@sixthsummit/ship-api 0.0.0-stage → 4.1.1

package/lib/http/utils/validate.d.ts

@@ -0,0 +1,41 @@
+import type { MiddlewareHandler } from "hono";
+import type { ZodType } from "zod";
+/**
+ * Drop-in replacement for `@hono/zod-validator`'s `zValidator(...)` that
+ * additionally tags the returned middleware so `createApp`'s route-method
+ * interceptors can capture the schema in the route registry.
+ *
+ * Same call shape as `zValidator`:
+ *
+ * ```ts
+ * import { validate } from "@sixthsummit/ship-api/http/utils/validate";
+ *
+ * app.post(
+ *   '/accounts',
+ *   requireAuth(),
+ *   requirePermission('accounts:create'),
+ *   validate('json', createAccountSchema),
+ *   async (c) => {
+ *     const body = c.req.valid('json');   // typed via z.infer
+ *     ...
+ *   },
+ * );
+ * ```
+ *
+ * The function is generic over the validation target and the Zod schema so
+ * the typed middleware return flows through Hono's chain and `c.req.valid()`
+ * is fully typed downstream — matching `zValidator`'s native behavior.
+ *
+ * Validation errors throw `ValidationError` (preserving the framework's
+ * AppError taxonomy) so `app.onError(...)` produces the same response shape
+ * the v3 stack used. The first issue's `path` joins to a dotted name to
+ * match v3's `ValidationMiddleware` error message format.
+ */
+export declare function validate<Target extends "json" | "query" | "param" | "header", T extends ZodType>(target: Target, schema: T, meta?: {
+    description?: string;
+    example?: unknown;
+}): MiddlewareHandler<import("hono").Env, string, {
+    in: (undefined extends (T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never) ? true : false) extends true ? { [K in Target]?: ([T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never] extends [import("hono").ValidationTargets[K]] ? import("hono").ValidationTargets[K] & (T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never) : [Exclude<T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never, undefined>] extends [never] ? {} : [Exclude<T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never, undefined>] extends [object] ? undefined extends (T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never) ? ((T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never) & undefined) | (((Exclude<T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never, (T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never) & undefined> extends infer T_3 ? { [K_4 in keyof T_3]: ([Exclude<T_3[K_4], undefined>] extends [string] ? [string & Exclude<T_3[K_4], undefined>] extends [import("hono/utils/types").UnionToIntersection<string & Exclude<T_3[K_4], undefined>>] ? false : true : false) extends true ? T_3[K_4] : ([unknown] extends [T_3[K_4]] ? false : undefined extends T_3[K_4] ? true : false) extends true ? T_3[K_4] : Target_1 extends "form" ? T$1 | T$1[] : Target_1 extends "query" ? string | string[] : Target_1 extends "param" ? string : Target_1 extends "header" ? string : Target_1 extends "cookie" ? string : unknown; } : never) extends infer T_2 ? { [K_3 in keyof T_2]: T_2[K_3]; } : never) extends infer T_1 ? { [K_2 in keyof T_1]: T_1[K_2]; } : never) : (((T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never) extends infer T_6 ? { [K_7 in keyof T_6]: ([Exclude<T_6[K_7], undefined>] extends [string] ? [string & Exclude<T_6[K_7], undefined>] extends [import("hono/utils/types").UnionToIntersection<string & Exclude<T_6[K_7], undefined>>] ? false : true : false) extends true ? T_6[K_7] : ([unknown] extends [T_6[K_7]] ? false : undefined extends T_6[K_7] ? true : false) extends true ? T_6[K_7] : Target_1 extends "form" ? T$1 | T$1[] : Target_1 extends "query" ? string | string[] : Target_1 extends "param" ? string : Target_1 extends "header" ? string : Target_1 extends "cookie" ? string : unknown; } : never) extends infer T_5 ? { [K_6 in keyof T_5]: T_5[K_6]; } : never) extends infer T_4 ? { [K_5 in keyof T_4]: T_4[K_5]; } : never : {}) | undefined; } : { [K_1 in Target]: [T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never] extends [import("hono").ValidationTargets[K_1]] ? import("hono").ValidationTargets[K_1] & (T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never) : [Exclude<T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never, undefined>] extends [never] ? {} : [Exclude<T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never, undefined>] extends [object] ? undefined extends (T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never) ? ((T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never) & undefined) | (((Exclude<T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never, (T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never) & undefined> extends infer T_3 ? { [K_5 in keyof T_3]: ([Exclude<T_3[K_5], undefined>] extends [string] ? [string & Exclude<T_3[K_5], undefined>] extends [import("hono/utils/types").UnionToIntersection<string & Exclude<T_3[K_5], undefined>>] ? false : true : false) extends true ? T_3[K_5] : ([unknown] extends [T_3[K_5]] ? false : undefined extends T_3[K_5] ? true : false) extends true ? T_3[K_5] : Target_1 extends "form" ? T$1 | T$1[] : Target_1 extends "query" ? string | string[] : Target_1 extends "param" ? string : Target_1 extends "header" ? string : Target_1 extends "cookie" ? string : unknown; } : never) extends infer T_2 ? { [K_4 in keyof T_2]: T_2[K_4]; } : never) extends infer T_1 ? { [K_3 in keyof T_1]: T_1[K_3]; } : never) : (((T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never) extends infer T_6 ? { [K_8 in keyof T_6]: ([Exclude<T_6[K_8], undefined>] extends [string] ? [string & Exclude<T_6[K_8], undefined>] extends [import("hono/utils/types").UnionToIntersection<string & Exclude<T_6[K_8], undefined>>] ? false : true : false) extends true ? T_6[K_8] : ([unknown] extends [T_6[K_8]] ? false : undefined extends T_6[K_8] ? true : false) extends true ? T_6[K_8] : Target_1 extends "form" ? T$1 | T$1[] : Target_1 extends "query" ? string | string[] : Target_1 extends "param" ? string : Target_1 extends "header" ? string : Target_1 extends "cookie" ? string : unknown; } : never) extends infer T_5 ? { [K_7 in keyof T_5]: T_5[K_7]; } : never) extends infer T_4 ? { [K_6 in keyof T_4]: T_4[K_6]; } : never : {}; };
+    out: { [K_2 in Target]: T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").output<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod").infer<T> : never; };
+}, never>;
+//# sourceMappingURL=validate.d.ts.map

package/lib/http/utils/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../src/http/utils/validate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAY,OAAO,EAAE,MAAM,KAAK,CAAC;AAM7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,QAAQ,CAAC,MAAM,SAAS,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,EAAE,CAAC,SAAS,OAAO,EAC9F,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,CAAC,EACT,IAAI,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE;;;UAsBnD"}

package/lib/http/utils/validate.js

@@ -0,0 +1,55 @@
+import { zValidator as honoZodValidator } from "@hono/zod-validator";
+import { ValidationError } from "../errors/ValidationError.js";
+import { SCHEMA_META, setMetaTag } from "./metaTags.js";
+/**
+ * Drop-in replacement for `@hono/zod-validator`'s `zValidator(...)` that
+ * additionally tags the returned middleware so `createApp`'s route-method
+ * interceptors can capture the schema in the route registry.
+ *
+ * Same call shape as `zValidator`:
+ *
+ * ```ts
+ * import { validate } from "@sixthsummit/ship-api/http/utils/validate";
+ *
+ * app.post(
+ *   '/accounts',
+ *   requireAuth(),
+ *   requirePermission('accounts:create'),
+ *   validate('json', createAccountSchema),
+ *   async (c) => {
+ *     const body = c.req.valid('json');   // typed via z.infer
+ *     ...
+ *   },
+ * );
+ * ```
+ *
+ * The function is generic over the validation target and the Zod schema so
+ * the typed middleware return flows through Hono's chain and `c.req.valid()`
+ * is fully typed downstream — matching `zValidator`'s native behavior.
+ *
+ * Validation errors throw `ValidationError` (preserving the framework's
+ * AppError taxonomy) so `app.onError(...)` produces the same response shape
+ * the v3 stack used. The first issue's `path` joins to a dotted name to
+ * match v3's `ValidationMiddleware` error message format.
+ */
+export function validate(target, schema, meta) {
+    const middleware = honoZodValidator(target, schema, ((result) => {
+        if (!result.success) {
+            const first = result.error.issues[0];
+            const path = first?.path?.length ? first.path.join(".") : target;
+            const message = first?.message ?? "Invalid request";
+            throw new ValidationError(`${path}: ${message}`);
+        }
+    }));
+    const tag = {
+        target,
+        schema,
+        description: meta?.description,
+        example: meta?.example,
+    };
+    // Cast for the side effect — setMetaTag accepts the bare MiddlewareHandler
+    // shape; the typed return below keeps zValidator's full generics.
+    setMetaTag(middleware, SCHEMA_META, tag);
+    return middleware;
+}
+//# sourceMappingURL=validate.js.map

package/lib/http/utils/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../../src/http/utils/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,IAAI,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAGrE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAmB,UAAU,EAAE,MAAM,eAAe,CAAC;AAIzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,QAAQ,CACtB,MAAc,EACd,MAAS,EACT,IAAkD;IAElD,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAuB,EAAE,EAAE;QAC/E,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YACjE,MAAM,OAAO,GAAG,KAAK,EAAE,OAAO,IAAI,iBAAiB,CAAC;YACpD,MAAM,IAAI,eAAe,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC,CAAU,CAAC,CAAC;IAEb,MAAM,GAAG,GAAe;QACtB,MAAM;QACN,MAAM;QACN,WAAW,EAAE,IAAI,EAAE,WAAW;QAC9B,OAAO,EAAE,IAAI,EAAE,OAAO;KACvB,CAAC;IACF,2EAA2E;IAC3E,kEAAkE;IAClE,UAAU,CAAC,UAA+B,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IAE9D,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/lib/http/utils/webhooks.d.ts

@@ -0,0 +1,63 @@
+import type { Context } from "hono";
+/**
+ * `parseWebhook(c, { provider, secret })` — verify a webhook signature and
+ * return the parsed payload + raw body.
+ *
+ * Replaces ad-hoc Express `express.raw()` patterns. Reads
+ * `await c.req.text()` to preserve the *exact* bytes the sender signed —
+ * Hono caches the body so subsequent calls work too.
+ *
+ * Built-in providers: `stripe`, `github`, `slack`. For others, pass a
+ * custom `WebhookVerifier`. Twilio's URL+form-fields scheme requires the
+ * full request URL plus form-encoding context; out-of-scope for v4.0 — a
+ * v4.x adapter lands when first needed.
+ *
+ * Replay protection (where the provider exposes a timestamp): rejects
+ * requests where the timestamp is more than ~5 minutes off from now.
+ *
+ * On signature mismatch, throws `AuthenticationError` (mapped by
+ * `registerErrorHandlers` to 401).
+ */
+export interface WebhookVerifyArgs {
+    rawBody: string;
+    headers: Readonly<Record<string, string | undefined>>;
+    secret: string;
+    /** Current epoch ms; injected for deterministic tests. */
+    now?: number;
+}
+export type WebhookVerifyResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+export interface WebhookVerifier {
+    readonly name: string;
+    verify(args: WebhookVerifyArgs): WebhookVerifyResult;
+}
+export declare const stripeVerifier: WebhookVerifier;
+export declare const githubVerifier: WebhookVerifier;
+export declare const slackVerifier: WebhookVerifier;
+declare const BUILT_IN_VERIFIERS: Record<string, WebhookVerifier>;
+export type BuiltInProvider = keyof typeof BUILT_IN_VERIFIERS;
+export interface ParseWebhookOptions {
+    /** Built-in provider name OR a custom WebhookVerifier. */
+    provider: BuiltInProvider | WebhookVerifier;
+    secret: string;
+    /**
+     * Parse the verified body. Default `JSON.parse`. Returns the raw text
+     * unparsed if `parse: false`.
+     */
+    parse?: ((rawBody: string) => unknown) | false;
+}
+export interface ParseWebhookResult<T = unknown> {
+    rawBody: string;
+    payload: T;
+}
+/**
+ * Verify the webhook signature, then return raw body + parsed payload.
+ * Throws `AuthenticationError` on signature mismatch.
+ */
+export declare function parseWebhook<T = unknown>(c: Context, opts: ParseWebhookOptions): Promise<ParseWebhookResult<T>>;
+export {};
+//# sourceMappingURL=webhooks.d.ts.map

package/lib/http/utils/webhooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../../../src/http/utils/webhooks.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAIpC;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IACtD,MAAM,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,mBAAmB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,IAAI,EAAE,iBAAiB,GAAG,mBAAmB,CAAC;CACtD;AAmBD,eAAO,MAAM,cAAc,EAAE,eA4B5B,CAAC;AAOF,eAAO,MAAM,cAAc,EAAE,eAe5B,CAAC;AAOF,eAAO,MAAM,aAAa,EAAE,eAwB3B,CAAC;AAEF,QAAA,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAIvD,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,MAAM,OAAO,kBAAkB,CAAC;AAE9D,MAAM,WAAW,mBAAmB;IAClC,0DAA0D;IAC1D,QAAQ,EAAE,eAAe,GAAG,eAAe,CAAC;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,KAAK,CAAC;CAChD;AAED,MAAM,WAAW,kBAAkB,CAAC,CAAC,GAAG,OAAO;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,CAAC,CAAC;CACZ;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,CAAC,GAAG,OAAO,EAC5C,CAAC,EAAE,OAAO,EACV,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAoChC"}

package/lib/http/utils/webhooks.js

@@ -0,0 +1,133 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { AuthenticationError } from "../errors/AuthenticationError.js";
+import { BadRequestError } from "../errors/BadRequestError.js";
+const REPLAY_WINDOW_MS = 5 * 60 * 1000;
+function safeEqualHex(a, b) {
+    const aBuf = Buffer.from(a, "hex");
+    const bBuf = Buffer.from(b, "hex");
+    if (aBuf.length !== bBuf.length || aBuf.length === 0) {
+        timingSafeEqual(aBuf, aBuf);
+        return false;
+    }
+    return timingSafeEqual(aBuf, bBuf);
+}
+// ─────────────────────────────────────────────────────────────────────────
+// Stripe — `Stripe-Signature: t=<ts>,v1=<sig>[,v0=<sig>]`
+//   sig = HMAC-SHA256(<ts>.<rawBody>) using endpoint secret
+// ─────────────────────────────────────────────────────────────────────────
+export const stripeVerifier = {
+    name: "stripe",
+    verify({ rawBody, headers, secret, now = Date.now() }) {
+        const sigHeader = headers["stripe-signature"];
+        if (!sigHeader)
+            return { ok: false, reason: "Missing Stripe-Signature header" };
+        const parts = Object.fromEntries(sigHeader.split(",").map((p) => {
+            const [k, v] = p.split("=");
+            return [k?.trim(), v?.trim()];
+        }));
+        const ts = parts.t;
+        const v1 = parts.v1;
+        if (!ts || !v1)
+            return { ok: false, reason: "Stripe signature missing t / v1" };
+        const tsMs = Number.parseInt(ts, 10) * 1000;
+        if (!Number.isFinite(tsMs) || Math.abs(now - tsMs) > REPLAY_WINDOW_MS) {
+            return { ok: false, reason: "Stripe signature timestamp outside tolerance" };
+        }
+        const expected = createHmac("sha256", secret).update(`${ts}.${rawBody}`).digest("hex");
+        if (!safeEqualHex(expected, v1)) {
+            return { ok: false, reason: "Stripe signature mismatch" };
+        }
+        return { ok: true };
+    },
+};
+// ─────────────────────────────────────────────────────────────────────────
+// GitHub — `X-Hub-Signature-256: sha256=<hex>`
+//   sig = HMAC-SHA256(rawBody) using webhook secret
+// ─────────────────────────────────────────────────────────────────────────
+export const githubVerifier = {
+    name: "github",
+    verify({ rawBody, headers, secret }) {
+        const header = headers["x-hub-signature-256"];
+        if (!header)
+            return { ok: false, reason: "Missing X-Hub-Signature-256 header" };
+        if (!header.startsWith("sha256=")) {
+            return { ok: false, reason: "X-Hub-Signature-256 not in 'sha256=<hex>' form" };
+        }
+        const presented = header.slice("sha256=".length);
+        const expected = createHmac("sha256", secret).update(rawBody).digest("hex");
+        if (!safeEqualHex(expected, presented)) {
+            return { ok: false, reason: "GitHub signature mismatch" };
+        }
+        return { ok: true };
+    },
+};
+// ─────────────────────────────────────────────────────────────────────────
+// Slack — `X-Slack-Signature: v0=<hex>`, `X-Slack-Request-Timestamp: <ts>`
+//   sig = HMAC-SHA256(`v0:${ts}:${rawBody}`) using signing secret
+// ─────────────────────────────────────────────────────────────────────────
+export const slackVerifier = {
+    name: "slack",
+    verify({ rawBody, headers, secret, now = Date.now() }) {
+        const sig = headers["x-slack-signature"];
+        const ts = headers["x-slack-request-timestamp"];
+        if (!sig)
+            return { ok: false, reason: "Missing X-Slack-Signature header" };
+        if (!ts)
+            return { ok: false, reason: "Missing X-Slack-Request-Timestamp header" };
+        if (!sig.startsWith("v0=")) {
+            return { ok: false, reason: "X-Slack-Signature not in 'v0=<hex>' form" };
+        }
+        const tsMs = Number.parseInt(ts, 10) * 1000;
+        if (!Number.isFinite(tsMs) || Math.abs(now - tsMs) > REPLAY_WINDOW_MS) {
+            return { ok: false, reason: "Slack signature timestamp outside tolerance" };
+        }
+        const presented = sig.slice("v0=".length);
+        const expected = createHmac("sha256", secret).update(`v0:${ts}:${rawBody}`).digest("hex");
+        if (!safeEqualHex(expected, presented)) {
+            return { ok: false, reason: "Slack signature mismatch" };
+        }
+        return { ok: true };
+    },
+};
+const BUILT_IN_VERIFIERS = {
+    stripe: stripeVerifier,
+    github: githubVerifier,
+    slack: slackVerifier,
+};
+/**
+ * Verify the webhook signature, then return raw body + parsed payload.
+ * Throws `AuthenticationError` on signature mismatch.
+ */
+export async function parseWebhook(c, opts) {
+    const verifier = typeof opts.provider === "string" ? BUILT_IN_VERIFIERS[opts.provider] : opts.provider;
+    if (!verifier) {
+        throw new Error(`parseWebhook: unknown provider "${opts.provider}"`);
+    }
+    const rawBody = await c.req.text();
+    const headers = {};
+    c.req.raw.headers.forEach((value, key) => {
+        headers[key.toLowerCase()] = value;
+    });
+    const result = verifier.verify({ rawBody, headers, secret: opts.secret });
+    if (!result.ok) {
+        throw new AuthenticationError(`Webhook signature invalid: ${result.reason}`);
+    }
+    // F18: catch parse failures *after* the signature passes so a
+    // bad body surfaces as 400 (BadRequestError) rather than the
+    // unhandled 500 that would otherwise leak via the framework
+    // error pipeline. There's no oracle here — the signature still
+    // had to verify for control to reach this point.
+    const parser = opts.parse === false ? null : (opts.parse ?? JSON.parse);
+    if (!parser) {
+        return { rawBody, payload: rawBody };
+    }
+    let payload;
+    try {
+        payload = parser(rawBody);
+    }
+    catch (err) {
+        throw new BadRequestError(`Webhook payload is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return { rawBody, payload };
+}
+//# sourceMappingURL=webhooks.js.map

package/lib/http/utils/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../../src/http/utils/webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAqC/D,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvC,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,4EAA4E;AAC5E,0DAA0D;AAC1D,4DAA4D;AAC5D,4EAA4E;AAE5E,MAAM,CAAC,MAAM,cAAc,GAAoB;IAC7C,IAAI,EAAE,QAAQ;IACd,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE;QACnD,MAAM,SAAS,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;QAEhF,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAC9B,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC7B,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5B,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAChC,CAAC,CAAC,CACH,CAAC;QACF,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;QACnB,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;QACpB,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;QAEhF,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,gBAAgB,EAAE,CAAC;YACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;QAC/E,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEvF,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;QAC5D,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;CACF,CAAC;AAEF,4EAA4E;AAC5E,+CAA+C;AAC/C,oDAAoD;AACpD,4EAA4E;AAE5E,MAAM,CAAC,MAAM,cAAc,GAAoB;IAC7C,IAAI,EAAE,QAAQ;IACd,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE;QACjC,MAAM,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;QAChF,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gDAAgD,EAAE,CAAC;QACjF,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5E,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;QAC5D,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;CACF,CAAC;AAEF,4EAA4E;AAC5E,2EAA2E;AAC3E,kEAAkE;AAClE,4EAA4E;AAE5E,MAAM,CAAC,MAAM,aAAa,GAAoB;IAC5C,IAAI,EAAE,OAAO;IACb,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE;QACnD,MAAM,GAAG,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACzC,MAAM,EAAE,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;QAC3E,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;QAClF,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;QAC3E,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,gBAAgB,EAAE,CAAC;YACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC;QAC9E,CAAC;QAED,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE1F,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;QAC3D,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;CACF,CAAC;AAEF,MAAM,kBAAkB,GAAoC;IAC1D,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,cAAc;IACtB,KAAK,EAAE,aAAa;CACrB,CAAC;AAoBF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,CAAU,EACV,IAAyB;IAEzB,MAAM,QAAQ,GACZ,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;IACxF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,CAAC,QAAkB,GAAG,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,OAAO,GAAuC,EAAE,CAAC;IACvD,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACvC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,mBAAmB,CAAC,8BAA8B,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,8DAA8D;IAC9D,6DAA6D;IAC7D,4DAA4D;IAC5D,+DAA+D;IAC/D,iDAAiD;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAuB,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,OAAU,CAAC;IACf,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,OAAO,CAAM,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CACvB,sCAAsC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACzF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC"}

package/lib/http/ws/auth.d.ts

@@ -0,0 +1,46 @@
+import type { AuthenticatedAccount, AuthProvider } from "../../app/auth/AuthProvider.js";
+export interface WsAuthExtractResult {
+    /** All subprotocols the client presented, in order. */
+    protocols: string[];
+    /** The bearer token (without the `bearer.` prefix), if present. */
+    bearerToken: string | null;
+    /** First non-bearer subprotocol — what the server should echo back. */
+    selectedSubprotocol: string | null;
+}
+/**
+ * Parse the `Sec-WebSocket-Protocol` header value into the framework's
+ * subprotocol-auth shape.
+ */
+export declare function extractWsAuth(headerValue: string | string[] | undefined): WsAuthExtractResult;
+export interface AuthenticateWsUpgradeArgs<TAccount extends AuthenticatedAccount = AuthenticatedAccount> {
+    /** All upgrade-request headers, lower-cased keys. */
+    headers: Readonly<Record<string, string | undefined>>;
+    provider: AuthProvider<TAccount>;
+    /**
+     * If `true`, missing-token connections are admitted (account=null).
+     * Present-but-bad tokens still reject — same semantics as `requireAuth`.
+     */
+    optional?: boolean;
+}
+export type AuthenticateWsUpgradeResult<TAccount extends AuthenticatedAccount = AuthenticatedAccount> = {
+    ok: true;
+    /** Resolved Account, or `null` when `optional: true` and no token was supplied. */
+    account: TAccount | null;
+    /** First non-bearer subprotocol — the server echoes this. */
+    selectedSubprotocol: string | null;
+    /** Verified claims (when ok). */
+    claims: import("../../app/auth/AuthProvider.js").AuthClaims | null;
+} | {
+    ok: false;
+    /** 401 (auth failure) or 403 (account not registered). */
+    status: 401 | 403;
+    reason: string;
+};
+/**
+ * Run the AuthProvider chain against a WebSocket upgrade request. Pure —
+ * does not touch the underlying socket. The caller is responsible for
+ * accepting (with `Sec-WebSocket-Protocol: <selectedSubprotocol>`) or
+ * rejecting (with `status`) based on the returned verdict.
+ */
+export declare function authenticateWsUpgrade<TAccount extends AuthenticatedAccount = AuthenticatedAccount>(args: AuthenticateWsUpgradeArgs<TAccount>): Promise<AuthenticateWsUpgradeResult<TAccount>>;
+//# sourceMappingURL=auth.d.ts.map

package/lib/http/ws/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/http/ws/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,YAAY,EAEb,MAAM,gCAAgC,CAAC;AA0CxC,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,mEAAmE;IACnE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,uEAAuE;IACvE,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GAAG,mBAAmB,CA6B7F;AAED,MAAM,WAAW,yBAAyB,CACxC,QAAQ,SAAS,oBAAoB,GAAG,oBAAoB;IAE5D,qDAAqD;IACrD,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IACtD,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,MAAM,2BAA2B,CACrC,QAAQ,SAAS,oBAAoB,GAAG,oBAAoB,IAE1D;IACE,EAAE,EAAE,IAAI,CAAC;IACT,mFAAmF;IACnF,OAAO,EAAE,QAAQ,GAAG,IAAI,CAAC;IACzB,6DAA6D;IAC7D,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,iCAAiC;IACjC,MAAM,EAAE,OAAO,gCAAgC,EAAE,UAAU,GAAG,IAAI,CAAC;CACpE,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,0DAA0D;IAC1D,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEN;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,SAAS,oBAAoB,GAAG,oBAAoB,EAC5D,IAAI,EAAE,yBAAyB,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,2BAA2B,CAAC,QAAQ,CAAC,CAAC,CAoD3F"}

package/lib/http/ws/auth.js

@@ -0,0 +1,123 @@
+/**
+ * WebSocket subprotocol-header authentication — the locked v4 default.
+ *
+ * Clients open with two subprotocols: a versioning marker (e.g.
+ * `ship-api.v1`) and a credential (`bearer.<token>`):
+ *
+ * ```ts
+ * new WebSocket(url, ["ship-api.v1", `bearer.${token}`]);
+ * ```
+ *
+ * The server parses the `Sec-WebSocket-Protocol` header during the upgrade
+ * handshake (BEFORE the connection is established), runs the configured
+ * `AuthProvider` chain, attaches the resolved Account to `ws.data`, and
+ * responds with `Sec-WebSocket-Protocol: ship-api.v1` to confirm. Failed
+ * auth rejects the upgrade with 401 — there's no "connected but
+ * unauthenticated" intermediate state.
+ *
+ * Why subprotocol over alternatives — documented in
+ * `.cursor/rules/security.mdc`:
+ *   - URL token (`?token=...`): leaks into server / proxy / browser logs.
+ *   - Cookie auth: same-origin web only; breaks RN+Expo and any future
+ *     cross-origin client.
+ *   - First-message handshake: introduces an authenticated-but-resourceful
+ *     window before auth completes; footgun.
+ *   - Subprotocol header: proper Authorization-header semantics, no
+ *     leakage, no intermediate state, supported by every WS client
+ *     (including React Native's). Adopted.
+ *
+ * **Operator note**: some load balancers and proxies log the
+ * `Sec-WebSocket-Protocol` header. Firebase ID tokens are short-lived
+ * (~1 h) which bounds the leakage window, but operators should configure
+ * proxies to redact this header where possible.
+ *
+ * This file is the auth-extraction primitive — testable in isolation.
+ * The full `upgradeWebSocket` integration with `@hono/node-ws` lives in
+ * `wsAdapter.ts` (v4.x; lands when there's a concrete consumer).
+ */
+const BEARER_PREFIX = "bearer.";
+/**
+ * Parse the `Sec-WebSocket-Protocol` header value into the framework's
+ * subprotocol-auth shape.
+ */
+export function extractWsAuth(headerValue) {
+    const raw = Array.isArray(headerValue) ? headerValue.join(",") : (headerValue ?? "");
+    const protocols = raw
+        .split(",")
+        .map((p) => p.trim())
+        .filter(Boolean);
+    let bearerToken = null;
+    let selectedSubprotocol = null;
+    for (const proto of protocols) {
+        // Case-insensitive prefix detection. F21: slice from the literal
+        // prefix length; this is safe because every case variant of
+        // `bearer.` is exactly the same ASCII length (7), so the
+        // case-folded match position equals the original-string slice
+        // index. A future prefix change to anything non-ASCII (or any
+        // case-folding that changes string length) would break this
+        // invariant and require switching to a regex-based extractor.
+        if (proto.toLowerCase().startsWith(BEARER_PREFIX)) {
+            // Use the FIRST bearer subprotocol; ignore subsequent ones.
+            if (bearerToken === null) {
+                bearerToken = proto.slice(BEARER_PREFIX.length);
+            }
+        }
+        else if (selectedSubprotocol === null) {
+            selectedSubprotocol = proto;
+        }
+    }
+    return { protocols, bearerToken, selectedSubprotocol };
+}
+/**
+ * Run the AuthProvider chain against a WebSocket upgrade request. Pure —
+ * does not touch the underlying socket. The caller is responsible for
+ * accepting (with `Sec-WebSocket-Protocol: <selectedSubprotocol>`) or
+ * rejecting (with `status`) based on the returned verdict.
+ */
+export async function authenticateWsUpgrade(args) {
+    const { bearerToken, selectedSubprotocol } = extractWsAuth(args.headers["sec-websocket-protocol"]);
+    if (!bearerToken) {
+        if (args.optional) {
+            return { ok: true, account: null, selectedSubprotocol, claims: null };
+        }
+        return { ok: false, status: 401, reason: "Missing bearer.<token> subprotocol" };
+    }
+    const ctx = {
+        headers: args.headers,
+        rawCredential: bearerToken,
+    };
+    const verifyResult = await args.provider.verify(ctx);
+    if (!verifyResult.ok) {
+        if (verifyResult.reason === "missing-token" && args.optional) {
+            return { ok: true, account: null, selectedSubprotocol, claims: null };
+        }
+        return {
+            ok: false,
+            status: 401,
+            reason: verifyResult.message ?? `Authentication failed (${verifyResult.reason})`,
+        };
+    }
+    const account = await args.provider.resolve(verifyResult.claims);
+    if (account === null) {
+        if (args.provider.onUnknownAccount === "next") {
+            return {
+                ok: true,
+                account: null,
+                selectedSubprotocol,
+                claims: verifyResult.claims,
+            };
+        }
+        return {
+            ok: false,
+            status: 403,
+            reason: "No account registered for this credential",
+        };
+    }
+    return {
+        ok: true,
+        account,
+        selectedSubprotocol,
+        claims: verifyResult.claims,
+    };
+}
+//# sourceMappingURL=auth.js.map

package/lib/http/ws/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/http/ws/auth.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,MAAM,aAAa,GAAG,SAAS,CAAC;AAWhC;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,WAA0C;IACtE,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IACrF,MAAM,SAAS,GAAG,GAAG;SAClB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IAEnB,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,mBAAmB,GAAkB,IAAI,CAAC;IAE9C,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,iEAAiE;QACjE,4DAA4D;QAC5D,yDAAyD;QACzD,8DAA8D;QAC9D,8DAA8D;QAC9D,4DAA4D;QAC5D,8DAA8D;QAC9D,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAClD,4DAA4D;YAC5D,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;gBACzB,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;aAAM,IAAI,mBAAmB,KAAK,IAAI,EAAE,CAAC;YACxC,mBAAmB,GAAG,KAAK,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;AACzD,CAAC;AAkCD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAEzC,IAAyC;IACzC,MAAM,EAAE,WAAW,EAAE,mBAAmB,EAAE,GAAG,aAAa,CACxD,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,CACvC,CAAC;IAEF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACxE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;IAClF,CAAC;IAED,MAAM,GAAG,GAAwB;QAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,WAAW;KAC3B,CAAC;IAEF,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,IAAI,YAAY,CAAC,MAAM,KAAK,eAAe,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACxE,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,MAAM,EAAE,YAAY,CAAC,OAAO,IAAI,0BAA0B,YAAY,CAAC,MAAM,GAAG;SACjF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACjE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,KAAK,MAAM,EAAE,CAAC;YAC9C,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,OAAO,EAAE,IAAI;gBACb,mBAAmB;gBACnB,MAAM,EAAE,YAAY,CAAC,MAAM;aAC5B,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,MAAM,EAAE,2CAA2C;SACpD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO;QACP,mBAAmB;QACnB,MAAM,EAAE,YAAY,CAAC,MAAM;KAC5B,CAAC;AACJ,CAAC"}

package/lib/index.d.ts

@@ -0,0 +1,80 @@
+/**
+ * `@sixthsummit/ship-api` — public API barrel for ShipAPI v4.
+ *
+ * This is the canonical entry point for consumer apps. The framework
+ * exports a curated, semver-stable surface here; deep-path imports
+ * (`@sixthsummit/ship-api/http/middleware/...`) are still available
+ * but NOT covered by semver — they're for internal cross-module use
+ * and advanced consumers who need primitives the barrel doesn't yet
+ * surface.
+ *
+ * The `@sixthsummit/ship-api/client` subpath remains a separate
+ * lightweight bundle for typed-client consumers (web / mobile) that
+ * shouldn't pull in the framework's runtime deps. Import from there:
+ *
+ *   import { hc } from "@sixthsummit/ship-api/client";
+ *   import type { ShipApiClient } from "@my-org/api";
+ */
+export type { AccessGraphNode, ActorResolution, ActorResolutionFailure, ActorResolutionFailureReason, ActorResolutionRequest, ActorResolutionResult, ActorResolver, ActorResolverDefinition, AnyModule, AnyOperation, AnyProvider, ApplicationDefinition, ApplicationDiagnostic, ApplicationDiagnosticCode, ApplicationExecutor, ApplicationGraph, ApplicationModuleMap, ApplicationOperationMap, ApplicationProviderMap, AuthenticatedAccess, CompiledApplication, DependencyBindings, DependencyGraphNode, DependencyProviderValue, DependencyToken, EffectDependencyToken, EffectGraphNode, ExplicitOperationResponse, FrameworkOperationFailure, InferOperationInput, InferOperationOutputs, InferOperationRawInput, InferSchemaInput, InferSchemaOutput, LegacyOperationActor, ModuleDefinition, ModuleDiagnosticCode, ModuleGraphNode, NormalizedActorResolution, Operation, OperationAccess, OperationActor, OperationActorInput, OperationContext, OperationContextForAccess, OperationDefinition, OperationDefinitionDiagnosticCode, OperationErrorDefinition, OperationErrorDetails, OperationErrorDetailsInput, OperationErrorGraphNode, OperationErrorPayload, OperationExecutionDiagnosticCode, OperationExecutionResult, OperationFailureOptions, OperationFailureResult, OperationGraphNode, OperationHandler, OperationHandlerArguments, OperationHandlerResult, OperationId, OperationIdentity, OperationInputSchemas, OperationOutputSchemas, OperationOutputStatus, OperationRawInput, OperationResponse, OperationRunOptions, OperationSuccessResult, OperationTransactionMode, OperationTransport, OperationTransportMetadata, OperationTransportMetadataPrimitive, OperationTransportMetadataValue, OptionalIdentityAccess, OutputSchemaGraphNode, PermissionAccess, Provider, ProviderDefinition, ProviderDiagnosticCode, ProviderFactoryArguments, ProviderGraphNode, ProviderLifetime, PublicAccess, ResolveDependencyBindings, RuntimeSchema, SchemaGraphNode, SchemaIssue, SchemaResult, ShipModule, TenantBypass, TenantBypassAuditEvent, TenantBypassAuditSink, TenantBypassAuthority, TenantBypassRequest, TenantCapabilityErrorCode, TenantIdentifier, TenantScope, TenantScopeAuthority, TenantScopeRequest, TransportGraphNode, UnitOfWork, UnitOfWorkDependencyToken, ValidationIssue, } from "./kernel/index.js";
+export { ApplicationCompilationError, anyPermission, authenticatedAccess, checkOperationAccess, compileApp, createExecutor, createTenantBypassAuthority, createTenantScopeAuthority, defineActorResolver, defineApp, defineModule, defineOperation, defineProvider, dependency, effectDependency, InvalidModuleDefinitionError, InvalidOperationDefinitionError, InvalidProviderDefinitionError, isActorResolution, isActorResolver, isEffectDependencyToken, isExplicitOperationResponse, isOperationActor, isOperationIdentity, isTenantBypass, isTenantScope, isUnitOfWork, isUnitOfWorkDependencyToken, normalizeActorResolution, normalizeOperationActor, OperationExecutionError, OperationFailure, operationActor, operationError, operationFailure, operationIdentity, optionalIdentityAccess, permission, permissionSnapshot, publicAccess, respond, TenantCapabilityError, unitOfWorkDependency, valueProvider, } from "./kernel/index.js";
+export type { PermissionDefinition } from "./app/auth/permissionDefinition.js";
+export type { CreateHonoAdapterOptions, HeaderCredential, HonoAdapterDiagnosticCode, HonoAuthenticationOptions, HonoCredentialAdapter, HonoUnexpectedErrorContext, HttpJsonBodyPolicy, HttpMethod, HttpMultipartBodyOptions, HttpMultipartBodyPolicy, HttpRawBodyOptions, HttpRawBodyPolicy, HttpRequestBodyPolicy, HttpResponseMode, HttpTransport, HttpTransportOptions, ShipHttpErrorEnvelope, } from "./hono/index.js";
+export { createHonoAdapter, defineHonoCredentialAdapter, HonoAdapterError, honoAuthProvider, http, InvalidHttpTransportError, isHonoCredentialAdapter, isHttpTransport, requestHeadersCredential, } from "./hono/index.js";
+export type { AppEnv, AppEnvVariables, CorsOptions, CreateAppOptions, CreateModuleAppOptions, } from "./http/app/createApp.js";
+export { createApp, createModuleApp } from "./http/app/createApp.js";
+export type { ErrorResponseShape, RegisterErrorHandlersOptions } from "./http/app/errors.js";
+export { registerErrorHandlers } from "./http/app/errors.js";
+export type { ApiKeyOptions } from "./http/middleware/apiKey.js";
+export { apiKey } from "./http/middleware/apiKey.js";
+export type { CsrfOptions } from "./http/middleware/csrf.js";
+export { csrf } from "./http/middleware/csrf.js";
+export type { HttpLoggerOptions } from "./http/middleware/httpLogger.js";
+export { httpLogger } from "./http/middleware/httpLogger.js";
+export type { IdempotencyOptions } from "./http/middleware/idempotency.js";
+export { idempotency } from "./http/middleware/idempotency.js";
+export type { RateLimitOptions } from "./http/middleware/rateLimit.js";
+export { rateLimit } from "./http/middleware/rateLimit.js";
+export type { RequireAuthOptions } from "./http/middleware/requireAuth.js";
+export { AUTH_CONTEXT_KEYS, requireAuth } from "./http/middleware/requireAuth.js";
+export { requirePermission } from "./http/middleware/requirePermission.js";
+export type { ResolveTenantOptions } from "./http/middleware/resolveTenant.js";
+export { resolveTenant } from "./http/middleware/resolveTenant.js";
+export type { StreamSSEOptions } from "./http/streaming/sse.js";
+export { streamSSE } from "./http/streaming/sse.js";
+export { streamLLM } from "./http/streaming/streamLLM.js";
+export { parseUpload } from "./http/utils/uploads.js";
+export { validate } from "./http/utils/validate.js";
+export { parseWebhook } from "./http/utils/webhooks.js";
+export { AppError, AuthenticationError, AuthorizationError, BadRequestError, ConflictError, InternalServerError, NotFoundError, RateLimitError, ServiceUnavailableError, ValidationError, } from "./http/errors/index.js";
+export type { AccountResolver, AuthClaims, AuthenticatedAccount, AuthProvider, AuthVerifyResult, } from "./app/auth/AuthProvider.js";
+export { FirebaseAuthProvider, firebaseAuth } from "./app/auth/adapters/firebase.js";
+export type { RequestContext } from "./app/context/RequestContext.js";
+export { getRequestContext } from "./app/context/RequestContext.js";
+export type { BaseFields } from "./app/db/baseFields.js";
+export { baseFields, baseFieldsTimestampsOnly } from "./app/db/baseFields.js";
+export type { ColumnFilter, OrderClause, QueryOperator, QueryOptions, } from "./app/db/QueryOptions.js";
+export { isQueryOperator, QUERY_OPERATORS } from "./app/db/QueryOptions.js";
+export type { TenantScoped } from "./app/db/tenantScoped.js";
+export { tenantScoped } from "./app/db/tenantScoped.js";
+export type { ShipTx, WithTransactionOptions } from "./app/db/transaction.js";
+export { RollbackError, withTransaction } from "./app/db/transaction.js";
+export { DrizzleEntityService } from "./app/services/DrizzleEntityService.js";
+export type { LifecycleHookContext, LifecycleHooks, QueryFilter, } from "./app/services/hooks/LifecycleHooks.js";
+export { composeHooks } from "./app/services/hooks/LifecycleHooks.js";
+export type { Cache, CacheSetOptions, InMemoryCacheOptions } from "./app/services/cache/index.js";
+export { cached, InMemoryCache, RedisCache } from "./app/services/cache/index.js";
+export { RedisProvider } from "./app/services/RedisProvider.js";
+export type { JobDefinition, JobDefinitionOptions, JobHandler, JobHandlerContext, JobsManagerOptions, WorkerMode, } from "./app/services/jobs/index.js";
+export { defineJob, JobRegistry, JobsManager, jobRegistry } from "./app/services/jobs/index.js";
+export type { DefineCronArgs } from "./app/services/cron/index.js";
+export { CRON_QUEUE, defineCron } from "./app/services/cron/index.js";
+export type { AddHealthCheckOptions, HealthCheck, HealthCheckFailure, HealthCheckResult, RunAllOptions, RunAllResult, } from "./app/health/HealthCheck.js";
+export { HealthCheckRegistry, healthCheckRegistry } from "./app/health/HealthCheck.js";
+export { redisHealthCheck } from "./app/health/redisHealthCheck.js";
+export type { ReadyzBody, ReadyzCheck, RegisterHealthRoutesOptions, } from "./http/app/health.js";
+export { hasHealthRoutes, registerHealthRoutes } from "./http/app/health.js";
+export type { RouteEntry } from "./app/registry/routes.js";
+export { routeRegistry } from "./app/registry/routes.js";
+export type { DefineEnvOptions, EnvSafeParseResult, EnvSchema, EnvSchemaError, EnvSchemaIssue, } from "./app/utils/defineEnv.js";
+export { defineEnv } from "./app/utils/defineEnv.js";
+//# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,YAAY,EACV,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,4BAA4B,EAC5B,sBAAsB,EACtB,qBAAqB,EACrB,aAAa,EACb,uBAAuB,EACvB,SAAS,EACT,YAAY,EACZ,WAAW,EACX,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,eAAe,EACf,qBAAqB,EACrB,eAAe,EACf,yBAAyB,EACzB,yBAAyB,EACzB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,yBAAyB,EACzB,SAAS,EACT,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,yBAAyB,EACzB,mBAAmB,EACnB,iCAAiC,EACjC,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,uBAAuB,EACvB,qBAAqB,EACrB,gCAAgC,EAChC,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,yBAAyB,EACzB,sBAAsB,EACtB,WAAW,EACX,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,EAClB,0BAA0B,EAC1B,mCAAmC,EACnC,+BAA+B,EAC/B,sBAAsB,EACtB,qBAAqB,EACrB,gBAAgB,EAChB,QAAQ,EACR,kBAAkB,EAClB,sBAAsB,EACtB,wBAAwB,EACxB,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,yBAAyB,EACzB,aAAa,EACb,eAAe,EACf,WAAW,EACX,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,yBAAyB,EACzB,gBAAgB,EAChB,WAAW,EACX,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,UAAU,EACV,yBAAyB,EACzB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,2BAA2B,EAC3B,aAAa,EACb,mBAAmB,EACnB,oBAAoB,EACpB,UAAU,EACV,cAAc,EACd,2BAA2B,EAC3B,0BAA0B,EAC1B,mBAAmB,EACnB,SAAS,EACT,YAAY,EACZ,eAAe,EACf,cAAc,EACd,UAAU,EACV,gBAAgB,EAChB,4BAA4B,EAC5B,+BAA+B,EAC/B,8BAA8B,EAC9B,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,2BAA2B,EAC3B,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,aAAa,EACb,YAAY,EACZ,2BAA2B,EAC3B,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,UAAU,EACV,kBAAkB,EAClB,YAAY,EACZ,OAAO,EACP,qBAAqB,EACrB,oBAAoB,EACpB,aAAa,GACd,MAAM,mBAAmB,CAAC;AAI3B,YAAY,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,YAAY,EACV,wBAAwB,EACxB,gBAAgB,EAChB,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,0BAA0B,EAC1B,kBAAkB,EAClB,UAAU,EACV,wBAAwB,EACxB,uBAAuB,EACvB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,EACb,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,iBAAiB,EACjB,2BAA2B,EAC3B,gBAAgB,EAChB,gBAAgB,EAChB,IAAI,EACJ,yBAAyB,EACzB,uBAAuB,EACvB,eAAe,EACf,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,MAAM,EACN,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACrE,YAAY,EAAE,kBAAkB,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,YAAY,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,YAAY,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,2BAA2B,CAAC;AACjD,YAAY,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,YAAY,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAC/D,YAAY,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,YAAY,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAC3E,YAAY,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAIxD,OAAO,EACL,QAAQ,EACR,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,aAAa,EACb,cAAc,EACd,uBAAuB,EACvB,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAIhC,YAAY,EACV,eAAe,EACf,UAAU,EACV,oBAAoB,EACpB,YAAY,EACZ,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAIrF,YAAY,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,YAAY,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAC9E,YAAY,EACV,YAAY,EACZ,WAAW,EACX,aAAa,EACb,YAAY,GACb,MAAM,0BAA0B,CAAC;AAOlC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC5E,YAAY,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,YAAY,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAI9E,YAAY,EACV,oBAAoB,EACpB,cAAc,EACd,WAAW,GACZ,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AAItE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAClG,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAIlF,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAIhE,YAAY,EACV,aAAa,EACb,oBAAoB,EACpB,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,UAAU,GACX,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAIhG,YAAY,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAItE,YAAY,EACV,qBAAqB,EACrB,WAAW,EACX,kBAAkB,EAClB,iBAAiB,EACjB,aAAa,EACb,YAAY,GACb,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvF,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,YAAY,EACV,UAAU,EACV,WAAW,EACX,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAI7E,YAAY,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAIzD,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,SAAS,EACT,cAAc,EACd,cAAc,GACf,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC"}