iobroker.time-tracker 0.2.0

package/build/lib/web/router.js

@@ -0,0 +1,274 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var router_exports = {};
+__export(router_exports, {
+  DEFAULT_MAX_BODY_BYTES: () => DEFAULT_MAX_BODY_BYTES,
+  binary: () => binary,
+  createRouter: () => createRouter,
+  isRawResponse: () => isRawResponse,
+  json: () => json,
+  noContent: () => noContent
+});
+module.exports = __toCommonJS(router_exports);
+var import_cookies = require("./cookies");
+var import_problem = require("./problem");
+var import_rate_limit = require("./rate-limit");
+const ROUTE_RESPONSE = Symbol("routeResponse");
+const RAW_RESPONSE = Symbol("rawResponse");
+function json(status, body, headers = {}) {
+  return Object.assign({ status, body, headers }, { [ROUTE_RESPONSE]: true });
+}
+function noContent(status = 204, headers = {}) {
+  return Object.assign({ status, body: void 0, headers }, { [ROUTE_RESPONSE]: true });
+}
+function binary(status, body, contentType, headers = {}) {
+  return Object.assign(
+    { status, body, headers: { "content-type": contentType, ...headers } },
+    { [ROUTE_RESPONSE]: true, [RAW_RESPONSE]: true }
+  );
+}
+function isRawResponse(value) {
+  return typeof value === "object" && value !== null && RAW_RESPONSE in value;
+}
+function isRouteResponse(value) {
+  return typeof value === "object" && value !== null && ROUTE_RESPONSE in value;
+}
+const BASE_HEADERS = {
+  "content-type": "application/json; charset=utf-8",
+  "cache-control": "no-store",
+  "x-content-type-options": "nosniff",
+  "referrer-policy": "no-referrer"
+};
+const PROBLEM_HEADERS = {
+  ...BASE_HEADERS,
+  "content-type": import_problem.PROBLEM_CONTENT_TYPE
+};
+const SAFE_METHODS = ["GET", "HEAD", "OPTIONS"];
+function splitPath(path) {
+  return path.split("/").filter((segment) => segment.length > 0);
+}
+function compileSegments(path) {
+  return splitPath(path).map(
+    (segment) => segment.startsWith(":") ? { literal: null, name: segment.slice(1) } : { literal: segment, name: "" }
+  );
+}
+function problemResponse(status, code, detail, instance, headers = {}) {
+  const details = new import_problem.HttpProblem(status, code, detail).toProblem(instance);
+  return {
+    status,
+    headers: { ...PROBLEM_HEADERS, ...headers },
+    body: JSON.stringify(details)
+  };
+}
+function forwardedAddress(headerValue) {
+  const raw = headerValue("x-forwarded-for");
+  if (!raw) {
+    return null;
+  }
+  const hops = raw.split(",").map((hop) => hop.trim()).filter((hop) => hop.length > 0);
+  return hops.length > 0 ? hops[hops.length - 1] : null;
+}
+function resolveClientAddress(request, headerValue, trustProxy) {
+  var _a;
+  const forwarded = trustProxy ? forwardedAddress(headerValue) : null;
+  return (_a = forwarded != null ? forwarded : request.remoteAddress) != null ? _a : null;
+}
+function forwardedProto(headerValue) {
+  var _a, _b;
+  return ((_b = ((_a = headerValue("x-forwarded-proto")) != null ? _a : "").split(",")[0]) != null ? _b : "").trim().toLowerCase();
+}
+const DEFAULT_MAX_BODY_BYTES = 2 * 1024 * 1024;
+function createRouter(options) {
+  var _a, _b;
+  const routes = [];
+  const maxBodyBytes = (_a = options.maxBodyBytes) != null ? _a : DEFAULT_MAX_BODY_BYTES;
+  const now = (_b = options.now) != null ? _b : (() => Math.floor(Date.now() / 1e3));
+  const limiter = (0, import_rate_limit.createRateLimiter)();
+  return {
+    add(route) {
+      routes.push({
+        definition: route,
+        methods: Array.isArray(route.method) ? route.method : [route.method],
+        segments: compileSegments(route.path)
+      });
+    },
+    routes() {
+      return routes.flatMap((route) => route.methods.map((method) => ({ method, path: route.definition.path })));
+    },
+    async handle(request) {
+      var _a2, _b2, _c, _d, _e, _f, _g, _h, _i, _j, _k;
+      const method = ((_a2 = request.method) != null ? _a2 : "GET").toUpperCase();
+      const path = (_b2 = request.path) != null ? _b2 : "/";
+      const pathSegments = splitPath(path);
+      const headers = (_c = request.headers) != null ? _c : {};
+      const headerValue = (name) => {
+        var _a3, _b3;
+        const value = (_a3 = headers[name]) != null ? _a3 : headers[name.toLowerCase()];
+        return Array.isArray(value) ? (_b3 = value[0]) != null ? _b3 : null : value != null ? value : null;
+      };
+      const clientAddress = resolveClientAddress(request, headerValue, options.trustProxy === true);
+      const secure = options.trustProxy === true && forwardedProto(headerValue) === "https";
+      const routedRequest = ((_d = request.remoteAddress) != null ? _d : null) === clientAddress ? request : { ...request, remoteAddress: clientAddress };
+      const matched = [];
+      for (const route2 of routes) {
+        if (route2.segments.length !== pathSegments.length) {
+          continue;
+        }
+        const params2 = {};
+        let matches = true;
+        for (let index = 0; index < route2.segments.length; index++) {
+          const segment = route2.segments[index];
+          if (segment.literal === null) {
+            params2[segment.name] = decodeURIComponent(pathSegments[index]);
+            continue;
+          }
+          if (segment.literal !== pathSegments[index]) {
+            matches = false;
+            break;
+          }
+        }
+        if (matches) {
+          matched.push({ route: route2, params: params2 });
+        }
+      }
+      if (matched.length === 0) {
+        return problemResponse(404, "not_found", `no route for ${method} ${path}`, path);
+      }
+      const candidate = matched.find((entry) => entry.route.methods.includes(method));
+      if (!candidate) {
+        const allowed = [...new Set(matched.flatMap((entry) => entry.route.methods))].sort();
+        return problemResponse(405, "method_not_allowed", `allowed: ${allowed.join(", ")}`, path, {
+          allow: allowed.join(", ")
+        });
+      }
+      const { route, params } = candidate;
+      const body = (_e = request.body) != null ? _e : "";
+      const bodyLimit = (_f = route.definition.maxBodyBytes) != null ? _f : maxBodyBytes;
+      const bodySize = typeof body === "string" ? Buffer.byteLength(body) : body.length;
+      if (bodySize > bodyLimit) {
+        return problemResponse(413, "payload_too_large", `body exceeds ${bodyLimit} bytes`, path);
+      }
+      const bearerToken = (_g = headerValue("x-session-token")) != null ? _g : "";
+      const cookieToken = (_h = (0, import_cookies.parseCookies)(headerValue("cookie"))[import_cookies.SESSION_COOKIE]) != null ? _h : "";
+      const token = bearerToken || cookieToken;
+      const viaCookie = bearerToken === "" && cookieToken !== "";
+      const requiresCsrf = (_i = route.definition.requiresCsrf) != null ? _i : !SAFE_METHODS.includes(method) && cookieToken !== "";
+      if (route.definition.rateLimit) {
+        const limited = limiter.check(route.definition.rateLimit, clientAddress != null ? clientAddress : "unknown", now());
+        if (!limited.allowed) {
+          return problemResponse(429, "rate_limited", "too many requests, try again later", path, {
+            "retry-after": String(limited.retryAfterSeconds),
+            "x-ratelimit-remaining": "0"
+          });
+        }
+      }
+      let auth = null;
+      let rotated = null;
+      if (route.definition.requiresAuth !== false) {
+        const result = options.auth.authenticate({
+          token,
+          permission: route.definition.permission,
+          now: now()
+        });
+        if (!result.ok) {
+          const status = result.error === "permission_denied" ? 403 : 401;
+          return problemResponse(status, result.error, `request rejected (${result.error})`, path);
+        }
+        auth = result.context;
+        if (requiresCsrf && !options.auth.verifyCsrf({ token, csrfToken: (_j = headerValue("x-csrf-token")) != null ? _j : "" })) {
+          return problemResponse(403, "csrf_rejected", "missing or wrong CSRF token", path);
+        }
+        rotated = cookieToken !== "" ? options.auth.rotateIfDue({ token, now: now() }) : null;
+      }
+      function parseRequestBody(required) {
+        var _a3;
+        const contentType = (_a3 = headerValue("content-type")) != null ? _a3 : "";
+        if (contentType && !contentType.toLowerCase().includes("application/json")) {
+          throw new import_problem.HttpProblem(415, "unsupported_media_type", `unsupported content type ${contentType}`);
+        }
+        const text = Buffer.isBuffer(body) ? body.toString("utf8") : body;
+        if (!text.trim()) {
+          if (required) {
+            throw new import_problem.HttpProblem(400, "bad_request", "body is required");
+          }
+          return {};
+        }
+        try {
+          return JSON.parse(text);
+        } catch {
+          throw new import_problem.HttpProblem(400, "bad_request", "body is not valid JSON");
+        }
+      }
+      const context = {
+        request: routedRequest,
+        params,
+        auth,
+        sessionToken: token,
+        viaCookie,
+        secure,
+        query: (name) => {
+          var _a3, _b3;
+          const value = (_a3 = request.query) == null ? void 0 : _a3[name];
+          return Array.isArray(value) ? (_b3 = value[0]) != null ? _b3 : null : value != null ? value : null;
+        },
+        header: headerValue,
+        jsonBody: () => parseRequestBody(true),
+        optionalJsonBody: () => parseRequestBody(false),
+        rawBody: () => {
+          var _a3;
+          return Buffer.isBuffer(request.body) ? request.body : Buffer.from((_a3 = request.body) != null ? _a3 : "", "utf8");
+        }
+      };
+      try {
+        const result = await route.definition.handler(context);
+        if (!isRouteResponse(result)) {
+          throw new Error("handler did not return a response object");
+        }
+        const responseHeaders = { ...BASE_HEADERS, ...(_k = result.headers) != null ? _k : {} };
+        if (rotated && !responseHeaders["set-cookie"]) {
+          responseHeaders["set-cookie"] = (0, import_cookies.serializeCookie)(import_cookies.SESSION_COOKIE, rotated.token, {
+            maxAgeSeconds: Math.max(0, rotated.expiresAt - now()),
+            secure
+          });
+        }
+        if (result.body === void 0) {
+          delete responseHeaders["content-type"];
+          return { status: result.status, headers: responseHeaders, body: "" };
+        }
+        if (isRawResponse(result)) {
+          return { status: result.status, headers: responseHeaders, body: result.body };
+        }
+        return { status: result.status, headers: responseHeaders, body: JSON.stringify(result.body) };
+      } catch (error) {
+        const { problem: details } = (0, import_problem.toProblem)(error, path);
+        return { status: details.status, headers: { ...PROBLEM_HEADERS }, body: JSON.stringify(details) };
+      }
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DEFAULT_MAX_BODY_BYTES,
+  binary,
+  createRouter,
+  isRawResponse,
+  json,
+  noContent
+});
+//# sourceMappingURL=router.js.map

package/build/lib/web/router.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/lib/web/router.ts"],
+  "sourcesContent": ["/**\n * Server agnostic HTTP router.\n *\n * The router only sees plain request/response objects, so the same routes can later be mounted on an own HTTP\n * server (`native.port`) or be handed to the web extension of a `web` instance. Everything security relevant\n * happens here and not in the single handlers: session check, permission check (RBAC), CSRF token for state\n * changing requests and a body size limit.\n *\n * Handlers return `json(status, body)` or `noContent()`; any thrown error is converted by `toProblem`.\n */\n\nimport type { AuthContext, AuthService } from \"../services/auth\";\nimport { parseCookies, SESSION_COOKIE, serializeCookie } from \"./cookies\";\nimport { HttpProblem, PROBLEM_CONTENT_TYPE, toProblem, type ProblemCode, type ProblemDetails } from \"./problem\";\nimport { createRateLimiter } from \"./rate-limit\";\n\n/** Supported HTTP methods. */\nexport type HttpMethod = \"GET\" | \"POST\" | \"PUT\" | \"PATCH\" | \"DELETE\";\n\n/** A request as the router sees it (the body is already read and size limited). */\nexport interface HttpRequest {\n\t/** HTTP method, upper case */\n\tmethod: string;\n\t/** Path without query string, e.g. `/reports/day` */\n\tpath: string;\n\t/** Query parameters, repeated names become arrays */\n\tquery?: Record<string, string | string[] | undefined>;\n\t/** Request headers, names lower case */\n\theaders?: Record<string, string | string[] | undefined>;\n\t/** Raw body: JSON text for the JSON endpoints, bytes for an upload */\n\tbody?: string | Buffer;\n\t/** Client address */\n\tremoteAddress?: string | null;\n}\n\n/** A response as the router produces it. */\nexport interface HttpResponse {\n\t/** HTTP status code */\n\tstatus: number;\n\t/** Response headers (lower case names) */\n\theaders: Record<string, string>;\n\t/** Response body, already serialised (a Buffer for binary content) */\n\tbody: string | Buffer;\n}\n\n/** Result of a handler. */\nexport interface RouteResponse {\n\t/** HTTP status code */\n\tstatus: number;\n\t/** Body, serialised as JSON when it is not `undefined` */\n\tbody?: unknown;\n\t/** Additional headers */\n\theaders?: Record<string, string>;\n}\n\n/** What a handler receives. */\nexport interface RouteContext {\n\t/** The incoming request */\n\trequest: HttpRequest;\n\t/** Path parameters of the route */\n\tparams: Record<string, string>;\n\t/** Authenticated context, `null` for public routes */\n\tauth: AuthContext | null;\n\t/** Session token of the request: the bearer header or, for browsers, the session cookie */\n\tsessionToken: string;\n\t/** True when no bearer header was sent and the session came from the cookie */\n\tviaCookie: boolean;\n\t/** True when the client talks HTTPS (a trusted proxy reported `x-forwarded-proto: https`) */\n\tsecure: boolean;\n\t/** Reads a query parameter */\n\tquery(name: string): string | null;\n\t/** Reads a request header */\n\theader(name: string): string | null;\n\t/** Parses the JSON body, throws `400 bad_request` when it is not usable */\n\tjsonBody<T = Record<string, unknown>>(): T;\n\t/** Parses the JSON body; an empty body becomes an empty object (optional fields) */\n\toptionalJsonBody<T = Record<string, unknown>>(): T;\n\t/** The body as bytes \u2014 binary uploads arrive here, the JSON helpers are for everything else */\n\trawBody(): Buffer;\n}\n\n/** A single route. */\nexport interface RouteDefinition {\n\t/** Method (or methods) the route answers */\n\tmethod: HttpMethod | HttpMethod[];\n\t/** Path pattern, `:name` marks a parameter, e.g. `/reports/day/:date` */\n\tpath: string;\n\t/** Session required (default true) */\n\trequiresAuth?: boolean;\n\t/** Permission the caller has to hold */\n\tpermission?: string;\n\t/** CSRF token required (default true for state changing methods) */\n\trequiresCsrf?: boolean;\n\t/** Rate limit of the route class (counted per client address) */\n\trateLimit?: { name: string; limit: number; windowSeconds: number };\n\t/**\n\t * Body limit of this route in bytes; the router-wide limit applies when it is missing.\n\t *\n\t * A backup upload is bigger than any other request the API accepts, so that one route raises the limit while\n\t * everything else stays where it was.\n\t */\n\tmaxBodyBytes?: number;\n\t/** Handler of the route */\n\thandler: (context: RouteContext) => RouteResponse | Promise<RouteResponse>;\n}\n\n/** Options of the router. */\nexport interface RouterOptions {\n\t/** Authentication service used for the session check */\n\tauth: AuthService;\n\t/** Maximum body size in bytes (default 2 MiB) */\n\tmaxBodyBytes?: number;\n\t/** Instant source, defaults to the system clock */\n\tnow?: () => number;\n\t/**\n\t * Trusts the `x-forwarded-*` headers of a reverse proxy. Only switch this on when a proxy is really in\n\t * front: the declared client address lands in the audit trail and decides the rate limit buckets, so a\n\t * client that is allowed to set the header itself could shift both.\n\t */\n\ttrustProxy?: boolean;\n}\n\n/** The router. */\nexport interface Router {\n\t/** Registers a route */\n\tadd(route: RouteDefinition): void;\n\t/** Handles a request; never throws */\n\thandle(request: HttpRequest): Promise<HttpResponse>;\n\t/** Registered routes (method and path), e.g. for the API documentation */\n\troutes(): { method: string; path: string }[];\n}\n\n/** Marker to tell a handler result from a plain JSON payload. */\nconst ROUTE_RESPONSE = Symbol(\"routeResponse\");\n\n/** Marker for responses whose body is passed to the transport unchanged. */\nconst RAW_RESPONSE = Symbol(\"rawResponse\");\n\n/** A response whose body is written to the transport as it is (see `binary`). */\nexport interface RawRouteResponse extends RouteResponse {\n\t/** Bytes or text */\n\tbody: string | Buffer;\n}\n\n/**\n * Creates a response object for a handler.\n *\n * @param status - HTTP status code\n * @param body - body to serialise as JSON\n * @param headers - additional response headers\n * @returns route response\n */\nexport function json(status: number, body: unknown, headers: Record<string, string> = {}): RouteResponse {\n\treturn Object.assign({ status, body, headers }, { [ROUTE_RESPONSE]: true });\n}\n\n/**\n * Creates an empty response.\n *\n * @param status - HTTP status code (default 204)\n * @param headers - additional response headers (e.g. a `set-cookie` that ends a session)\n * @returns route response without a body\n */\nexport function noContent(status = 204, headers: Record<string, string> = {}): RouteResponse {\n\treturn Object.assign({ status, body: undefined, headers }, { [ROUTE_RESPONSE]: true });\n}\n\n/**\n * Creates a response with a body that is not JSON.\n *\n * Used for downloads and other binary payloads (reports, backups). The body is handed to the transport\n * unchanged, so a `Buffer` keeps its bytes and a string is written as UTF-8 text.\n *\n * @param status - HTTP status code\n * @param body - bytes or text\n * @param contentType - media type of the body\n * @param headers - additional response headers (e.g. `content-disposition`)\n * @returns route response\n */\nexport function binary(\n\tstatus: number,\n\tbody: string | Buffer,\n\tcontentType: string,\n\theaders: Record<string, string> = {},\n): RouteResponse {\n\treturn Object.assign(\n\t\t{ status, body, headers: { \"content-type\": contentType, ...headers } },\n\t\t{ [ROUTE_RESPONSE]: true, [RAW_RESPONSE]: true },\n\t);\n}\n\n/**\n * Checks whether a response body is handed to the transport unchanged.\n *\n * @param value - handler result\n * @returns true for responses created by `binary`\n */\nexport function isRawResponse(value: unknown): value is RawRouteResponse {\n\treturn typeof value === \"object\" && value !== null && RAW_RESPONSE in value;\n}\n\n/**\n * Checks whether a handler result is a route response.\n *\n * @param value - handler result\n * @returns true when the value was created by `json` or `noContent`\n */\nfunction isRouteResponse(value: unknown): value is RouteResponse {\n\treturn typeof value === \"object\" && value !== null && ROUTE_RESPONSE in value;\n}\n\n/** Headers every API response carries. */\nconst BASE_HEADERS: Record<string, string> = {\n\t\"content-type\": \"application/json; charset=utf-8\",\n\t\"cache-control\": \"no-store\",\n\t\"x-content-type-options\": \"nosniff\",\n\t\"referrer-policy\": \"no-referrer\",\n};\n\n/** Headers of a problem document: the same security headers with the RFC 9457 content type. */\nconst PROBLEM_HEADERS: Record<string, string> = {\n\t...BASE_HEADERS,\n\t\"content-type\": PROBLEM_CONTENT_TYPE,\n};\n\n/** State changing methods need a CSRF token by default. */\nconst SAFE_METHODS: string[] = [\"GET\", \"HEAD\", \"OPTIONS\"];\n\ninterface CompiledRoute {\n\tdefinition: RouteDefinition;\n\tmethods: HttpMethod[];\n\t/** Path segments, `literal: null` marks a parameter */\n\tsegments: { literal: string | null; name: string }[];\n}\n\n/**\n * Splits a path into segments without leading/trailing slashes.\n *\n * @param path - path to split\n * @returns segments\n */\nfunction splitPath(path: string): string[] {\n\treturn path.split(\"/\").filter(segment => segment.length > 0);\n}\n\n/**\n * Compiles the path pattern of a route.\n *\n * @param path - pattern like `/reports/day/:date`\n * @returns segments with their parameter names\n */\nfunction compileSegments(path: string): { literal: string | null; name: string }[] {\n\treturn splitPath(path).map(segment =>\n\t\tsegment.startsWith(\":\") ? { literal: null, name: segment.slice(1) } : { literal: segment, name: \"\" },\n\t);\n}\n\n/**\n * Creates a problem response.\n *\n * @param status - HTTP status code\n * @param code - stable error code\n * @param detail - optional explanation\n * @param instance - request path\n * @param headers - additional headers\n * @returns HTTP response\n */\nfunction problemResponse(\n\tstatus: number,\n\tcode: ProblemCode,\n\tdetail: string | undefined,\n\tinstance: string,\n\theaders: Record<string, string> = {},\n): HttpResponse {\n\tconst details: ProblemDetails = new HttpProblem(status, code, detail).toProblem(instance);\n\treturn {\n\t\tstatus,\n\t\theaders: { ...PROBLEM_HEADERS, ...headers },\n\t\tbody: JSON.stringify(details),\n\t};\n}\n\n/** Reads a request header (lower case names). */\ntype HeaderReader = (name: string) => string | null;\n\n/**\n * Reads the last hop of `x-forwarded-for`.\n *\n * Every client may send the header itself; the proxy *appends* the address it saw, so the rightmost entry is\n * the one the trusted proxy wrote. Taking the first one instead would let a caller pick its own address \u2014 and\n * with it the rate limit bucket and the audit entry.\n *\n * @param headerValue - header reader\n * @returns the forwarded client address or `null` when the header is missing or empty\n */\nfunction forwardedAddress(headerValue: HeaderReader): string | null {\n\tconst raw = headerValue(\"x-forwarded-for\");\n\tif (!raw) {\n\t\treturn null;\n\t}\n\tconst hops = raw\n\t\t.split(\",\")\n\t\t.map(hop => hop.trim())\n\t\t.filter(hop => hop.length > 0);\n\treturn hops.length > 0 ? hops[hops.length - 1] : null;\n}\n\n/**\n * Resolves the client address used for rate limits and the audit trail.\n *\n * @param request - incoming request\n * @param headerValue - header reader\n * @param trustProxy - true when the operator declared a reverse proxy in front\n * @returns the client address\n */\nfunction resolveClientAddress(request: HttpRequest, headerValue: HeaderReader, trustProxy: boolean): string | null {\n\tconst forwarded = trustProxy ? forwardedAddress(headerValue) : null;\n\treturn forwarded ?? request.remoteAddress ?? null;\n}\n\n/**\n * Reads the protocol a trusted proxy reported.\n *\n * @param headerValue - header reader\n * @returns `https` when the request reached the proxy over TLS, otherwise the raw value\n */\nfunction forwardedProto(headerValue: HeaderReader): string {\n\treturn ((headerValue(\"x-forwarded-proto\") ?? \"\").split(\",\")[0] ?? \"\").trim().toLowerCase();\n}\n\n/**\n * Default limit of a request body.\n *\n * It has to be roomier than the biggest value a client may store: a branding picture is a data URL of up to\n * `MAX_BRANDING_BYTES` (512 KiB), and base64 makes it about a third bigger. Everything else the API accepts\n * (a punch, a patch, a report request) is a few kilobytes.\n */\nexport const DEFAULT_MAX_BODY_BYTES = 2 * 1024 * 1024;\n\n/**\n * Creates the router.\n *\n * @param options - authentication service and limits\n * @returns router instance\n */\nexport function createRouter(options: RouterOptions): Router {\n\tconst routes: CompiledRoute[] = [];\n\tconst maxBodyBytes = options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;\n\tconst now = options.now ?? (() => Math.floor(Date.now() / 1000));\n\t// the counters live in the router, so the limits belong to the API instance that registered them\n\tconst limiter = createRateLimiter();\n\n\treturn {\n\t\tadd(route: RouteDefinition): void {\n\t\t\troutes.push({\n\t\t\t\tdefinition: route,\n\t\t\t\tmethods: Array.isArray(route.method) ? route.method : [route.method],\n\t\t\t\tsegments: compileSegments(route.path),\n\t\t\t});\n\t\t},\n\n\t\troutes(): { method: string; path: string }[] {\n\t\t\treturn routes.flatMap(route => route.methods.map(method => ({ method, path: route.definition.path })));\n\t\t},\n\n\t\tasync handle(request: HttpRequest): Promise<HttpResponse> {\n\t\t\tconst method = (request.method ?? \"GET\").toUpperCase();\n\t\t\tconst path = request.path ?? \"/\";\n\t\t\tconst pathSegments = splitPath(path);\n\t\t\tconst headers = request.headers ?? {};\n\t\t\tconst headerValue = (name: string): string | null => {\n\t\t\t\tconst value = headers[name] ?? headers[name.toLowerCase()];\n\t\t\t\treturn Array.isArray(value) ? (value[0] ?? null) : (value ?? null);\n\t\t\t};\n\n\t\t\t// Behind a reverse proxy the socket address is the proxy itself, so the address the proxy appended to\n\t\t\t// `x-forwarded-for` is used \u2014 but only when the operator declared the proxy as trusted (`trustProxy`),\n\t\t\t// because any client can send that header on its own. One hop is assumed, which is what a single\n\t\t\t// nginx/caddy in front produces.\n\t\t\tconst clientAddress = resolveClientAddress(request, headerValue, options.trustProxy === true);\n\t\t\tconst secure = options.trustProxy === true && forwardedProto(headerValue) === \"https\";\n\t\t\t// the handlers see the address the rate limit counted and the audit trail stores\n\t\t\tconst routedRequest: HttpRequest =\n\t\t\t\t(request.remoteAddress ?? null) === clientAddress\n\t\t\t\t\t? request\n\t\t\t\t\t: { ...request, remoteAddress: clientAddress };\n\n\t\t\tconst matched: { route: CompiledRoute; params: Record<string, string> }[] = [];\n\t\t\tfor (const route of routes) {\n\t\t\t\tif (route.segments.length !== pathSegments.length) {\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tconst params: Record<string, string> = {};\n\t\t\t\tlet matches = true;\n\t\t\t\tfor (let index = 0; index < route.segments.length; index++) {\n\t\t\t\t\tconst segment = route.segments[index];\n\t\t\t\t\tif (segment.literal === null) {\n\t\t\t\t\t\tparams[segment.name] = decodeURIComponent(pathSegments[index]);\n\t\t\t\t\t\tcontinue;\n\t\t\t\t\t}\n\t\t\t\t\tif (segment.literal !== pathSegments[index]) {\n\t\t\t\t\t\tmatches = false;\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tif (matches) {\n\t\t\t\t\tmatched.push({ route, params });\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (matched.length === 0) {\n\t\t\t\treturn problemResponse(404, \"not_found\", `no route for ${method} ${path}`, path);\n\t\t\t}\n\n\t\t\tconst candidate = matched.find(entry => entry.route.methods.includes(method as HttpMethod));\n\t\t\tif (!candidate) {\n\t\t\t\tconst allowed = [...new Set(matched.flatMap(entry => entry.route.methods))].sort();\n\t\t\t\treturn problemResponse(405, \"method_not_allowed\", `allowed: ${allowed.join(\", \")}`, path, {\n\t\t\t\t\tallow: allowed.join(\", \"),\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tconst { route, params } = candidate;\n\t\t\tconst body = request.body ?? \"\";\n\t\t\t// a route may raise the limit for itself (a backup upload is bigger than any other body)\n\t\t\tconst bodyLimit = route.definition.maxBodyBytes ?? maxBodyBytes;\n\t\t\tconst bodySize = typeof body === \"string\" ? Buffer.byteLength(body) : body.length;\n\t\t\tif (bodySize > bodyLimit) {\n\t\t\t\treturn problemResponse(413, \"payload_too_large\", `body exceeds ${bodyLimit} bytes`, path);\n\t\t\t}\n\n\t\t\t// The session travels in the `x-session-token` header (integration clients) or in the httpOnly\n\t\t\t// session cookie (browsers, specification 4.x). CSRF is only possible where the browser attaches a\n\t\t\t// credential by itself, so a state changing request needs the CSRF token as soon as the cookie is\n\t\t\t// present \u2014 while a pure bearer client, which no foreign page can equip with a header, needs none.\n\t\t\tconst bearerToken = headerValue(\"x-session-token\") ?? \"\";\n\t\t\tconst cookieToken = parseCookies(headerValue(\"cookie\"))[SESSION_COOKIE] ?? \"\";\n\t\t\tconst token = bearerToken || cookieToken;\n\t\t\tconst viaCookie = bearerToken === \"\" && cookieToken !== \"\";\n\t\t\tconst requiresCsrf =\n\t\t\t\troute.definition.requiresCsrf ?? (!SAFE_METHODS.includes(method) && cookieToken !== \"\");\n\n\t\t\t// the limit is counted per client address, before any work is done\n\t\t\tif (route.definition.rateLimit) {\n\t\t\t\tconst limited = limiter.check(route.definition.rateLimit, clientAddress ?? \"unknown\", now());\n\t\t\t\tif (!limited.allowed) {\n\t\t\t\t\treturn problemResponse(429, \"rate_limited\", \"too many requests, try again later\", path, {\n\t\t\t\t\t\t\"retry-after\": String(limited.retryAfterSeconds),\n\t\t\t\t\t\t\"x-ratelimit-remaining\": \"0\",\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tlet auth: AuthContext | null = null;\n\t\t\tlet rotated: { token: string; expiresAt: number } | null = null;\n\n\t\t\tif (route.definition.requiresAuth !== false) {\n\t\t\t\tconst result = options.auth.authenticate({\n\t\t\t\t\ttoken,\n\t\t\t\t\tpermission: route.definition.permission,\n\t\t\t\t\tnow: now(),\n\t\t\t\t});\n\t\t\t\tif (!result.ok) {\n\t\t\t\t\tconst status = result.error === \"permission_denied\" ? 403 : 401;\n\t\t\t\t\treturn problemResponse(status, result.error, `request rejected (${result.error})`, path);\n\t\t\t\t}\n\t\t\t\tauth = result.context;\n\n\t\t\t\tif (requiresCsrf && !options.auth.verifyCsrf({ token, csrfToken: headerValue(\"x-csrf-token\") ?? \"\" })) {\n\t\t\t\t\treturn problemResponse(403, \"csrf_rejected\", \"missing or wrong CSRF token\", path);\n\t\t\t\t}\n\n\t\t\t\t// A browser session that has been in use for a while gets a fresh token: the cookie is replaced\n\t\t\t\t// below and the old token dies with its row (specification 4.10: rotation). Bearer clients keep\n\t\t\t\t// their token \u2014 they hold no cookie that could be renewed without asking them.\n\t\t\t\trotated = cookieToken !== \"\" ? options.auth.rotateIfDue({ token, now: now() }) : null;\n\t\t\t}\n\n\t\t\t/**\n\t\t\t * Parses the request body.\n\t\t\t *\n\t\t\t * @param required - true when an empty body is a client error\n\t\t\t * @returns the parsed body\n\t\t\t */\n\t\t\tfunction parseRequestBody<T>(required: boolean): T {\n\t\t\t\tconst contentType = headerValue(\"content-type\") ?? \"\";\n\t\t\t\tif (contentType && !contentType.toLowerCase().includes(\"application/json\")) {\n\t\t\t\t\tthrow new HttpProblem(415, \"unsupported_media_type\", `unsupported content type ${contentType}`);\n\t\t\t\t}\n\t\t\t\t// a body that arrived as bytes (an upload) cannot be JSON; the text endpoints send text\n\t\t\t\tconst text = Buffer.isBuffer(body) ? body.toString(\"utf8\") : body;\n\t\t\t\tif (!text.trim()) {\n\t\t\t\t\tif (required) {\n\t\t\t\t\t\tthrow new HttpProblem(400, \"bad_request\", \"body is required\");\n\t\t\t\t\t}\n\t\t\t\t\t// DELETE requests often carry no body at all; the optional fields stay empty then\n\t\t\t\t\treturn {} as T;\n\t\t\t\t}\n\t\t\t\ttry {\n\t\t\t\t\treturn JSON.parse(text) as T;\n\t\t\t\t} catch {\n\t\t\t\t\tthrow new HttpProblem(400, \"bad_request\", \"body is not valid JSON\");\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst context: RouteContext = {\n\t\t\t\trequest: routedRequest,\n\t\t\t\tparams,\n\t\t\t\tauth,\n\t\t\t\tsessionToken: token,\n\t\t\t\tviaCookie,\n\t\t\t\tsecure,\n\t\t\t\tquery: name => {\n\t\t\t\t\tconst value = request.query?.[name];\n\t\t\t\t\treturn Array.isArray(value) ? (value[0] ?? null) : (value ?? null);\n\t\t\t\t},\n\t\t\t\theader: headerValue,\n\t\t\t\tjsonBody: <T = Record<string, unknown>>(): T => parseRequestBody<T>(true),\n\t\t\t\toptionalJsonBody: <T = Record<string, unknown>>(): T => parseRequestBody<T>(false),\n\t\t\t\trawBody: (): Buffer =>\n\t\t\t\t\tBuffer.isBuffer(request.body) ? request.body : Buffer.from(request.body ?? \"\", \"utf8\"),\n\t\t\t};\n\n\t\t\ttry {\n\t\t\t\tconst result = await route.definition.handler(context);\n\t\t\t\tif (!isRouteResponse(result)) {\n\t\t\t\t\tthrow new Error(\"handler did not return a response object\");\n\t\t\t\t}\n\n\t\t\t\tconst responseHeaders = { ...BASE_HEADERS, ...(result.headers ?? {}) };\n\t\t\t\tif (rotated && !responseHeaders[\"set-cookie\"]) {\n\t\t\t\t\t// the renewed session cookie of a browser; routes that set their own (login, logout) win\n\t\t\t\t\tresponseHeaders[\"set-cookie\"] = serializeCookie(SESSION_COOKIE, rotated.token, {\n\t\t\t\t\t\tmaxAgeSeconds: Math.max(0, rotated.expiresAt - now()),\n\t\t\t\t\t\tsecure,\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t\tif (result.body === undefined) {\n\t\t\t\t\tdelete responseHeaders[\"content-type\"];\n\t\t\t\t\treturn { status: result.status, headers: responseHeaders, body: \"\" };\n\t\t\t\t}\n\t\t\t\tif (isRawResponse(result)) {\n\t\t\t\t\t// downloads keep their bytes: a buffer is written as is, a string as UTF-8 text\n\t\t\t\t\treturn { status: result.status, headers: responseHeaders, body: result.body };\n\t\t\t\t}\n\t\t\t\treturn { status: result.status, headers: responseHeaders, body: JSON.stringify(result.body) };\n\t\t\t} catch (error) {\n\t\t\t\tconst { problem: details } = toProblem(error, path);\n\t\t\t\treturn { status: details.status, headers: { ...PROBLEM_HEADERS }, body: JSON.stringify(details) };\n\t\t\t}\n\t\t},\n\t};\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAYA,qBAA8D;AAC9D,qBAAoG;AACpG,wBAAkC;AAuHlC,MAAM,iBAAiB,OAAO,eAAe;AAG7C,MAAM,eAAe,OAAO,aAAa;AAgBlC,SAAS,KAAK,QAAgB,MAAe,UAAkC,CAAC,GAAkB;AACxG,SAAO,OAAO,OAAO,EAAE,QAAQ,MAAM,QAAQ,GAAG,EAAE,CAAC,cAAc,GAAG,KAAK,CAAC;AAC3E;AASO,SAAS,UAAU,SAAS,KAAK,UAAkC,CAAC,GAAkB;AAC5F,SAAO,OAAO,OAAO,EAAE,QAAQ,MAAM,QAAW,QAAQ,GAAG,EAAE,CAAC,cAAc,GAAG,KAAK,CAAC;AACtF;AAcO,SAAS,OACf,QACA,MACA,aACA,UAAkC,CAAC,GACnB;AAChB,SAAO,OAAO;AAAA,IACb,EAAE,QAAQ,MAAM,SAAS,EAAE,gBAAgB,aAAa,GAAG,QAAQ,EAAE;AAAA,IACrE,EAAE,CAAC,cAAc,GAAG,MAAM,CAAC,YAAY,GAAG,KAAK;AAAA,EAChD;AACD;AAQO,SAAS,cAAc,OAA2C;AACxE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,gBAAgB;AACvE;AAQA,SAAS,gBAAgB,OAAwC;AAChE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,kBAAkB;AACzE;AAGA,MAAM,eAAuC;AAAA,EAC5C,gBAAgB;AAAA,EAChB,iBAAiB;AAAA,EACjB,0BAA0B;AAAA,EAC1B,mBAAmB;AACpB;AAGA,MAAM,kBAA0C;AAAA,EAC/C,GAAG;AAAA,EACH,gBAAgB;AACjB;AAGA,MAAM,eAAyB,CAAC,OAAO,QAAQ,SAAS;AAexD,SAAS,UAAU,MAAwB;AAC1C,SAAO,KAAK,MAAM,GAAG,EAAE,OAAO,aAAW,QAAQ,SAAS,CAAC;AAC5D;AAQA,SAAS,gBAAgB,MAA0D;AAClF,SAAO,UAAU,IAAI,EAAE;AAAA,IAAI,aAC1B,QAAQ,WAAW,GAAG,IAAI,EAAE,SAAS,MAAM,MAAM,QAAQ,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,SAAS,MAAM,GAAG;AAAA,EACpG;AACD;AAYA,SAAS,gBACR,QACA,MACA,QACA,UACA,UAAkC,CAAC,GACpB;AACf,QAAM,UAA0B,IAAI,2BAAY,QAAQ,MAAM,MAAM,EAAE,UAAU,QAAQ;AACxF,SAAO;AAAA,IACN;AAAA,IACA,SAAS,EAAE,GAAG,iBAAiB,GAAG,QAAQ;AAAA,IAC1C,MAAM,KAAK,UAAU,OAAO;AAAA,EAC7B;AACD;AAeA,SAAS,iBAAiB,aAA0C;AACnE,QAAM,MAAM,YAAY,iBAAiB;AACzC,MAAI,CAAC,KAAK;AACT,WAAO;AAAA,EACR;AACA,QAAM,OAAO,IACX,MAAM,GAAG,EACT,IAAI,SAAO,IAAI,KAAK,CAAC,EACrB,OAAO,SAAO,IAAI,SAAS,CAAC;AAC9B,SAAO,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,CAAC,IAAI;AAClD;AAUA,SAAS,qBAAqB,SAAsB,aAA2B,YAAoC;AA3TnH;AA4TC,QAAM,YAAY,aAAa,iBAAiB,WAAW,IAAI;AAC/D,UAAO,qCAAa,QAAQ,kBAArB,YAAsC;AAC9C;AAQA,SAAS,eAAe,aAAmC;AAtU3D;AAuUC,WAAS,wBAAY,mBAAmB,MAA/B,YAAoC,IAAI,MAAM,GAAG,EAAE,CAAC,MAApD,YAAyD,IAAI,KAAK,EAAE,YAAY;AAC1F;AASO,MAAM,yBAAyB,IAAI,OAAO;AAQ1C,SAAS,aAAa,SAAgC;AAzV7D;AA0VC,QAAM,SAA0B,CAAC;AACjC,QAAM,gBAAe,aAAQ,iBAAR,YAAwB;AAC7C,QAAM,OAAM,aAAQ,QAAR,aAAgB,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAE9D,QAAM,cAAU,qCAAkB;AAElC,SAAO;AAAA,IACN,IAAI,OAA8B;AACjC,aAAO,KAAK;AAAA,QACX,YAAY;AAAA,QACZ,SAAS,MAAM,QAAQ,MAAM,MAAM,IAAI,MAAM,SAAS,CAAC,MAAM,MAAM;AAAA,QACnE,UAAU,gBAAgB,MAAM,IAAI;AAAA,MACrC,CAAC;AAAA,IACF;AAAA,IAEA,SAA6C;AAC5C,aAAO,OAAO,QAAQ,WAAS,MAAM,QAAQ,IAAI,aAAW,EAAE,QAAQ,MAAM,MAAM,WAAW,KAAK,EAAE,CAAC;AAAA,IACtG;AAAA,IAEA,MAAM,OAAO,SAA6C;AA7W5D,UAAAA,KAAAC,KAAA;AA8WG,YAAM,WAAUD,MAAA,QAAQ,WAAR,OAAAA,MAAkB,OAAO,YAAY;AACrD,YAAM,QAAOC,MAAA,QAAQ,SAAR,OAAAA,MAAgB;AAC7B,YAAM,eAAe,UAAU,IAAI;AACnC,YAAM,WAAU,aAAQ,YAAR,YAAmB,CAAC;AACpC,YAAM,cAAc,CAAC,SAAgC;AAlXxD,YAAAD,KAAAC;AAmXI,cAAM,SAAQD,MAAA,QAAQ,IAAI,MAAZ,OAAAA,MAAiB,QAAQ,KAAK,YAAY,CAAC;AACzD,eAAO,MAAM,QAAQ,KAAK,KAAKC,MAAA,MAAM,CAAC,MAAP,OAAAA,MAAY,OAAS,wBAAS;AAAA,MAC9D;AAMA,YAAM,gBAAgB,qBAAqB,SAAS,aAAa,QAAQ,eAAe,IAAI;AAC5F,YAAM,SAAS,QAAQ,eAAe,QAAQ,eAAe,WAAW,MAAM;AAE9E,YAAM,kBACJ,aAAQ,kBAAR,YAAyB,UAAU,gBACjC,UACA,EAAE,GAAG,SAAS,eAAe,cAAc;AAE/C,YAAM,UAAsE,CAAC;AAC7E,iBAAWC,UAAS,QAAQ;AAC3B,YAAIA,OAAM,SAAS,WAAW,aAAa,QAAQ;AAClD;AAAA,QACD;AACA,cAAMC,UAAiC,CAAC;AACxC,YAAI,UAAU;AACd,iBAAS,QAAQ,GAAG,QAAQD,OAAM,SAAS,QAAQ,SAAS;AAC3D,gBAAM,UAAUA,OAAM,SAAS,KAAK;AACpC,cAAI,QAAQ,YAAY,MAAM;AAC7B,YAAAC,QAAO,QAAQ,IAAI,IAAI,mBAAmB,aAAa,KAAK,CAAC;AAC7D;AAAA,UACD;AACA,cAAI,QAAQ,YAAY,aAAa,KAAK,GAAG;AAC5C,sBAAU;AACV;AAAA,UACD;AAAA,QACD;AACA,YAAI,SAAS;AACZ,kBAAQ,KAAK,EAAE,OAAAD,QAAO,QAAAC,QAAO,CAAC;AAAA,QAC/B;AAAA,MACD;AAEA,UAAI,QAAQ,WAAW,GAAG;AACzB,eAAO,gBAAgB,KAAK,aAAa,gBAAgB,MAAM,IAAI,IAAI,IAAI,IAAI;AAAA,MAChF;AAEA,YAAM,YAAY,QAAQ,KAAK,WAAS,MAAM,MAAM,QAAQ,SAAS,MAAoB,CAAC;AAC1F,UAAI,CAAC,WAAW;AACf,cAAM,UAAU,CAAC,GAAG,IAAI,IAAI,QAAQ,QAAQ,WAAS,MAAM,MAAM,OAAO,CAAC,CAAC,EAAE,KAAK;AACjF,eAAO,gBAAgB,KAAK,sBAAsB,YAAY,QAAQ,KAAK,IAAI,CAAC,IAAI,MAAM;AAAA,UACzF,OAAO,QAAQ,KAAK,IAAI;AAAA,QACzB,CAAC;AAAA,MACF;AAEA,YAAM,EAAE,OAAO,OAAO,IAAI;AAC1B,YAAM,QAAO,aAAQ,SAAR,YAAgB;AAE7B,YAAM,aAAY,WAAM,WAAW,iBAAjB,YAAiC;AACnD,YAAM,WAAW,OAAO,SAAS,WAAW,OAAO,WAAW,IAAI,IAAI,KAAK;AAC3E,UAAI,WAAW,WAAW;AACzB,eAAO,gBAAgB,KAAK,qBAAqB,gBAAgB,SAAS,UAAU,IAAI;AAAA,MACzF;AAMA,YAAM,eAAc,iBAAY,iBAAiB,MAA7B,YAAkC;AACtD,YAAM,eAAc,sCAAa,YAAY,QAAQ,CAAC,EAAE,6BAAc,MAAlD,YAAuD;AAC3E,YAAM,QAAQ,eAAe;AAC7B,YAAM,YAAY,gBAAgB,MAAM,gBAAgB;AACxD,YAAM,gBACL,WAAM,WAAW,iBAAjB,YAAkC,CAAC,aAAa,SAAS,MAAM,KAAK,gBAAgB;AAGrF,UAAI,MAAM,WAAW,WAAW;AAC/B,cAAM,UAAU,QAAQ,MAAM,MAAM,WAAW,WAAW,wCAAiB,WAAW,IAAI,CAAC;AAC3F,YAAI,CAAC,QAAQ,SAAS;AACrB,iBAAO,gBAAgB,KAAK,gBAAgB,sCAAsC,MAAM;AAAA,YACvF,eAAe,OAAO,QAAQ,iBAAiB;AAAA,YAC/C,yBAAyB;AAAA,UAC1B,CAAC;AAAA,QACF;AAAA,MACD;AAEA,UAAI,OAA2B;AAC/B,UAAI,UAAuD;AAE3D,UAAI,MAAM,WAAW,iBAAiB,OAAO;AAC5C,cAAM,SAAS,QAAQ,KAAK,aAAa;AAAA,UACxC;AAAA,UACA,YAAY,MAAM,WAAW;AAAA,UAC7B,KAAK,IAAI;AAAA,QACV,CAAC;AACD,YAAI,CAAC,OAAO,IAAI;AACf,gBAAM,SAAS,OAAO,UAAU,sBAAsB,MAAM;AAC5D,iBAAO,gBAAgB,QAAQ,OAAO,OAAO,qBAAqB,OAAO,KAAK,KAAK,IAAI;AAAA,QACxF;AACA,eAAO,OAAO;AAEd,YAAI,gBAAgB,CAAC,QAAQ,KAAK,WAAW,EAAE,OAAO,YAAW,iBAAY,cAAc,MAA1B,YAA+B,GAAG,CAAC,GAAG;AACtG,iBAAO,gBAAgB,KAAK,iBAAiB,+BAA+B,IAAI;AAAA,QACjF;AAKA,kBAAU,gBAAgB,KAAK,QAAQ,KAAK,YAAY,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC,IAAI;AAAA,MAClF;AAQA,eAAS,iBAAoB,UAAsB;AApetD,YAAAH;AAqeI,cAAM,eAAcA,MAAA,YAAY,cAAc,MAA1B,OAAAA,MAA+B;AACnD,YAAI,eAAe,CAAC,YAAY,YAAY,EAAE,SAAS,kBAAkB,GAAG;AAC3E,gBAAM,IAAI,2BAAY,KAAK,0BAA0B,4BAA4B,WAAW,EAAE;AAAA,QAC/F;AAEA,cAAM,OAAO,OAAO,SAAS,IAAI,IAAI,KAAK,SAAS,MAAM,IAAI;AAC7D,YAAI,CAAC,KAAK,KAAK,GAAG;AACjB,cAAI,UAAU;AACb,kBAAM,IAAI,2BAAY,KAAK,eAAe,kBAAkB;AAAA,UAC7D;AAEA,iBAAO,CAAC;AAAA,QACT;AACA,YAAI;AACH,iBAAO,KAAK,MAAM,IAAI;AAAA,QACvB,QAAQ;AACP,gBAAM,IAAI,2BAAY,KAAK,eAAe,wBAAwB;AAAA,QACnE;AAAA,MACD;AAEA,YAAM,UAAwB;AAAA,QAC7B,SAAS;AAAA,QACT;AAAA,QACA;AAAA,QACA,cAAc;AAAA,QACd;AAAA,QACA;AAAA,QACA,OAAO,UAAQ;AAhgBnB,cAAAA,KAAAC;AAigBK,gBAAM,SAAQD,MAAA,QAAQ,UAAR,gBAAAA,IAAgB;AAC9B,iBAAO,MAAM,QAAQ,KAAK,KAAKC,MAAA,MAAM,CAAC,MAAP,OAAAA,MAAY,OAAS,wBAAS;AAAA,QAC9D;AAAA,QACA,QAAQ;AAAA,QACR,UAAU,MAAsC,iBAAoB,IAAI;AAAA,QACxE,kBAAkB,MAAsC,iBAAoB,KAAK;AAAA,QACjF,SAAS,MAAW;AAvgBxB,cAAAD;AAwgBK,wBAAO,SAAS,QAAQ,IAAI,IAAI,QAAQ,OAAO,OAAO,MAAKA,MAAA,QAAQ,SAAR,OAAAA,MAAgB,IAAI,MAAM;AAAA;AAAA,MACvF;AAEA,UAAI;AACH,cAAM,SAAS,MAAM,MAAM,WAAW,QAAQ,OAAO;AACrD,YAAI,CAAC,gBAAgB,MAAM,GAAG;AAC7B,gBAAM,IAAI,MAAM,0CAA0C;AAAA,QAC3D;AAEA,cAAM,kBAAkB,EAAE,GAAG,cAAc,IAAI,YAAO,YAAP,YAAkB,CAAC,EAAG;AACrE,YAAI,WAAW,CAAC,gBAAgB,YAAY,GAAG;AAE9C,0BAAgB,YAAY,QAAI,gCAAgB,+BAAgB,QAAQ,OAAO;AAAA,YAC9E,eAAe,KAAK,IAAI,GAAG,QAAQ,YAAY,IAAI,CAAC;AAAA,YACpD;AAAA,UACD,CAAC;AAAA,QACF;AACA,YAAI,OAAO,SAAS,QAAW;AAC9B,iBAAO,gBAAgB,cAAc;AACrC,iBAAO,EAAE,QAAQ,OAAO,QAAQ,SAAS,iBAAiB,MAAM,GAAG;AAAA,QACpE;AACA,YAAI,cAAc,MAAM,GAAG;AAE1B,iBAAO,EAAE,QAAQ,OAAO,QAAQ,SAAS,iBAAiB,MAAM,OAAO,KAAK;AAAA,QAC7E;AACA,eAAO,EAAE,QAAQ,OAAO,QAAQ,SAAS,iBAAiB,MAAM,KAAK,UAAU,OAAO,IAAI,EAAE;AAAA,MAC7F,SAAS,OAAO;AACf,cAAM,EAAE,SAAS,QAAQ,QAAI,0BAAU,OAAO,IAAI;AAClD,eAAO,EAAE,QAAQ,QAAQ,QAAQ,SAAS,EAAE,GAAG,gBAAgB,GAAG,MAAM,KAAK,UAAU,OAAO,EAAE;AAAA,MACjG;AAAA,IACD;AAAA,EACD;AACD;",
+  "names": ["_a", "_b", "route", "params"]
+}

package/build/lib/web/server.js

@@ -0,0 +1,189 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var server_exports = {};
+__export(server_exports, {
+  normalizeBindAddress: () => normalizeBindAddress,
+  startWebServer: () => startWebServer
+});
+module.exports = __toCommonJS(server_exports);
+var http = __toESM(require("node:http"));
+var import_problem = require("./problem");
+var import_router = require("./router");
+var import_stream = require("./stream");
+function normalizePrefix(prefix) {
+  const trimmed = prefix.trim();
+  if (trimmed === "" || trimmed === "/") {
+    return "";
+  }
+  return trimmed.startsWith("/") ? trimmed.replace(/\/+$/, "") : `/${trimmed.replace(/\/+$/, "")}`;
+}
+async function readBody(request, maxBytes) {
+  var _a;
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of request) {
+    const buffer = chunk;
+    size += buffer.length;
+    if (size > maxBytes) {
+      return null;
+    }
+    chunks.push(buffer);
+  }
+  const body = Buffer.concat(chunks);
+  return ((_a = request.headers["content-type"]) != null ? _a : "").toLowerCase().startsWith("application/octet-stream") ? body : body.toString("utf8");
+}
+function parseQuery(requestUrl) {
+  var _a;
+  const url = new URL(requestUrl, "http://localhost");
+  const query = {};
+  for (const key of new Set(url.searchParams.keys())) {
+    const values = url.searchParams.getAll(key);
+    query[key] = values.length > 1 ? values : (_a = values[0]) != null ? _a : "";
+  }
+  return query;
+}
+function normalizeBindAddress(value) {
+  const raw = (value != null ? value : "").trim();
+  if (raw === "") {
+    return "127.0.0.1";
+  }
+  if (raw === "*") {
+    return "0.0.0.0";
+  }
+  const bracketed = /^\[([^\]]+)]:\d+$/.exec(raw);
+  if (bracketed) {
+    return bracketed[1];
+  }
+  const withPort = /^(\d{1,3}(?:\.\d{1,3}){3}):\d+$/.exec(raw);
+  if (withPort) {
+    return withPort[1];
+  }
+  return raw;
+}
+async function startWebServer(options) {
+  var _a, _b, _c, _d, _e;
+  const maxBodyBytes = (_a = options.maxBodyBytes) != null ? _a : import_router.DEFAULT_MAX_BODY_BYTES;
+  const bind = normalizeBindAddress(options.bind);
+  const apiPrefix = normalizePrefix((_b = options.apiPrefix) != null ? _b : "/api");
+  const handle = async (request, response) => {
+    var _a2, _b2, _c2, _d2, _e2, _f, _g, _h, _i, _j;
+    try {
+      const body = await readBody(request, maxBodyBytes);
+      if (body === null) {
+        const details = new import_problem.HttpProblem(413, "payload_too_large", `body exceeds ${maxBodyBytes} bytes`);
+        response.writeHead(413, { "content-type": import_problem.PROBLEM_CONTENT_TYPE });
+        response.end(JSON.stringify(details.toProblem((_a2 = request.url) != null ? _a2 : "/")));
+        return;
+      }
+      const url = new URL((_b2 = request.url) != null ? _b2 : "/", "http://localhost");
+      const headers = request.headers;
+      const remoteAddress = (_c2 = request.socket.remoteAddress) != null ? _c2 : null;
+      if (apiPrefix !== "" && url.pathname.startsWith(`${apiPrefix}/`)) {
+        const routerRequest = {
+          method: (_d2 = request.method) != null ? _d2 : "GET",
+          path: url.pathname.slice(apiPrefix.length),
+          query: parseQuery((_e2 = request.url) != null ? _e2 : "/"),
+          headers,
+          body,
+          remoteAddress
+        };
+        const result = await options.router.handle(routerRequest);
+        response.writeHead(result.status, result.headers);
+        response.end(result.body);
+        return;
+      }
+      const staticRequest = {
+        method: (_f = request.method) != null ? _f : "GET",
+        path: url.pathname,
+        query: parseQuery((_g = request.url) != null ? _g : "/"),
+        headers,
+        body,
+        remoteAddress
+      };
+      const file = (_i = (_h = options.staticFiles) == null ? void 0 : _h.call(options, staticRequest)) != null ? _i : null;
+      if (file) {
+        response.writeHead(file.status, file.headers);
+        response.end(file.body);
+        return;
+      }
+      response.writeHead(404, { "content-type": import_problem.PROBLEM_CONTENT_TYPE });
+      response.end(
+        JSON.stringify(
+          new import_problem.HttpProblem(404, "not_found", `no route for ${url.pathname}`).toProblem(url.pathname)
+        )
+      );
+    } catch (error) {
+      (_j = options.log) == null ? void 0 : _j.error(`request failed: ${error instanceof Error ? error.message : String(error)}`);
+      if (!response.headersSent) {
+        response.writeHead(500, { "content-type": import_problem.PROBLEM_CONTENT_TYPE });
+      }
+      response.end();
+    }
+  };
+  const server = http.createServer((request, response) => {
+    void handle(request, response);
+  });
+  server.on("clientError", (_error, socket) => socket.destroy());
+  await new Promise((resolve, reject) => {
+    const onError = (error) => reject(error);
+    server.once("error", onError);
+    server.listen(options.port, bind, () => {
+      server.off("error", onError);
+      resolve();
+    });
+  });
+  const address = server.address();
+  const port = (_c = address == null ? void 0 : address.port) != null ? _c : options.port;
+  const stream = options.stream ? (0, import_stream.attachEventStream)({
+    ...options.stream,
+    server,
+    path: (_d = options.stream.path) != null ? _d : `${apiPrefix}/stream`
+  }) : void 0;
+  (_e = options.log) == null ? void 0 : _e.info(
+    `API listening on http://${bind}:${port}${apiPrefix}${options.staticFiles ? " - web interface is served from disk" : ""}${stream ? " - live events on /stream" : ""}`
+  );
+  return {
+    port,
+    url: `http://${bind === "0.0.0.0" ? "127.0.0.1" : bind}:${port}`,
+    stream,
+    close: async () => {
+      await (stream == null ? void 0 : stream.close());
+      await new Promise((resolve) => {
+        server.close(() => resolve());
+        server.closeAllConnections();
+      });
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  normalizeBindAddress,
+  startWebServer
+});
+//# sourceMappingURL=server.js.map

package/build/lib/web/server.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/lib/web/server.ts"],
+  "sourcesContent": ["/**\n * HTTP server that mounts the router on a Node http server.\n *\n * This is the adapter's own port (`native.port`): the PWA, the REST API and the kiosk terminal are served on\n * it. The server only translates between Node's request/response objects and the router \u2014 all routing,\n * authentication, RBAC and error handling live in the router and the API.\n *\n * Safety nets: the body is limited while it is being read (a client cannot fill the memory), the bind address\n * defaults to the local machine and a failure to bind never stops the adapter (the API is reported as\n * unavailable instead).\n */\n\nimport * as http from \"node:http\";\nimport type { AddressInfo } from \"node:net\";\nimport { HttpProblem, PROBLEM_CONTENT_TYPE } from \"./problem\";\nimport { DEFAULT_MAX_BODY_BYTES, type HttpRequest, type Router } from \"./router\";\nimport type { StaticHandler } from \"./static\";\nimport { attachEventStream, type EventStream, type EventStreamOptions } from \"./stream\";\n\n/** Minimal logger used by the server. */\nexport interface ServerLogger {\n\t/** Informational message */\n\tinfo(message: string): void;\n\t/** Warning */\n\twarn(message: string): void;\n\t/** Error */\n\terror(message: string): void;\n}\n\n/** Options of the HTTP server. */\nexport interface WebServerOptions {\n\t/** Router that handles the requests */\n\trouter: Router;\n\t/** Port to listen on (`0` picks a free port) */\n\tport: number;\n\t/** Bind address, default `127.0.0.1` */\n\tbind?: string;\n\t/** Path prefix the API is mounted on (default `/api`) */\n\tapiPrefix?: string;\n\t/** Handler for the files of the web interface (PWA) */\n\tstaticFiles?: StaticHandler;\n\t/** Live event stream (`/api/stream`); without it the endpoint does not exist */\n\tstream?: Omit<EventStreamOptions, \"server\">;\n\t/** Maximum body size in bytes (default 2 MiB) */\n\tmaxBodyBytes?: number;\n\t/** Logger */\n\tlog?: ServerLogger;\n}\n\n/** A running server. */\nexport interface WebServer {\n\t/** Port the server is listening on */\n\treadonly port: number;\n\t/** Base URL of the server, e.g. `http://127.0.0.1:8092` */\n\treadonly url: string;\n\t/** Live event stream, when one is configured */\n\treadonly stream?: EventStream;\n\t/** Stops the server and closes all connections */\n\tclose(): Promise<void>;\n}\n\n/**\n * Normalises a path prefix.\n *\n * @param prefix - configured prefix\n * @returns prefix without trailing slash (`\"\"` disables the prefix)\n */\nfunction normalizePrefix(prefix: string): string {\n\tconst trimmed = prefix.trim();\n\tif (trimmed === \"\" || trimmed === \"/\") {\n\t\treturn \"\";\n\t}\n\treturn trimmed.startsWith(\"/\") ? trimmed.replace(/\\/+$/, \"\") : `/${trimmed.replace(/\\/+$/, \"\")}`;\n}\n\n/**\n * Reads the request body up to a limit.\n *\n * A body that is not text is kept as bytes: an uploaded backup has to arrive byte for byte. Everything else is\n * decoded here, because the endpoints expect a JSON document.\n *\n * @param request - incoming request\n * @param maxBytes - maximum number of bytes\n * @returns body as text or bytes, `null` when the limit is exceeded\n */\nasync function readBody(request: http.IncomingMessage, maxBytes: number): Promise<string | Buffer | null> {\n\tconst chunks: Buffer[] = [];\n\tlet size = 0;\n\n\tfor await (const chunk of request) {\n\t\tconst buffer = chunk as Buffer;\n\t\tsize += buffer.length;\n\t\tif (size > maxBytes) {\n\t\t\treturn null;\n\t\t}\n\t\tchunks.push(buffer);\n\t}\n\n\tconst body = Buffer.concat(chunks);\n\t// the raw upload arrives as bytes; a JSON document is decoded right away\n\treturn (request.headers[\"content-type\"] ?? \"\").toLowerCase().startsWith(\"application/octet-stream\")\n\t\t? body\n\t\t: body.toString(\"utf8\");\n}\n\n/**\n * Builds the query map of a request, repeated names become arrays.\n *\n * @param requestUrl - raw request URL\n * @returns query parameters\n */\nfunction parseQuery(requestUrl: string): Record<string, string | string[]> {\n\tconst url = new URL(requestUrl, \"http://localhost\");\n\tconst query: Record<string, string | string[]> = {};\n\tfor (const key of new Set(url.searchParams.keys())) {\n\t\tconst values = url.searchParams.getAll(key);\n\t\tquery[key] = values.length > 1 ? values : (values[0] ?? \"\");\n\t}\n\treturn query;\n}\n\n/**\n * Normalises the bind address of the instance settings.\n *\n * The admin offers the local addresses of the host in a list, and a value may come back in the `host:port` form\n * (`[::1]:8092` for IPv6) or as a wildcard. `listen` expects the address alone and the port comes from the\n * instance, so such a value cannot make the server fail to start. An empty value means \"this machine only\".\n *\n * @param value - raw value of the instance settings\n * @returns the address to bind to\n */\nexport function normalizeBindAddress(value: string | null | undefined): string {\n\tconst raw = (value ?? \"\").trim();\n\tif (raw === \"\") {\n\t\treturn \"127.0.0.1\";\n\t}\n\tif (raw === \"*\") {\n\t\treturn \"0.0.0.0\";\n\t}\n\t// [::1]:8092 or 192.168.1.5:8092 - the port belongs to the instance, not to the address\n\tconst bracketed = /^\\[([^\\]]+)]:\\d+$/.exec(raw);\n\tif (bracketed) {\n\t\treturn bracketed[1];\n\t}\n\tconst withPort = /^(\\d{1,3}(?:\\.\\d{1,3}){3}):\\d+$/.exec(raw);\n\tif (withPort) {\n\t\treturn withPort[1];\n\t}\n\treturn raw;\n}\n\n/**\n * Starts the HTTP server.\n *\n * @param options - router, port and limits\n * @returns the running server\n */\nexport async function startWebServer(options: WebServerOptions): Promise<WebServer> {\n\tconst maxBodyBytes = options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;\n\tconst bind = normalizeBindAddress(options.bind);\n\tconst apiPrefix = normalizePrefix(options.apiPrefix ?? \"/api\");\n\n\tconst handle = async (request: http.IncomingMessage, response: http.ServerResponse): Promise<void> => {\n\t\ttry {\n\t\t\tconst body = await readBody(request, maxBodyBytes);\n\t\t\tif (body === null) {\n\t\t\t\tconst details = new HttpProblem(413, \"payload_too_large\", `body exceeds ${maxBodyBytes} bytes`);\n\t\t\t\tresponse.writeHead(413, { \"content-type\": PROBLEM_CONTENT_TYPE });\n\t\t\t\tresponse.end(JSON.stringify(details.toProblem(request.url ?? \"/\")));\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tconst url = new URL(request.url ?? \"/\", \"http://localhost\");\n\t\t\tconst headers = request.headers;\n\t\t\tconst remoteAddress = request.socket.remoteAddress ?? null;\n\n\t\t\t// the API lives below the prefix; everything else is a file of the web interface\n\t\t\tif (apiPrefix !== \"\" && url.pathname.startsWith(`${apiPrefix}/`)) {\n\t\t\t\tconst routerRequest: HttpRequest = {\n\t\t\t\t\tmethod: request.method ?? \"GET\",\n\t\t\t\t\tpath: url.pathname.slice(apiPrefix.length),\n\t\t\t\t\tquery: parseQuery(request.url ?? \"/\"),\n\t\t\t\t\theaders,\n\t\t\t\t\tbody,\n\t\t\t\t\tremoteAddress,\n\t\t\t\t};\n\t\t\t\tconst result = await options.router.handle(routerRequest);\n\t\t\t\tresponse.writeHead(result.status, result.headers);\n\t\t\t\tresponse.end(result.body);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tconst staticRequest: HttpRequest = {\n\t\t\t\tmethod: request.method ?? \"GET\",\n\t\t\t\tpath: url.pathname,\n\t\t\t\tquery: parseQuery(request.url ?? \"/\"),\n\t\t\t\theaders,\n\t\t\t\tbody,\n\t\t\t\tremoteAddress,\n\t\t\t};\n\t\t\tconst file = options.staticFiles?.(staticRequest) ?? null;\n\t\t\tif (file) {\n\t\t\t\tresponse.writeHead(file.status, file.headers);\n\t\t\t\tresponse.end(file.body);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tresponse.writeHead(404, { \"content-type\": PROBLEM_CONTENT_TYPE });\n\t\t\tresponse.end(\n\t\t\t\tJSON.stringify(\n\t\t\t\t\tnew HttpProblem(404, \"not_found\", `no route for ${url.pathname}`).toProblem(url.pathname),\n\t\t\t\t),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\t// the router never throws, so this is an unexpected failure of the transport itself\n\t\t\toptions.log?.error(`request failed: ${error instanceof Error ? error.message : String(error)}`);\n\t\t\tif (!response.headersSent) {\n\t\t\t\tresponse.writeHead(500, { \"content-type\": PROBLEM_CONTENT_TYPE });\n\t\t\t}\n\t\t\tresponse.end();\n\t\t}\n\t};\n\n\tconst server = http.createServer((request, response) => {\n\t\tvoid handle(request, response);\n\t});\n\tserver.on(\"clientError\", (_error, socket) => socket.destroy());\n\n\tawait new Promise<void>((resolve, reject) => {\n\t\tconst onError = (error: Error): void => reject(error);\n\t\tserver.once(\"error\", onError);\n\t\tserver.listen(options.port, bind, () => {\n\t\t\tserver.off(\"error\", onError);\n\t\t\tresolve();\n\t\t});\n\t});\n\n\tconst address = server.address() as AddressInfo | null;\n\tconst port = address?.port ?? options.port;\n\tconst stream = options.stream\n\t\t? attachEventStream({\n\t\t\t\t...options.stream,\n\t\t\t\tserver,\n\t\t\t\tpath: options.stream.path ?? `${apiPrefix}/stream`,\n\t\t\t})\n\t\t: undefined;\n\toptions.log?.info(\n\t\t`API listening on http://${bind}:${port}${apiPrefix}${\n\t\t\toptions.staticFiles ? \" - web interface is served from disk\" : \"\"\n\t\t}${stream ? \" - live events on /stream\" : \"\"}`,\n\t);\n\n\treturn {\n\t\tport,\n\t\turl: `http://${bind === \"0.0.0.0\" ? \"127.0.0.1\" : bind}:${port}`,\n\t\tstream,\n\t\tclose: async (): Promise<void> => {\n\t\t\tawait stream?.close();\n\t\t\tawait new Promise<void>(resolve => {\n\t\t\t\tserver.close(() => resolve());\n\t\t\t\t// keep-alive connections would delay the shutdown\n\t\t\t\tserver.closeAllConnections();\n\t\t\t});\n\t\t},\n\t};\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAYA,WAAsB;AAEtB,qBAAkD;AAClD,oBAAsE;AAEtE,oBAA6E;AAkD7E,SAAS,gBAAgB,QAAwB;AAChD,QAAM,UAAU,OAAO,KAAK;AAC5B,MAAI,YAAY,MAAM,YAAY,KAAK;AACtC,WAAO;AAAA,EACR;AACA,SAAO,QAAQ,WAAW,GAAG,IAAI,QAAQ,QAAQ,QAAQ,EAAE,IAAI,IAAI,QAAQ,QAAQ,QAAQ,EAAE,CAAC;AAC/F;AAYA,eAAe,SAAS,SAA+B,UAAmD;AArF1G;AAsFC,QAAM,SAAmB,CAAC;AAC1B,MAAI,OAAO;AAEX,mBAAiB,SAAS,SAAS;AAClC,UAAM,SAAS;AACf,YAAQ,OAAO;AACf,QAAI,OAAO,UAAU;AACpB,aAAO;AAAA,IACR;AACA,WAAO,KAAK,MAAM;AAAA,EACnB;AAEA,QAAM,OAAO,OAAO,OAAO,MAAM;AAEjC,WAAQ,aAAQ,QAAQ,cAAc,MAA9B,YAAmC,IAAI,YAAY,EAAE,WAAW,0BAA0B,IAC/F,OACA,KAAK,SAAS,MAAM;AACxB;AAQA,SAAS,WAAW,YAAuD;AA/G3E;AAgHC,QAAM,MAAM,IAAI,IAAI,YAAY,kBAAkB;AAClD,QAAM,QAA2C,CAAC;AAClD,aAAW,OAAO,IAAI,IAAI,IAAI,aAAa,KAAK,CAAC,GAAG;AACnD,UAAM,SAAS,IAAI,aAAa,OAAO,GAAG;AAC1C,UAAM,GAAG,IAAI,OAAO,SAAS,IAAI,UAAU,YAAO,CAAC,MAAR,YAAa;AAAA,EACzD;AACA,SAAO;AACR;AAYO,SAAS,qBAAqB,OAA0C;AAC9E,QAAM,OAAO,wBAAS,IAAI,KAAK;AAC/B,MAAI,QAAQ,IAAI;AACf,WAAO;AAAA,EACR;AACA,MAAI,QAAQ,KAAK;AAChB,WAAO;AAAA,EACR;AAEA,QAAM,YAAY,oBAAoB,KAAK,GAAG;AAC9C,MAAI,WAAW;AACd,WAAO,UAAU,CAAC;AAAA,EACnB;AACA,QAAM,WAAW,kCAAkC,KAAK,GAAG;AAC3D,MAAI,UAAU;AACb,WAAO,SAAS,CAAC;AAAA,EAClB;AACA,SAAO;AACR;AAQA,eAAsB,eAAe,SAA+C;AA7JpF;AA8JC,QAAM,gBAAe,aAAQ,iBAAR,YAAwB;AAC7C,QAAM,OAAO,qBAAqB,QAAQ,IAAI;AAC9C,QAAM,YAAY,iBAAgB,aAAQ,cAAR,YAAqB,MAAM;AAE7D,QAAM,SAAS,OAAO,SAA+B,aAAiD;AAlKvG,QAAAA,KAAAC,KAAAC,KAAAC,KAAAC,KAAA;AAmKE,QAAI;AACH,YAAM,OAAO,MAAM,SAAS,SAAS,YAAY;AACjD,UAAI,SAAS,MAAM;AAClB,cAAM,UAAU,IAAI,2BAAY,KAAK,qBAAqB,gBAAgB,YAAY,QAAQ;AAC9F,iBAAS,UAAU,KAAK,EAAE,gBAAgB,oCAAqB,CAAC;AAChE,iBAAS,IAAI,KAAK,UAAU,QAAQ,WAAUJ,MAAA,QAAQ,QAAR,OAAAA,MAAe,GAAG,CAAC,CAAC;AAClE;AAAA,MACD;AAEA,YAAM,MAAM,IAAI,KAAIC,MAAA,QAAQ,QAAR,OAAAA,MAAe,KAAK,kBAAkB;AAC1D,YAAM,UAAU,QAAQ;AACxB,YAAM,iBAAgBC,MAAA,QAAQ,OAAO,kBAAf,OAAAA,MAAgC;AAGtD,UAAI,cAAc,MAAM,IAAI,SAAS,WAAW,GAAG,SAAS,GAAG,GAAG;AACjE,cAAM,gBAA6B;AAAA,UAClC,SAAQC,MAAA,QAAQ,WAAR,OAAAA,MAAkB;AAAA,UAC1B,MAAM,IAAI,SAAS,MAAM,UAAU,MAAM;AAAA,UACzC,OAAO,YAAWC,MAAA,QAAQ,QAAR,OAAAA,MAAe,GAAG;AAAA,UACpC;AAAA,UACA;AAAA,UACA;AAAA,QACD;AACA,cAAM,SAAS,MAAM,QAAQ,OAAO,OAAO,aAAa;AACxD,iBAAS,UAAU,OAAO,QAAQ,OAAO,OAAO;AAChD,iBAAS,IAAI,OAAO,IAAI;AACxB;AAAA,MACD;AAEA,YAAM,gBAA6B;AAAA,QAClC,SAAQ,aAAQ,WAAR,YAAkB;AAAA,QAC1B,MAAM,IAAI;AAAA,QACV,OAAO,YAAW,aAAQ,QAAR,YAAe,GAAG;AAAA,QACpC;AAAA,QACA;AAAA,QACA;AAAA,MACD;AACA,YAAM,QAAO,mBAAQ,gBAAR,iCAAsB,mBAAtB,YAAwC;AACrD,UAAI,MAAM;AACT,iBAAS,UAAU,KAAK,QAAQ,KAAK,OAAO;AAC5C,iBAAS,IAAI,KAAK,IAAI;AACtB;AAAA,MACD;AAEA,eAAS,UAAU,KAAK,EAAE,gBAAgB,oCAAqB,CAAC;AAChE,eAAS;AAAA,QACR,KAAK;AAAA,UACJ,IAAI,2BAAY,KAAK,aAAa,gBAAgB,IAAI,QAAQ,EAAE,EAAE,UAAU,IAAI,QAAQ;AAAA,QACzF;AAAA,MACD;AAAA,IACD,SAAS,OAAO;AAEf,oBAAQ,QAAR,mBAAa,MAAM,mBAAmB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAC5F,UAAI,CAAC,SAAS,aAAa;AAC1B,iBAAS,UAAU,KAAK,EAAE,gBAAgB,oCAAqB,CAAC;AAAA,MACjE;AACA,eAAS,IAAI;AAAA,IACd;AAAA,EACD;AAEA,QAAM,SAAS,KAAK,aAAa,CAAC,SAAS,aAAa;AACvD,SAAK,OAAO,SAAS,QAAQ;AAAA,EAC9B,CAAC;AACD,SAAO,GAAG,eAAe,CAAC,QAAQ,WAAW,OAAO,QAAQ,CAAC;AAE7D,QAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC5C,UAAM,UAAU,CAAC,UAAuB,OAAO,KAAK;AACpD,WAAO,KAAK,SAAS,OAAO;AAC5B,WAAO,OAAO,QAAQ,MAAM,MAAM,MAAM;AACvC,aAAO,IAAI,SAAS,OAAO;AAC3B,cAAQ;AAAA,IACT,CAAC;AAAA,EACF,CAAC;AAED,QAAM,UAAU,OAAO,QAAQ;AAC/B,QAAM,QAAO,wCAAS,SAAT,YAAiB,QAAQ;AACtC,QAAM,SAAS,QAAQ,aACpB,iCAAkB;AAAA,IAClB,GAAG,QAAQ;AAAA,IACX;AAAA,IACA,OAAM,aAAQ,OAAO,SAAf,YAAuB,GAAG,SAAS;AAAA,EAC1C,CAAC,IACA;AACH,gBAAQ,QAAR,mBAAa;AAAA,IACZ,2BAA2B,IAAI,IAAI,IAAI,GAAG,SAAS,GAClD,QAAQ,cAAc,yCAAyC,EAChE,GAAG,SAAS,8BAA8B,EAAE;AAAA;AAG7C,SAAO;AAAA,IACN;AAAA,IACA,KAAK,UAAU,SAAS,YAAY,cAAc,IAAI,IAAI,IAAI;AAAA,IAC9D;AAAA,IACA,OAAO,YAA2B;AACjC,aAAM,iCAAQ;AACd,YAAM,IAAI,QAAc,aAAW;AAClC,eAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,eAAO,oBAAoB;AAAA,MAC5B,CAAC;AAAA,IACF;AAAA,EACD;AACD;",
+  "names": ["_a", "_b", "_c", "_d", "_e"]
+}