC,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;YAC1C,KAAK;YACL,MAAM;YACN,OAAO;YACP,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI;YACzB,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1B,UAAU,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;YACrD,SAAS;YACT,QAAQ,EAAE,IAAI;YACd,cAAc;YACd,UAAU,EAAE,CAAC;SACd,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEvD,MAAM,IAAI,CAAC,KAAK,CAAC,+CAAkB,CAAC,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE;YACtE,KAAK;YACL,cAAc;YACd,SAAS,EAAE,SAAS,KAAK,IAAI;YAC7B,YAAY,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC;SACpC,CAAC,CAAC;QAEH,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;IACzD,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,WAAW,CAAC,MAAc;QACtC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACnG,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,aAAa,CACzB,MAAc,EACd,KAAa,EACb,IAAwB,EACxB,UAAgC;QAEhC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QACjF,CAAC;QAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,GAAG,CAAC,IAAI,GAAG,IAAI,IAAI,IAAI,CAAC;QAC1B,CAAC;QACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;YACxD,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7D,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,KAAK,CAAC,+CAAkB,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,KAAa,EAAE,MAAc;QACvE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjB,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC;YACrB,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;YAC3B,GAAG,CAAC,YAAY,GAAG,MAAM,CAAC;YAC1B,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,+CAAkB,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAChF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,KAAa;QACvD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,KAAK,CAAC,+CAAkB,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAChF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,6EAA6E;IAC7E,UAAU;IACV,6EAA6E;IAE7E;;;;OAIG;IACK,qBAAqB;QAC3B,MAAM,WAAW,GAAG,gCAAc,CAAC,GAAG,CAAQ,cAAc,CAAC,CAAC;QAC9D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,kBAAkB,CAAC,GAAW;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,KAAyB;QAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,iBAAiB,EAAE,sCAAsC,CAAC,CAAC;QACpG,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,aAAwC;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QAEtC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,gCAAc,CACtB,gCAAa,CAAC,uBAAuB,EACrC,6FAA6F,CAC9F,CAAC;QACJ,CAAC;QAED,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,eAAe,KAAK,KAAK,EAAE,CAAC;gBAClC,MAAM,IAAI,gCAAc,CACtB,gCAAa,CAAC,8BAA8B,EAC5C,mEAAmE,CACpE,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,iBAAiB,EAAE,mDAAmD,CAAC,CAAC;QACjH,CAAC;QAED,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,IAAI,aAAa,GAAG,GAAG,CAAC,aAAa,EAAE,CAAC;YAC/E,MAAM,IAAI,gCAAc,CACtB,gCAAa,CAAC,uBAAuB,EACrC,iCAAiC,GAAG,CAAC,aAAa,QAAQ,EAC1D,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CACrC,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,CAAC;QACvD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,UAAgC;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;QAEvC,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC5B,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,kEAAkE,CAAC,CAAC;YAC3F,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,UAAU,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEvF,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,gCAAc,CACtB,gCAAa,CAAC,iBAAiB,EAC/B,0FAA0F,CAC3F,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC;QACxC,IAAI,UAAU,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;YAC/B,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,iBAAiB,EAAE,+BAA+B,MAAM,cAAc,EAAE;gBAC7G,YAAY,EAAE,MAAM;aACrB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,0BAAe,EAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,iBAAiB,EAAE,iDAAiD,EAAE;gBAC3G,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;OAEG;IACK,OAAO,CAAC,MAAc;QAC5B,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,WAAW,CAAC,GAAe,EAAE,QAAuB;QAChE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAE3D,IAAI,IAAI,KAAK,CAAC,IAAI,GAAG,GAAG,IAAI,GAAG,UAAU,EAAE,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAqD;gBAC/D,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC;aAC1B,CAAC;YACF,IAAI,GAAG,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;gBAC/B,MAAM,CAAC,UAAU,GAAG,QAAQ,CAAC;YAC/B,CAAC;YACD,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YAC3D,sFAAsF;YACtF,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;YAEvE,MAAM,IAAI,CAAC,KAAK,CAAC,+CAAkB,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QACjG,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACzE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,2CAA2C,GAAG,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,GAAe;QAChC,OAAO;YACL,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI;YACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;YAC9B,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;YAClC,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;YAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;YAClC,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;YAClC,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;YAC/B,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,KAAK,CACjB,SAA6B,EAC7B,MAAqB,EACrB,WAA0D,EAC1D,QAAkC;QAElC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC;gBAClC,MAAM,EAAE,MAAM,IAAI,SAAS;gBAC3B,SAAS;gBACT,WAAW;gBACX,UAAU,EAAE,SAAS;gBACrB,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACzE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,yCAAyC,SAAS,KAAK,OAAO,EAAE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;CACF;AA3gBD,sCA2gBC"}

package/dist/utils/index.d.ts

@@ -3,6 +3,7 @@
  */
 export * from './pii-redactor';
 export * from './ip-extractor';
+export * from './ip-match';
 export * from './nauth-logger';
 export * from './cookies.util';
 export * from './cookie-names.util';

package/dist/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC"}

package/dist/utils/index.js

@@ -19,6 +19,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./pii-redactor"), exports);
 __exportStar(require("./ip-extractor"), exports);
+__exportStar(require("./ip-match"), exports);
 __exportStar(require("./nauth-logger"), exports);
 __exportStar(require("./cookies.util"), exports);
 __exportStar(require("./cookie-names.util"), exports);

package/dist/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;AAEH,iDAA+B;AAC/B,iDAA+B;AAC/B,iDAA+B;AAC/B,iDAA+B;AAC/B,sDAAoC;AACpC,oDAAkC;AAClC,0DAAwC;AACxC,uDAAqC;AACrC,kDAAgC;AAChC,wFAAwF"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;AAEH,iDAA+B;AAC/B,iDAA+B;AAC/B,6CAA2B;AAC3B,iDAA+B;AAC/B,iDAA+B;AAC/B,sDAAoC;AACpC,oDAAkC;AAClC,0DAAwC;AACxC,uDAAqC;AACrC,kDAAgC;AAChC,wFAAwF"}

package/dist/utils/ip-match.d.ts

@@ -0,0 +1,44 @@
+/**
+ * IP Allowlist Matching
+ *
+ * Utilities for matching a source IP against an allowlist entry that may be an
+ * exact IPv4/IPv6 address or an IPv4 CIDR range. Used to enforce per-API-key IP
+ * restrictions.
+ *
+ * @remarks
+ * IPv4 CIDR ranges (e.g. `10.0.0.0/8`) and exact IPv4/IPv6 addresses are supported.
+ * IPv6 CIDR ranges are not expanded; provide exact IPv6 addresses instead.
+ */
+/**
+ * Validate whether a string is a valid IP address or IPv4 CIDR range.
+ *
+ * @param entry - Candidate allowlist entry
+ * @returns true if the entry is a usable IP or IPv4 CIDR
+ *
+ * @example
+ * ```typescript
+ * isValidIpOrCidr('203.0.113.4');   // true
+ * isValidIpOrCidr('10.0.0.0/8');    // true
+ * isValidIpOrCidr('not-an-ip');     // false
+ * ```
+ */
+export declare function isValidIpOrCidr(entry: string): boolean;
+/**
+ * Determine whether a source IP matches a single allowlist entry.
+ *
+ * Supports:
+ * - Exact IPv4/IPv6 match (case-insensitive for IPv6)
+ * - IPv4 CIDR range match (e.g. `10.0.0.0/8`)
+ *
+ * @param ip - Source IP of the request
+ * @param entry - Allowlist entry (IP or IPv4 CIDR)
+ * @returns true if the IP is covered by the entry
+ *
+ * @example
+ * ```typescript
+ * ipMatchesEntry('10.1.2.3', '10.0.0.0/8'); // true
+ * ipMatchesEntry('203.0.113.4', '203.0.113.4'); // true
+ * ```
+ */
+export declare function ipMatchesEntry(ip: string, entry: string): boolean;
+//# sourceMappingURL=ip-match.d.ts.map

package/dist/utils/ip-match.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip-match.d.ts","sourceRoot":"","sources":["../../src/utils/ip-match.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAuCH;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAetD;AAkBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAwBjE"}