@schlessera/brain-ui-server 0.31.0 → 0.33.0

package/dist/middleware/auth.js

@@ -1,17 +1,44 @@
 import { Hono } from "hono";
 import { getSignedCookie, setSignedCookie, deleteCookie } from "hono/cookie";
 import { isTailscaleAllowed, clientIp } from "./tailscale.js";
+import { readJsonBody } from "./body-limit.js";
+import { requireJson } from "./origin.js";
+import { setSetting } from "../db/settings.js";
 const COOKIE_NAME = "brain_ui_session";
 const SESSION_TTL_SECONDS = 30 * 24 * 60 * 60; // 30 days
-export const LOGIN_RATE_LIMIT = 5; // attempts per window, per client IP
+const SESSIONS_EPOCH_KEY = "auth.sessionsEpoch";
+const SESSION_REVOKED_CLOSE_CODE = 1008;
+const SESSION_REVOKED_CLOSE_REASON = "Sessions invalidated";
+export const LOGIN_RATE_LIMIT = 5; // failures per window, per client IP
 const LOGIN_RATE_WINDOW_MS = 60_000; // per minute
 // A global cap in addition to the per-IP one: the per-IP key is derived from
 // X-Forwarded-For, which a client behind a trusted proxy can rotate to mint a
 // fresh bucket per request. The global cap bounds brute force across rotated
-// IPs. It stays well above a human's needs and, combined with the argon2id
-// verify cost, makes online guessing infeasible without being a lockout an
-// attacker could weaponize to deny the owner access.
-export const GLOBAL_LOGIN_RATE_LIMIT = 20; // attempts per window, all IPs combined
+// IPs. At 100 genuine failures/minute it stays well above a human's needs and
+// makes a global lockout substantially harder to weaponize, while still
+// bounding distributed online guessing. Per-IP failures remain at 5/minute.
+// Passkeys get 5 matched-but-invalid assertions/minute in an independent
+// `pk:` bucket: assertions are not guessable, but verification still consumes
+// resources. Password and passkey verification therefore each allow two
+// in-flight operations per IP and eight process-wide. Two tolerates a browser
+// retry/double-submit; eight bounds either verifier's comparable CPU cost.
+// Keeping the reservation pools separate preserves passkeys' independent
+// admission path while each pool still has a process-wide ceiling. The failure
+// map and both reservation maps cap at 1,024 source keys, comfortably above
+// the global password-failure budget while bounding forged-IP memory growth.
+export const GLOBAL_LOGIN_RATE_LIMIT = 100; // failures per window, all IPs combined
+export const PASSKEY_LOGIN_RATE_LIMIT = 5;
+const PASSWORD_VERIFY_IN_FLIGHT_PER_IP = 2;
+const PASSWORD_VERIFY_IN_FLIGHT_GLOBAL = 8;
+const PASSKEY_VERIFY_IN_FLIGHT_PER_IP = 2;
+const PASSKEY_VERIFY_IN_FLIGHT_GLOBAL = 8;
+const LOGIN_BUCKET_CAP = 1_024;
+// Client-derived password buckets always start `pw:ip:`, which cannot equal
+// the fixed `pw:global` key for any client-controlled key suffix. Keeping these
+// namespaces disjoint prevents a per-IP saturated write from clamping the
+// authoritative global failure counter to the smaller per-IP limit.
+const PASSWORD_IP_BUCKET_PREFIX = "pw:ip:";
+const PASSWORD_GLOBAL_BUCKET = "pw:global";
 export function resolveAuthMode(auth, log) {
     if (auth.mode)
         return auth.mode;
@@ -89,7 +116,7 @@ export function assertAuthConfig(mode, auth, log) {
     });
 }
 /** Middleware guarding /api/* according to the resolved mode. */
-export function authGuard(mode, auth) {
+export function authGuard(mode, auth, db) {
     switch (mode) {
         case "tailscale":
             return async (c, next) => {
@@ -111,7 +138,7 @@ export function authGuard(mode, auth) {
             };
         case "password":
             return async (c, next) => {
-                if (await hasValidSession(c, auth)) {
+                if (await hasValidSession(c, auth, db)) {
                     await next();
                 }
                 else {
@@ -131,7 +158,7 @@ export function authGuard(mode, auth) {
  * middleware may sit on the WS route (immutable-header errors). Mirrors
  * {@link authGuard} without emitting a response.
  */
-export async function isWsAuthorized(c, mode, auth) {
+export async function isWsAuthorized(c, mode, auth, db) {
     switch (mode) {
         case "none":
             return true;
@@ -140,7 +167,7 @@ export async function isWsAuthorized(c, mode, auth) {
         case "proxy":
             return hasProxyAuth(c, auth);
         case "password":
-            return hasValidSession(c, auth);
+            return hasValidSession(c, auth, db);
     }
 }
 // --- password mode helpers ---
@@ -149,9 +176,10 @@ export async function isWsAuthorized(c, mode, auth) {
  * both password login and passkey login (middleware/passkeys.ts) call this, so
  * authGuard / isWsAuthorized / TTL semantics stay identical across methods.
  */
-export async function issueSessionCookie(c, auth) {
+export async function issueSessionCookie(c, auth, db) {
     const secret = auth.cookieSecret ?? "";
-    await setSignedCookie(c, COOKIE_NAME, String(Date.now()), secret, {
+    const epoch = sessionsEpoch(db);
+    await setSignedCookie(c, COOKIE_NAME, `${Date.now()}.${epoch}`, secret, {
         httpOnly: true,
         sameSite: "Strict",
         // Always Secure — every real deployment serves over HTTPS, and we do not
@@ -162,26 +190,69 @@ export async function issueSessionCookie(c, auth) {
         maxAge: SESSION_TTL_SECONDS,
     });
 }
-async function hasValidSession(c, auth) {
+async function hasValidSession(c, auth, db) {
     const secret = auth.cookieSecret ?? "";
     if (!secret)
         return false;
+    let value;
     try {
-        const value = await getSignedCookie(c, secret, COOKIE_NAME);
-        if (typeof value !== "string" || value.length === 0)
-            return false;
-        // The cookie value is the issue timestamp. Validate its age server-side:
-        // Max-Age is client-discardable, so the signature alone does not bound a
-        // session's lifetime — this does.
-        const issuedAt = Number(value);
-        if (!Number.isFinite(issuedAt))
-            return false;
-        const ageSeconds = (Date.now() - issuedAt) / 1000;
-        return ageSeconds >= 0 && ageSeconds < SESSION_TTL_SECONDS;
+        value = await getSignedCookie(c, secret, COOKIE_NAME);
     }
     catch {
         return false;
     }
+    if (typeof value !== "string" || value.length === 0)
+        return false;
+    // Both fields are decimal integers. Requiring the exact shape rejects every
+    // pre-epoch cookie instead of accidentally interpreting its timestamp as a
+    // current session.
+    const match = /^(\d+)\.(\d+)$/.exec(value);
+    if (!match)
+        return false;
+    const issuedAt = Number(match[1]);
+    const cookieEpoch = Number(match[2]);
+    if (!Number.isSafeInteger(issuedAt) || !Number.isSafeInteger(cookieEpoch)) {
+        return false;
+    }
+    const ageSeconds = (Date.now() - issuedAt) / 1000;
+    if (ageSeconds < 0 || ageSeconds >= SESSION_TTL_SECONDS)
+        return false;
+    // Deliberately outside the cookie-parser catch: corrupt authoritative auth
+    // state refuses loudly and must never degrade to epoch zero.
+    return cookieEpoch === sessionsEpoch(db);
+}
+/**
+ * Read authoritative session state. A missing row is first-run epoch zero;
+ * any present row that is not a non-negative safe integer is corruption.
+ */
+function sessionsEpoch(db) {
+    const row = db
+        .query("SELECT value FROM settings WHERE key = ?")
+        .get(SESSIONS_EPOCH_KEY);
+    if (!row)
+        return 0;
+    let value;
+    try {
+        value = JSON.parse(row.value);
+    }
+    catch {
+        throw new Error(`Corrupt ${SESSIONS_EPOCH_KEY}: expected a JSON integer`);
+    }
+    if (!Number.isSafeInteger(value) || value < 0) {
+        throw new Error(`Corrupt ${SESSIONS_EPOCH_KEY}: expected a non-negative integer`);
+    }
+    return value;
+}
+/** Invalidate every issued session and disconnect every attached client. */
+export function bumpSessionsEpoch(db, clients) {
+    const current = sessionsEpoch(db);
+    if (current === Number.MAX_SAFE_INTEGER) {
+        throw new Error(`${SESSIONS_EPOCH_KEY} cannot be advanced safely`);
+    }
+    const next = current + 1;
+    setSetting(db, SESSIONS_EPOCH_KEY, next);
+    clients.closeAll(SESSION_REVOKED_CLOSE_CODE, SESSION_REVOKED_CLOSE_REASON);
+    return next;
 }
 // --- proxy mode helpers ---
 function hasProxyAuth(c, auth) {
@@ -195,63 +266,190 @@ function hasProxyAuth(c, auth) {
     return !!user && user.trim().length > 0;
 }
 const loginBuckets = new Map();
+function pruneExpiredBuckets(now) {
+    for (const [key, bucket] of loginBuckets) {
+        if (now >= bucket.resetAt)
+            loginBuckets.delete(key);
+    }
+}
+function makeBucketRoom() {
+    while (loginBuckets.size >= LOGIN_BUCKET_CAP) {
+        // Keep the global password bucket authoritative. The cap is larger than
+        // its maximum number of per-IP contributors in one window, so ordinary
+        // password traffic never needs to evict an active per-IP failure record.
+        const oldest = [...loginBuckets.keys()].find((key) => key !== PASSWORD_GLOBAL_BUCKET);
+        if (oldest === undefined)
+            break;
+        loginBuckets.delete(oldest);
+    }
+}
+function bucketForWrite(key, now) {
+    pruneExpiredBuckets(now);
+    const existing = loginBuckets.get(key);
+    if (existing)
+        return existing;
+    makeBucketRoom();
+    const bucket = { failures: 0, resetAt: now + LOGIN_RATE_WINDOW_MS };
+    loginBuckets.set(key, bucket);
+    return bucket;
+}
+/** Record one genuine authentication failure in a fixed one-minute window. */
+export function recordLoginFailure(key, limit) {
+    const bucket = bucketForWrite(key, Date.now());
+    // Saturate: callers only care whether the limit was reached, and this avoids
+    // an unbounded counter if a test or future caller records after blocking.
+    bucket.failures = Math.min(limit, bucket.failures + 1);
+}
+/** Read without allocating: junk requests cannot grow the failure map. */
+export function isLoginBlocked(key, limit) {
+    const now = Date.now();
+    const bucket = loginBuckets.get(key);
+    if (!bucket)
+        return false;
+    if (now >= bucket.resetAt) {
+        loginBuckets.delete(key);
+        return false;
+    }
+    return bucket.failures >= limit;
+}
+function createVerificationReservations(perIpLimit, globalLimit) {
+    const buckets = new Map();
+    let totalInFlight = 0;
+    function prune(now) {
+        for (const [key, bucket] of buckets) {
+            if (bucket.count === 0 && now >= bucket.expiresAt)
+                buckets.delete(key);
+        }
+    }
+    return {
+        acquire(ip) {
+            const now = Date.now();
+            prune(now);
+            if (totalInFlight >= globalLimit)
+                return false;
+            let bucket = buckets.get(ip);
+            if (bucket && bucket.count >= perIpLimit)
+                return false;
+            if (!bucket) {
+                while (buckets.size >= LOGIN_BUCKET_CAP) {
+                    const idle = [...buckets].find(([, entry]) => entry.count === 0);
+                    if (!idle)
+                        return false;
+                    buckets.delete(idle[0]);
+                }
+                bucket = { count: 0, expiresAt: now + LOGIN_RATE_WINDOW_MS };
+                buckets.set(ip, bucket);
+            }
+            bucket.count++;
+            bucket.expiresAt = now + LOGIN_RATE_WINDOW_MS;
+            totalInFlight++;
+            return true;
+        },
+        release(ip) {
+            const bucket = buckets.get(ip);
+            if (!bucket || bucket.count === 0)
+                return;
+            bucket.count--;
+            bucket.expiresAt = Date.now() + LOGIN_RATE_WINDOW_MS;
+            totalInFlight--;
+        },
+        reset() {
+            buckets.clear();
+            totalInFlight = 0;
+        },
+    };
+}
+const passwordVerifications = createVerificationReservations(PASSWORD_VERIFY_IN_FLIGHT_PER_IP, PASSWORD_VERIFY_IN_FLIGHT_GLOBAL);
+const passkeyVerifications = createVerificationReservations(PASSKEY_VERIFY_IN_FLIGHT_PER_IP, PASSKEY_VERIFY_IN_FLIGHT_GLOBAL);
+function acquirePasswordVerification(ip) {
+    return passwordVerifications.acquire(ip);
+}
+function releasePasswordVerification(ip) {
+    passwordVerifications.release(ip);
+}
+/** Internal middleware coordination; not exported from the package root. */
+export function acquirePasskeyVerification(ip) {
+    return passkeyVerifications.acquire(ip);
+}
+/** Internal middleware coordination; not exported from the package root. */
+export function releasePasskeyVerification(ip) {
+    passkeyVerifications.release(ip);
+}
 /** Test-only: clear all rate-limit buckets (they are module-global state). */
 export function resetLoginRateLimiter() {
     loginBuckets.clear();
+    passwordVerifications.reset();
+    passkeyVerifications.reset();
 }
+/** Attempt-counting bucket retained for passkey option generation. */
 export function consumeLoginToken(key, limit) {
-    const now = Date.now();
-    let bucket = loginBuckets.get(key);
-    if (!bucket || now >= bucket.resetAt) {
-        bucket = { tokens: limit, resetAt: now + LOGIN_RATE_WINDOW_MS };
-        loginBuckets.set(key, bucket);
-    }
-    if (bucket.tokens <= 0)
+    if (isLoginBlocked(key, limit))
         return false;
-    bucket.tokens--;
+    recordLoginFailure(key, limit);
     return true;
 }
 /** Login/logout routes. Only functional in `password` mode. */
-export function authRoutes(mode, auth, deps = {}) {
+export function authRoutes(mode, auth, deps) {
     const app = new Hono();
     const { log, failures } = deps;
-    app.post("/auth/login", async (c) => {
+    const verifyPassword = deps.verifyPassword ?? Bun.password.verify;
+    let warnedUntrustedForwardedFor = false;
+    app.post("/auth/login", requireJson(), async (c) => {
         if (mode !== "password") {
             return c.json({ error: "Password login is not enabled" }, 400);
         }
+        if (!auth.trustProxy &&
+            !warnedUntrustedForwardedFor &&
+            c.req.header("x-forwarded-for")) {
+            warnedUntrustedForwardedFor = true;
+            log?.emit({
+                severityText: "WARN",
+                body: "X-Forwarded-For ignored in password mode",
+                attributes: { "auth.mode": "password", "auth.trust_proxy": false },
+            });
+        }
         const key = clientIp(c, auth.trustProxy, auth.trustProxyHops) || "unknown";
-        const perIpOk = consumeLoginToken(`ip:${key}`, LOGIN_RATE_LIMIT);
-        const globalOk = consumeLoginToken("global", GLOBAL_LOGIN_RATE_LIMIT);
-        if (!perIpOk || !globalOk) {
+        const perIpBucket = `${PASSWORD_IP_BUCKET_PREFIX}${key}`;
+        if (deps.passwordDisabled?.(c)) {
+            return c.json({ error: "Password login is disabled — sign in with a passkey." }, 403);
+        }
+        // Refuse a blocked client before reading its body: admission control is
+        // cheapest when it costs no parsing.
+        const perIpBlocked = isLoginBlocked(perIpBucket, LOGIN_RATE_LIMIT);
+        const globalBlocked = isLoginBlocked(PASSWORD_GLOBAL_BUCKET, GLOBAL_LOGIN_RATE_LIMIT);
+        if (perIpBlocked || globalBlocked) {
             failures?.add(1, { reason: "rate_limited", method: "password" });
             log?.emit({
                 severityText: "WARN",
                 body: "login rate limited",
-                attributes: { ip: key, limit: perIpOk ? "global" : "ip" },
+                attributes: { ip: key, limit: perIpBlocked ? "ip" : "global" },
             });
             return c.json({ error: "Too many attempts. Try again in a minute." }, 429);
         }
-        if (deps.passwordDisabled?.(c)) {
-            return c.json({ error: "Password login is disabled — sign in with a passkey." }, 403);
-        }
         const hash = auth.passwordHash ?? "";
         const secret = auth.cookieSecret ?? "";
         let body;
         try {
-            body = await c.req.json();
+            const result = await readJsonBody(c);
+            if (result instanceof Response)
+                return result;
+            body = result;
         }
         catch {
             return c.json({ error: "Invalid request body" }, 400);
         }
         const password = typeof body.password === "string" ? body.password : "";
         if (!password || !hash || !secret) {
-            failures?.add(1, { reason: "invalid_password", method: "password" });
+            return c.json({ error: "Invalid credentials" }, 401);
+        }
+        if (!acquirePasswordVerification(key)) {
+            failures?.add(1, { reason: "in_flight_limited", method: "password" });
             log?.emit({
                 severityText: "WARN",
-                body: "login failed",
+                body: "password verification capacity reached",
                 attributes: { ip: key },
             });
-            return c.json({ error: "Invalid credentials" }, 401);
+            return c.json({ error: "Too many login verifications in progress." }, 429);
         }
         // A verify that THROWS is not a wrong password — it is a hash Bun cannot
         // parse (a corrupt BRAIN_UI_PASSWORD_HASH locks the owner out of every
@@ -259,11 +457,14 @@ export function authRoutes(mode, auth, deps = {}) {
         let ok = false;
         let verifyError = null;
         try {
-            ok = await Bun.password.verify(password, hash);
+            ok = await verifyPassword(password, hash);
         }
         catch (err) {
             verifyError = err;
         }
+        finally {
+            releasePasswordVerification(key);
+        }
         if (verifyError) {
             failures?.add(1, { reason: "verify_error", method: "password" });
             log?.emit({
@@ -276,6 +477,8 @@ export function authRoutes(mode, auth, deps = {}) {
             return c.json({ error: "Invalid credentials" }, 401);
         }
         if (!ok) {
+            recordLoginFailure(perIpBucket, LOGIN_RATE_LIMIT);
+            recordLoginFailure(PASSWORD_GLOBAL_BUCKET, GLOBAL_LOGIN_RATE_LIMIT);
             failures?.add(1, { reason: "invalid_password", method: "password" });
             log?.emit({
                 severityText: "WARN",
@@ -284,7 +487,7 @@ export function authRoutes(mode, auth, deps = {}) {
             });
             return c.json({ error: "Invalid credentials" }, 401);
         }
-        await issueSessionCookie(c, auth);
+        await issueSessionCookie(c, auth, deps.db);
         log?.emit({
             severityText: "INFO",
             body: "login succeeded",
@@ -292,7 +495,12 @@ export function authRoutes(mode, auth, deps = {}) {
         });
         return c.json({ ok: true });
     });
-    app.post("/auth/logout", (c) => {
+    app.post("/auth/logout", async (c) => {
+        if (mode === "password" && !(await hasValidSession(c, auth, deps.db))) {
+            return c.json({ error: "Authentication required", authRequired: true }, 401);
+        }
+        if (mode === "password")
+            bumpSessionsEpoch(deps.db, deps.clients);
         deleteCookie(c, COOKIE_NAME, { path: "/" });
         return c.json({ ok: true });
     });

package/dist/middleware/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAmC9D,MAAM,WAAW,GAAG,kBAAkB,CAAC;AACvC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU;AACzD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,CAAC,qCAAqC;AACxE,MAAM,oBAAoB,GAAG,MAAM,CAAC,CAAC,aAAa;AAClD,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,qDAAqD;AACrD,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC,CAAC,wCAAwC;AAEnF,MAAM,UAAU,eAAe,CAAC,IAAiB,EAAE,GAAY;IAC7D,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IAChC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,GAAG,EAAE,IAAI,CAAC;YACR,YAAY,EAAE,MAAM;YACpB,IAAI,EAAE,2CAA2C;YACjD,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE;SAC5C,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,YAAY;QAAE,OAAO,UAAU,CAAC;IACzC,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAc,EAAE,IAAiB,EAAE,GAAY;IAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,QAAQ,GAAG,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,WAAW,CAAC;IAEhF,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,0EAA0E;gBACxE,kFAAkF,CACrF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,0EAA0E;gBACxE,sEAAsE,CACzE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,uEAAuE;IACvE,2BAA2B;IAC3B,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAChC,wEAAwE;YACxE,wEAAwE;YACxE,sDAAsD;YACtD,GAAG,EAAE,IAAI,CAAC;gBACR,YAAY,EAAE,OAAO;gBACrB,IAAI,EACF,oDAAoD;oBACpD,oEAAoE;oBACpE,kEAAkE;gBACpE,UAAU,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACb,0DAA0D;gBACxD,cAAc,IAAI,sDAAsD;gBACxE,0EAA0E;gBAC1E,kEAAkE;gBAClE,iEAAiE;gBACjE,sCAAsC,CACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,yEAAyE;gBACvE,sEAAsE;gBACtE,8DAA8D,CACjE,CAAC;QACJ,CAAC;QACD,GAAG,EAAE,IAAI,CAAC;YACR,YAAY,EAAE,MAAM;YACpB,IAAI,EACF,yEAAyE;gBACzE,qCAAqC;YACvC,UAAU,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE;SACnE,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,GAAG,EAAE,IAAI,CAAC;QACR,YAAY,EAAE,MAAM;QACpB,IAAI,EAAE,oBAAoB;QAC1B,UAAU,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE;KAClC,CAAC,CAAC;AACL,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,SAAS,CAAC,IAAc,EAAE,IAAiB;IACzD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,WAAW;YACd,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;gBACvB,IAAI,kBAAkB,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;oBAChE,MAAM,IAAI,EAAE,CAAC;gBACf,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;gBACvD,CAAC;YACH,CAAC,CAAC;QACJ,KAAK,OAAO;YACV,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;gBACvB,IAAI,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;oBAC1B,MAAM,IAAI,EAAE,CAAC;gBACf,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,yBAAyB,EAAE,YAAY,EAAE,IAAI,EAAE,EACxD,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC;QACJ,KAAK,UAAU;YACb,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;gBACvB,IAAI,MAAM,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;oBACnC,MAAM,IAAI,EAAE,CAAC;gBACf,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,yBAAyB,EAAE,YAAY,EAAE,IAAI,EAAE,EACxD,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC;QACJ,KAAK,MAAM;YACT,OAAO,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;gBACxB,MAAM,IAAI,EAAE,CAAC;YACf,CAAC,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,CAAU,EACV,IAAc,EACd,IAAiB;IAEjB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM;YACT,OAAO,IAAI,CAAC;QACd,KAAK,WAAW;YACd,OAAO,kBAAkB,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACrE,KAAK,OAAO;YACV,OAAO,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC/B,KAAK,UAAU;YACb,OAAO,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,gCAAgC;AAEhC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,CAAU,EAAE,IAAiB;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;IACvC,MAAM,eAAe,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE;QAChE,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,QAAQ;QAClB,yEAAyE;QACzE,0EAA0E;QAC1E,qEAAqE;QACrE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,mBAAmB;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,CAAU,EAAE,IAAiB;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAClE,yEAAyE;QACzE,yEAAyE;QACzE,kCAAkC;QAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7C,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC;QAClD,OAAO,UAAU,IAAI,CAAC,IAAI,UAAU,GAAG,mBAAmB,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,6BAA6B;AAE7B,SAAS,YAAY,CAAC,CAAU,EAAE,IAAiB;IACjD,+EAA+E;IAC/E,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAI,CAAC,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAChD,OAAO,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC1C,CAAC;AAQD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE/C,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB;IACnC,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,KAAa;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,oBAAoB,EAAE,CAAC;QAChE,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,CAAC,MAAM,EAAE,CAAC;IAChB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,UAAU,CACxB,IAAc,EACd,IAAiB,EACjB,OAYI,EAAE;IAEN,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAE/B,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACxB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,EAAE,GAAG,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;QAC3E,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,GAAG,EAAE,EAAE,gBAAgB,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1B,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACjE,GAAG,EAAE,IAAI,CAAC;gBACR,YAAY,EAAE,MAAM;gBACpB,IAAI,EAAE,oBAAoB;gBAC1B,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE;aAC1D,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7E,CAAC;QAED,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,sDAAsD,EAAE,EACjE,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;QACvC,IAAI,IAA4B,CAAC;QACjC,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAClC,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACrE,GAAG,EAAE,IAAI,CAAC;gBACR,YAAY,EAAE,MAAM;gBACpB,IAAI,EAAE,cAAc;gBACpB,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE;aACxB,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,IAAI,EAAE,GAAG,KAAK,CAAC;QACf,IAAI,WAAW,GAAY,IAAI,CAAC;QAChC,IAAI,CAAC;YACH,EAAE,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,GAAG,GAAG,CAAC;QACpB,CAAC;QACD,IAAI,WAAW,EAAE,CAAC;YAChB,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACjE,GAAG,EAAE,IAAI,CAAC;gBACR,YAAY,EAAE,OAAO;gBACrB,IAAI,EAAE,8DAA8D;gBACpE,UAAU,EAAE;oBACV,KAAK,EAAE,WAAW,YAAY,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;iBAChF;aACF,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACrE,GAAG,EAAE,IAAI,CAAC;gBACR,YAAY,EAAE,MAAM;gBACpB,IAAI,EAAE,cAAc;gBACpB,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE;aACxB,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,kBAAkB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAClC,GAAG,EAAE,IAAI,CAAC;YACR,YAAY,EAAE,MAAM;YACpB,IAAI,EAAE,iBAAiB;YACvB,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE;SACxB,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE;QAC7B,YAAY,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE7E,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE9D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAmC/C,MAAM,WAAW,GAAG,kBAAkB,CAAC;AACvC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU;AACzD,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAChD,MAAM,0BAA0B,GAAG,IAAI,CAAC;AACxC,MAAM,4BAA4B,GAAG,sBAAsB,CAAC;AAC5D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,CAAC,qCAAqC;AACxE,MAAM,oBAAoB,GAAG,MAAM,CAAC,CAAC,aAAa;AAClD,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,wEAAwE;AACxE,4EAA4E;AAC5E,yEAAyE;AACzE,8EAA8E;AAC9E,wEAAwE;AACxE,8EAA8E;AAC9E,2EAA2E;AAC3E,yEAAyE;AACzE,+EAA+E;AAC/E,4EAA4E;AAC5E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC,CAAC,wCAAwC;AACpF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAC1C,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAC3C,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAC3C,MAAM,+BAA+B,GAAG,CAAC,CAAC;AAC1C,MAAM,+BAA+B,GAAG,CAAC,CAAC;AAC1C,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,4EAA4E;AAC5E,gFAAgF;AAChF,0EAA0E;AAC1E,oEAAoE;AACpE,MAAM,yBAAyB,GAAG,QAAQ,CAAC;AAC3C,MAAM,sBAAsB,GAAG,WAAW,CAAC;AAE3C,MAAM,UAAU,eAAe,CAAC,IAAiB,EAAE,GAAY;IAC7D,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IAChC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,GAAG,EAAE,IAAI,CAAC;YACR,YAAY,EAAE,MAAM;YACpB,IAAI,EAAE,2CAA2C;YACjD,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE;SAC5C,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,YAAY;QAAE,OAAO,UAAU,CAAC;IACzC,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAc,EAAE,IAAiB,EAAE,GAAY;IAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,QAAQ,GAAG,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,WAAW,CAAC;IAEhF,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,0EAA0E;gBACxE,kFAAkF,CACrF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,0EAA0E;gBACxE,sEAAsE,CACzE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,uEAAuE;IACvE,2BAA2B;IAC3B,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAChC,wEAAwE;YACxE,wEAAwE;YACxE,sDAAsD;YACtD,GAAG,EAAE,IAAI,CAAC;gBACR,YAAY,EAAE,OAAO;gBACrB,IAAI,EACF,oDAAoD;oBACpD,oEAAoE;oBACpE,kEAAkE;gBACpE,UAAU,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACb,0DAA0D;gBACxD,cAAc,IAAI,sDAAsD;gBACxE,0EAA0E;gBAC1E,kEAAkE;gBAClE,iEAAiE;gBACjE,sCAAsC,CACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,yEAAyE;gBACvE,sEAAsE;gBACtE,8DAA8D,CACjE,CAAC;QACJ,CAAC;QACD,GAAG,EAAE,IAAI,CAAC;YACR,YAAY,EAAE,MAAM;YACpB,IAAI,EACF,yEAAyE;gBACzE,qCAAqC;YACvC,UAAU,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE;SACnE,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,GAAG,EAAE,IAAI,CAAC;QACR,YAAY,EAAE,MAAM;QACpB,IAAI,EAAE,oBAAoB;QAC1B,UAAU,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE;KAClC,CAAC,CAAC;AACL,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,SAAS,CACvB,IAAc,EACd,IAAiB,EACjB,EAAY;IAEZ,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,WAAW;YACd,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;gBACvB,IAAI,kBAAkB,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;oBAChE,MAAM,IAAI,EAAE,CAAC;gBACf,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;gBACvD,CAAC;YACH,CAAC,CAAC;QACJ,KAAK,OAAO;YACV,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;gBACvB,IAAI,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;oBAC1B,MAAM,IAAI,EAAE,CAAC;gBACf,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,yBAAyB,EAAE,YAAY,EAAE,IAAI,EAAE,EACxD,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC;QACJ,KAAK,UAAU;YACb,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;gBACvB,IAAI,MAAM,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;oBACvC,MAAM,IAAI,EAAE,CAAC;gBACf,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,yBAAyB,EAAE,YAAY,EAAE,IAAI,EAAE,EACxD,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC;QACJ,KAAK,MAAM;YACT,OAAO,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;gBACxB,MAAM,IAAI,EAAE,CAAC;YACf,CAAC,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,CAAU,EACV,IAAc,EACd,IAAiB,EACjB,EAAY;IAEZ,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM;YACT,OAAO,IAAI,CAAC;QACd,KAAK,WAAW;YACd,OAAO,kBAAkB,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACrE,KAAK,OAAO;YACV,OAAO,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC/B,KAAK,UAAU;YACb,OAAO,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,gCAAgC;AAEhC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,CAAU,EACV,IAAiB,EACjB,EAAY;IAEZ,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IAChC,MAAM,eAAe,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,EAAE,EAAE,MAAM,EAAE;QACtE,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,QAAQ;QAClB,yEAAyE;QACzE,0EAA0E;QAC1E,qEAAqE;QACrE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,mBAAmB;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,CAAU,EACV,IAAiB,EACjB,EAAY;IAEZ,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,KAAiC,CAAC;IACtC,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAElE,4EAA4E;IAC5E,2EAA2E;IAC3E,mBAAmB;IACnB,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC;IAClD,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,IAAI,mBAAmB;QAAE,OAAO,KAAK,CAAC;IAEtE,2EAA2E;IAC3E,6DAA6D;IAC7D,OAAO,WAAW,KAAK,aAAa,CAAC,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,EAAY;IACjC,MAAM,GAAG,GAAG,EAAE;SACX,KAAK,CAAC,0CAA0C,CAAC;SACjD,GAAG,CAAC,kBAAkB,CAA6B,CAAC;IACvD,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,CAAC;IAEnB,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,WAAW,kBAAkB,2BAA2B,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAK,KAAgB,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,WAAW,kBAAkB,mCAAmC,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,KAAe,CAAC;AACzB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,iBAAiB,CAAC,EAAY,EAAE,OAAkB;IAChE,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IAClC,IAAI,OAAO,KAAK,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,GAAG,kBAAkB,4BAA4B,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,CAAC;IACzB,UAAU,CAAC,EAAE,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC;IACzC,OAAO,CAAC,QAAQ,CAAC,0BAA0B,EAAE,4BAA4B,CAAC,CAAC;IAC3E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6BAA6B;AAE7B,SAAS,YAAY,CAAC,CAAU,EAAE,IAAiB;IACjD,+EAA+E;IAC/E,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAI,CAAC,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAChD,OAAO,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC1C,CAAC;AAQD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;AAa/C,SAAS,mBAAmB,CAAC,GAAW;IACtC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QACzC,IAAI,GAAG,IAAI,MAAM,CAAC,OAAO;YAAE,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,SAAS,cAAc;IACrB,OAAO,YAAY,CAAC,IAAI,IAAI,gBAAgB,EAAE,CAAC;QAC7C,wEAAwE;QACxE,uEAAuE;QACvE,yEAAyE;QACzE,MAAM,MAAM,GAAG,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAC1C,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,sBAAsB,CACxC,CAAC;QACF,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM;QAChC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAW,EAAE,GAAW;IAC9C,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,cAAc,EAAE,CAAC;IACjB,MAAM,MAAM,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,oBAAoB,EAAE,CAAC;IACpE,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,KAAa;IAC3D,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/C,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,KAAa;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC1B,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC;AAClC,CAAC;AAED,SAAS,8BAA8B,CACrC,UAAkB,EAClB,WAAmB;IAEnB,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAClD,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,SAAS,KAAK,CAAC,GAAW;QACxB,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACpC,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,IAAI,MAAM,CAAC,SAAS;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,CAAC,EAAE;YACR,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,KAAK,CAAC,GAAG,CAAC,CAAC;YACX,IAAI,aAAa,IAAI,WAAW;gBAAE,OAAO,KAAK,CAAC;YAE/C,IAAI,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7B,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,IAAI,UAAU;gBAAE,OAAO,KAAK,CAAC;YACvD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,OAAO,CAAC,IAAI,IAAI,gBAAgB,EAAE,CAAC;oBACxC,MAAM,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;oBACjE,IAAI,CAAC,IAAI;wBAAE,OAAO,KAAK,CAAC;oBACxB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1B,CAAC;gBACD,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,GAAG,oBAAoB,EAAE,CAAC;gBAC7D,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAC1B,CAAC;YACD,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,SAAS,GAAG,GAAG,GAAG,oBAAoB,CAAC;YAC9C,aAAa,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,EAAE;YACR,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC;gBAAE,OAAO;YAC1C,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB,CAAC;YACrD,aAAa,EAAE,CAAC;QAClB,CAAC;QACD,KAAK;YACH,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,aAAa,GAAG,CAAC,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,qBAAqB,GAAG,8BAA8B,CAC1D,gCAAgC,EAChC,gCAAgC,CACjC,CAAC;AACF,MAAM,oBAAoB,GAAG,8BAA8B,CACzD,+BAA+B,EAC/B,+BAA+B,CAChC,CAAC;AAEF,SAAS,2BAA2B,CAAC,EAAU;IAC7C,OAAO,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,2BAA2B,CAAC,EAAU;IAC7C,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,0BAA0B,CAAC,EAAU;IACnD,OAAO,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,0BAA0B,CAAC,EAAU;IACnD,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB;IACnC,YAAY,CAAC,KAAK,EAAE,CAAC;IACrB,qBAAqB,CAAC,KAAK,EAAE,CAAC;IAC9B,oBAAoB,CAAC,KAAK,EAAE,CAAC;AAC/B,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,KAAa;IAC1D,IAAI,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC/B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,UAAU,CACxB,IAAc,EACd,IAAiB,EACjB,IAkBC;IAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAC/B,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;IAClE,IAAI,2BAA2B,GAAG,KAAK,CAAC;IAExC,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjD,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACxB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,EAAE,GAAG,CAAC,CAAC;QACjE,CAAC;QAED,IACE,CAAC,IAAI,CAAC,UAAU;YAChB,CAAC,2BAA2B;YAC5B,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAC/B,CAAC;YACD,2BAA2B,GAAG,IAAI,CAAC;YACnC,GAAG,EAAE,IAAI,CAAC;gBACR,YAAY,EAAE,MAAM;gBACpB,IAAI,EAAE,0CAA0C;gBAChD,UAAU,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,kBAAkB,EAAE,KAAK,EAAE;aACnE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;QAC3E,MAAM,WAAW,GAAG,GAAG,yBAAyB,GAAG,GAAG,EAAE,CAAC;QAEzD,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,sDAAsD,EAAE,EACjE,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,qCAAqC;QACrC,MAAM,YAAY,GAAG,cAAc,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QACnE,MAAM,aAAa,GAAG,cAAc,CAClC,sBAAsB,EACtB,uBAAuB,CACxB,CAAC;QACF,IAAI,YAAY,IAAI,aAAa,EAAE,CAAC;YAClC,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACjE,GAAG,EAAE,IAAI,CAAC;gBACR,YAAY,EAAE,MAAM;gBACpB,IAAI,EAAE,oBAAoB;gBAC1B,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE;aAC/D,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;QACvC,IAAI,IAA4B,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAyB,CAAC,CAAC,CAAC;YAC7D,IAAI,MAAM,YAAY,QAAQ;gBAAE,OAAO,MAAM,CAAC;YAC9C,IAAI,GAAG,MAAM,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACtE,GAAG,EAAE,IAAI,CAAC;gBACR,YAAY,EAAE,MAAM;gBACpB,IAAI,EAAE,wCAAwC;gBAC9C,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE;aACxB,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7E,CAAC;QAED,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,IAAI,EAAE,GAAG,KAAK,CAAC;QACf,IAAI,WAAW,GAAY,IAAI,CAAC;QAChC,IAAI,CAAC;YACH,EAAE,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,GAAG,GAAG,CAAC;QACpB,CAAC;gBAAS,CAAC;YACT,2BAA2B,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,WAAW,EAAE,CAAC;YAChB,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACjE,GAAG,EAAE,IAAI,CAAC;gBACR,YAAY,EAAE,OAAO;gBACrB,IAAI,EAAE,8DAA8D;gBACpE,UAAU,EAAE;oBACV,KAAK,EAAE,WAAW,YAAY,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;iBAChF;aACF,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,kBAAkB,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;YAClD,kBAAkB,CAAC,sBAAsB,EAAE,uBAAuB,CAAC,CAAC;YACpE,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACrE,GAAG,EAAE,IAAI,CAAC;gBACR,YAAY,EAAE,MAAM;gBACpB,IAAI,EAAE,cAAc;gBACpB,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE;aACxB,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,kBAAkB,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3C,GAAG,EAAE,IAAI,CAAC;YACR,YAAY,EAAE,MAAM;YACpB,IAAI,EAAE,iBAAiB;YACvB,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE;SACxB,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnC,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACtE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,IAAI,KAAK,UAAU;YAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAClE,YAAY,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/middleware/body-limit.d.ts

@@ -0,0 +1,15 @@
+import type { Context } from "hono";
+/** Ordinary JSON control-plane requests never need to be large. */
+export declare const JSON_BODY_LIMIT_BYTES: number;
+/** Render requests may contain inlined images and SVG. */
+export declare const RENDER_BODY_LIMIT_BYTES = 5000000;
+/**
+ * Read and parse a JSON request without replacing the request object.
+ *
+ * Content-Length can reject an oversized request before its stream is touched.
+ * Lengthless and chunked bodies are counted while streaming and cancelled as
+ * soon as they cross the cap. Returning the 413 response lets route-local
+ * invalid-JSON handling remain distinct from an oversized request.
+ */
+export declare function readJsonBody<T = unknown>(c: Context, maxBytes?: number): Promise<T | Response>;
+//# sourceMappingURL=body-limit.d.ts.map

package/dist/middleware/body-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-limit.d.ts","sourceRoot":"","sources":["../../src/middleware/body-limit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,mEAAmE;AACnE,eAAO,MAAM,qBAAqB,QAAa,CAAC;AAEhD,0DAA0D;AAC1D,eAAO,MAAM,uBAAuB,UAAY,CAAC;AAEjD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,CAAC,GAAG,OAAO,EAC5C,CAAC,EAAE,OAAO,EACV,QAAQ,SAAwB,GAC/B,OAAO,CAAC,CAAC,GAAG,QAAQ,CAAC,CA2BvB"}

package/dist/middleware/body-limit.js

@@ -0,0 +1,41 @@
+/** Ordinary JSON control-plane requests never need to be large. */
+export const JSON_BODY_LIMIT_BYTES = 256 * 1024;
+/** Render requests may contain inlined images and SVG. */
+export const RENDER_BODY_LIMIT_BYTES = 5_000_000;
+/**
+ * Read and parse a JSON request without replacing the request object.
+ *
+ * Content-Length can reject an oversized request before its stream is touched.
+ * Lengthless and chunked bodies are counted while streaming and cancelled as
+ * soon as they cross the cap. Returning the 413 response lets route-local
+ * invalid-JSON handling remain distinct from an oversized request.
+ */
+export async function readJsonBody(c, maxBytes = JSON_BODY_LIMIT_BYTES) {
+    const contentLength = c.req.header("content-length");
+    if (contentLength !== undefined) {
+        const declaredBytes = Number(contentLength);
+        if (Number.isFinite(declaredBytes) && declaredBytes > maxBytes) {
+            return c.json({ error: "Request body too large" }, 413);
+        }
+    }
+    const reader = c.req.raw.body?.getReader();
+    if (!reader)
+        return JSON.parse("");
+    const decoder = new TextDecoder();
+    let bytesRead = 0;
+    let text = "";
+    while (true) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        bytesRead += value.byteLength;
+        if (bytesRead > maxBytes) {
+            await reader.cancel().catch(() => undefined);
+            return c.json({ error: "Request body too large" }, 413);
+        }
+        text += decoder.decode(value, { stream: true });
+    }
+    text += decoder.decode();
+    return JSON.parse(text);
+}
+//# sourceMappingURL=body-limit.js.map

package/dist/middleware/body-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-limit.js","sourceRoot":"","sources":["../../src/middleware/body-limit.ts"],"names":[],"mappings":"AAEA,mEAAmE;AACnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,GAAG,IAAI,CAAC;AAEhD,0DAA0D;AAC1D,MAAM,CAAC,MAAM,uBAAuB,GAAG,SAAS,CAAC;AAEjD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,CAAU,EACV,QAAQ,GAAG,qBAAqB;IAEhC,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACrD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;QAC5C,IAAI,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,QAAQ,EAAE,CAAC;YAC/D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IAC3C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAM,CAAC;IAExC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC;QAC9B,IAAI,SAAS,GAAG,QAAQ,EAAE,CAAC;YACzB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC7C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IACzB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;AAC/B,CAAC"}

package/dist/middleware/origin.d.ts

@@ -1,16 +1,24 @@
-import type { Context } from "hono";
+import type { Context, MiddlewareHandler } from "hono";
 /**
- * Same-origin enforcement for requests a browser sends without a preflight.
+ * Browser request origin policy shared by state-changing HTTP routes and the
+ * WebSocket upgrade.
  *
- * Every other state-changing route here reads `application/json`, which is not
- * a CORS-simple content type and so forces a preflight the attacker's origin
- * fails — CSRF-safe by accident. A multipart upload has no such protection: it
- * is a simple request, and under `AUTH_MODE=tailscale` the credential is the
- * source IP rather than a cookie, so no SameSite flag stands in the way either.
- * Any page opened on the tailnet could otherwise POST into the brain.
- *
- * The check is free because the routes that use it are only ever called by the
- * app itself, same-origin. Same shape as the WebSocket upgrade's origin guard.
+ * Fetch metadata is authoritative when it says same-origin (including the
+ * Vite proxy case where Host is rewritten). Older browsers fall back to an
+ * Origin comparison: host+port without TRUST_PROXY, or the full origin when
+ * proxy headers are trusted. Headerless non-browser clients remain accepted
+ * and are still subject to the route's auth guard. ALLOWED_ORIGINS is an
+ * additional path for explicitly configured split-topology deployments.
+ */
+export declare function isSameOriginRequest(c: Context, allowedOrigins: readonly string[], trustProxy?: boolean): boolean;
+/**
+ * Enforce the origin policy on every non-GET API request, with an optional
+ * additional allowlist confined to one route prefix.
  */
-export declare function isSameOriginRequest(c: Context, allowed: string[]): boolean;
+export declare function originPolicy(allowedOrigins: readonly string[], trustProxy?: boolean, scopedAllowlist?: {
+    pathPrefix: string;
+    origins: readonly string[];
+}): MiddlewareHandler;
+/** Require the exact JSON media type while allowing standard parameters. */
+export declare function requireJson(): MiddlewareHandler;
 //# sourceMappingURL=origin.d.ts.map

package/dist/middleware/origin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"origin.d.ts","sourceRoot":"","sources":["../../src/middleware/origin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAgB1E"}
+{"version":3,"file":"origin.d.ts","sourceRoot":"","sources":["../../src/middleware/origin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AA4BvD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,CAAC,EAAE,OAAO,EACV,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,UAAU,UAAQ,GACjB,OAAO,CAqBT;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,UAAU,UAAQ,EAClB,eAAe,CAAC,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACnE,iBAAiB,CAcnB;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,IAAI,iBAAiB,CAQ/C"}