awesome-node-checkout 1.2.5 → 2.0.0

package/CHANGELOG.md

@@ -5,6 +5,59 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.0.0] - 2026-11-12
+
+Every permissive default of `createCheckoutRouter` becomes an explicit, named opt-in. Resolves #29.
+
+### Breaking
+Migration list:
+- **The router throws at mount without `buildPaymentRequest`.** `createCheckoutRouter(checkout)` now throws `CheckoutError` with the new code `INSECURE_CONFIGURATION`. Set `buildPaymentRequest` (server-side amount), or, only where the client may choose the amount, `allowClientPaymentRequest: true` (prints one `console.warn` at mount). The old mount warning `the client body decides the amount; set buildPaymentRequest` is gone.
+- **The details route `GET /:provider/:id` is not mounted by default.** Add `details: { middleware: [...] }` to mount it behind your auth. `details: {}` mounts it unprotected and prints one `console.warn`. `details.enabled` is deprecated: `enabled: false` behaves as omitted (Express 404 instead of the former JSON `'Payment details route is disabled'`).
+- **`amount` values with excess decimals now fail instead of being rounded.** Through the router, an amount with more decimals than the currency allows (`19.999` EUR, `10.5` JPY) answers `400 { success: false, code: 'INVALID_AMOUNT', error }` (new `CheckoutErrorCode`) without calling the provider; `0`, negative and non-finite amounts keep their earlier 400 (`INVALID_PAYMENT_REQUEST` from `buildPaymentRequest`, uncoded on the client-body path). Called directly, Nexi, Satispay and PayPal `createPayment` reject all of these (excess decimals, `0`, negative, non-finite) with `INVALID_AMOUNT` and return `{ success: false, status: 'FAILED', error }`, and so does `refundPayment` for a partial amount with excess decimals, `0` or a negative value (only an omitted `amount` refunds in full; Nexi and Satispay previously treated `0` and `null` as a full refund, and now reject them like PayPal). Amounts are checked against the ISO 4217 exponent of the currency (0, 2 or 3). PayPal formats payment and refund amounts with that exponent, so it now receives `'1000'` for 1000 JPY (previously the rejected `'1000.00'`) and `'1.200'` for 1.2 KWD. **Nexi and Satispay `createPayment` now reject currencies whose exponent is not 2** (JPY, KWD, …, and Nexi numeric codes such as `392`) with `{ success: false, status: 'FAILED', error }`: their outcome amounts and refunds are in hundredths, so only 2-decimal currencies keep the created, reported and refunded amounts on the same scale.
+- **500 response bodies are generic.** Unexpected errors answer `{ success: false, error: 'Internal server error' }`. Set `exposeErrorMessages: true` to get the previous messages (including the `'Invalid provider response'` masking). The error is passed to the new `onError(err, req)` option, or logged with `console.error('[awesome-node-checkout]', err)` when `onError` is not set. `CheckoutError` 4xx responses keep their message and code.
+- **Generated order ids changed format.** Without `orderId`, Nexi `codTrans` and Satispay `external_code` are `ORD-` + 24 random hex chars (28 chars) instead of `ORD-<Date.now()>`.
+
+### Security
+- **Express Adapter**: the client body can no longer decide the amount unless `allowClientPaymentRequest: true` is set explicitly; previously a missing `buildPaymentRequest` only logged a warning and `POST /checkout/paypal {"amount":0.01,…}` created a 0.01 payment. Resolves #29.
+- **Express Adapter**: `GET /:provider/:id` is opt-in, so status, amount and currency of a payment are no longer readable by anyone who knows (or, for Nexi, guesses) a payment id. Resolves #29.
+- **Nexi, Satispay**: generated order ids come from `crypto.randomBytes` (96 bits) instead of a millisecond timestamp: they cannot be enumerated and do not collide across instances or within the same millisecond. Resolves #29.
+- **Nexi, Satispay, PayPal**: amounts are converted to exact minor units for the currency (`toMinorUnits`/`toMajorString`, internal); an excess decimal is rejected instead of silently rounded. PayPal no longer formats zero/three-decimal currencies with two decimals; Nexi and Satispay reject them at `createPayment`, so for payments created through this library the created, reported and refunded amounts are on the same scale (outcome amounts are still read in hundredths, whatever the `divisa`/`currency`). A refund `amount` of `0` or `null` no longer turns into a full refund on Nexi and Satispay. Resolves #29.
+- **Express Adapter**: internal error messages (including those thrown by `buildPaymentRequest`, `onBeforeExecute`, `redirect` handlers and event listeners) no longer reach the client in 500 responses by default. Resolves #29.
+
+### Added
+- `ExpressCheckoutOptions.allowClientPaymentRequest`, `exposeErrorMessages` and `onError`. Resolves #29.
+- `CheckoutErrorCode` values `INSECURE_CONFIGURATION` and `INVALID_AMOUNT`. Resolves #29.
+
+### Unchanged
+- `POST /:provider/execute` stays mounted by default: capturing an approved payment only completes the payer's own payment, and since 1.3.0 the outcome is keyed on the provider-authenticated id (#27). Documented in the README.
+
+### Documentation
+- README: "Secure defaults (2.0)" section, details marked *opt-in* in the Routes table, Quick Start and Express examples always build the request server-side. Resolves #29.
+
+## [1.3.0] - 2026-09-29
+
+### Breaking
+- **Custom `IPaymentProvider` implementations must authenticate their outcomes.** Redirect, webhook and execute outcomes from a provider that does not set `verified: true` now fail closed: `success: false`, `verified: false`, no `paymentId`/`orderId`, error `'Payment outcome could not be verified'`.
+- **`orderId` is no longer read from the query or unsigned body fields.** The configurator no longer reads `query.order_id`, `raw.orderId` or `raw.external_code`: a provider that relied on this must return `orderId` itself.
+- **Listener errors are wrapped.** Direct API callers now receive `CheckoutListenerError`; the original value is in `cause`.
+- Released as a minor version because these paths were the security holes fixed here (#27). The built-in Nexi, PayPal and Satispay providers are updated.
+
+
+### Security
+- **Nexi Execute**: `executePayment` is keyed on the MAC-covered `codTrans`: result `paymentId`/`orderId`, the local order lookup and the emitted event no longer use the caller's `paymentId`. A non-empty `paymentId` argument different from the outcome's `codTrans` now fails (`success: false`, `verified: false`, error `'Payment id does not match the outcome'`) and emits `payment.failed`, never `payment.completed`. The configurator applies the same check to every provider's execute outcome. Resolves #27.
+- **Core (orderId)**: No provider takes `orderId` from the query string of a redirect or callback, or from unsigned body fields (`orderId`, `order_id`, `external_code`): `orderId` comes only from the local `paymentId -> orderId` map (keyed on the provider-authenticated `paymentId`) or from the provider's authenticated outcome. Covers the PayPal redirect, Satispay unsigned POST without `webhookPublicKey`, and Nexi under any registration name (the rule no longer depends on the provider being registered as `nexi`). Resolves #27.
+- **Core (verified)**: Unverified callback/redirect/execute outcomes carry no `paymentId`/`orderId` and never report `success: true`; a provider outcome counts as verified only when the provider sets `verified: true` (fail closed). Resolves #27.
+
+### Changed
+- **`verified` semantics**: one documented meaning on `PaymentResult`, `WebhookResult` and all events: the outcome was authenticated by a signature/MAC or by an authenticated read from the provider API. `payment.created` (and `payment.failed` from `createPayment`) is now always `verified: false`; redirect/execute outcomes with a valid MAC and `esito=KO` are `verified: true` with an error, like webhooks; `payment.refunded` reflects the provider's `verified` (PayPal/Satispay API response `true`, Nexi `false`). `PaymentResult` gains an optional `verified` field set by the built-in providers. Custom providers must now set `verified: true` on authenticated outcomes. Resolves #27.
+- **Event bus**: errors thrown by listeners are wrapped in the new exported `CheckoutListenerError` (`message` copied, original value in `cause`, `event` name) instead of being mutated; direct API callers now receive the wrapper. Resolves #27.
+- **Satispay Redirect**: `handleRedirect` returns `orderId` from the authenticated API `external_code` or the local transaction store (previously it was filled by the configurator from the query). Resolves #27.
+
+### Fixed
+- **Event bus**: frozen or non-extensible listener errors keep their message (previously replaced by `Cannot add property __isEventListenerError, object is not extensible`). Resolves #27.
+- **Currency**: `parseIsoCurrency`/`parseNexiCurrency` (used by Satispay and Nexi) check alpha-3 codes against the ISO 4217 list of active currencies (`ISO_4217_ALPHA3_CODES`, from ISO 4217 List One published 2026-09-17, non-monetary codes excluded); `'XYZ'` and `'ABC'` are rejected. Resolves #27.
+- **Documentation**: README `verified`/`paymentId`/`orderId` statements aligned with the behaviour, with a per-event `verified` table. Resolves #27.
+
 ## [1.2.5] - 2026-09-28
 
 ### Security

package/README.md

@@ -46,14 +46,15 @@ checkout
     callbackPath: '/checkout/satispay/webhook', // Optional: defaults to /checkout/satispay/webhook
   }));
 
-// Use directly — no HTTP framework needed
+// Use directly — no HTTP framework needed. The amount comes from your own order, never from the client.
+const order = await myOrderService.getOrder('ORD-1234');
 const result = await checkout.createPayment('paypal', {
-  amount: 49.99,
-  currency: 'EUR',
-  description: 'Order #1234',
+  amount: order.totalAmount, // e.g. 49.99: at most as many decimals as the currency allows
+  currency: order.currency,  // e.g. 'EUR'
+  description: `Order #${order.id}`,
   returnUrl: 'https://myapp.com/payment/success',
   cancelUrl: 'https://myapp.com/payment/cancel',
-  orderId: 'ORD-1234',
+  orderId: order.id,
 });
 
 if (result.approvalUrl) {
@@ -81,7 +82,7 @@ app.use(express.urlencoded({ extended: false }));
 app.use(
   '/checkout',
   createCheckoutRouter(checkout, {
-    // Recommended: verify order and compute amount on the server
+    // Required: verify the order and compute the amount on the server
     buildPaymentRequest: async (req, { provider }) => {
       const order = await myOrderService.getOrder(req.body.orderId);
       return {
@@ -99,10 +100,6 @@ app.use(
       onSuccess: (result, req) => `/orders/${result.orderId}?status=success`,
       onFailure: (result, req) => `/orders/${result.orderId}?status=failed&error=${encodeURIComponent(result.error || '')}`,
     },
-    // Optional: gate or disable public access to GET /:provider/:id
-    details: {
-      enabled: false, // or provide middleware: [requireAuth]
-    },
     // Opt-in: mount POST /:provider/refund protected by admin middleware
     refund: {
       middleware: [requireAdminAuth],
@@ -118,13 +115,24 @@ app.use(
       ':provider/webhook',
       ':provider/redirect',
     ],
+    // Optional: report unexpected (500) errors; the client only sees 'Internal server error'
+    onError: (err, req) => logger.error({ err, path: req.path }, 'checkout error'),
   }),
 );
 
 app.listen(3000);
 ```
 
-> **Security Note**: Never trust client-sent amounts directly. Always define `buildPaymentRequest` so the payment amount and order parameters are derived server-side. If `buildPaymentRequest` is omitted, the router will issue a warning at mount time and validate that client bodies contain positive finite amounts and valid currencies.
+> **Security Note**: Never trust client-sent amounts. `buildPaymentRequest` derives the amount and order parameters server-side, and since 2.0.0 it is mandatory: `createCheckoutRouter` throws `CheckoutError('INSECURE_CONFIGURATION')` at mount without it. See [Secure defaults (2.0)](#secure-defaults-20).
+
+To expose payment status to your own front end, mount the details route explicitly and protect it:
+
+```typescript
+createCheckoutRouter(checkout, {
+  buildPaymentRequest,
+  details: { middleware: [requireAuth] }, // GET /checkout/:provider/:id
+});
+```
 
 ### With Fastify (or any other framework)
 
@@ -132,8 +140,17 @@ Use the `CheckoutConfigurator` methods directly in your own routes:
 
 ```typescript
 fastify.post('/checkout/:provider', async (req, reply) => {
-  const result = await checkout.createPayment(req.params.provider, req.body);
-  reply.status(result.success ? 201 : 400).send(result);
+  // Build the request from your own order: never pass req.body to createPayment
+  const order = await myOrderService.getOrder(req.body.orderId);
+  const result = await checkout.createPayment(req.params.provider, {
+    amount: order.totalAmount,
+    currency: order.currency,
+    orderId: order.id,
+    returnUrl: `https://myapp.com/checkout/${req.params.provider}/redirect`,
+    cancelUrl: 'https://myapp.com/payment/cancel',
+  });
+  const { raw, ...safeResult } = result;
+  reply.status(result.success ? 201 : 400).send(safeResult);
 });
 
 // Handle both POST and GET webhooks (e.g. Satispay GET callback vs Nexi/Satispay POST notification)
@@ -165,15 +182,38 @@ A full-featured reference implementation using Express 5, SQLite (`ITransactionS
 
 | Method      | Path                        | Description                                                    |
 |-------------|-----------------------------|----------------------------------------------------------------|
-| POST        | `/:provider`                | Create a payment (server-built or validated)                  |
+| POST        | `/:provider`                | Create a payment (built by `buildPaymentRequest`)              |
 | POST        | `/:provider/execute`        | Execute/capture a payment (supports `onBeforeExecute`)         |
 | GET         | `/:provider/redirect`       | Handle provider redirect callback (supports 302 via `redirect`)|
-| GET         | `/:provider/:id`            | Get payment details (*configurable*: can disable or protect via `details`)|
+| GET         | `/:provider/:id`            | Get payment details (*opt-in*: mounted only when `details` option is set; protect it with `details.middleware`)|
 | POST        | `/:provider/refund`         | Refund a payment (*opt-in*: mounted only when `refund` option is set)|
 | GET / POST  | `/:provider/webhook`        | Handle provider webhook (POST for Nexi/Satispay, GET for Satispay)|
 
 ---
 
+## Secure defaults (2.0)
+
+Since 2.0.0 every permissive behaviour of `createCheckoutRouter` is an explicit, named opt-in that shows up in code review.
+
+1. **`buildPaymentRequest` is mandatory.** Without it, `createCheckoutRouter` throws `CheckoutError` with code `INSECURE_CONFIGURATION` at mount. The opt-out is `allowClientPaymentRequest: true`: the client request body becomes the `PaymentRequest`, so **the browser chooses the amount**. Never use it for a shop. It prints one `console.warn` at mount.
+2. **`GET /:provider/:id` is opt-in.** The details route returns `success`, `status`, `amount`, `currency` and `paymentId` for any id it is given (for Nexi, the id is your order code). It is mounted only when `details` is set: `details: { middleware: [requireAuth] }`. `details: {}` mounts it unprotected and prints one `console.warn`. The old `details: { enabled: false }` is deprecated and behaves as omitted.
+3. **Generated order ids are unpredictable.** When `orderId` is omitted, Nexi (`codTrans`) and Satispay (`external_code`) use `ORD-` + 24 random hex chars instead of `ORD-<timestamp>`, so ids cannot be enumerated and do not collide.
+4. **Amounts are exact, in the currency's minor units.** Amounts are checked against the ISO 4217 exponent (0 for JPY, KRW, CLP…; 3 for KWD, BHD, JOD…; 2 otherwise) and never rounded: `19.999 EUR` or `10.5 JPY` fails with `INVALID_AMOUNT` instead of charging a rounded amount. The router answers `400 { success: false, code: 'INVALID_AMOUNT', error }` without calling the provider; a provider called directly returns `{ success: false, status: 'FAILED', error }`. PayPal formats payment and refund amounts with the exponent of the order's currency: it receives `'1000'` for 1000 JPY and `'1.200'` for 1.2 KWD. Nexi and Satispay accept only currencies with 2 decimal places: `createPayment` in JPY, KWD or another 0- or 3-decimal currency (including Nexi numeric codes such as `392`) returns `{ success: false, status: 'FAILED', error }`, because their outcome amounts and refund amounts are in hundredths. A refund `amount` of `0` (or `null`) fails like any invalid amount; only an omitted amount refunds in full.
+5. **500 bodies are generic.** An unexpected error (a throwing `buildPaymentRequest`, `onBeforeExecute`, `redirect.onSuccess`/`onFailure`, event listener, or provider) answers `500 { success: false, error: 'Internal server error' }`. The error goes to `onError(err, req)`, or to `console.error` when `onError` is not set. `exposeErrorMessages: true` restores the message in the body (for development). `CheckoutError` responses (4xx) keep their message and code and are not passed to `onError`.
+
+| Option | Default | Effect |
+|--------|---------|--------|
+| `buildPaymentRequest` | — (required) | Server-side `PaymentRequest` |
+| `allowClientPaymentRequest: true` | off | Client body decides the amount (insecure) |
+| `details: { middleware }` | not mounted | Mounts `GET /:provider/:id` |
+| `refund: { middleware }` | not mounted | Mounts `POST /:provider/refund` |
+| `exposeErrorMessages: true` | off | Error messages in 500 bodies |
+| `onError(err, req)` | `console.error` | Receives every 500 error |
+
+**`POST /:provider/execute` stays mounted by default.** Capturing an approved payment only completes the payer's own payment, and since 1.3.0 the outcome is keyed on the provider-authenticated payment id (#27), so a forged `paymentId` cannot confirm another order. Use `execute.middleware` or `execute.onBeforeExecute` to tie the capture to the current session.
+
+---
+
 ## Security: A Redirect Is Not Proof of Payment
 
 Relying solely on front-end browser redirects (`GET /:provider/redirect`) to fulfill orders introduces significant risk:
@@ -182,7 +222,7 @@ Relying solely on front-end browser redirects (`GET /:provider/redirect`) to ful
 - **Amount Mismatch**: Always verify that the captured payment amount matches your order ledger before fulfilling goods or services. In `awesome-node-checkout`, `success: true` strictly requires that a payment is confirmed with a valid amount.
 
 To ensure safe fulfillment:
-1. **Verify Amount & Currency**: `PaymentResult` and `WebhookResult` return `amount` and `currency` extracted directly from the provider. Compare amounts in minor units (cents) or with rounding to prevent floating-point discrepancies:
+1. **Verify Amount & Currency**: `PaymentResult` and `WebhookResult` return `amount` and `currency` extracted directly from the provider. Compare amounts in minor units (cents) or with rounding to prevent floating-point discrepancies. The example below scales by 100, which is exact for currencies with at most 2 decimal places (every Nexi and Satispay payment created through this library); for a PayPal order in a 3-decimal currency such as KWD, scale by 1000:
    ```typescript
    const result = await checkout.handleRedirect(provider, req.query);
    if (result.success) {
@@ -229,13 +269,29 @@ checkout.events
   .on('webhook.received',  ({ provider, paymentId, orderId, status, error, verified, data, raw }) => { /* ... */ });
 ```
 
-### Understanding `verified` vs `error` in `WebhookResult` and Events
+An error thrown by a listener propagates to the caller wrapped in a `CheckoutListenerError` (exported): its `message` is the original message (or `String(value)` for non-Error values), `cause` is the original value, untouched (frozen errors are fine), and `event` is the event name. The Express adapter answers `500` with a generic body (the message only with `exposeErrorMessages: true`) and passes the error to `onError`.
+
+Currencies are validated against the ISO 4217 list of active alpha-3 codes (`ISO_4217_ALPHA3_CODES`, plus the mapped Nexi numeric codes such as `978`); shape-only codes like `'XYZ'` or `'ABC'` and non-monetary codes (`XXX`, `XTS`, precious metals) are rejected.
+
+### Understanding `verified` vs `error` in Results and Events
+
+`verified` has one meaning everywhere (`PaymentResult`, `WebhookResult` and every event payload):
+
+> **`verified: true` means the outcome was authenticated**, either by a provider signature/MAC checked by the library (Nexi 7-field outcome MAC, Satispay HTTP Signature) or by an authenticated server-to-server read from the provider API (PayPal capture/order read with OAuth credentials, Satispay `GET /payments/{id}` signed with the merchant key). Anything else is `verified: false`.
+
+- `success` and `verified` are independent: a genuine cancellation or failed payment (user canceled, card declined) is `verified: true, success: false` with `error: 'Payment is CANCELED'` or `error: 'Payment failed with outcome KO'`. This holds for webhooks, redirects and `executePayment` alike (e.g. a Nexi redirect or execute with `esito=KO` and a valid MAC emits `payment.failed` with `verified: true`).
+- On a callback, redirect or execute outcome with `verified: false` (missing/tampered MAC or signature, failed API read, provider that does not assert `verified: true`), the result and the event carry **no `paymentId` and no `orderId`**, and `success` is always `false` (error e.g. `'MAC verification failed'`, `'Webhook signature verification failed'`, `'Payment outcome could not be verified'`).
+- `orderId` is never taken from the query string of a redirect or callback, nor from unsigned body fields, for any provider and under any registration name. It comes from the local `paymentId → orderId` map filled by `createPayment` (keyed on the provider-authenticated `paymentId`), or from the provider's authenticated outcome (Nexi MAC-covered `codTrans`, Satispay API `external_code` / transaction store).
+- `executePayment(provider, paymentId, data)` is keyed on the `paymentId` authenticated by the provider (for Nexi the MAC-covered `codTrans`), never on the argument. If a non-empty `paymentId` argument differs from the authenticated one, the call fails with `success: false, verified: false, error: 'Payment id does not match the outcome'` and emits `payment.failed` (never `payment.completed`).
+
+| Event | `verified` |
+|-------|------------|
+| `payment.created` (and `payment.failed` from `createPayment`) | always `false`: creation reports no payment outcome. `paymentId`/`orderId` are the ones you just created. |
+| `payment.completed` / `payment.failed` from `handleRedirect` / `executePayment` | `true` only for a MAC-verified (Nexi) or API-read (PayPal, Satispay) outcome, whatever its `success` |
+| `webhook.received` | `true` only for a MAC/signature-verified notification or an authenticated API re-read |
+| `payment.refunded` | `true` when the refund outcome comes from an authenticated provider API response (PayPal, Satispay); `false` for Nexi, whose refund response carries no MAC checked by the library |
 
-The `verified: boolean` field indicates whether the incoming request was verified as authentic:
-- **`verified: true`**: The notification was cryptographically verified (e.g. Nexi 7-field outcome MAC or Satispay HTTP Signature) or verified via authenticated server-to-server API re-read.
-  - A genuine cancellation or failed payment (e.g. user canceled on gateway, card declined) has `verified: true, success: false, error: 'Payment is CANCELED'` or `error: 'Payment failed with outcome KO'`.
-- **`verified: false`**: The signature/MAC was missing, tampered with, or invalid. The payload is untrusted.
-  - In this case, `success: false, verified: false, error: 'MAC verification failed'` (or `'Webhook signature verification failed'`), and `orderId` / `paymentId` from untrusted query/body are stripped to prevent parameter injection attacks.
+Custom providers must set `verified: true` on the outcomes they have authenticated; an outcome without it is treated as unverified.
 
 #### Satispay `verified` Semantics
 - **With `webhookPublicKey` configured**: Inbound POST webhooks must carry a valid HTTP Signature matching Satispay's RSA public key, correct SHA-256 body digest, and fresh `Date` header. `verified: true` guarantees cryptographic authenticity.
@@ -284,7 +340,9 @@ export class StripeProvider extends BasePaymentProvider {
   // ... implement other methods
 
   async handleRedirect(query: Record<string, any>): Promise<PaymentResult> {
-    // ... handle Stripe redirect
+    // ... handle Stripe redirect: re-read the session from the Stripe API and
+    // return { success, verified: true, paymentId, orderId, amount, currency }
+    // only for an authenticated outcome (see "Understanding `verified`")
   }
 }
 

package/dist/adapters/express/index.d.ts

@@ -22,8 +22,18 @@ export interface ExpressCheckoutOptions {
      * Builds the PaymentRequest on the server (amount from your own order), ignoring the client body.
      * If the hook sends an HTTP response directly (e.g. via `ctx.res.status(403)...`),
      * returning `null` or `undefined` halts further adapter processing without error.
+     *
+     * Required: `createCheckoutRouter` throws `CheckoutError('INSECURE_CONFIGURATION')` at mount
+     * when it is missing, unless `allowClientPaymentRequest: true` is set.
      */
     buildPaymentRequest?: (req: Request, ctx: PaymentRequestContext) => PaymentRequest | null | undefined | Promise<PaymentRequest | null | undefined>;
+    /**
+     * **Insecure.** Without `buildPaymentRequest`, sends the client request body to the provider
+     * as the PaymentRequest: the browser chooses the amount, the currency and the order id.
+     * Never use this for a shop or for anything with a price; it exists for donations-style
+     * flows and tests. Ignored when `buildPaymentRequest` is set.
+     */
+    allowClientPaymentRequest?: true;
     /**
      * When configured, GET /:provider/redirect responds with a 302 redirect
      * to the URL returned by onSuccess or onFailure instead of JSON.
@@ -34,9 +44,15 @@ export interface ExpressCheckoutOptions {
     };
     /**
      * Configuration for GET /:provider/:id (getPaymentDetails).
-     * Default: enabled: true. Set enabled: false to return 404.
+     * If omitted, the details route is NOT mounted (returns 404), like `refund`.
+     * The route returns status, amount and currency for any payment id it is given:
+     * protect it with `middleware` (a console warning is printed at mount when it has none).
      */
     details?: {
+        /**
+         * @deprecated Since 2.0.0 the route is mounted only when `details` is set.
+         * `enabled: false` behaves as if `details` were omitted; any other value is ignored.
+         */
         enabled?: boolean;
         middleware?: RequestHandler[];
     };
@@ -54,6 +70,20 @@ export interface ExpressCheckoutOptions {
         middleware?: RequestHandler[];
         onBeforeExecute?: (req: Request, paymentId: string) => void | Promise<void>;
     };
+    /**
+     * When `true`, 500 responses carry the error message (masked to 'Invalid provider response'
+     * for provider parse errors). Default `false`: 500 bodies are always
+     * `{ success: false, error: 'Internal server error' }`. `CheckoutError` 4xx responses keep
+     * their message and code either way.
+     */
+    exposeErrorMessages?: boolean;
+    /**
+     * Called with the original error (and the request) for every error answered with a 500,
+     * whatever `exposeErrorMessages` says. Not called for 4xx `CheckoutError` responses, which are
+     * client-triggerable (e.g. an unknown provider name). When omitted, the error is logged with
+     * `console.error('[awesome-node-checkout]', err)`.
+     */
+    onError?: (err: unknown, req: Request) => void;
 }
 /**
  * Matches a request path against public path patterns by segments.
@@ -72,9 +102,12 @@ export declare function isPathPublic(reqPath: string, publicPaths: (string | str
  * GET    /:provider/webhook      → handleWebhook
  * POST   /:provider/webhook      → handleWebhook
  * GET    /:provider/redirect     → handleRedirect  (must come before /:provider/:id)
- * GET    /:provider/:id          → getPaymentDetails
+ * GET    /:provider/:id          → getPaymentDetails (only if options.details is configured)
  * ```
  *
+ * Throws `CheckoutError('INSECURE_CONFIGURATION')` when neither `buildPaymentRequest` nor
+ * `allowClientPaymentRequest: true` is set.
+ *
  * Usage:
  * ```typescript
  * import { createCheckoutRouter } from 'awesome-node-checkout/express';

package/dist/adapters/express/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/express/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAElE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,QAAQ,CAAC;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;IAE9B;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC;IAEpC;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,CACpB,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,qBAAqB,KACvB,cAAc,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAEpF;;;OAGG;IACH,QAAQ,CAAC,EAAE;QACT,SAAS,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;QAC3D,SAAS,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;KAC5D,CAAC;IAEF;;;OAGG;IACH,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;KAC/B,CAAC;IAEF;;;OAGG;IACH,MAAM,CAAC,EAAE;QACP,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;KAC/B,CAAC;IAEF;;OAEG;IACH,OAAO,CAAC,EAAE;QACR,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;QAC9B,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC7E,CAAC;CACH;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAgBzF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,oBAAoB,EAC9B,OAAO,GAAE,sBAA2B,GACnC,MAAM,CAiNR"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/express/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAIlE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,QAAQ,CAAC;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;IAE9B;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC;IAEpC;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,CACpB,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,qBAAqB,KACvB,cAAc,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAEpF;;;;;OAKG;IACH,yBAAyB,CAAC,EAAE,IAAI,CAAC;IAEjC;;;OAGG;IACH,QAAQ,CAAC,EAAE;QACT,SAAS,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;QAC3D,SAAS,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;KAC5D,CAAC;IAEF;;;;;OAKG;IACH,OAAO,CAAC,EAAE;QACR;;;WAGG;QACH,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;KAC/B,CAAC;IAEF;;;OAGG;IACH,MAAM,CAAC,EAAE;QACP,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;KAC/B,CAAC;IAEF;;OAEG;IACH,OAAO,CAAC,EAAE;QACR,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;QAC9B,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC7E,CAAC;IAEF;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAE9B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;CAChD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAgBzF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,oBAAoB,EAC9B,OAAO,GAAE,sBAA2B,GACnC,MAAM,CAmOR"}

package/dist/adapters/express/index.js

@@ -4,6 +4,8 @@ exports.isPathPublic = isPathPublic;
 exports.createCheckoutRouter = createCheckoutRouter;
 const express_1 = require("express");
 const errors_1 = require("../../models/errors");
+const checkout_event_bus_1 = require("../../events/checkout-event-bus");
+const money_1 = require("../../utils/money");
 /**
  * Matches a request path against public path patterns by segments.
  * ':provider' matches any single non-empty segment.
@@ -37,9 +39,12 @@ function isPathPublic(reqPath, publicPaths) {
  * GET    /:provider/webhook      → handleWebhook
  * POST   /:provider/webhook      → handleWebhook
  * GET    /:provider/redirect     → handleRedirect  (must come before /:provider/:id)
- * GET    /:provider/:id          → getPaymentDetails
+ * GET    /:provider/:id          → getPaymentDetails (only if options.details is configured)
  * ```
  *
+ * Throws `CheckoutError('INSECURE_CONFIGURATION')` when neither `buildPaymentRequest` nor
+ * `allowClientPaymentRequest: true` is set.
+ *
  * Usage:
  * ```typescript
  * import { createCheckoutRouter } from 'awesome-node-checkout/express';
@@ -58,10 +63,14 @@ function isPathPublic(reqPath, publicPaths) {
  * ```
  */
 function createCheckoutRouter(checkout, options = {}) {
-    const router = (0, express_1.Router)();
+    if (!options.buildPaymentRequest && options.allowClientPaymentRequest !== true) {
+        throw new errors_1.CheckoutError('createCheckoutRouter: set buildPaymentRequest (server-side amount) or allowClientPaymentRequest: true', 'INSECURE_CONFIGURATION');
+    }
     if (!options.buildPaymentRequest) {
-        console.warn('[awesome-node-checkout] createCheckoutRouter: the client body decides the amount; set buildPaymentRequest');
+        console.warn('[awesome-node-checkout] allowClientPaymentRequest: the client body decides the amount');
     }
+    const router = (0, express_1.Router)();
+    const sendError = (req, res, err, isProvider = true) => sendErrorResponse(req, res, options, err, isProvider);
     // Apply shared middleware (skipping public paths by segment match)
     if (options.middleware?.length) {
         const publicPaths = options.publicPaths ?? [];
@@ -92,7 +101,7 @@ function createCheckoutRouter(checkout, options = {}) {
                     });
                 }
                 catch (consumerErr) {
-                    sendError(res, consumerErr, false);
+                    sendError(req, res, consumerErr, false);
                     return;
                 }
                 if (res.headersSent) {
@@ -133,12 +142,22 @@ function createCheckoutRouter(checkout, options = {}) {
                 }
                 paymentRequest = body;
             }
+            // Exact minor units: an amount with more decimals than the currency allows is rejected,
+            // never rounded
+            try {
+                (0, money_1.toMinorUnits)(paymentRequest.amount, paymentRequest.currency);
+            }
+            catch (amountErr) {
+                if (!(0, money_1.isInvalidAmountError)(amountErr))
+                    throw amountErr;
+                return res.status(400).json({ success: false, code: 'INVALID_AMOUNT', error: amountErr.message });
+            }
             const result = await checkout.createPayment(provider, paymentRequest);
             const { raw, ...safeResult } = result;
             res.status(result.success ? 201 : 400).json(safeResult);
         }
         catch (err) {
-            sendError(res, err, true);
+            sendError(req, res, err, true);
         }
     });
     // ---- POST /:provider/execute — execute payment ---------------------------
@@ -154,7 +173,7 @@ function createCheckoutRouter(checkout, options = {}) {
                     await options.execute.onBeforeExecute(req, paymentId);
                 }
                 catch (consumerErr) {
-                    sendError(res, consumerErr, false);
+                    sendError(req, res, consumerErr, false);
                     return;
                 }
             }
@@ -163,7 +182,7 @@ function createCheckoutRouter(checkout, options = {}) {
             res.status(result.success ? 200 : 400).json(safeResult);
         }
         catch (err) {
-            sendError(res, err, true);
+            sendError(req, res, err, true);
         }
     });
     // ---- POST /:provider/refund — refund payment (opt-in) --------------------
@@ -180,7 +199,7 @@ function createCheckoutRouter(checkout, options = {}) {
                 res.status(result.success ? 200 : 400).json(safeResult);
             }
             catch (err) {
-                sendError(res, err, true);
+                sendError(req, res, err, true);
             }
         });
     }
@@ -197,7 +216,7 @@ function createCheckoutRouter(checkout, options = {}) {
             res.status(result.success ? 200 : 400).json(safeResult);
         }
         catch (err) {
-            sendError(res, err, true);
+            sendError(req, res, err, true);
         }
     };
     router.get('/:provider/webhook', webhookHandler);
@@ -212,7 +231,7 @@ function createCheckoutRouter(checkout, options = {}) {
             result = await checkout.handleRedirect(String(req.params.provider), req.query);
         }
         catch (err) {
-            sendError(res, err, true);
+            sendError(req, res, err, true);
             return;
         }
         if (options.redirect) {
@@ -223,7 +242,7 @@ function createCheckoutRouter(checkout, options = {}) {
                     : options.redirect.onFailure(result, req);
             }
             catch (consumerErr) {
-                sendError(res, consumerErr, false);
+                sendError(req, res, consumerErr, false);
                 return;
             }
             return res.redirect(302, targetUrl);
@@ -231,34 +250,42 @@ function createCheckoutRouter(checkout, options = {}) {
         const { raw, ...safeResult } = result;
         res.status(result.success ? 200 : 400).json(safeResult);
     });
-    // ---- GET /:provider/:id — get payment details ----------------------------
-    const detailsHandlers = [];
-    if (options.details?.middleware?.length) {
-        detailsHandlers.push(...options.details.middleware);
-    }
-    router.get('/:provider/:id', ...detailsHandlers, async (req, res) => {
-        if (options.details?.enabled === false) {
-            return res.status(404).json({ success: false, error: 'Payment details route is disabled' });
+    // ---- GET /:provider/:id — get payment details (opt-in) -------------------
+    // Registered after /:provider/redirect and /:provider/webhook so that those win.
+    if (options.details && options.details.enabled !== false) {
+        const detailsHandlers = [];
+        if (options.details.middleware?.length) {
+            detailsHandlers.push(...options.details.middleware);
         }
-        try {
-            const result = await checkout.getPaymentDetails(String(req.params.provider), String(req.params.id));
-            const { raw, ...safeResult } = result;
-            res.status(result.success ? 200 : 404).json(safeResult);
-        }
-        catch (err) {
-            sendError(res, err, true);
+        else {
+            console.warn('[awesome-node-checkout] details route mounted without middleware: payment status and amount are readable by anyone who knows a payment id');
         }
-    });
+        router.get('/:provider/:id', ...detailsHandlers, async (req, res) => {
+            try {
+                const result = await checkout.getPaymentDetails(String(req.params.provider), String(req.params.id));
+                const { raw, ...safeResult } = result;
+                res.status(result.success ? 200 : 404).json(safeResult);
+            }
+            catch (err) {
+                sendError(req, res, err, true);
+            }
+        });
+    }
     return router;
 }
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
-function sendError(res, err, isProvider = true) {
-    if (res.headersSent)
-        return;
-    const isListenerError = !!(err && typeof err === 'object' && err.__isEventListenerError);
+function sendErrorResponse(req, res, options, originalErr, isProvider = true) {
+    let err = originalErr;
+    const isListenerError = err instanceof checkout_event_bus_1.CheckoutListenerError;
+    if (err instanceof checkout_event_bus_1.CheckoutListenerError && err.cause instanceof errors_1.CheckoutError) {
+        // A listener that throws a CheckoutError keeps its status mapping
+        err = err.cause;
+    }
     if (err instanceof errors_1.CheckoutError) {
+        if (res.headersSent)
+            return;
         const statusMap = {
             PROVIDER_NOT_FOUND: 404,
             WEBHOOK_NOT_SUPPORTED: 422,
@@ -266,13 +293,29 @@ function sendError(res, err, isProvider = true) {
         };
         const status = statusMap[err.code] ?? 400;
         res.status(status).json({ success: false, error: err.message, code: err.code });
+        return;
+    }
+    // Unexpected error (500): report it to the app, never to the client unless asked to
+    try {
+        if (options.onError) {
+            options.onError(originalErr, req);
+        }
+        else {
+            console.error('[awesome-node-checkout]', originalErr);
+        }
     }
-    else {
-        let message = err instanceof Error ? err.message : String(err ?? 'Internal server error');
+    catch {
+        // A throwing onError must not prevent the response
+    }
+    if (res.headersSent)
+        return;
+    let message = 'Internal server error';
+    if (options.exposeErrorMessages === true) {
+        message = err instanceof Error ? err.message : String(err ?? 'Internal server error');
         if (!isListenerError && isProvider && (err instanceof SyntaxError || /JSON|Unexpected token/i.test(message))) {
             message = 'Invalid provider response';
         }
-        res.status(500).json({ success: false, error: message });
     }
+    res.status(500).json({ success: false, error: message });
 }
 //# sourceMappingURL=index.js.map

package/dist/adapters/express/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/express/index.ts"],"names":[],"mappings":";;AA2EA,oCAgBC;AAiCD,oDAoNC;AAhVD,qCAAoE;AAEpE,gDAAoD;AAoEpD;;;;GAIG;AACH,SAAgB,YAAY,CAAC,OAAe,EAAE,WAAkC;IAC9E,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvD,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAClC,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAC5C,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,WAAW,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;YACzC,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrD,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YACnC,CAAC;YACD,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,SAAgB,oBAAoB,CAClC,QAA8B,EAC9B,UAAkC,EAAE;IAEpC,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IAExB,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;QACjC,OAAO,CAAC,IAAI,CACV,2GAA2G,CAC5G,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,IAAI,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;QAC9C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YAC5B,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAC;YACvD,mCAAmC;YACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAW,CAAC;YACrC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAQ,EAAE;gBAC9B,IAAI,CAAC,IAAI,QAAQ,CAAC,MAAM;oBAAE,OAAO,IAAI,EAAE,CAAC;gBACxC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC1C,CAAC,CAAC;YACF,GAAG,CAAC,CAAC,CAAC,CAAC;QACT,CAAC,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC9D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,cAA8B,CAAC;YACnC,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;gBAChC,IAAI,SAA4C,CAAC;gBACjD,IAAI,CAAC;oBACH,SAAS,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,GAAG,EAAE;wBACjD,QAAQ;wBACR,GAAG;qBACJ,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,WAAW,EAAE,CAAC;oBACrB,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;oBACnC,OAAO;gBACT,CAAC;gBAED,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;oBACpB,OAAO;gBACT,CAAC;gBAED,IACE,CAAC,SAAS;oBACV,OAAO,SAAS,KAAK,QAAQ;oBAC7B,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ;oBACpC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC;oBAClC,SAAS,CAAC,MAAM,IAAI,CAAC;oBACrB,OAAO,SAAS,CAAC,QAAQ,KAAK,QAAQ;oBACtC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE;oBAChC,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ;oBACvC,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE;oBACjC,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ;oBACvC,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EACjC,CAAC;oBACD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBAC1B,OAAO,EAAE,KAAK;wBACd,IAAI,EAAE,yBAAyB;wBAC/B,KAAK,EACH,oJAAoJ;qBACvJ,CAAC,CAAC;gBACL,CAAC;gBACD,cAAc,GAAG,SAAS,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;gBACtB,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC;gBAC5B,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,CAAC;gBAChC,IACE,OAAO,MAAM,KAAK,QAAQ;oBAC1B,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACxB,MAAM,IAAI,CAAC;oBACX,OAAO,QAAQ,KAAK,QAAQ;oBAC5B,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EACtB,CAAC;oBACD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBAC1B,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,oFAAoF;qBAC5F,CAAC,CAAC;gBACL,CAAC;gBACD,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;YACtE,MAAM,EAAE,GAAG,EAAE,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC;YACtC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,MAAM,eAAe,GAAqB,EAAE,CAAC;IAC7C,IAAI,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QACxC,eAAe,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,eAAe,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC1F,IAAI,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,IAAyC,CAAC;YAC1E,IAAI,OAAO,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC;gBACrC,IAAI,CAAC;oBACH,MAAM,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBACxD,CAAC;gBAAC,OAAO,WAAW,EAAE,CAAC;oBACrB,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;oBACnC,OAAO;gBACT,CAAC;YACH,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YAC3F,MAAM,EAAE,GAAG,EAAE,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC;YACtC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,cAAc,GAAqB,EAAE,CAAC;QAC5C,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;YACtC,cAAc,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,cAAc,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;YACxF,IAAI,CAAC;gBACH,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAA8C,CAAC;gBACjF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;gBAC5F,MAAM,EAAE,GAAG,EAAE,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC;gBACtC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,MAAM,cAAc,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC3D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,aAAa,CACzC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC3B,GAAG,CAAC,IAAI,EACR,GAAG,CAAC,OAAiC,EACrC,GAAG,CAAC,KAA+B,EACnC;gBACE,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG;gBAChC,OAAO,EAAG,GAAW,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;aACpF,CACF,CAAC;YACF,iEAAiE;YACjE,MAAM,EAAE,GAAG,EAAE,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC;YACtC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAC;IACjD,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAC;IAClD,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAC;IAElD,6EAA6E;IAC7E,wEAAwE;IACxE,0BAA0B;IAC1B,MAAM,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACtE,IAAI,MAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,QAAQ,CAAC,cAAc,CACpC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC3B,GAAG,CAAC,KAA+B,CACpC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAC1B,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,IAAI,SAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,CAAC,OAAO;oBACxB,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC;oBACzC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,WAAW,EAAE,CAAC;gBACrB,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;gBACnC,OAAO;YACT,CAAC;YACD,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC;QACtC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,MAAM,eAAe,GAAqB,EAAE,CAAC;IAC7C,IAAI,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QACxC,eAAe,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,GAAG,eAAe,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACrF,IAAI,OAAO,CAAC,OAAO,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;YACvC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YACpG,MAAM,EAAE,GAAG,EAAE,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC;YACtC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,SAAS,CAAC,GAAa,EAAE,GAAY,EAAE,UAAU,GAAG,IAAI;IAC/D,IAAI,GAAG,CAAC,WAAW;QAAE,OAAO;IAC5B,MAAM,eAAe,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAK,GAAW,CAAC,sBAAsB,CAAC,CAAC;IAClG,IAAI,GAAG,YAAY,sBAAa,EAAE,CAAC;QACjC,MAAM,SAAS,GAA2B;YACxC,kBAAkB,EAAE,GAAG;YACvB,qBAAqB,EAAE,GAAG;YAC1B,sBAAsB,EAAE,GAAG;SAC5B,CAAC;QACF,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;QAC1C,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAClF,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,uBAAuB,CAAC,CAAC;QAC1F,IAAI,CAAC,eAAe,IAAI,UAAU,IAAI,CAAC,GAAG,YAAY,WAAW,IAAI,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC7G,OAAO,GAAG,2BAA2B,CAAC;QACxC,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/express/index.ts"],"names":[],"mappings":";;AA8GA,oCAgBC;AAoCD,oDAsOC;AAxYD,qCAAoE;AAEpE,gDAAoD;AAGpD,wEAAwE;AACxE,6CAAuE;AAmGvE;;;;GAIG;AACH,SAAgB,YAAY,CAAC,OAAe,EAAE,WAAkC;IAC9E,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvD,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAClC,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAC5C,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,WAAW,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;YACzC,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrD,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YACnC,CAAC;YACD,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,SAAgB,oBAAoB,CAClC,QAA8B,EAC9B,UAAkC,EAAE;IAEpC,IAAI,CAAC,OAAO,CAAC,mBAAmB,IAAI,OAAO,CAAC,yBAAyB,KAAK,IAAI,EAAE,CAAC;QAC/E,MAAM,IAAI,sBAAa,CACrB,uGAAuG,EACvG,wBAAwB,CACzB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,uFAAuF,CAAC,CAAC;IACxG,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IACxB,MAAM,SAAS,GAAG,CAAC,GAAY,EAAE,GAAa,EAAE,GAAY,EAAE,UAAU,GAAG,IAAI,EAAQ,EAAE,CACvF,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IAExD,mEAAmE;IACnE,IAAI,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;QAC9C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YAC5B,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAC;YACvD,mCAAmC;YACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAW,CAAC;YACrC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAQ,EAAE;gBAC9B,IAAI,CAAC,IAAI,QAAQ,CAAC,MAAM;oBAAE,OAAO,IAAI,EAAE,CAAC;gBACxC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC1C,CAAC,CAAC;YACF,GAAG,CAAC,CAAC,CAAC,CAAC;QACT,CAAC,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC9D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,cAA8B,CAAC;YACnC,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;gBAChC,IAAI,SAA4C,CAAC;gBACjD,IAAI,CAAC;oBACH,SAAS,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,GAAG,EAAE;wBACjD,QAAQ;wBACR,GAAG;qBACJ,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,WAAW,EAAE,CAAC;oBACrB,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;oBACxC,OAAO;gBACT,CAAC;gBAED,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;oBACpB,OAAO;gBACT,CAAC;gBAED,IACE,CAAC,SAAS;oBACV,OAAO,SAAS,KAAK,QAAQ;oBAC7B,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ;oBACpC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC;oBAClC,SAAS,CAAC,MAAM,IAAI,CAAC;oBACrB,OAAO,SAAS,CAAC,QAAQ,KAAK,QAAQ;oBACtC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE;oBAChC,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ;oBACvC,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE;oBACjC,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ;oBACvC,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EACjC,CAAC;oBACD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBAC1B,OAAO,EAAE,KAAK;wBACd,IAAI,EAAE,yBAAyB;wBAC/B,KAAK,EACH,oJAAoJ;qBACvJ,CAAC,CAAC;gBACL,CAAC;gBACD,cAAc,GAAG,SAAS,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;gBACtB,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC;gBAC5B,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,CAAC;gBAChC,IACE,OAAO,MAAM,KAAK,QAAQ;oBAC1B,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACxB,MAAM,IAAI,CAAC;oBACX,OAAO,QAAQ,KAAK,QAAQ;oBAC5B,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EACtB,CAAC;oBACD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBAC1B,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,oFAAoF;qBAC5F,CAAC,CAAC;gBACL,CAAC;gBACD,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;YACD,wFAAwF;YACxF,gBAAgB;YAChB,IAAI,CAAC;gBACH,IAAA,oBAAY,EAAC,cAAc,CAAC,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC/D,CAAC;YAAC,OAAO,SAAS,EAAE,CAAC;gBACnB,IAAI,CAAC,IAAA,4BAAoB,EAAC,SAAS,CAAC;oBAAE,MAAM,SAAS,CAAC;gBACtD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;YACpG,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;YACtE,MAAM,EAAE,GAAG,EAAE,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC;YACtC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACjC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,MAAM,eAAe,GAAqB,EAAE,CAAC;IAC7C,IAAI,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QACxC,eAAe,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,eAAe,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC1F,IAAI,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,IAAyC,CAAC;YAC1E,IAAI,OAAO,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC;gBACrC,IAAI,CAAC;oBACH,MAAM,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBACxD,CAAC;gBAAC,OAAO,WAAW,EAAE,CAAC;oBACrB,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;oBACxC,OAAO;gBACT,CAAC;YACH,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YAC3F,MAAM,EAAE,GAAG,EAAE,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC;YACtC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACjC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,cAAc,GAAqB,EAAE,CAAC;QAC5C,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;YACtC,cAAc,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,cAAc,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;YACxF,IAAI,CAAC;gBACH,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAA8C,CAAC;gBACjF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;gBAC5F,MAAM,EAAE,GAAG,EAAE,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC;gBACtC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACjC,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,MAAM,cAAc,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC3D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,aAAa,CACzC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC3B,GAAG,CAAC,IAAI,EACR,GAAG,CAAC,OAAiC,EACrC,GAAG,CAAC,KAA+B,EACnC;gBACE,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG;gBAChC,OAAO,EAAG,GAAW,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;aACpF,CACF,CAAC;YACF,iEAAiE;YACjE,MAAM,EAAE,GAAG,EAAE,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC;YACtC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACjC,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAC;IACjD,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAC;IAClD,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAC;IAElD,6EAA6E;IAC7E,wEAAwE;IACxE,0BAA0B;IAC1B,MAAM,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACtE,IAAI,MAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,QAAQ,CAAC,cAAc,CACpC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC3B,GAAG,CAAC,KAA+B,CACpC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,IAAI,SAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,CAAC,OAAO;oBACxB,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC;oBACzC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,WAAW,EAAE,CAAC;gBACrB,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;gBACxC,OAAO;YACT,CAAC;YACD,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC;QACtC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,iFAAiF;IACjF,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QACzD,MAAM,eAAe,GAAqB,EAAE,CAAC;QAC7C,IAAI,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;YACvC,eAAe,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CACV,2IAA2I,CAC5I,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,GAAG,eAAe,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;YACrF,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;gBACpG,MAAM,EAAE,GAAG,EAAE,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC;gBACtC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACjC,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,iBAAiB,CACxB,GAAY,EACZ,GAAa,EACb,OAA+B,EAC/B,WAAoB,EACpB,UAAU,GAAG,IAAI;IAEjB,IAAI,GAAG,GAAG,WAAW,CAAC;IACtB,MAAM,eAAe,GAAG,GAAG,YAAY,0CAAqB,CAAC;IAC7D,IAAI,GAAG,YAAY,0CAAqB,IAAI,GAAG,CAAC,KAAK,YAAY,sBAAa,EAAE,CAAC;QAC/E,kEAAkE;QAClE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC;IAClB,CAAC;IACD,IAAI,GAAG,YAAY,sBAAa,EAAE,CAAC;QACjC,IAAI,GAAG,CAAC,WAAW;YAAE,OAAO;QAC5B,MAAM,SAAS,GAA2B;YACxC,kBAAkB,EAAE,GAAG;YACvB,qBAAqB,EAAE,GAAG;YAC1B,sBAAsB,EAAE,GAAG;SAC5B,CAAC;QACF,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;QAC1C,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAChF,OAAO;IACT,CAAC;IAED,oFAAoF;IACpF,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,WAAW,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;IACrD,CAAC;IACD,IAAI,GAAG,CAAC,WAAW;QAAE,OAAO;IAC5B,IAAI,OAAO,GAAG,uBAAuB,CAAC;IACtC,IAAI,OAAO,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;QACzC,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,uBAAuB,CAAC,CAAC;QACtF,IAAI,CAAC,eAAe,IAAI,UAAU,IAAI,CAAC,GAAG,YAAY,WAAW,IAAI,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC7G,OAAO,GAAG,2BAA2B,CAAC;QACxC,CAAC;IACH,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;AAC3D,CAAC"}