@vorionsys/platform-core 0.1.0

package/dist/api/middleware/dpop-enforcement.js

@@ -0,0 +1,596 @@
+/**
+ * DPoP Enforcement Middleware
+ *
+ * Fastify plugin that enforces DPoP (Demonstrating Proof-of-Possession) proof
+ * validation on protected endpoints. Integrates with the existing DPoP service
+ * to provide sender-constrained token validation per RFC 9449.
+ *
+ * Features:
+ * - Per-route DPoP enforcement configuration (required, optional, none)
+ * - Access token binding validation
+ * - Replay attack prevention via JTI cache
+ * - Security monitoring via structured logging
+ * - Metrics for validation success/failure rates
+ *
+ * @packageDocumentation
+ */
+import fp from 'fastify-plugin';
+import { createLogger } from '../../common/logger.js';
+import { Counter, Histogram } from 'prom-client';
+import { vorionRegistry } from '../../common/metrics-registry.js';
+import { DPoPService, DPoPError, createDPoPService, } from '../../security/dpop.js';
+const logger = createLogger({ component: 'dpop-enforcement' });
+// =============================================================================
+// METRICS
+// =============================================================================
+const dpopEnforcementAttempts = new Counter({
+    name: 'vorion_dpop_enforcement_attempts_total',
+    help: 'Total DPoP enforcement attempts by route',
+    labelNames: ['enforcement_mode', 'result'],
+    registers: [vorionRegistry],
+});
+const dpopEnforcementDuration = new Histogram({
+    name: 'vorion_dpop_enforcement_duration_seconds',
+    help: 'Duration of DPoP enforcement checks',
+    buckets: [0.001, 0.005, 0.01, 0.025, 0.05, 0.1, 0.25],
+    registers: [vorionRegistry],
+});
+const dpopMissingProofs = new Counter({
+    name: 'vorion_dpop_missing_proofs_total',
+    help: 'Total requests missing DPoP proofs when required',
+    labelNames: ['path', 'method'],
+    registers: [vorionRegistry],
+});
+const dpopValidationFailures = new Counter({
+    name: 'vorion_dpop_validation_failures_total',
+    help: 'Total DPoP validation failures by error type',
+    labelNames: ['error_code', 'path'],
+    registers: [vorionRegistry],
+});
+// =============================================================================
+// CONSTANTS
+// =============================================================================
+/** HTTP header name for DPoP proof */
+const DPOP_HEADER = 'dpop';
+/** HTTP header name for Authorization */
+const AUTHORIZATION_HEADER = 'authorization';
+/** Bearer token prefix */
+const BEARER_PREFIX = 'Bearer ';
+/** DPoP token prefix (for DPoP-bound tokens) */
+const DPOP_TOKEN_PREFIX = 'DPoP ';
+// =============================================================================
+// ROUTE MATCHING
+// =============================================================================
+/**
+ * Match a URL pattern against a request URL
+ */
+function matchPattern(pattern, url) {
+    // Remove query string from URL
+    const urlPath = url.split('?')[0] ?? url;
+    // Exact match
+    if (pattern === urlPath) {
+        return true;
+    }
+    // Wildcard match
+    if (pattern.endsWith('/*')) {
+        const prefix = pattern.slice(0, -2);
+        return urlPath.startsWith(prefix);
+    }
+    // Path parameter match (convert :param to regex)
+    const regexPattern = pattern.replace(/:[^/]+/g, '[^/]+');
+    const regex = new RegExp(`^${regexPattern}$`);
+    return regex.test(urlPath);
+}
+/**
+ * Find matching route config for a request
+ */
+function findRouteConfig(request, configs) {
+    const method = request.method.toUpperCase();
+    const url = request.url;
+    for (const config of configs) {
+        // Check method match
+        if (config.method !== '*' && config.method.toUpperCase() !== method) {
+            continue;
+        }
+        // Check pattern match
+        if (matchPattern(config.pattern, url)) {
+            return config.dpop;
+        }
+    }
+    return null;
+}
+// =============================================================================
+// TOKEN EXTRACTION
+// =============================================================================
+/**
+ * Extract access token from Authorization header
+ */
+function extractAccessToken(request) {
+    const authHeader = request.headers[AUTHORIZATION_HEADER];
+    if (!authHeader || typeof authHeader !== 'string') {
+        return null;
+    }
+    // Support both Bearer and DPoP token schemes
+    if (authHeader.startsWith(BEARER_PREFIX)) {
+        return authHeader.slice(BEARER_PREFIX.length);
+    }
+    if (authHeader.startsWith(DPOP_TOKEN_PREFIX)) {
+        return authHeader.slice(DPOP_TOKEN_PREFIX.length);
+    }
+    return null;
+}
+/**
+ * Extract DPoP proof from request header
+ */
+function extractDPoPProof(request) {
+    const dpopHeader = request.headers[DPOP_HEADER];
+    if (!dpopHeader || typeof dpopHeader !== 'string') {
+        return null;
+    }
+    return dpopHeader;
+}
+/**
+ * Build full request URI for DPoP validation
+ */
+function buildRequestUri(request, baseUrl) {
+    if (baseUrl) {
+        // Use provided base URL
+        const urlPath = request.url.split('?')[0] ?? request.url;
+        return `${baseUrl.replace(/\/$/, '')}${urlPath}`;
+    }
+    // Build from request
+    const protocol = request.protocol || 'https';
+    const host = request.headers.host || request.hostname;
+    const urlPath = request.url.split('?')[0] ?? request.url;
+    return `${protocol}://${host}${urlPath}`;
+}
+/**
+ * Send 400 Bad Request for malformed DPoP proof
+ */
+function sendBadRequest(reply, code, message, hint) {
+    const response = {
+        error: {
+            code,
+            message,
+            ...(hint && { hint }),
+        },
+    };
+    // Set WWW-Authenticate header per RFC 9449
+    reply.header('WWW-Authenticate', 'DPoP error="invalid_dpop_proof"');
+    reply.status(400).send(response);
+}
+/**
+ * Send 401 Unauthorized for missing or invalid DPoP proof
+ */
+function sendUnauthorized(reply, code, message, hint) {
+    const response = {
+        error: {
+            code,
+            message,
+            ...(hint && { hint }),
+        },
+    };
+    // Set WWW-Authenticate header per RFC 9449
+    reply.header('WWW-Authenticate', 'DPoP error="invalid_token"');
+    reply.status(401).send(response);
+}
+/**
+ * Send 403 Forbidden for DPoP proof that doesn't match token
+ */
+function sendForbidden(reply, code, message, hint) {
+    const response = {
+        error: {
+            code,
+            message,
+            ...(hint && { hint }),
+        },
+    };
+    reply.header('WWW-Authenticate', 'DPoP error="use_dpop_nonce"');
+    reply.status(403).send(response);
+}
+// =============================================================================
+// DEFAULT ROUTE CONFIGURATIONS
+// =============================================================================
+/**
+ * Default DPoP route configurations
+ *
+ * DPoP ENFORCEMENT PER ROUTE TYPE:
+ *
+ * None (public endpoints):
+ * - /health, /ready, /metrics - Health checks
+ * - /api/v1/docs/* - API documentation
+ *
+ * Optional (accept DPoP if provided):
+ * - /api/v1/auth/* - Authentication endpoints (token issuance)
+ *
+ * Required (DPoP must be present and valid):
+ * - /api/v1/intents/* - Intent operations (T2+ per ACI spec)
+ * - /api/v1/escalations/* - Escalation operations
+ * - /api/v1/policies/* - Policy operations
+ * - /api/v1/admin/* - Admin operations (high security)
+ * - /api/v1/gdpr/* - GDPR operations (high security)
+ */
+const DEFAULT_DPOP_ROUTE_CONFIGS = [
+    // Public routes - no DPoP required
+    { method: '*', pattern: '/health', dpop: 'none' },
+    { method: '*', pattern: '/ready', dpop: 'none' },
+    { method: '*', pattern: '/metrics', dpop: 'none' },
+    { method: '*', pattern: '/scheduler', dpop: 'none' },
+    { method: '*', pattern: '/api/v1/docs', dpop: 'none' },
+    { method: '*', pattern: '/api/v1/docs/*', dpop: 'none' },
+    { method: '*', pattern: '/api/v1/health', dpop: 'none' },
+    { method: '*', pattern: '/api/v1/health/*', dpop: 'none' },
+    // Auth routes - DPoP optional (for token issuance with DPoP binding)
+    { method: '*', pattern: '/api/v1/auth/*', dpop: 'optional' },
+    { method: '*', pattern: '/api/v1/sessions/*', dpop: 'optional' },
+    // Protected routes - DPoP required
+    { method: '*', pattern: '/api/v1/intents', dpop: 'required' },
+    { method: '*', pattern: '/api/v1/intents/*', dpop: 'required' },
+    { method: '*', pattern: '/api/v1/escalations', dpop: 'required' },
+    { method: '*', pattern: '/api/v1/escalations/*', dpop: 'required' },
+    { method: '*', pattern: '/api/v1/policies', dpop: 'required' },
+    { method: '*', pattern: '/api/v1/policies/*', dpop: 'required' },
+    { method: '*', pattern: '/api/v1/audit', dpop: 'required' },
+    { method: '*', pattern: '/api/v1/audit/*', dpop: 'required' },
+    { method: '*', pattern: '/api/v1/proofs/*', dpop: 'required' },
+    { method: '*', pattern: '/api/v1/trust/*', dpop: 'required' },
+    { method: '*', pattern: '/api/v1/constraints/*', dpop: 'required' },
+    { method: '*', pattern: '/api/v1/webhooks', dpop: 'required' },
+    { method: '*', pattern: '/api/v1/webhooks/*', dpop: 'required' },
+    { method: '*', pattern: '/api/v1/admin/*', dpop: 'required' },
+    { method: '*', pattern: '/api/v1/gdpr/*', dpop: 'required' },
+    { method: '*', pattern: '/api/v1/extensions/*', dpop: 'required' },
+];
+/**
+ * Create DPoP enforcement handler for a specific mode
+ */
+function createDPoPEnforcementHandler(dpopService, enforcementMode, options) {
+    return async (request, reply) => {
+        const startTime = Date.now();
+        const requestId = request.id;
+        // Initialize DPoP context
+        const dpopContext = {
+            validated: false,
+            enforcementMode,
+        };
+        try {
+            // Skip if mode is 'none'
+            if (enforcementMode === 'none') {
+                dpopContext.validated = true;
+                request.dpopContext = dpopContext;
+                dpopEnforcementAttempts.inc({ enforcement_mode: 'none', result: 'skipped' });
+                return;
+            }
+            // Extract DPoP proof
+            const dpopProof = extractDPoPProof(request);
+            const accessToken = extractAccessToken(request);
+            // Handle missing DPoP proof
+            if (!dpopProof) {
+                if (enforcementMode === 'required') {
+                    // Log security event
+                    logger.warn({
+                        requestId,
+                        method: request.method,
+                        path: request.url,
+                        ip: request.ip,
+                        userAgent: request.headers['user-agent'],
+                    }, 'DPoP proof missing for protected endpoint');
+                    dpopMissingProofs.inc({ path: request.url.split('?')[0] ?? request.url, method: request.method });
+                    dpopEnforcementAttempts.inc({ enforcement_mode: 'required', result: 'missing_proof' });
+                    dpopContext.error = 'DPoP proof is required';
+                    dpopContext.errorCode = 'MISSING_DPOP_PROOF';
+                    request.dpopContext = dpopContext;
+                    sendUnauthorized(reply, 'DPOP_REQUIRED', 'DPoP proof is required for this endpoint', 'Include a DPoP proof JWT in the DPoP header');
+                    return;
+                }
+                // Optional mode - proceed without DPoP
+                dpopContext.validated = true;
+                request.dpopContext = dpopContext;
+                dpopEnforcementAttempts.inc({ enforcement_mode: 'optional', result: 'skipped_no_proof' });
+                if (options.logDecisions) {
+                    logger.debug({ requestId, method: request.method, path: request.url }, 'DPoP proof not provided (optional mode)');
+                }
+                return;
+            }
+            // Handle missing access token when DPoP is provided
+            if (!accessToken) {
+                logger.warn({
+                    requestId,
+                    method: request.method,
+                    path: request.url,
+                }, 'DPoP proof provided without access token');
+                dpopEnforcementAttempts.inc({ enforcement_mode: enforcementMode, result: 'missing_token' });
+                dpopContext.error = 'Access token missing';
+                dpopContext.errorCode = 'MISSING_ACCESS_TOKEN';
+                request.dpopContext = dpopContext;
+                sendUnauthorized(reply, 'ACCESS_TOKEN_REQUIRED', 'Access token is required when providing DPoP proof', 'Include access token in Authorization header');
+                return;
+            }
+            // Build request URI for validation
+            const requestUri = buildRequestUri(request, options.baseUrl);
+            // Calculate access token hash for binding validation
+            const accessTokenHash = await dpopService.generateAccessTokenHash(accessToken);
+            // Verify the DPoP proof
+            const verificationResult = await dpopService.verifyProof(dpopProof, request.method, requestUri, accessTokenHash);
+            if (!verificationResult.valid) {
+                // Log security event with details
+                logger.warn({
+                    requestId,
+                    method: request.method,
+                    path: request.url,
+                    ip: request.ip,
+                    userAgent: request.headers['user-agent'],
+                    error: verificationResult.error,
+                    errorCode: verificationResult.errorCode,
+                }, 'DPoP proof validation failed');
+                dpopValidationFailures.inc({
+                    error_code: verificationResult.errorCode || 'UNKNOWN',
+                    path: request.url.split('?')[0] ?? request.url,
+                });
+                dpopEnforcementAttempts.inc({ enforcement_mode: enforcementMode, result: 'validation_failed' });
+                dpopContext.error = verificationResult.error;
+                dpopContext.errorCode = verificationResult.errorCode;
+                request.dpopContext = dpopContext;
+                // Choose appropriate error response based on error type
+                switch (verificationResult.errorCode) {
+                    case 'INVALID_FORMAT':
+                        sendBadRequest(reply, 'DPOP_INVALID_FORMAT', verificationResult.error || 'Invalid DPoP proof format', 'Ensure the DPoP proof is a valid JWT with required claims');
+                        break;
+                    case 'EXPIRED':
+                        sendUnauthorized(reply, 'DPOP_EXPIRED', verificationResult.error || 'DPoP proof has expired', 'Generate a fresh DPoP proof with current timestamp');
+                        break;
+                    case 'REPLAY':
+                        sendForbidden(reply, 'DPOP_REPLAY', verificationResult.error || 'DPoP proof replay detected', 'Each DPoP proof must have a unique jti claim');
+                        break;
+                    case 'METHOD_MISMATCH':
+                        sendBadRequest(reply, 'DPOP_METHOD_MISMATCH', verificationResult.error || 'DPoP proof method does not match request', 'Ensure the htm claim matches the HTTP method');
+                        break;
+                    case 'URI_MISMATCH':
+                        sendBadRequest(reply, 'DPOP_URI_MISMATCH', verificationResult.error || 'DPoP proof URI does not match request', 'Ensure the htu claim matches the request URI');
+                        break;
+                    case 'INVALID_SIGNATURE':
+                        sendUnauthorized(reply, 'DPOP_INVALID_SIGNATURE', verificationResult.error || 'DPoP proof signature is invalid', 'Ensure the proof is signed with the correct key');
+                        break;
+                    default:
+                        sendUnauthorized(reply, 'DPOP_VALIDATION_FAILED', verificationResult.error || 'DPoP proof validation failed', 'Check the DPoP proof format and claims');
+                }
+                return;
+            }
+            // Validation successful
+            dpopContext.validated = true;
+            dpopContext.keyThumbprint = verificationResult.keyThumbprint;
+            dpopContext.validatedAt = verificationResult.verifiedAt;
+            request.dpopContext = dpopContext;
+            request.dpopKeyThumbprint = verificationResult.keyThumbprint;
+            dpopEnforcementAttempts.inc({ enforcement_mode: enforcementMode, result: 'success' });
+            if (options.logDecisions) {
+                logger.debug({
+                    requestId,
+                    method: request.method,
+                    path: request.url,
+                    keyThumbprint: verificationResult.keyThumbprint,
+                }, 'DPoP proof validated successfully');
+            }
+        }
+        catch (error) {
+            // Unexpected error during validation
+            logger.error({
+                requestId,
+                method: request.method,
+                path: request.url,
+                error: error instanceof Error ? error.message : String(error),
+            }, 'DPoP enforcement error');
+            dpopEnforcementAttempts.inc({ enforcement_mode: enforcementMode, result: 'error' });
+            dpopContext.error = error instanceof Error ? error.message : 'Internal error';
+            dpopContext.errorCode = 'INTERNAL_ERROR';
+            request.dpopContext = dpopContext;
+            if (enforcementMode === 'required') {
+                sendUnauthorized(reply, 'DPOP_VALIDATION_ERROR', 'Failed to validate DPoP proof', 'An unexpected error occurred during DPoP validation');
+                return;
+            }
+            // Optional mode - proceed despite error
+            dpopContext.validated = true;
+        }
+        finally {
+            const duration = (Date.now() - startTime) / 1000;
+            dpopEnforcementDuration.observe(duration);
+        }
+    };
+}
+// =============================================================================
+// FASTIFY PLUGIN
+// =============================================================================
+/**
+ * DPoP Enforcement Plugin
+ *
+ * Registers DPoP proof validation middleware for protected endpoints.
+ * Supports route-level configuration for required, optional, or no enforcement.
+ *
+ * @example
+ * ```typescript
+ * await fastify.register(dpopEnforcementPlugin, {
+ *   defaultMode: 'required',
+ *   routeConfigs: [
+ *     { method: '*', pattern: '/public/*', dpop: 'none' },
+ *     { method: 'POST', pattern: '/api/v1/auth/token', dpop: 'optional' },
+ *   ],
+ * });
+ * ```
+ */
+export const dpopEnforcementPlugin = fp(async (fastify, options) => {
+    // Create or use provided DPoP service
+    const dpopService = options.dpopService ?? createDPoPService(options.dpopConfig, options.jtiCache);
+    const defaultMode = options.defaultMode ?? 'required';
+    const routeConfigs = [...DEFAULT_DPOP_ROUTE_CONFIGS, ...(options.routeConfigs ?? [])];
+    const skipPaths = new Set(options.skipPaths ?? ['/health', '/ready', '/metrics']);
+    const logDecisions = options.logDecisions ?? false;
+    // Decorate fastify with the DPoP service
+    if (!fastify.hasDecorator('dpopService')) {
+        fastify.decorate('dpopService', dpopService);
+    }
+    // Decorate request with DPoP context
+    fastify.decorateRequest('dpopContext', undefined);
+    fastify.decorateRequest('dpopKeyThumbprint', undefined);
+    // Add preHandler hook for DPoP enforcement
+    fastify.addHook('preHandler', async (request, reply) => {
+        // Skip for explicitly excluded paths
+        if (skipPaths.has(request.url) || skipPaths.has(request.routeOptions?.url ?? '')) {
+            request.dpopContext = {
+                validated: true,
+                enforcementMode: 'none',
+            };
+            return;
+        }
+        // Find matching route config
+        const routeMode = findRouteConfig(request, routeConfigs);
+        // Determine enforcement mode
+        let enforcementMode = routeMode ?? defaultMode;
+        // Check trust tier if extractor provided (tier-based enforcement)
+        if (options.extractTrustTier) {
+            const trustTier = options.extractTrustTier(request);
+            if (trustTier !== undefined && dpopService.isRequired(trustTier)) {
+                // Upgrade to required if trust tier requires DPoP
+                if (enforcementMode === 'optional' || enforcementMode === 'none') {
+                    enforcementMode = 'required';
+                    if (logDecisions) {
+                        logger.debug({
+                            requestId: request.id,
+                            trustTier,
+                            originalMode: routeMode ?? defaultMode,
+                        }, 'DPoP enforcement upgraded to required based on trust tier');
+                    }
+                }
+            }
+        }
+        // Create and execute enforcement handler
+        const enforcer = createDPoPEnforcementHandler(dpopService, enforcementMode, options);
+        await enforcer(request, reply);
+    });
+    logger.info({
+        defaultMode,
+        routeConfigCount: routeConfigs.length,
+        skipPaths: Array.from(skipPaths),
+    }, 'DPoP enforcement plugin registered');
+}, {
+    name: 'vorion-dpop-enforcement',
+    fastify: '>=4.x',
+});
+// =============================================================================
+// ROUTE DECORATOR UTILITIES
+// =============================================================================
+/**
+ * Create a route-specific DPoP configuration
+ *
+ * Use this with Fastify route options for per-route DPoP requirements.
+ *
+ * @example
+ * ```typescript
+ * fastify.post('/api/v1/sensitive', {
+ *   config: { dpop: dpopRequired() },
+ * }, handler);
+ * ```
+ */
+export function dpopRequired() {
+    return { dpop: 'required' };
+}
+/**
+ * Create a route config for optional DPoP
+ */
+export function dpopOptional() {
+    return { dpop: 'optional' };
+}
+/**
+ * Create a route config for no DPoP enforcement
+ */
+export function dpopNone() {
+    return { dpop: 'none' };
+}
+// =============================================================================
+// PREHANDLER UTILITIES
+// =============================================================================
+/**
+ * Create a preHandler hook that enforces DPoP for a specific route
+ *
+ * Use this when you need per-route DPoP enforcement outside the plugin.
+ *
+ * @example
+ * ```typescript
+ * fastify.post('/api/v1/sensitive', {
+ *   preHandler: requireDPoP(),
+ * }, handler);
+ * ```
+ */
+export function requireDPoP(dpopService, options) {
+    // Lazy initialization - will use fastify.dpopService if available
+    let service = dpopService;
+    return async (request, reply) => {
+        // Try to get service from fastify instance if not provided
+        if (!service) {
+            const fastifyService = request.server.dpopService;
+            if (fastifyService) {
+                service = fastifyService;
+            }
+            else {
+                service = createDPoPService(options?.dpopConfig, options?.jtiCache);
+            }
+        }
+        const handler = createDPoPEnforcementHandler(service, 'required', options ?? {});
+        await handler(request, reply);
+    };
+}
+/**
+ * Create a preHandler that accepts optional DPoP proof
+ */
+export function optionalDPoP(dpopService, options) {
+    let service = dpopService;
+    return async (request, reply) => {
+        if (!service) {
+            const fastifyService = request.server.dpopService;
+            if (fastifyService) {
+                service = fastifyService;
+            }
+            else {
+                service = createDPoPService(options?.dpopConfig, options?.jtiCache);
+            }
+        }
+        const handler = createDPoPEnforcementHandler(service, 'optional', options ?? {});
+        await handler(request, reply);
+    };
+}
+// =============================================================================
+// UTILITY FUNCTIONS
+// =============================================================================
+/**
+ * Check if request has validated DPoP proof
+ */
+export function hasDPoPProof(request) {
+    return request.dpopContext?.validated === true && request.dpopContext?.keyThumbprint !== undefined;
+}
+/**
+ * Get DPoP key thumbprint from request
+ */
+export function getDPoPKeyThumbprint(request) {
+    return request.dpopContext?.keyThumbprint;
+}
+/**
+ * Get full DPoP context from request
+ */
+export function getDPoPContext(request) {
+    return request.dpopContext;
+}
+/**
+ * Check if DPoP validation failed
+ */
+export function dpopValidationFailed(request) {
+    const context = request.dpopContext;
+    if (!context) {
+        return false;
+    }
+    return context.enforcementMode !== 'none' && !context.validated;
+}
+// =============================================================================
+// EXPORTS
+// =============================================================================
+export { DPoPService, DPoPError, createDPoPService, };
+export default dpopEnforcementPlugin;
+//# sourceMappingURL=dpop-enforcement.js.map

package/dist/api/middleware/dpop-enforcement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dpop-enforcement.js","sourceRoot":"","sources":["../../../src/api/middleware/dpop-enforcement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAOH,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EACL,WAAW,EACX,SAAS,EACT,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAQhC,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;AAE/D,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,MAAM,uBAAuB,GAAG,IAAI,OAAO,CAAC;IAC1C,IAAI,EAAE,wCAAwC;IAC9C,IAAI,EAAE,0CAA0C;IAChD,UAAU,EAAE,CAAC,kBAAkB,EAAE,QAAQ,CAAU;IACnD,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAG,IAAI,SAAS,CAAC;IAC5C,IAAI,EAAE,0CAA0C;IAChD,IAAI,EAAE,qCAAqC;IAC3C,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC;IACrD,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,IAAI,OAAO,CAAC;IACpC,IAAI,EAAE,kCAAkC;IACxC,IAAI,EAAE,kDAAkD;IACxD,UAAU,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IACvC,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,IAAI,OAAO,CAAC;IACzC,IAAI,EAAE,uCAAuC;IAC7C,IAAI,EAAE,8CAA8C;IACpD,UAAU,EAAE,CAAC,YAAY,EAAE,MAAM,CAAU;IAC3C,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AA0FH,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,sCAAsC;AACtC,MAAM,WAAW,GAAG,MAAM,CAAC;AAE3B,yCAAyC;AACzC,MAAM,oBAAoB,GAAG,eAAe,CAAC;AAE7C,0BAA0B;AAC1B,MAAM,aAAa,GAAG,SAAS,CAAC;AAEhC,gDAAgD;AAChD,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAElC,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF;;GAEG;AACH,SAAS,YAAY,CAAC,OAAe,EAAE,GAAW;IAChD,+BAA+B;IAC/B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;IAEzC,cAAc;IACd,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iBAAiB;IACjB,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpC,OAAO,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,iDAAiD;IACjD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,YAAY,GAAG,CAAC,CAAC;IAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CACtB,OAAuB,EACvB,OAA2B;IAE3B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAExB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,qBAAqB;QACrB,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;YACpE,SAAS;QACX,CAAC;QAED,sBAAsB;QACtB,IAAI,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;YACtC,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF;;GAEG;AACH,SAAS,kBAAkB,CAAC,OAAuB;IACjD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACzD,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6CAA6C;IAC7C,IAAI,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACzC,OAAO,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,UAAU,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC7C,OAAO,UAAU,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,OAAuB;IAC/C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAChD,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,OAAuB,EAAE,OAAgB;IAChE,IAAI,OAAO,EAAE,CAAC;QACZ,wBAAwB;QACxB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC;QACzD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC;IACnD,CAAC;IAED,qBAAqB;IACrB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC;IAEzD,OAAO,GAAG,QAAQ,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;AAC3C,CAAC;AAkBD;;GAEG;AACH,SAAS,cAAc,CACrB,KAAmB,EACnB,IAAY,EACZ,OAAe,EACf,IAAa;IAEb,MAAM,QAAQ,GAAsB;QAClC,KAAK,EAAE;YACL,IAAI;YACJ,OAAO;YACP,GAAG,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC;SACtB;KACF,CAAC;IAEF,2CAA2C;IAC3C,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAE,iCAAiC,CAAC,CAAC;IACpE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CACvB,KAAmB,EACnB,IAAY,EACZ,OAAe,EACf,IAAa;IAEb,MAAM,QAAQ,GAAsB;QAClC,KAAK,EAAE;YACL,IAAI;YACJ,OAAO;YACP,GAAG,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC;SACtB;KACF,CAAC;IAEF,2CAA2C;IAC3C,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAE,4BAA4B,CAAC,CAAC;IAC/D,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CACpB,KAAmB,EACnB,IAAY,EACZ,OAAe,EACf,IAAa;IAEb,MAAM,QAAQ,GAAsB;QAClC,KAAK,EAAE;YACL,IAAI;YACJ,OAAO;YACP,GAAG,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC;SACtB;KACF,CAAC;IAEF,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAE,6BAA6B,CAAC,CAAC;IAChE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED,gFAAgF;AAChF,+BAA+B;AAC/B,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,0BAA0B,GAAuB;IACrD,mCAAmC;IACnC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE;IACjD,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE;IAChD,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE;IAClD,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE;IACpD,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE;IACtD,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE;IACxD,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE;IACxD,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,EAAE;IAE1D,qEAAqE;IACrE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,UAAU,EAAE;IAC5D,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,UAAU,EAAE;IAEhE,mCAAmC;IACnC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,UAAU,EAAE;IAC7D,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,UAAU,EAAE;IAC/D,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,UAAU,EAAE;IACjE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,uBAAuB,EAAE,IAAI,EAAE,UAAU,EAAE;IACnE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,UAAU,EAAE;IAC9D,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,UAAU,EAAE;IAChE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,UAAU,EAAE;IAC3D,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,UAAU,EAAE;IAC7D,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,UAAU,EAAE;IAC9D,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,UAAU,EAAE;IAC7D,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,uBAAuB,EAAE,IAAI,EAAE,UAAU,EAAE;IACnE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,UAAU,EAAE;IAC9D,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,UAAU,EAAE;IAChE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,UAAU,EAAE;IAC7D,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,UAAU,EAAE;IAC5D,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,UAAU,EAAE;CACnE,CAAC;AAWF;;GAEG;AACH,SAAS,4BAA4B,CACnC,WAAwB,EACxB,eAAoC,EACpC,OAA+B;IAE/B,OAAO,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAiB,EAAE;QAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;QAE7B,0BAA0B;QAC1B,MAAM,WAAW,GAAgB;YAC/B,SAAS,EAAE,KAAK;YAChB,eAAe;SAChB,CAAC;QAEF,IAAI,CAAC;YACH,yBAAyB;YACzB,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;gBAC/B,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC;gBAC7B,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC;gBAClC,uBAAuB,CAAC,GAAG,CAAC,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC7E,OAAO;YACT,CAAC;YAED,qBAAqB;YACrB,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAEhD,4BAA4B;YAC5B,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,IAAI,eAAe,KAAK,UAAU,EAAE,CAAC;oBACnC,qBAAqB;oBACrB,MAAM,CAAC,IAAI,CACT;wBACE,SAAS;wBACT,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,IAAI,EAAE,OAAO,CAAC,GAAG;wBACjB,EAAE,EAAE,OAAO,CAAC,EAAE;wBACd,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;qBACzC,EACD,2CAA2C,CAC5C,CAAC;oBAEF,iBAAiB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;oBAClG,uBAAuB,CAAC,GAAG,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;oBAEvF,WAAW,CAAC,KAAK,GAAG,wBAAwB,CAAC;oBAC7C,WAAW,CAAC,SAAS,GAAG,oBAAoB,CAAC;oBAC7C,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC;oBAElC,gBAAgB,CACd,KAAK,EACL,eAAe,EACf,0CAA0C,EAC1C,6CAA6C,CAC9C,CAAC;oBACF,OAAO;gBACT,CAAC;gBAED,uCAAuC;gBACvC,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC;gBAC7B,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC;gBAClC,uBAAuB,CAAC,GAAG,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAE1F,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;oBACzB,MAAM,CAAC,KAAK,CACV,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,EACxD,yCAAyC,CAC1C,CAAC;gBACJ,CAAC;gBACD,OAAO;YACT,CAAC;YAED,oDAAoD;YACpD,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CACT;oBACE,SAAS;oBACT,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,IAAI,EAAE,OAAO,CAAC,GAAG;iBAClB,EACD,0CAA0C,CAC3C,CAAC;gBAEF,uBAAuB,CAAC,GAAG,CAAC,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;gBAE5F,WAAW,CAAC,KAAK,GAAG,sBAAsB,CAAC;gBAC3C,WAAW,CAAC,SAAS,GAAG,sBAAsB,CAAC;gBAC/C,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC;gBAElC,gBAAgB,CACd,KAAK,EACL,uBAAuB,EACvB,oDAAoD,EACpD,8CAA8C,CAC/C,CAAC;gBACF,OAAO;YACT,CAAC;YAED,mCAAmC;YACnC,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YAE7D,qDAAqD;YACrD,MAAM,eAAe,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC;YAE/E,wBAAwB;YACxB,MAAM,kBAAkB,GAA2B,MAAM,WAAW,CAAC,WAAW,CAC9E,SAAS,EACT,OAAO,CAAC,MAAM,EACd,UAAU,EACV,eAAe,CAChB,CAAC;YAEF,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;gBAC9B,kCAAkC;gBAClC,MAAM,CAAC,IAAI,CACT;oBACE,SAAS;oBACT,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,IAAI,EAAE,OAAO,CAAC,GAAG;oBACjB,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;oBACxC,KAAK,EAAE,kBAAkB,CAAC,KAAK;oBAC/B,SAAS,EAAE,kBAAkB,CAAC,SAAS;iBACxC,EACD,8BAA8B,CAC/B,CAAC;gBAEF,sBAAsB,CAAC,GAAG,CAAC;oBACzB,UAAU,EAAE,kBAAkB,CAAC,SAAS,IAAI,SAAS;oBACrD,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG;iBAC/C,CAAC,CAAC;gBACH,uBAAuB,CAAC,GAAG,CAAC,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBAEhG,WAAW,CAAC,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC;gBAC7C,WAAW,CAAC,SAAS,GAAG,kBAAkB,CAAC,SAAS,CAAC;gBACrD,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC;gBAElC,wDAAwD;gBACxD,QAAQ,kBAAkB,CAAC,SAAS,EAAE,CAAC;oBACrC,KAAK,gBAAgB;wBACnB,cAAc,CACZ,KAAK,EACL,qBAAqB,EACrB,kBAAkB,CAAC,KAAK,IAAI,2BAA2B,EACvD,2DAA2D,CAC5D,CAAC;wBACF,MAAM;oBAER,KAAK,SAAS;wBACZ,gBAAgB,CACd,KAAK,EACL,cAAc,EACd,kBAAkB,CAAC,KAAK,IAAI,wBAAwB,EACpD,oDAAoD,CACrD,CAAC;wBACF,MAAM;oBAER,KAAK,QAAQ;wBACX,aAAa,CACX,KAAK,EACL,aAAa,EACb,kBAAkB,CAAC,KAAK,IAAI,4BAA4B,EACxD,8CAA8C,CAC/C,CAAC;wBACF,MAAM;oBAER,KAAK,iBAAiB;wBACpB,cAAc,CACZ,KAAK,EACL,sBAAsB,EACtB,kBAAkB,CAAC,KAAK,IAAI,0CAA0C,EACtE,8CAA8C,CAC/C,CAAC;wBACF,MAAM;oBAER,KAAK,cAAc;wBACjB,cAAc,CACZ,KAAK,EACL,mBAAmB,EACnB,kBAAkB,CAAC,KAAK,IAAI,uCAAuC,EACnE,8CAA8C,CAC/C,CAAC;wBACF,MAAM;oBAER,KAAK,mBAAmB;wBACtB,gBAAgB,CACd,KAAK,EACL,wBAAwB,EACxB,kBAAkB,CAAC,KAAK,IAAI,iCAAiC,EAC7D,iDAAiD,CAClD,CAAC;wBACF,MAAM;oBAER;wBACE,gBAAgB,CACd,KAAK,EACL,wBAAwB,EACxB,kBAAkB,CAAC,KAAK,IAAI,8BAA8B,EAC1D,wCAAwC,CACzC,CAAC;gBACN,CAAC;gBACD,OAAO;YACT,CAAC;YAED,wBAAwB;YACxB,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC;YAC7B,WAAW,CAAC,aAAa,GAAG,kBAAkB,CAAC,aAAa,CAAC;YAC7D,WAAW,CAAC,WAAW,GAAG,kBAAkB,CAAC,UAAU,CAAC;YACxD,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC;YAClC,OAAO,CAAC,iBAAiB,GAAG,kBAAkB,CAAC,aAAa,CAAC;YAE7D,uBAAuB,CAAC,GAAG,CAAC,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAEtF,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;gBACzB,MAAM,CAAC,KAAK,CACV;oBACE,SAAS;oBACT,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,IAAI,EAAE,OAAO,CAAC,GAAG;oBACjB,aAAa,EAAE,kBAAkB,CAAC,aAAa;iBAChD,EACD,mCAAmC,CACpC,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qCAAqC;YACrC,MAAM,CAAC,KAAK,CACV;gBACE,SAAS;gBACT,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,IAAI,EAAE,OAAO,CAAC,GAAG;gBACjB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,EACD,wBAAwB,CACzB,CAAC;YAEF,uBAAuB,CAAC,GAAG,CAAC,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YAEpF,WAAW,CAAC,KAAK,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC;YAC9E,WAAW,CAAC,SAAS,GAAG,gBAAgB,CAAC;YACzC,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC;YAElC,IAAI,eAAe,KAAK,UAAU,EAAE,CAAC;gBACnC,gBAAgB,CACd,KAAK,EACL,uBAAuB,EACvB,+BAA+B,EAC/B,qDAAqD,CACtD,CAAC;gBACF,OAAO;YACT,CAAC;YAED,wCAAwC;YACxC,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC;QAC/B,CAAC;gBAAS,CAAC;YACT,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC;YACjD,uBAAuB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CACrC,KAAK,EAAE,OAAwB,EAAE,OAA+B,EAAE,EAAE;IAClE,sCAAsC;IACtC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,iBAAiB,CAC1D,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,QAAQ,CACjB,CAAC;IAEF,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,UAAU,CAAC;IACtD,MAAM,YAAY,GAAG,CAAC,GAAG,0BAA0B,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;IACtF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;IAClF,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,KAAK,CAAC;IAEnD,yCAAyC;IACzC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa,CAAC,EAAE,CAAC;QACzC,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAC/C,CAAC;IAED,qCAAqC;IACrC,OAAO,CAAC,eAAe,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IAClD,OAAO,CAAC,eAAe,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;IAExD,2CAA2C;IAC3C,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACrD,qCAAqC;QACrC,IAAI,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;YACjF,OAAO,CAAC,WAAW,GAAG;gBACpB,SAAS,EAAE,IAAI;gBACf,eAAe,EAAE,MAAM;aACxB,CAAC;YACF,OAAO;QACT,CAAC;QAED,6BAA6B;QAC7B,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAEzD,6BAA6B;QAC7B,IAAI,eAAe,GAAG,SAAS,IAAI,WAAW,CAAC;QAE/C,kEAAkE;QAClE,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACpD,IAAI,SAAS,KAAK,SAAS,IAAI,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACjE,kDAAkD;gBAClD,IAAI,eAAe,KAAK,UAAU,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;oBACjE,eAAe,GAAG,UAAU,CAAC;oBAE7B,IAAI,YAAY,EAAE,CAAC;wBACjB,MAAM,CAAC,KAAK,CACV;4BACE,SAAS,EAAE,OAAO,CAAC,EAAE;4BACrB,SAAS;4BACT,YAAY,EAAE,SAAS,IAAI,WAAW;yBACvC,EACD,2DAA2D,CAC5D,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,MAAM,QAAQ,GAAG,4BAA4B,CAAC,WAAW,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;QACrF,MAAM,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CACT;QACE,WAAW;QACX,gBAAgB,EAAE,YAAY,CAAC,MAAM;QACrC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;KACjC,EACD,oCAAoC,CACrC,CAAC;AACJ,CAAC,EACD;IACE,IAAI,EAAE,yBAAyB;IAC/B,OAAO,EAAE,OAAO;CACjB,CACF,CAAC;AAEF,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ;IACtB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CACzB,WAAyB,EACzB,OAAyC;IAEzC,kEAAkE;IAClE,IAAI,OAAO,GAA4B,WAAW,CAAC;IAEnD,OAAO,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAiB,EAAE;QAC3E,2DAA2D;QAC3D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,cAAc,GAAI,OAAO,CAAC,MAA0D,CAAC,WAAW,CAAC;YACvG,IAAI,cAAc,EAAE,CAAC;gBACnB,OAAO,GAAG,cAAc,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,iBAAiB,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,4BAA4B,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;QACjF,MAAM,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAC1B,WAAyB,EACzB,OAAyC;IAEzC,IAAI,OAAO,GAA4B,WAAW,CAAC;IAEnD,OAAO,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAiB,EAAE;QAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,cAAc,GAAI,OAAO,CAAC,MAA0D,CAAC,WAAW,CAAC;YACvG,IAAI,cAAc,EAAE,CAAC;gBACnB,OAAO,GAAG,cAAc,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,iBAAiB,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,4BAA4B,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;QACjF,MAAM,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,OAAuB;IAClD,OAAO,OAAO,CAAC,WAAW,EAAE,SAAS,KAAK,IAAI,IAAI,OAAO,CAAC,WAAW,EAAE,aAAa,KAAK,SAAS,CAAC;AACrG,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAuB;IAC1D,OAAO,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,OAAuB;IACpD,OAAO,OAAO,CAAC,WAAW,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAuB;IAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IACpC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAC,eAAe,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;AAClE,CAAC;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,OAAO,EACL,WAAW,EACX,SAAS,EACT,iBAAiB,GAClB,CAAC;AASF,eAAe,qBAAqB,CAAC"}

package/dist/api/middleware/index.d.ts

@@ -0,0 +1,24 @@
+/**
+ * API Middleware Barrel Export
+ *
+ * Exports all middleware components for API hardening:
+ * - Validation middleware (Zod-based input validation)
+ * - Rate limiting middleware (per-tenant and per-endpoint)
+ * - Security middleware (headers, request ID, logging)
+ * - API key enforcement middleware (API key auth with JWT integration)
+ * - DPoP enforcement middleware (sender-constrained tokens per RFC 9449)
+ *
+ * @packageDocumentation
+ */
+export { validateBody, validateQuery, validateParams, validateRequest, registerValidationPlugin, type ValidationOptions, type ValidationErrorDetail, type ZodSchema, type ZodError, } from './validation.js';
+export { rateLimit, rateLimitPerTenant, rateLimitByMethod, registerRateLimitPlugin, getRateLimitStore, resetRateLimitStore, getRateLimitStats, resetTenantRateLimit, type RateLimitConfig, type TenantRateLimitConfig, type RateLimitResult, } from './rateLimit.js';
+export { securityHeaders, requestIdInjection, requestLogging, combinedSecurityMiddleware, registerSecurityPlugin, maskSensitiveData, timingSafeEqual, type SecurityHeadersConfig, type CorsConfig, type CspConfig, type HstsConfig, type RequestLoggingConfig, } from './security.js';
+export { securityHeadersMiddleware, swaggerSecurityHeaders, applySecurityHeaders, registerSecurityHeadersPlugin, generateNonce, generateSriHash, verifySriHash, buildCspHeader, getEnvironmentCsp, generateSriHashForFile, DEFAULT_SECURITY_HEADERS, DEFAULT_API_CSP, SWAGGER_UI_CSP, ENVIRONMENT_CSP_CONFIG, type CspDirectives, type EnvironmentCspConfig, type SecurityHeadersOptions, type SriHash, } from './security-headers.js';
+export { apiKeyEnforcementPlugin, createRouteAuth, requireApiKeyAuth, requireJwtOrApiKey, apiKeyMiddleware, requireScopes, getApiKey, hasApiKey, getApiKeyTenantId, type AuthMethod, type RouteAuthConfig, type RoutePattern, type ApiKeyEnforcementOptions, } from './api-key-enforcement.js';
+export { dpopEnforcementPlugin, dpopRequired, dpopOptional, dpopNone, requireDPoP, optionalDPoP, hasDPoPProof, getDPoPKeyThumbprint, getDPoPContext, dpopValidationFailed, DPoPService, DPoPError, createDPoPService, type DPoPEnforcementMode, type RouteDPoPConfig, type DPoPRoutePattern, type DPoPEnforcementOptions, type DPoPContext, type DPoPConfig, type DPoPVerificationResult, type JTICache, type TrustTier, } from './dpop-enforcement.js';
+export { RedisRateLimiter, createRateLimiter, redisRateLimitPlugin, redisRateLimitPerUser, redisRateLimitPerIp, redisRateLimitPerTenant, getRedisRateLimiter, resetRedisRateLimiter, type RedisRateLimiterConfig, type RateLimitWindow, type MultiWindowRateLimitConfig, type RateLimitCheckResult, type WindowResult, type RateLimiterFactoryOptions, type RedisRateLimitPluginOptions, } from './redis-rate-limiter.js';
+export { metricsMiddleware, createApiTimer, type MetricsMiddlewareOptions, } from './metrics.js';
+export { createWebhookVerifyMiddleware, webhookVerifyPlugin, verifyRequestSignature, getWebhookSecurityDocumentation, WEBHOOK_VERIFICATION_SAMPLE_CODE, SIGNATURE_HEADER, SIGNATURE_TIMESTAMP_HEADER, type WebhookVerifyConfig, type WebhookVerifyResult, } from './webhook-verify.js';
+export { rateLimitsPlugin, comprehensiveRateLimit, createEndpointRateLimit, getRateLimitStatus, getUserRateLimitStore, resetUserRateLimitStore, rateLimitConfig, defaultMultipliers, RATE_LIMIT_BYPASS_PERMISSION, type EndpointRateLimitConfig, type UserType, type RateLimitMultipliers, type RateLimitStatus, type RateLimitsPluginOptions, } from './rate-limits.js';
+export { createAuditMiddleware, auditMiddlewarePlugin, withAudit, captureBeforeState, recordAuditEvent, recordAccessDeniedEvent, type AuditEventConfig, type AuditContext, type AuditMiddlewareOptions, MUTATION_METHODS, type MutationMethod, } from './audit.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/api/middleware/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/middleware/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EACL,YAAY,EACZ,aAAa,EACb,cAAc,EACd,eAAe,EACf,wBAAwB,EACxB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,SAAS,EACd,KAAK,QAAQ,GACd,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,SAAS,EACT,kBAAkB,EAClB,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,0BAA0B,EAC1B,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,KAAK,qBAAqB,EAC1B,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,oBAAoB,EACpB,6BAA6B,EAC7B,aAAa,EACb,eAAe,EACf,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,OAAO,GACb,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAElB,gBAAgB,EAChB,aAAa,EACb,SAAS,EACT,SAAS,EACT,iBAAiB,EACjB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,wBAAwB,GAC9B,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EACL,qBAAqB,EACrB,YAAY,EACZ,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,oBAAoB,EACpB,cAAc,EACd,oBAAoB,EAEpB,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,sBAAsB,EAC3B,KAAK,QAAQ,EACb,KAAK,SAAS,GACf,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,GACjC,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,KAAK,wBAAwB,GAC9B,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,6BAA6B,EAC7B,mBAAmB,EACnB,sBAAsB,EACtB,+BAA+B,EAC/B,gCAAgC,EAChC,gBAAgB,EAChB,0BAA0B,EAC1B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,uBAAuB,EACvB,kBAAkB,EAClB,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,kBAAkB,EAClB,4BAA4B,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,QAAQ,EACb,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,uBAAuB,GAC7B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAEL,qBAAqB,EACrB,qBAAqB,EAGrB,SAAS,EACT,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EAGvB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAC3B,gBAAgB,EAChB,KAAK,cAAc,GACpB,MAAM,YAAY,CAAC"}