@zudojs/security 0.0.1

package/dist/cors/cors.core.js

@@ -0,0 +1,131 @@
+/**
+ * @zudojs/security — CORS
+ *
+ * Validates and generates CORS headers for cross-origin requests.
+ */
+/** Default CORS configuration (restrictive). */
+const DEFAULT_CORS_CONFIG = {
+    origin: undefined,
+    methods: ["GET", "HEAD", "PUT", "PATCH", "POST", "DELETE"],
+    allowedHeaders: ["Content-Type", "Authorization"],
+    exposedHeaders: [],
+    credentials: false,
+    maxAge: 86400,
+};
+/**
+ * Checks if a request origin is allowed.
+ *
+ * @param origin - The request Origin header value.
+ * @param config - CORS configuration.
+ * @returns The allowed origin value, or undefined if not allowed.
+ */
+export function isOriginAllowed(origin, config) {
+    if (!origin) {
+        return undefined;
+    }
+    const allowedOrigin = config.origin;
+    if (allowedOrigin === undefined) {
+        // No origin configuration = no CORS headers
+        return undefined;
+    }
+    // Function check
+    if (typeof allowedOrigin === "function") {
+        return allowedOrigin(origin) ? origin : undefined;
+    }
+    // Regex check
+    if (allowedOrigin instanceof RegExp) {
+        return allowedOrigin.test(origin) ? origin : undefined;
+    }
+    // String check
+    if (typeof allowedOrigin === "string") {
+        if (allowedOrigin === "*") {
+            return "*";
+        }
+        return allowedOrigin === origin ? origin : undefined;
+    }
+    // Array check
+    if (Array.isArray(allowedOrigin)) {
+        if (allowedOrigin.includes(origin)) {
+            return origin;
+        }
+        // Check for wildcard in array
+        if (allowedOrigin.includes("*")) {
+            return "*";
+        }
+        return undefined;
+    }
+    return undefined;
+}
+/**
+ * Generates CORS headers for a preflight request.
+ *
+ * @param requestOrigin - The request Origin header.
+ * @param config - CORS configuration.
+ * @returns CORS headers to set on the response.
+ */
+export function generatePreflightHeaders(requestOrigin, config) {
+    const headers = {};
+    const allowedOrigin = isOriginAllowed(requestOrigin, config);
+    if (allowedOrigin) {
+        headers["Access-Control-Allow-Origin"] = allowedOrigin;
+    }
+    else {
+        // No matching origin — don't set CORS headers
+        return headers;
+    }
+    const methods = config.methods ?? DEFAULT_CORS_CONFIG.methods;
+    headers["Access-Control-Allow-Methods"] = methods.join(", ");
+    const allowedHeaders = config.allowedHeaders ?? DEFAULT_CORS_CONFIG.allowedHeaders;
+    headers["Access-Control-Allow-Headers"] = allowedHeaders.join(", ");
+    if (config.credentials) {
+        headers["Access-Control-Allow-Credentials"] = "true";
+    }
+    const maxAge = config.maxAge ?? DEFAULT_CORS_CONFIG.maxAge;
+    headers["Access-Control-Max-Age"] = String(maxAge);
+    return headers;
+}
+/**
+ * Generates CORS headers for a simple request.
+ *
+ * @param requestOrigin - The request Origin header.
+ * @param config - CORS configuration.
+ * @returns CORS headers to set on the response.
+ */
+export function generateSimpleHeaders(requestOrigin, config) {
+    const headers = {};
+    const allowedOrigin = isOriginAllowed(requestOrigin, config);
+    if (allowedOrigin) {
+        headers["Access-Control-Allow-Origin"] = allowedOrigin;
+    }
+    if (config.credentials) {
+        headers["Access-Control-Allow-Credentials"] = "true";
+    }
+    const exposedHeaders = config.exposedHeaders;
+    if (exposedHeaders && exposedHeaders.length > 0) {
+        headers["Access-Control-Expose-Headers"] = exposedHeaders.join(", ");
+    }
+    return headers;
+}
+/**
+ * Validates that a requested method is allowed.
+ *
+ * @param method - The HTTP method from Access-Control-Request-Method.
+ * @param config - CORS configuration.
+ * @returns True if the method is allowed.
+ */
+export function isMethodAllowed(method, config) {
+    const allowedMethods = config.methods ?? DEFAULT_CORS_CONFIG.methods;
+    return allowedMethods.includes(method.toUpperCase());
+}
+/**
+ * Validates that all requested headers are allowed.
+ *
+ * @param headers - Headers from Access-Control-Request-Headers.
+ * @param config - CORS configuration.
+ * @returns An array of disallowed headers, or empty array if all allowed.
+ */
+export function getDisallowedHeaders(headers, config) {
+    const allowedHeaders = new Set((config.allowedHeaders ?? DEFAULT_CORS_CONFIG.allowedHeaders).map((h) => h.toLowerCase()));
+    return headers.filter((h) => !allowedHeaders.has(h.toLowerCase()));
+}
+//# sourceMappingURL=cors.core.js.map

package/dist/cors/cors.core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.core.js","sourceRoot":"","sources":["../../src/cors/cors.core.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,gDAAgD;AAChD,MAAM,mBAAmB,GAErB;IACF,MAAM,EAAE,SAAS;IACjB,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC;IAC1D,cAAc,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;IACjD,cAAc,EAAE,EAAE;IAClB,WAAW,EAAE,KAAK;IAClB,MAAM,EAAE,KAAK;CACd,CAAC;AAcF;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,MAA0B,EAC1B,MAAkB;IAElB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IAEpC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,4CAA4C;QAC5C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,iBAAiB;IACjB,IAAI,OAAO,aAAa,KAAK,UAAU,EAAE,CAAC;QACxC,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IAED,cAAc;IACd,IAAI,aAAa,YAAY,MAAM,EAAE,CAAC;QACpC,OAAO,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACzD,CAAC;IAED,eAAe;IACf,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACtC,IAAI,aAAa,KAAK,GAAG,EAAE,CAAC;YAC1B,OAAO,GAAG,CAAC;QACb,CAAC;QACD,OAAO,aAAa,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAED,cAAc;IACd,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACjC,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,8BAA8B;QAC9B,IAAI,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,GAAG,CAAC;QACb,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,aAAiC,EACjC,MAAkB;IAElB,MAAM,OAAO,GAAgB,EAAE,CAAC;IAEhC,MAAM,aAAa,GAAG,eAAe,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CAAC,6BAA6B,CAAC,GAAG,aAAa,CAAC;IACzD,CAAC;SAAM,CAAC;QACN,8CAA8C;QAC9C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,mBAAmB,CAAC,OAAO,CAAC;IAC9D,OAAO,CAAC,8BAA8B,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE7D,MAAM,cAAc,GAClB,MAAM,CAAC,cAAc,IAAI,mBAAmB,CAAC,cAAc,CAAC;IAC9D,OAAO,CAAC,8BAA8B,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEpE,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,OAAO,CAAC,kCAAkC,CAAC,GAAG,MAAM,CAAC;IACvD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC;IAC3D,OAAO,CAAC,wBAAwB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAEnD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,aAAiC,EACjC,MAAkB;IAElB,MAAM,OAAO,GAAgB,EAAE,CAAC;IAEhC,MAAM,aAAa,GAAG,eAAe,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CAAC,6BAA6B,CAAC,GAAG,aAAa,CAAC;IACzD,CAAC;IAED,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,OAAO,CAAC,kCAAkC,CAAC,GAAG,MAAM,CAAC;IACvD,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;IAC7C,IAAI,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,OAAO,CAAC,+BAA+B,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,MAAkB;IAChE,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,IAAI,mBAAmB,CAAC,OAAO,CAAC;IACrE,OAAO,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAiB,EACjB,MAAkB;IAElB,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,CAAC,MAAM,CAAC,cAAc,IAAI,mBAAmB,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACtE,CAAC,CAAC,WAAW,EAAE,CAChB,CACF,CAAC;IAEF,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACrE,CAAC"}

package/dist/cors/cors.namespace.d.ts

@@ -0,0 +1,15 @@
+/**
+ * @zudojs/security — CORS Namespace
+ *
+ * Convenience namespace for CORS utilities.
+ */
+import { isOriginAllowed, generatePreflightHeaders, generateSimpleHeaders, isMethodAllowed, getDisallowedHeaders } from "./cors.core.js";
+export type { CorsHeaders } from "./cors.core.js";
+export declare const cors: {
+    isOriginAllowed: typeof isOriginAllowed;
+    generatePreflightHeaders: typeof generatePreflightHeaders;
+    generateSimpleHeaders: typeof generateSimpleHeaders;
+    isMethodAllowed: typeof isMethodAllowed;
+    getDisallowedHeaders: typeof getDisallowedHeaders;
+};
+//# sourceMappingURL=cors.namespace.d.ts.map

package/dist/cors/cors.namespace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.namespace.d.ts","sourceRoot":"","sources":["../../src/cors/cors.namespace.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,qBAAqB,EACrB,eAAe,EACf,oBAAoB,EACrB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD,eAAO,MAAM,IAAI;;;;;;CAMhB,CAAC"}

package/dist/cors/cors.namespace.js

@@ -0,0 +1,14 @@
+/**
+ * @zudojs/security — CORS Namespace
+ *
+ * Convenience namespace for CORS utilities.
+ */
+import { isOriginAllowed, generatePreflightHeaders, generateSimpleHeaders, isMethodAllowed, getDisallowedHeaders, } from "./cors.core.js";
+export const cors = {
+    isOriginAllowed,
+    generatePreflightHeaders,
+    generateSimpleHeaders,
+    isMethodAllowed,
+    getDisallowedHeaders,
+};
+//# sourceMappingURL=cors.namespace.js.map

package/dist/cors/cors.namespace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.namespace.js","sourceRoot":"","sources":["../../src/cors/cors.namespace.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,qBAAqB,EACrB,eAAe,EACf,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAIxB,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,eAAe;IACf,wBAAwB;IACxB,qBAAqB;IACrB,eAAe;IACf,oBAAoB;CACrB,CAAC"}

package/dist/cors/index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @zudojs/security — CORS Barrel
+ */
+export type { CorsHeaders } from "./cors.core.js";
+export { isOriginAllowed, generatePreflightHeaders, generateSimpleHeaders, isMethodAllowed, getDisallowedHeaders, } from "./cors.core.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/cors/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cors/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,qBAAqB,EACrB,eAAe,EACf,oBAAoB,GACrB,MAAM,gBAAgB,CAAC"}

package/dist/cors/index.js

@@ -0,0 +1,5 @@
+/**
+ * @zudojs/security — CORS Barrel
+ */
+export { isOriginAllowed, generatePreflightHeaders, generateSimpleHeaders, isMethodAllowed, getDisallowedHeaders, } from "./cors.core.js";
+//# sourceMappingURL=index.js.map

package/dist/cors/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cors/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,qBAAqB,EACrB,eAAe,EACf,oBAAoB,GACrB,MAAM,gBAAgB,CAAC"}

package/dist/csrf/csrf.core.d.ts

@@ -0,0 +1,56 @@
+/**
+ * @zudojs/security — CSRF Protection
+ *
+ * Generates and validates CSRF tokens for state-changing requests.
+ */
+import type { CsrfConfig } from "../types/security.type.js";
+/**
+ * Generates a cryptographically secure CSRF token.
+ *
+ * @param secret - The secret key for HMAC generation.
+ * @param expiration - Optional expiration in seconds (default: 3600).
+ * @returns The CSRF token string.
+ */
+export declare function generateCsrfToken(secret: string, expiration?: number): string;
+/**
+ * Validates a CSRF token.
+ *
+ * @param token - The CSRF token to validate.
+ * @param secret - The secret key for verification.
+ * @param expiration - Optional expiration in seconds (default: 3600).
+ * @returns True if the token is valid and not expired.
+ */
+export declare function validateCsrfToken(token: string, secret: string, expiration?: number): boolean;
+/**
+ * Checks if a request method requires CSRF protection.
+ *
+ * @param method - The HTTP method.
+ * @param config - Optional CSRF configuration.
+ * @returns True if CSRF protection is required.
+ */
+export declare function requiresCsrfProtection(method: string, config?: CsrfConfig): boolean;
+/**
+ * Extracts the CSRF token from request headers.
+ *
+ * @param headers - Request headers.
+ * @param headerName - The header name to look for.
+ * @returns The CSRF token, or undefined.
+ */
+export declare function extractCsrfTokenFromHeaders(headers: Record<string, string | string[] | undefined>, headerName?: string): string | undefined;
+/**
+ * Extracts the CSRF token from cookies.
+ *
+ * @param cookieHeader - The raw Cookie header.
+ * @param cookieName - The cookie name to look for.
+ * @returns The CSRF token, or undefined.
+ */
+export declare function extractCsrfTokenFromCookies(cookieHeader: string, cookieName?: string): string | undefined;
+/**
+ * Generates Set-Cookie header for CSRF token.
+ *
+ * @param token - The CSRF token to store.
+ * @param config - Optional CSRF configuration.
+ * @returns The Set-Cookie header value.
+ */
+export declare function generateCsrfCookie(token: string, config?: CsrfConfig): string;
+//# sourceMappingURL=csrf.core.d.ts.map

package/dist/csrf/csrf.core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.core.d.ts","sourceRoot":"","sources":["../../src/csrf/csrf.core.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAkB5D;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAW7E;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CA4CT;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,UAAU,GAClB,OAAO,CAOT;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,EACtD,UAAU,CAAC,EAAE,MAAM,GAClB,MAAM,GAAG,SAAS,CAapB;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,YAAY,EAAE,MAAM,EACpB,UAAU,CAAC,EAAE,MAAM,GAClB,MAAM,GAAG,SAAS,CAcpB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,UAAU,GAAG,MAAM,CAW7E"}

package/dist/csrf/csrf.core.js

@@ -0,0 +1,149 @@
+/**
+ * @zudojs/security — CSRF Protection
+ *
+ * Generates and validates CSRF tokens for state-changing requests.
+ */
+import { createHash, randomBytes } from "node:crypto";
+/** Default token expiration (1 hour). */
+const DEFAULT_EXPIRATION = 3600;
+/** Default cookie name for CSRF token. */
+const DEFAULT_COOKIE_NAME = "_csrf";
+/** Default header name for CSRF token. */
+const DEFAULT_HEADER_NAME = "x-csrf-token";
+/** Methods that require CSRF protection. */
+const SAFE_METHODS = ["GET", "HEAD", "OPTIONS", "TRACE"];
+/** Default methods that require CSRF protection. */
+const DEFAULT_METHODS = ["POST", "PUT", "PATCH", "DELETE"];
+/**
+ * Generates a cryptographically secure CSRF token.
+ *
+ * @param secret - The secret key for HMAC generation.
+ * @param expiration - Optional expiration in seconds (default: 3600).
+ * @returns The CSRF token string.
+ */
+export function generateCsrfToken(secret, expiration) {
+    const ttl = expiration ?? DEFAULT_EXPIRATION;
+    const expiresAt = Math.floor(Date.now() / 1000) + ttl;
+    const random = randomBytes(16).toString("hex");
+    const payload = `${expiresAt}:${random}`;
+    const signature = createHash("sha256")
+        .update(`${payload}:${secret}`)
+        .digest("hex")
+        .slice(0, 16);
+    return `${payload}:${signature}`;
+}
+/**
+ * Validates a CSRF token.
+ *
+ * @param token - The CSRF token to validate.
+ * @param secret - The secret key for verification.
+ * @param expiration - Optional expiration in seconds (default: 3600).
+ * @returns True if the token is valid and not expired.
+ */
+export function validateCsrfToken(token, secret, expiration) {
+    const ttl = expiration ?? DEFAULT_EXPIRATION;
+    const parts = token.split(":");
+    if (parts.length !== 3) {
+        return false;
+    }
+    const [expiresAtStr, random, providedSignature] = parts;
+    if (!expiresAtStr || !random || !providedSignature) {
+        return false;
+    }
+    const expiresAt = parseInt(expiresAtStr, 10);
+    if (isNaN(expiresAt)) {
+        return false;
+    }
+    // Check expiration
+    const now = Math.floor(Date.now() / 1000);
+    if (now > expiresAt) {
+        return false;
+    }
+    // Verify signature
+    const payload = `${expiresAt}:${random}`;
+    const expectedSignature = createHash("sha256")
+        .update(`${payload}:${secret}`)
+        .digest("hex")
+        .slice(0, 16);
+    // Constant-time comparison
+    if (providedSignature.length !== expectedSignature.length) {
+        return false;
+    }
+    let result = 0;
+    for (let i = 0; i < providedSignature.length; i++) {
+        result |= providedSignature.charCodeAt(i) ^ expectedSignature.charCodeAt(i);
+    }
+    return result === 0;
+}
+/**
+ * Checks if a request method requires CSRF protection.
+ *
+ * @param method - The HTTP method.
+ * @param config - Optional CSRF configuration.
+ * @returns True if CSRF protection is required.
+ */
+export function requiresCsrfProtection(method, config) {
+    if (SAFE_METHODS.includes(method.toUpperCase())) {
+        return false;
+    }
+    const methods = config?.methods ?? DEFAULT_METHODS;
+    return methods.includes(method.toUpperCase());
+}
+/**
+ * Extracts the CSRF token from request headers.
+ *
+ * @param headers - Request headers.
+ * @param headerName - The header name to look for.
+ * @returns The CSRF token, or undefined.
+ */
+export function extractCsrfTokenFromHeaders(headers, headerName) {
+    const name = headerName ?? DEFAULT_HEADER_NAME;
+    const value = headers[name];
+    if (typeof value === "string") {
+        return value;
+    }
+    if (Array.isArray(value) && value.length > 0) {
+        return value[0];
+    }
+    return undefined;
+}
+/**
+ * Extracts the CSRF token from cookies.
+ *
+ * @param cookieHeader - The raw Cookie header.
+ * @param cookieName - The cookie name to look for.
+ * @returns The CSRF token, or undefined.
+ */
+export function extractCsrfTokenFromCookies(cookieHeader, cookieName) {
+    const name = cookieName ?? DEFAULT_COOKIE_NAME;
+    const cookies = cookieHeader.split(";").map((pair) => {
+        const eqIndex = pair.indexOf("=");
+        if (eqIndex === -1)
+            return { name: pair.trim(), value: "" };
+        return {
+            name: pair.slice(0, eqIndex).trim(),
+            value: pair.slice(eqIndex + 1).trim(),
+        };
+    });
+    const cookie = cookies.find((c) => c.name === name);
+    return cookie?.value || undefined;
+}
+/**
+ * Generates Set-Cookie header for CSRF token.
+ *
+ * @param token - The CSRF token to store.
+ * @param config - Optional CSRF configuration.
+ * @returns The Set-Cookie header value.
+ */
+export function generateCsrfCookie(token, config) {
+    const name = config?.cookieName ?? DEFAULT_COOKIE_NAME;
+    const ttl = config?.expiration ?? DEFAULT_EXPIRATION;
+    return [
+        `${name}=${token}`,
+        "Path=/",
+        "HttpOnly",
+        "SameSite=Strict",
+        `Max-Age=${ttl}`,
+    ].join("; ");
+}
+//# sourceMappingURL=csrf.core.js.map

package/dist/csrf/csrf.core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.core.js","sourceRoot":"","sources":["../../src/csrf/csrf.core.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,yCAAyC;AACzC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC,0CAA0C;AAC1C,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAEpC,0CAA0C;AAC1C,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAE3C,4CAA4C;AAC5C,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAEzD,oDAAoD;AACpD,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;AAE3D;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,UAAmB;IACnE,MAAM,GAAG,GAAG,UAAU,IAAI,kBAAkB,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;IACtD,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,MAAM,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC;SACnC,MAAM,CAAC,GAAG,OAAO,IAAI,MAAM,EAAE,CAAC;SAC9B,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEhB,OAAO,GAAG,OAAO,IAAI,SAAS,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAa,EACb,MAAc,EACd,UAAmB;IAEnB,MAAM,GAAG,GAAG,UAAU,IAAI,kBAAkB,CAAC;IAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,iBAAiB,CAAC,GAAG,KAAK,CAAC;IAExD,IAAI,CAAC,YAAY,IAAI,CAAC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAE7C,IAAI,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,mBAAmB;IACnB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,GAAG,GAAG,SAAS,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,mBAAmB;IACnB,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,MAAM,EAAE,CAAC;IACzC,MAAM,iBAAiB,GAAG,UAAU,CAAC,QAAQ,CAAC;SAC3C,MAAM,CAAC,GAAG,OAAO,IAAI,MAAM,EAAE,CAAC;SAC9B,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEhB,2BAA2B;IAC3B,IAAI,iBAAiB,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,iBAAiB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED,OAAO,MAAM,KAAK,CAAC,CAAC;AACtB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAc,EACd,MAAmB;IAEnB,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,eAAe,CAAC;IACnD,OAAO,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAAsD,EACtD,UAAmB;IAEnB,MAAM,IAAI,GAAG,UAAU,IAAI,mBAAmB,CAAC;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,YAAoB,EACpB,UAAmB;IAEnB,MAAM,IAAI,GAAG,UAAU,IAAI,mBAAmB,CAAC;IAE/C,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QAC5D,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE;YACnC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE;SACtC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACpD,OAAO,MAAM,EAAE,KAAK,IAAI,SAAS,CAAC;AACpC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,MAAmB;IACnE,MAAM,IAAI,GAAG,MAAM,EAAE,UAAU,IAAI,mBAAmB,CAAC;IACvD,MAAM,GAAG,GAAG,MAAM,EAAE,UAAU,IAAI,kBAAkB,CAAC;IAErD,OAAO;QACL,GAAG,IAAI,IAAI,KAAK,EAAE;QAClB,QAAQ;QACR,UAAU;QACV,iBAAiB;QACjB,WAAW,GAAG,EAAE;KACjB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/csrf/index.d.ts

@@ -0,0 +1,5 @@
+/**
+ * @zudojs/security — CSRF Protection Barrel
+ */
+export { generateCsrfToken, validateCsrfToken, requiresCsrfProtection, extractCsrfTokenFromHeaders, extractCsrfTokenFromCookies, generateCsrfCookie, } from "./csrf.core.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/csrf/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/csrf/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,gBAAgB,CAAC"}

package/dist/csrf/index.js

@@ -0,0 +1,5 @@
+/**
+ * @zudojs/security — CSRF Protection Barrel
+ */
+export { generateCsrfToken, validateCsrfToken, requiresCsrfProtection, extractCsrfTokenFromHeaders, extractCsrfTokenFromCookies, generateCsrfCookie, } from "./csrf.core.js";
+//# sourceMappingURL=index.js.map

package/dist/csrf/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/csrf/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,gBAAgB,CAAC"}

package/dist/header/header.core.d.ts

@@ -0,0 +1,47 @@
+/**
+ * @zudojs/security — Header Security
+ *
+ * Validates and sanitizes HTTP headers against injection attacks,
+ * size limits, and blocked header names.
+ */
+import type { HeaderSecurityConfig, HeaderValidationResult } from "../types/security.type.js";
+/**
+ * Validates a single header name.
+ *
+ * @param name - The header name to validate.
+ * @returns An error message if invalid, or undefined.
+ */
+export declare function validateHeaderName(name: string): string | undefined;
+/**
+ * Validates a single header value.
+ *
+ * @param name - The header name (for context in error messages).
+ * @param value - The header value to validate.
+ * @param config - Optional security configuration.
+ * @returns An error message if invalid, or undefined.
+ */
+export declare function validateHeaderValue(name: string, value: string, config?: HeaderSecurityConfig): string | undefined;
+/**
+ * Validates all headers against security configuration.
+ *
+ * @param headers - Record of header name-value pairs.
+ * @param config - Optional security configuration.
+ * @returns Validation result with any errors found.
+ */
+export declare function validateHeaders(headers: Record<string, string | string[] | undefined>, config?: HeaderSecurityConfig): HeaderValidationResult;
+/**
+ * Sanitizes a header value by stripping dangerous characters.
+ * Returns undefined if the value is completely empty after sanitization.
+ *
+ * @param value - The header value to sanitize.
+ * @returns The sanitized value, or undefined if empty.
+ */
+export declare function sanitizeHeaderValue(value: string): string | undefined;
+/**
+ * Checks if a header is a hop-by-hop header that should not be forwarded.
+ *
+ * @param name - The header name.
+ * @returns True if the header is hop-by-hop.
+ */
+export declare function isHopByHopHeader(name: string): boolean;
+//# sourceMappingURL=header.core.d.ts.map

package/dist/header/header.core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"header.core.d.ts","sourceRoot":"","sources":["../../src/header/header.core.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,2BAA2B,CAAC;AA6BnC;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAiBnE;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,oBAAoB,GAC5B,MAAM,GAAG,SAAS,CAoBpB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,EACtD,MAAM,CAAC,EAAE,oBAAoB,GAC5B,sBAAsB,CA+DxB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQrE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAYtD"}

package/dist/header/header.core.js

@@ -0,0 +1,158 @@
+/**
+ * @zudojs/security — Header Security
+ *
+ * Validates and sanitizes HTTP headers against injection attacks,
+ * size limits, and blocked header names.
+ */
+/** Default maximum header value size (8KB). */
+const DEFAULT_MAX_VALUE_SIZE = 8192;
+/** Default maximum number of headers. */
+const DEFAULT_MAX_HEADERS = 50;
+/** Default maximum total header size (64KB). */
+const DEFAULT_MAX_TOTAL_SIZE = 65536;
+/** Headers that are commonly blocked for security. */
+const DEFAULT_BLOCKED_HEADERS = [
+    "x-forwarded-for",
+    "x-forwarded-host",
+    "x-forwarded-proto",
+];
+/**
+ * CRLF injection pattern — matches carriage return or line feed.
+ * These characters must never appear in header values.
+ */
+const CRLF_PATTERN = /[\r\n]/;
+/**
+ * Null byte pattern.
+ */
+const NULL_BYTE_PATTERN = /\x00/;
+/**
+ * Validates a single header name.
+ *
+ * @param name - The header name to validate.
+ * @returns An error message if invalid, or undefined.
+ */
+export function validateHeaderName(name) {
+    if (name.length === 0) {
+        return "Header name cannot be empty";
+    }
+    if (name.length > 256) {
+        return `Header name exceeds maximum length of 256: ${name.length}`;
+    }
+    // RFC 7230: token = 1*tchar
+    // tchar = "!" / "#" / "$" / "%" / "&" / "'" / "*" / "+" / "-" / "." /
+    //         "^" / "_" / "`" / "|" / "~" / DIGIT / ALPHA
+    if (!/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(name)) {
+        return `Header name contains invalid characters: ${name}`;
+    }
+    return undefined;
+}
+/**
+ * Validates a single header value.
+ *
+ * @param name - The header name (for context in error messages).
+ * @param value - The header value to validate.
+ * @param config - Optional security configuration.
+ * @returns An error message if invalid, or undefined.
+ */
+export function validateHeaderValue(name, value, config) {
+    const maxValueSize = config?.maxValueSize ?? DEFAULT_MAX_VALUE_SIZE;
+    // Check for CRLF injection
+    if (CRLF_PATTERN.test(value)) {
+        return `Header "${name}" contains CRLF characters (injection risk)`;
+    }
+    // Check for null bytes
+    if (NULL_BYTE_PATTERN.test(value)) {
+        return `Header "${name}" contains null bytes`;
+    }
+    // Check value size
+    const byteSize = Buffer.byteLength(value, "utf8");
+    if (byteSize > maxValueSize) {
+        return `Header "${name}" value size ${byteSize} exceeds maximum ${maxValueSize}`;
+    }
+    return undefined;
+}
+/**
+ * Validates all headers against security configuration.
+ *
+ * @param headers - Record of header name-value pairs.
+ * @param config - Optional security configuration.
+ * @returns Validation result with any errors found.
+ */
+export function validateHeaders(headers, config) {
+    const errors = [];
+    const maxHeaders = config?.maxHeaders ?? DEFAULT_MAX_HEADERS;
+    const maxTotalSize = config?.maxTotalSize ?? DEFAULT_MAX_TOTAL_SIZE;
+    const blockedHeaders = new Set((config?.blockedHeaders ?? DEFAULT_BLOCKED_HEADERS).map((h) => h.toLowerCase()));
+    const entries = Object.entries(headers).filter(([, v]) => v !== undefined);
+    // Check header count
+    if (entries.length > maxHeaders) {
+        errors.push(`Too many headers: ${entries.length} exceeds maximum ${maxHeaders}`);
+    }
+    let totalSize = 0;
+    for (const [name, value] of entries) {
+        // Check blocked headers
+        if (blockedHeaders.has(name.toLowerCase())) {
+            errors.push(`Header "${name}" is blocked by security policy`);
+            continue;
+        }
+        // Validate name
+        const nameError = validateHeaderName(name);
+        if (nameError) {
+            errors.push(nameError);
+            continue;
+        }
+        // Validate values (may be array for Set-Cookie, etc.)
+        const values = Array.isArray(value) ? value : [value];
+        for (const v of values) {
+            const valueError = validateHeaderValue(name, v, config);
+            if (valueError) {
+                errors.push(valueError);
+                continue;
+            }
+            totalSize +=
+                Buffer.byteLength(name, "utf8") + Buffer.byteLength(v, "utf8");
+        }
+    }
+    // Check total size
+    if (totalSize > maxTotalSize) {
+        errors.push(`Total header size ${totalSize} exceeds maximum ${maxTotalSize}`);
+    }
+    return {
+        valid: errors.length === 0,
+        errors,
+    };
+}
+/**
+ * Sanitizes a header value by stripping dangerous characters.
+ * Returns undefined if the value is completely empty after sanitization.
+ *
+ * @param value - The header value to sanitize.
+ * @returns The sanitized value, or undefined if empty.
+ */
+export function sanitizeHeaderValue(value) {
+    // Strip null bytes
+    let sanitized = value.replace(NULL_BYTE_PATTERN, "");
+    // Strip CRLF (strip both \r and \n)
+    sanitized = sanitized.replace(/[\r\n]/g, "");
+    return sanitized.length > 0 ? sanitized : undefined;
+}
+/**
+ * Checks if a header is a hop-by-hop header that should not be forwarded.
+ *
+ * @param name - The header name.
+ * @returns True if the header is hop-by-hop.
+ */
+export function isHopByHopHeader(name) {
+    const hopByHop = new Set([
+        "connection",
+        "keep-alive",
+        "proxy-authenticate",
+        "proxy-authorization",
+        "te",
+        "trailer",
+        "transfer-encoding",
+        "upgrade",
+    ]);
+    return hopByHop.has(name.toLowerCase());
+}
+//# sourceMappingURL=header.core.js.map

package/dist/header/header.core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"header.core.js","sourceRoot":"","sources":["../../src/header/header.core.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,+CAA+C;AAC/C,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAEpC,yCAAyC;AACzC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B,gDAAgD;AAChD,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAErC,sDAAsD;AACtD,MAAM,uBAAuB,GAAG;IAC9B,iBAAiB;IACjB,kBAAkB;IAClB,mBAAmB;CACpB,CAAC;AAEF;;;GAGG;AACH,MAAM,YAAY,GAAG,QAAQ,CAAC;AAE9B;;GAEG;AACH,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,6BAA6B,CAAC;IACvC,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACtB,OAAO,8CAA8C,IAAI,CAAC,MAAM,EAAE,CAAC;IACrE,CAAC;IAED,4BAA4B;IAC5B,sEAAsE;IACtE,sDAAsD;IACtD,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,OAAO,4CAA4C,IAAI,EAAE,CAAC;IAC5D,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,KAAa,EACb,MAA6B;IAE7B,MAAM,YAAY,GAAG,MAAM,EAAE,YAAY,IAAI,sBAAsB,CAAC;IAEpE,2BAA2B;IAC3B,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,WAAW,IAAI,6CAA6C,CAAC;IACtE,CAAC;IAED,uBAAuB;IACvB,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,WAAW,IAAI,uBAAuB,CAAC;IAChD,CAAC;IAED,mBAAmB;IACnB,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClD,IAAI,QAAQ,GAAG,YAAY,EAAE,CAAC;QAC5B,OAAO,WAAW,IAAI,gBAAgB,QAAQ,oBAAoB,YAAY,EAAE,CAAC;IACnF,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAsD,EACtD,MAA6B;IAE7B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,UAAU,GAAG,MAAM,EAAE,UAAU,IAAI,mBAAmB,CAAC;IAC7D,MAAM,YAAY,GAAG,MAAM,EAAE,YAAY,IAAI,sBAAsB,CAAC;IACpE,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,CAAC,MAAM,EAAE,cAAc,IAAI,uBAAuB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5D,CAAC,CAAC,WAAW,EAAE,CAChB,CACF,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAC5C,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CACW,CAAC;IAExC,qBAAqB;IACrB,IAAI,OAAO,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CACT,qBAAqB,OAAO,CAAC,MAAM,oBAAoB,UAAU,EAAE,CACpE,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACpC,wBAAwB;QACxB,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,iCAAiC,CAAC,CAAC;YAC9D,SAAS;QACX,CAAC;QAED,gBAAgB;QAChB,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QAED,sDAAsD;QACtD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAEtD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;YACxD,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACxB,SAAS;YACX,CAAC;YAED,SAAS;gBACP,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,mBAAmB;IACnB,IAAI,SAAS,GAAG,YAAY,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CACT,qBAAqB,SAAS,oBAAoB,YAAY,EAAE,CACjE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,mBAAmB;IACnB,IAAI,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;IAErD,oCAAoC;IACpC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAE7C,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;QACvB,YAAY;QACZ,YAAY;QACZ,oBAAoB;QACpB,qBAAqB;QACrB,IAAI;QACJ,SAAS;QACT,mBAAmB;QACnB,SAAS;KACV,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AAC1C,CAAC"}