@sixthsummit/ship-api 0.0.0-stage → 4.1.1

package/lib/http/middleware/csrf.js

@@ -0,0 +1,169 @@
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { getCookie, setCookie } from "hono/cookie";
+import { AuthorizationError } from "../errors/AuthorizationError.js";
+import { checkCookieDomainAgainstPublicSuffix } from "../utils/publicSuffix.js";
+/**
+ * `csrf({ allowedOrigins, doubleSubmit? })` — declared CSRF stance.
+ *
+ * Default mode (`doubleSubmit: false`):
+ *   - Mutating requests (POST/PUT/PATCH/DELETE) must carry an `Origin` (or
+ *     `Referer`) header whose origin matches one of `allowedOrigins`.
+ *   - `Sec-Fetch-Site: cross-site` is rejected outright when the header is
+ *     present (modern browsers; gracefully ignored on older clients).
+ *   - This protects against the typical "user follows a link / submits a
+ *     form on attacker.com that hits api.yours.com" scenario when paired
+ *     with `httpOnly, secure, sameSite=lax` session/JWT cookies.
+ *
+ * Hardened mode (`doubleSubmit: true`):
+ *   - Issues a `csrfToken` cookie on safe (GET/HEAD/OPTIONS) requests when
+ *     none is present.
+ *   - On mutating requests, requires the client to echo the cookie value
+ *     in the `X-CSRF-Token` header (the "double-submit cookie" pattern).
+ *   - Cookie comparison uses `crypto.timingSafeEqual`.
+ *   - Recommended for: third-party-iframed apps, multi-subdomain consumers
+ *     where SameSite=lax doesn't fully protect.
+ *
+ * Documented in `.cursor/rules/security.mdc` (Why subprotocol over alternatives,
+ * and the CSRF stance).
+ */
+const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+const COOKIE_NAME = "ship_csrf";
+const HEADER_NAME = "x-csrf-token";
+/**
+ * Extract a canonical origin from `Origin` (preferred) or `Referer`
+ * (fallback). F24: both paths are validated via `new URL(...)` so a
+ * malformed value (`javascript:alert()`, garbage, empty-after-trim)
+ * never makes it to the allowlist membership check. Returned origin
+ * is lowercased so the allowlist comparison is case-insensitive (per
+ * RFC 6454 §4 hosts MUST compare ASCII-case-insensitively).
+ */
+function originFromHeaders(c) {
+    const origin = c.req.header("origin");
+    if (origin) {
+        try {
+            const url = new URL(origin);
+            if (url.protocol !== "http:" && url.protocol !== "https:")
+                return undefined;
+            return `${url.protocol}//${url.host}`.toLowerCase();
+        }
+        catch {
+            return undefined;
+        }
+    }
+    const referer = c.req.header("referer");
+    if (!referer)
+        return undefined;
+    try {
+        const url = new URL(referer);
+        if (url.protocol !== "http:" && url.protocol !== "https:")
+            return undefined;
+        return `${url.protocol}//${url.host}`.toLowerCase();
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Token length in characters. `randomBytes(24).toString('base64url')`
+ * always produces exactly 32 base64url characters. F25: the
+ * double-submit verifier checks both cookie + header against this
+ * length before the constant-time compare, so an attacker who can
+ * only forge a wrong-length value (e.g. truncated by a buggy proxy,
+ * or a deliberate short-circuit attempt) gets a fast rejection
+ * without revealing per-byte timing of the compare.
+ */
+const TOKEN_LENGTH = 32;
+function generateToken() {
+    return randomBytes(24).toString("base64url");
+}
+function safeEqual(a, b) {
+    const aBuf = Buffer.from(a);
+    const bBuf = Buffer.from(b);
+    if (aBuf.length !== bBuf.length) {
+        timingSafeEqual(aBuf, aBuf); // dummy to keep timing constant-ish
+        return false;
+    }
+    return timingSafeEqual(aBuf, bBuf);
+}
+export function csrf(opts) {
+    if (!opts.allowedOrigins || opts.allowedOrigins.length === 0) {
+        throw new Error("csrf(): `allowedOrigins` must be a non-empty list");
+    }
+    // F5: defend the consumer's double-submit cookie against public-
+    // suffix domain misconfiguration at middleware-construction time.
+    const domainFailure = checkCookieDomainAgainstPublicSuffix(opts.cookie?.domain);
+    if (domainFailure) {
+        throw new Error(`csrf(): invalid cookie.domain — ${domainFailure}`);
+    }
+    // F24: lowercase the allowlist so origin comparison is
+    // case-insensitive per RFC 6454 §4 (hosts compare ASCII-case-
+    // insensitively). Without this, `https://App.Example.com` in the
+    // config wouldn't match `https://app.example.com` from a browser.
+    const allowed = new Set(opts.allowedOrigins.map((o) => o.toLowerCase()));
+    const doubleSubmit = opts.doubleSubmit ?? false;
+    const headerOnly = opts.headerOnly ?? false;
+    const cookieName = opts.cookieName ?? COOKIE_NAME;
+    const headerName = (opts.headerName ?? HEADER_NAME).toLowerCase();
+    const cookieAttrs = opts.cookie ?? {};
+    const middleware = async (c, next) => {
+        const method = c.req.method.toUpperCase();
+        const isSafe = SAFE_METHODS.has(method);
+        // F27 — header-only mode skips cookie issuance. Consumer fetches
+        // tokens out-of-band and stores in memory only. For double-submit
+        // mode without `headerOnly`, ensure a token cookie exists; we
+        // issue on safe requests so the SPA picks it up before the first
+        // mutation.
+        if (doubleSubmit && !headerOnly && isSafe && !getCookie(c, cookieName)) {
+            const token = generateToken();
+            setCookie(c, cookieName, token, {
+                httpOnly: false, // client JS must read it to echo into the header
+                secure: cookieAttrs.secure ?? true,
+                sameSite: cookieAttrs.sameSite ?? "Lax",
+                domain: cookieAttrs.domain,
+                maxAge: cookieAttrs.maxAge ?? 60 * 60 * 24 * 7,
+                path: "/",
+            });
+        }
+        if (isSafe)
+            return next();
+        // Mutating request — apply Origin check.
+        const origin = originFromHeaders(c);
+        if (!origin || !allowed.has(origin)) {
+            throw new AuthorizationError(origin
+                ? `CSRF: origin "${origin}" is not allowed`
+                : "CSRF: missing Origin / Referer header on mutating request");
+        }
+        // Modern browsers tag cross-site initiations explicitly.
+        const fetchSite = c.req.header("sec-fetch-site");
+        if (fetchSite === "cross-site") {
+            throw new AuthorizationError("CSRF: Sec-Fetch-Site is cross-site");
+        }
+        // Hardened: double-submit cookie ↔ header.
+        if (doubleSubmit) {
+            const cookie = getCookie(c, cookieName);
+            const header = c.req.header(headerName);
+            if (!cookie) {
+                throw new AuthorizationError(`CSRF: missing ${cookieName} cookie`);
+            }
+            if (!header) {
+                throw new AuthorizationError(`CSRF: missing ${headerName} header`);
+            }
+            // F25: reject wrong-length values before the constant-time
+            // compare. An empty cookie + empty header would otherwise
+            // short-circuit safeEqual (both buffers length 0, equal), and
+            // a truncated cookie matched against a truncated header would
+            // pass against an attacker who controls both sides. Tokens are
+            // exactly TOKEN_LENGTH chars by construction; any deviation is
+            // either tampering or a buggy proxy.
+            if (cookie.length !== TOKEN_LENGTH || header.length !== TOKEN_LENGTH) {
+                throw new AuthorizationError("CSRF: cookie / header has wrong length");
+            }
+            if (!safeEqual(cookie, header)) {
+                throw new AuthorizationError("CSRF: cookie / header mismatch");
+            }
+        }
+        return next();
+    };
+    return middleware;
+}
+//# sourceMappingURL=csrf.js.map

package/lib/http/middleware/csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../../../src/http/middleware/csrf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE3D,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,oCAAoC,EAAE,MAAM,0BAA0B,CAAC;AAEhF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AACzD,MAAM,WAAW,GAAG,WAAW,CAAC;AAChC,MAAM,WAAW,GAAG,cAAc,CAAC;AA+DnC;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,CAAmC;IAC5D,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAC5E,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC5E,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,YAAY,GAAG,EAAE,CAAC;AAExB,SAAS,aAAa;IACpB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,oCAAoC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,IAAiB;IACpC,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,iEAAiE;IACjE,kEAAkE;IAClE,MAAM,aAAa,GAAG,oCAAoC,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChF,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,mCAAmC,aAAa,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,uDAAuD;IACvD,8DAA8D;IAC9D,iEAAiE;IACjE,kEAAkE;IAClE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACzE,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC;IAChD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC;IAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,WAAW,CAAC;IAClD,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;IAClE,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IAEtC,MAAM,UAAU,GAAsB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACtD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAExC,iEAAiE;QACjE,kEAAkE;QAClE,8DAA8D;QAC9D,iEAAiE;QACjE,YAAY;QACZ,IAAI,YAAY,IAAI,CAAC,UAAU,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC;YACvE,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;YAC9B,SAAS,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE;gBAC9B,QAAQ,EAAE,KAAK,EAAE,iDAAiD;gBAClE,MAAM,EAAE,WAAW,CAAC,MAAM,IAAI,IAAI;gBAClC,QAAQ,EAAE,WAAW,CAAC,QAAQ,IAAI,KAAK;gBACvC,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,MAAM,EAAE,WAAW,CAAC,MAAM,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;gBAC9C,IAAI,EAAE,GAAG;aACV,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM;YAAE,OAAO,IAAI,EAAE,CAAC;QAE1B,yCAAyC;QACzC,MAAM,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,kBAAkB,CAC1B,MAAM;gBACJ,CAAC,CAAC,iBAAiB,MAAM,kBAAkB;gBAC3C,CAAC,CAAC,2DAA2D,CAChE,CAAC;QACJ,CAAC;QAED,yDAAyD;QACzD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACjD,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;YAC/B,MAAM,IAAI,kBAAkB,CAAC,oCAAoC,CAAC,CAAC;QACrE,CAAC;QAED,2CAA2C;QAC3C,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,UAAU,SAAS,CAAC,CAAC;YACrE,CAAC;YACD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,UAAU,SAAS,CAAC,CAAC;YACrE,CAAC;YACD,2DAA2D;YAC3D,0DAA0D;YAC1D,8DAA8D;YAC9D,8DAA8D;YAC9D,+DAA+D;YAC/D,+DAA+D;YAC/D,qCAAqC;YACrC,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;gBACrE,MAAM,IAAI,kBAAkB,CAAC,wCAAwC,CAAC,CAAC;YACzE,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,kBAAkB,CAAC,gCAAgC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;IAEF,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/lib/http/middleware/httpLogger.d.ts

@@ -0,0 +1,39 @@
+import type { MiddlewareHandler } from "hono";
+import { logger as defaultLogger } from "../../observability/logger.js";
+/**
+ * `httpLogger()` — request-scoped logging + RequestContext binding.
+ *
+ * On each request:
+ * 1. Resolves a request ID (incoming `X-Request-Id` header, else a fresh
+ *    UUID). Mirrors the value back on the response as `X-Request-Id`.
+ * 2. Wraps `next()` inside `runWithRequestContext({ requestId, ... })` so
+ *    the framework-wide pino logger auto-attaches `requestId` to every
+ *    log line emitted by downstream middleware / handlers / services /
+ *    DrizzleEntityService lifecycle hooks. No callsite changes.
+ * 3. Logs one structured line per request at completion:
+ *    `info` for 2xx/3xx/4xx, `error` for 5xx, with `{method, path, status,
+ *    durationMs}` plus the bound `requestId`.
+ *
+ * Replaces v3's `RequestIdMiddleware` + ad-hoc console logging. Designed
+ * to run *first* in the middleware chain (before auth, validation, etc.)
+ * so every log line generated downstream gets the request ID.
+ */
+export interface HttpLoggerOptions {
+    /** Override the framework default pino logger. */
+    logger?: typeof defaultLogger;
+    /** Header name to read for the incoming request ID. Default `"x-request-id"`. */
+    headerName?: string;
+    /**
+     * Override request-ID generation. Default is `crypto.randomUUID()`.
+     * Useful for tests that want deterministic IDs.
+     */
+    generateId?: () => string;
+    /**
+     * Log a "request received" line at debug level on entry. Default `false`
+     * because it doubles log volume; enable when you need to see timing of
+     * slow upstream middleware (auth, body parsing).
+     */
+    logStart?: boolean;
+}
+export declare function httpLogger(opts?: HttpLoggerOptions): MiddlewareHandler;
+//# sourceMappingURL=httpLogger.d.ts.map

package/lib/http/middleware/httpLogger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"httpLogger.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/httpLogger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE9C,OAAO,EAAE,MAAM,IAAI,aAAa,EAAuB,MAAM,+BAA+B,CAAC;AAE7F;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,WAAW,iBAAiB;IAChC,kDAAkD;IAClD,MAAM,CAAC,EAAE,OAAO,aAAa,CAAC;IAC9B,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAoED,wBAAgB,UAAU,CAAC,IAAI,GAAE,iBAAsB,GAAG,iBAAiB,CAsD1E"}

package/lib/http/middleware/httpLogger.js

@@ -0,0 +1,118 @@
+import { runWithRequestContext } from "../../app/context/RequestContext.js";
+import { logger as defaultLogger } from "../../observability/logger.js";
+const DEFAULT_HEADER = "x-request-id";
+/**
+ * Query-string keys whose VALUES are redacted in log emission. Case-
+ * insensitive match — `Token`, `TOKEN`, `token` all redact.
+ *
+ * The pino redactor (`packages/core/src/observability/logger.ts`)
+ * covers structured fields like `headers.authorization` and
+ * `body.password`, but URL query parameters arrive as a single
+ * string that the redactor can't see into. This list closes that
+ * gap defensively — consumers SHOULDN'T put secrets in query strings,
+ * but recovery / reset / signed-URL / share / OAuth flows commonly
+ * do anyway. Anything that lands here also leaks to observability
+ * stacks (Stackdriver, Datadog, Loki) by default.
+ *
+ * Documented in `.cursor/rules/security.mdc`. Keep in sync with the
+ * pino redactor's body-side list.
+ */
+const SENSITIVE_QUERY_KEYS = new Set([
+    "token",
+    "signature",
+    "sig",
+    "key",
+    "secret",
+    "code",
+    "state",
+    "password",
+    "passwd",
+    "pwd",
+    "apikey",
+    "api_key",
+    "auth",
+    "authorization",
+    "access_token",
+    "refresh_token",
+    "id_token",
+    "client_secret",
+    "session",
+    "sessionid",
+    "session_id",
+]);
+const REDACTED = "<redacted>";
+/**
+ * Parse the URL's query string into a redacted key→value map. Returns
+ * `undefined` when there's no query, so the caller can omit the field
+ * entirely (cleaner log lines than `query: {}` everywhere).
+ */
+function parseQueryRedacted(rawUrl) {
+    let parsed;
+    try {
+        parsed = new URL(rawUrl, "http://localhost.invalid");
+    }
+    catch {
+        return undefined;
+    }
+    if (parsed.search.length <= 1)
+        return undefined; // "" or "?"
+    const out = {};
+    for (const [k, v] of parsed.searchParams) {
+        out[k] = SENSITIVE_QUERY_KEYS.has(k.toLowerCase()) ? REDACTED : v;
+    }
+    if (Object.keys(out).length === 0)
+        return undefined;
+    return out;
+}
+export function httpLogger(opts = {}) {
+    const log = opts.logger ?? defaultLogger;
+    const headerName = (opts.headerName ?? DEFAULT_HEADER).toLowerCase();
+    const generateId = opts.generateId ?? (() => globalThis.crypto.randomUUID());
+    const middleware = async (c, next) => {
+        const requestId = c.req.header(headerName) ?? generateId();
+        c.header("X-Request-Id", requestId);
+        c.set("requestId", requestId);
+        const ctx = { requestId };
+        const start = performance.now();
+        if (opts.logStart) {
+            runWithRequestContext(ctx, () => {
+                log.debug({ method: c.req.method, path: c.req.path }, "http.request.start");
+            });
+        }
+        let thrown;
+        try {
+            await runWithRequestContext(ctx, async () => {
+                await next();
+            });
+        }
+        catch (err) {
+            thrown = err;
+        }
+        const durationMs = Math.round(performance.now() - start);
+        const status = c.res?.status ?? (thrown ? 500 : 200);
+        const query = parseQueryRedacted(c.req.url);
+        const fields = {
+            method: c.req.method,
+            path: c.req.path,
+            ...(query ? { query } : {}),
+            status,
+            durationMs,
+            requestId,
+        };
+        runWithRequestContext(ctx, () => {
+            if (thrown !== undefined) {
+                log.error({ ...fields, err: thrown }, "http.request.error");
+            }
+            else if (status >= 500) {
+                log.error(fields, "http.request");
+            }
+            else {
+                log.info(fields, "http.request");
+            }
+        });
+        if (thrown !== undefined)
+            throw thrown;
+    };
+    return middleware;
+}
+//# sourceMappingURL=httpLogger.js.map

package/lib/http/middleware/httpLogger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"httpLogger.js","sourceRoot":"","sources":["../../../src/http/middleware/httpLogger.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,MAAM,IAAI,aAAa,EAAuB,MAAM,+BAA+B,CAAC;AAuC7F,MAAM,cAAc,GAAG,cAAc,CAAC;AAEtC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC;IACxD,OAAO;IACP,WAAW;IACX,KAAK;IACL,KAAK;IACL,QAAQ;IACR,MAAM;IACN,OAAO;IACP,UAAU;IACV,QAAQ;IACR,KAAK;IACL,QAAQ;IACR,SAAS;IACT,MAAM;IACN,eAAe;IACf,cAAc;IACd,eAAe;IACf,UAAU;IACV,eAAe;IACf,SAAS;IACT,WAAW;IACX,YAAY;CACb,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC,CAAC,YAAY;IAE7D,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACzC,GAAG,CAAC,CAAC,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAA0B,EAAE;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC;IACzC,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC;IACrE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAE7E,MAAM,UAAU,GAAsB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACtD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3D,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QACpC,CAAC,CAAC,GAAG,CAAC,WAAoB,EAAE,SAAkB,CAAC,CAAC;QAEhD,MAAM,GAAG,GAAmB,EAAE,SAAS,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAEhC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE;gBAC9B,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,oBAAoB,CAAC,CAAC;YAC9E,CAAC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,qBAAqB,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;gBAC1C,MAAM,IAAI,EAAE,CAAC;YACf,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,CAAC;QACf,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG;YACb,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;YACpB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI;YAChB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,MAAM;YACN,UAAU;YACV,SAAS;SACV,CAAC;QAEF,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE;YAC9B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC;YAC9D,CAAC;iBAAM,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;gBACzB,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;YACpC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;YACnC,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,MAAM,CAAC;IACzC,CAAC,CAAC;IAEF,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/lib/http/middleware/idempotency.d.ts

@@ -0,0 +1,48 @@
+import type { Context, MiddlewareHandler } from "hono";
+import type { Cache } from "../../app/services/cache/Cache.js";
+import { logger as defaultLogger } from "../../observability/logger.js";
+import { AppError } from "../errors/AppError.js";
+export interface StoredIdempotencyEntry {
+    /** Hash of the canonical request — used to detect "key reused with different payload". */
+    requestHash: string;
+    status: number;
+    headers: Record<string, string>;
+    /** Response body as text. `null` if the body was too large to cache. */
+    body: string | null;
+    bodyTooLarge?: boolean;
+    /** Wall-clock ms when this entry was recorded. Surfaced in replay headers. */
+    recordedAt: number;
+}
+export interface IdempotencyOptions {
+    /** Cache backend. Production: RedisCache. Tests: InMemoryCache. */
+    cache: Cache;
+    /** Window for replay. Stripe defaults to 24 h. */
+    ttlSec?: number;
+    /**
+     * Bucket namespace appended after `idempotency:`. Default `"global"`.
+     */
+    scope?: string;
+    /**
+     * Compose the actor portion of the cache key. Defaults to
+     * `c.get('user').id` or `'anon'`. Override for API-key-based clients.
+     */
+    keyGenerator?: (c: Context) => string;
+    /**
+     * Cap on the request/response body size that will be cached + replayed.
+     * Defaults to 256 KB. Larger bodies still execute the request once but
+     * the response isn't stored for replay (a flag is recorded so the second
+     * request gets a 200 with a `X-Idempotency-Replay-Lost: true` header).
+     */
+    maxBodyBytes?: number;
+    /** Override the framework default pino logger. */
+    logger?: typeof defaultLogger;
+}
+export declare function idempotency(opts: IdempotencyOptions): MiddlewareHandler;
+/**
+ * Thrown when an Idempotency-Key is reused with a different request payload.
+ * Stripe returns 422 here; we match.
+ */
+export declare class IdempotencyKeyReusedError extends AppError {
+    constructor(message?: string);
+}
+//# sourceMappingURL=idempotency.d.ts.map

package/lib/http/middleware/idempotency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/idempotency.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACvD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mCAAmC,CAAC;AAC/D,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAiDjD,MAAM,WAAW,sBAAsB;IACrC,0FAA0F;IAC1F,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,wEAAwE;IACxE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,KAAK,EAAE,KAAK,CAAC;IACb,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,CAAC;IACtC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,MAAM,CAAC,EAAE,OAAO,aAAa,CAAC;CAC/B;AAsCD,wBAAgB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,iBAAiB,CAkHvE;AAED;;;GAGG;AACH,qBAAa,yBAA0B,SAAQ,QAAQ;gBACzC,OAAO,SAAgE;CAGpF"}

package/lib/http/middleware/idempotency.js

@@ -0,0 +1,180 @@
+import { createHash } from "node:crypto";
+import { logger as defaultLogger } from "../../observability/logger.js";
+import { AppError } from "../errors/AppError.js";
+import { ConflictError } from "../errors/ConflictError.js";
+import { IDEMPOTENCY_META, setMetaTag } from "../utils/metaTags.js";
+/**
+ * `idempotency({ cache, ttlSec, scope?, keyGenerator? })` — Stripe-style
+ * `Idempotency-Key` header dedup.
+ *
+ * Usage: clients send `Idempotency-Key: <uuid>` on a mutating request. If the
+ * server has already processed a request with that key (in the last `ttlSec`
+ * seconds), the previously-recorded response is replayed verbatim — same
+ * status, same headers, same body. Safely retryable network failures, in
+ * other words.
+ *
+ * Pipeline (per request bearing an Idempotency-Key):
+ *
+ *   1. Compose cache key: `idempotency:<scope>:<actor>:<idempotency-key>`.
+ *   2. Hash the canonical request: sha256(method + path + sortedQuery + body).
+ *   3. Look up the cache:
+ *      - If a finalized entry exists for the same hash → replay it.
+ *      - If a finalized entry exists for a *different* hash → 422
+ *        (key reused with different payload — Stripe behavior).
+ *      - If a "pending" sentinel exists → 409 (concurrent in-flight). The
+ *        client should retry; the typical SDK auto-retries.
+ *      - If absent → claim the key with a pending sentinel via
+ *        `cache.setIfAbsent`, then run the handler.
+ *   4. After the handler completes (success or AppError), capture the
+ *      response (status, headers, body) and replace the pending sentinel
+ *      with the finalized entry.
+ *
+ * Requests without an Idempotency-Key header pass through unchanged. Apply
+ * this middleware to mutating routes that should be idempotent (POST that
+ * creates resources, payment flows, anything not safely retried otherwise).
+ *
+ * Tagged `IDEMPOTENCY_META` so `createApp` populates the route registry.
+ *
+ * Limitations (documented for adopters):
+ * - Response body is captured as text. Streamed / very-large bodies will
+ *   bloat the cache; consider `maxBodyBytes` (TODO future). Default rejects
+ *   bodies > 256 KB silently (the request runs once but isn't replayable).
+ * - The pending-sentinel concurrency policy returns 409 immediately
+ *   instead of blocking. Stripe blocks; we don't, to keep the dependency
+ *   surface narrow. Most SDKs handle 409 with retry/backoff.
+ */
+const HEADER = "idempotency-key";
+const SENTINEL_PENDING = "__pending__";
+const DEFAULT_MAX_BODY_BYTES = 256 * 1024;
+function defaultKeyGenerator(c) {
+    const user = c.get("user");
+    return user?.id ? `user:${user.id}` : "anon";
+}
+function hashRequest(method, path, query, body) {
+    const h = createHash("sha256");
+    h.update(method);
+    h.update("|");
+    h.update(path);
+    h.update("|");
+    h.update(query);
+    h.update("|");
+    h.update(body);
+    return h.digest("hex");
+}
+function sortedQuery(c) {
+    const url = new URL(c.req.url);
+    const entries = [...url.searchParams.entries()];
+    entries.sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+    return entries.map(([k, v]) => `${k}=${v}`).join("&");
+}
+async function readRequestBody(c, max) {
+    if (c.req.method === "GET" || c.req.method === "HEAD") {
+        return { text: "", tooLarge: false };
+    }
+    // Hono caches the body — calling text() multiple times is safe.
+    const text = await c.req.text();
+    return { text, tooLarge: text.length > max };
+}
+export function idempotency(opts) {
+    const ttlSec = opts.ttlSec ?? 24 * 60 * 60;
+    const scope = opts.scope ?? "global";
+    const keyGen = opts.keyGenerator ?? defaultKeyGenerator;
+    const maxBodyBytes = opts.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
+    const log = opts.logger ?? defaultLogger;
+    const middleware = async (c, next) => {
+        const idemKey = c.req.header(HEADER);
+        if (!idemKey)
+            return next();
+        const actor = keyGen(c);
+        const cacheKey = `idempotency:${scope}:${actor}:${idemKey}`;
+        const { text: bodyText, tooLarge: requestTooLarge } = await readRequestBody(c, maxBodyBytes);
+        const requestHash = hashRequest(c.req.method, c.req.path, sortedQuery(c), bodyText);
+        // 1. Look up existing entry
+        const existing = await opts.cache.get(cacheKey);
+        if (existing === SENTINEL_PENDING) {
+            // Concurrent request with same key still in flight
+            throw new ConflictError("Idempotent request already in flight for this Idempotency-Key. Retry after a short delay.");
+        }
+        if (existing) {
+            const entry = existing;
+            if (entry.requestHash !== requestHash) {
+                // Different payload under the same key — Stripe returns 422
+                throw new IdempotencyKeyReusedError("Idempotency-Key was reused with a different request payload");
+            }
+            // Replay
+            log.debug({ idemKey: idemKey.slice(0, 8) }, "idempotency.replay");
+            const headers = new Headers(entry.headers);
+            headers.set("X-Idempotency-Replay", "true");
+            headers.set("X-Idempotency-Recorded-At", new Date(entry.recordedAt).toISOString());
+            if (entry.bodyTooLarge)
+                headers.set("X-Idempotency-Replay-Lost", "true");
+            return new Response(entry.body ?? "", {
+                status: entry.status,
+                headers,
+            });
+        }
+        // 2. Try to claim with a pending sentinel. Use a short TTL on the
+        //    sentinel so a crashed handler doesn't permanently block retries.
+        const claimed = await opts.cache.setIfAbsent(cacheKey, SENTINEL_PENDING, { ttlSec: 60 });
+        if (!claimed) {
+            // Lost the race — another request just landed. Treat as concurrent.
+            throw new ConflictError("Idempotent request already in flight for this Idempotency-Key. Retry after a short delay.");
+        }
+        // 3. Execute the handler. Hono's compose intercepts thrown errors and
+        //    routes them through `app.onError`, so by the time `await next()`
+        //    returns, c.res is the (possibly error-) response and c.error is
+        //    the original throw if any.
+        try {
+            await next();
+        }
+        catch (err) {
+            // Only reached if NO error handler is registered (vanilla Hono throw).
+            // Drop the sentinel so a retry can run again.
+            await opts.cache.del(cacheKey);
+            throw err;
+        }
+        const downstreamErr = c.error;
+        // Non-AppError downstream failure: this was an unexpected exception
+        // (probably a code defect). Don't replay it — drop the sentinel so a
+        // retry can run fresh, and let Hono surface the error response normally.
+        if (downstreamErr !== undefined && !(downstreamErr instanceof AppError)) {
+            await opts.cache.del(cacheKey);
+            return;
+        }
+        // Capture c.res for storage. AppErrors that flowed through
+        // `registerErrorHandlers` produce a real Response in c.res, so this
+        // works for both success and AppError paths — failures can be idempotent.
+        const responseClone = c.res.clone();
+        const bodyBuf = Buffer.from(await responseClone.arrayBuffer());
+        const responseTooLarge = bodyBuf.length > maxBodyBytes;
+        const headers = {};
+        c.res.headers.forEach((v, k) => {
+            headers[k] = v;
+        });
+        const entry = {
+            requestHash,
+            status: c.res.status,
+            headers,
+            body: responseTooLarge || requestTooLarge ? null : bodyBuf.toString("utf8"),
+            bodyTooLarge: responseTooLarge || requestTooLarge,
+            recordedAt: Date.now(),
+        };
+        // Replace the pending sentinel with the finalized entry.
+        await opts.cache.set(cacheKey, entry, { ttlSec });
+        // c.res already holds the handler's response.
+        return undefined;
+    };
+    const tag = { ttlSec, scope };
+    setMetaTag(middleware, IDEMPOTENCY_META, tag);
+    return middleware;
+}
+/**
+ * Thrown when an Idempotency-Key is reused with a different request payload.
+ * Stripe returns 422 here; we match.
+ */
+export class IdempotencyKeyReusedError extends AppError {
+    constructor(message = "Idempotency-Key was reused with a different request payload") {
+        super(message, 422, "IDEMPOTENCY_KEY_REUSED");
+    }
+}
+//# sourceMappingURL=idempotency.js.map

package/lib/http/middleware/idempotency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency.js","sourceRoot":"","sources":["../../../src/http/middleware/idempotency.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAwB,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAE1F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,MAAM,MAAM,GAAG,iBAAiB,CAAC;AACjC,MAAM,gBAAgB,GAAG,aAAa,CAAC;AACvC,MAAM,sBAAsB,GAAG,GAAG,GAAG,IAAI,CAAC;AAuC1C,SAAS,mBAAmB,CAAC,CAAU;IACrC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAe,CAAgC,CAAC;IACnE,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/C,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,IAAY,EAAE,KAAa,EAAE,IAAY;IAC5E,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACd,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACd,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACd,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACf,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,WAAW,CAAC,CAAU;IAC7B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,CAAU,EACV,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACtD,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACvC,CAAC;IACD,gEAAgE;IAChE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAChC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAwB;IAClD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,mBAAmB,CAAC;IACxD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,sBAAsB,CAAC;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC;IAEzC,MAAM,UAAU,GAAsB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACtD,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,EAAE,CAAC;QAE5B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,QAAQ,GAAG,eAAe,KAAK,IAAI,KAAK,IAAI,OAAO,EAAE,CAAC;QAE5D,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,eAAe,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QAC7F,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAEpF,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CACnC,QAAQ,CACT,CAAC;QAEF,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;YAClC,mDAAmD;YACnD,MAAM,IAAI,aAAa,CACrB,2FAA2F,CAC5F,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,QAAkC,CAAC;YACjD,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;gBACtC,4DAA4D;gBAC5D,MAAM,IAAI,yBAAyB,CACjC,6DAA6D,CAC9D,CAAC;YACJ,CAAC;YACD,SAAS;YACT,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,oBAAoB,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACnF,IAAI,KAAK,CAAC,YAAY;gBAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,MAAM,CAAC,CAAC;YACzE,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE;gBACpC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAED,kEAAkE;QAClE,sEAAsE;QACtE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE,gBAAgB,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,oEAAoE;YACpE,MAAM,IAAI,aAAa,CACrB,2FAA2F,CAC5F,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,sEAAsE;QACtE,qEAAqE;QACrE,gCAAgC;QAChC,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,uEAAuE;YACvE,8CAA8C;YAC9C,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC/B,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,aAAa,GAAI,CAAoC,CAAC,KAAK,CAAC;QAElE,oEAAoE;QACpE,qEAAqE;QACrE,yEAAyE;QACzE,IAAI,aAAa,KAAK,SAAS,IAAI,CAAC,CAAC,aAAa,YAAY,QAAQ,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,2DAA2D;QAC3D,oEAAoE;QACpE,0EAA0E;QAC1E,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/D,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,GAAG,YAAY,CAAC;QAEvD,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAC7B,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAA2B;YACpC,WAAW;YACX,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;YACpB,OAAO;YACP,IAAI,EAAE,gBAAgB,IAAI,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC3E,YAAY,EAAE,gBAAgB,IAAI,eAAe;YACjD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;SACvB,CAAC;QAEF,yDAAyD;QACzD,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAElD,8CAA8C;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,MAAM,GAAG,GAAoB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC/C,UAAU,CAAC,UAAU,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAE9C,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,yBAA0B,SAAQ,QAAQ;IACrD,YAAY,OAAO,GAAG,6DAA6D;QACjF,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;IAChD,CAAC;CACF"}