@winstonsayno/mcp-gateway 1.1.0 → 1.2.0

package/CHANGELOG.md

@@ -9,6 +9,91 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.2.0] - 2026-10-07
+
+Security hardening and more of the MCP spec on `/mcp`. Every new protection that could reject traffic that 1.1
+accepted is **opt-in**; see *Upgrade notes*.
+
+### Security
+- **Hashed API keys**: `auth.apiKeys` entries (plain strings or `key`) may be `sha256:<64 hex>` digests, so the config
+  file never holds a usable key. Digest and plain form of a key share the same client id. New CLI commands
+  `mcp-gateway gen-key` (random `mgw_…` key + digest, `--bytes`, `--prefix`, `--json`) and
+  `mcp-gateway hash-key [key]` (reads stdin when no argument is given). Malformed `sha256:` values are a config error.
+- **Key expiry / disabling**: `expiresAt` (ISO 8601) and `disabled` on object keys → `401`; open `/mcp` sessions of
+  such keys end on the next reload. Keys expiring within 7 days produce a warning.
+- **JWT hardening** (`auth.jwt`): `issuer`, `audience` (string or list), `algorithms` allowlist, `clockToleranceSeconds`,
+  `requireExp`, `maxTokenAgeSeconds`; verification keys from `jwtSecret` (HS*), a PEM `publicKey` (RS/PS/ES/EdDSA) or
+  a `jwksUrl` (HTTPS, cached `jwksCacheSeconds`, refetch on unknown `kid`). HMAC and asymmetric algorithms are never
+  mixed (algorithm-confusion protection); exactly one key source must be configured.
+- **Security headers** (`security.headers`, default on): `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`,
+  `Referrer-Policy: no-referrer`, `Cross-Origin-Opener-Policy`, `Cross-Origin-Resource-Policy`, a deny-all CSP on API
+  responses and a dashboard CSP that allows exactly its inline script by SHA-256 hash. Optional `security.hsts`.
+- **Network guards**: `security.ipAllowlist` (IPv4 / IPv6 / CIDR, via `net.BlockList`), `security.allowedHosts` (Host
+  header allowlist with `*.domain` wildcards), `security.trustProxy` (Express "trust proxy": decides `req.ip` for rate
+  limits, lockout, allowlist and logs). Liveness / readiness probes stay reachable.
+- **DNS-rebinding protection** (`security.dnsRebindingProtection`): Host must be a loopback name / the bind address
+  (or `allowedHosts`), and `/mcp` accepts browser `Origin`s only when same-origin, loopback or explicitly listed.
+- **Size limits**: `security.maxBodyBytes` (default 10 MiB as before, now configurable for REST and `/mcp`) and
+  `security.maxToolArgumentsBytes` for `tools/call`, `prompts/get` and `completion/complete` arguments (`413` on REST,
+  `-32602` on `/mcp`).
+- **Brute-force lockout** (`security.authLockout`): after `maxFailures` (10) failed authentications from one IP within
+  `windowSeconds` (300), the IP gets `429` + `Retry-After` for `lockoutSeconds` (900) on every authenticated route,
+  including `/mcp` and `/api/v1/events`.
+- **Secret redaction**: log lines and metadata, recorded `errorMessage`s (request log, audit log, `/requests`,
+  `/stats`, `/events`, dashboard) mask Bearer / Basic tokens, JWTs, common provider keys (OpenAI, Anthropic, GitHub,
+  GitLab, Slack, AWS, Google), `password=` / `token=` / `api_key=` pairs, URL credentials and values under
+  secret-looking keys. `GET /servers` now also masks secret-looking stdio `args` (`--token x`, `--api-key=x`). Extra
+  patterns via `security.redactPatterns`.
+- **Secure-defaults check**: startup warnings / hints (auth off on a public bind, DNS rebinding, `/mcp` open to any
+  origin, plain-text / short / expiring keys, JWT without iss / aud / exp, no lockout, `corsOrigins: ["*"]` with auth,
+  headers disabled, error details exposed). `mcp-gateway validate` prints them; `--strict` exits with code 2.
+- `GET /api/v1/security`: auth strategy, warnings, key hygiene counts and upcoming expiries, JWT settings, effective
+  security settings and lockout state — never key material; scoped clients get `403`. The dashboard's *Connect*
+  page shows it as a *Security posture* card (demo mock updated).
+- `SECURITY.md`: hardening table and scope; `docs/deployment.md` security checklist extended.
+
+### Fixed (security)
+- Unexpected errors (500) no longer return their message and stack trace whenever `NODE_ENV` was not `production`
+  (the default for `npm i -g` installs). They are shown only with `NODE_ENV=development` or the new
+  `security.exposeErrorDetails: true`. Deliberate `GatewayError` details are unchanged.
+
+### Added (MCP)
+- **Progress notifications**: a single `tools/call` with `params._meta.progressToken` from a client that accepts
+  `text/event-stream` is forwarded with a gateway-generated token; upstream `notifications/progress` are mapped back
+  and the reply becomes an SSE stream (progress events, then the result). Plain JSON otherwise.
+- **Logging**: `logging` capability, `logging/setLevel` per session; upstream `notifications/message` are forwarded to
+  sessions in scope at or above their level (`logger: "<serverId>/<logger>"`), and upstream servers announcing
+  `logging` are set to the most verbose level any session requested (re-applied after reconnects).
+- **Completion**: `completions` capability and `completion/complete` routed by prompt (exposed name translated back)
+  or resource template / URI; servers without the capability answer an empty completion.
+- **Resource subscriptions**: `resources.subscribe` capability, `resources/subscribe` / `resources/unsubscribe`
+  (routed like `resources/read`; `-32601` when the owning server does not support subscriptions) and
+  `notifications/resources/updated` forwarding. One upstream subscription per (server, URI) is shared and
+  reference-counted across sessions, released when the last session unsubscribes or ends, and restored after an
+  upstream reconnect.
+- Proxy: `RequestOptions.onProgress`, `connected` and `notification` events.
+- Library exports: `hashApiKey`, `isHashedKey`, `buildJwtVerifier`, `HMAC_ALGORITHMS`, `ASYMMETRIC_ALGORITHMS`,
+  `redactString`, `redactValue`, `redactArgs`, `configureRedaction`, `securityWarnings`, `AuthLockout`,
+  `createIpMatcher`, `hostAllowed`, `dashboardCsp`, `inlineScriptHashes`, `LOG_LEVELS`; types `SecurityConfig`,
+  `JwtConfig`, `AuthLockoutConfig`, `SecurityWarning`, `McpLogLevel`, `RequestOptions`, `ProgressUpdate`.
+
+### Changed
+- `auth.jwtSecret` is no longer required for `strategy: jwt` when `auth.jwt.publicKey` or `auth.jwt.jwksUrl` is set.
+- `initialize` on `/mcp` now also announces `logging`, `completions` and `resources.subscribe` (clients ignore
+  capabilities they do not use).
+- JWT verification failures are logged with the client IP.
+
+### Upgrade notes
+- No configuration changes are required. New behaviour that is on by default: security headers (disable with
+  `security.headers: false`), secret redaction in logs / recorded error messages, hidden 500 error details, and the
+  extra capabilities on `/mcp`.
+- If you embedded the dashboard in an `<iframe>` on another origin, set `security.headers: false` (the new
+  `frame-ancestors 'none'` / `X-Frame-Options: DENY` block that).
+- Tests or tooling that relied on 500 responses carrying `error.message` / `details` outside production need
+  `NODE_ENV=development` or `security.exposeErrorDetails: true`.
+- Everything else (`ipAllowlist`, `allowedHosts`, `dnsRebindingProtection`, `authLockout`, `maxToolArgumentsBytes`,
+  `hsts`, `trustProxy`, JWT checks, key expiry) is opt-in.
+
 ## [1.1.0] - 2026-10-07
 
 ### Added

package/README.md

@@ -21,6 +21,8 @@ Route · Authenticate · Rate-limit · Monitor — all your [Model Context Proto
 
 ---
 
+> **Live demo:** try the dashboard with simulated traffic — <https://harrisoncn.github.io/mcp-gateway/> (runs entirely in your browser).
+
 ## The Problem
 
 As [MCP](https://modelcontextprotocol.io) becomes the standard protocol for AI agents to interact with tools, teams are running **dozens of MCP servers** — filesystem, GitHub, databases, Slack, search, and more. Managing them is chaos:
@@ -63,10 +65,11 @@ As [MCP](https://modelcontextprotocol.io) becomes the standard protocol for AI a
 ## Features
 
 - **Unified API endpoint** — one URL for all your MCP tools, auto-routed by tool name
-- **MCP endpoint for clients** — `/mcp` speaks MCP Streamable HTTP (2025-06-18 / 2025-03-26), so Claude Code, Cursor or any MCP client sees every upstream tool through one server, with the same auth, limits and metrics
+- **MCP endpoint for clients** — `/mcp` speaks MCP Streamable HTTP (2025-06-18 / 2025-03-26), so Claude Code, Cursor or any MCP client sees every upstream tool through one server, with the same auth, limits and metrics — including progress notifications, cancellation, logging, completions and resource subscriptions
 - **Every MCP transport** — `stdio`, `streamable-http` (current spec), legacy `sse` (HTTP+SSE) and `websocket` upstream servers, with per-server headers for upstream auth
 - **Automatic reconnect** — crashed or disconnected servers are reconnected with exponential backoff + jitter; state is visible in `/servers`, `/health`, the dashboard and Prometheus
-- **Authentication** — API key (constant-time compare), JWT (HS256/384/512), or no-auth; misconfiguration fails closed
+- **Authentication** — API keys (constant-time compare, storable as `sha256:` digests, with expiry), JWT (HMAC secret, PEM public key or JWKS URL; issuer / audience / exp checks), or no-auth; misconfiguration fails closed
+- **Hardening** — security headers + hash-based CSP, IP allowlist, Host / Origin checks against DNS rebinding, body and argument size limits, brute-force lockout, secret redaction in logs and history, startup security warnings (`mcp-gateway validate --strict`)
 - **Rate limiting** — per-key sliding-window counter, with standard `X-RateLimit-*` headers
 - **Per-key scopes** — restrict an API key (or a JWT via claims) to some servers / tools and give it its own rate limit; enforced on REST and `/mcp`
 - **Concurrency limits** — per-server `maxConcurrency`, queued requests count against `timeout`
@@ -199,9 +202,9 @@ What the endpoint does:
 
 | | |
 |---|---|
-| `POST /mcp` | JSON-RPC: `initialize`, `ping`, `tools/list` (paginated), `tools/call`, `resources/list`, `resources/templates/list`, `resources/read`, `prompts/list`, `prompts/get`, notifications (incl. `notifications/cancelled`). Batches are accepted. Responses are `application/json`. |
-| `GET /mcp` | SSE stream for server→client notifications: `notifications/tools/list_changed`, `notifications/resources/list_changed` and `notifications/prompts/list_changed` are sent when the aggregated list a session sees changes (a server announces changes, connects, is removed by hot reload, …). |
-| Resources & prompts | Resource URIs are passed through unchanged; when two servers list the same URI the lowest server id wins. `resources/read` is routed by exact URI, then by resource template, then to the only server with resources. Prompt names follow `toolNaming` like tools. `resources/subscribe` is not offered. |
+| `POST /mcp` | JSON-RPC: `initialize`, `ping`, `tools/list` (paginated), `tools/call`, `resources/list`, `resources/templates/list`, `resources/read`, `resources/subscribe` / `unsubscribe`, `prompts/list`, `prompts/get`, `logging/setLevel`, `completion/complete`, notifications (incl. `notifications/cancelled`). Batches are accepted. Responses are `application/json`; a single `tools/call` with `_meta.progressToken` switches to an SSE reply when the upstream reports progress (`notifications/progress`, then the result). |
+| `GET /mcp` | SSE stream for server→client notifications: `notifications/tools/list_changed`, `notifications/resources/list_changed` and `notifications/prompts/list_changed` are sent when the aggregated list a session sees changes (a server announces changes, connects, is removed by hot reload, …); `notifications/resources/updated` for subscribed URIs; upstream `notifications/message` at or above the session's `logging/setLevel` level (`logger` = `<serverId>/<logger>`). |
+| Resources & prompts | Resource URIs are passed through unchanged; when two servers list the same URI the lowest server id wins. `resources/read` is routed by exact URI, then by resource template, then to the only server with resources. Prompt names follow `toolNaming` like tools. `resources/subscribe` is routed the same way; sessions share one upstream subscription per URI, restored after reconnects. `completion/complete` is routed by prompt name or resource template. |
 | `DELETE /mcp` | Ends the session. |
 | Sessions | `initialize` returns `Mcp-Session-Id`; later requests must send it (`400` if missing, `404` if unknown or expired). A session is bound to the API key / JWT subject that created it. Idle sessions expire after `mcp.sessionIdleTimeoutSeconds`. |
 | Tool names | `toolNaming: auto` (default) keeps a tool's name unless two servers expose the same name; then every copy becomes `<serverId>__<tool>`. `prefix` always uses `<serverId>__<tool>`. Ordering is deterministic (server id, then tool name). In `auto` mode the prefixed form is also accepted by `tools/call`. |
@@ -292,11 +295,13 @@ auth:
   strategy: api-key           # none | api-key | jwt   (oauth2 is not implemented and is rejected)
   apiKeys:
     - "your-secret-key"       # full access
+    - "sha256:…"              # a key stored as its digest (mcp-gateway gen-key / hash-key)
     - key: "${APP_KEY}"       # scoped key (see "Per-key scopes")
       name: app
       servers: ["github"]
       tools: ["read_*"]
       rateLimit: { limit: 30, windowSeconds: 60 }
+      expiresAt: "2027-01-01" # optional expiry; disabled: true switches a key off
   protect:
     health: false             # true → /api/v1/health requires auth
     metrics: false            # true → /api/v1/metrics requires auth (configure your scraper)
@@ -323,6 +328,12 @@ monitor:
   prometheus: true            # Enable Prometheus /metrics
   retentionHours: 24          # Metrics retention
 
+security:                     # hardening (see docs/configuration.md#security)
+  authLockout: true           # 429 for IPs with repeated auth failures
+  dnsRebindingProtection: false  # true for a local gateway without auth
+  ipAllowlist: ["10.0.0.0/8"]
+  maxToolArgumentsBytes: 262144
+
 corsOrigins:
   - "https://your-app.com"
 
@@ -568,6 +579,18 @@ await gateway.start();
 process.on('SIGTERM', () => gateway.stop());
 ```
 
+## What's New in v1.2
+
+| Feature | Description |
+|---------|-------------|
+| **Hashed & expiring keys** | `auth.apiKeys` entries can be `sha256:<hex>` digests (`mcp-gateway gen-key`, `hash-key`) and carry `expiresAt` / `disabled` |
+| **JWT hardening** | `auth.jwt`: `issuer`, `audience`, `algorithms` (HMAC / asymmetric never mixed), `clockToleranceSeconds`, `requireExp`, `maxTokenAgeSeconds`, PEM `publicKey` or cached `jwksUrl` (works with OAuth 2.0 / OIDC providers) |
+| **`security` block** | headers + dashboard CSP, `hsts`, `trustProxy`, `ipAllowlist`, `allowedHosts`, `dnsRebindingProtection`, `maxBodyBytes`, `maxToolArgumentsBytes`, `authLockout`, `redactPatterns` — all hot reloadable |
+| **Secure-defaults check** | startup warnings, `validate --strict`, `GET /api/v1/security` and a *Security posture* card in the dashboard |
+| **More of MCP on `/mcp`** | `notifications/progress` (SSE replies), `logging/setLevel` + forwarded `notifications/message`, `completion/complete`, `resources/subscribe` / `unsubscribe` + `notifications/resources/updated` |
+
+Details and upgrade notes: [CHANGELOG](CHANGELOG.md#120---2026-10-07).
+
 ## What's New in v1.0
 
 | Feature | Description |
@@ -617,8 +640,11 @@ unknown fields). Deep imports, log format, the dashboard and the audit database
 | JS / Kotlin clients, OpenAI / Anthropic tool schemas | ✅ Done (v1.0) |
 | Resources & prompts passthrough, persistent audit log | ✅ Done (v1.0) |
 | Stable API, docs, container image | ✅ Done (v1.0) |
+| Security hardening (hashed keys, JWKS, lockout, DNS-rebinding guard, CSP) | ✅ Done (v1.2) |
+| Progress, logging, completions, resource subscriptions on `/mcp` | ✅ Done (v1.2) |
 | Redis-backed rate limiting | 📋 Planned |
-| OAuth2 / OIDC auth | 📋 Planned |
+| OAuth2 / OIDC auth | 🟡 JWT access tokens via `auth.jwt.jwksUrl` (v1.2); discovery / token introspection planned |
+| Forwarding sampling / elicitation / roots requests to downstream clients | 📋 Planned |
 | Tool-level access control | ✅ Done via per-key scopes (v0.6) |
 | Request replay & debugging | 📋 Planned (history is available via the audit log) |
 | Multi-tenant mode | 📋 Planned |

package/dashboard/README.md

@@ -70,3 +70,7 @@ servers and tools.
 |---|---|
 | ![Onboarding](../docs/images/dashboard-onboarding-try-tool.png) | ![Playground (中文)](../docs/images/dashboard-playground-zh.png) |
 | ![Light theme](../docs/images/dashboard-overview-light.png) | ![Mobile](../docs/images/dashboard-mobile-zh.png) |
+
+## Demo build
+
+`demo/mock.js` replaces `fetch` for the gateway API with an in-browser simulation (servers, tools, request stream, SSE events). The GitHub Pages workflow (`.github/workflows/pages.yml`) injects it before the dashboard script and publishes the result to <https://harrisoncn.github.io/mcp-gateway/>. It is not shipped in the npm package or Docker image.

package/dashboard/index.html

@@ -196,6 +196,12 @@ main { max-width: 1320px; margin: 0 auto; padding: 20px 16px 96px; }
 .kv b { font-size: 13.5px; font-variant-numeric: tabular-nums; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; display: block; }
 .srv .err { color: var(--bad); font-size: 12px; overflow-wrap: anywhere; }
 .chips { display: flex; flex-wrap: wrap; gap: 6px; }
+.sec-card { margin-top: 14px; }
+.sec-card .kv { margin-bottom: 12px; }
+.sec-list { list-style: none; margin: 0; padding: 0; display: grid; gap: 8px; }
+.sec-list li { display: flex; gap: 10px; align-items: flex-start; font-size: 13px; line-height: 1.45; color: var(--text); }
+.sec-list li .badge { flex: none; margin-top: 1px; }
+@media (max-width: 560px) { .sec-card .kv { grid-template-columns: repeat(2, 1fr); } }
 .chip { font-family: var(--mono); font-size: 11.5px; padding: 3px 8px; border-radius: 7px; background: var(--surface-2); border: 1px solid var(--border); cursor: pointer; transition: border-color .2s, transform .15s var(--ease); }
 .chip:hover { border-color: var(--accent); }
 .chip:active { transform: scale(.95); }
@@ -478,6 +484,7 @@ tbody tr:hover { background: var(--surface-2); }
   <section class="view" id="view-connect" role="tabpanel" aria-labelledby="tab-connect">
     <div class="page-head"><div><h1 data-i18n="cnTitle">Connect a client</h1><p data-i18n="cnSub">Point any MCP client at this gateway</p></div></div>
     <div class="card" id="connectCard"></div>
+    <div class="card sec-card" id="securityCard" hidden></div>
   </section>
 </main>
 
@@ -567,6 +574,7 @@ const I18N = {
     via: 'Via', kind: 'Kind', any: 'Any', ok: 'OK', failed: 'Failed', apply: 'Apply', reset: 'Reset', time: 'Time', duration: 'Duration',
     prev: '← Newer', next: 'Older →', page: 'Page {n}', srcAudit: 'Persistent audit log', srcMemory: 'In-memory log',
     cnTitle: 'Connect a client', cnSub: 'Point any MCP client at this gateway',
+    secTitle: 'Security posture', secOk: 'No issues', secIssues: '{n} to review', secAuth: 'Auth', secKeys: 'Hashed keys', secLockout: 'Lockout', secRebind: 'DNS-rebinding guard', secHeaders: 'Security headers', secLocked: 'Locked IPs', secOn: 'on', secOff: 'off', secWarn: 'warning', secHint: 'hint', secNone: 'Nothing to report.',
     ob1Eye: 'Step 1 · Connect', ob1Title: 'Welcome to your MCP gateway',
     ob1Lead: "One endpoint for every MCP server — with auth, rate limits and live metrics. Let's get you connected in under a minute.",
     hero1: 'Many servers', hero1s: 'stdio, SSE, WebSocket, HTTP', hero2: 'One secure door', hero2s: 'keys, scopes, limits', hero3: 'Live insight', hero3s: 'latency, errors, usage',
@@ -611,6 +619,7 @@ const I18N = {
     via: '通道', kind: '类型', any: '全部', ok: '成功', failed: '失败', apply: '应用', reset: '重置', time: '时间', duration: '耗时',
     prev: '← 较新', next: '较早 →', page: '第 {n} 页', srcAudit: '持久化审计日志', srcMemory: '内存日志',
     cnTitle: '接入客户端', cnSub: '让任意 MCP 客户端连接到本网关',
+    secTitle: '安全状态', secOk: '无问题', secIssues: '{n} 项待处理', secAuth: '认证', secKeys: '已哈希的密钥', secLockout: '失败锁定', secRebind: 'DNS 重绑定防护', secHeaders: '安全响应头', secLocked: '已锁定 IP', secOn: '开', secOff: '关', secWarn: '警告', secHint: '建议', secNone: '暂无可报告的问题。',
     ob1Eye: '第 1 步 · 连接', ob1Title: '欢迎使用 MCP 网关',
     ob1Lead: '一个入口接入所有 MCP 服务器——自带鉴权、限流与实时监控。一分钟内即可完成连接。',
     hero1: '多个服务器', hero1s: 'stdio、SSE、WebSocket、HTTP', hero2: '统一安全入口', hero2s: '密钥、权限范围、限流', hero3: '实时洞察', hero3s: '延迟、错误、用量',
@@ -672,7 +681,7 @@ const fmtNum = (v, d = 0) => (v == null || !isFinite(v) ? '—' : v >= 1e6 ? (v
 const fmtTime = (ts) => new Date(ts).toLocaleTimeString(lang === 'zh' ? 'zh-CN' : undefined, { hour12: false });
 const fmtDateTime = (ts) => new Date(ts).toLocaleString(lang === 'zh' ? 'zh-CN' : undefined, { hour12: false, month: 'short', day: 'numeric', hour: '2-digit', minute: '2-digit', second: '2-digit' });
 const statusCls = (s) => ({ online: 'ok', degraded: 'warn', reconnecting: 'info', offline: 'bad' })[s] || '';
-const ORIGIN = location.origin;
+const ORIGIN = window.__MCP_GATEWAY_DEMO__ ? 'http://localhost:4000' : location.origin;
 const ICON = {
   overview: '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round"><path d="M3 13h4l3-8 4 14 3-6h4"/></svg>',
   servers: '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><rect x="3" y="4" width="18" height="6" rx="2"/><rect x="3" y="14" width="18" height="6" rx="2"/><path d="M7 7h.01M7 17h.01"/></svg>',
@@ -828,7 +837,7 @@ function go(view, push = true) {
   if (view === 'servers') loadServers();
   if (view === 'playground') renderPlayground($('#pgMain'), 'main');
   if (view === 'history') loadHistory();
-  if (view === 'connect') renderSnippets($('#connectCard'), 'main');
+  if (view === 'connect') { renderSnippets($('#connectCard'), 'main'); loadSecurity(); }
   if (view === 'overview') requestAnimationFrame(renderCharts);
 }
 window.addEventListener('hashchange', () => go(location.hash.slice(1), false));
@@ -1537,6 +1546,36 @@ document.addEventListener('keydown', (e) => {
   }
 });
 
+// ─── Security posture (Connect page) ─────────────────────────────────────────
+async function loadSecurity() {
+  try { state.security = await api('/security'); }
+  catch { state.security = null; }  // older gateway, scoped key or no access: hide the card
+  renderSecurity();
+}
+function renderSecurity() {
+  const card = $('#securityCard');
+  const s = state.security;
+  if (!s || !Array.isArray(s.warnings)) { card.hidden = true; return; }
+  card.hidden = false;
+  const warns = s.warnings.filter((w) => w.level === 'warn').length;
+  const onOff = (v) => esc(v ? t('secOn') : t('secOff'));
+  const k = s.apiKeys || { total: 0, hashed: 0 };
+  const facts = [
+    [t('secAuth'), esc(s.authStrategy)],
+    [t('secKeys'), k.total ? `${k.hashed}/${k.total}` : '—'],
+    [t('secLockout'), onOff(s.settings?.authLockout)],
+    [t('secRebind'), onOff(s.settings?.dnsRebindingProtection)],
+    [t('secHeaders'), onOff(s.settings?.headers)],
+    [t('secLocked'), s.lockout ? String(s.lockout.lockedClients) : '—'],
+  ];
+  card.innerHTML =
+    `<h2><span>${esc(t('secTitle'))}</span><span class="badge ${warns ? 'warn' : 'ok'}" style="margin-left:auto">${esc(warns ? t('secIssues').replace('{n}', warns) : t('secOk'))}</span></h2>` +
+    `<div class="kv">${facts.map(([a, b]) => `<div><span>${esc(a)}</span><b>${b}</b></div>`).join('')}</div>` +
+    (s.warnings.length
+      ? `<ul class="sec-list">${s.warnings.map((w) => `<li><span class="badge ${w.level === 'warn' ? 'warn' : 'info'}">${esc(w.level === 'warn' ? t('secWarn') : t('secHint'))}</span><span>${esc(w.message)}</span></li>`).join('')}</ul>`
+      : `<div class="empty">${esc(t('secNone'))}</div>`);
+}
+
 // ─── Language ────────────────────────────────────────────────────────────────
 $('#langBtn').addEventListener('click', () => transition(() => {
   lang = lang === 'zh' ? 'en' : 'zh';
@@ -1545,7 +1584,7 @@ $('#langBtn').addEventListener('click', () => transition(() => {
   if (state.servers.length) renderServers();
   delete $('#pgMain').dataset.built; delete $('#obPg').dataset.built;
   if (state.view === 'playground') renderPlayground($('#pgMain'), 'main');
-  if (state.view === 'connect') renderSnippets($('#connectCard'), 'main');
+  if (state.view === 'connect') { renderSnippets($('#connectCard'), 'main'); renderSecurity(); }
   if (state.view === 'history') loadHistory();
   if (!$('#ob').hidden) showStep(obState.step);
 }));

package/dist/auth/middleware.d.ts

@@ -10,8 +10,17 @@
  *  - The client id attached to a request is a hash fingerprint of the key,
  *    never a prefix of the key itself (prefixes were leaking into logs and the
  *    /requests endpoint, and keys sharing a prefix shared a rate-limit bucket).
+ *  - Keys may be stored as SHA-256 digests (`sha256:<hex>`), so the config
+ *    file never holds a usable key. A digest key and its plain form produce
+ *    the same client id.
+ *  - Keys can expire (`expiresAt`) or be switched off (`disabled`).
+ *  - JWTs: HMAC secret, PEM public key or JWKS URL; algorithm allowlist that
+ *    never mixes HMAC and asymmetric algorithms; optional issuer / audience /
+ *    exp / max-age checks and clock tolerance.
  */
+import { type KeyObject } from 'crypto';
 import type { Request, RequestHandler } from 'express';
+import { type JWTVerifyGetKey, type JWTVerifyOptions } from 'jose';
 import type { ApiKeyConfig, AuthConfig } from '../utils/types.js';
 import { type AccessScope } from './scopes.js';
 export type AuthedRequest = Request & {
@@ -34,10 +43,30 @@ export type AuthMiddleware = RequestHandler & {
 };
 /** Normalise `auth.apiKeys` entries (plain strings or objects). */
 export declare function normalizeApiKeys(keys: AuthConfig['apiKeys']): ApiKeyConfig[];
+export declare const HMAC_ALGORITHMS: string[];
+export declare const ASYMMETRIC_ALGORITHMS: string[];
+/** Whether a configured key is a `sha256:<hex>` digest rather than the key itself. */
+export declare function isHashedKey(key: string): boolean;
+/** `sha256:<hex>` digest of a key, the form to store in the config file. */
+export declare function hashApiKey(key: string): string;
+/** Expiry of a key entry as epoch ms (undefined = never; NaN for an unparsable date). */
+export declare function keyExpiry(entry: ApiKeyConfig): number | undefined;
+/** Why a key is currently unusable, or undefined when it is active. */
+export declare function keyInactiveReason(entry: ApiKeyConfig, now?: number): 'disabled' | 'expired' | undefined;
 export declare function createAuthMiddleware(config?: AuthConfig): AuthMiddleware;
 export declare function fingerprint(key: string): string;
 /** Constant-time membership check against a pre-hashed key list. */
 export declare function matchesAnyKey(candidate: string, keyDigests: Buffer[]): boolean;
 /** Constant-time lookup: index of the matching key digest, or -1. */
 export declare function matchKeyIndex(candidate: string, keyDigests: Buffer[]): number;
+export interface JwtVerifier {
+    key: Uint8Array | KeyObject | JWTVerifyGetKey;
+    options: JWTVerifyOptions;
+}
+/**
+ * Key source + verification options for the `jwt` strategy. Throws on
+ * misconfiguration (missing / conflicting key sources, algorithms that do not
+ * fit the key type, non-HTTPS JWKS URL).
+ */
+export declare function buildJwtVerifier(config: AuthConfig): JwtVerifier;
 //# sourceMappingURL=middleware.d.ts.map

package/dist/auth/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,OAAO,EAA0B,cAAc,EAAE,MAAM,SAAS,CAAC;AAE/E,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAElE,OAAO,EAAgB,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAE7D,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,yFAAyF;IACzF,KAAK,CAAC,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,kGAAkG;AAClG,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG;IAC5C;;;;OAIG;IACH,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,KAAK;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,WAAW,CAAA;KAAE,CAAC;CAC3F,CAAC;AAEF,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG,YAAY,EAAE,CAI5E;AAaD,wBAAgB,oBAAoB,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,cAAc,CAmCxE;AAMD,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,oEAAoE;AACpE,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAE9E;AAED,qEAAqE;AACrE,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,CAQ7E"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAgD,KAAK,SAAS,EAAE,MAAM,QAAQ,CAAC;AACtF,OAAO,KAAK,EAAE,OAAO,EAA0B,cAAc,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,EAAiC,KAAK,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,MAAM,CAAC;AAClG,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAa,MAAM,mBAAmB,CAAC;AAE7E,OAAO,EAAgB,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAE7D,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,yFAAyF;IACzF,KAAK,CAAC,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,kGAAkG;AAClG,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG;IAC5C;;;;OAIG;IACH,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,KAAK;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,WAAW,CAAA;KAAE,CAAC;CAC3F,CAAC;AAEF,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG,YAAY,EAAE,CAI5E;AAWD,eAAO,MAAM,eAAe,UAA8B,CAAC;AAC3D,eAAO,MAAM,qBAAqB,UAKjC,CAAC;AAIF,sFAAsF;AACtF,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEhD;AAED,4EAA4E;AAC5E,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,yFAAyF;AACzF,wBAAgB,SAAS,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,GAAG,SAAS,CAGjE;AAED,uEAAuE;AACvE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,SAAa,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAK3G;AAED,wBAAgB,oBAAoB,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,cAAc,CA4BxE;AAYD,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAI/C;AAED,oEAAoE;AACpE,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAE9E;AAED,qEAAqE;AACrE,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,CAQ7E;AAsDD,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,UAAU,GAAG,SAAS,GAAG,eAAe,CAAC;IAC9C,OAAO,EAAE,gBAAgB,CAAC;CAC3B;AAID;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,WAAW,CAyDhE"}

package/dist/auth/middleware.js

@@ -10,9 +10,16 @@
  *  - The client id attached to a request is a hash fingerprint of the key,
  *    never a prefix of the key itself (prefixes were leaking into logs and the
  *    /requests endpoint, and keys sharing a prefix shared a rate-limit bucket).
+ *  - Keys may be stored as SHA-256 digests (`sha256:<hex>`), so the config
+ *    file never holds a usable key. A digest key and its plain form produce
+ *    the same client id.
+ *  - Keys can expire (`expiresAt`) or be switched off (`disabled`).
+ *  - JWTs: HMAC secret, PEM public key or JWKS URL; algorithm allowlist that
+ *    never mixes HMAC and asymmetric algorithms; optional issuer / audience /
+ *    exp / max-age checks and clock tolerance.
  */
-import { createHash, timingSafeEqual } from 'crypto';
-import { jwtVerify } from 'jose';
+import { createHash, createPublicKey, timingSafeEqual } from 'crypto';
+import { createRemoteJWKSet, jwtVerify } from 'jose';
 import { logger } from '../utils/logger.js';
 import { scopeFromJwt } from './scopes.js';
 /** Normalise `auth.apiKeys` entries (plain strings or objects). */
@@ -33,7 +40,37 @@ function scopeOf(entry) {
         scope.rateLimit = { ...entry.rateLimit, perKey: true };
     return Object.keys(scope).length > 0 ? scope : undefined;
 }
-const JWT_ALGORITHMS = ['HS256', 'HS384', 'HS512'];
+export const HMAC_ALGORITHMS = ['HS256', 'HS384', 'HS512'];
+export const ASYMMETRIC_ALGORITHMS = [
+    'RS256', 'RS384', 'RS512',
+    'PS256', 'PS384', 'PS512',
+    'ES256', 'ES384', 'ES512',
+    'EdDSA',
+];
+const HASHED_KEY_RE = /^sha256:([0-9a-f]{64})$/i;
+/** Whether a configured key is a `sha256:<hex>` digest rather than the key itself. */
+export function isHashedKey(key) {
+    return HASHED_KEY_RE.test(key);
+}
+/** `sha256:<hex>` digest of a key, the form to store in the config file. */
+export function hashApiKey(key) {
+    return `sha256:${createHash('sha256').update(key, 'utf8').digest('hex')}`;
+}
+/** Expiry of a key entry as epoch ms (undefined = never; NaN for an unparsable date). */
+export function keyExpiry(entry) {
+    if (entry.expiresAt === undefined)
+        return undefined;
+    return Date.parse(entry.expiresAt);
+}
+/** Why a key is currently unusable, or undefined when it is active. */
+export function keyInactiveReason(entry, now = Date.now()) {
+    if (entry.disabled)
+        return 'disabled';
+    const exp = keyExpiry(entry);
+    if (exp !== undefined && !(exp > now))
+        return 'expired';
+    return undefined;
+}
 export function createAuthMiddleware(config) {
     if (!config || config.strategy === 'none') {
         const none = (_req, _res, next) => next();
@@ -56,15 +93,8 @@ export function createAuthMiddleware(config) {
             }
             return apiKeyMiddleware(keys);
         }
-        case 'jwt': {
-            if (!config.jwtSecret) {
-                throw new Error('auth.strategy is "jwt" but auth.jwtSecret is not configured');
-            }
-            if (config.jwtSecret.length < 32) {
-                logger.warn('auth.jwtSecret is shorter than 32 characters; use a longer random secret');
-            }
-            return jwtMiddleware(config.jwtSecret);
-        }
+        case 'jwt':
+            return jwtMiddleware(buildJwtVerifier(config));
         default:
             // Fail closed. Previously this fell back to *no auth*, so configuring the
             // advertised-but-unimplemented "oauth2" strategy exposed every endpoint.
@@ -74,7 +104,15 @@ export function createAuthMiddleware(config) {
 function digest(value) {
     return createHash('sha256').update(value, 'utf8').digest();
 }
+/** Digest of a configured key: the stored digest for `sha256:` keys, else SHA-256 of the key. */
+function configuredDigest(key) {
+    const m = HASHED_KEY_RE.exec(key);
+    return m ? Buffer.from(m[1], 'hex') : digest(key);
+}
 export function fingerprint(key) {
+    const m = HASHED_KEY_RE.exec(key);
+    if (m)
+        return m[1].toLowerCase().slice(0, 12);
     return createHash('sha256').update(key, 'utf8').digest('hex').slice(0, 12);
 }
 /** Constant-time membership check against a pre-hashed key list. */
@@ -103,7 +141,12 @@ function extractKey(req) {
     return undefined;
 }
 function apiKeyMiddleware(entries) {
-    const keyDigests = entries.map((e) => digest(e.key));
+    for (const e of entries) {
+        if (e.expiresAt !== undefined && Number.isNaN(keyExpiry(e))) {
+            throw new Error(`auth.apiKeys: invalid expiresAt "${e.expiresAt}"${e.name ? ` (key "${e.name}")` : ''}`);
+        }
+    }
+    const keyDigests = entries.map((e) => configuredDigest(e.key));
     const clients = entries.map((e) => ({
         clientId: e.name ? `key:${e.name}` : `key:${fingerprint(e.key)}`,
         scope: scopeOf(e),
@@ -118,6 +161,12 @@ function apiKeyMiddleware(entries) {
             return;
         }
         const client = clients[index];
+        const inactive = keyInactiveReason(entries[index]);
+        if (inactive) {
+            logger.warn(`Unauthorized request from ${req.ip}: API key ${client.clientId} is ${inactive}`);
+            res.status(401).json({ error: 'Unauthorized', message: 'Valid API key required' });
+            return;
+        }
         req.clientId = client.clientId;
         if (client.scope)
             req.scope = client.scope;
@@ -125,12 +174,87 @@ function apiKeyMiddleware(entries) {
     };
     mw.resolveClient = (clientId) => {
         const c = clientId ? byClientId.get(clientId) : undefined;
-        return c ? { known: true, scope: c.scope } : { known: false };
+        if (!c || keyInactiveReason(entries[clients.indexOf(c)]))
+            return { known: false };
+        return { known: true, scope: c.scope };
     };
     return mw;
 }
-function jwtMiddleware(secret) {
-    const secretKey = new TextEncoder().encode(secret);
+const asList = (v) => (v === undefined ? undefined : Array.isArray(v) ? v : [v]);
+/**
+ * Key source + verification options for the `jwt` strategy. Throws on
+ * misconfiguration (missing / conflicting key sources, algorithms that do not
+ * fit the key type, non-HTTPS JWKS URL).
+ */
+export function buildJwtVerifier(config) {
+    const jwt = config.jwt ?? {};
+    const sources = [config.jwtSecret ? 'jwtSecret' : '', jwt.publicKey ? 'jwt.publicKey' : '', jwt.jwksUrl ? 'jwt.jwksUrl' : ''].filter(Boolean);
+    if (sources.length === 0) {
+        throw new Error('auth.strategy is "jwt" but none of auth.jwtSecret, auth.jwt.publicKey or auth.jwt.jwksUrl is configured');
+    }
+    if (sources.length > 1)
+        throw new Error(`auth: configure only one of ${sources.join(', ')}`);
+    const hmac = !!config.jwtSecret;
+    const allowed = hmac ? HMAC_ALGORITHMS : ASYMMETRIC_ALGORITHMS;
+    const algorithms = jwt.algorithms ?? allowed;
+    if (algorithms.length === 0)
+        throw new Error('auth.jwt.algorithms must not be empty');
+    const bad = algorithms.filter((a) => !allowed.includes(a));
+    if (bad.length > 0) {
+        throw new Error(`auth.jwt.algorithms: ${bad.join(', ')} cannot be used with ${sources[0]} (allowed: ${allowed.join(', ')})`);
+    }
+    let key;
+    if (config.jwtSecret) {
+        if (config.jwtSecret.length < 32) {
+            logger.warn('auth.jwtSecret is shorter than 32 characters; use a longer random secret');
+        }
+        key = new TextEncoder().encode(config.jwtSecret);
+    }
+    else if (jwt.publicKey) {
+        try {
+            key = createPublicKey(jwt.publicKey);
+        }
+        catch (err) {
+            throw new Error(`auth.jwt.publicKey is not a valid PEM public key: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    else {
+        let url;
+        try {
+            url = new URL(jwt.jwksUrl);
+        }
+        catch {
+            throw new Error(`auth.jwt.jwksUrl is not a valid URL: ${jwt.jwksUrl}`);
+        }
+        const local = ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname);
+        if (url.protocol !== 'https:' && !(url.protocol === 'http:' && local)) {
+            throw new Error('auth.jwt.jwksUrl must use https:// (http:// is only allowed for localhost)');
+        }
+        key = createRemoteJWKSet(url, {
+            cacheMaxAge: (jwt.jwksCacheSeconds ?? 600) * 1000,
+            cooldownDuration: 30_000,
+            timeoutDuration: 5_000,
+        });
+    }
+    const options = { algorithms };
+    const issuer = asList(jwt.issuer);
+    const audience = asList(jwt.audience);
+    if (issuer)
+        options.issuer = issuer;
+    if (audience)
+        options.audience = audience;
+    if (jwt.clockToleranceSeconds)
+        options.clockTolerance = jwt.clockToleranceSeconds;
+    if (jwt.requireExp)
+        options.requiredClaims = ['exp'];
+    if (jwt.maxTokenAgeSeconds)
+        options.maxTokenAge = jwt.maxTokenAgeSeconds;
+    return { key, options };
+}
+function jwtMiddleware(verifier) {
+    const verify = (token) => typeof verifier.key === 'function'
+        ? jwtVerify(token, verifier.key, verifier.options)
+        : jwtVerify(token, verifier.key, verifier.options);
     return (req, res, next) => {
         const authHeader = req.headers.authorization;
         if (!authHeader || !/^Bearer /i.test(authHeader)) {
@@ -140,7 +264,7 @@ function jwtMiddleware(secret) {
         const token = authHeader.slice(7).trim();
         // Two-argument then(): an error thrown downstream of next() must not be
         // misreported as an auth failure.
-        jwtVerify(token, secretKey, { algorithms: JWT_ALGORITHMS }).then(({ payload }) => {
+        verify(token).then(({ payload }) => {
             req.jwtPayload = payload;
             req.clientId = `jwt:${String(payload.sub ?? 'unknown')}`;
             const scope = scopeFromJwt(payload);
@@ -148,7 +272,7 @@ function jwtMiddleware(secret) {
                 req.scope = scope;
             next();
         }, (err) => {
-            logger.warn(`JWT verification failed: ${err instanceof Error ? err.message : String(err)}`);
+            logger.warn(`JWT verification failed from ${req.ip}: ${err instanceof Error ? err.message : String(err)}`);
             if (!res.headersSent) {
                 res.status(401).json({ error: 'Unauthorized', message: 'Invalid or expired token' });
             }

package/dist/auth/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAErD,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEjC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAoB,MAAM,aAAa,CAAC;AAmB7D,mEAAmE;AACnE,MAAM,UAAU,gBAAgB,CAAC,IAA2B;IAC1D,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;SAChB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACpD,MAAM,CAAC,CAAC,CAAC,EAAqB,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,OAAO,CAAC,KAAmB;IAClC,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,IAAI,KAAK,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxC,IAAI,KAAK,CAAC,OAAO;QAAE,KAAK,CAAC,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,KAAK;QAAE,KAAK,CAAC,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,SAAS;QAAE,KAAK,CAAC,SAAS,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC5E,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAEnD,MAAM,UAAU,oBAAoB,CAAC,MAAmB;IACtD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAmB,CAAC,IAAa,EAAE,IAAc,EAAE,IAAkB,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3F,IAAI,CAAC,aAAa,GAAG,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxB,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;YAChC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,IAAI,CAAC,CAAC,CAAC,IAAI;oBAAE,SAAS;gBACtB,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;gBACvF,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;YACD,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;YACjF,CAAC;YACD,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;gBACjC,MAAM,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;YAC1F,CAAC;YACD,OAAO,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzC,CAAC;QACD;YACE,0EAA0E;YAC1E,yEAAyE;YACzE,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,UAAoB;IACnE,OAAO,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,UAAoB;IACnE,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;IACf,oFAAoF;IACpF,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC1B,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC;YAAE,KAAK,GAAG,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7C,IAAI,UAAU,IAAI,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/C,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IACjD,CAAC;IACD,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC;IACrF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAuB;IAC/C,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE;QAChE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;KAClB,CAAC,CAAC,CAAC;IACJ,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhE,MAAM,EAAE,GAAmB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC7E,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAExD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,6BAA6B,GAAG,CAAC,EAAE,8BAA8B,CAAC,CAAC;YAC/E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;QAC9B,GAAqB,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAClD,IAAI,MAAM,CAAC,KAAK;YAAG,GAAqB,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC9D,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IACF,EAAE,CAAC,aAAa,GAAG,CAAC,QAAQ,EAAE,EAAE;QAC9B,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1D,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAChE,CAAC,CAAC;IACF,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEnD,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAEzC,wEAAwE;QACxE,kCAAkC;QAClC,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC,IAAI,CAC9D,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;YACb,GAAqB,CAAC,UAAU,GAAG,OAAO,CAAC;YAC3C,GAAqB,CAAC,QAAQ,GAAG,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,SAAS,CAAC,EAAE,CAAC;YAC5E,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,KAAK;gBAAG,GAAqB,CAAC,KAAK,GAAG,KAAK,CAAC;YAChD,IAAI,EAAE,CAAC;QACT,CAAC,EACD,CAAC,GAAY,EAAE,EAAE;YACf,MAAM,CAAC,IAAI,CAAC,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5F,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACvF,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAkB,MAAM,QAAQ,CAAC;AAEtF,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAA+C,MAAM,MAAM,CAAC;AAElG,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAoB,MAAM,aAAa,CAAC;AAmB7D,mEAAmE;AACnE,MAAM,UAAU,gBAAgB,CAAC,IAA2B;IAC1D,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;SAChB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACpD,MAAM,CAAC,CAAC,CAAC,EAAqB,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,OAAO,CAAC,KAAmB;IAClC,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,IAAI,KAAK,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxC,IAAI,KAAK,CAAC,OAAO;QAAE,KAAK,CAAC,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,KAAK;QAAE,KAAK,CAAC,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,SAAS;QAAE,KAAK,CAAC,SAAS,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC5E,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC3D,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,OAAO,EAAE,OAAO,EAAE,OAAO;IACzB,OAAO,EAAE,OAAO,EAAE,OAAO;IACzB,OAAO,EAAE,OAAO,EAAE,OAAO;IACzB,OAAO;CACR,CAAC;AAEF,MAAM,aAAa,GAAG,0BAA0B,CAAC;AAEjD,sFAAsF;AACtF,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,OAAO,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,SAAS,CAAC,KAAmB;IAC3C,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AACrC,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,iBAAiB,CAAC,KAAmB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACrE,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,UAAU,CAAC;IACtC,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACxD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAmB;IACtD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAmB,CAAC,IAAa,EAAE,IAAc,EAAE,IAAkB,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3F,IAAI,CAAC,aAAa,GAAG,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxB,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;YAChC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,IAAI,CAAC,CAAC,CAAC,IAAI;oBAAE,SAAS;gBACtB,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;gBACvF,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;YACD,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,KAAK;YACR,OAAO,aAAa,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;QACjD;YACE,0EAA0E;YAC1E,yEAAyE;YACzE,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AAC7D,CAAC;AAED,iGAAiG;AACjG,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,UAAoB;IACnE,OAAO,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,UAAoB;IACnE,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;IACf,oFAAoF;IACpF,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC1B,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC;YAAE,KAAK,GAAG,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7C,IAAI,UAAU,IAAI,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/C,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IACjD,CAAC;IACD,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC;IACrF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAuB;IAC/C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3G,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE;QAChE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;KAClB,CAAC,CAAC,CAAC;IACJ,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhE,MAAM,EAAE,GAAmB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC7E,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAExD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,6BAA6B,GAAG,CAAC,EAAE,8BAA8B,CAAC,CAAC;YAC/E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAE,CAAC,CAAC;QACpD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,6BAA6B,GAAG,CAAC,EAAE,aAAa,MAAM,CAAC,QAAQ,OAAO,QAAQ,EAAE,CAAC,CAAC;YAC9F,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QACA,GAAqB,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAClD,IAAI,MAAM,CAAC,KAAK;YAAG,GAAqB,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC9D,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IACF,EAAE,CAAC,aAAa,GAAG,CAAC,QAAQ,EAAE,EAAE;QAC9B,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1D,IAAI,CAAC,CAAC,IAAI,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACnF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACzC,CAAC,CAAC;IACF,OAAO,EAAE,CAAC;AACZ,CAAC;AAOD,MAAM,MAAM,GAAG,CAAC,CAAgC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhH;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAkB;IACjD,MAAM,GAAG,GAAc,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9I,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,yGAAyG,CAAC,CAAC;IAC7H,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7F,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,qBAAqB,CAAC;IAC/D,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC;IAC7C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACtF,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,wBAAwB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC5G,CAAC;IACJ,CAAC;IAED,IAAI,GAAuB,CAAC;IAC5B,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;QAC1F,CAAC;QACD,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACnD,CAAC;SAAM,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,qDAAqD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3H,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAQ,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzE,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAChG,CAAC;QACD,GAAG,GAAG,kBAAkB,CAAC,GAAG,EAAE;YAC5B,WAAW,EAAE,CAAC,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,GAAG,IAAI;YACjD,gBAAgB,EAAE,MAAM;YACxB,eAAe,EAAE,KAAK;SACvB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAqB,EAAE,UAAU,EAAE,CAAC;IACjD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,MAAM;QAAE,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;IACpC,IAAI,QAAQ;QAAE,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC1C,IAAI,GAAG,CAAC,qBAAqB;QAAE,OAAO,CAAC,cAAc,GAAG,GAAG,CAAC,qBAAqB,CAAC;IAClF,IAAI,GAAG,CAAC,UAAU;QAAE,OAAO,CAAC,cAAc,GAAG,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,GAAG,CAAC,kBAAkB;QAAE,OAAO,CAAC,WAAW,GAAG,GAAG,CAAC,kBAAkB,CAAC;IACzE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,aAAa,CAAC,QAAqB;IAC1C,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAC/B,OAAO,QAAQ,CAAC,GAAG,KAAK,UAAU;QAChC,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC;QAClD,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAEvD,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAEzC,wEAAwE;QACxE,kCAAkC;QAClC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAChB,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;YACb,GAAqB,CAAC,UAAU,GAAG,OAAO,CAAC;YAC3C,GAAqB,CAAC,QAAQ,GAAG,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,SAAS,CAAC,EAAE,CAAC;YAC5E,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,KAAK;gBAAG,GAAqB,CAAC,KAAK,GAAG,KAAK,CAAC;YAChD,IAAI,EAAE,CAAC;QACT,CAAC,EACD,CAAC,GAAY,EAAE,EAAE;YACf,MAAM,CAAC,IAAI,CAAC,gCAAgC,GAAG,CAAC,EAAE,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC3G,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACvF,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}