@prosopo/api-express-router 3.1.98 → 3.2.0

package/.turbo/turbo-build$colon$cjs.log

@@ -1,5 +1,5 @@
 
-> @prosopo/api-express-router@3.1.98 build:cjs
+> @prosopo/api-express-router@3.2.0 build:cjs
 > NODE_ENV=${NODE_ENV:-development}; vite build --config vite.cjs.config.ts --mode $NODE_ENV
 
 ViteCommonJSConfig: .
@@ -26,7 +26,6 @@ ViteCommonJSConfig: .
 {
   externals: [
     '@prosopo/api-route',
-The plugin "vite-tsconfig-paths" is detected. Vite now supports tsconfig paths resolution natively via the resolve.tsconfigPaths option. You can remove the plugin and set resolve.tsconfigPaths: true in your Vite config instead.
     '@prosopo/logger',
     '@prosopo/util',
     '@prosopo/common',
@@ -44,17 +43,19 @@ ViteCommonJSConfig: .
     '@prosopo/keyring'
   ]
 }
+The plugin "vite-tsconfig-paths" is detected. Vite now supports tsconfig paths resolution natively via the resolve.tsconfigPaths option. You can remove the plugin and set resolve.tsconfigPaths: true in your Vite config instead.
 vite v8.1.5 building ssr environment for production...
 Bundle build started
 
-✓ 7 modules transformed.
+✓ 8 modules transformed.
 rendering chunks...
 computing gzip size...
 dist/cjs/errorHandler.cjs                                      0.45 kB │ gzip: 0.25 kB
 dist/cjs/apiExpressRouterFactory.cjs                           0.78 kB │ gzip: 0.35 kB
-dist/cjs/index.cjs                                             1.25 kB │ gzip: 0.37 kB
+dist/cjs/middlewares/jwtReplayGuard.cjs                        0.97 kB │ gzip: 0.53 kB
+dist/cjs/index.cjs                                             1.42 kB │ gzip: 0.41 kB
 dist/cjs/endpointAdapter/apiExpressDefaultEndpointAdapter.cjs  1.49 kB │ gzip: 0.62 kB
-dist/cjs/middlewares/authMiddleware.cjs                        1.71 kB │ gzip: 0.74 kB
 dist/cjs/middlewares/requestLoggerMiddleware.cjs               1.81 kB │ gzip: 0.78 kB
+dist/cjs/middlewares/authMiddleware.cjs                        2.47 kB │ gzip: 1.01 kB
 
-✓ built in 40ms
+✓ built in 54ms

package/.turbo/turbo-build$colon$tsc.log

@@ -1,8 +1,8 @@
 
-> @prosopo/api-express-router@3.1.98 build:tsc
+> @prosopo/api-express-router@3.2.0 build:tsc
 > tsc --build --verbose
 
-8:26:05 PM - Projects in this build: 
+12:39:13 PM - Projects in this build: 
     * ../../dev/config/tsconfig.json
     * ../util/tsconfig.json
     * ../logger/tsconfig.json
@@ -22,41 +22,41 @@
     * ../env/tsconfig.json
     * tsconfig.json
 
-8:26:05 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
+12:39:13 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
 
-8:26:05 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
+12:39:13 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
 
-8:26:05 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/index.ts' is older than output '../logger/tsconfig.tsbuildinfo'
+12:39:14 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/index.ts' is older than output '../logger/tsconfig.tsbuildinfo'
 
-8:26:05 PM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/apiRoutes.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
+12:39:14 PM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/apiRoutes.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
 
-8:26:05 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
+12:39:14 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
 
-8:26:05 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
+12:39:14 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
 
-8:26:05 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/index.ts' is older than output '../types/tsconfig.tsbuildinfo'
+12:39:14 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
 
-8:26:05 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/index.ts' is older than output '../common/tsconfig.tsbuildinfo'
+12:39:14 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/error.ts' is older than output '../common/tsconfig.tsbuildinfo'
 
-8:26:05 PM - Project '../ipinfo/tsconfig.json' is up to date because newest input '../ipinfo/src/IpInfoService.ts' is older than output '../ipinfo/tsconfig.tsbuildinfo'
+12:39:14 PM - Project '../ipinfo/tsconfig.json' is up to date because newest input '../ipinfo/src/index.ts' is older than output '../ipinfo/tsconfig.tsbuildinfo'
 
-8:26:05 PM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/index.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
+12:39:14 PM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/index.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
 
-8:26:05 PM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/index.ts' is older than output '../api/tsconfig.tsbuildinfo'
+12:39:14 PM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/index.ts' is older than output '../api/tsconfig.tsbuildinfo'
 
-8:26:05 PM - Project '../user-access-policy/tsconfig.json' is up to date because newest input '../user-access-policy/src/ruleRecord.ts' is older than output '../user-access-policy/tsconfig.tsbuildinfo'
+12:39:14 PM - Project '../user-access-policy/tsconfig.json' is up to date because newest input '../user-access-policy/src/transformRule.ts' is older than output '../user-access-policy/tsconfig.tsbuildinfo'
 
-8:26:05 PM - Project '../types-database/tsconfig.json' is up to date because newest input '../types-database/src/index.ts' is older than output '../types-database/tsconfig.tsbuildinfo'
+12:39:14 PM - Project '../types-database/tsconfig.json' is up to date because newest input '../types-database/src/index.ts' is older than output '../types-database/tsconfig.tsbuildinfo'
 
-8:26:05 PM - Project '../database/tsconfig.json' is up to date because newest input '../database/src/tests/mongoGlobalSetup.ts' is older than output '../database/tsconfig.tsbuildinfo'
+12:39:14 PM - Project '../database/tsconfig.json' is up to date because newest input '../database/src/tests/unit/captchaLabel.unit.test.ts' is older than output '../database/tsconfig.tsbuildinfo'
 
-8:26:05 PM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/keyring/keyring.test.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
+12:39:14 PM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/pair/decode.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
 
-8:26:05 PM - Project '../types-env/tsconfig.json' is up to date because newest input '../types-env/src/env.ts' is older than output '../types-env/tsconfig.tsbuildinfo'
+12:39:14 PM - Project '../types-env/tsconfig.json' is up to date because newest input '../types-env/src/index.ts' is older than output '../types-env/tsconfig.tsbuildinfo'
 
-8:26:05 PM - Project '../env/tsconfig.json' is up to date because newest input '../env/src/env.ts' is older than output '../env/tsconfig.tsbuildinfo'
+12:39:14 PM - Project '../env/tsconfig.json' is up to date because newest input '../env/src/env.ts' is older than output '../env/tsconfig.tsbuildinfo'
 
-8:26:05 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
+12:39:14 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
 
-8:26:05 PM - Building project '/home/runner/work/captcha/captcha/packages/api-express-router/tsconfig.json'...
+12:39:14 PM - Building project '/home/runner/work/captcha/captcha/packages/api-express-router/tsconfig.json'...
 

package/.turbo/turbo-build.log

@@ -1,9 +1,9 @@
 
-> @prosopo/api-express-router@3.1.98 build
+> @prosopo/api-express-router@3.2.0 build
 > npm run build:cross-env -- --mode ${NODE_ENV:-development}
 
 
-> @prosopo/api-express-router@3.1.98 build:cross-env
+> @prosopo/api-express-router@3.2.0 build:cross-env
 > vite build --config vite.esm.config.ts --mode production
 
 ViteEsmConfig: .
@@ -51,15 +51,16 @@ ViteEsmConfig: .
 vite v8.1.5 building ssr environment for production...
 Bundle build started
 
-✓ 7 modules transformed.
+✓ 8 modules transformed.
 rendering chunks...
 computing gzip size...
 dist/_virtual/_rolldown/runtime.js                        0.04 kB │ gzip: 0.06 kB
 dist/errorHandler.js                                      0.42 kB │ gzip: 0.24 kB
 dist/apiExpressRouterFactory.js                           0.71 kB │ gzip: 0.34 kB
-dist/index.js                                             0.84 kB │ gzip: 0.31 kB
+dist/index.js                                             0.94 kB │ gzip: 0.34 kB
+dist/middlewares/jwtReplayGuard.js                        0.95 kB │ gzip: 0.53 kB
 dist/endpointAdapter/apiExpressDefaultEndpointAdapter.js  1.30 kB │ gzip: 0.59 kB
-dist/middlewares/authMiddleware.js                        1.60 kB │ gzip: 0.72 kB
 dist/middlewares/requestLoggerMiddleware.js               1.75 kB │ gzip: 0.76 kB
+dist/middlewares/authMiddleware.js                        2.34 kB │ gzip: 0.98 kB
 
-✓ built in 35ms
+✓ built in 49ms

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # @prosopo/api-express-router
 
+## 3.2.0
+### Minor Changes
+
+- ede4352: Admin tokens can now be bound to one provider and used only once. `jwtVerify` takes optional checks for the `aud` claim and for the longest allowed lifetime, and the provider's admin check uses them. A token that names an audience must name this provider: its host, `https://` plus its host, or one of the values in `PROSOPO_ADMIN_JWT_AUDIENCE`. A token that carries a `jti` is accepted once per provider process. Tokens may live at most one hour (`PROSOPO_ADMIN_JWT_MAX_LIFETIME_SECONDS`).
+  
+  Migration: tokens without `aud` or `jti` are still accepted, so current callers keep working. Callers should add both, for example `pair.jwtIssue({ expiresIn }, { aud: provider.url, jti: randomUUID() })`, minting one token per provider and per request. Callers that reuse one token for several requests to the same provider must mint a new one per request before they add `jti`. Once every caller sends `aud`, set `PROSOPO_ADMIN_JWT_REQUIRE_AUDIENCE=true` to refuse tokens without it.
+
+### Patch Changes
+
+- 9ed0afd: 401 responses no longer include server internals. The admin auth check returned the whole error object, which included the request's i18n instance with its settings and file paths (about 16 KB per response), or whatever a failing check had thrown. It now returns `{ error: { code: 401, key, message } }`, the same shape as other API errors. The domain check returned unexpected errors, such as database errors, in the response body. It now returns a fixed message and logs the error.
+- Updated dependencies [ede4352]
+- Updated dependencies [de6bb08]
+- Updated dependencies [2145922]
+- Updated dependencies [b017dfb]
+- Updated dependencies [8ed0eb8]
+- Updated dependencies [06784d0]
+- Updated dependencies [06784d0]
+- Updated dependencies [8d7ba8c]
+- Updated dependencies [995e954]
+- Updated dependencies [97a799e]
+- Updated dependencies [9fc1e8a]
+- Updated dependencies [4461043]
+- Updated dependencies [92edebd]
+- Updated dependencies [54a07f3]
+- Updated dependencies [b75e9b7]
+- Updated dependencies [6d5b7f5]
+  - @prosopo/util-crypto@13.6.0
+  - @prosopo/types@5.12.0
+  - @prosopo/util@3.3.13
+  - @prosopo/locale@3.6.2
+  - @prosopo/common@3.1.61
+  - @prosopo/env@3.6.68
+  - @prosopo/logger@2.1.2
+  - @prosopo/api-route@2.6.62
+
 ## 3.1.98
 ### Patch Changes
 

package/dist/cjs/index.cjs

@@ -3,6 +3,7 @@ const require_errorHandler = require("./errorHandler.cjs");
 const require_apiExpressRouterFactory = require("./apiExpressRouterFactory.cjs");
 const require_apiExpressDefaultEndpointAdapter = require("./endpointAdapter/apiExpressDefaultEndpointAdapter.cjs");
 const require_authMiddleware = require("./middlewares/authMiddleware.cjs");
+const require_jwtReplayGuard = require("./middlewares/jwtReplayGuard.cjs");
 const require_requestLoggerMiddleware = require("./middlewares/requestLoggerMiddleware.cjs");
 //#region src/index.ts
 var apiExpressRouterFactory = new require_apiExpressRouterFactory.ApiExpressRouterFactory();
@@ -13,6 +14,7 @@ var createApiExpressDefaultEndpointAdapter = (logLevel, errorStatusCode = 500) =
 exports.apiExpressRouterFactory = apiExpressRouterFactory;
 exports.authMiddleware = require_authMiddleware.authMiddleware;
 exports.createApiExpressDefaultEndpointAdapter = createApiExpressDefaultEndpointAdapter;
+exports.createMemoryJwtReplayGuard = require_jwtReplayGuard.createMemoryJwtReplayGuard;
 exports.handleErrors = require_errorHandler.handleErrors;
 exports.requestLoggerMiddleware = require_requestLoggerMiddleware.requestLoggerMiddleware;
 exports.verifySignature = require_authMiddleware.verifySignature;

package/dist/cjs/middlewares/authMiddleware.cjs

@@ -1,36 +1,47 @@
 let _prosopo_common = require("@prosopo/common");
 let _polkadot_util = require("@polkadot/util");
+let _prosopo_locale = require("@prosopo/locale");
 //#region src/middlewares/authMiddleware.ts
-var authMiddleware = (pair, authAccount) => {
+var verifyWith = (key, jwt, options) => {
+	if (!key) return void 0;
+	const result = key.jwtVerify(jwt, options.verify);
+	return result.isValid ? result : void 0;
+};
+var isReplay = (result, options) => {
+	const payload = result.payload;
+	if (!options.replayGuard || !payload || typeof payload.jti !== "string") return false;
+	return !options.replayGuard.claim(`${payload.sub}:${payload.jti}`, payload.exp);
+};
+var authMiddleware = (pair, authAccount, options = {}) => {
 	return async (req, res, next) => {
 		try {
 			const jwt = extractJWT(req);
-			if (authAccount?.jwtVerify(jwt).isValid) {
+			const verified = verifyWith(authAccount, jwt, options) ?? verifyWith(pair, jwt, options);
+			if (verified && !isReplay(verified, options)) {
 				next();
 				return;
 			}
-			if (pair?.jwtVerify(jwt).isValid) {
-				next();
-				return;
-			}
-			res.status(401).json({ error: new _prosopo_common.ProsopoEnvError("API.UNAUTHORIZED", { context: {
-				i18n: req.i18n,
-				code: 401
-			} }) });
+			unauthorized(req, res, "API.UNAUTHORIZED");
 			return;
 		} catch (err) {
 			req.logger.error(() => ({
 				err,
 				msg: "Auth Middleware Error"
 			}));
-			res.status(401).json({
-				error: "Unauthorized",
-				message: err
-			});
+			unauthorized(req, res, translationKeyOf(err));
 			return;
 		}
 	};
 };
+var translationKeyOf = (err) => err instanceof _prosopo_common.ProsopoBaseError && err.translationKey !== void 0 && (0, _prosopo_locale.isTranslationKey)(err.translationKey) ? err.translationKey : "API.UNAUTHORIZED";
+var unauthorized = (req, res, key) => {
+	const body = { error: {
+		code: 401,
+		key,
+		message: req.i18n ? req.i18n.t(key) : key
+	} };
+	res.status(401).json(body);
+};
 var extractJWT = (req) => {
 	const authHeader = req.headers.Authorization || req.headers.authorization;
 	if (!authHeader || typeof authHeader !== "string") throw new _prosopo_common.ProsopoApiError("GENERAL.MISSING_AUTH_HEADER", { context: {

package/dist/cjs/middlewares/jwtReplayGuard.cjs

@@ -0,0 +1,28 @@
+//#region src/middlewares/jwtReplayGuard.ts
+/**
+* Per-process set of token ids seen until their expiry. Only tokens signed by
+* an admin key reach it, so the size cap guards against a misbehaving issuer
+* rather than an attacker; when full the oldest entry is dropped.
+*/
+var createMemoryJwtReplayGuard = (maxEntries = 1e4, nowSeconds = () => Date.now() / 1e3) => {
+	const seen = /* @__PURE__ */ new Map();
+	const sweep = (now) => {
+		for (const [id, exp] of seen) if (exp < now) seen.delete(id);
+	};
+	return { claim(id, expiresAtSeconds) {
+		const now = nowSeconds();
+		const previous = seen.get(id);
+		if (previous !== void 0 && previous >= now) return false;
+		if (seen.size >= maxEntries) {
+			sweep(now);
+			if (seen.size >= maxEntries) {
+				const oldest = seen.keys().next();
+				if (!oldest.done) seen.delete(oldest.value);
+			}
+		}
+		seen.set(id, expiresAtSeconds);
+		return true;
+	} };
+};
+//#endregion
+exports.createMemoryJwtReplayGuard = createMemoryJwtReplayGuard;

package/dist/index.d.ts

@@ -6,5 +6,6 @@ declare const createApiExpressDefaultEndpointAdapter: (logLevel: LogLevel, error
 export { apiExpressRouterFactory, createApiExpressDefaultEndpointAdapter, type ApiExpressEndpointAdapter, };
 export * from "./errorHandler.js";
 export * from "./middlewares/authMiddleware.js";
+export * from "./middlewares/jwtReplayGuard.js";
 export * from "./middlewares/requestLoggerMiddleware.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gDAAgD,CAAC;AAEhG,QAAA,MAAM,uBAAuB,yBAAgC,CAAC;AAE9D,QAAA,MAAM,sCAAsC,aACjC,QAAQ,+BAEhB,yBAEF,CAAC;AAEF,OAAO,EACN,uBAAuB,EACvB,sCAAsC,EACtC,KAAK,yBAAyB,GAC9B,CAAC;AAEF,cAAc,mBAAmB,CAAC;AAClC,cAAc,iCAAiC,CAAC;AAChD,cAAc,0CAA0C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gDAAgD,CAAC;AAEhG,QAAA,MAAM,uBAAuB,yBAAgC,CAAC;AAE9D,QAAA,MAAM,sCAAsC,aACjC,QAAQ,+BAEhB,yBAEF,CAAC;AAEF,OAAO,EACN,uBAAuB,EACvB,sCAAsC,EACtC,KAAK,yBAAyB,GAC9B,CAAC;AAEF,cAAc,mBAAmB,CAAC;AAClC,cAAc,iCAAiC,CAAC;AAChD,cAAc,iCAAiC,CAAC;AAChD,cAAc,0CAA0C,CAAC"}

package/dist/index.js

@@ -3,6 +3,7 @@ import { handleErrors } from "./errorHandler.js";
 import { ApiExpressRouterFactory } from "./apiExpressRouterFactory.js";
 import { ApiExpressDefaultEndpointAdapter } from "./endpointAdapter/apiExpressDefaultEndpointAdapter.js";
 import { authMiddleware, verifySignature } from "./middlewares/authMiddleware.js";
+import { createMemoryJwtReplayGuard } from "./middlewares/jwtReplayGuard.js";
 import { requestLoggerMiddleware } from "./middlewares/requestLoggerMiddleware.js";
 //#region src/index.ts
 var apiExpressRouterFactory = new ApiExpressRouterFactory();
@@ -10,4 +11,4 @@ var createApiExpressDefaultEndpointAdapter = (logLevel, errorStatusCode = 500) =
 	return new ApiExpressDefaultEndpointAdapter(logLevel, errorStatusCode);
 };
 //#endregion
-export { apiExpressRouterFactory, authMiddleware, createApiExpressDefaultEndpointAdapter, handleErrors, requestLoggerMiddleware, verifySignature };
+export { apiExpressRouterFactory, authMiddleware, createApiExpressDefaultEndpointAdapter, createMemoryJwtReplayGuard, handleErrors, requestLoggerMiddleware, verifySignature };

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,gCAAgC,EAAE,MAAM,uDAAuD,CAAC;AAGzG,MAAM,uBAAuB,GAAG,IAAI,uBAAuB,EAAE,CAAC;AAE9D,MAAM,sCAAsC,GAAG,CAC9C,QAAkB,EAClB,eAAe,GAAG,GAAG,EACO,EAAE;IAC9B,OAAO,IAAI,gCAAgC,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;AACxE,CAAC,CAAC;AAEF,OAAO,EACN,uBAAuB,EACvB,sCAAsC,GAEtC,CAAC;AAEF,cAAc,mBAAmB,CAAC;AAClC,cAAc,iCAAiC,CAAC;AAChD,cAAc,0CAA0C,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,gCAAgC,EAAE,MAAM,uDAAuD,CAAC;AAGzG,MAAM,uBAAuB,GAAG,IAAI,uBAAuB,EAAE,CAAC;AAE9D,MAAM,sCAAsC,GAAG,CAC9C,QAAkB,EAClB,eAAe,GAAG,GAAG,EACO,EAAE;IAC9B,OAAO,IAAI,gCAAgC,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;AACxE,CAAC,CAAC;AAEF,OAAO,EACN,uBAAuB,EACvB,sCAAsC,GAEtC,CAAC;AAEF,cAAc,mBAAmB,CAAC;AAClC,cAAc,iCAAiC,CAAC;AAChD,cAAc,iCAAiC,CAAC;AAChD,cAAc,0CAA0C,CAAC"}

package/dist/middlewares/authMiddleware.d.ts

@@ -1,5 +1,11 @@
 import type { KeyringPair } from "@prosopo/types";
+import type { JWTVerifyOptions } from "@prosopo/util-crypto";
 import type { NextFunction, Request, Response } from "express";
-export declare const authMiddleware: (pair: KeyringPair | undefined, authAccount?: KeyringPair | undefined) => (req: Request, res: Response, next: NextFunction) => Promise<void>;
+import type { JwtReplayGuard } from "./jwtReplayGuard.js";
+export type AuthMiddlewareOptions = {
+    verify?: JWTVerifyOptions;
+    replayGuard?: JwtReplayGuard;
+};
+export declare const authMiddleware: (pair: KeyringPair | undefined, authAccount?: KeyringPair | undefined, options?: AuthMiddlewareOptions) => (req: Request, res: Response, next: NextFunction) => Promise<void>;
 export declare const verifySignature: (signature: string, message: string, pair: KeyringPair) => void;
 //# sourceMappingURL=authMiddleware.d.ts.map

package/dist/middlewares/authMiddleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authMiddleware.d.ts","sourceRoot":"","sources":["../../src/middlewares/authMiddleware.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAE/D,eAAO,MAAM,cAAc,SACpB,WAAW,GAAG,SAAS,gBACf,WAAW,GAAG,SAAS,WAElB,OAAO,OAAO,QAAQ,QAAQ,YAAY,kBA4B7D,CAAC;AAsBF,eAAO,MAAM,eAAe,cAChB,MAAM,WACR,MAAM,QACT,WAAW,SAejB,CAAC"}
+{"version":3,"file":"authMiddleware.d.ts","sourceRoot":"","sources":["../../src/middlewares/authMiddleware.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAgB,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,KAAK,EAEX,gBAAgB,EAEhB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D,MAAM,MAAM,qBAAqB,GAAG;IAEnC,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAK1B,WAAW,CAAC,EAAE,cAAc,CAAC;CAC7B,CAAC;AA0BF,eAAO,MAAM,cAAc,SACpB,WAAW,GAAG,SAAS,gBACf,WAAW,GAAG,SAAS,YAC5B,qBAAqB,WAEX,OAAO,OAAO,QAAQ,QAAQ,YAAY,kBAsB7D,CAAC;AA4CF,eAAO,MAAM,eAAe,cAChB,MAAM,WACR,MAAM,QACT,WAAW,SAejB,CAAC"}

package/dist/middlewares/authMiddleware.js

@@ -1,36 +1,47 @@
-import { ProsopoApiError, ProsopoEnvError } from "@prosopo/common";
+import { ProsopoApiError, ProsopoBaseError } from "@prosopo/common";
 import { hexToU8a } from "@polkadot/util";
+import { isTranslationKey } from "@prosopo/locale";
 //#region src/middlewares/authMiddleware.ts
-var authMiddleware = (pair, authAccount) => {
+var verifyWith = (key, jwt, options) => {
+	if (!key) return void 0;
+	const result = key.jwtVerify(jwt, options.verify);
+	return result.isValid ? result : void 0;
+};
+var isReplay = (result, options) => {
+	const payload = result.payload;
+	if (!options.replayGuard || !payload || typeof payload.jti !== "string") return false;
+	return !options.replayGuard.claim(`${payload.sub}:${payload.jti}`, payload.exp);
+};
+var authMiddleware = (pair, authAccount, options = {}) => {
 	return async (req, res, next) => {
 		try {
 			const jwt = extractJWT(req);
-			if (authAccount?.jwtVerify(jwt).isValid) {
+			const verified = verifyWith(authAccount, jwt, options) ?? verifyWith(pair, jwt, options);
+			if (verified && !isReplay(verified, options)) {
 				next();
 				return;
 			}
-			if (pair?.jwtVerify(jwt).isValid) {
-				next();
-				return;
-			}
-			res.status(401).json({ error: new ProsopoEnvError("API.UNAUTHORIZED", { context: {
-				i18n: req.i18n,
-				code: 401
-			} }) });
+			unauthorized(req, res, "API.UNAUTHORIZED");
 			return;
 		} catch (err) {
 			req.logger.error(() => ({
 				err,
 				msg: "Auth Middleware Error"
 			}));
-			res.status(401).json({
-				error: "Unauthorized",
-				message: err
-			});
+			unauthorized(req, res, translationKeyOf(err));
 			return;
 		}
 	};
 };
+var translationKeyOf = (err) => err instanceof ProsopoBaseError && err.translationKey !== void 0 && isTranslationKey(err.translationKey) ? err.translationKey : "API.UNAUTHORIZED";
+var unauthorized = (req, res, key) => {
+	const body = { error: {
+		code: 401,
+		key,
+		message: req.i18n ? req.i18n.t(key) : key
+	} };
+	res.status(401).json(body);
+};
 var extractJWT = (req) => {
 	const authHeader = req.headers.Authorization || req.headers.authorization;
 	if (!authHeader || typeof authHeader !== "string") throw new ProsopoApiError("GENERAL.MISSING_AUTH_HEADER", { context: {

package/dist/middlewares/authMiddleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"authMiddleware.js","sourceRoot":"","sources":["../../src/middlewares/authMiddleware.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAKnE,MAAM,CAAC,MAAM,cAAc,GAAG,CAC7B,IAA6B,EAC7B,WAAqC,EACpC,EAAE;IACH,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAChE,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;YAE5B,IAAI,KAAkC,CAAC;YAEvC,IAAI,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;gBACzC,IAAI,EAAE,CAAC;gBACP,OAAO;YACR,CAAC;YAED,IAAI,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;gBAClC,IAAI,EAAE,CAAC;gBACP,OAAO;YACR,CAAC;YAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,IAAI,eAAe,CAAC,KAAK,IAAI,kBAAkB,EAAE;oBACvD,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;iBACtC,CAAC;aACF,CAAC,CAAC;YACH,OAAO;QACR,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC;YAChE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9D,OAAO;QACR,CAAC;IACF,CAAC,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,GAAY,EAAE,EAAE;IACnC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAE1E,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnD,MAAM,IAAI,eAAe,CAAC,6BAA6B,EAAE;YACxD,OAAO,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,GAAG,EAAE;SAC7D,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAE9C,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE;YAChD,OAAO,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE;SAC5C,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,GAAU,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAC9B,SAAiB,EACjB,OAAe,EACf,IAAiB,EAChB,EAAE;IACH,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IAElC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,eAAe,CAAC,2BAA2B,EAAE;YACtD,OAAO,EAAE;gBACR,KAAK,EAAE,+BAA+B;gBACtC,IAAI,EAAE,GAAG;gBACT,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO;gBACP,SAAS;aACT;SACD,CAAC,CAAC;IACJ,CAAC;AACF,CAAC,CAAC"}
+{"version":3,"file":"authMiddleware.js","sourceRoot":"","sources":["../../src/middlewares/authMiddleware.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAAuB,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAoBxE,MAAM,UAAU,GAAG,CAClB,GAA4B,EAC5B,GAAQ,EACR,OAA8B,EACA,EAAE;IAChC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC,CAAC;AAEF,MAAM,QAAQ,GAAG,CAChB,MAAuB,EACvB,OAA8B,EACpB,EAAE;IACZ,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACzE,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAChC,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAC/B,OAAO,CAAC,GAAG,CACX,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAC7B,IAA6B,EAC7B,WAAqC,EACrC,UAAiC,EAAE,EAClC,EAAE;IACH,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAChE,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;YAE5B,MAAM,QAAQ,GACb,UAAU,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YAEzE,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC9C,IAAI,EAAE,CAAC;gBACP,OAAO;YACR,CAAC;YAED,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAC3C,OAAO;QACR,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC;YAGhE,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9C,OAAO;QACR,CAAC;IACF,CAAC,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,GAAY,EAAkB,EAAE,CACzD,GAAG,YAAY,gBAAgB;IAC/B,GAAG,CAAC,cAAc,KAAK,SAAS;IAChC,gBAAgB,CAAC,GAAG,CAAC,cAAc,CAAC;IACnC,CAAC,CAAC,GAAG,CAAC,cAAc;IACpB,CAAC,CAAC,kBAAkB,CAAC;AAEvB,MAAM,YAAY,GAAG,CACpB,GAAY,EACZ,GAAa,EACb,GAAmB,EACZ,EAAE;IACT,MAAM,IAAI,GAA4B;QACrC,KAAK,EAAE;YACN,IAAI,EAAE,GAAG;YACT,GAAG;YACH,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG;SACzC;KACD,CAAC;IACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,GAAY,EAAE,EAAE;IACnC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAE1E,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnD,MAAM,IAAI,eAAe,CAAC,6BAA6B,EAAE;YACxD,OAAO,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,GAAG,EAAE;SAC7D,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAE9C,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE;YAChD,OAAO,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE;SAC5C,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,GAAU,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAC9B,SAAiB,EACjB,OAAe,EACf,IAAiB,EAChB,EAAE;IACH,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IAElC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,eAAe,CAAC,2BAA2B,EAAE;YACtD,OAAO,EAAE;gBACR,KAAK,EAAE,+BAA+B;gBACtC,IAAI,EAAE,GAAG;gBACT,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO;gBACP,SAAS;aACT;SACD,CAAC,CAAC;IACJ,CAAC;AACF,CAAC,CAAC"}

package/dist/middlewares/jwtReplayGuard.d.ts

@@ -0,0 +1,5 @@
+export interface JwtReplayGuard {
+    claim(id: string, expiresAtSeconds: number): boolean;
+}
+export declare const createMemoryJwtReplayGuard: (maxEntries?: number, nowSeconds?: () => number) => JwtReplayGuard;
+//# sourceMappingURL=jwtReplayGuard.d.ts.map

package/dist/middlewares/jwtReplayGuard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwtReplayGuard.d.ts","sourceRoot":"","sources":["../../src/middlewares/jwtReplayGuard.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,cAAc;IAK9B,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC;CACrD;AAOD,eAAO,MAAM,0BAA0B,qCAE1B,MAAM,MAAM,KACtB,cAyBF,CAAC"}

package/dist/middlewares/jwtReplayGuard.js

@@ -0,0 +1,28 @@
+//#region src/middlewares/jwtReplayGuard.ts
+/**
+* Per-process set of token ids seen until their expiry. Only tokens signed by
+* an admin key reach it, so the size cap guards against a misbehaving issuer
+* rather than an attacker; when full the oldest entry is dropped.
+*/
+var createMemoryJwtReplayGuard = (maxEntries = 1e4, nowSeconds = () => Date.now() / 1e3) => {
+	const seen = /* @__PURE__ */ new Map();
+	const sweep = (now) => {
+		for (const [id, exp] of seen) if (exp < now) seen.delete(id);
+	};
+	return { claim(id, expiresAtSeconds) {
+		const now = nowSeconds();
+		const previous = seen.get(id);
+		if (previous !== void 0 && previous >= now) return false;
+		if (seen.size >= maxEntries) {
+			sweep(now);
+			if (seen.size >= maxEntries) {
+				const oldest = seen.keys().next();
+				if (!oldest.done) seen.delete(oldest.value);
+			}
+		}
+		seen.set(id, expiresAtSeconds);
+		return true;
+	} };
+};
+//#endregion
+export { createMemoryJwtReplayGuard };

package/dist/middlewares/jwtReplayGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwtReplayGuard.js","sourceRoot":"","sources":["../../src/middlewares/jwtReplayGuard.ts"],"names":[],"mappings":"AA2BA,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACzC,UAAU,GAAG,MAAM,EACnB,aAA2B,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EACjC,EAAE;IACnB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEvC,MAAM,KAAK,GAAG,CAAC,GAAW,EAAQ,EAAE;QACnC,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;YAC9B,IAAI,GAAG,GAAG,GAAG;gBAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChC,CAAC;IACF,CAAC,CAAC;IAEF,OAAO;QACN,KAAK,CAAC,EAAU,EAAE,gBAAwB;YACzC,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,IAAI,GAAG;gBAAE,OAAO,KAAK,CAAC;YAC5D,IAAI,IAAI,CAAC,IAAI,IAAI,UAAU,EAAE,CAAC;gBAC7B,KAAK,CAAC,GAAG,CAAC,CAAC;gBACX,IAAI,IAAI,CAAC,IAAI,IAAI,UAAU,EAAE,CAAC;oBAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;oBAClC,IAAI,CAAC,MAAM,CAAC,IAAI;wBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC7C,CAAC;YACF,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;YAC/B,OAAO,IAAI,CAAC;QACb,CAAC;KACD,CAAC;AACH,CAAC,CAAC"}

package/dist/tests/apiExpressRouter.test-d.js

@@ -41,7 +41,7 @@ describe("the endpoint adapter interface", () => {
     });
 });
 describe("the middleware", () => {
-    test("authMiddleware takes an optional pair and an optional auth account", () => {
+    test("authMiddleware takes an optional pair, auth account and options", () => {
         expectTypeOf(authMiddleware).parameters.toEqualTypeOf();
     });
     test("authMiddleware returns an async express handler", () => {

package/dist/tests/apiExpressRouter.test-d.js.map

@@ -1 +1 @@
-{"version":3,"file":"apiExpressRouter.test-d.js","sourceRoot":"","sources":["../../src/tests/apiExpressRouter.test-d.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAGlE,OAAO,EAEN,uBAAuB,EACvB,cAAc,EACd,sCAAsC,EACtC,YAAY,EACZ,uBAAuB,EACvB,eAAe,GACf,MAAM,aAAa,CAAC;AAQrB,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IACnC,IAAI,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC/C,YAAY,EAAuB,CAAC,aAAa,EAO9C,CAAC;IACL,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;IACvD,IAAI,CAAC,+CAA+C,EAAE,GAAG,EAAE;QAC1D,YAAY,CACX,sCAAsC,CACtC,CAAC,UAAU,CAAC,aAAa,EAEvB,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,+CAA+C,EAAE,GAAG,EAAE;QAG1D,YAAY,CACX,sCAAsC,CACtC,CAAC,OAAO,CAAC,aAAa,EAA6B,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yDAAyD,EAAE,GAAG,EAAE;QAEpE,sCAAsC,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAE9C,sCAAsC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IACnC,IAAI,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACzE,YAAY,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAC,aAAa,EAK7D,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAChE,MAAM,OAAO,GAA8B;YAC1C,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS;SACpC,CAAC;QAEF,uBAAuB,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC/C,IAAI,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACzE,YAAY,EAA8C,CAAC,aAAa,EAOrE,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAGrE,UAAU,CAA4B;YACrC,aAAa,EAAE,KAAK,IAAmB,EAAE,CAAC,SAAS;SACnD,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC/B,IAAI,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC/E,YAAY,CAAC,cAAc,CAAC,CAAC,UAAU,CAAC,aAAa,EAElD,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,iDAAiD,EAAE,GAAG,EAAE;QAC5D,YAAY,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,aAAa,EAE/C,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,+DAA+D,EAAE,GAAG,EAAE;QAI1E,cAAc,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,+DAA+D,EAAE,GAAG,EAAE;QAC1E,YAAY,CAAC,uBAAuB,CAAC,CAAC,OAAO,CAAC,aAAa,EAExD,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,iEAAiE,EAAE,GAAG,EAAE;QAG5E,UAAU,CACT,uBAAuB,CACtB,EAAmD,CACnD,CACD,CAAC;QACF,UAAU,CAAiB,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,2EAA2E,EAAE,GAAG,EAAE;QACtF,YAAY,CAAC,eAAe,CAAC,CAAC,UAAU,CAAC,aAAa,EAEnD,CAAC;QACJ,YAAY,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,aAAa,EAAQ,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,gDAAgD,EAAE,GAAG,EAAE;QAI3D,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAiB,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IAClC,IAAI,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAG9E,YAAY,CAAC,YAAY,CAAC,CAAC,UAAU,CAAC,aAAa,EAEhD,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,8CAA8C,EAAE,GAAG,EAAE;QAEzD,UAAU,CAAiB,YAAY,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}
+{"version":3,"file":"apiExpressRouter.test-d.js","sourceRoot":"","sources":["../../src/tests/apiExpressRouter.test-d.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAGlE,OAAO,EAGN,uBAAuB,EACvB,cAAc,EACd,sCAAsC,EACtC,YAAY,EACZ,uBAAuB,EACvB,eAAe,GACf,MAAM,aAAa,CAAC;AAQrB,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IACnC,IAAI,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC/C,YAAY,EAAuB,CAAC,aAAa,EAQ9C,CAAC;IACL,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;IACvD,IAAI,CAAC,+CAA+C,EAAE,GAAG,EAAE;QAC1D,YAAY,CACX,sCAAsC,CACtC,CAAC,UAAU,CAAC,aAAa,EAEvB,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,+CAA+C,EAAE,GAAG,EAAE;QAG1D,YAAY,CACX,sCAAsC,CACtC,CAAC,OAAO,CAAC,aAAa,EAA6B,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yDAAyD,EAAE,GAAG,EAAE;QAEpE,sCAAsC,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAE9C,sCAAsC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IACnC,IAAI,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACzE,YAAY,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAC,aAAa,EAK7D,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAChE,MAAM,OAAO,GAA8B;YAC1C,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS;SACpC,CAAC;QAEF,uBAAuB,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC/C,IAAI,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACzE,YAAY,EAA8C,CAAC,aAAa,EAOrE,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAGrE,UAAU,CAA4B;YACrC,aAAa,EAAE,KAAK,IAAmB,EAAE,CAAC,SAAS;SACnD,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC/B,IAAI,CAAC,iEAAiE,EAAE,GAAG,EAAE;QAC5E,YAAY,CAAC,cAAc,CAAC,CAAC,UAAU,CAAC,aAAa,EAMlD,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,iDAAiD,EAAE,GAAG,EAAE;QAC5D,YAAY,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,aAAa,EAE/C,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,+DAA+D,EAAE,GAAG,EAAE;QAI1E,cAAc,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,+DAA+D,EAAE,GAAG,EAAE;QAC1E,YAAY,CAAC,uBAAuB,CAAC,CAAC,OAAO,CAAC,aAAa,EAExD,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,iEAAiE,EAAE,GAAG,EAAE;QAG5E,UAAU,CACT,uBAAuB,CACtB,EAAmD,CACnD,CACD,CAAC;QACF,UAAU,CAAiB,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,2EAA2E,EAAE,GAAG,EAAE;QACtF,YAAY,CAAC,eAAe,CAAC,CAAC,UAAU,CAAC,aAAa,EAEnD,CAAC;QACJ,YAAY,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,aAAa,EAAQ,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,gDAAgD,EAAE,GAAG,EAAE;QAI3D,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAiB,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IAClC,IAAI,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAG9E,YAAY,CAAC,YAAY,CAAC,CAAC,UAAU,CAAC,aAAa,EAEhD,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,8CAA8C,EAAE,GAAG,EAAE;QAEzD,UAAU,CAAiB,YAAY,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}