edgeaegis 2026.10.1

package/tools/.build/scr/cli/init.js

@@ -0,0 +1,62 @@
+import { randomBytes } from "node:crypto";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { SHIELD_VERSION } from "../core/version.js";
+/** Materialize operator files outside node_modules; existing files are never overwritten. */
+export async function initProject(target) {
+    let root = dirname(fileURLToPath(import.meta.url));
+    let found = false;
+    for (let i = 0; i < 6; i++) {
+        try {
+            if (JSON.parse(await readFile(join(root, "package.json"), "utf8")).name === "edgeaegis") {
+                found = true;
+                break;
+            }
+        }
+        catch { }
+        root = dirname(root);
+    }
+    if (!found)
+        throw new Error("Cannot locate installed EdgeAegis package");
+    const directory = resolve(target);
+    const files = [
+        "config.yml",
+        "rules/seclang-bundle.json",
+        "rules/seclang-upstreams.json",
+        "rules/allowlist.yml",
+        "rules/local.conf",
+        "rules/setup.conf",
+        "rules/emergency.conf",
+        "secret/credentials.example.yml",
+        "respond/403.html",
+        "respond/403.json",
+        "secret/relay-server.example.yml",
+        ...["cloudflare", "vercel", "netlify", "esa", "edgeone"].flatMap((platform) => [
+            `origin/${platform}/app/config.yml`,
+            `origin/${platform}/app/index.js`,
+        ]),
+    ];
+    async function put(path, data) {
+        const destination = join(directory, path);
+        await mkdir(dirname(destination), { recursive: true });
+        try {
+            await writeFile(destination, data, { flag: "wx", mode: 0o600 });
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+        }
+    }
+    for (const file of files)
+        await put(file, await readFile(join(root, file)));
+    await put("secret/credentials.yml", `originToken: ${randomBytes(32).toString("base64url")}\ningressKey: ${randomBytes(32).toString("base64url")}\n`);
+    const scripts = {};
+    for (const platform of ["cloudflare", "vercel", "netlify", "esa", "edgeone", "local"])
+        for (const command of ["build", "start", "deploy"])
+            scripts[`${command}:${platform}`] = `edgeaegis ${command} ${platform}`;
+    await put("package.json", `${JSON.stringify({ private: true, type: "module", scripts, dependencies: { edgeaegis: `^${SHIELD_VERSION}` } }, null, 2)}\n`);
+    await put(".gitignore", "secret/*\n!secret/credentials.example.yml\ntools/.state/\n");
+    console.log(`Initialized operator files in ${directory}`);
+}
+//# sourceMappingURL=init.js.map

package/tools/.build/scr/cli/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../../../scr/cli/init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAc;IAC9C,IAAI,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBACxF,KAAK,GAAG,IAAI,CAAC;gBACb,MAAM;YACR,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG;QACZ,YAAY;QACZ,2BAA2B;QAC3B,8BAA8B;QAC9B,qBAAqB;QACrB,kBAAkB;QAClB,kBAAkB;QAClB,sBAAsB;QACtB,gCAAgC;QAChC,kBAAkB;QAClB,kBAAkB;QAClB,iCAAiC;QACjC,GAAG,CAAC,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC7E,UAAU,QAAQ,iBAAiB;YACnC,UAAU,QAAQ,eAAe;SAClC,CAAC;KACH,CAAC;IACF,KAAK,UAAU,GAAG,CAAC,IAAY,EAAE,IAAyB;QACxD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC1C,MAAM,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QACtE,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,GAAG,CACP,wBAAwB,EACxB,gBAAgB,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,iBAAiB,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAChH,CAAC;IACF,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,QAAQ,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC;QACnF,KAAK,MAAM,OAAO,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC;YAChD,OAAO,CAAC,GAAG,OAAO,IAAI,QAAQ,EAAE,CAAC,GAAG,aAAa,OAAO,IAAI,QAAQ,EAAE,CAAC;IAC3E,MAAM,GAAG,CACP,cAAc,EACd,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,cAAc,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAC9H,CAAC;IACF,MAAM,GAAG,CAAC,YAAY,EAAE,4DAA4D,CAAC,CAAC;IACtF,OAAO,CAAC,GAAG,CAAC,iCAAiC,SAAS,EAAE,CAAC,CAAC;AAC5D,CAAC"}

package/tools/.build/scr/cli/main.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export declare function main(args?: string[]): Promise<void>;

package/tools/.build/scr/cli/main.js

@@ -0,0 +1,99 @@
+#!/usr/bin/env node
+import { execFileSync } from "node:child_process";
+import { realpathSync } from "node:fs";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { SHIELD_VERSION } from "../core/version.js";
+export async function main(args = process.argv.slice(2)) {
+    const [command, file] = args;
+    if (command === "--version" || command === "-v") {
+        console.log(SHIELD_VERSION);
+        return;
+    }
+    if (!command || command === "--help") {
+        console.log("edgeaegis init [directory]\nedgeaegis build <cloudflare|vercel|netlify|esa|edgeone|local> [config.yml]\nedgeaegis start <platform|local> [config.yml] [--plan]\nedgeaegis deploy <platform|local> [config.yml] [--plan]\nedgeaegis serve [config.yml]\nedgeaegis serve-relay <secret/relay-server.yml>\nedgeaegis check <SecLang file or source bundle>\nedgeaegis sync [--registry path] [--output path] [--latest]\nedgeaegis --version");
+        return;
+    }
+    if (command === "init") {
+        await (await import("./init.js")).initProject(file ?? ".");
+        return;
+    }
+    if (["build", "start", "deploy"].includes(command) && file) {
+        if (file === "local") {
+            const rest = args.slice(2).filter((value) => value !== "--plan");
+            if (rest.length > 1)
+                throw new Error("Unexpected command arguments");
+            const configFile = rest[0] ?? "config.yml";
+            if (args.includes("--plan")) {
+                console.log(JSON.stringify({
+                    platform: "local",
+                    tool: "node",
+                    args: ["edgeaegis", "start", "local", configFile],
+                }));
+                return;
+            }
+            if (command !== "build") {
+                await (await import("./serve.js")).serve(configFile);
+                return;
+            }
+            const { config } = await (await import("./deployment.js")).readDeployment(configFile);
+            await (await import("./config.js")).readCredentials(config.secretFile);
+            const native = await (await import("../seclang/node.js")).loadSecLangDeployment(config.secLangFile, config.localRulesFile, config.setupRulesFile);
+            const program = (await import("../seclang/index.js")).compileSecLang(native.secLang, {
+                ...native.secLangOptions,
+                strict: true,
+            });
+            try {
+                console.log(JSON.stringify({
+                    platform: "local",
+                    sourceRules: program.sourceRules,
+                    unsupported: program.unsupported.length,
+                }));
+            }
+            finally {
+                program.dispose();
+            }
+            return;
+        }
+        execFileSync(process.execPath, [fileURLToPath(new URL("../../../platform-command.mjs", import.meta.url)), ...args], { stdio: "inherit", windowsHide: true });
+        return;
+    }
+    if (command === "sync") {
+        execFileSync(process.execPath, [
+            fileURLToPath(new URL("../../../sync-native-seclang.mjs", import.meta.url)),
+            ...args.slice(1),
+        ], { stdio: "inherit" });
+        return;
+    }
+    if (command === "serve") {
+        await (await import("./serve.js")).serve(file ?? "config.yml");
+        return;
+    }
+    if (command === "serve-relay" && file) {
+        await (await import("./relay-serve.js")).serveRelay(file);
+        return;
+    }
+    if (command === "check" && file) {
+        const { loadSecLangFile } = await import("../seclang/node.js");
+        const { compileSecLang } = await import("../seclang/index.js");
+        const loaded = await loadSecLangFile(file);
+        const program = compileSecLang(loaded.secLang, { ...loaded.secLangOptions, strict: true });
+        try {
+            console.log(JSON.stringify({
+                sourceRules: program.sourceRules,
+                rootRules: program.supportedRules,
+                unsupported: program.unsupported.length,
+            }));
+        }
+        finally {
+            program.dispose();
+        }
+        return;
+    }
+    throw new Error("Unknown command or missing rule file");
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href)
+    main().catch((error) => {
+        process.stderr.write(`${error.message}\n`);
+        process.exitCode = 1;
+    });
+//# sourceMappingURL=main.js.map

package/tools/.build/scr/cli/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../../../scr/cli/main.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACrD,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7B,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC5B,OAAO;IACT,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CACT,2aAA2a,CAC5a,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;QAC3D,OAAO;IACT,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAQ,CAAC,IAAI,IAAI,EAAE,CAAC;QAC5D,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC;YACjE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YACrE,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC;YAC3C,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC;oBACb,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC;iBAClD,CAAC,CACH,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACxB,MAAM,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;YACtF,MAAM,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,qBAAqB,CAC7E,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,cAAc,CACtB,CAAC;YACF,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE;gBACnF,GAAG,MAAM,CAAC,cAAc;gBACxB,MAAM,EAAE,IAAI;aACb,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC;oBACb,QAAQ,EAAE,OAAO;oBACjB,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,MAAM;iBACxC,CAAC,CACH,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,CAAC;YACD,OAAO;QACT,CAAC;QACD,YAAY,CACV,OAAO,CAAC,QAAQ,EAChB,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,+BAA+B,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,EACnF,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,CACxC,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,YAAY,CACV,OAAO,CAAC,QAAQ,EAChB;YACE,aAAa,CAAC,IAAI,GAAG,CAAC,kCAAkC,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3E,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;SACjB,EACD,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,YAAY,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,aAAa,IAAI,IAAI,EAAE,CAAC;QACtC,MAAM,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,OAAO,IAAI,IAAI,EAAE,CAAC;QAChC,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAC/D,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC;gBACb,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,SAAS,EAAE,OAAO,CAAC,cAAc;gBACjC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,MAAM;aACxC,CAAC,CACH,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;AAC1D,CAAC;AACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;IAC1F,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;QAC3C,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC"}

package/tools/.build/scr/cli/relay-serve.d.ts

@@ -0,0 +1 @@
+export declare function serveRelay(path: string): Promise<void>;

package/tools/.build/scr/cli/relay-serve.js

@@ -0,0 +1,48 @@
+import { once } from "node:events";
+import { mkdir, readFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { createRelayServer } from "../origin/relay.js";
+import { SqliteReplayStore } from "../origin/replay-node.js";
+import { createNodeServer } from "../runtime/node.js";
+import { readCredentials, readData } from "./config.js";
+import { readBusinessFunction } from "./deployment.js";
+export async function serveRelay(path) {
+    const input = (await readData(path));
+    const base = dirname(resolve(path));
+    if (!["127.0.0.1", "::1"].includes(input.listen?.host) ||
+        !Number.isInteger(input.listen.port) ||
+        input.listen.port < 0 ||
+        input.listen.port > 65535 ||
+        typeof input.publicHost !== "string")
+        throw new Error("Relay server requires an explicit loopback listener behind TLS ingress");
+    const stateFile = resolve(base, input.stateFile);
+    await mkdir(dirname(stateFile), { recursive: true });
+    const store = new SqliteReplayStore(stateFile);
+    const credentials = await readCredentials(resolve(base, input.credentialsFile));
+    const business = await readBusinessFunction(resolve(base, input.businessFile));
+    const handler = await createRelayServer({
+        serverPrivateKey: JSON.parse(await readFile(resolve(base, input.privateKeyFile), "utf8")),
+        authenticationKey: (await readFile(resolve(base, input.authenticationKeyFile), "utf8")).trim(),
+        originToken: credentials.originToken,
+        business: (request) => Promise.resolve(business.fetch(request)),
+        replay: store,
+        ...(input.maxBytes ? { maxBytes: input.maxBytes } : {}),
+    });
+    const server = createNodeServer(async (request) => new URL(request.url).pathname === "/_edgeshield/relay"
+        ? handler(request)
+        : new Response(null, { status: 404 }), input.publicHost);
+    server.listen(input.listen.port, input.listen.host);
+    await once(server, "listening");
+    const address = server.address();
+    if (!address || typeof address === "string")
+        throw new Error("Missing relay listener");
+    process.stderr.write(`Relay listening at http://${input.listen.host}:${address.port}; HTTPS ingress required\n`);
+    const stop = () => {
+        server.close(() => store.close());
+        server.closeIdleConnections();
+        setTimeout(() => server.closeAllConnections(), 5000).unref();
+    };
+    process.once("SIGTERM", stop);
+    process.once("SIGINT", stop);
+}
+//# sourceMappingURL=relay-serve.js.map

package/tools/.build/scr/cli/relay-serve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay-serve.js","sourceRoot":"","sources":["../../../../scr/cli/relay-serve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY;IAC3C,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CASlC,CAAC;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,IACE,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC;QAClD,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;QACpC,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;QACrB,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK;QACzB,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QAEpC,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,IAAI,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC;QACtC,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;QACzF,iBAAiB,EAAE,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE;QAC9F,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,EAAE,KAAK;QACb,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,gBAAgB,CAC7B,KAAK,EAAE,OAAO,EAAE,EAAE,CAChB,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,oBAAoB;QACpD,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QAClB,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EACzC,KAAK,CAAC,UAAU,CACjB,CAAC;IACF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACvF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,6BAA6B,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,4BAA4B,CAC3F,CAAC;IACF,MAAM,IAAI,GAAG,GAAG,EAAE;QAChB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAClC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAC9B,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAC/D,CAAC,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9B,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC/B,CAAC"}

package/tools/.build/scr/cli/responses.d.ts

@@ -0,0 +1,2 @@
+import type { ErrorPages } from "../runtime/error-pages.js";
+export declare function readResponsePages(directory: string, csp: string): Promise<ErrorPages>;

package/tools/.build/scr/cli/responses.js

@@ -0,0 +1,31 @@
+import { readdir, readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { parseStrictJson } from "../http-boundary/json.js";
+export async function readResponsePages(directory, csp) {
+    const pages = {};
+    const names = await readdir(directory);
+    if (names.length > 100)
+        throw new Error("Too many custom response files");
+    for (const name of names) {
+        const match = /^([45]\d\d)\.html$/.exec(name);
+        if (!match)
+            continue;
+        const bytes = await readFile(join(directory, name));
+        if (bytes.length > 262144)
+            throw new Error("Custom response HTML exceeds 256 KiB");
+        const status = Number(match[1]);
+        pages[status] = {
+            html: new TextDecoder("utf-8", { fatal: true }).decode(bytes),
+            contentSecurityPolicy: csp,
+        };
+        const jsonName = `${status}.json`;
+        if (names.includes(jsonName)) {
+            const raw = await readFile(join(directory, jsonName));
+            if (raw.length > 65536)
+                throw new Error("Custom response JSON exceeds 64 KiB");
+            pages[status].json = parseStrictJson(new TextDecoder("utf-8", { fatal: true }).decode(raw));
+        }
+    }
+    return pages;
+}
+//# sourceMappingURL=responses.js.map

package/tools/.build/scr/cli/responses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"responses.js","sourceRoot":"","sources":["../../../../scr/cli/responses.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE3D,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAiB,EAAE,GAAW;IACpE,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC1E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;QACpD,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACnF,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAChC,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,IAAI,EAAE,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC7D,qBAAqB,EAAE,GAAG;SAC3B,CAAC;QACF,MAAM,QAAQ,GAAG,GAAG,MAAM,OAAO,CAAC;QAClC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;YACtD,IAAI,GAAG,CAAC,MAAM,GAAG,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YAC/E,KAAK,CAAC,MAAM,CAAE,CAAC,IAAI,GAAG,eAAe,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/tools/.build/scr/cli/serve.d.ts

@@ -0,0 +1 @@
+export declare function serve(path: string): Promise<void>;

package/tools/.build/scr/cli/serve.js

@@ -0,0 +1,132 @@
+import { timingSafeEqual } from "node:crypto";
+import { once } from "node:events";
+import { digest, stableJson } from "../core/types.js";
+import { createRelayTransport } from "../origin/relay.js";
+import { createShield } from "../runtime/index.js";
+import { createNodeServer } from "../runtime/node.js";
+import { loadSecLangDeployment } from "../seclang/node.js";
+import { readCredentials, readData } from "./config.js";
+import { readBusinessFunction, readDeployment } from "./deployment.js";
+import { readResponsePages } from "./responses.js";
+function authorized(header, secret) {
+    const given = Buffer.from(header?.startsWith("Bearer ") ? header.slice(7) : "");
+    const expected = Buffer.from(secret);
+    return given.length === expected.length && timingSafeEqual(given, expected);
+}
+export async function serve(path) {
+    let fingerprint = "";
+    async function candidate() {
+        const { config, businesses } = await readDeployment(path);
+        const credentials = await readCredentials(config.secretFile), native = await loadSecLangDeployment(config.secLangFile, config.localRulesFile, config.setupRulesFile);
+        const allowlist = config.allowlistFile
+            ? (await readData(config.allowlistFile))
+            : [];
+        const errorPages = config.responses
+            ? await readResponsePages(config.responses.directory, config.responses.contentSecurityPolicy)
+            : {};
+        const origins = Object.create(null);
+        for (const [name, { settings, businessFile }] of Object.entries(businesses)) {
+            const business = settings.mode === "function" ? await readBusinessFunction(businessFile) : undefined;
+            const originFetch = business
+                ? (input, init) => Promise.resolve(business.fetch(new Request(input, init)))
+                : settings.mode === "relay"
+                    ? await createRelayTransport({
+                        endpoint: settings.endpoint,
+                        serverPublicKey: (await readData(settings.publicKeyFile, 16384)),
+                        authenticationKey: (await readData(settings.authenticationKeyFile, 4096)),
+                        maxBytes: config.limits?.maxBodyBytes ?? 8388608,
+                    })
+                    : undefined;
+            origins[name] = {
+                ...config.origins[name],
+                originToken: credentials.originToken,
+                allowLoopbackHttp: config.allowLoopbackHttp ?? false,
+                ...(originFetch ? { fetch: originFetch } : {}),
+            };
+        }
+        const hash = await digest(stableJson({
+            config,
+            businesses,
+            errorPages,
+            credentials,
+            source: native.secLang,
+            files: native.secLangOptions.files,
+            allowlist,
+        }));
+        if (hash === fingerprint)
+            return undefined;
+        const engine = await createShield({
+            tenant: config.tenant,
+            service: config.service,
+            publicHosts: config.publicHosts,
+            routes: config.routes,
+            ...native,
+            allowlist,
+            errorPages,
+            ...(config.limits ? { limits: config.limits } : {}),
+            ...(config.maxConcurrentRequests
+                ? { maxConcurrentRequests: config.maxConcurrentRequests }
+                : {}),
+            origins,
+            event: (event) => process.stdout.write(`${JSON.stringify(event)}\n`),
+        });
+        return { config, credentials, engine, hash };
+    }
+    let current = (await candidate());
+    fingerprint = current.hash;
+    let nextReload = Date.now() + 1000, reloading;
+    const server = createNodeServer(async (request, incoming) => {
+        if (Date.now() >= nextReload && !reloading) {
+            nextReload = Date.now() + 1000;
+            reloading = candidate()
+                .then((next) => {
+                if (!next)
+                    return;
+                if (stableJson(next.config.listen) !== stableJson(current.config.listen)) {
+                    next.engine.dispose();
+                    throw new Error("Listener changes require restart");
+                }
+                const previous = current;
+                current = next;
+                fingerprint = next.hash;
+                previous.engine.dispose();
+                process.stderr.write('{"event":"rules-reloaded"}\n');
+            })
+                .catch(() => process.stderr.write('{"event":"reload-rejected"}\n'))
+                .then(() => { })
+                .finally(() => {
+                reloading = undefined;
+            });
+        }
+        await reloading;
+        return current.engine.handle(request, {
+            tenant: current.config.tenant,
+            verifiedClientIp: incoming.socket.remoteAddress ?? "127.0.0.1",
+            httpProtocol: `HTTP/${incoming.httpVersion}`,
+            ...(current.credentials.clientToken &&
+                authorized(request.headers.get("authorization"), current.credentials.clientToken)
+                ? { identity: "configured-api-client" }
+                : {}),
+        }, incoming.url);
+    }, () => current.config.publicHosts[0]);
+    server.listen(current.config.listen.port, current.config.listen.host);
+    await once(server, "listening");
+    const address = server.address();
+    if (!address || typeof address === "string")
+        throw new Error("Missing TCP listener");
+    process.stderr.write(`listening at http://${current.config.listen.host}:${address.port}; native SecLang\n`);
+    let stopping = false;
+    const stop = () => {
+        if (stopping)
+            return;
+        stopping = true;
+        server.close(() => {
+            current.engine.dispose();
+        });
+        server.closeIdleConnections();
+        setTimeout(() => server.closeAllConnections(), 5000).unref();
+    };
+    process.once("SIGINT", stop);
+    process.once("SIGTERM", stop);
+}
+//# sourceMappingURL=serve.js.map

package/tools/.build/scr/cli/serve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.js","sourceRoot":"","sources":["../../../../scr/cli/serve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAuB,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD,SAAS,UAAU,CAAC,MAAqB,EAAE,MAAc;IACvD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrC,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AAC9E,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,IAAY;IACtC,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,KAAK,UAAU,SAAS;QACtB,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,EAC1D,MAAM,GAAG,MAAM,qBAAqB,CAClC,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,cAAc,CACtB,CAAC;QACJ,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa;YACpC,CAAC,CAAE,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAsB;YAC9D,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS;YACjC,CAAC,CAAC,MAAM,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,qBAAqB,CAAC;YAC7F,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,OAAO,GAA+D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAChG,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5E,MAAM,QAAQ,GACZ,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACtF,MAAM,WAAW,GAAG,QAAQ;gBAC1B,CAAC,CAAC,CAAC,KAAwB,EAAE,IAAkB,EAAE,EAAE,CAC/C,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC7D,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO;oBACzB,CAAC,CAAC,MAAM,oBAAoB,CAAC;wBACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;wBAC3B,eAAe,EAAE,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC,CAAe;wBAC9E,iBAAiB,EAAE,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAW;wBACnF,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,IAAI,OAAO;qBACjD,CAAC;oBACJ,CAAC,CAAC,SAAS,CAAC;YAChB,OAAO,CAAC,IAAI,CAAC,GAAG;gBACd,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAE;gBACxB,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,KAAK;gBACpD,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/C,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,MAAM,CACvB,UAAU,CAAC;YACT,MAAM;YACN,UAAU;YACV,UAAU;YACV,WAAW;YACX,MAAM,EAAE,MAAM,CAAC,OAAO;YACtB,KAAK,EAAE,MAAM,CAAC,cAAc,CAAC,KAAK;YAClC,SAAS;SACV,CAAC,CACH,CAAC;QACF,IAAI,IAAI,KAAK,WAAW;YAAE,OAAO,SAAS,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;YAChC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,MAAM;YACT,SAAS;YACT,UAAU;YACV,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,qBAAqB;gBAC9B,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,EAAE;gBACzD,CAAC,CAAC,EAAE,CAAC;YACP,OAAO;YACP,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;SACrE,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC/C,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,MAAM,SAAS,EAAE,CAAE,CAAC;IACnC,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAC3B,IAAI,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAChC,SAAoC,CAAC;IACvC,MAAM,MAAM,GAAG,gBAAgB,CAC7B,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC1B,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,UAAU,IAAI,CAAC,SAAS,EAAE,CAAC;YAC3C,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAC/B,SAAS,GAAG,SAAS,EAAE;iBACpB,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;gBACb,IAAI,CAAC,IAAI;oBAAE,OAAO;gBAClB,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;oBACzE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACtB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;gBACtD,CAAC;gBACD,MAAM,QAAQ,GAAG,OAAO,CAAC;gBACzB,OAAO,GAAG,IAAI,CAAC;gBACf,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC;gBACxB,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;YACvD,CAAC,CAAC;iBACD,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;iBAClE,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;iBACd,OAAO,CAAC,GAAG,EAAE;gBACZ,SAAS,GAAG,SAAS,CAAC;YACxB,CAAC,CAAC,CAAC;QACP,CAAC;QACD,MAAM,SAAS,CAAC;QAChB,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,CAC1B,OAAO,EACP;YACE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM;YAC7B,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,IAAI,WAAW;YAC9D,YAAY,EAAE,QAAQ,QAAQ,CAAC,WAAW,EAAE;YAC5C,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW;gBACnC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC;gBAC/E,CAAC,CAAC,EAAE,QAAQ,EAAE,uBAAuB,EAAE;gBACvC,CAAC,CAAC,EAAE,CAAC;SACR,EACD,QAAQ,CAAC,GAAG,CACb,CAAC;IACJ,CAAC,EACD,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAE,CACrC,CAAC;IACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtE,MAAM,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACrF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uBAAuB,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,oBAAoB,CACtF,CAAC;IACF,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,IAAI,GAAG,GAAG,EAAE;QAChB,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;YAChB,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAC9B,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAC/D,CAAC,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC7B,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC"}

package/tools/.build/scr/config.d.ts

@@ -0,0 +1,39 @@
+import type { BoundaryLimits } from "./http-boundary/index.js";
+import type { PlatformName } from "./origin/types.js";
+import type { Route } from "./runtime/index.js";
+export interface DeploymentConfig {
+    platform: PlatformName;
+    tenant: string;
+    service: string;
+    publicHosts: string[];
+    routes: Route[];
+    secLangFile: string;
+    localRulesFile?: string;
+    setupRulesFile?: string;
+    allowlistFile?: string;
+    secretFile: string;
+    originDirectory: string;
+    origins: Record<string, {
+        origin: string;
+        allowedOrigins: string[];
+    }>;
+    listen: {
+        host: "127.0.0.1" | "::1" | "0.0.0.0" | "::";
+        port: number;
+    };
+    allowLoopbackHttp?: boolean;
+    limits?: Partial<BoundaryLimits>;
+    maxConcurrentRequests?: number;
+    responses?: {
+        directory: string;
+        contentSecurityPolicy: string;
+    };
+}
+export interface ProjectCredentials {
+    originToken: string;
+    clientToken?: string;
+    ingressKey?: string;
+}
+export declare function parseConfigText(text: string): unknown;
+export declare function validateDeploymentConfig(value: unknown): DeploymentConfig;
+export declare function validateCredentials(value: unknown): ProjectCredentials;

package/tools/.build/scr/config.js

@@ -0,0 +1,89 @@
+import { parseDocument } from "yaml";
+export function parseConfigText(text) {
+    if (new TextEncoder().encode(text).length > 8_000_000)
+        throw new Error("Configuration exceeds 8MB");
+    const doc = parseDocument(text, { uniqueKeys: true, merge: false });
+    if (doc.errors.length)
+        throw new Error(doc.errors.map((e) => e.message).join("; "));
+    return doc.toJS({ maxAliasCount: 0 });
+}
+export function validateDeploymentConfig(value) {
+    const config = value;
+    const keys = [
+        "tenant",
+        "platform",
+        "service",
+        "publicHosts",
+        "routes",
+        "secLangFile",
+        "localRulesFile",
+        "setupRulesFile",
+        "allowlistFile",
+        "secretFile",
+        "originDirectory",
+        "origins",
+        "listen",
+        "allowLoopbackHttp",
+        "limits",
+        "maxConcurrentRequests",
+        "responses",
+    ];
+    if (!config ||
+        typeof config !== "object" ||
+        Object.keys(config).some((k) => !keys.includes(k)) ||
+        !["cloudflare", "vercel", "netlify", "esa", "edgeone"].includes(config.platform) ||
+        !Array.isArray(config.routes) ||
+        !Array.isArray(config.publicHosts) ||
+        config.publicHosts.length < 1 ||
+        config.publicHosts.length > 16 ||
+        !["tenant", "service", "secLangFile", "secretFile", "originDirectory"].every((k) => typeof config[k] === "string" && config[k].length) ||
+        !config.origins ||
+        typeof config.origins !== "object" ||
+        Array.isArray(config.origins) ||
+        !["127.0.0.1", "::1", "0.0.0.0", "::"].includes(config.listen?.host) ||
+        !Number.isInteger(config.listen.port) ||
+        config.listen.port < 0 ||
+        config.listen.port > 65535)
+        throw new Error("Invalid deployment configuration");
+    for (const route of config.routes) {
+        if (!route ||
+            typeof route.business !== "string" ||
+            !/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(route.business) ||
+            !Object.hasOwn(config.origins, route.business))
+            throw new Error("Every route must select a configured business");
+    }
+    for (const host of config.publicHosts) {
+        const publicUrl = new URL(`https://${host}`);
+        if (publicUrl.host !== host ||
+            publicUrl.pathname !== "/" ||
+            publicUrl.username ||
+            publicUrl.password ||
+            publicUrl.search ||
+            publicUrl.hash)
+            throw new Error("An exact public host is required");
+    }
+    if (config.responses &&
+        (typeof config.responses.directory !== "string" ||
+            !config.responses.directory ||
+            typeof config.responses.contentSecurityPolicy !== "string" ||
+            !config.responses.contentSecurityPolicy ||
+            Object.keys(config.responses).some((k) => !["directory", "contentSecurityPolicy"].includes(k))))
+        throw new Error("Invalid custom response configuration");
+    return config;
+}
+export function validateCredentials(value) {
+    const credentials = value;
+    if (!credentials ||
+        typeof credentials !== "object" ||
+        Object.keys(credentials).some((k) => !["originToken", "clientToken", "ingressKey"].includes(k)) ||
+        typeof credentials.originToken !== "string" ||
+        !/^[\x21-\x7e]{32,2048}$/.test(credentials.originToken) ||
+        (credentials.clientToken !== undefined &&
+            (!/^[\x21-\x7e]{32,2048}$/.test(credentials.clientToken) ||
+                credentials.clientToken === credentials.originToken)))
+        throw new Error("Invalid project credentials");
+    if (credentials.ingressKey !== undefined && !/^[\w-]{43,256}$/.test(credentials.ingressKey))
+        throw new Error("Invalid ingress signing key");
+    return credentials;
+}
+//# sourceMappingURL=config.js.map

package/tools/.build/scr/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../scr/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AA4BrC,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,SAAS;QACnD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACpF,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;AACxC,CAAC;AACD,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,MAAM,MAAM,GAAG,KAAyB,CAAC;IACzC,MAAM,IAAI,GAAG;QACX,QAAQ;QACR,UAAU;QACV,SAAS;QACT,aAAa;QACb,QAAQ;QACR,aAAa;QACb,gBAAgB;QAChB,gBAAgB;QAChB,eAAe;QACf,YAAY;QACZ,iBAAiB;QACjB,SAAS;QACT,QAAQ;QACR,mBAAmB;QACnB,QAAQ;QACR,uBAAuB;QACvB,WAAW;KACZ,CAAC;IACF,IACE,CAAC,MAAM;QACP,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAClD,CAAC,CAAC,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;QAChF,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7B,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;QAClC,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QAC7B,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,EAAE;QAC9B,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC,KAAK,CAC1E,CAAC,CAAC,EAAE,EAAE,CAAC,OAAQ,MAAc,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAK,MAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAC3E;QACD,CAAC,MAAM,CAAC,OAAO;QACf,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;QAClC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAC7B,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;QACpE,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;QACtB,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK;QAE1B,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,IACE,CAAC,KAAK;YACN,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;YAClC,CAAC,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;YACxD,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC;YAE9C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACrE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QAC7C,IACE,SAAS,CAAC,IAAI,KAAK,IAAI;YACvB,SAAS,CAAC,QAAQ,KAAK,GAAG;YAC1B,SAAS,CAAC,QAAQ;YAClB,SAAS,CAAC,QAAQ;YAClB,SAAS,CAAC,MAAM;YAChB,SAAS,CAAC,IAAI;YAEd,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACxD,CAAC;IACD,IACE,MAAM,CAAC,SAAS;QAChB,CAAC,OAAO,MAAM,CAAC,SAAS,CAAC,SAAS,KAAK,QAAQ;YAC7C,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS;YAC3B,OAAO,MAAM,CAAC,SAAS,CAAC,qBAAqB,KAAK,QAAQ;YAC1D,CAAC,MAAM,CAAC,SAAS,CAAC,qBAAqB;YACvC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAC3D,CAAC;QAEJ,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,MAAM,WAAW,GAAG,KAA2B,CAAC;IAChD,IACE,CAAC,WAAW;QACZ,OAAO,WAAW,KAAK,QAAQ;QAC/B,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CACjE;QACD,OAAO,WAAW,CAAC,WAAW,KAAK,QAAQ;QAC3C,CAAC,wBAAwB,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;QACvD,CAAC,WAAW,CAAC,WAAW,KAAK,SAAS;YACpC,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;gBACtD,WAAW,CAAC,WAAW,KAAK,WAAW,CAAC,WAAW,CAAC,CAAC;QAEzD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,IAAI,WAAW,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC;QACzF,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/tools/.build/scr/core/types.d.ts

@@ -0,0 +1,27 @@
+/** Only a platform adapter or verified authentication middleware may supply these values. */
+export interface TrustedContext {
+    /** Actual protocol reported by the ingress transport, never a forwarded request header. */
+    httpProtocol?: string;
+    verifiedClientIp?: string;
+    identity?: string;
+    tenant: string;
+}
+export interface SecurityEvent {
+    id: string;
+    tenant: string;
+    at: number;
+    kind: "allow" | "block" | "detect" | "error";
+    source: "boundary" | "route" | "identity" | "rule" | "proxy";
+    policy: string;
+    ruleId?: string;
+    reason: string;
+}
+export declare class ShieldError extends Error {
+    readonly code: string;
+    readonly status: number;
+    constructor(code: string, status?: number);
+}
+export type Fetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+export declare function requireInteger(value: number, min: number, max: number, name: string): number;
+export declare function digest(value: string | Uint8Array): Promise<string>;
+export declare function stableJson(value: unknown): string;

package/tools/.build/scr/core/types.js

@@ -0,0 +1,34 @@
+export class ShieldError extends Error {
+    code;
+    status;
+    constructor(code, status = 400) {
+        super(code);
+        this.code = code;
+        this.status = status;
+        this.name = "ShieldError";
+    }
+}
+export function requireInteger(value, min, max, name) {
+    if (!Number.isSafeInteger(value) || value < min || value > max) {
+        throw new Error(`Invalid ${name}: expected integer ${min}..${max}`);
+    }
+    return value;
+}
+export async function digest(value) {
+    const data = typeof value === "string" ? new TextEncoder().encode(value) : value;
+    const hash = await crypto.subtle.digest("SHA-256", data);
+    return Array.from(new Uint8Array(hash), (b) => b.toString(16).padStart(2, "0")).join("");
+}
+export function stableJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(stableJson).join(",")}]`;
+    if (value !== null && typeof value === "object") {
+        const obj = value;
+        return `{${Object.keys(obj)
+            .sort()
+            .map((key) => `${JSON.stringify(key)}:${stableJson(obj[key])}`)
+            .join(",")}}`;
+    }
+    return JSON.stringify(value) ?? "null";
+}
+//# sourceMappingURL=types.js.map

package/tools/.build/scr/core/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../scr/core/types.ts"],"names":[],"mappings":"AAqBA,MAAM,OAAO,WAAY,SAAQ,KAAK;IAElB,IAAI;IACJ,MAAM;IAFxB,YACkB,IAAY,EACZ,MAAM,GAAG,GAAG;QAE5B,KAAK,CAAC,IAAI,CAAC,CAAC;oBAHI,IAAI;sBACJ,MAAM;QAGtB,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAID,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,GAAW,EAAE,GAAW,EAAE,IAAY;IAClF,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,GAAG,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,sBAAsB,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,KAA0B;IACrD,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACjF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAoB,CAAC,CAAC;IACzE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACxE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;aACxB,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;aAC9D,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;AACzC,CAAC"}