npm - nextjs-secure - Versions diffs - 0.7.0 → 0.8.0 - Mend

nextjs-secure 0.7.0 → 0.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (14) hide show

package/dist/api.cjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"sources":["../src/middleware/api/types.ts","../src/middleware/api/signing.ts","../src/middleware/api/replay.ts","../src/middleware/api/timestamp.ts","../src/middleware/api/versioning.ts","../src/middleware/api/idempotency.ts","../src/middleware/api/middleware.ts"],"names":["generateNonce","defaultInvalidResponse","defaultErrorResponse"],"mappings":";;;AA4aO,IAAM,sBAAA,GAAqF;AAAA;AAAA,EAEhG,KAAA,EAAO;AAAA,IACL,OAAA,EAAS,KAAA;AAAA,IACT,MAAA,EAAQ,KAAA;AAAA,IACR,SAAA,EAAW;AAAA,MACT,MAAA,EAAQ,GAAA;AAAA;AAAA,MACR,QAAA,EAAU;AAAA,KACZ;AAAA,IACA,UAAA,EAAY,KAAA;AAAA,IACZ,WAAA,EAAa;AAAA,GACf;AAAA;AAAA,EAGA,QAAA,EAAU;AAAA,IACR,OAAA,EAAS,KAAA;AAAA,IACT,MAAA,EAAQ;AAAA,MACN,GAAA,EAAK,GAAA;AAAA;AAAA,MACL,QAAA,EAAU;AAAA,KACZ;AAAA,IACA,SAAA,EAAW;AAAA,MACT,MAAA,EAAQ,GAAA;AAAA;AAAA,MACR,QAAA,EAAU;AAAA,KACZ;AAAA,IACA,UAAA,EAAY,KAAA;AAAA,IACZ,WAAA,EAAa;AAAA,MACX,QAAA,EAAU;AAAA;AACZ,GACF;AAAA;AAAA,EAGA,MAAA,EAAQ;AAAA,IACN,OAAA,EAAS;AAAA,MACP,MAAA,EAAQ,EAAA;AAAA;AAAA,MACR,SAAA,EAAW,QAAA;AAAA,MACX,kBAAA,EAAoB;AAAA,KACtB;AAAA,IACA,MAAA,EAAQ;AAAA,MACN,GAAA,EAAK,GAAA;AAAA,MACL,QAAA,EAAU,IAAA;AAAA,MACV,SAAA,EAAW;AAAA,KACb;AAAA,IACA,SAAA,EAAW;AAAA,MACT,MAAA,EAAQ,GAAA;AAAA,MACR,QAAA,EAAU,IAAA;AAAA,MACV,WAAA,EAAa;AAAA,KACf;AAAA,IACA,UAAA,EAAY,KAAA;AAAA,IACZ,WAAA,EAAa;AAAA,MACX,QAAA,EAAU,IAAA;AAAA,MACV,OAAA,EAAS,CAAC,MAAA,EAAQ,KAAA,EAAO,SAAS,QAAQ;AAAA;AAC5C,GACF;AAAA;AAAA,EAGA,SAAA,EAAW;AAAA,IACT,OAAA,EAAS;AAAA,MACP,MAAA,EAAQ,EAAA;AAAA;AAAA,MACR,SAAA,EAAW,QAAA;AAAA,MACX,kBAAA,EAAoB,EAAA;AAAA;AAAA,MACpB,UAAA,EAAY;AAAA,QACV,MAAA,EAAQ,IAAA;AAAA,QACR,IAAA,EAAM,IAAA;AAAA,QACN,KAAA,EAAO,IAAA;AAAA,QACP,IAAA,EAAM,IAAA;AAAA,QACN,SAAA,EAAW,IAAA;AAAA,QACX,KAAA,EAAO;AAAA;AACT,KACF;AAAA,IACA,MAAA,EAAQ;AAAA,MACN,GAAA,EAAK,KAAA;AAAA;AAAA,MACL,QAAA,EAAU,IAAA;AAAA,MACV,SAAA,EAAW;AAAA,KACb;AAAA,IACA,SAAA,EAAW;AAAA,MACT,MAAA,EAAQ,EAAA;AAAA;AAAA,MACR,QAAA,EAAU,IAAA;AAAA,MACV,WAAA,EAAa,KAAA;AAAA,MACb,SAAA,EAAW;AAAA,KACb;AAAA,IACA,UAAA,EAAY,KAAA;AAAA,IACZ,WAAA,EAAa;AAAA,MACX,QAAA,EAAU,IAAA;AAAA,MACV,GAAA,EAAK,MAAA;AAAA;AAAA,MACL,OAAA,EAAS,CAAC,MAAA,EAAQ,KAAA,EAAO,SAAS,QAAQ,CAAA;AAAA,MAC1C,eAAA,EAAiB;AAAA;AACnB;AAEJ;;;AClfO,IAAM,uBAAA,GAAgH;AAAA,EAC3H,SAAA,EAAW,QAAA;AAAA,EACX,QAAA,EAAU,KAAA;AAAA,EACV,eAAA,EAAiB,aAAA;AAAA,EACjB,eAAA,EAAiB,aAAA;AAAA,EACjB,WAAA,EAAa,SAAA;AAAA,EACb,UAAA,EAAY;AAAA,IACV,MAAA,EAAQ,IAAA;AAAA,IACR,IAAA,EAAM,IAAA;AAAA,IACN,KAAA,EAAO,IAAA;AAAA,IACP,IAAA,EAAM,IAAA;AAAA,IACN,SAAS,EAAC;AAAA,IACV,SAAA,EAAW,IAAA;AAAA,IACX,KAAA,EAAO;AAAA,GACT;AAAA,EACA,kBAAA,EAAoB;AAAA;AACtB;AASA,eAAsB,WACpB,IAAA,EACA,MAAA,EACA,SAAA,GAA8B,QAAA,EAC9B,WAA8B,KAAA,EACb;AACjB,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,MAAA,CAAO,MAAM,CAAA;AACrC,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,MAAA,CAAO,IAAI,CAAA;AAGvC,EAAA,MAAM,QAAA,GAAW;AAAA,IACf,IAAA,EAAM,OAAA;AAAA,IACN,MAAA,EAAQ,SAAA;AAAA,IACR,MAAA,EAAQ,SAAA;AAAA,IACR,MAAA,EAAQ;AAAA,IACR,SAAS,CAAA;AAGX,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA;AAAA,IAC9B,KAAA;AAAA,IACA,OAAA;AAAA,IACA,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,QAAA,EAAS;AAAA,IAC/B,KAAA;AAAA,IACA,CAAC,MAAM;AAAA,GACT;AAGA,EAAA,MAAM,YAAY,MAAM,MAAA,CAAO,OAAO,IAAA,CAAK,MAAA,EAAQ,KAAK,WAAW,CAAA;AAGnE,EAAA,OAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,SAAS,GAAG,QAAQ,CAAA;AAC5D;AAKA,SAAS,eAAA,CAAgB,OAAmB,QAAA,EAAqC;AAC/E,EAAA,QAAQ,QAAA;AAAU,IAChB,KAAK,KAAA;AACH,MAAA,OAAO,MAAM,IAAA,CAAK,KAAK,CAAA,CACpB,GAAA,CAAI,OAAK,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,SAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CACxC,KAAK,EAAE,CAAA;AAAA,IACZ,KAAK,QAAA;AACH,MAAA,OAAO,IAAA,CAAK,MAAA,CAAO,YAAA,CAAa,GAAG,KAAK,CAAC,CAAA;AAAA,IAC3C,KAAK,WAAA;AACH,MAAA,OAAO,KAAK,MAAA,CAAO,YAAA,CAAa,GAAG,KAAK,CAAC,CAAA,CACtC,OAAA,CAAQ,KAAA,EAAO,GAAG,EAClB,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAClB,OAAA,CAAQ,OAAO,EAAE,CAAA;AAAA,IACtB;AACE,MAAA,OAAO,MAAM,IAAA,CAAK,KAAK,CAAA,CACpB,GAAA,CAAI,OAAK,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,SAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CACxC,KAAK,EAAE,CAAA;AAAA;AAEhB;AAKO,SAAS,eAAA,CAAgB,GAAW,CAAA,EAAoB;AAC7D,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ;AACzB,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AACjC,IAAA,MAAA,IAAU,EAAE,UAAA,CAAW,CAAC,CAAA,GAAI,CAAA,CAAE,WAAW,CAAC,CAAA;AAAA,EAC5C;AAEA,EAAA,OAAO,MAAA,KAAW,CAAA;AACpB;AASA,eAAsB,oBAAA,CACpB,GAAA,EACA,UAAA,EACA,OAAA,GAA8D,EAAC,EAC9C;AACjB,EAAA,MAAM,QAAkB,EAAC;AAGzB,EAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,IAAA,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,WAAA,EAAa,CAAA;AAAA,EACrC;AAGA,EAAA,IAAI,WAAW,IAAA,EAAM;AACnB,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,GAAA,CAAI,GAAG,CAAA;AAC3B,IAAA,KAAA,CAAM,IAAA,CAAK,IAAI,QAAQ,CAAA;AAAA,EACzB;AAGA,EAAA,IAAI,WAAW,KAAA,EAAO;AACpB,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,GAAA,CAAI,GAAG,CAAA;AAC3B,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB,GAAA,CAAI,MAAM,CAAA;AAC7C,IAAA,MAAM,YAAA,GAAe,KAAA,CAAM,IAAA,CAAK,MAAA,CAAO,SAAS,CAAA,CAC7C,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,CAAC,EAAE,aAAA,CAAc,CAAA,CAAE,CAAC,CAAC,CAAC,CAAA,CACvC,GAAA,CAAI,CAAC,CAAC,CAAA,EAAG,CAAC,CAAA,KAAM,CAAA,EAAG,CAAC,CAAA,CAAA,EAAI,CAAC,CAAA,CAAE,CAAA,CAC3B,KAAK,GAAG,CAAA;AACX,IAAA,KAAA,CAAM,KAAK,YAAY,CAAA;AAAA,EACzB;AAGA,EAAA,IAAI,WAAW,IAAA,EAAM;AACnB,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,IAAI,KAAA,EAAM;AACzB,MAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,IAAA,EAAK;AAC/B,MAAA,IAAI,IAAA,EAAM;AACR,QAAA,KAAA,CAAM,KAAK,IAAI,CAAA;AAAA,MACjB;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAGA,EAAA,IAAI,UAAA,CAAW,OAAA,IAAW,UAAA,CAAW,OAAA,CAAQ,SAAS,CAAA,EAAG;AACvD,IAAA,MAAM,WAAA,GAAc,WAAW,OAAA,CAC5B,GAAA,CAAI,OAAK,CAAA,CAAE,WAAA,EAAa,CAAA,CACxB,IAAA,EAAK,CACL,IAAI,CAAA,CAAA,KAAK,CAAA,EAAG,CAAC,CAAA,CAAA,EAAI,GAAA,CAAI,QAAQ,GAAA,CAAI,CAAC,CAAA,IAAK,EAAE,CAAA,CAAE,CAAA;AAC9C,IAAA,KAAA,CAAM,IAAA,CAAK,WAAA,CAAY,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,EACnC;AAGA,EAAA,IAAI,WAAW,SAAA,EAAW;AACxB,IAAA,MAAM,eAAA,GAAkB,QAAQ,eAAA,IAAmB,aAAA;AACnD,IAAA,MAAM,SAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA,IAAK,EAAA;AACtD,IAAA,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,EACtB;AAGA,EAAA,IAAI,WAAW,KAAA,EAAO;AACpB,IAAA,MAAM,WAAA,GAAc,QAAQ,WAAA,IAAe,SAAA;AAC3C,IAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA,IAAK,EAAA;AAC9C,IAAA,KAAA,CAAM,KAAK,KAAK,CAAA;AAAA,EAClB;AAEA,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,CAAA;AACxB;AASA,eAAsB,iBAAA,CACpB,KACA,OAAA,EACiB;AACjB,EAAA,MAAM;AAAA,IACJ,MAAA;AAAA,IACA,YAAY,uBAAA,CAAwB,SAAA;AAAA,IACpC,WAAW,uBAAA,CAAwB,QAAA;AAAA,IACnC,aAAa,uBAAA,CAAwB,UAAA;AAAA,IACrC,kBAAkB,uBAAA,CAAwB,eAAA;AAAA,IAC1C,cAAc,uBAAA,CAAwB,WAAA;AAAA,IACtC;AAAA,GACF,GAAI,OAAA;AAGJ,EAAA,MAAM,SAAA,GAAY,gBAAA,GACd,MAAM,gBAAA,CAAiB,KAAK,UAAU,CAAA,GACtC,MAAM,oBAAA,CAAqB,GAAA,EAAK,UAAA,EAAY,EAAE,eAAA,EAAiB,aAAa,CAAA;AAGhF,EAAA,OAAO,UAAA,CAAW,SAAA,EAAW,MAAA,EAAQ,SAAA,EAAW,QAAQ,CAAA;AAC1D;AAKA,eAAsB,wBAAA,CACpB,MAAA,EACA,GAAA,EACA,IAAA,EACA,OAAA,EACiC;AACjC,EAAA,MAAM;AAAA,IACJ,MAAA;AAAA,IACA,YAAY,uBAAA,CAAwB,SAAA;AAAA,IACpC,WAAW,uBAAA,CAAwB,QAAA;AAAA,IACnC,aAAa,uBAAA,CAAwB,UAAA;AAAA,IACrC,kBAAkB,uBAAA,CAAwB,eAAA;AAAA,IAC1C,kBAAkB,uBAAA,CAAwB,eAAA;AAAA,IAC1C,cAAc,uBAAA,CAAwB,WAAA;AAAA,IACtC,gBAAA,GAAmB,IAAA;AAAA,IACnB,YAAA,GAAe;AAAA,GACjB,GAAI,OAAA;AAEJ,EAAA,MAAM,UAAkC,EAAC;AACzC,EAAA,MAAM,QAAkB,EAAC;AAGzB,EAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,IAAA,KAAA,CAAM,IAAA,CAAK,MAAA,CAAO,WAAA,EAAa,CAAA;AAAA,EACjC;AAGA,EAAA,IAAI,WAAW,IAAA,EAAM;AACnB,IAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,GAAG,CAAA;AAC7B,IAAA,KAAA,CAAM,IAAA,CAAK,UAAU,QAAQ,CAAA;AAAA,EAC/B;AAGA,EAAA,IAAI,WAAW,KAAA,EAAO;AACpB,IAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,GAAG,CAAA;AAC7B,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB,SAAA,CAAU,MAAM,CAAA;AACnD,IAAA,MAAM,YAAA,GAAe,KAAA,CAAM,IAAA,CAAK,MAAA,CAAO,SAAS,CAAA,CAC7C,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,CAAC,EAAE,aAAA,CAAc,CAAA,CAAE,CAAC,CAAC,CAAC,CAAA,CACvC,GAAA,CAAI,CAAC,CAAC,CAAA,EAAG,CAAC,CAAA,KAAM,CAAA,EAAG,CAAC,CAAA,CAAA,EAAI,CAAC,CAAA,CAAE,CAAA,CAC3B,KAAK,GAAG,CAAA;AACX,IAAA,KAAA,CAAM,KAAK,YAAY,CAAA;AAAA,EACzB;AAGA,EAAA,IAAI,UAAA,CAAW,QAAQ,IAAA,EAAM;AAC3B,IAAA,KAAA,CAAM,KAAK,IAAI,CAAA;AAAA,EACjB;AAGA,EAAA,IAAI,UAAA,CAAW,aAAa,gBAAA,EAAkB;AAC5C,IAAA,MAAM,SAAA,GAAY,KAAK,KAAA,CAAM,IAAA,CAAK,KAAI,GAAI,GAAI,EAAE,QAAA,EAAS;AACzD,IAAA,OAAA,CAAQ,eAAe,CAAA,GAAI,SAAA;AAC3B,IAAA,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,EACtB;AAGA,EAAA,IAAI,UAAA,CAAW,SAAS,YAAA,EAAc;AACpC,IAAA,MAAM,QAAQ,aAAA,EAAc;AAC5B,IAAA,OAAA,CAAQ,WAAW,CAAA,GAAI,KAAA;AACvB,IAAA,KAAA,CAAM,KAAK,KAAK,CAAA;AAAA,EAClB;AAEA,EAAA,MAAM,SAAA,GAAY,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA;AACjC,EAAA,MAAM,YAAY,MAAM,UAAA,CAAW,SAAA,EAAW,MAAA,EAAQ,WAAW,QAAQ,CAAA;AACzE,EAAA,OAAA,CAAQ,eAAe,CAAA,GAAI,SAAA;AAE3B,EAAA,OAAO,OAAA;AACT;AAKA,SAAS,aAAA,CAAc,SAAiB,EAAA,EAAY;AAClD,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAM,CAAA;AACnC,EAAA,MAAA,CAAO,gBAAgB,KAAK,CAAA;AAC5B,EAAA,OAAO,MAAM,IAAA,CAAK,KAAK,CAAA,CACpB,GAAA,CAAI,OAAK,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,SAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CACxC,KAAK,EAAE,CAAA;AACZ;AASA,eAAsB,eAAA,CACpB,KACA,OAAA,EAC0B;AAC1B,EAAA,MAAM;AAAA,IACJ,MAAA;AAAA,IACA,YAAY,uBAAA,CAAwB,SAAA;AAAA,IACpC,WAAW,uBAAA,CAAwB,QAAA;AAAA,IACnC,kBAAkB,uBAAA,CAAwB,eAAA;AAAA,IAC1C,kBAAkB,uBAAA,CAAwB,eAAA;AAAA,IAC1C,cAAc,uBAAA,CAAwB,WAAA;AAAA,IACtC,aAAa,uBAAA,CAAwB,UAAA;AAAA,IACrC,qBAAqB,uBAAA,CAAwB,kBAAA;AAAA,IAC7C;AAAA,GACF,GAAI,OAAA;AAGJ,EAAA,MAAM,iBAAA,GAAoB,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA;AACzD,EAAA,IAAI,CAAC,iBAAA,EAAmB;AACtB,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,MAAA,EAAQ;AAAA,KACV;AAAA,EACF;AAGA,EAAA,IAAI,WAAW,SAAA,EAAW;AACxB,IAAA,MAAM,SAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA;AACjD,IAAA,IAAI,CAAC,SAAA,EAAW;AACd,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,MAAA,EAAQ;AAAA,OACV;AAAA,IACF;AAEA,IAAA,MAAM,YAAA,GAAe,QAAA,CAAS,SAAA,EAAW,EAAE,CAAA;AAC3C,IAAA,IAAI,KAAA,CAAM,YAAY,CAAA,EAAG;AACvB,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,MAAA,EAAQ;AAAA,OACV;AAAA,IACF;AAEA,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,CAAI,GAAA,GAAM,YAAY,CAAA;AACvC,IAAA,IAAI,MAAM,kBAAA,EAAoB;AAC5B,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,MAAA,EAAQ,CAAA,6CAAA,EAAgD,GAAG,CAAA,QAAA,EAAW,kBAAkB,CAAA,EAAA;AAAA,OAC1F;AAAA,IACF;AAAA,EACF;AAGA,EAAA,MAAM,SAAA,GAAY,gBAAA,GACd,MAAM,gBAAA,CAAiB,KAAK,UAAU,CAAA,GACtC,MAAM,oBAAA,CAAqB,GAAA,EAAK,UAAA,EAAY,EAAE,eAAA,EAAiB,aAAa,CAAA;AAGhF,EAAA,MAAM,oBAAoB,MAAM,UAAA,CAAW,SAAA,EAAW,MAAA,EAAQ,WAAW,QAAQ,CAAA;AAGjF,EAAA,MAAM,KAAA,GAAQ,eAAA,CAAgB,iBAAA,EAAmB,iBAAiB,CAAA;AAElE,EAAA,OAAO;AAAA,IACL,KAAA;AAAA,IACA,MAAA,EAAQ,QAAQ,MAAA,GAAY,oBAAA;AAAA,IAC5B,QAAA,EAAU,iBAAA;AAAA,IACV,QAAA,EAAU,iBAAA;AAAA,IACV;AAAA,GACF;AACF;AASA,SAAS,uBAAuB,MAAA,EAA0B;AACxD,EAAA,OAAO,IAAI,QAAA;AAAA,IACT,KAAK,SAAA,CAAU;AAAA,MACb,KAAA,EAAO,cAAA;AAAA,MACP,OAAA,EAAS,MAAA;AAAA,MACT,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,IACD;AAAA,MACE,MAAA,EAAQ,GAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB;AAChD,GACF;AACF;AAKO,SAAS,kBAAA,CACd,SACA,OAAA,EACiD;AACjD,EAAA,OAAO,OAAO,KAAkB,GAAA,KAA8B;AAE5D,IAAA,IAAI,QAAQ,IAAA,IAAQ,MAAM,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAA,EAAG;AAC3C,MAAA,OAAO,OAAA,CAAQ,KAAK,GAAG,CAAA;AAAA,IACzB;AAGA,IAAA,MAAM,MAAA,GAAS,MAAM,eAAA,CAAgB,GAAA,EAAK,OAAO,CAAA;AAEjD,IAAA,IAAI,CAAC,OAAO,KAAA,EAAO;AACjB,MAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,sBAAA;AACvC,MAAA,OAAO,SAAA,CAAU,MAAA,CAAO,MAAA,IAAU,mBAAmB,CAAA;AAAA,IACvD;AAEA,IAAA,OAAO,OAAA,CAAQ,KAAK,GAAG,CAAA;AAAA,EACzB,CAAA;AACF;;;AChaO,IAAM,sBAAA,GAA8G;AAAA,EACzH,WAAA,EAAa,SAAA;AAAA,EACb,UAAA,EAAY,EAAA;AAAA,EACZ,GAAA,EAAK,GAAA;AAAA;AAAA,EACL,QAAA,EAAU,IAAA;AAAA,EACV,SAAA,EAAW,EAAA;AAAA,EACX,SAAA,EAAW;AACb;AAcO,IAAM,mBAAN,MAA6C;AAAA,EAC1C,MAAA,uBAAsC,GAAA,EAAI;AAAA,EAC1C,OAAA;AAAA,EACA,eAAA,GAAyD,IAAA;AAAA,EAEjE,WAAA,CAAY,OAAA,GAAmF,EAAC,EAAG;AACjG,IAAA,MAAM,EAAE,OAAA,GAAU,GAAA,EAAQ,cAAc,IAAA,EAAM,iBAAA,GAAoB,KAAM,GAAI,OAAA;AAC5E,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAEf,IAAA,IAAI,WAAA,EAAa;AACf,MAAA,IAAA,CAAK,eAAA,GAAkB,YAAY,MAAM;AACvC,QAAA,IAAA,CAAK,OAAA,EAAQ;AAAA,MACf,GAAG,iBAAiB,CAAA;AAGpB,MAAA,IAAI,IAAA,CAAK,gBAAgB,KAAA,EAAO;AAC9B,QAAA,IAAA,CAAK,gBAAgB,KAAA,EAAM;AAAA,MAC7B;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,KAAA,EAAiC;AAC5C,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,KAAK,CAAA;AACnC,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,OAAO,KAAA;AAAA,IACT;AAGA,IAAA,IAAI,IAAA,CAAK,GAAA,EAAI,GAAI,KAAA,CAAM,SAAA,EAAW;AAChC,MAAA,IAAA,CAAK,MAAA,CAAO,OAAO,KAAK,CAAA;AACxB,MAAA,OAAO,KAAA;AAAA,IACT;AAEA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,GAAA,CAAI,KAAA,EAAe,GAAA,EAA4B;AAEnD,IAAA,IAAI,IAAA,CAAK,MAAA,CAAO,IAAA,IAAQ,IAAA,CAAK,OAAA,EAAS;AACpC,MAAA,IAAA,CAAK,WAAA,EAAY;AAAA,IACnB;AAEA,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IAAA,CAAK,MAAA,CAAO,IAAI,KAAA,EAAO;AAAA,MACrB,SAAA,EAAW,GAAA;AAAA,MACX,WAAW,GAAA,GAAM;AAAA,KAClB,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,OAAA,GAAyB;AAC7B,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,KAAA,MAAW,CAAC,KAAA,EAAO,KAAK,KAAK,IAAA,CAAK,MAAA,CAAO,SAAQ,EAAG;AAClD,MAAA,IAAI,GAAA,GAAM,MAAM,SAAA,EAAW;AACzB,QAAA,IAAA,CAAK,MAAA,CAAO,OAAO,KAAK,CAAA;AAAA,MAC1B;AAAA,IACF;AAAA,EACF;AAAA,EAEA,QAAA,GAAuD;AACrD,IAAA,IAAI,eAAA;AAEJ,IAAA,KAAA,MAAW,KAAA,IAAS,IAAA,CAAK,MAAA,CAAO,MAAA,EAAO,EAAG;AACxC,MAAA,IAAI,CAAC,eAAA,IAAmB,KAAA,CAAM,SAAA,GAAY,eAAA,EAAiB;AACzD,QAAA,eAAA,GAAkB,KAAA,CAAM,SAAA;AAAA,MAC1B;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,KAAK,MAAA,CAAO,IAAA;AAAA,MAClB;AAAA,KACF;AAAA,EACF;AAAA,EAEQ,WAAA,GAAoB;AAE1B,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,UAAU,GAAG,CAAA;AAC7C,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,IAAA,CAAK,OAAO,OAAA,EAAS,CAAA,CAC7C,IAAA,CAAK,CAAC,CAAA,EAAG,MAAM,CAAA,CAAE,CAAC,CAAA,CAAE,SAAA,GAAY,CAAA,CAAE,CAAC,EAAE,SAAS,CAAA,CAC9C,KAAA,CAAM,CAAA,EAAG,QAAQ,CAAA;AAEpB,IAAA,KAAA,MAAW,CAAC,KAAK,CAAA,IAAK,OAAA,EAAS;AAC7B,MAAA,IAAA,CAAK,MAAA,CAAO,OAAO,KAAK,CAAA;AAAA,IAC1B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,KAAA,GAAc;AACZ,IAAA,IAAA,CAAK,OAAO,KAAA,EAAM;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA,EAKA,OAAA,GAAgB;AACd,IAAA,IAAI,KAAK,eAAA,EAAiB;AACxB,MAAA,aAAA,CAAc,KAAK,eAAe,CAAA;AAClC,MAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AAAA,IACzB;AAAA,EACF;AACF;AAMA,IAAI,gBAAA,GAA4C,IAAA;AAKzC,SAAS,mBAAA,GAAwC;AACtD,EAAA,IAAI,CAAC,gBAAA,EAAkB;AACrB,IAAA,gBAAA,GAAmB,IAAI,gBAAA,EAAiB;AAAA,EAC1C;AACA,EAAA,OAAO,gBAAA;AACT;AASO,SAASA,cAAAA,CAAc,SAAiB,EAAA,EAAY;AACzD,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAM,CAAA;AACnC,EAAA,MAAA,CAAO,gBAAgB,KAAK,CAAA;AAC5B,EAAA,OAAO,MAAM,IAAA,CAAK,KAAK,CAAA,CACpB,GAAA,CAAI,OAAK,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,SAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CACxC,KAAK,EAAE,CAAA;AACZ;AAKO,SAAS,kBAAA,CAAmB,KAAA,EAAe,SAAA,GAAoB,EAAA,EAAI,YAAoB,GAAA,EAAc;AAC1G,EAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,EAAU;AACvC,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,KAAA,CAAM,MAAA,GAAS,SAAA,IAAa,KAAA,CAAM,SAAS,SAAA,EAAW;AACxD,IAAA,OAAO,KAAA;AAAA,EACT;AAGA,EAAA,OAAO,kBAAA,CAAmB,KAAK,KAAK,CAAA;AACtC;AASO,SAAS,YAAA,CAAa,GAAA,EAAkB,OAAA,GAAmC,EAAC,EAAkB;AACnG,EAAA,MAAM;AAAA,IACJ,cAAc,sBAAA,CAAuB,WAAA;AAAA,IACrC,aAAa,sBAAA,CAAuB;AAAA,GACtC,GAAI,OAAA;AAGJ,EAAA,MAAM,WAAA,GAAc,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA;AAC/C,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,OAAO,WAAA;AAAA,EACT;AAGA,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,GAAA,CAAI,GAAG,CAAA;AAC3B,IAAA,MAAM,UAAA,GAAa,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,UAAU,CAAA;AAClD,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,OAAO,UAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT;AAKA,eAAsB,WAAA,CACpB,GAAA,EACA,OAAA,GAAmC,EAAC,EACR;AAC5B,EAAA,MAAM;AAAA,IACJ,QAAQ,mBAAA,EAAoB;AAAA,IAC5B,cAAc,sBAAA,CAAuB,WAAA;AAAA,IACrC,aAAa,sBAAA,CAAuB,UAAA;AAAA,IACpC,MAAM,sBAAA,CAAuB,GAAA;AAAA,IAC7B,WAAW,sBAAA,CAAuB,QAAA;AAAA,IAClC,YAAY,sBAAA,CAAuB,SAAA;AAAA,IACnC,YAAY,sBAAA,CAAuB,SAAA;AAAA,IACnC;AAAA,GACF,GAAI,OAAA;AAGJ,EAAA,MAAM,QAAQ,YAAA,CAAa,GAAA,EAAK,EAAE,WAAA,EAAa,YAAY,CAAA;AAG3D,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,OAAO;AAAA,QACL,QAAA,EAAU,KAAA;AAAA;AAAA,QACV,KAAA,EAAO,IAAA;AAAA,QACP,MAAA,EAAQ;AAAA,OACV;AAAA,IACF;AACA,IAAA,OAAO;AAAA,MACL,QAAA,EAAU;AAAA,KACZ;AAAA,EACF;AAGA,EAAA,IAAI,CAAC,kBAAA,CAAmB,KAAA,EAAO,SAAA,EAAW,SAAS,CAAA,EAAG;AACpD,IAAA,OAAO;AAAA,MACL,QAAA,EAAU,KAAA;AAAA,MACV,KAAA;AAAA,MACA,MAAA,EAAQ,CAAA,qCAAA,EAAwC,SAAS,CAAA,CAAA,EAAI,SAAS,CAAA,eAAA;AAAA,KACxE;AAAA,EACF;AAGA,EAAA,IAAI,QAAA,EAAU;AACZ,IAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,KAAK,CAAA;AACpC,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,OAAO;AAAA,QACL,QAAA,EAAU,KAAA;AAAA,QACV,KAAA;AAAA,QACA,MAAA,EAAQ;AAAA,OACV;AAAA,IACF;AAAA,EACF;AAGA,EAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,MAAA,CAAO,KAAK,CAAA;AACvC,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,OAAO;AAAA,MACL,QAAA,EAAU,IAAA;AAAA,MACV,KAAA;AAAA,MACA,MAAA,EAAQ;AAAA,KACV;AAAA,EACF;AAGA,EAAA,MAAM,KAAA,CAAM,GAAA,CAAI,KAAA,EAAO,GAAG,CAAA;AAE1B,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,KAAA;AAAA,IACV;AAAA,GACF;AACF;AASA,SAAS,sBAAsB,KAAA,EAAyB;AACtD,EAAA,OAAO,IAAI,QAAA;AAAA,IACT,KAAK,SAAA,CAAU;AAAA,MACb,KAAA,EAAO,WAAA;AAAA,MACP,OAAA,EAAS,yBAAA;AAAA,MACT,IAAA,EAAM,iBAAA;AAAA,MACN;AAAA,KACD,CAAA;AAAA,IACD;AAAA,MACE,MAAA,EAAQ,GAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB;AAChD,GACF;AACF;AAKA,SAAS,4BAA4B,MAAA,EAA0B;AAC7D,EAAA,OAAO,IAAI,QAAA;AAAA,IACT,KAAK,SAAA,CAAU;AAAA,MACb,KAAA,EAAO,aAAA;AAAA,MACP,OAAA,EAAS,MAAA;AAAA,MACT,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,IACD;AAAA,MACE,MAAA,EAAQ,GAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB;AAChD,GACF;AACF;AAKO,SAAS,oBAAA,CACd,OAAA,EACA,OAAA,GAAmC,EAAC,EACa;AACjD,EAAA,OAAO,OAAO,KAAkB,GAAA,KAA8B;AAE5D,IAAA,IAAI,QAAQ,IAAA,IAAQ,MAAM,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAA,EAAG;AAC3C,MAAA,OAAO,OAAA,CAAQ,KAAK,GAAG,CAAA;AAAA,IACzB;AAGA,IAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,GAAA,EAAK,OAAO,CAAA;AAG7C,IAAA,IAAI,OAAO,QAAA,EAAU;AACnB,MAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,qBAAA;AACrC,MAAA,OAAO,QAAA,CAAS,OAAO,KAAM,CAAA;AAAA,IAC/B;AAGA,IAAA,IAAI,MAAA,CAAO,MAAA,IAAU,OAAA,CAAQ,QAAA,KAAa,KAAA,EAAO;AAC/C,MAAA,OAAO,2BAAA,CAA4B,OAAO,MAAM,CAAA;AAAA,IAClD;AAEA,IAAA,OAAO,OAAA,CAAQ,KAAK,GAAG,CAAA;AAAA,EACzB,CAAA;AACF;AASO,SAAS,eACd,OAAA,GAAkC,EAAC,EACnC,OAAA,GAAoD,EAAC,EAC7B;AACxB,EAAA,MAAM,EAAE,UAAA,GAAa,SAAA,EAAW,MAAA,GAAS,IAAG,GAAI,OAAA;AAChD,EAAA,OAAO;AAAA,IACL,GAAG,OAAA;AAAA,IACH,CAAC,UAAU,GAAGA,cAAAA,CAAc,MAAM;AAAA,GACpC;AACF;;;AC3WO,IAAM,yBAAA,GAAuG;AAAA,EAClH,eAAA,EAAiB,aAAA;AAAA,EACjB,MAAA,EAAQ,MAAA;AAAA,EACR,MAAA,EAAQ,GAAA;AAAA;AAAA,EACR,WAAA,EAAa,KAAA;AAAA,EACb,SAAA,EAAW,EAAA;AAAA;AAAA,EACX,QAAA,EAAU;AACZ;AASO,SAAS,cAAA,CAAe,KAAA,EAAe,MAAA,GAA0B,MAAA,EAAuB;AAC7F,EAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,EAAU;AACvC,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,IAAI;AACF,IAAA,QAAQ,MAAA;AAAQ,MACd,KAAK,MAAA,EAAQ;AACX,QAAA,MAAM,GAAA,GAAM,QAAA,CAAS,KAAA,EAAO,EAAE,CAAA;AAC9B,QAAA,IAAI,KAAA,CAAM,GAAG,CAAA,IAAK,GAAA,IAAO,CAAA,EAAG;AAC1B,UAAA,OAAO,IAAA;AAAA,QACT;AACA,QAAA,OAAO,GAAA;AAAA,MACT;AAAA,MAEA,KAAK,SAAA,EAAW;AACd,QAAA,MAAM,GAAA,GAAM,QAAA,CAAS,KAAA,EAAO,EAAE,CAAA;AAC9B,QAAA,IAAI,KAAA,CAAM,GAAG,CAAA,IAAK,GAAA,IAAO,CAAA,EAAG;AAC1B,UAAA,OAAO,IAAA;AAAA,QACT;AACA,QAAA,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,GAAI,CAAA;AAAA,MAC9B;AAAA,MAEA,KAAK,SAAA,EAAW;AACd,QAAA,MAAM,IAAA,GAAO,IAAI,IAAA,CAAK,KAAK,CAAA;AAC3B,QAAA,IAAI,KAAA,CAAM,IAAA,CAAK,OAAA,EAAS,CAAA,EAAG;AACzB,UAAA,OAAO,IAAA;AAAA,QACT;AACA,QAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,OAAA,KAAY,GAAI,CAAA;AAAA,MACzC;AAAA,MAEA;AACE,QAAA,OAAO,IAAA;AAAA;AACX,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAKO,SAAS,eAAA,CAAgB,SAA0B,MAAA,EAAgB;AACxE,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AAErB,EAAA,QAAQ,MAAA;AAAQ,IACd,KAAK,MAAA;AACH,MAAA,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,GAAI,EAAE,QAAA,EAAS;AAAA,IACzC,KAAK,SAAA;AACH,MAAA,OAAO,IAAI,QAAA,EAAS;AAAA,IACtB,KAAK,SAAA;AACH,MAAA,OAAO,IAAI,IAAA,CAAK,GAAG,CAAA,CAAE,WAAA,EAAY;AAAA,IACnC;AACE,MAAA,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,GAAI,EAAE,QAAA,EAAS;AAAA;AAE7C;AASO,SAAS,gBAAA,CAAiB,GAAA,EAAkB,OAAA,GAA4B,EAAC,EAAkB;AAChG,EAAA,MAAM;AAAA,IACJ,kBAAkB,yBAAA,CAA0B,eAAA;AAAA,IAC5C;AAAA,GACF,GAAI,OAAA;AAGJ,EAAA,MAAM,eAAA,GAAkB,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA;AACvD,EAAA,IAAI,eAAA,EAAiB;AACnB,IAAA,OAAO,eAAA;AAAA,EACT;AAGA,EAAA,IAAI,cAAA,EAAgB;AAClB,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,GAAA,CAAI,GAAG,CAAA;AAC3B,IAAA,MAAM,cAAA,GAAiB,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,cAAc,CAAA;AAC1D,IAAA,IAAI,cAAA,EAAgB;AAClB,MAAA,OAAO,cAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT;AASO,SAAS,iBAAA,CACd,GAAA,EACA,OAAA,GAA4B,EAAC,EACZ;AACjB,EAAA,MAAM;AAAA,IACJ,kBAAkB,yBAAA,CAA0B,eAAA;AAAA,IAC5C,cAAA;AAAA,IACA,SAAS,yBAAA,CAA0B,MAAA;AAAA,IACnC,SAAS,yBAAA,CAA0B,MAAA;AAAA,IACnC,cAAc,yBAAA,CAA0B,WAAA;AAAA,IACxC,YAAY,yBAAA,CAA0B,SAAA;AAAA,IACtC,WAAW,yBAAA,CAA0B;AAAA,GACvC,GAAI,OAAA;AAGJ,EAAA,MAAM,eAAe,gBAAA,CAAiB,GAAA,EAAK,EAAE,eAAA,EAAiB,gBAAgB,CAAA;AAG9E,EAAA,IAAI,CAAC,YAAA,EAAc;AACjB,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,MAAA,EAAQ;AAAA,OACV;AAAA,IACF;AACA,IAAA,OAAO;AAAA,MACL,KAAA,EAAO;AAAA,KACT;AAAA,EACF;AAGA,EAAA,MAAM,SAAA,GAAY,cAAA,CAAe,YAAA,EAAc,MAAM,CAAA;AACrD,EAAA,IAAI,cAAc,IAAA,EAAM;AACtB,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,MAAA,EAAQ,uCAAuC,MAAM,CAAA,CAAA;AAAA,KACvD;AAAA,EACF;AAGA,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,EAAA,MAAM,MAAM,GAAA,GAAM,SAAA;AAGlB,EAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,SAAA;AAAA,MACA,GAAA;AAAA,MACA,MAAA,EAAQ,CAAA,wBAAA,EAA2B,GAAG,CAAA,QAAA,EAAW,MAAM,CAAA,EAAA;AAAA,KACzD;AAAA,EACF;AAGA,EAAA,IAAI,MAAM,CAAA,EAAG;AACX,IAAA,IAAI,CAAC,WAAA,EAAa;AAChB,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,SAAA;AAAA,QACA,GAAA;AAAA,QACA,MAAA,EAAQ;AAAA,OACV;AAAA,IACF;AAGA,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA;AAC9B,IAAA,IAAI,YAAY,SAAA,EAAW;AACzB,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,SAAA;AAAA,QACA,GAAA;AAAA,QACA,MAAA,EAAQ,CAAA,6BAAA,EAAgC,SAAS,CAAA,QAAA,EAAW,SAAS,CAAA,EAAA;AAAA,OACvE;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,IAAA;AAAA,IACP,SAAA;AAAA,IACA;AAAA,GACF;AACF;AAKO,SAAS,gBAAA,CACd,YAAA,EACA,OAAA,GAAoG,EAAC,EAC5F;AACT,EAAA,MAAM;AAAA,IACJ,MAAA,GAAS,MAAA;AAAA,IACT,MAAA,GAAS,GAAA;AAAA,IACT,WAAA,GAAc,KAAA;AAAA,IACd,SAAA,GAAY;AAAA,GACd,GAAI,OAAA;AAEJ,EAAA,MAAM,SAAA,GAAY,cAAA,CAAe,YAAA,EAAc,MAAM,CAAA;AACrD,EAAA,IAAI,cAAc,IAAA,EAAM;AACtB,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,EAAA,MAAM,MAAM,GAAA,GAAM,SAAA;AAGlB,EAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,IAAA,OAAO,KAAA;AAAA,EACT;AAGA,EAAA,IAAI,MAAM,CAAA,EAAG;AACX,IAAA,IAAI,CAAC,WAAA,EAAa;AAChB,MAAA,OAAO,KAAA;AAAA,IACT;AACA,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,GAAI,SAAA,EAAW;AAC7B,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT;AASA,SAASC,wBAAuB,MAAA,EAA0B;AACxD,EAAA,OAAO,IAAI,QAAA;AAAA,IACT,KAAK,SAAA,CAAU;AAAA,MACb,KAAA,EAAO,aAAA;AAAA,MACP,OAAA,EAAS,MAAA;AAAA,MACT,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,IACD;AAAA,MACE,MAAA,EAAQ,GAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB;AAChD,GACF;AACF;AAKO,SAAS,aAAA,CACd,OAAA,EACA,OAAA,GAA4B,EAAC,EACoB;AACjD,EAAA,OAAO,OAAO,KAAkB,GAAA,KAA8B;AAE5D,IAAA,IAAI,QAAQ,IAAA,IAAQ,MAAM,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAA,EAAG;AAC3C,MAAA,OAAO,OAAA,CAAQ,KAAK,GAAG,CAAA;AAAA,IACzB;AAGA,IAAA,MAAM,MAAA,GAAS,iBAAA,CAAkB,GAAA,EAAK,OAAO,CAAA;AAE7C,IAAA,IAAI,CAAC,OAAO,KAAA,EAAO;AACjB,MAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAaA,uBAAAA;AACvC,MAAA,OAAO,SAAA,CAAU,MAAA,CAAO,MAAA,IAAU,mBAAmB,CAAA;AAAA,IACvD;AAEA,IAAA,OAAO,OAAA,CAAQ,KAAK,GAAG,CAAA;AAAA,EACzB,CAAA;AACF;AASO,SAAS,mBACd,OAAA,GAAkC,EAAC,EACnC,OAAA,GAA6D,EAAC,EACtC;AACxB,EAAA,MAAM,EAAE,UAAA,GAAa,aAAA,EAAe,MAAA,GAAS,QAAO,GAAI,OAAA;AACxD,EAAA,OAAO;AAAA,IACL,GAAG,OAAA;AAAA,IACH,CAAC,UAAU,GAAG,eAAA,CAAgB,MAAM;AAAA,GACtC;AACF;AAKO,SAAS,aAAA,CAAc,GAAA,EAAkB,OAAA,GAA4B,EAAC,EAAkB;AAC7F,EAAA,MAAM,YAAA,GAAe,gBAAA,CAAiB,GAAA,EAAK,OAAO,CAAA;AAClD,EAAA,IAAI,CAAC,YAAA,EAAc;AACjB,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,SAAA,GAAY,cAAA,CAAe,YAAA,EAAc,OAAA,CAAQ,MAAM,CAAA;AAC7D,EAAA,IAAI,cAAc,IAAA,EAAM;AACtB,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,EAAA,OAAO,GAAA,GAAM,SAAA;AACf;;;AC1TO,IAAM,0BAAA,GAAkO;AAAA,EAC7O,MAAA,EAAQ,QAAA;AAAA,EACR,aAAA,EAAe,eAAA;AAAA,EACf,YAAA,EAAc,SAAA;AAAA,EACd,qBAAA,EAAuB;AACzB;AASA,SAAS,iBAAA,CAAkB,KAAkB,UAAA,EAAmC;AAC9E,EAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA;AACnC;AAKA,SAAS,gBAAA,CAAiB,KAAkB,UAAA,EAAmC;AAC7E,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,GAAA,CAAI,GAAG,CAAA;AAC3B,EAAA,OAAO,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,UAAU,CAAA;AACxC;AAKA,SAAS,eAAA,CAAgB,KAAkB,OAAA,EAAiC;AAC1E,EAAA,IAAI,CAAC,OAAA,EAAS;AAEZ,IAAA,OAAA,GAAU,sBAAA;AAAA,EACZ;AAEA,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,GAAA,CAAI,GAAG,CAAA;AAC3B,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,QAAA,CAAS,KAAA,CAAM,OAAO,CAAA;AAExC,EAAA,IAAI,KAAA,IAAS,KAAA,CAAM,CAAC,CAAA,EAAG;AACrB,IAAA,OAAO,MAAM,CAAC,CAAA;AAAA,EAChB;AAEA,EAAA,OAAO,IAAA;AACT;AAKA,SAAS,iBAAA,CAAkB,KAAkB,OAAA,EAAiC;AAC5E,EAAA,MAAM,MAAA,GAAS,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA;AACvC,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,IAAI,CAAC,OAAA,EAAS;AAEZ,IAAA,OAAA,GAAU,yBAAA;AAAA,EACZ;AAEA,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA;AAClC,EAAA,IAAI,KAAA,IAAS,KAAA,CAAM,CAAC,CAAA,EAAG;AACrB,IAAA,OAAO,MAAM,CAAC,CAAA;AAAA,EAChB;AAEA,EAAA,OAAO,IAAA;AACT;AAKO,SAAS,cAAA,CACd,KACA,OAAA,EAC0D;AAC1D,EAAA,MAAM;AAAA,IACJ,SAAS,0BAAA,CAA2B,MAAA;AAAA,IACpC,gBAAgB,0BAAA,CAA2B,aAAA;AAAA,IAC3C,eAAe,0BAAA,CAA2B,YAAA;AAAA,IAC1C,WAAA;AAAA,IACA,aAAA;AAAA,IACA;AAAA,GACF,GAAI,OAAA;AAEJ,EAAA,IAAI,OAAA,GAAyB,IAAA;AAC7B,EAAA,IAAI,eAAA,GAAwC,IAAA;AAE5C,EAAA,QAAQ,MAAA;AAAQ,IACd,KAAK,QAAA;AACH,MAAA,OAAA,GAAU,iBAAA,CAAkB,KAAK,aAAa,CAAA;AAC9C,MAAA,eAAA,GAAkB,UAAU,QAAA,GAAW,IAAA;AACvC,MAAA;AAAA,IAEF,KAAK,OAAA;AACH,MAAA,OAAA,GAAU,gBAAA,CAAiB,KAAK,YAAY,CAAA;AAC5C,MAAA,eAAA,GAAkB,UAAU,OAAA,GAAU,IAAA;AACtC,MAAA;AAAA,IAEF,KAAK,MAAA;AACH,MAAA,OAAA,GAAU,eAAA,CAAgB,KAAK,WAAW,CAAA;AAC1C,MAAA,eAAA,GAAkB,UAAU,MAAA,GAAS,IAAA;AACrC,MAAA;AAAA,IAEF,KAAK,QAAA;AACH,MAAA,OAAA,GAAU,iBAAA,CAAkB,KAAK,aAAa,CAAA;AAC9C,MAAA,eAAA,GAAkB,UAAU,QAAA,GAAW,IAAA;AACvC,MAAA;AAAA;AAIJ,EAAA,IAAI,WAAW,YAAA,EAAc;AAC3B,IAAA,OAAA,GAAU,aAAa,OAAO,CAAA;AAAA,EAChC;AAEA,EAAA,OAAO,EAAE,OAAA,EAAS,MAAA,EAAQ,eAAA,EAAgB;AAC5C;AAKO,SAAS,yBAAA,CACd,KACA,OAAA,EACA,OAAA,GAA2B,CAAC,QAAA,EAAU,OAAA,EAAS,MAAA,EAAQ,QAAQ,CAAA,EACL;AAC1D,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,IAAA,MAAM,SAAS,cAAA,CAAe,GAAA,EAAK,EAAE,GAAG,OAAA,EAAS,QAAQ,CAAA;AACzD,IAAA,IAAI,OAAO,OAAA,EAAS;AAClB,MAAA,OAAO,MAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAK;AACvC;AASO,SAAS,gBAAA,CACd,SACA,OAAA,EACsB;AACtB,EAAA,MAAM,EAAE,SAAS,SAAA,EAAW,UAAA,GAAa,EAAC,EAAG,MAAA,GAAS,EAAC,EAAE,GAAI,OAAA;AAE7D,EAAA,IAAI,YAAY,OAAA,EAAS;AACvB,IAAA,OAAO,SAAA;AAAA,EACT;AAEA,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,OAAO,CAAA,EAAG;AAC5B,IAAA,OAAO,QAAA;AAAA,EACT;AAEA,EAAA,IAAI,UAAA,CAAW,QAAA,CAAS,OAAO,CAAA,EAAG;AAChC,IAAA,OAAO,YAAA;AAAA,EACT;AAEA,EAAA,IAAI,SAAA,CAAU,QAAA,CAAS,OAAO,CAAA,EAAG;AAC/B,IAAA,OAAO,WAAA;AAAA,EACT;AAEA,EAAA,OAAO,IAAA;AACT;AAKO,SAAS,kBAAA,CAAmB,SAAiB,OAAA,EAAqC;AACvF,EAAA,MAAM,MAAA,GAAS,gBAAA,CAAiB,OAAA,EAAS,OAAO,CAAA;AAChD,EAAA,OAAO,MAAA,KAAW,SAAA,IAAa,MAAA,KAAW,WAAA,IAAe,MAAA,KAAW,YAAA;AACtE;AASO,SAAS,eAAA,CACd,KACA,OAAA,EACe;AACf,EAAA,MAAM,EAAE,OAAA,EAAS,SAAA,EAAW,UAAA,GAAa,EAAC,EAAG,MAAA,GAAS,EAAC,EAAG,WAAA,GAAc,EAAC,EAAE,GAAI,OAAA;AAG/E,EAAA,MAAM,EAAE,OAAA,EAAS,MAAA,EAAO,GAAI,cAAA,CAAe,KAAK,OAAO,CAAA;AAGvD,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,OAAA;AAAA,MACT,MAAA,EAAQ,IAAA;AAAA,MACR,MAAA,EAAQ,SAAA;AAAA,MACR,KAAA,EAAO;AAAA,KACT;AAAA,EACF;AAGA,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,OAAO,CAAA,EAAG;AAC5B,IAAA,MAAM,UAAA,GAAa,YAAY,OAAO,CAAA;AACtC,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,MAAA;AAAA,MACA,MAAA,EAAQ,QAAA;AAAA,MACR,KAAA,EAAO,KAAA;AAAA,MACP,MAAA,EAAQ,CAAA,YAAA,EAAe,OAAO,CAAA,gBAAA,EAAmB,UAAA,GAAa,OAAO,UAAA,CAAW,WAAA,EAAa,CAAA,CAAA,GAAK,EAAE,CAAA,CAAA;AAAA,MACpG;AAAA,KACF;AAAA,EACF;AAGA,EAAA,IAAI,UAAA,CAAW,QAAA,CAAS,OAAO,CAAA,EAAG;AAChC,IAAA,MAAM,UAAA,GAAa,YAAY,OAAO,CAAA;AACtC,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,MAAA;AAAA,MACA,MAAA,EAAQ,YAAA;AAAA,MACR,KAAA,EAAO,IAAA;AAAA,MACP;AAAA,KACF;AAAA,EACF;AAGA,EAAA,IAAI,YAAY,OAAA,EAAS;AACvB,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,MAAA;AAAA,MACA,MAAA,EAAQ,SAAA;AAAA,MACR,KAAA,EAAO;AAAA,KACT;AAAA,EACF;AAGA,EAAA,IAAI,SAAA,CAAU,QAAA,CAAS,OAAO,CAAA,EAAG;AAC/B,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,MAAA;AAAA,MACA,MAAA,EAAQ,WAAA;AAAA,MACR,KAAA,EAAO;AAAA,KACT;AAAA,EACF;AAGA,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,MAAA;AAAA,IACA,MAAA,EAAQ,IAAA;AAAA,IACR,KAAA,EAAO,KAAA;AAAA,IACP,MAAA,EAAQ,CAAA,yBAAA,EAA4B,OAAO,CAAA,sBAAA,EAAyB,CAAC,OAAA,EAAS,GAAG,SAAS,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,GACxG;AACF;AASO,SAAS,qBAAA,CACd,QAAA,EACA,OAAA,EACA,UAAA,EACU;AACV,EAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,QAAA,CAAS,OAAO,CAAA;AAG5C,EAAA,OAAA,CAAQ,GAAA,CAAI,eAAe,MAAM,CAAA;AAGjC,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,OAAA,CAAQ,GAAA,CAAI,QAAA,EAAU,UAAA,CAAW,WAAA,EAAa,CAAA;AAAA,EAChD;AAGA,EAAA,OAAA,CAAQ,GAAA;AAAA,IACN,SAAA;AAAA,IACA,CAAA,mBAAA,EAAsB,OAAO,CAAA,cAAA,EAAiB,UAAA,GAAa,2BAA2B,UAAA,CAAW,WAAA,EAAY,CAAE,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAC,KAAK,EAAE,CAAA,CAAA;AAAA,GACrI;AAEA,EAAA,OAAO,IAAI,QAAA,CAAS,QAAA,CAAS,IAAA,EAAM;AAAA,IACjC,QAAQ,QAAA,CAAS,MAAA;AAAA,IACjB,YAAY,QAAA,CAAS,UAAA;AAAA,IACrB;AAAA,GACD,CAAA;AACH;AASA,SAAS,0BAAA,CAA2B,SAAiB,iBAAA,EAAuC;AAC1F,EAAA,OAAO,IAAI,QAAA;AAAA,IACT,KAAK,SAAA,CAAU;AAAA,MACb,KAAA,EAAO,aAAA;AAAA,MACP,OAAA,EAAS,4BAA4B,OAAO,CAAA,CAAA;AAAA,MAC5C,IAAA,EAAM,qBAAA;AAAA,MACN;AAAA,KACD,CAAA;AAAA,IACD;AAAA,MACE,MAAA,EAAQ,GAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB;AAChD,GACF;AACF;AAKA,SAAS,qBAAA,CAAsB,SAAiB,UAAA,EAA6B;AAC3E,EAAA,OAAO,IAAI,QAAA;AAAA,IACT,KAAK,SAAA,CAAU;AAAA,MACb,KAAA,EAAO,MAAA;AAAA,MACP,OAAA,EAAS,CAAA,YAAA,EAAe,OAAO,CAAA,uBAAA,EAA0B,aAAa,CAAA,mBAAA,EAAsB,UAAA,CAAW,WAAA,EAAY,CAAE,MAAM,GAAG,CAAA,CAAE,CAAC,CAAC,KAAK,EAAE,CAAA,CAAA;AAAA,MACzI,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,IACD;AAAA,MACE,MAAA,EAAQ,GAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB;AAChD,GACF;AACF;AAKO,SAAS,cAAA,CACd,SACA,OAAA,EACiD;AACjD,EAAA,OAAO,OAAO,KAAkB,GAAA,KAA8B;AAE5D,IAAA,IAAI,QAAQ,IAAA,IAAQ,MAAM,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAA,EAAG;AAC3C,MAAA,OAAO,OAAA,CAAQ,KAAK,GAAG,CAAA;AAAA,IACzB;AAGA,IAAA,MAAM,MAAA,GAAS,eAAA,CAAgB,GAAA,EAAK,OAAO,CAAA;AAG3C,IAAA,IAAI,MAAA,CAAO,WAAW,QAAA,EAAU;AAC9B,MAAA,OAAO,qBAAA,CAAsB,MAAA,CAAO,OAAA,EAAU,MAAA,CAAO,UAAU,CAAA;AAAA,IACjE;AAGA,IAAA,IAAI,CAAC,OAAO,KAAA,EAAO;AACjB,MAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,aAAA,KAC5B,CAAC,CAAA,KAAc,0BAAA,CAA2B,CAAA,EAAG,CAAC,OAAA,CAAQ,OAAA,EAAS,GAAG,OAAA,CAAQ,SAAS,CAAC,CAAA,CAAA;AAEtF,MAAA,OAAO,aAAA,CAAc,OAAO,OAAQ,CAAA;AAAA,IACtC;AAGA,IAAA,IAAI,QAAA,GAAW,MAAM,OAAA,CAAQ,GAAA,EAAK,GAAG,CAAA;AAGrC,IAAA,IAAI,MAAA,CAAO,WAAW,YAAA,EAAc;AAElC,MAAA,IAAI,QAAQ,YAAA,EAAc;AACxB,QAAA,OAAA,CAAQ,YAAA,CAAa,MAAA,CAAO,OAAA,EAAU,MAAA,CAAO,UAAU,CAAA;AAAA,MACzD;AAGA,MAAA,IAAI,OAAA,CAAQ,0BAA0B,KAAA,EAAO;AAC3C,QAAA,QAAA,GAAW,qBAAA,CAAsB,QAAA,EAAU,MAAA,CAAO,OAAA,EAAU,OAAO,UAAU,CAAA;AAAA,MAC/E;AAAA,IACF;AAEA,IAAA,OAAO,QAAA;AAAA,EACT,CAAA;AACF;AAWO,SAAS,mBAAA,CACd,UACA,OAAA,EACiD;AACjD,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA;AACrC,EAAA,MAAM,iBAAiB,OAAA,CAAQ,OAAA,IAAW,QAAA,CAAS,QAAA,CAAS,SAAS,CAAC,CAAA;AAEtE,EAAA,OAAO,OAAO,KAAkB,GAAA,KAA8B;AAE5D,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,cAAA,CAAe,GAAA,EAAK;AAAA,MACtC,GAAG,OAGL,CAAC,CAAA;AAGD,IAAA,MAAM,gBAAgB,OAAA,IAAW,cAAA;AAGjC,IAAA,MAAM,OAAA,GAAU,SAAS,aAAa,CAAA;AACtC,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,OAAO,0BAAA,CAA2B,eAAe,QAAQ,CAAA;AAAA,IAC3D;AAEA,IAAA,OAAO,OAAA,CAAQ,KAAK,GAAG,CAAA;AAAA,EACzB,CAAA;AACF;AASO,SAAS,eAAA,CAAgB,GAAW,CAAA,EAAmB;AAC5D,EAAA,MAAM,SAAS,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA,CAAE,IAAI,MAAM,CAAA;AACtC,EAAA,MAAM,SAAS,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA,CAAE,IAAI,MAAM,CAAA;AAEtC,EAAA,MAAM,YAAY,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,MAAA,EAAQ,OAAO,MAAM,CAAA;AAEvD,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,SAAA,EAAW,CAAA,EAAA,EAAK;AAClC,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,CAAC,CAAA,IAAK,CAAA;AAC1B,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,CAAC,CAAA,IAAK,CAAA;AAE1B,IAAA,IAAI,IAAA,GAAO,MAAM,OAAO,CAAA;AACxB,IAAA,IAAI,IAAA,GAAO,MAAM,OAAO,EAAA;AAAA,EAC1B;AAEA,EAAA,OAAO,CAAA;AACT;AAKO,SAAS,gBAAA,CAAiB,SAAiB,OAAA,EAA0B;AAC1E,EAAA,OAAO,eAAA,CAAgB,OAAA,EAAS,OAAO,CAAA,IAAK,CAAA;AAC9C;AAKO,SAAS,iBAAiB,OAAA,EAAyB;AAExD,EAAA,OAAA,GAAU,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAGnC,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAA;AAC/B,EAAA,OAAO,KAAA,CAAM,SAAS,CAAA,EAAG;AACvB,IAAA,KAAA,CAAM,KAAK,GAAG,CAAA;AAAA,EAChB;AAEA,EAAA,OAAO,KAAA,CAAM,KAAK,GAAG,CAAA;AACvB;;;AC5cO,IAAM,2BAAA,GAA+H;AAAA,EAC1I,SAAA,EAAW,iBAAA;AAAA,EACX,GAAA,EAAK,KAAA;AAAA;AAAA,EACL,QAAA,EAAU,KAAA;AAAA,EACV,OAAA,EAAS,CAAC,MAAA,EAAQ,KAAA,EAAO,OAAO,CAAA;AAAA,EAChC,YAAA,EAAc,EAAA;AAAA,EACd,YAAA,EAAc,GAAA;AAAA,EACd,eAAA,EAAiB,IAAA;AAAA,EACjB,WAAA,EAAa,GAAA;AAAA;AAAA,EACb,WAAA,EAAa,IAAA;AAAA,EACb,WAAA,EAAa;AAAA;AACf;AAmBO,IAAM,yBAAN,MAAyD;AAAA,EACtD,KAAA,uBAA2C,GAAA,EAAI;AAAA,EAC/C,UAAA,uBAA+C,GAAA,EAAI;AAAA,EACnD,OAAA;AAAA,EACA,eAAA,GAAyD,IAAA;AAAA,EAEjE,WAAA,CAAY,OAAA,GAAmF,EAAC,EAAG;AACjG,IAAA,MAAM,EAAE,OAAA,GAAU,GAAA,EAAO,cAAc,IAAA,EAAM,iBAAA,GAAoB,KAAM,GAAI,OAAA;AAC3E,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAEf,IAAA,IAAI,WAAA,EAAa;AACf,MAAA,IAAA,CAAK,eAAA,GAAkB,YAAY,MAAM;AACvC,QAAA,IAAA,CAAK,OAAA,EAAQ;AAAA,MACf,GAAG,iBAAiB,CAAA;AAEpB,MAAA,IAAI,IAAA,CAAK,gBAAgB,KAAA,EAAO;AAC9B,QAAA,IAAA,CAAK,gBAAgB,KAAA,EAAM;AAAA,MAC7B;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,IAAI,GAAA,EAA6C;AACrD,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAChC,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,OAAO,IAAA;AAAA,IACT;AAGA,IAAA,IAAI,IAAA,CAAK,GAAA,EAAI,GAAI,KAAA,CAAM,SAAA,EAAW;AAChC,MAAA,IAAA,CAAK,KAAA,CAAM,OAAO,GAAG,CAAA;AACrB,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,OAAO,KAAA,CAAM,QAAA;AAAA,EACf;AAAA,EAEA,MAAM,GAAA,CAAI,GAAA,EAAa,QAAA,EAA0B,GAAA,EAA4B;AAE3E,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,IAAA,IAAQ,IAAA,CAAK,OAAA,EAAS;AACnC,MAAA,IAAA,CAAK,WAAA,EAAY;AAAA,IACnB;AAEA,IAAA,IAAA,CAAK,KAAA,CAAM,IAAI,GAAA,EAAK;AAAA,MAClB,QAAA;AAAA,MACA,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI;AAAA,KACzB,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,aAAa,GAAA,EAA+B;AAChD,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,GAAG,CAAA;AACrC,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,OAAO,KAAA;AAAA,IACT;AAGA,IAAA,IAAI,IAAA,CAAK,GAAA,EAAI,GAAI,KAAA,CAAM,SAAA,EAAW;AAChC,MAAA,IAAA,CAAK,UAAA,CAAW,OAAO,GAAG,CAAA;AAC1B,MAAA,OAAO,KAAA;AAAA,IACT;AAEA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,eAAA,CAAgB,GAAA,EAAa,OAAA,EAAmC;AAEpE,IAAA,IAAI,MAAM,IAAA,CAAK,YAAA,CAAa,GAAG,CAAA,EAAG;AAChC,MAAA,OAAO,KAAA;AAAA,IACT;AAEA,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IAAA,CAAK,UAAA,CAAW,IAAI,GAAA,EAAK;AAAA,MACvB,SAAA,EAAW,GAAA;AAAA,MACX,WAAW,GAAA,GAAM;AAAA,KAClB,CAAA;AAED,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,cAAc,GAAA,EAA4B;AAC9C,IAAA,IAAA,CAAK,UAAA,CAAW,OAAO,GAAG,CAAA;AAAA,EAC5B;AAAA,EAEA,MAAM,OAAO,GAAA,EAA4B;AACvC,IAAA,IAAA,CAAK,KAAA,CAAM,OAAO,GAAG,CAAA;AACrB,IAAA,IAAA,CAAK,UAAA,CAAW,OAAO,GAAG,CAAA;AAAA,EAC5B;AAAA,EAEA,MAAM,OAAA,GAAyB;AAC7B,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AAGrB,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,IAAA,CAAK,KAAA,CAAM,SAAQ,EAAG;AAC/C,MAAA,IAAI,GAAA,GAAM,MAAM,SAAA,EAAW;AACzB,QAAA,IAAA,CAAK,KAAA,CAAM,OAAO,GAAG,CAAA;AAAA,MACvB;AAAA,IACF;AAGA,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,IAAA,CAAK,UAAA,CAAW,SAAQ,EAAG;AACpD,MAAA,IAAI,GAAA,GAAM,MAAM,SAAA,EAAW;AACzB,QAAA,IAAA,CAAK,UAAA,CAAW,OAAO,GAAG,CAAA;AAAA,MAC5B;AAAA,IACF;AAAA,EACF;AAAA,EAEA,QAAA,GAA0D;AACxD,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,KAAK,KAAA,CAAM,IAAA;AAAA,MACtB,cAAA,EAAgB,KAAK,UAAA,CAAW;AAAA,KAClC;AAAA,EACF;AAAA,EAEQ,WAAA,GAAoB;AAE1B,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,UAAU,GAAG,CAAA;AAC7C,IAAA,MAAM,OAAA,GAAU,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA,CAC5C,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,EAAE,CAAC,CAAA,CAAE,QAAA,CAAS,QAAA,GAAW,CAAA,CAAE,CAAC,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA,CAC9D,KAAA,CAAM,CAAA,EAAG,QAAQ,CAAA;AAEpB,IAAA,KAAA,MAAW,CAAC,GAAG,CAAA,IAAK,OAAA,EAAS;AAC3B,MAAA,IAAA,CAAK,KAAA,CAAM,OAAO,GAAG,CAAA;AAAA,IACvB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,KAAA,GAAc;AACZ,IAAA,IAAA,CAAK,MAAM,KAAA,EAAM;AACjB,IAAA,IAAA,CAAK,WAAW,KAAA,EAAM;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA,EAKA,OAAA,GAAgB;AACd,IAAA,IAAI,KAAK,eAAA,EAAiB;AACxB,MAAA,aAAA,CAAc,KAAK,eAAe,CAAA;AAClC,MAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AAAA,IACzB;AAAA,EACF;AACF;AAMA,IAAI,sBAAA,GAAwD,IAAA;AAKrD,SAAS,yBAAA,GAAoD;AAClE,EAAA,IAAI,CAAC,sBAAA,EAAwB;AAC3B,IAAA,sBAAA,GAAyB,IAAI,sBAAA,EAAuB;AAAA,EACtD;AACA,EAAA,OAAO,sBAAA;AACT;AASO,SAAS,sBAAA,CAAuB,SAAiB,EAAA,EAAY;AAClE,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAM,CAAA;AACnC,EAAA,MAAA,CAAO,gBAAgB,KAAK,CAAA;AAC5B,EAAA,OAAO,MAAM,IAAA,CAAK,KAAK,CAAA,CACpB,GAAA,CAAI,OAAK,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,SAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CACxC,KAAK,EAAE,CAAA;AACZ;AAKA,eAAsB,gBAAgB,IAAA,EAA+B;AACnE,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,MAAA,CAAO,IAAI,CAAA;AAChC,EAAA,MAAM,aAAa,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,WAAW,IAAI,CAAA;AAC7D,EAAA,MAAM,SAAA,GAAY,IAAI,UAAA,CAAW,UAAU,CAAA;AAC3C,EAAA,OAAO,MAAM,IAAA,CAAK,SAAS,CAAA,CACxB,GAAA,CAAI,OAAK,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,SAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CACxC,KAAK,EAAE,CAAA;AACZ;AAKO,SAAS,qBAAA,CACd,GAAA,EACA,SAAA,GAAoB,EAAA,EACpB,YAAoB,GAAA,EACX;AACT,EAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,QAAA,EAAU;AACnC,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,GAAA,CAAI,MAAA,GAAS,SAAA,IAAa,GAAA,CAAI,SAAS,SAAA,EAAW;AACpD,IAAA,OAAO,KAAA;AAAA,EACT;AAGA,EAAA,OAAO,kBAAA,CAAmB,KAAK,GAAG,CAAA;AACpC;AAKA,eAAsB,cAAA,CACpB,cAAA,EACA,GAAA,EACA,QAAA,GAAoB,IAAA,EACH;AACjB,EAAA,MAAM,KAAA,GAAQ,CAAC,cAAA,EAAgB,GAAA,CAAI,MAAA,EAAQ,IAAI,GAAA,CAAI,GAAA,CAAI,GAAG,CAAA,CAAE,QAAQ,CAAA;AAEpE,EAAA,IAAI,QAAA,EAAU;AACZ,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,IAAI,KAAA,EAAM;AACzB,MAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,IAAA,EAAK;AAC/B,MAAA,IAAI,IAAA,EAAM;AACR,QAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,IAAI,CAAA;AAC3C,QAAA,KAAA,CAAM,KAAK,QAAQ,CAAA;AAAA,MACrB;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAEA,EAAA,OAAO,KAAA,CAAM,KAAK,GAAG,CAAA;AACvB;AASO,SAAS,qBAAA,CACd,GAAA,EACA,OAAA,GAA8B,EAAC,EAChB;AACf,EAAA,MAAM,EAAE,SAAA,GAAY,2BAAA,CAA4B,SAAA,EAAU,GAAI,OAAA;AAC9D,EAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,SAAS,CAAA;AAClC;AAKA,eAAsB,gBAAA,CACpB,GAAA,EACA,OAAA,GAA8B,EAAC,EACH;AAC5B,EAAA,MAAM;AAAA,IACJ,QAAQ,yBAAA,EAA0B;AAAA,IAClC,YAAY,2BAAA,CAA4B,SAAA;AAAA,IACxC,WAAW,2BAAA,CAA4B,QAAA;AAAA,IACvC,UAAU,2BAAA,CAA4B,OAAA;AAAA,IACtC,eAAe,2BAAA,CAA4B,YAAA;AAAA,IAC3C,eAAe,2BAAA,CAA4B,YAAA;AAAA,IAC3C,eAAA,EAAiB,WAAW,2BAAA,CAA4B,eAAA;AAAA,IACxD;AAAA,GACF,GAAI,OAAA;AAGJ,EAAA,MAAM,MAAA,GAAS,GAAA,CAAI,MAAA,CAAO,WAAA,EAAY;AACtC,EAAA,IAAI,CAAC,OAAA,CAAQ,QAAA,CAAS,MAAM,CAAA,EAAG;AAC7B,IAAA,OAAO;AAAA,MACL,GAAA,EAAK,IAAA;AAAA,MACL,SAAA,EAAW,KAAA;AAAA,MACX,YAAA,EAAc;AAAA,KAChB;AAAA,EACF;AAGA,EAAA,MAAM,GAAA,GAAM,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,SAAS,CAAA;AAGrC,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,OAAO;AAAA,QACL,GAAA,EAAK,IAAA;AAAA,QACL,SAAA,EAAW,KAAA;AAAA,QACX,YAAA,EAAc,KAAA;AAAA,QACd,MAAA,EAAQ;AAAA,OACV;AAAA,IACF;AACA,IAAA,OAAO;AAAA,MACL,GAAA,EAAK,IAAA;AAAA,MACL,SAAA,EAAW,KAAA;AAAA,MACX,YAAA,EAAc;AAAA,KAChB;AAAA,EACF;AAGA,EAAA,IAAI,CAAC,qBAAA,CAAsB,GAAA,EAAK,YAAA,EAAc,YAAY,CAAA,EAAG;AAC3D,IAAA,OAAO;AAAA,MACL,GAAA;AAAA,MACA,SAAA,EAAW,KAAA;AAAA,MACX,YAAA,EAAc,KAAA;AAAA,MACd,MAAA,EAAQ,CAAA,+CAAA,EAAkD,YAAY,CAAA,CAAA,EAAI,YAAY,CAAA,eAAA;AAAA,KACxF;AAAA,EACF;AAGA,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,MAAM,OAAA,GAAU,MAAM,WAAA,CAAY,GAAG,CAAA;AACrC,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,OAAO;AAAA,QACL,GAAA;AAAA,QACA,SAAA,EAAW,KAAA;AAAA,QACX,YAAA,EAAc,KAAA;AAAA,QACd,MAAA,EAAQ;AAAA,OACV;AAAA,IACF;AAAA,EACF;AAGA,EAAA,MAAM,QAAA,GAAW,MAAM,cAAA,CAAe,GAAA,EAAK,KAAK,QAAQ,CAAA;AAGxD,EAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,GAAA,CAAI,QAAQ,CAAA;AACvC,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,OAAO;AAAA,MACL,GAAA;AAAA,MACA,SAAA,EAAW,IAAA;AAAA,MACX,cAAA,EAAgB,MAAA;AAAA,MAChB,YAAA,EAAc;AAAA,KAChB;AAAA,EACF;AAGA,EAAA,MAAM,YAAA,GAAe,MAAM,KAAA,CAAM,YAAA,CAAa,QAAQ,CAAA;AAEtD,EAAA,OAAO;AAAA,IACL,GAAA;AAAA,IACA,SAAA,EAAW,KAAA;AAAA,IACX,YAAA;AAAA,IACA,MAAA,EAAQ,eAAe,sCAAA,GAAyC;AAAA,GAClE;AACF;AASA,eAAsB,cACpB,GAAA,EACA,GAAA,EACA,QAAA,EACA,OAAA,GAA8B,EAAC,EAChB;AACf,EAAA,MAAM;AAAA,IACJ,QAAQ,yBAAA,EAA0B;AAAA,IAClC,MAAM,2BAAA,CAA4B,GAAA;AAAA,IAClC,eAAA,EAAiB,WAAW,2BAAA,CAA4B;AAAA,GAC1D,GAAI,OAAA;AAGJ,EAAA,MAAM,QAAA,GAAW,MAAM,cAAA,CAAe,GAAA,EAAK,KAAK,QAAQ,CAAA;AAGxD,EAAA,MAAM,MAAA,GAAS,SAAS,KAAA,EAAM;AAC9B,EAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,IAAA,EAAK;AAG/B,EAAA,MAAM,UAAkC,EAAC;AACzC,EAAA,QAAA,CAAS,OAAA,CAAQ,OAAA,CAAQ,CAAC,KAAA,EAAO,IAAA,KAAS;AACxC,IAAA,OAAA,CAAQ,IAAI,CAAA,GAAI,KAAA;AAAA,EAClB,CAAC,CAAA;AAGD,EAAA,MAAM,cAAA,GAAiC;AAAA,IACrC,QAAQ,QAAA,CAAS,MAAA;AAAA,IACjB,OAAA;AAAA,IACA,IAAA;AAAA,IACA,QAAA,EAAU,KAAK,GAAA;AAAI,GACrB;AAEA,EAAA,MAAM,KAAA,CAAM,GAAA,CAAI,QAAA,EAAU,cAAA,EAAgB,GAAG,CAAA;AAG7C,EAAA,MAAM,KAAA,CAAM,cAAc,QAAQ,CAAA;AACpC;AAKO,SAAS,wBAAwB,MAAA,EAAkC;AACxE,EAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,MAAA,CAAO,OAAO,CAAA;AAG1C,EAAA,OAAA,CAAQ,GAAA,CAAI,0BAA0B,MAAM,CAAA;AAC5C,EAAA,OAAA,CAAQ,GAAA,CAAI,2BAA2B,IAAI,IAAA,CAAK,OAAO,QAAQ,CAAA,CAAE,aAAa,CAAA;AAE9E,EAAA,OAAO,IAAI,QAAA,CAAS,MAAA,CAAO,IAAA,EAAM;AAAA,IAC/B,QAAQ,MAAA,CAAO,MAAA;AAAA,IACf;AAAA,GACD,CAAA;AACH;AASA,SAAS,qBAAqB,MAAA,EAA0B;AACtD,EAAA,OAAO,IAAI,QAAA;AAAA,IACT,KAAK,SAAA,CAAU;AAAA,MACb,KAAA,EAAO,aAAA;AAAA,MACP,OAAA,EAAS,MAAA;AAAA,MACT,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,IACD;AAAA,MACE,MAAA,EAAQ,GAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB;AAChD,GACF;AACF;AAKA,eAAe,WAAA,CACb,KAAA,EACA,QAAA,EACA,WAAA,EACA,eAAuB,GAAA,EACS;AAChC,EAAA,MAAM,SAAA,GAAY,KAAK,GAAA,EAAI;AAE3B,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA,GAAY,WAAA,EAAa;AAE3C,IAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,GAAA,CAAI,QAAQ,CAAA;AACvC,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,OAAO,MAAA;AAAA,IACT;AAGA,IAAA,MAAM,YAAA,GAAe,MAAM,KAAA,CAAM,YAAA,CAAa,QAAQ,CAAA;AACtD,IAAA,IAAI,CAAC,YAAA,EAAc;AAEjB,MAAA,OAAO,IAAA;AAAA,IACT;AAGA,IAAA,MAAM,IAAI,OAAA,CAAQ,CAAA,OAAA,KAAW,UAAA,CAAW,OAAA,EAAS,YAAY,CAAC,CAAA;AAAA,EAChE;AAEA,EAAA,OAAO,IAAA;AACT;AAKO,SAAS,eAAA,CACd,OAAA,EACA,OAAA,GAA8B,EAAC,EACkB;AACjD,EAAA,OAAO,OAAO,KAAkB,GAAA,KAA8B;AAE5D,IAAA,IAAI,QAAQ,IAAA,IAAQ,MAAM,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAA,EAAG;AAC3C,MAAA,OAAO,OAAA,CAAQ,KAAK,GAAG,CAAA;AAAA,IACzB;AAEA,IAAA,MAAM;AAAA,MACJ,QAAQ,yBAAA,EAA0B;AAAA,MAClC,UAAU,2BAAA,CAA4B,OAAA;AAAA,MACtC,eAAA,EAAiB,WAAW,2BAAA,CAA4B,eAAA;AAAA,MACxD,cAAc,2BAAA,CAA4B,WAAA;AAAA,MAC1C,WAAA,EAAa,aAAa,2BAAA,CAA4B,WAAA;AAAA,MACtD,cAAc,2BAAA,CAA4B,WAAA;AAAA,MAC1C,OAAA;AAAA,MACA;AAAA,KACF,GAAI,OAAA;AAGJ,IAAA,MAAM,MAAA,GAAS,GAAA,CAAI,MAAA,CAAO,WAAA,EAAY;AACtC,IAAA,IAAI,CAAC,OAAA,CAAQ,QAAA,CAAS,MAAM,CAAA,EAAG;AAC7B,MAAA,OAAO,OAAA,CAAQ,KAAK,GAAG,CAAA;AAAA,IACzB;AAGA,IAAA,MAAM,MAAA,GAAS,MAAM,gBAAA,CAAiB,GAAA,EAAK,OAAO,CAAA;AAGlD,IAAA,IAAI,MAAA,CAAO,MAAA,IAAU,CAAC,MAAA,CAAO,YAAA,EAAc;AACzC,MAAA,MAAM,eAAe,OAAA,IAAW,oBAAA;AAChC,MAAA,OAAO,YAAA,CAAa,OAAO,MAAM,CAAA;AAAA,IACnC;AAGA,IAAA,IAAI,MAAA,CAAO,SAAA,IAAa,MAAA,CAAO,cAAA,EAAgB;AAC7C,MAAA,IAAI,UAAA,EAAY;AACd,QAAA,UAAA,CAAW,MAAA,CAAO,GAAA,EAAM,MAAA,CAAO,cAAc,CAAA;AAAA,MAC/C;AACA,MAAA,OAAO,uBAAA,CAAwB,OAAO,cAAc,CAAA;AAAA,IACtD;AAGA,IAAA,IAAI,CAAC,OAAO,GAAA,EAAK;AACf,MAAA,OAAO,OAAA,CAAQ,KAAK,GAAG,CAAA;AAAA,IACzB;AAGA,IAAA,MAAM,WAAW,MAAM,cAAA,CAAe,MAAA,CAAO,GAAA,EAAK,KAAK,QAAQ,CAAA;AAG/D,IAAA,IAAI,OAAO,YAAA,EAAc;AACvB,MAAA,IAAI,UAAA,EAAY;AACd,QAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,KAAA,EAAO,UAAU,WAAW,CAAA;AAC7D,QAAA,IAAI,MAAA,EAAQ;AACV,UAAA,IAAI,UAAA,EAAY;AACd,YAAA,UAAA,CAAW,MAAA,CAAO,KAAK,MAAM,CAAA;AAAA,UAC/B;AACA,UAAA,OAAO,wBAAwB,MAAM,CAAA;AAAA,QACvC;AAAA,MACF;AAEA,MAAA,OAAO,IAAI,QAAA;AAAA,QACT,KAAK,SAAA,CAAU;AAAA,UACb,KAAA,EAAO,UAAA;AAAA,UACP,OAAA,EAAS,gEAAA;AAAA,UACT,IAAA,EAAM;AAAA,SACP,CAAA;AAAA,QACD;AAAA,UACE,MAAA,EAAQ,GAAA;AAAA,UACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB;AAChD,OACF;AAAA,IACF;AAGA,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,eAAA,CAAgB,UAAU,WAAW,CAAA;AAClE,IAAA,IAAI,CAAC,QAAA,EAAU;AAEb,MAAA,IAAI,UAAA,EAAY;AACd,QAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,KAAA,EAAO,UAAU,WAAW,CAAA;AAC7D,QAAA,IAAI,MAAA,EAAQ;AACV,UAAA,IAAI,UAAA,EAAY;AACd,YAAA,UAAA,CAAW,MAAA,CAAO,KAAK,MAAM,CAAA;AAAA,UAC/B;AACA,UAAA,OAAO,wBAAwB,MAAM,CAAA;AAAA,QACvC;AAAA,MACF;AAEA,MAAA,OAAO,IAAI,QAAA;AAAA,QACT,KAAK,SAAA,CAAU;AAAA,UACb,KAAA,EAAO,UAAA;AAAA,UACP,OAAA,EAAS,gEAAA;AAAA,UACT,IAAA,EAAM;AAAA,SACP,CAAA;AAAA,QACD;AAAA,UACE,MAAA,EAAQ,GAAA;AAAA,UACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB;AAChD,OACF;AAAA,IACF;AAEA,IAAA,IAAI;AAEF,MAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,GAAA,EAAK,GAAG,CAAA;AAGvC,MAAA,IAAI,QAAA,CAAS,MAAA,IAAU,GAAA,IAAO,QAAA,CAAS,SAAS,GAAA,EAAK;AACnD,QAAA,MAAM,aAAA,CAAc,MAAA,CAAO,GAAA,EAAK,GAAA,EAAK,UAAU,OAAO,CAAA;AAAA,MACxD,CAAA,MAAO;AAEL,QAAA,MAAM,KAAA,CAAM,cAAc,QAAQ,CAAA;AAAA,MACpC;AAEA,MAAA,OAAO,QAAA;AAAA,IACT,SAAS,KAAA,EAAO;AAEd,MAAA,MAAM,KAAA,CAAM,cAAc,QAAQ,CAAA;AAClC,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF,CAAA;AACF;AASO,SAAS,qBACd,OAAA,GAAkC,EAAC,EACnC,OAAA,GAAiD,EAAC,EAC1B;AACxB,EAAA,MAAM,EAAE,UAAA,GAAa,iBAAA,EAAmB,GAAA,GAAM,sBAAA,IAAyB,GAAI,OAAA;AAC3E,EAAA,OAAO;AAAA,IACL,GAAG,OAAA;AAAA,IACH,CAAC,UAAU,GAAG;AAAA,GAChB;AACF;;;ACtmBA,eAAsB,kBAAA,CACpB,KACA,OAAA,EAC8B;AAC9B,EAAA,MAAM,MAAA,GAA8B;AAAA,IAClC,MAAA,EAAQ;AAAA,GACV;AAGA,EAAA,IAAI,OAAA,CAAQ,cAAc,KAAA,EAAO;AAC/B,IAAA,MAAM,eAAA,GAAkB,iBAAA,CAAkB,GAAA,EAAK,OAAA,CAAQ,SAA6B,CAAA;AACpF,IAAA,MAAA,CAAO,SAAA,GAAY,eAAA;AAEnB,IAAA,IAAI,CAAC,gBAAgB,KAAA,EAAO;AAC1B,MAAA,MAAA,CAAO,MAAA,GAAS,KAAA;AAChB,MAAA,MAAA,CAAO,KAAA,GAAQ;AAAA,QACb,IAAA,EAAM,WAAA;AAAA,QACN,OAAA,EAAS,gBAAgB,MAAA,IAAU;AAAA,OACrC;AACA,MAAA,OAAO,MAAA;AAAA,IACT;AAAA,EACF;AAGA,EAAA,IAAI,OAAA,CAAQ,WAAW,KAAA,EAAO;AAC5B,IAAA,MAAM,aAAa,OAAA,CAAQ,MAAA;AAC3B,IAAA,MAAM,YAAA,GAAe,MAAM,WAAA,CAAY,GAAA,EAAK;AAAA,MAC1C,GAAG,UAAA;AAAA,MACH,KAAA,EAAO,UAAA,CAAW,KAAA,IAAS,mBAAA;AAAoB,KAChD,CAAA;AACD,IAAA,MAAA,CAAO,MAAA,GAAS,YAAA;AAEhB,IAAA,IAAI,aAAa,QAAA,EAAU;AACzB,MAAA,MAAA,CAAO,MAAA,GAAS,KAAA;AAChB,MAAA,MAAA,CAAO,KAAA,GAAQ;AAAA,QACb,IAAA,EAAM,QAAA;AAAA,QACN,OAAA,EAAS,yBAAA;AAAA,QACT,OAAA,EAAS,EAAE,KAAA,EAAO,YAAA,CAAa,KAAA;AAAM,OACvC;AACA,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,IAAI,YAAA,CAAa,MAAA,IAAU,UAAA,CAAW,QAAA,KAAa,KAAA,EAAO;AACxD,MAAA,MAAA,CAAO,MAAA,GAAS,KAAA;AAChB,MAAA,MAAA,CAAO,KAAA,GAAQ;AAAA,QACb,IAAA,EAAM,QAAA;AAAA,QACN,SAAS,YAAA,CAAa;AAAA,OACxB;AACA,MAAA,OAAO,MAAA;AAAA,IACT;AAAA,EACF;AAGA,EAAA,IAAI,OAAA,CAAQ,YAAY,KAAA,EAAO;AAC7B,IAAA,MAAM,cAAc,OAAA,CAAQ,OAAA;AAC5B,IAAA,MAAM,aAAA,GAAgB,MAAM,eAAA,CAAgB,GAAA,EAAK,WAAW,CAAA;AAC5D,IAAA,MAAA,CAAO,OAAA,GAAU,aAAA;AAEjB,IAAA,IAAI,CAAC,cAAc,KAAA,EAAO;AACxB,MAAA,MAAA,CAAO,MAAA,GAAS,KAAA;AAChB,MAAA,MAAA,CAAO,KAAA,GAAQ;AAAA,QACb,IAAA,EAAM,SAAA;AAAA,QACN,OAAA,EAAS,cAAc,MAAA,IAAU;AAAA,OACnC;AACA,MAAA,OAAO,MAAA;AAAA,IACT;AAAA,EACF;AAGA,EAAA,IAAI,OAAA,CAAQ,eAAe,KAAA,EAAO;AAChC,IAAA,MAAM,iBAAiB,OAAA,CAAQ,UAAA;AAC/B,IAAA,MAAM,aAAA,GAAgB,eAAA,CAAgB,GAAA,EAAK,cAAc,CAAA;AACzD,IAAA,MAAA,CAAO,OAAA,GAAU,aAAA;AAEjB,IAAA,IAAI,CAAC,cAAc,KAAA,EAAO;AACxB,MAAA,MAAA,CAAO,MAAA,GAAS,KAAA;AAChB,MAAA,MAAA,CAAO,KAAA,GAAQ;AAAA,QACb,IAAA,EAAM,YAAA;AAAA,QACN,OAAA,EAAS,cAAc,MAAA,IAAU,qBAAA;AAAA,QACjC,OAAA,EAAS,EAAE,OAAA,EAAS,aAAA,CAAc,OAAA;AAAQ,OAC5C;AACA,MAAA,OAAO,MAAA;AAAA,IACT;AAAA,EACF;AAGA,EAAA,IAAI,OAAA,CAAQ,gBAAgB,KAAA,EAAO;AACjC,IAAA,MAAM,kBAAkB,OAAA,CAAQ,WAAA;AAChC,IAAA,MAAM,iBAAA,GAAoB,MAAM,gBAAA,CAAiB,GAAA,EAAK;AAAA,MACpD,GAAG,eAAA;AAAA,MACH,KAAA,EAAO,eAAA,CAAgB,KAAA,IAAS,yBAAA;AAA0B,KAC3D,CAAA;AACD,IAAA,MAAA,CAAO,WAAA,GAAc,iBAAA;AAGrB,IAAA,IAAI,kBAAkB,MAAA,IAAU,CAAC,kBAAkB,YAAA,IAAgB,CAAC,kBAAkB,SAAA,EAAW;AAC/F,MAAA,IAAI,gBAAgB,QAAA,EAAU;AAC5B,QAAA,MAAA,CAAO,MAAA,GAAS,KAAA;AAChB,QAAA,MAAA,CAAO,KAAA,GAAQ;AAAA,UACb,IAAA,EAAM,aAAA;AAAA,UACN,SAAS,iBAAA,CAAkB,MAAA;AAAA,UAC3B,OAAA,EAAS,EAAE,GAAA,EAAK,iBAAA,CAAkB,GAAA;AAAI,SACxC;AACA,QAAA,OAAO,MAAA;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT;AASA,SAASC,sBAAqB,KAAA,EAAmC;AAC/D,EAAA,MAAM,SAAA,GAAsD;AAAA,IAC1D,OAAA,EAAS,GAAA;AAAA,IACT,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,GAAA;AAAA,IACX,UAAA,EAAY,GAAA;AAAA,IACZ,WAAA,EAAa;AAAA,GACf;AAEA,EAAA,MAAM,OAAA,GAAoD;AAAA,IACxD,OAAA,EAAS,mBAAA;AAAA,IACT,MAAA,EAAQ,iBAAA;AAAA,IACR,SAAA,EAAW,mBAAA;AAAA,IACX,UAAA,EAAY,qBAAA;AAAA,IACZ,WAAA,EAAa;AAAA,GACf;AAEA,EAAA,OAAO,IAAI,QAAA;AAAA,IACT,KAAK,SAAA,CAAU;AAAA,MACb,KAAA,EAAO,MAAM,IAAA,KAAS,SAAA,GAAY,iBAAiB,KAAA,CAAM,IAAA,KAAS,WAAW,WAAA,GAAc,aAAA;AAAA,MAC3F,SAAS,KAAA,CAAM,OAAA;AAAA,MACf,IAAA,EAAM,OAAA,CAAQ,KAAA,CAAM,IAAI,CAAA;AAAA,MACxB,GAAI,KAAA,CAAM,OAAA,IAAW;AAAC,KACvB,CAAA;AAAA,IACD;AAAA,MACE,MAAA,EAAQ,SAAA,CAAU,KAAA,CAAM,IAAI,CAAA;AAAA,MAC5B,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB;AAChD,GACF;AACF;AAKO,SAAS,iBAAA,CACd,SACA,OAAA,EACiD;AACjD,EAAA,OAAO,OAAO,KAAkB,GAAA,KAA8B;AAE5D,IAAA,IAAI,QAAQ,IAAA,IAAQ,MAAM,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAA,EAAG;AAC3C,MAAA,OAAO,OAAA,CAAQ,KAAK,GAAG,CAAA;AAAA,IACzB;AAGA,IAAA,MAAM,MAAA,GAAS,MAAM,kBAAA,CAAmB,GAAA,EAAK,OAAO,CAAA;AAGpD,IAAA,IAAI,CAAC,MAAA,CAAO,MAAA,IAAU,MAAA,CAAO,KAAA,EAAO;AAClC,MAAA,MAAM,OAAA,GAAU,QAAQ,OAAA,IAAWA,qBAAAA;AACnC,MAAA,OAAO,OAAA,CAAQ,OAAO,KAAK,CAAA;AAAA,IAC7B;AAGA,IAAA,IAAI,MAAA,CAAO,WAAA,EAAa,SAAA,IAAa,MAAA,CAAO,YAAY,cAAA,EAAgB;AACtE,MAAA,MAAM,kBAAkB,OAAA,CAAQ,WAAA;AAChC,MAAA,IAAI,gBAAgB,UAAA,EAAY;AAC9B,QAAA,eAAA,CAAgB,WAAW,MAAA,CAAO,WAAA,CAAY,GAAA,EAAM,MAAA,CAAO,YAAY,cAAc,CAAA;AAAA,MACvF;AACA,MAAA,OAAO,uBAAA,CAAwB,MAAA,CAAO,WAAA,CAAY,cAAc,CAAA;AAAA,IAClE;AAGA,IAAA,IAAI,MAAA,CAAO,aAAa,YAAA,EAAc;AACpC,MAAA,OAAO,IAAI,QAAA;AAAA,QACT,KAAK,SAAA,CAAU;AAAA,UACb,KAAA,EAAO,UAAA;AAAA,UACP,OAAA,EAAS,gEAAA;AAAA,UACT,IAAA,EAAM;AAAA,SACP,CAAA;AAAA,QACD;AAAA,UACE,MAAA,EAAQ,GAAA;AAAA,UACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB;AAChD,OACF;AAAA,IACF;AAGA,IAAA,IAAI,QAAA,GAAW,MAAM,OAAA,CAAQ,GAAA,EAAK,GAAG,CAAA;AAGrC,IAAA,IAAI,MAAA,CAAO,OAAA,EAAS,MAAA,KAAW,YAAA,EAAc;AAC3C,MAAA,MAAM,iBAAiB,OAAA,CAAQ,UAAA;AAC/B,MAAA,IAAI,cAAA,CAAe,0BAA0B,KAAA,EAAO;AAClD,QAAA,QAAA,GAAW,sBAAsB,QAAA,EAAU,MAAA,CAAO,QAAQ,OAAA,EAAU,MAAA,CAAO,QAAQ,UAAU,CAAA;AAAA,MAC/F;AACA,MAAA,IAAI,eAAe,YAAA,EAAc;AAC/B,QAAA,cAAA,CAAe,aAAa,MAAA,CAAO,OAAA,CAAQ,OAAA,EAAU,MAAA,CAAO,QAAQ,UAAU,CAAA;AAAA,MAChF;AAAA,IACF;AAGA,IAAA,IAAI,MAAA,CAAO,WAAA,EAAa,GAAA,IAAO,OAAA,CAAQ,gBAAgB,KAAA,EAAO;AAC5D,MAAA,MAAM,kBAAkB,OAAA,CAAQ,WAAA;AAChC,MAAA,IAAI,QAAA,CAAS,MAAA,IAAU,GAAA,IAAO,QAAA,CAAS,SAAS,GAAA,EAAK;AACnD,QAAA,MAAM,cAAc,MAAA,CAAO,WAAA,CAAY,GAAA,EAAK,GAAA,EAAK,UAAU,eAAe,CAAA;AAAA,MAC5E;AAAA,IACF;AAEA,IAAA,OAAO,QAAA;AAAA,EACT,CAAA;AACF;AASO,SAAS,uBAAA,CACd,OAAA,EACA,MAAA,EACA,SAAA,GAA2C,EAAC,EACK;AACjD,EAAA,MAAM,YAAA,GAAe,uBAAuB,MAAM,CAAA;AAClD,EAAA,MAAM,aAAA,GAAsC;AAAA,IAC1C,GAAG,YAAA;AAAA,IACH,GAAG;AAAA,GACL;AAGA,EAAA,IAAI,YAAA,CAAa,OAAA,IAAW,OAAO,YAAA,CAAa,OAAA,KAAY,QAAA,IACxD,SAAA,CAAU,OAAA,IAAW,OAAO,SAAA,CAAU,OAAA,KAAY,QAAA,EAAU;AAC9D,IAAA,aAAA,CAAc,UAAU,EAAE,GAAG,aAAa,OAAA,EAAS,GAAG,UAAU,OAAA,EAAQ;AAAA,EAC1E;AACA,EAAA,IAAI,YAAA,CAAa,MAAA,IAAU,OAAO,YAAA,CAAa,MAAA,KAAW,QAAA,IACtD,SAAA,CAAU,MAAA,IAAU,OAAO,SAAA,CAAU,MAAA,KAAW,QAAA,EAAU;AAC5D,IAAA,aAAA,CAAc,SAAS,EAAE,GAAG,aAAa,MAAA,EAAQ,GAAG,UAAU,MAAA,EAAO;AAAA,EACvE;AACA,EAAA,IAAI,YAAA,CAAa,SAAA,IAAa,OAAO,YAAA,CAAa,SAAA,KAAc,QAAA,IAC5D,SAAA,CAAU,SAAA,IAAa,OAAO,SAAA,CAAU,SAAA,KAAc,QAAA,EAAU;AAClE,IAAA,aAAA,CAAc,YAAY,EAAE,GAAG,aAAa,SAAA,EAAW,GAAG,UAAU,SAAA,EAAU;AAAA,EAChF;AACA,EAAA,IAAI,YAAA,CAAa,WAAA,IAAe,OAAO,YAAA,CAAa,WAAA,KAAgB,QAAA,IAChE,SAAA,CAAU,WAAA,IAAe,OAAO,SAAA,CAAU,WAAA,KAAgB,QAAA,EAAU;AACtE,IAAA,aAAA,CAAc,cAAc,EAAE,GAAG,aAAa,WAAA,EAAa,GAAG,UAAU,WAAA,EAAY;AAAA,EACtF;AAEA,EAAA,OAAO,iBAAA,CAAkB,SAAS,aAAa,CAAA;AACjD","file":"api.cjs","sourcesContent":["/**\n * API Security Types\n * @module nextjs-secure/api\n */\n\n// ============================================================================\n// Request Signing Types\n// ============================================================================\n\n/**\n * Supported signing algorithms\n */\nexport type SigningAlgorithm = 'sha256' | 'sha512' | 'sha384' | 'sha1'\n\n/**\n * Signature encoding format\n */\nexport type SignatureEncoding = 'hex' | 'base64' | 'base64url'\n\n/**\n * Components to include in signature\n */\nexport interface SignatureComponents {\n /** Include HTTP method */\n method?: boolean\n /** Include request path */\n path?: boolean\n /** Include query string */\n query?: boolean\n /** Include request body */\n body?: boolean\n /** Include specific headers */\n headers?: string[]\n /** Include timestamp */\n timestamp?: boolean\n /** Include nonce */\n nonce?: boolean\n}\n\n/**\n * Request signing options\n */\nexport interface SigningOptions {\n /** Secret key for HMAC signing */\n secret: string\n /** Signing algorithm (default: sha256) */\n algorithm?: SigningAlgorithm\n /** Signature encoding (default: hex) */\n encoding?: SignatureEncoding\n /** Header name for signature (default: x-signature) */\n signatureHeader?: string\n /** Header name for timestamp (default: x-timestamp) */\n timestampHeader?: string\n /** Header name for nonce (default: x-nonce) */\n nonceHeader?: string\n /** Components to include in signature */\n components?: SignatureComponents\n /** Timestamp tolerance in seconds (default: 300) */\n timestampTolerance?: number\n /** Custom canonical string builder */\n canonicalBuilder?: (req: Request, components: SignatureComponents) => Promise<string>\n /** Custom error response */\n onInvalid?: (reason: string) => Response | Promise<Response>\n /** Skip signing for certain requests */\n skip?: (req: Request) => boolean | Promise<boolean>\n}\n\n/**\n * Signature verification result\n */\nexport interface SignatureResult {\n /** Whether signature is valid */\n valid: boolean\n /** Reason for failure (if invalid) */\n reason?: string\n /** Computed signature (for debugging) */\n computed?: string\n /** Provided signature */\n provided?: string\n /** Canonical string used */\n canonical?: string\n}\n\n// ============================================================================\n// Replay Prevention Types\n// ============================================================================\n\n/**\n * Nonce store interface for replay prevention\n */\nexport interface NonceStore {\n /** Check if nonce exists (has been used) */\n exists(nonce: string): Promise<boolean>\n /** Store a nonce with TTL */\n set(nonce: string, ttl: number): Promise<void>\n /** Remove expired nonces (optional cleanup) */\n cleanup?(): Promise<void>\n /** Get store statistics */\n getStats?(): { size: number; oldestTimestamp?: number }\n}\n\n/**\n * Replay prevention options\n */\nexport interface ReplayPreventionOptions {\n /** Nonce store instance */\n store?: NonceStore\n /** Header name for nonce (default: x-nonce) */\n nonceHeader?: string\n /** Query param name for nonce (optional) */\n nonceQuery?: string\n /** TTL for nonces in milliseconds (default: 300000 = 5 minutes) */\n ttl?: number\n /** Require nonce on all requests (default: true) */\n required?: boolean\n /** Minimum nonce length (default: 16) */\n minLength?: number\n /** Maximum nonce length (default: 128) */\n maxLength?: number\n /** Custom nonce validator */\n validate?: (nonce: string) => boolean | Promise<boolean>\n /** Custom error response */\n onReplay?: (nonce: string) => Response | Promise<Response>\n /** Skip replay check for certain requests */\n skip?: (req: Request) => boolean | Promise<boolean>\n}\n\n/**\n * Replay check result\n */\nexport interface ReplayCheckResult {\n /** Whether request is a replay */\n isReplay: boolean\n /** Nonce value */\n nonce?: string\n /** Reason for failure */\n reason?: string\n}\n\n// ============================================================================\n// Timestamp Validation Types\n// ============================================================================\n\n/**\n * Timestamp format\n */\nexport type TimestampFormat = 'unix' | 'unix-ms' | 'iso8601'\n\n/**\n * Timestamp validation options\n */\nexport interface TimestampOptions {\n /** Header name for timestamp (default: x-timestamp) */\n timestampHeader?: string\n /** Query param name for timestamp (optional) */\n timestampQuery?: string\n /** Expected timestamp format (default: unix) */\n format?: TimestampFormat\n /** Maximum age in seconds (default: 300 = 5 minutes) */\n maxAge?: number\n /** Allow future timestamps (default: false) */\n allowFuture?: boolean\n /** Maximum future time in seconds (default: 60) */\n maxFuture?: number\n /** Require timestamp on all requests (default: true) */\n required?: boolean\n /** Custom error response */\n onInvalid?: (reason: string) => Response | Promise<Response>\n /** Skip timestamp check for certain requests */\n skip?: (req: Request) => boolean | Promise<boolean>\n}\n\n/**\n * Timestamp validation result\n */\nexport interface TimestampResult {\n /** Whether timestamp is valid */\n valid: boolean\n /** Parsed timestamp value */\n timestamp?: number\n /** Age of request in seconds */\n age?: number\n /** Reason for failure */\n reason?: string\n}\n\n// ============================================================================\n// API Versioning Types\n// ============================================================================\n\n/**\n * Version extraction source\n */\nexport type VersionSource = 'header' | 'path' | 'query' | 'accept'\n\n/**\n * Version status\n */\nexport type VersionStatus = 'current' | 'supported' | 'deprecated' | 'sunset'\n\n/**\n * Version information\n */\nexport interface VersionInfo {\n /** Version string */\n version: string\n /** Version status */\n status: VersionStatus\n /** Sunset date (for deprecated versions) */\n sunsetDate?: Date\n /** Deprecation message */\n deprecationMessage?: string\n}\n\n/**\n * API versioning options\n */\nexport interface VersioningOptions {\n /** Version extraction source (default: header) */\n source?: VersionSource\n /** Header name for version (default: x-api-version) */\n versionHeader?: string\n /** Query param name for version */\n versionQuery?: string\n /** Path prefix pattern (e.g., /v{version}/) */\n pathPattern?: RegExp\n /** Accept header media type pattern */\n acceptPattern?: RegExp\n /** Current/default version */\n current: string\n /** All supported versions */\n supported: string[]\n /** Deprecated versions (still work but show warning) */\n deprecated?: string[]\n /** Sunset versions (no longer work) */\n sunset?: string[]\n /** Sunset dates for deprecated versions */\n sunsetDates?: Record<string, Date>\n /** Add deprecation headers to response */\n addDeprecationHeaders?: boolean\n /** Custom version parser */\n parseVersion?: (value: string) => string | null\n /** Custom error response for unsupported version */\n onUnsupported?: (version: string) => Response | Promise<Response>\n /** Custom warning response for deprecated version */\n onDeprecated?: (version: string, sunsetDate?: Date) => void\n /** Skip version check for certain requests */\n skip?: (req: Request) => boolean | Promise<boolean>\n}\n\n/**\n * Version extraction result\n */\nexport interface VersionResult {\n /** Extracted version */\n version: string | null\n /** Version source */\n source: VersionSource | null\n /** Version status */\n status: VersionStatus | null\n /** Whether version is valid */\n valid: boolean\n /** Reason for failure */\n reason?: string\n /** Sunset date (if deprecated) */\n sunsetDate?: Date\n}\n\n// ============================================================================\n// Idempotency Types\n// ============================================================================\n\n/**\n * Cached response for idempotency\n */\nexport interface CachedResponse {\n /** Response status code */\n status: number\n /** Response headers */\n headers: Record<string, string>\n /** Response body */\n body: string\n /** Timestamp when cached */\n cachedAt: number\n /** Request hash for validation */\n requestHash?: string\n}\n\n/**\n * Idempotency store interface\n */\nexport interface IdempotencyStore {\n /** Get cached response for key */\n get(key: string): Promise<CachedResponse | null>\n /** Store response with TTL */\n set(key: string, response: CachedResponse, ttl: number): Promise<void>\n /** Check if key is currently being processed (for concurrent requests) */\n isProcessing(key: string): Promise<boolean>\n /** Mark key as being processed */\n startProcessing(key: string, timeout: number): Promise<boolean>\n /** Mark key as done processing */\n endProcessing(key: string): Promise<void>\n /** Remove a key */\n delete(key: string): Promise<void>\n /** Cleanup expired entries */\n cleanup?(): Promise<void>\n}\n\n/**\n * Idempotency options\n */\nexport interface IdempotencyOptions {\n /** Idempotency store instance */\n store?: IdempotencyStore\n /** Header name for idempotency key (default: idempotency-key) */\n keyHeader?: string\n /** TTL for cached responses in milliseconds (default: 86400000 = 24 hours) */\n ttl?: number\n /** Require idempotency key for mutating requests (default: false) */\n required?: boolean\n /** HTTP methods that require idempotency (default: POST, PUT, PATCH) */\n methods?: string[]\n /** Minimum key length (default: 16) */\n minKeyLength?: number\n /** Maximum key length (default: 256) */\n maxKeyLength?: number\n /** Include request body hash in cache key (default: true) */\n hashRequestBody?: boolean\n /** Lock timeout for concurrent requests in ms (default: 30000) */\n lockTimeout?: number\n /** Wait for lock instead of failing (default: true) */\n waitForLock?: boolean\n /** Max wait time for lock in ms (default: 10000) */\n maxWaitTime?: number\n /** Custom key validator */\n validateKey?: (key: string) => boolean | Promise<boolean>\n /** Custom error response */\n onError?: (reason: string) => Response | Promise<Response>\n /** Skip idempotency for certain requests */\n skip?: (req: Request) => boolean | Promise<boolean>\n /** Called when returning cached response */\n onCacheHit?: (key: string, response: CachedResponse) => void\n}\n\n/**\n * Idempotency check result\n */\nexport interface IdempotencyResult {\n /** Idempotency key */\n key: string | null\n /** Whether response was from cache */\n fromCache: boolean\n /** Cached response (if from cache) */\n cachedResponse?: CachedResponse\n /** Whether request is currently being processed */\n isProcessing: boolean\n /** Reason for any errors */\n reason?: string\n}\n\n// ============================================================================\n// Combined API Protection Types\n// ============================================================================\n\n/**\n * API protection preset names\n */\nexport type APIProtectionPreset = 'basic' | 'standard' | 'strict' | 'financial'\n\n/**\n * Combined API protection options\n */\nexport interface APIProtectionOptions {\n /** Request signing options (false to disable) */\n signing?: SigningOptions | false\n /** Replay prevention options (false to disable) */\n replay?: ReplayPreventionOptions | false\n /** Timestamp validation options (false to disable) */\n timestamp?: TimestampOptions | false\n /** API versioning options (false to disable) */\n versioning?: VersioningOptions | false\n /** Idempotency options (false to disable) */\n idempotency?: IdempotencyOptions | false\n /** Custom error handler */\n onError?: (error: APISecurityError) => Response | Promise<Response>\n /** Skip all checks for certain requests */\n skip?: (req: Request) => boolean | Promise<boolean>\n}\n\n/**\n * API security error\n */\nexport interface APISecurityError {\n /** Error type */\n type: 'signing' | 'replay' | 'timestamp' | 'versioning' | 'idempotency'\n /** Error message */\n message: string\n /** Additional details */\n details?: Record<string, unknown>\n}\n\n/**\n * API protection result\n */\nexport interface APIProtectionResult {\n /** Whether all checks passed */\n passed: boolean\n /** Signing result */\n signing?: SignatureResult\n /** Replay check result */\n replay?: ReplayCheckResult\n /** Timestamp result */\n timestamp?: TimestampResult\n /** Version result */\n version?: VersionResult\n /** Idempotency result */\n idempotency?: IdempotencyResult\n /** Error if any check failed */\n error?: APISecurityError\n}\n\n// ============================================================================\n// Preset Configurations\n// ============================================================================\n\n/**\n * API protection presets\n */\nexport const API_PROTECTION_PRESETS: Record<APIProtectionPreset, Partial<APIProtectionOptions>> = {\n /** Basic: Only timestamp and versioning */\n basic: {\n signing: false,\n replay: false,\n timestamp: {\n maxAge: 600, // 10 minutes\n required: false,\n },\n versioning: false,\n idempotency: false,\n },\n\n /** Standard: Timestamp, replay prevention, versioning */\n standard: {\n signing: false,\n replay: {\n ttl: 300000, // 5 minutes\n required: true,\n },\n timestamp: {\n maxAge: 300, // 5 minutes\n required: true,\n },\n versioning: false,\n idempotency: {\n required: false,\n },\n },\n\n /** Strict: All protections enabled */\n strict: {\n signing: {\n secret: '', // Must be provided\n algorithm: 'sha256',\n timestampTolerance: 300,\n },\n replay: {\n ttl: 300000,\n required: true,\n minLength: 32,\n },\n timestamp: {\n maxAge: 300,\n required: true,\n allowFuture: false,\n },\n versioning: false,\n idempotency: {\n required: true,\n methods: ['POST', 'PUT', 'PATCH', 'DELETE'],\n },\n },\n\n /** Financial: Maximum security for financial APIs */\n financial: {\n signing: {\n secret: '', // Must be provided\n algorithm: 'sha512',\n timestampTolerance: 60, // 1 minute\n components: {\n method: true,\n path: true,\n query: true,\n body: true,\n timestamp: true,\n nonce: true,\n },\n },\n replay: {\n ttl: 86400000, // 24 hours\n required: true,\n minLength: 64,\n },\n timestamp: {\n maxAge: 60, // 1 minute\n required: true,\n allowFuture: false,\n maxFuture: 10,\n },\n versioning: false,\n idempotency: {\n required: true,\n ttl: 604800000, // 7 days\n methods: ['POST', 'PUT', 'PATCH', 'DELETE'],\n hashRequestBody: true,\n },\n },\n}\n","/**\n * Request Signing for API Security\n * @module nextjs-secure/api\n */\n\nimport type { NextRequest } from 'next/server'\nimport type {\n SigningOptions,\n SignatureResult,\n SigningAlgorithm,\n SignatureEncoding,\n SignatureComponents,\n} from './types'\n\n// ============================================================================\n// Default Configuration\n// ============================================================================\n\nexport const DEFAULT_SIGNING_OPTIONS: Required<Omit<SigningOptions, 'secret' | 'canonicalBuilder' | 'onInvalid' | 'skip'>> = {\n algorithm: 'sha256',\n encoding: 'hex',\n signatureHeader: 'x-signature',\n timestampHeader: 'x-timestamp',\n nonceHeader: 'x-nonce',\n components: {\n method: true,\n path: true,\n query: true,\n body: true,\n headers: [],\n timestamp: true,\n nonce: false,\n },\n timestampTolerance: 300, // 5 minutes\n}\n\n// ============================================================================\n// Crypto Utilities\n// ============================================================================\n\n/**\n * Create HMAC signature using Web Crypto API\n */\nexport async function createHMAC(\n data: string,\n secret: string,\n algorithm: SigningAlgorithm = 'sha256',\n encoding: SignatureEncoding = 'hex'\n): Promise<string> {\n const encoder = new TextEncoder()\n const keyData = encoder.encode(secret)\n const messageData = encoder.encode(data)\n\n // Map algorithm names to Web Crypto format\n const hashName = {\n sha1: 'SHA-1',\n sha256: 'SHA-256',\n sha384: 'SHA-384',\n sha512: 'SHA-512',\n }[algorithm]\n\n // Import the key\n const key = await crypto.subtle.importKey(\n 'raw',\n keyData,\n { name: 'HMAC', hash: hashName },\n false,\n ['sign']\n )\n\n // Sign the data\n const signature = await crypto.subtle.sign('HMAC', key, messageData)\n\n // Convert to specified encoding\n return encodeSignature(new Uint8Array(signature), encoding)\n}\n\n/**\n * Encode signature bytes to string\n */\nfunction encodeSignature(bytes: Uint8Array, encoding: SignatureEncoding): string {\n switch (encoding) {\n case 'hex':\n return Array.from(bytes)\n .map(b => b.toString(16).padStart(2, '0'))\n .join('')\n case 'base64':\n return btoa(String.fromCharCode(...bytes))\n case 'base64url':\n return btoa(String.fromCharCode(...bytes))\n .replace(/\\+/g, '-')\n .replace(/\\//g, '_')\n .replace(/=+$/, '')\n default:\n return Array.from(bytes)\n .map(b => b.toString(16).padStart(2, '0'))\n .join('')\n }\n}\n\n/**\n * Timing-safe string comparison\n */\nexport function timingSafeEqual(a: string, b: string): boolean {\n if (a.length !== b.length) {\n return false\n }\n\n let result = 0\n for (let i = 0; i < a.length; i++) {\n result |= a.charCodeAt(i) ^ b.charCodeAt(i)\n }\n\n return result === 0\n}\n\n// ============================================================================\n// Canonical String Building\n// ============================================================================\n\n/**\n * Build canonical string for signing\n */\nexport async function buildCanonicalString(\n req: NextRequest,\n components: SignatureComponents,\n options: { timestampHeader?: string; nonceHeader?: string } = {}\n): Promise<string> {\n const parts: string[] = []\n\n // Method\n if (components.method) {\n parts.push(req.method.toUpperCase())\n }\n\n // Path\n if (components.path) {\n const url = new URL(req.url)\n parts.push(url.pathname)\n }\n\n // Query string (sorted)\n if (components.query) {\n const url = new URL(req.url)\n const params = new URLSearchParams(url.search)\n const sortedParams = Array.from(params.entries())\n .sort((a, b) => a[0].localeCompare(b[0]))\n .map(([k, v]) => `${k}=${v}`)\n .join('&')\n parts.push(sortedParams)\n }\n\n // Request body\n if (components.body) {\n try {\n const cloned = req.clone()\n const body = await cloned.text()\n if (body) {\n parts.push(body)\n }\n } catch {\n // No body or error reading\n }\n }\n\n // Specific headers (sorted)\n if (components.headers && components.headers.length > 0) {\n const headerParts = components.headers\n .map(h => h.toLowerCase())\n .sort()\n .map(h => `${h}:${req.headers.get(h) || ''}`)\n parts.push(headerParts.join('\\n'))\n }\n\n // Timestamp\n if (components.timestamp) {\n const timestampHeader = options.timestampHeader || 'x-timestamp'\n const timestamp = req.headers.get(timestampHeader) || ''\n parts.push(timestamp)\n }\n\n // Nonce\n if (components.nonce) {\n const nonceHeader = options.nonceHeader || 'x-nonce'\n const nonce = req.headers.get(nonceHeader) || ''\n parts.push(nonce)\n }\n\n return parts.join('\\n')\n}\n\n// ============================================================================\n// Signature Generation\n// ============================================================================\n\n/**\n * Generate signature for a request\n */\nexport async function generateSignature(\n req: NextRequest,\n options: SigningOptions\n): Promise<string> {\n const {\n secret,\n algorithm = DEFAULT_SIGNING_OPTIONS.algorithm,\n encoding = DEFAULT_SIGNING_OPTIONS.encoding,\n components = DEFAULT_SIGNING_OPTIONS.components,\n timestampHeader = DEFAULT_SIGNING_OPTIONS.timestampHeader,\n nonceHeader = DEFAULT_SIGNING_OPTIONS.nonceHeader,\n canonicalBuilder,\n } = options\n\n // Build canonical string\n const canonical = canonicalBuilder\n ? await canonicalBuilder(req, components)\n : await buildCanonicalString(req, components, { timestampHeader, nonceHeader })\n\n // Generate HMAC\n return createHMAC(canonical, secret, algorithm, encoding)\n}\n\n/**\n * Generate signature headers for outgoing requests\n */\nexport async function generateSignatureHeaders(\n method: string,\n url: string,\n body: string | null,\n options: SigningOptions & { includeTimestamp?: boolean; includeNonce?: boolean }\n): Promise<Record<string, string>> {\n const {\n secret,\n algorithm = DEFAULT_SIGNING_OPTIONS.algorithm,\n encoding = DEFAULT_SIGNING_OPTIONS.encoding,\n components = DEFAULT_SIGNING_OPTIONS.components,\n signatureHeader = DEFAULT_SIGNING_OPTIONS.signatureHeader,\n timestampHeader = DEFAULT_SIGNING_OPTIONS.timestampHeader,\n nonceHeader = DEFAULT_SIGNING_OPTIONS.nonceHeader,\n includeTimestamp = true,\n includeNonce = false,\n } = options\n\n const headers: Record<string, string> = {}\n const parts: string[] = []\n\n // Method\n if (components.method) {\n parts.push(method.toUpperCase())\n }\n\n // Path\n if (components.path) {\n const parsedUrl = new URL(url)\n parts.push(parsedUrl.pathname)\n }\n\n // Query\n if (components.query) {\n const parsedUrl = new URL(url)\n const params = new URLSearchParams(parsedUrl.search)\n const sortedParams = Array.from(params.entries())\n .sort((a, b) => a[0].localeCompare(b[0]))\n .map(([k, v]) => `${k}=${v}`)\n .join('&')\n parts.push(sortedParams)\n }\n\n // Body\n if (components.body && body) {\n parts.push(body)\n }\n\n // Timestamp\n if (components.timestamp && includeTimestamp) {\n const timestamp = Math.floor(Date.now() / 1000).toString()\n headers[timestampHeader] = timestamp\n parts.push(timestamp)\n }\n\n // Nonce\n if (components.nonce && includeNonce) {\n const nonce = generateNonce()\n headers[nonceHeader] = nonce\n parts.push(nonce)\n }\n\n const canonical = parts.join('\\n')\n const signature = await createHMAC(canonical, secret, algorithm, encoding)\n headers[signatureHeader] = signature\n\n return headers\n}\n\n/**\n * Generate a random nonce\n */\nfunction generateNonce(length: number = 32): string {\n const bytes = new Uint8Array(length)\n crypto.getRandomValues(bytes)\n return Array.from(bytes)\n .map(b => b.toString(16).padStart(2, '0'))\n .join('')\n}\n\n// ============================================================================\n// Signature Verification\n// ============================================================================\n\n/**\n * Verify request signature\n */\nexport async function verifySignature(\n req: NextRequest,\n options: SigningOptions\n): Promise<SignatureResult> {\n const {\n secret,\n algorithm = DEFAULT_SIGNING_OPTIONS.algorithm,\n encoding = DEFAULT_SIGNING_OPTIONS.encoding,\n signatureHeader = DEFAULT_SIGNING_OPTIONS.signatureHeader,\n timestampHeader = DEFAULT_SIGNING_OPTIONS.timestampHeader,\n nonceHeader = DEFAULT_SIGNING_OPTIONS.nonceHeader,\n components = DEFAULT_SIGNING_OPTIONS.components,\n timestampTolerance = DEFAULT_SIGNING_OPTIONS.timestampTolerance,\n canonicalBuilder,\n } = options\n\n // Get provided signature\n const providedSignature = req.headers.get(signatureHeader)\n if (!providedSignature) {\n return {\n valid: false,\n reason: 'Missing signature header',\n }\n }\n\n // Validate timestamp if required\n if (components.timestamp) {\n const timestamp = req.headers.get(timestampHeader)\n if (!timestamp) {\n return {\n valid: false,\n reason: 'Missing timestamp header',\n }\n }\n\n const timestampNum = parseInt(timestamp, 10)\n if (isNaN(timestampNum)) {\n return {\n valid: false,\n reason: 'Invalid timestamp format',\n }\n }\n\n const now = Math.floor(Date.now() / 1000)\n const age = Math.abs(now - timestampNum)\n if (age > timestampTolerance) {\n return {\n valid: false,\n reason: `Timestamp too old or too far in future (age: ${age}s, max: ${timestampTolerance}s)`,\n }\n }\n }\n\n // Build canonical string\n const canonical = canonicalBuilder\n ? await canonicalBuilder(req, components)\n : await buildCanonicalString(req, components, { timestampHeader, nonceHeader })\n\n // Compute expected signature\n const computedSignature = await createHMAC(canonical, secret, algorithm, encoding)\n\n // Compare signatures (timing-safe)\n const valid = timingSafeEqual(providedSignature, computedSignature)\n\n return {\n valid,\n reason: valid ? undefined : 'Signature mismatch',\n computed: computedSignature,\n provided: providedSignature,\n canonical,\n }\n}\n\n// ============================================================================\n// Signing Middleware\n// ============================================================================\n\n/**\n * Default response for invalid signature\n */\nfunction defaultInvalidResponse(reason: string): Response {\n return new Response(\n JSON.stringify({\n error: 'Unauthorized',\n message: reason,\n code: 'INVALID_SIGNATURE',\n }),\n {\n status: 401,\n headers: { 'Content-Type': 'application/json' },\n }\n )\n}\n\n/**\n * Create request signing middleware\n */\nexport function withRequestSigning<T = unknown>(\n handler: (req: NextRequest, ctx: T) => Response | Promise<Response>,\n options: SigningOptions\n): (req: NextRequest, ctx: T) => Promise<Response> {\n return async (req: NextRequest, ctx: T): Promise<Response> => {\n // Check if should skip\n if (options.skip && await options.skip(req)) {\n return handler(req, ctx)\n }\n\n // Verify signature\n const result = await verifySignature(req, options)\n\n if (!result.valid) {\n const onInvalid = options.onInvalid || defaultInvalidResponse\n return onInvalid(result.reason || 'Invalid signature')\n }\n\n return handler(req, ctx)\n }\n}\n\n// ============================================================================\n// Utility Exports\n// ============================================================================\n\nexport {\n generateNonce as createNonce,\n}\n","/**\n * Replay Attack Prevention for API Security\n * @module nextjs-secure/api\n */\n\nimport type { NextRequest } from 'next/server'\nimport type { NonceStore, ReplayPreventionOptions, ReplayCheckResult } from './types'\n\n// ============================================================================\n// Default Configuration\n// ============================================================================\n\nexport const DEFAULT_REPLAY_OPTIONS: Required<Omit<ReplayPreventionOptions, 'store' | 'validate' | 'onReplay' | 'skip'>> = {\n nonceHeader: 'x-nonce',\n nonceQuery: '',\n ttl: 300000, // 5 minutes\n required: true,\n minLength: 16,\n maxLength: 128,\n}\n\n// ============================================================================\n// Memory Nonce Store\n// ============================================================================\n\ninterface NonceEntry {\n timestamp: number\n expiresAt: number\n}\n\n/**\n * In-memory nonce store with LRU eviction\n */\nexport class MemoryNonceStore implements NonceStore {\n private nonces: Map<string, NonceEntry> = new Map()\n private maxSize: number\n private cleanupInterval: ReturnType<typeof setInterval> | null = null\n\n constructor(options: { maxSize?: number; autoCleanup?: boolean; cleanupIntervalMs?: number } = {}) {\n const { maxSize = 100000, autoCleanup = true, cleanupIntervalMs = 60000 } = options\n this.maxSize = maxSize\n\n if (autoCleanup) {\n this.cleanupInterval = setInterval(() => {\n this.cleanup()\n }, cleanupIntervalMs)\n\n // Prevent interval from keeping the process alive\n if (this.cleanupInterval.unref) {\n this.cleanupInterval.unref()\n }\n }\n }\n\n async exists(nonce: string): Promise<boolean> {\n const entry = this.nonces.get(nonce)\n if (!entry) {\n return false\n }\n\n // Check if expired\n if (Date.now() > entry.expiresAt) {\n this.nonces.delete(nonce)\n return false\n }\n\n return true\n }\n\n async set(nonce: string, ttl: number): Promise<void> {\n // Evict oldest entries if at capacity\n if (this.nonces.size >= this.maxSize) {\n this.evictOldest()\n }\n\n const now = Date.now()\n this.nonces.set(nonce, {\n timestamp: now,\n expiresAt: now + ttl,\n })\n }\n\n async cleanup(): Promise<void> {\n const now = Date.now()\n for (const [nonce, entry] of this.nonces.entries()) {\n if (now > entry.expiresAt) {\n this.nonces.delete(nonce)\n }\n }\n }\n\n getStats(): { size: number; oldestTimestamp?: number } {\n let oldestTimestamp: number | undefined\n\n for (const entry of this.nonces.values()) {\n if (!oldestTimestamp || entry.timestamp < oldestTimestamp) {\n oldestTimestamp = entry.timestamp\n }\n }\n\n return {\n size: this.nonces.size,\n oldestTimestamp,\n }\n }\n\n private evictOldest(): void {\n // Find and remove oldest entries (10% of max size)\n const toRemove = Math.ceil(this.maxSize * 0.1)\n const entries = Array.from(this.nonces.entries())\n .sort((a, b) => a[1].timestamp - b[1].timestamp)\n .slice(0, toRemove)\n\n for (const [nonce] of entries) {\n this.nonces.delete(nonce)\n }\n }\n\n /**\n * Clear all nonces\n */\n clear(): void {\n this.nonces.clear()\n }\n\n /**\n * Stop auto cleanup\n */\n destroy(): void {\n if (this.cleanupInterval) {\n clearInterval(this.cleanupInterval)\n this.cleanupInterval = null\n }\n }\n}\n\n// ============================================================================\n// Global Store\n// ============================================================================\n\nlet globalNonceStore: MemoryNonceStore | null = null\n\n/**\n * Get global nonce store (singleton)\n */\nexport function getGlobalNonceStore(): MemoryNonceStore {\n if (!globalNonceStore) {\n globalNonceStore = new MemoryNonceStore()\n }\n return globalNonceStore\n}\n\n// ============================================================================\n// Nonce Utilities\n// ============================================================================\n\n/**\n * Generate a cryptographically secure nonce\n */\nexport function generateNonce(length: number = 32): string {\n const bytes = new Uint8Array(length)\n crypto.getRandomValues(bytes)\n return Array.from(bytes)\n .map(b => b.toString(16).padStart(2, '0'))\n .join('')\n}\n\n/**\n * Validate nonce format\n */\nexport function isValidNonceFormat(nonce: string, minLength: number = 16, maxLength: number = 128): boolean {\n if (!nonce || typeof nonce !== 'string') {\n return false\n }\n\n if (nonce.length < minLength || nonce.length > maxLength) {\n return false\n }\n\n // Check for valid characters (alphanumeric, dash, underscore)\n return /^[a-zA-Z0-9_-]+$/.test(nonce)\n}\n\n// ============================================================================\n// Replay Check\n// ============================================================================\n\n/**\n * Extract nonce from request\n */\nexport function extractNonce(req: NextRequest, options: ReplayPreventionOptions = {}): string | null {\n const {\n nonceHeader = DEFAULT_REPLAY_OPTIONS.nonceHeader,\n nonceQuery = DEFAULT_REPLAY_OPTIONS.nonceQuery,\n } = options\n\n // Try header first\n const headerNonce = req.headers.get(nonceHeader)\n if (headerNonce) {\n return headerNonce\n }\n\n // Try query param\n if (nonceQuery) {\n const url = new URL(req.url)\n const queryNonce = url.searchParams.get(nonceQuery)\n if (queryNonce) {\n return queryNonce\n }\n }\n\n return null\n}\n\n/**\n * Check request for replay attack\n */\nexport async function checkReplay(\n req: NextRequest,\n options: ReplayPreventionOptions = {}\n): Promise<ReplayCheckResult> {\n const {\n store = getGlobalNonceStore(),\n nonceHeader = DEFAULT_REPLAY_OPTIONS.nonceHeader,\n nonceQuery = DEFAULT_REPLAY_OPTIONS.nonceQuery,\n ttl = DEFAULT_REPLAY_OPTIONS.ttl,\n required = DEFAULT_REPLAY_OPTIONS.required,\n minLength = DEFAULT_REPLAY_OPTIONS.minLength,\n maxLength = DEFAULT_REPLAY_OPTIONS.maxLength,\n validate,\n } = options\n\n // Extract nonce\n const nonce = extractNonce(req, { nonceHeader, nonceQuery })\n\n // Check if nonce is required\n if (!nonce) {\n if (required) {\n return {\n isReplay: false, // Not a replay, but missing\n nonce: null as unknown as undefined,\n reason: 'Missing nonce',\n }\n }\n return {\n isReplay: false,\n }\n }\n\n // Validate nonce format\n if (!isValidNonceFormat(nonce, minLength, maxLength)) {\n return {\n isReplay: false,\n nonce,\n reason: `Invalid nonce format (length must be ${minLength}-${maxLength}, alphanumeric)`,\n }\n }\n\n // Custom validation\n if (validate) {\n const isValid = await validate(nonce)\n if (!isValid) {\n return {\n isReplay: false,\n nonce,\n reason: 'Nonce failed custom validation',\n }\n }\n }\n\n // Check if nonce has been used\n const exists = await store.exists(nonce)\n if (exists) {\n return {\n isReplay: true,\n nonce,\n reason: 'Nonce has already been used',\n }\n }\n\n // Store the nonce\n await store.set(nonce, ttl)\n\n return {\n isReplay: false,\n nonce,\n }\n}\n\n// ============================================================================\n// Replay Prevention Middleware\n// ============================================================================\n\n/**\n * Default response for replay attack\n */\nfunction defaultReplayResponse(nonce: string): Response {\n return new Response(\n JSON.stringify({\n error: 'Forbidden',\n message: 'Request replay detected',\n code: 'REPLAY_DETECTED',\n nonce,\n }),\n {\n status: 403,\n headers: { 'Content-Type': 'application/json' },\n }\n )\n}\n\n/**\n * Default response for missing/invalid nonce\n */\nfunction defaultMissingNonceResponse(reason: string): Response {\n return new Response(\n JSON.stringify({\n error: 'Bad Request',\n message: reason,\n code: 'INVALID_NONCE',\n }),\n {\n status: 400,\n headers: { 'Content-Type': 'application/json' },\n }\n )\n}\n\n/**\n * Create replay prevention middleware\n */\nexport function withReplayPrevention<T = unknown>(\n handler: (req: NextRequest, ctx: T) => Response | Promise<Response>,\n options: ReplayPreventionOptions = {}\n): (req: NextRequest, ctx: T) => Promise<Response> {\n return async (req: NextRequest, ctx: T): Promise<Response> => {\n // Check if should skip\n if (options.skip && await options.skip(req)) {\n return handler(req, ctx)\n }\n\n // Check for replay\n const result = await checkReplay(req, options)\n\n // Handle replay attack\n if (result.isReplay) {\n const onReplay = options.onReplay || defaultReplayResponse\n return onReplay(result.nonce!)\n }\n\n // Handle missing/invalid nonce\n if (result.reason && options.required !== false) {\n return defaultMissingNonceResponse(result.reason)\n }\n\n return handler(req, ctx)\n }\n}\n\n// ============================================================================\n// Request Helper\n// ============================================================================\n\n/**\n * Add nonce header to outgoing request headers\n */\nexport function addNonceHeader(\n headers: Record<string, string> = {},\n options: { headerName?: string; length?: number } = {}\n): Record<string, string> {\n const { headerName = 'x-nonce', length = 32 } = options\n return {\n ...headers,\n [headerName]: generateNonce(length),\n }\n}\n","/**\n * Timestamp Validation for API Security\n * @module nextjs-secure/api\n */\n\nimport type { NextRequest } from 'next/server'\nimport type { TimestampOptions, TimestampResult, TimestampFormat } from './types'\n\n// ============================================================================\n// Default Configuration\n// ============================================================================\n\nexport const DEFAULT_TIMESTAMP_OPTIONS: Required<Omit<TimestampOptions, 'timestampQuery' | 'onInvalid' | 'skip'>> = {\n timestampHeader: 'x-timestamp',\n format: 'unix',\n maxAge: 300, // 5 minutes\n allowFuture: false,\n maxFuture: 60, // 1 minute\n required: true,\n}\n\n// ============================================================================\n// Timestamp Parsing\n// ============================================================================\n\n/**\n * Parse timestamp string to Unix timestamp (seconds)\n */\nexport function parseTimestamp(value: string, format: TimestampFormat = 'unix'): number | null {\n if (!value || typeof value !== 'string') {\n return null\n }\n\n try {\n switch (format) {\n case 'unix': {\n const num = parseInt(value, 10)\n if (isNaN(num) || num <= 0) {\n return null\n }\n return num\n }\n\n case 'unix-ms': {\n const num = parseInt(value, 10)\n if (isNaN(num) || num <= 0) {\n return null\n }\n return Math.floor(num / 1000)\n }\n\n case 'iso8601': {\n const date = new Date(value)\n if (isNaN(date.getTime())) {\n return null\n }\n return Math.floor(date.getTime() / 1000)\n }\n\n default:\n return null\n }\n } catch {\n return null\n }\n}\n\n/**\n * Format current timestamp\n */\nexport function formatTimestamp(format: TimestampFormat = 'unix'): string {\n const now = Date.now()\n\n switch (format) {\n case 'unix':\n return Math.floor(now / 1000).toString()\n case 'unix-ms':\n return now.toString()\n case 'iso8601':\n return new Date(now).toISOString()\n default:\n return Math.floor(now / 1000).toString()\n }\n}\n\n// ============================================================================\n// Timestamp Extraction\n// ============================================================================\n\n/**\n * Extract timestamp from request\n */\nexport function extractTimestamp(req: NextRequest, options: TimestampOptions = {}): string | null {\n const {\n timestampHeader = DEFAULT_TIMESTAMP_OPTIONS.timestampHeader,\n timestampQuery,\n } = options\n\n // Try header first\n const headerTimestamp = req.headers.get(timestampHeader)\n if (headerTimestamp) {\n return headerTimestamp\n }\n\n // Try query param\n if (timestampQuery) {\n const url = new URL(req.url)\n const queryTimestamp = url.searchParams.get(timestampQuery)\n if (queryTimestamp) {\n return queryTimestamp\n }\n }\n\n return null\n}\n\n// ============================================================================\n// Timestamp Validation\n// ============================================================================\n\n/**\n * Validate request timestamp\n */\nexport function validateTimestamp(\n req: NextRequest,\n options: TimestampOptions = {}\n): TimestampResult {\n const {\n timestampHeader = DEFAULT_TIMESTAMP_OPTIONS.timestampHeader,\n timestampQuery,\n format = DEFAULT_TIMESTAMP_OPTIONS.format,\n maxAge = DEFAULT_TIMESTAMP_OPTIONS.maxAge,\n allowFuture = DEFAULT_TIMESTAMP_OPTIONS.allowFuture,\n maxFuture = DEFAULT_TIMESTAMP_OPTIONS.maxFuture,\n required = DEFAULT_TIMESTAMP_OPTIONS.required,\n } = options\n\n // Extract timestamp\n const timestampStr = extractTimestamp(req, { timestampHeader, timestampQuery })\n\n // Check if required\n if (!timestampStr) {\n if (required) {\n return {\n valid: false,\n reason: 'Missing timestamp',\n }\n }\n return {\n valid: true,\n }\n }\n\n // Parse timestamp\n const timestamp = parseTimestamp(timestampStr, format)\n if (timestamp === null) {\n return {\n valid: false,\n reason: `Invalid timestamp format (expected: ${format})`,\n }\n }\n\n // Get current time\n const now = Math.floor(Date.now() / 1000)\n const age = now - timestamp\n\n // Check if too old\n if (age > maxAge) {\n return {\n valid: false,\n timestamp,\n age,\n reason: `Timestamp too old (age: ${age}s, max: ${maxAge}s)`,\n }\n }\n\n // Check if in future\n if (age < 0) {\n if (!allowFuture) {\n return {\n valid: false,\n timestamp,\n age,\n reason: 'Timestamp is in the future',\n }\n }\n\n // Check if too far in future\n const futureAge = Math.abs(age)\n if (futureAge > maxFuture) {\n return {\n valid: false,\n timestamp,\n age,\n reason: `Timestamp too far in future (${futureAge}s, max: ${maxFuture}s)`,\n }\n }\n }\n\n return {\n valid: true,\n timestamp,\n age,\n }\n}\n\n/**\n * Quick check if timestamp is valid\n */\nexport function isTimestampValid(\n timestampStr: string,\n options: { format?: TimestampFormat; maxAge?: number; allowFuture?: boolean; maxFuture?: number } = {}\n): boolean {\n const {\n format = 'unix',\n maxAge = 300,\n allowFuture = false,\n maxFuture = 60,\n } = options\n\n const timestamp = parseTimestamp(timestampStr, format)\n if (timestamp === null) {\n return false\n }\n\n const now = Math.floor(Date.now() / 1000)\n const age = now - timestamp\n\n // Check if too old\n if (age > maxAge) {\n return false\n }\n\n // Check if in future\n if (age < 0) {\n if (!allowFuture) {\n return false\n }\n if (Math.abs(age) > maxFuture) {\n return false\n }\n }\n\n return true\n}\n\n// ============================================================================\n// Timestamp Middleware\n// ============================================================================\n\n/**\n * Default response for invalid timestamp\n */\nfunction defaultInvalidResponse(reason: string): Response {\n return new Response(\n JSON.stringify({\n error: 'Bad Request',\n message: reason,\n code: 'INVALID_TIMESTAMP',\n }),\n {\n status: 400,\n headers: { 'Content-Type': 'application/json' },\n }\n )\n}\n\n/**\n * Create timestamp validation middleware\n */\nexport function withTimestamp<T = unknown>(\n handler: (req: NextRequest, ctx: T) => Response | Promise<Response>,\n options: TimestampOptions = {}\n): (req: NextRequest, ctx: T) => Promise<Response> {\n return async (req: NextRequest, ctx: T): Promise<Response> => {\n // Check if should skip\n if (options.skip && await options.skip(req)) {\n return handler(req, ctx)\n }\n\n // Validate timestamp\n const result = validateTimestamp(req, options)\n\n if (!result.valid) {\n const onInvalid = options.onInvalid || defaultInvalidResponse\n return onInvalid(result.reason || 'Invalid timestamp')\n }\n\n return handler(req, ctx)\n }\n}\n\n// ============================================================================\n// Request Helper\n// ============================================================================\n\n/**\n * Add timestamp header to outgoing request headers\n */\nexport function addTimestampHeader(\n headers: Record<string, string> = {},\n options: { headerName?: string; format?: TimestampFormat } = {}\n): Record<string, string> {\n const { headerName = 'x-timestamp', format = 'unix' } = options\n return {\n ...headers,\n [headerName]: formatTimestamp(format),\n }\n}\n\n/**\n * Get request age in seconds (for monitoring/logging)\n */\nexport function getRequestAge(req: NextRequest, options: TimestampOptions = {}): number | null {\n const timestampStr = extractTimestamp(req, options)\n if (!timestampStr) {\n return null\n }\n\n const timestamp = parseTimestamp(timestampStr, options.format)\n if (timestamp === null) {\n return null\n }\n\n const now = Math.floor(Date.now() / 1000)\n return now - timestamp\n}\n","/**\n * API Versioning for API Security\n * @module nextjs-secure/api\n */\n\nimport type { NextRequest } from 'next/server'\nimport type { VersioningOptions, VersionResult, VersionSource, VersionStatus } from './types'\n\n// ============================================================================\n// Default Configuration\n// ============================================================================\n\nexport const DEFAULT_VERSIONING_OPTIONS: Required<Omit<VersioningOptions, 'current' | 'supported' | 'deprecated' | 'sunset' | 'sunsetDates' | 'pathPattern' | 'acceptPattern' | 'parseVersion' | 'onUnsupported' | 'onDeprecated' | 'skip'>> = {\n source: 'header',\n versionHeader: 'x-api-version',\n versionQuery: 'version',\n addDeprecationHeaders: true,\n}\n\n// ============================================================================\n// Version Extraction\n// ============================================================================\n\n/**\n * Extract version from header\n */\nfunction extractFromHeader(req: NextRequest, headerName: string): string | null {\n return req.headers.get(headerName)\n}\n\n/**\n * Extract version from query string\n */\nfunction extractFromQuery(req: NextRequest, queryParam: string): string | null {\n const url = new URL(req.url)\n return url.searchParams.get(queryParam)\n}\n\n/**\n * Extract version from path\n */\nfunction extractFromPath(req: NextRequest, pattern?: RegExp): string | null {\n if (!pattern) {\n // Default pattern: /v1/, /v2/, etc.\n pattern = /\\/v(\\d+(?:\\.\\d+)?)\\//\n }\n\n const url = new URL(req.url)\n const match = url.pathname.match(pattern)\n\n if (match && match[1]) {\n return match[1]\n }\n\n return null\n}\n\n/**\n * Extract version from Accept header\n */\nfunction extractFromAccept(req: NextRequest, pattern?: RegExp): string | null {\n const accept = req.headers.get('accept')\n if (!accept) {\n return null\n }\n\n if (!pattern) {\n // Default pattern: application/vnd.api+json; version=1\n pattern = /version=(\\d+(?:\\.\\d+)?)/\n }\n\n const match = accept.match(pattern)\n if (match && match[1]) {\n return match[1]\n }\n\n return null\n}\n\n/**\n * Extract version from request\n */\nexport function extractVersion(\n req: NextRequest,\n options: VersioningOptions\n): { version: string | null; source: VersionSource | null } {\n const {\n source = DEFAULT_VERSIONING_OPTIONS.source,\n versionHeader = DEFAULT_VERSIONING_OPTIONS.versionHeader,\n versionQuery = DEFAULT_VERSIONING_OPTIONS.versionQuery,\n pathPattern,\n acceptPattern,\n parseVersion,\n } = options\n\n let version: string | null = null\n let extractedSource: VersionSource | null = null\n\n switch (source) {\n case 'header':\n version = extractFromHeader(req, versionHeader)\n extractedSource = version ? 'header' : null\n break\n\n case 'query':\n version = extractFromQuery(req, versionQuery)\n extractedSource = version ? 'query' : null\n break\n\n case 'path':\n version = extractFromPath(req, pathPattern)\n extractedSource = version ? 'path' : null\n break\n\n case 'accept':\n version = extractFromAccept(req, acceptPattern)\n extractedSource = version ? 'accept' : null\n break\n }\n\n // Apply custom parser\n if (version && parseVersion) {\n version = parseVersion(version)\n }\n\n return { version, source: extractedSource }\n}\n\n/**\n * Try to extract version from multiple sources\n */\nexport function extractVersionMultiSource(\n req: NextRequest,\n options: VersioningOptions,\n sources: VersionSource[] = ['header', 'query', 'path', 'accept']\n): { version: string | null; source: VersionSource | null } {\n for (const source of sources) {\n const result = extractVersion(req, { ...options, source })\n if (result.version) {\n return result\n }\n }\n\n return { version: null, source: null }\n}\n\n// ============================================================================\n// Version Status\n// ============================================================================\n\n/**\n * Get version status\n */\nexport function getVersionStatus(\n version: string,\n options: VersioningOptions\n): VersionStatus | null {\n const { current, supported, deprecated = [], sunset = [] } = options\n\n if (version === current) {\n return 'current'\n }\n\n if (sunset.includes(version)) {\n return 'sunset'\n }\n\n if (deprecated.includes(version)) {\n return 'deprecated'\n }\n\n if (supported.includes(version)) {\n return 'supported'\n }\n\n return null\n}\n\n/**\n * Check if version is supported\n */\nexport function isVersionSupported(version: string, options: VersioningOptions): boolean {\n const status = getVersionStatus(version, options)\n return status === 'current' || status === 'supported' || status === 'deprecated'\n}\n\n// ============================================================================\n// Version Validation\n// ============================================================================\n\n/**\n * Validate request version\n */\nexport function validateVersion(\n req: NextRequest,\n options: VersioningOptions\n): VersionResult {\n const { current, supported, deprecated = [], sunset = [], sunsetDates = {} } = options\n\n // Extract version\n const { version, source } = extractVersion(req, options)\n\n // No version provided - use default\n if (!version) {\n return {\n version: current,\n source: null,\n status: 'current',\n valid: true,\n }\n }\n\n // Check if sunset (no longer available)\n if (sunset.includes(version)) {\n const sunsetDate = sunsetDates[version]\n return {\n version,\n source,\n status: 'sunset',\n valid: false,\n reason: `API version ${version} has been sunset${sunsetDate ? ` on ${sunsetDate.toISOString()}` : ''}`,\n sunsetDate,\n }\n }\n\n // Check if deprecated\n if (deprecated.includes(version)) {\n const sunsetDate = sunsetDates[version]\n return {\n version,\n source,\n status: 'deprecated',\n valid: true,\n sunsetDate,\n }\n }\n\n // Check if current\n if (version === current) {\n return {\n version,\n source,\n status: 'current',\n valid: true,\n }\n }\n\n // Check if supported\n if (supported.includes(version)) {\n return {\n version,\n source,\n status: 'supported',\n valid: true,\n }\n }\n\n // Unknown version\n return {\n version,\n source,\n status: null,\n valid: false,\n reason: `Unsupported API version: ${version}. Supported versions: ${[current, ...supported].join(', ')}`,\n }\n}\n\n// ============================================================================\n// Deprecation Headers\n// ============================================================================\n\n/**\n * Add deprecation headers to response\n */\nexport function addDeprecationHeaders(\n response: Response,\n version: string,\n sunsetDate?: Date\n): Response {\n const headers = new Headers(response.headers)\n\n // Add Deprecation header (RFC 8594)\n headers.set('Deprecation', 'true')\n\n // Add Sunset header if date is known\n if (sunsetDate) {\n headers.set('Sunset', sunsetDate.toUTCString())\n }\n\n // Add warning\n headers.set(\n 'Warning',\n `299 - \"API version ${version} is deprecated${sunsetDate ? ` and will be removed on ${sunsetDate.toISOString().split('T')[0]}` : ''}\"`\n )\n\n return new Response(response.body, {\n status: response.status,\n statusText: response.statusText,\n headers,\n })\n}\n\n// ============================================================================\n// Versioning Middleware\n// ============================================================================\n\n/**\n * Default response for unsupported version\n */\nfunction defaultUnsupportedResponse(version: string, supportedVersions: string[]): Response {\n return new Response(\n JSON.stringify({\n error: 'Bad Request',\n message: `Unsupported API version: ${version}`,\n code: 'UNSUPPORTED_VERSION',\n supportedVersions,\n }),\n {\n status: 400,\n headers: { 'Content-Type': 'application/json' },\n }\n )\n}\n\n/**\n * Default response for sunset version\n */\nfunction defaultSunsetResponse(version: string, sunsetDate?: Date): Response {\n return new Response(\n JSON.stringify({\n error: 'Gone',\n message: `API version ${version} is no longer available${sunsetDate ? `. It was sunset on ${sunsetDate.toISOString().split('T')[0]}` : ''}`,\n code: 'VERSION_SUNSET',\n }),\n {\n status: 410,\n headers: { 'Content-Type': 'application/json' },\n }\n )\n}\n\n/**\n * Create API versioning middleware\n */\nexport function withAPIVersion<T = unknown>(\n handler: (req: NextRequest, ctx: T) => Response | Promise<Response>,\n options: VersioningOptions\n): (req: NextRequest, ctx: T) => Promise<Response> {\n return async (req: NextRequest, ctx: T): Promise<Response> => {\n // Check if should skip\n if (options.skip && await options.skip(req)) {\n return handler(req, ctx)\n }\n\n // Validate version\n const result = validateVersion(req, options)\n\n // Handle sunset version\n if (result.status === 'sunset') {\n return defaultSunsetResponse(result.version!, result.sunsetDate)\n }\n\n // Handle unsupported version\n if (!result.valid) {\n const onUnsupported = options.onUnsupported || (\n (v: string) => defaultUnsupportedResponse(v, [options.current, ...options.supported])\n )\n return onUnsupported(result.version!)\n }\n\n // Call handler\n let response = await handler(req, ctx)\n\n // Handle deprecated version\n if (result.status === 'deprecated') {\n // Call deprecation callback\n if (options.onDeprecated) {\n options.onDeprecated(result.version!, result.sunsetDate)\n }\n\n // Add deprecation headers\n if (options.addDeprecationHeaders !== false) {\n response = addDeprecationHeaders(response, result.version!, result.sunsetDate)\n }\n }\n\n return response\n }\n}\n\n// ============================================================================\n// Version Router\n// ============================================================================\n\ntype VersionHandler<T> = (req: NextRequest, ctx: T) => Response | Promise<Response>\n\n/**\n * Create version-based router\n */\nexport function createVersionRouter<T = unknown>(\n handlers: Record<string, VersionHandler<T>>,\n options: Omit<VersioningOptions, 'current' | 'supported'> & { default?: string }\n): (req: NextRequest, ctx: T) => Promise<Response> {\n const versions = Object.keys(handlers)\n const defaultVersion = options.default || versions[versions.length - 1]\n\n return async (req: NextRequest, ctx: T): Promise<Response> => {\n // Extract version\n const { version } = extractVersion(req, {\n ...options,\n current: defaultVersion,\n supported: versions,\n })\n\n // Use default if not specified\n const targetVersion = version || defaultVersion\n\n // Get handler\n const handler = handlers[targetVersion]\n if (!handler) {\n return defaultUnsupportedResponse(targetVersion, versions)\n }\n\n return handler(req, ctx)\n }\n}\n\n// ============================================================================\n// Utility Functions\n// ============================================================================\n\n/**\n * Compare semantic versions\n */\nexport function compareVersions(a: string, b: string): number {\n const partsA = a.split('.').map(Number)\n const partsB = b.split('.').map(Number)\n\n const maxLength = Math.max(partsA.length, partsB.length)\n\n for (let i = 0; i < maxLength; i++) {\n const numA = partsA[i] || 0\n const numB = partsB[i] || 0\n\n if (numA > numB) return 1\n if (numA < numB) return -1\n }\n\n return 0\n}\n\n/**\n * Check if version is greater than or equal to minimum\n */\nexport function isVersionAtLeast(version: string, minimum: string): boolean {\n return compareVersions(version, minimum) >= 0\n}\n\n/**\n * Normalize version string\n */\nexport function normalizeVersion(version: string): string {\n // Remove 'v' prefix if present\n version = version.replace(/^v/i, '')\n\n // Ensure at least major.minor format\n const parts = version.split('.')\n while (parts.length < 2) {\n parts.push('0')\n }\n\n return parts.join('.')\n}\n","/**\n * Idempotency Support for API Security\n * @module nextjs-secure/api\n */\n\nimport type { NextRequest } from 'next/server'\nimport type { IdempotencyStore, CachedResponse, IdempotencyOptions, IdempotencyResult } from './types'\n\n// ============================================================================\n// Default Configuration\n// ============================================================================\n\nexport const DEFAULT_IDEMPOTENCY_OPTIONS: Required<Omit<IdempotencyOptions, 'store' | 'validateKey' | 'onError' | 'skip' | 'onCacheHit'>> = {\n keyHeader: 'idempotency-key',\n ttl: 86400000, // 24 hours\n required: false,\n methods: ['POST', 'PUT', 'PATCH'],\n minKeyLength: 16,\n maxKeyLength: 256,\n hashRequestBody: true,\n lockTimeout: 30000, // 30 seconds\n waitForLock: true,\n maxWaitTime: 10000, // 10 seconds\n}\n\n// ============================================================================\n// Memory Idempotency Store\n// ============================================================================\n\ninterface IdempotencyEntry {\n response: CachedResponse\n expiresAt: number\n}\n\ninterface ProcessingEntry {\n startedAt: number\n expiresAt: number\n}\n\n/**\n * In-memory idempotency store\n */\nexport class MemoryIdempotencyStore implements IdempotencyStore {\n private cache: Map<string, IdempotencyEntry> = new Map()\n private processing: Map<string, ProcessingEntry> = new Map()\n private maxSize: number\n private cleanupInterval: ReturnType<typeof setInterval> | null = null\n\n constructor(options: { maxSize?: number; autoCleanup?: boolean; cleanupIntervalMs?: number } = {}) {\n const { maxSize = 10000, autoCleanup = true, cleanupIntervalMs = 60000 } = options\n this.maxSize = maxSize\n\n if (autoCleanup) {\n this.cleanupInterval = setInterval(() => {\n this.cleanup()\n }, cleanupIntervalMs)\n\n if (this.cleanupInterval.unref) {\n this.cleanupInterval.unref()\n }\n }\n }\n\n async get(key: string): Promise<CachedResponse | null> {\n const entry = this.cache.get(key)\n if (!entry) {\n return null\n }\n\n // Check if expired\n if (Date.now() > entry.expiresAt) {\n this.cache.delete(key)\n return null\n }\n\n return entry.response\n }\n\n async set(key: string, response: CachedResponse, ttl: number): Promise<void> {\n // Evict oldest if at capacity\n if (this.cache.size >= this.maxSize) {\n this.evictOldest()\n }\n\n this.cache.set(key, {\n response,\n expiresAt: Date.now() + ttl,\n })\n }\n\n async isProcessing(key: string): Promise<boolean> {\n const entry = this.processing.get(key)\n if (!entry) {\n return false\n }\n\n // Check if lock expired\n if (Date.now() > entry.expiresAt) {\n this.processing.delete(key)\n return false\n }\n\n return true\n }\n\n async startProcessing(key: string, timeout: number): Promise<boolean> {\n // Check if already processing\n if (await this.isProcessing(key)) {\n return false\n }\n\n const now = Date.now()\n this.processing.set(key, {\n startedAt: now,\n expiresAt: now + timeout,\n })\n\n return true\n }\n\n async endProcessing(key: string): Promise<void> {\n this.processing.delete(key)\n }\n\n async delete(key: string): Promise<void> {\n this.cache.delete(key)\n this.processing.delete(key)\n }\n\n async cleanup(): Promise<void> {\n const now = Date.now()\n\n // Cleanup expired cache entries\n for (const [key, entry] of this.cache.entries()) {\n if (now > entry.expiresAt) {\n this.cache.delete(key)\n }\n }\n\n // Cleanup expired processing locks\n for (const [key, entry] of this.processing.entries()) {\n if (now > entry.expiresAt) {\n this.processing.delete(key)\n }\n }\n }\n\n getStats(): { cacheSize: number; processingSize: number } {\n return {\n cacheSize: this.cache.size,\n processingSize: this.processing.size,\n }\n }\n\n private evictOldest(): void {\n // Remove 10% of oldest entries\n const toRemove = Math.ceil(this.maxSize * 0.1)\n const entries = Array.from(this.cache.entries())\n .sort((a, b) => a[1].response.cachedAt - b[1].response.cachedAt)\n .slice(0, toRemove)\n\n for (const [key] of entries) {\n this.cache.delete(key)\n }\n }\n\n /**\n * Clear all entries\n */\n clear(): void {\n this.cache.clear()\n this.processing.clear()\n }\n\n /**\n * Stop auto cleanup\n */\n destroy(): void {\n if (this.cleanupInterval) {\n clearInterval(this.cleanupInterval)\n this.cleanupInterval = null\n }\n }\n}\n\n// ============================================================================\n// Global Store\n// ============================================================================\n\nlet globalIdempotencyStore: MemoryIdempotencyStore | null = null\n\n/**\n * Get global idempotency store (singleton)\n */\nexport function getGlobalIdempotencyStore(): MemoryIdempotencyStore {\n if (!globalIdempotencyStore) {\n globalIdempotencyStore = new MemoryIdempotencyStore()\n }\n return globalIdempotencyStore\n}\n\n// ============================================================================\n// Utilities\n// ============================================================================\n\n/**\n * Generate a cryptographically secure idempotency key\n */\nexport function generateIdempotencyKey(length: number = 32): string {\n const bytes = new Uint8Array(length)\n crypto.getRandomValues(bytes)\n return Array.from(bytes)\n .map(b => b.toString(16).padStart(2, '0'))\n .join('')\n}\n\n/**\n * Hash request body using SHA-256\n */\nexport async function hashRequestBody(body: string): Promise<string> {\n const encoder = new TextEncoder()\n const data = encoder.encode(body)\n const hashBuffer = await crypto.subtle.digest('SHA-256', data)\n const hashArray = new Uint8Array(hashBuffer)\n return Array.from(hashArray)\n .map(b => b.toString(16).padStart(2, '0'))\n .join('')\n}\n\n/**\n * Validate idempotency key format\n */\nexport function isValidIdempotencyKey(\n key: string,\n minLength: number = 16,\n maxLength: number = 256\n): boolean {\n if (!key || typeof key !== 'string') {\n return false\n }\n\n if (key.length < minLength || key.length > maxLength) {\n return false\n }\n\n // Check for valid characters (alphanumeric, dash, underscore)\n return /^[a-zA-Z0-9_-]+$/.test(key)\n}\n\n/**\n * Create cache key from idempotency key and request hash\n */\nexport async function createCacheKey(\n idempotencyKey: string,\n req: NextRequest,\n hashBody: boolean = true\n): Promise<string> {\n const parts = [idempotencyKey, req.method, new URL(req.url).pathname]\n\n if (hashBody) {\n try {\n const cloned = req.clone()\n const body = await cloned.text()\n if (body) {\n const bodyHash = await hashRequestBody(body)\n parts.push(bodyHash)\n }\n } catch {\n // Ignore body hash errors\n }\n }\n\n return parts.join(':')\n}\n\n// ============================================================================\n// Idempotency Check\n// ============================================================================\n\n/**\n * Extract idempotency key from request\n */\nexport function extractIdempotencyKey(\n req: NextRequest,\n options: IdempotencyOptions = {}\n): string | null {\n const { keyHeader = DEFAULT_IDEMPOTENCY_OPTIONS.keyHeader } = options\n return req.headers.get(keyHeader)\n}\n\n/**\n * Check idempotency for request\n */\nexport async function checkIdempotency(\n req: NextRequest,\n options: IdempotencyOptions = {}\n): Promise<IdempotencyResult> {\n const {\n store = getGlobalIdempotencyStore(),\n keyHeader = DEFAULT_IDEMPOTENCY_OPTIONS.keyHeader,\n required = DEFAULT_IDEMPOTENCY_OPTIONS.required,\n methods = DEFAULT_IDEMPOTENCY_OPTIONS.methods,\n minKeyLength = DEFAULT_IDEMPOTENCY_OPTIONS.minKeyLength,\n maxKeyLength = DEFAULT_IDEMPOTENCY_OPTIONS.maxKeyLength,\n hashRequestBody: hashBody = DEFAULT_IDEMPOTENCY_OPTIONS.hashRequestBody,\n validateKey,\n } = options\n\n // Check if method requires idempotency\n const method = req.method.toUpperCase()\n if (!methods.includes(method)) {\n return {\n key: null,\n fromCache: false,\n isProcessing: false,\n }\n }\n\n // Extract key\n const key = req.headers.get(keyHeader)\n\n // Check if required\n if (!key) {\n if (required) {\n return {\n key: null,\n fromCache: false,\n isProcessing: false,\n reason: 'Missing idempotency key',\n }\n }\n return {\n key: null,\n fromCache: false,\n isProcessing: false,\n }\n }\n\n // Validate key format\n if (!isValidIdempotencyKey(key, minKeyLength, maxKeyLength)) {\n return {\n key,\n fromCache: false,\n isProcessing: false,\n reason: `Invalid idempotency key format (length must be ${minKeyLength}-${maxKeyLength}, alphanumeric)`,\n }\n }\n\n // Custom validation\n if (validateKey) {\n const isValid = await validateKey(key)\n if (!isValid) {\n return {\n key,\n fromCache: false,\n isProcessing: false,\n reason: 'Idempotency key failed custom validation',\n }\n }\n }\n\n // Create cache key\n const cacheKey = await createCacheKey(key, req, hashBody)\n\n // Check cache\n const cached = await store.get(cacheKey)\n if (cached) {\n return {\n key,\n fromCache: true,\n cachedResponse: cached,\n isProcessing: false,\n }\n }\n\n // Check if processing\n const isProcessing = await store.isProcessing(cacheKey)\n\n return {\n key,\n fromCache: false,\n isProcessing,\n reason: isProcessing ? 'Request is currently being processed' : undefined,\n }\n}\n\n// ============================================================================\n// Response Caching\n// ============================================================================\n\n/**\n * Cache response for idempotency key\n */\nexport async function cacheResponse(\n key: string,\n req: NextRequest,\n response: Response,\n options: IdempotencyOptions = {}\n): Promise<void> {\n const {\n store = getGlobalIdempotencyStore(),\n ttl = DEFAULT_IDEMPOTENCY_OPTIONS.ttl,\n hashRequestBody: hashBody = DEFAULT_IDEMPOTENCY_OPTIONS.hashRequestBody,\n } = options\n\n // Create cache key\n const cacheKey = await createCacheKey(key, req, hashBody)\n\n // Clone response to read body\n const cloned = response.clone()\n const body = await cloned.text()\n\n // Convert headers to object\n const headers: Record<string, string> = {}\n response.headers.forEach((value, name) => {\n headers[name] = value\n })\n\n // Store cached response\n const cachedResponse: CachedResponse = {\n status: response.status,\n headers,\n body,\n cachedAt: Date.now(),\n }\n\n await store.set(cacheKey, cachedResponse, ttl)\n\n // End processing lock\n await store.endProcessing(cacheKey)\n}\n\n/**\n * Create response from cached data\n */\nexport function createResponseFromCache(cached: CachedResponse): Response {\n const headers = new Headers(cached.headers)\n\n // Add header to indicate this is a cached response\n headers.set('x-idempotency-replayed', 'true')\n headers.set('x-idempotency-cached-at', new Date(cached.cachedAt).toISOString())\n\n return new Response(cached.body, {\n status: cached.status,\n headers,\n })\n}\n\n// ============================================================================\n// Idempotency Middleware\n// ============================================================================\n\n/**\n * Default error response\n */\nfunction defaultErrorResponse(reason: string): Response {\n return new Response(\n JSON.stringify({\n error: 'Bad Request',\n message: reason,\n code: 'IDEMPOTENCY_ERROR',\n }),\n {\n status: 400,\n headers: { 'Content-Type': 'application/json' },\n }\n )\n}\n\n/**\n * Wait for lock with polling\n */\nasync function waitForLock(\n store: IdempotencyStore,\n cacheKey: string,\n maxWaitTime: number,\n pollInterval: number = 100\n): Promise<CachedResponse | null> {\n const startTime = Date.now()\n\n while (Date.now() - startTime < maxWaitTime) {\n // Check if response is now cached\n const cached = await store.get(cacheKey)\n if (cached) {\n return cached\n }\n\n // Check if still processing\n const isProcessing = await store.isProcessing(cacheKey)\n if (!isProcessing) {\n // Processing ended but no cached response - might be an error\n return null\n }\n\n // Wait before next poll\n await new Promise(resolve => setTimeout(resolve, pollInterval))\n }\n\n return null\n}\n\n/**\n * Create idempotency middleware\n */\nexport function withIdempotency<T = unknown>(\n handler: (req: NextRequest, ctx: T) => Response | Promise<Response>,\n options: IdempotencyOptions = {}\n): (req: NextRequest, ctx: T) => Promise<Response> {\n return async (req: NextRequest, ctx: T): Promise<Response> => {\n // Check if should skip\n if (options.skip && await options.skip(req)) {\n return handler(req, ctx)\n }\n\n const {\n store = getGlobalIdempotencyStore(),\n methods = DEFAULT_IDEMPOTENCY_OPTIONS.methods,\n hashRequestBody: hashBody = DEFAULT_IDEMPOTENCY_OPTIONS.hashRequestBody,\n lockTimeout = DEFAULT_IDEMPOTENCY_OPTIONS.lockTimeout,\n waitForLock: shouldWait = DEFAULT_IDEMPOTENCY_OPTIONS.waitForLock,\n maxWaitTime = DEFAULT_IDEMPOTENCY_OPTIONS.maxWaitTime,\n onError,\n onCacheHit,\n } = options\n\n // Check if method requires idempotency\n const method = req.method.toUpperCase()\n if (!methods.includes(method)) {\n return handler(req, ctx)\n }\n\n // Check idempotency\n const result = await checkIdempotency(req, options)\n\n // Handle errors\n if (result.reason && !result.isProcessing) {\n const errorHandler = onError || defaultErrorResponse\n return errorHandler(result.reason)\n }\n\n // Return cached response\n if (result.fromCache && result.cachedResponse) {\n if (onCacheHit) {\n onCacheHit(result.key!, result.cachedResponse)\n }\n return createResponseFromCache(result.cachedResponse)\n }\n\n // No key provided and not required\n if (!result.key) {\n return handler(req, ctx)\n }\n\n // Create cache key for lock\n const cacheKey = await createCacheKey(result.key, req, hashBody)\n\n // Handle concurrent request\n if (result.isProcessing) {\n if (shouldWait) {\n const cached = await waitForLock(store, cacheKey, maxWaitTime)\n if (cached) {\n if (onCacheHit) {\n onCacheHit(result.key, cached)\n }\n return createResponseFromCache(cached)\n }\n }\n\n return new Response(\n JSON.stringify({\n error: 'Conflict',\n message: 'Request with this idempotency key is currently being processed',\n code: 'IDEMPOTENCY_CONFLICT',\n }),\n {\n status: 409,\n headers: { 'Content-Type': 'application/json' },\n }\n )\n }\n\n // Acquire processing lock\n const acquired = await store.startProcessing(cacheKey, lockTimeout)\n if (!acquired) {\n // Race condition - another request got the lock\n if (shouldWait) {\n const cached = await waitForLock(store, cacheKey, maxWaitTime)\n if (cached) {\n if (onCacheHit) {\n onCacheHit(result.key, cached)\n }\n return createResponseFromCache(cached)\n }\n }\n\n return new Response(\n JSON.stringify({\n error: 'Conflict',\n message: 'Request with this idempotency key is currently being processed',\n code: 'IDEMPOTENCY_CONFLICT',\n }),\n {\n status: 409,\n headers: { 'Content-Type': 'application/json' },\n }\n )\n }\n\n try {\n // Execute handler\n const response = await handler(req, ctx)\n\n // Cache response (only for successful responses 2xx)\n if (response.status >= 200 && response.status < 300) {\n await cacheResponse(result.key, req, response, options)\n } else {\n // End processing without caching for error responses\n await store.endProcessing(cacheKey)\n }\n\n return response\n } catch (error) {\n // End processing lock on error\n await store.endProcessing(cacheKey)\n throw error\n }\n }\n}\n\n// ============================================================================\n// Request Helper\n// ============================================================================\n\n/**\n * Add idempotency key header to outgoing request headers\n */\nexport function addIdempotencyHeader(\n headers: Record<string, string> = {},\n options: { headerName?: string; key?: string } = {}\n): Record<string, string> {\n const { headerName = 'idempotency-key', key = generateIdempotencyKey() } = options\n return {\n ...headers,\n [headerName]: key,\n }\n}\n","/**\n * Combined API Security Middleware\n * @module nextjs-secure/api\n */\n\nimport type { NextRequest } from 'next/server'\nimport type {\n APIProtectionOptions,\n APIProtectionResult,\n APISecurityError,\n APIProtectionPreset,\n SigningOptions,\n ReplayPreventionOptions,\n TimestampOptions,\n VersioningOptions,\n IdempotencyOptions,\n} from './types'\nimport { API_PROTECTION_PRESETS } from './types'\nimport { verifySignature } from './signing'\nimport { checkReplay, getGlobalNonceStore } from './replay'\nimport { validateTimestamp } from './timestamp'\nimport { validateVersion, addDeprecationHeaders } from './versioning'\nimport { checkIdempotency, cacheResponse, createResponseFromCache, getGlobalIdempotencyStore } from './idempotency'\n\n// ============================================================================\n// Combined API Protection\n// ============================================================================\n\n/**\n * Check all API security measures\n */\nexport async function checkAPIProtection(\n req: NextRequest,\n options: APIProtectionOptions\n): Promise<APIProtectionResult> {\n const result: APIProtectionResult = {\n passed: true,\n }\n\n // 1. Timestamp validation (check first - fastest)\n if (options.timestamp !== false) {\n const timestampResult = validateTimestamp(req, options.timestamp as TimestampOptions)\n result.timestamp = timestampResult\n\n if (!timestampResult.valid) {\n result.passed = false\n result.error = {\n type: 'timestamp',\n message: timestampResult.reason || 'Invalid timestamp',\n }\n return result\n }\n }\n\n // 2. Replay prevention (check early)\n if (options.replay !== false) {\n const replayOpts = options.replay as ReplayPreventionOptions\n const replayResult = await checkReplay(req, {\n ...replayOpts,\n store: replayOpts.store || getGlobalNonceStore(),\n })\n result.replay = replayResult\n\n if (replayResult.isReplay) {\n result.passed = false\n result.error = {\n type: 'replay',\n message: 'Request replay detected',\n details: { nonce: replayResult.nonce },\n }\n return result\n }\n\n if (replayResult.reason && replayOpts.required !== false) {\n result.passed = false\n result.error = {\n type: 'replay',\n message: replayResult.reason,\n }\n return result\n }\n }\n\n // 3. Signature verification\n if (options.signing !== false) {\n const signingOpts = options.signing as SigningOptions\n const signingResult = await verifySignature(req, signingOpts)\n result.signing = signingResult\n\n if (!signingResult.valid) {\n result.passed = false\n result.error = {\n type: 'signing',\n message: signingResult.reason || 'Invalid signature',\n }\n return result\n }\n }\n\n // 4. API versioning\n if (options.versioning !== false) {\n const versioningOpts = options.versioning as VersioningOptions\n const versionResult = validateVersion(req, versioningOpts)\n result.version = versionResult\n\n if (!versionResult.valid) {\n result.passed = false\n result.error = {\n type: 'versioning',\n message: versionResult.reason || 'Unsupported version',\n details: { version: versionResult.version },\n }\n return result\n }\n }\n\n // 5. Idempotency (check last - may have side effects)\n if (options.idempotency !== false) {\n const idempotencyOpts = options.idempotency as IdempotencyOptions\n const idempotencyResult = await checkIdempotency(req, {\n ...idempotencyOpts,\n store: idempotencyOpts.store || getGlobalIdempotencyStore(),\n })\n result.idempotency = idempotencyResult\n\n // Error (invalid key format, etc.)\n if (idempotencyResult.reason && !idempotencyResult.isProcessing && !idempotencyResult.fromCache) {\n if (idempotencyOpts.required) {\n result.passed = false\n result.error = {\n type: 'idempotency',\n message: idempotencyResult.reason,\n details: { key: idempotencyResult.key },\n }\n return result\n }\n }\n }\n\n return result\n}\n\n// ============================================================================\n// Combined Middleware\n// ============================================================================\n\n/**\n * Default error response\n */\nfunction defaultErrorResponse(error: APISecurityError): Response {\n const statusMap: Record<APISecurityError['type'], number> = {\n signing: 401,\n replay: 403,\n timestamp: 400,\n versioning: 400,\n idempotency: 400,\n }\n\n const codeMap: Record<APISecurityError['type'], string> = {\n signing: 'INVALID_SIGNATURE',\n replay: 'REPLAY_DETECTED',\n timestamp: 'INVALID_TIMESTAMP',\n versioning: 'UNSUPPORTED_VERSION',\n idempotency: 'IDEMPOTENCY_ERROR',\n }\n\n return new Response(\n JSON.stringify({\n error: error.type === 'signing' ? 'Unauthorized' : error.type === 'replay' ? 'Forbidden' : 'Bad Request',\n message: error.message,\n code: codeMap[error.type],\n ...(error.details || {}),\n }),\n {\n status: statusMap[error.type],\n headers: { 'Content-Type': 'application/json' },\n }\n )\n}\n\n/**\n * Create combined API protection middleware\n */\nexport function withAPIProtection<T = unknown>(\n handler: (req: NextRequest, ctx: T) => Response | Promise<Response>,\n options: APIProtectionOptions\n): (req: NextRequest, ctx: T) => Promise<Response> {\n return async (req: NextRequest, ctx: T): Promise<Response> => {\n // Check if should skip all checks\n if (options.skip && await options.skip(req)) {\n return handler(req, ctx)\n }\n\n // Run all checks\n const result = await checkAPIProtection(req, options)\n\n // Handle error\n if (!result.passed && result.error) {\n const onError = options.onError || defaultErrorResponse\n return onError(result.error)\n }\n\n // Handle idempotency cache hit\n if (result.idempotency?.fromCache && result.idempotency.cachedResponse) {\n const idempotencyOpts = options.idempotency as IdempotencyOptions\n if (idempotencyOpts.onCacheHit) {\n idempotencyOpts.onCacheHit(result.idempotency.key!, result.idempotency.cachedResponse)\n }\n return createResponseFromCache(result.idempotency.cachedResponse)\n }\n\n // Handle idempotency conflict (concurrent request)\n if (result.idempotency?.isProcessing) {\n return new Response(\n JSON.stringify({\n error: 'Conflict',\n message: 'Request with this idempotency key is currently being processed',\n code: 'IDEMPOTENCY_CONFLICT',\n }),\n {\n status: 409,\n headers: { 'Content-Type': 'application/json' },\n }\n )\n }\n\n // Execute handler\n let response = await handler(req, ctx)\n\n // Add deprecation headers if needed\n if (result.version?.status === 'deprecated') {\n const versioningOpts = options.versioning as VersioningOptions\n if (versioningOpts.addDeprecationHeaders !== false) {\n response = addDeprecationHeaders(response, result.version.version!, result.version.sunsetDate)\n }\n if (versioningOpts.onDeprecated) {\n versioningOpts.onDeprecated(result.version.version!, result.version.sunsetDate)\n }\n }\n\n // Cache response for idempotency\n if (result.idempotency?.key && options.idempotency !== false) {\n const idempotencyOpts = options.idempotency as IdempotencyOptions\n if (response.status >= 200 && response.status < 300) {\n await cacheResponse(result.idempotency.key, req, response, idempotencyOpts)\n }\n }\n\n return response\n }\n}\n\n// ============================================================================\n// Preset-based Middleware\n// ============================================================================\n\n/**\n * Create API protection middleware using preset\n */\nexport function withAPIProtectionPreset<T = unknown>(\n handler: (req: NextRequest, ctx: T) => Response | Promise<Response>,\n preset: APIProtectionPreset,\n overrides: Partial<APIProtectionOptions> = {}\n): (req: NextRequest, ctx: T) => Promise<Response> {\n const presetConfig = API_PROTECTION_PRESETS[preset]\n const mergedOptions: APIProtectionOptions = {\n ...presetConfig,\n ...overrides,\n }\n\n // Handle nested options merging (only merge if both preset and override have objects, not false)\n if (presetConfig.signing && typeof presetConfig.signing === 'object' &&\n overrides.signing && typeof overrides.signing === 'object') {\n mergedOptions.signing = { ...presetConfig.signing, ...overrides.signing }\n }\n if (presetConfig.replay && typeof presetConfig.replay === 'object' &&\n overrides.replay && typeof overrides.replay === 'object') {\n mergedOptions.replay = { ...presetConfig.replay, ...overrides.replay }\n }\n if (presetConfig.timestamp && typeof presetConfig.timestamp === 'object' &&\n overrides.timestamp && typeof overrides.timestamp === 'object') {\n mergedOptions.timestamp = { ...presetConfig.timestamp, ...overrides.timestamp }\n }\n if (presetConfig.idempotency && typeof presetConfig.idempotency === 'object' &&\n overrides.idempotency && typeof overrides.idempotency === 'object') {\n mergedOptions.idempotency = { ...presetConfig.idempotency, ...overrides.idempotency }\n }\n\n return withAPIProtection(handler, mergedOptions)\n}\n\n// ============================================================================\n// Convenience Exports\n// ============================================================================\n\n// Re-export individual middleware for selective use\nexport { withRequestSigning } from './signing'\nexport { withReplayPrevention } from './replay'\nexport { withTimestamp } from './timestamp'\nexport { withAPIVersion } from './versioning'\nexport { withIdempotency } from './idempotency'\n"]}