typekro 0.44.1 → 0.45.0

package/dist/factories/crowdsec/utils/helm-values-mapper.js

@@ -0,0 +1,473 @@
+/**
+ * CrowdSec Helm values mapping for the official `crowdsec` chart 0.24.2.
+ *
+ * The detection policy (acquisitions, collections, allowlist, simulation,
+ * AppSec) is rendered into CrowdSec config FILES, so it comes from the
+ * build-time options and is always concrete. The runtime spec only supplies
+ * values that land in the tree as-is (names, resources, replicas), which may be
+ * schema references in KRO mode and are never branched on here.
+ */
+import { dump } from 'js-yaml';
+import { TypeKroError } from '../../../core/errors.js';
+import { Cel } from '../../../core/references/cel.js';
+import { isCelExpression, isKubernetesRef } from '../../../utils/type-guards.js';
+import { CROWDSEC_APPSEC_PORT, CROWDSEC_KUBECTL_IMAGE_TAG, DEFAULT_CROWDSEC_COLLECTIONS, } from '../constants.js';
+import { isCidr, isIp } from './net.js';
+// Defaults sized from a kind run with the Traefik collections and CRS loaded.
+// Requests are always set so no CrowdSec pod is BestEffort. No CPU limits:
+// AppSec sits on the request path, and throttling LAPI delays every pull.
+const DEFAULT_LAPI_RESOURCES = {
+    requests: { cpu: '100m', memory: '256Mi' },
+    limits: { memory: '512Mi' },
+};
+const DEFAULT_AGENT_RESOURCES = {
+    requests: { cpu: '100m', memory: '192Mi' },
+    limits: { memory: '384Mi' },
+};
+const DEFAULT_APPSEC_RESOURCES = {
+    requests: { cpu: '200m', memory: '384Mi' },
+    limits: { memory: '768Mi' },
+};
+// The chart's own default for `api.server.auto_registration.allowed_ranges`.
+const DEFAULT_AUTO_REGISTRATION_RANGES = [
+    '127.0.0.1/32',
+    '192.168.0.0/16',
+    '10.0.0.0/8',
+    '172.16.0.0/12',
+];
+/** Default acquisition: the pods `traefikBootstrap` creates with its defaults. */
+export const DEFAULT_CROWDSEC_ACQUISITIONS = [
+    { namespace: 'traefik', podName: 'traefik-*' },
+];
+/** File names this factory writes into the chart's config maps. */
+export const CROWDSEC_GENERATED_FILES = {
+    allowlist: 'typekro-allowlist.yaml',
+    appsecPolicy: 'typekro-appsec-policy.yaml',
+};
+/** Name of the AppSec config holding the body limit and the exclusions. */
+export const CROWDSEC_APPSEC_POLICY_NAME = 'typekro/appsec-policy';
+const BOUNCER_NAME = /^[A-Za-z0-9_]+$/;
+const DNS_LABEL = /^(?=.{1,63}$)[a-z0-9](?:[-a-z0-9]*[a-z0-9])?$/;
+function fail(message, context) {
+    throw new TypeKroError(message, 'CROWDSEC_INVALID_OPTIONS', context);
+}
+// Every option string lands in the values tree, where KRO would read `${` as CEL.
+function assertNoCel(options) {
+    const strings = [
+        options.allowlist?.reason,
+        options.centralApi?.enrollment?.instanceName,
+        ...(options.centralApi?.enrollment?.tags ?? []),
+        ...(options.collections ?? []),
+        ...(options.simulation?.global ? (options.simulation.enforce ?? []) : []),
+        ...(options.simulation && !options.simulation.global
+            ? (options.simulation.simulate ?? [])
+            : []),
+        ...(options.lapi?.autoRegistrationRanges ?? []),
+        ...(options.appsec?.exclusions ?? []).flatMap((e) => [e.ruleName, e.ruleTag, e.pathPrefix]),
+        ...(options.storage?.type === 'postgres'
+            ? [options.storage.host, options.storage.database, options.storage.user]
+            : []),
+        ...[...(options.lapi?.env ?? []), ...(options.agent?.env ?? [])].flatMap((env) => [
+            env.name,
+            env.value,
+            JSON.stringify(env.valueFrom ?? null),
+        ]),
+        options.networkPolicy?.traefikNamespace,
+        options.networkPolicy?.metricsNamespace,
+    ];
+    for (const value of strings) {
+        if (value?.includes('${'))
+            fail(`"${value}" contains "\${", which KRO would parse as CEL.`);
+    }
+}
+/**
+ * Throw on option combinations the chart would accept but CrowdSec would run
+ * wrongly, or not at all.
+ *
+ * @throws {TypeKroError} `CROWDSEC_INVALID_OPTIONS`
+ */
+export function assertCrowdsecBootstrapOptions(options) {
+    assertNoCel(options);
+    const storage = options.storage ?? { type: 'sqlite' };
+    const replicas = options.lapi?.replicas ?? 1;
+    if (!Number.isInteger(replicas) || replicas < 1) {
+        fail(`lapi.replicas must be a positive integer, got ${replicas}.`);
+    }
+    if (replicas > 1 && storage.type === 'sqlite') {
+        fail('lapi.replicas > 1 needs storage.type "postgres": SQLite lives on one ReadWriteOnce volume.');
+    }
+    const acquisitions = options.acquisitions ?? DEFAULT_CROWDSEC_ACQUISITIONS;
+    if (acquisitions.length === 0)
+        fail('At least one acquisition is required.');
+    for (const acquisition of acquisitions) {
+        // The chart interpolates both into a file glob.
+        if (!/^[a-z0-9*?.-]+$/.test(acquisition.podName) ||
+            !/^[a-z0-9-]+$/.test(acquisition.namespace)) {
+            fail(`Acquisition ${acquisition.namespace}/${acquisition.podName} is not a namespace and pod-name glob.`);
+        }
+    }
+    for (const namespace of [
+        options.networkPolicy?.traefikNamespace,
+        options.networkPolicy?.metricsNamespace,
+    ]) {
+        if (namespace !== undefined && !DNS_LABEL.test(namespace)) {
+            fail(`networkPolicy namespace "${namespace}" is not a DNS-1123 label.`);
+        }
+    }
+    const names = new Set();
+    for (const bouncer of options.bouncers ?? []) {
+        if (!BOUNCER_NAME.test(bouncer.name)) {
+            fail(`Bouncer name "${bouncer.name}" must match ${BOUNCER_NAME}; it becomes an env var.`);
+        }
+        if (names.has(bouncer.name))
+            fail(`Bouncer "${bouncer.name}" is declared twice.`);
+        names.add(bouncer.name);
+    }
+    for (const ip of options.allowlist?.ips ?? []) {
+        if (!isIp(ip))
+            fail(`Allowlist IP "${ip}" is not an IPv4 or IPv6 address.`);
+    }
+    for (const cidr of options.allowlist?.cidrs ?? []) {
+        if (!isCidr(cidr))
+            fail(`Allowlist CIDR "${cidr}" is not a valid range.`);
+    }
+    // The bouncer talks plain http to LAPI; with chart TLS on it could not
+    // connect, and a fail-open bouncer would then let everything through.
+    const rawTls = options.values?.tls;
+    if (rawTls?.enabled === true) {
+        fail('values.tls.enabled is not supported: the Traefik bouncer reaches LAPI over http.');
+    }
+    const enrollment = options.centralApi?.enrollment;
+    if (enrollment?.tags?.some((tag) => /\s/.test(tag) || tag.length === 0)) {
+        fail('Enrollment tags must be non-empty and contain no whitespace.');
+    }
+    const appsec = options.appsec;
+    if (appsec) {
+        if (appsec.virtualPatching === false && appsec.crs === false) {
+            fail('appsec needs virtualPatching or crs; omit appsec to disable it.');
+        }
+        const size = appsec.maxBodySize;
+        if (size !== undefined && (!Number.isInteger(size) || size <= 0)) {
+            fail(`appsec.maxBodySize must be a positive integer, got ${size}.`);
+        }
+        for (const exclusion of appsec.exclusions ?? []) {
+            const selectors = [exclusion.ruleId, exclusion.ruleName, exclusion.ruleTag].filter((value) => value !== undefined);
+            if (selectors.length !== 1) {
+                fail('Each appsec exclusion sets exactly one of ruleId, ruleName or ruleTag.');
+            }
+            for (const text of [exclusion.ruleName, exclusion.ruleTag, exclusion.pathPrefix]) {
+                if (text !== undefined && /['"\\\n]/.test(text)) {
+                    fail(`Appsec exclusion value "${text}" may not contain quotes, backslashes or newlines.`);
+                }
+            }
+            if (exclusion.pathPrefix !== undefined && !exclusion.pathPrefix.startsWith('/')) {
+                fail(`Appsec exclusion pathPrefix "${exclusion.pathPrefix}" must start with "/".`);
+            }
+        }
+    }
+}
+function isGraphValue(value) {
+    return isKubernetesRef(value) || isCelExpression(value);
+}
+function isPlainObject(value) {
+    return (value !== null && typeof value === 'object' && !Array.isArray(value) && !isGraphValue(value));
+}
+// Deep merge where refs, CEL and arrays are leaves and `override` wins.
+function merge(base, override) {
+    const result = { ...base };
+    for (const [key, value] of Object.entries(override)) {
+        const current = result[key];
+        result[key] = isPlainObject(current) && isPlainObject(value) ? merge(current, value) : value;
+    }
+    return result;
+}
+function yaml(value, quoted = false) {
+    return dump(value, { lineWidth: -1, noRefs: true, forceQuotes: quoted, quotingType: '"' });
+}
+function placementValues(placement, defaultSpread) {
+    const spread = placement?.topologySpreadConstraints ?? defaultSpread;
+    return {
+        ...(placement?.nodeSelector ? { nodeSelector: { ...placement.nodeSelector } } : {}),
+        ...(placement?.tolerations ? { tolerations: [...placement.tolerations] } : {}),
+        ...(placement?.affinity ? { affinity: placement.affinity } : {}),
+        ...(spread ? { topologySpreadConstraints: [...spread] } : {}),
+        ...(placement?.priorityClassName ? { priorityClassName: placement.priorityClassName } : {}),
+    };
+}
+function softSpread(name, component) {
+    return [
+        {
+            maxSkew: 1,
+            topologyKey: 'kubernetes.io/hostname',
+            whenUnsatisfiable: 'ScheduleAnyway',
+            labelSelector: { matchLabels: { 'k8s-app': name, type: component } },
+        },
+    ];
+}
+function secretEnv(name, ref) {
+    return { name, valueFrom: { secretKeyRef: { name: ref.name, key: ref.key } } };
+}
+/** The parser (and postoverflow) whitelist this factory renders, or `undefined`. */
+export function renderCrowdsecAllowlist(allowlist) {
+    const ips = allowlist?.ips ?? [];
+    const cidrs = allowlist?.cidrs ?? [];
+    if (ips.length === 0 && cidrs.length === 0)
+        return undefined;
+    return yaml({
+        name: 'typekro/allowlist',
+        description: 'IPs and ranges allowlisted by the TypeKro CrowdSec bootstrap',
+        whitelist: {
+            reason: allowlist?.reason ?? 'typekro allowlist',
+            ...(ips.length > 0 ? { ip: [...ips] } : {}),
+            ...(cidrs.length > 0 ? { cidr: [...cidrs] } : {}),
+        },
+    });
+}
+/** `simulation.yaml`, or `''` when simulation is not configured. */
+export function renderCrowdsecSimulation(simulation) {
+    if (!simulation)
+        return '';
+    // CrowdSec's `exclusions` invert the global flag: under global simulation
+    // they enforce, otherwise they are the only scenarios simulated.
+    const exclusions = simulation.global ? simulation.enforce : simulation.simulate;
+    return yaml({ simulation: simulation.global, exclusions: [...(exclusions ?? [])] });
+}
+function exclusionCall(exclusion, band) {
+    if (exclusion.ruleId !== undefined)
+        return `Remove${band}RuleByID(${exclusion.ruleId})`;
+    if (exclusion.ruleName !== undefined)
+        return `Remove${band}RuleByName('${exclusion.ruleName}')`;
+    return `Remove${band}RuleByTag('${exclusion.ruleTag}')`;
+}
+/** The AppSec config carrying the body limit and the rule exclusions. */
+export function renderCrowdsecAppsecPolicy(options) {
+    const appsec = options.appsec ?? {};
+    const remediation = appsec.inBandRemediation ?? (options.simulation?.global ? 'allow' : 'ban');
+    const onLoad = [
+        `SetMaxBodySize(${appsec.maxBodySize ?? 10_485_760})`,
+        `SetBodySizeExceededAction('${appsec.bodySizeExceededAction ?? 'partial'}')`,
+    ];
+    const preEval = [];
+    for (const exclusion of appsec.exclusions ?? []) {
+        const phase = exclusion.phase ?? 'both';
+        const calls = [
+            ...(phase === 'outofband' ? [] : [exclusionCall(exclusion, 'InBand')]),
+            ...(phase === 'inband' ? [] : [exclusionCall(exclusion, 'OutBand')]),
+        ];
+        if (exclusion.pathPrefix === undefined)
+            onLoad.push(...calls);
+        else
+            preEval.push({ filter: `req.URL.Path startsWith '${exclusion.pathPrefix}'`, apply: calls });
+    }
+    return yaml({
+        name: CROWDSEC_APPSEC_POLICY_NAME,
+        // Loaded last, so it sets the remediation for every config before it.
+        default_remediation: remediation,
+        on_load: [{ apply: onLoad }],
+        ...(preEval.length > 0 ? { pre_eval: preEval } : {}),
+    });
+}
+function clusterIpOnly() {
+    return { type: 'ClusterIP', externalIPs: [], loadBalancerIP: '', loadBalancerClass: '' };
+}
+function configYamlLocal(options) {
+    const storage = options.storage ?? { type: 'sqlite' };
+    const server = {
+        auto_registration: {
+            enabled: true,
+            // CrowdSec expands `$VAR` from the env. Not `${VAR}`: KRO would parse it as CEL.
+            token: '$REGISTRATION_TOKEN',
+            allowed_ranges: [
+                ...(options.lapi?.autoRegistrationRanges ?? DEFAULT_AUTO_REGISTRATION_RANGES),
+            ],
+        },
+    };
+    if (options.centralApi && options.centralApi.communityBlocklist === false) {
+        server.online_client = { pull: { community: false } };
+    }
+    // The password reaches CrowdSec as the plain scalar `password: $DB_PASSWORD`
+    // whatever this file says: CrowdSec 1.8 first decodes config.yaml and this
+    // file, merges and re-encodes them (go-cs-lib's YAML patcher), and only then
+    // expands `$VAR` and parses the result, so no quoting or block style set here
+    // survives. It then puts the password unquoted into a key=value Postgres
+    // connection string. CrowdSec offers no password file or DSN alternative, so
+    // the password must read back unchanged as a plain YAML scalar and contain no
+    // whitespace or backslash; the docs say so (the value lives in a Secret, so it
+    // cannot be checked here).
+    return yaml({
+        api: { server },
+        ...(storage.type === 'postgres'
+            ? {
+                db_config: {
+                    type: 'postgresql',
+                    user: storage.user,
+                    password: '$DB_PASSWORD',
+                    db_name: storage.database,
+                    host: storage.host,
+                    port: storage.port ?? 5432,
+                    sslmode: storage.sslMode ?? 'require',
+                },
+            }
+            : {}),
+    }, true);
+}
+function collections(options) {
+    return [...new Set([...DEFAULT_CROWDSEC_COLLECTIONS, ...(options.collections ?? [])])].join(' ');
+}
+/**
+ * Map the runtime spec and the build options to chart values.
+ *
+ * `options.values` is merged first; the mapped values win, and the network
+ * pins (no LAPI Ingress, ClusterIP Services only) are applied last.
+ */
+export function mapCrowdsecConfigToHelmValues(spec, options = {}) {
+    assertCrowdsecBootstrapOptions(options);
+    const storage = options.storage ?? { type: 'sqlite' };
+    const sqlite = storage.type === 'sqlite';
+    const acquisitions = options.acquisitions ?? DEFAULT_CROWDSEC_ACQUISITIONS;
+    const capi = options.centralApi !== undefined;
+    const appsec = options.appsec;
+    const allowlist = renderCrowdsecAllowlist(options.allowlist);
+    const simulation = renderCrowdsecSimulation(options.simulation);
+    const metrics = {
+        enabled: true,
+        serviceMonitor: { enabled: options.metrics?.serviceMonitor ?? false },
+        podMonitor: { enabled: options.metrics?.podMonitor ?? false },
+    };
+    const lapiEnv = [];
+    if (!capi)
+        lapiEnv.push({ name: 'DISABLE_ONLINE_API', value: 'true' });
+    const enrollment = options.centralApi?.enrollment;
+    if (enrollment) {
+        lapiEnv.push(secretEnv('ENROLL_KEY', enrollment.keySecretRef));
+        if (enrollment.instanceName) {
+            lapiEnv.push({ name: 'ENROLL_INSTANCE_NAME', value: enrollment.instanceName });
+        }
+        if (enrollment.tags?.length)
+            lapiEnv.push({ name: 'ENROLL_TAGS', value: enrollment.tags.join(' ') });
+    }
+    for (const bouncer of options.bouncers ?? []) {
+        lapiEnv.push(secretEnv(`BOUNCER_KEY_${bouncer.name}`, bouncer.keySecretRef));
+    }
+    if (storage.type === 'postgres')
+        lapiEnv.push(secretEnv('DB_PASSWORD', storage.passwordSecretRef));
+    lapiEnv.push(...(options.lapi?.env ?? []));
+    const mapped = {
+        container_runtime: options.agent?.containerRuntime ?? 'containerd',
+        // Upstream defaults the register Jobs' kubectl image to `latest`.
+        image: { kubectl: { tag: CROWDSEC_KUBECTL_IMAGE_TAG } },
+        config: {
+            parsers: {
+                's02-enrich': allowlist ? { [CROWDSEC_GENERATED_FILES.allowlist]: allowlist } : {},
+            },
+            'simulation.yaml': simulation,
+            'config.yaml.local': configYamlLocal(options),
+        },
+        lapi: {
+            replicas: options.lapi?.replicas ?? 1,
+            env: lapiEnv,
+            resources: Cel.default(spec.lapi?.resources, DEFAULT_LAPI_RESOURCES),
+            // SQLite on one RWO volume cannot overlap two pods during a rollout.
+            strategy: { type: sqlite ? 'Recreate' : 'RollingUpdate' },
+            persistentVolume: {
+                data: {
+                    enabled: sqlite,
+                    ...(sqlite && storage.size ? { size: storage.size } : {}),
+                    ...(sqlite && storage.storageClassName
+                        ? { storageClassName: storage.storageClassName }
+                        : {}),
+                },
+                // Config comes from values, never from a stale copy on a volume.
+                config: { enabled: false },
+            },
+            // Credentials in Secrets let replicas share one identity. The chart only
+            // grants its register Jobs RBAC when CAPI is on, so both follow it.
+            storeCAPICredentialsInSecret: capi,
+            storeLAPICscliCredentialsInSecret: capi,
+            metrics,
+            ...placementValues(options.lapi?.placement, softSpread(spec.name, 'lapi')),
+        },
+        agent: {
+            isDeployment: false,
+            acquisition: acquisitions.map((a) => ({
+                namespace: a.namespace,
+                podName: a.podName,
+                program: a.program ?? 'traefik',
+            })),
+            env: [{ name: 'COLLECTIONS', value: collections(options) }, ...(options.agent?.env ?? [])],
+            resources: Cel.default(spec.agent?.resources, DEFAULT_AGENT_RESOURCES),
+            metrics,
+            ...placementValues(options.agent?.placement, undefined),
+        },
+        appsec: appsec
+            ? appsecValues(spec, options, allowlist, simulation, metrics)
+            : { enabled: false },
+    };
+    const merged = merge({ ...(options.values ?? {}) }, mapped);
+    return merge(merged, {
+        // @security LAPI holds every bouncer key and decision: never published.
+        // ClusterIP alone is not enough: the chart also renders `externalIPs`,
+        // `loadBalancerIP` and `loadBalancerClass` from values, whatever the type.
+        lapi: { ingress: { enabled: false }, service: clusterIpOnly() },
+        agent: { service: clusterIpOnly() },
+        appsec: { service: clusterIpOnly() },
+        // @security The bouncer speaks http to LAPI (see assertCrowdsecBootstrapOptions).
+        tls: { enabled: false },
+    });
+}
+function appsecValues(spec, options, allowlist, simulation, metrics) {
+    const appsec = options.appsec ?? {};
+    const configs = [
+        ...(appsec.virtualPatching === false ? [] : ['crowdsecurity/appsec-default']),
+        ...(appsec.crs === false ? [] : ['crowdsecurity/crs']),
+        CROWDSEC_APPSEC_POLICY_NAME,
+    ];
+    const appsecCollections = [
+        // `appsec-default` loads rules from both of these collections.
+        ...(appsec.virtualPatching === false
+            ? []
+            : ['crowdsecurity/appsec-virtual-patching', 'crowdsecurity/appsec-generic-rules']),
+        ...(appsec.crs === false ? [] : ['crowdsecurity/appsec-crs']),
+    ];
+    return {
+        enabled: true,
+        replicas: Cel.default(spec.appsec?.replicas, 1),
+        strategy: { type: 'RollingUpdate' },
+        acquisitions: [
+            {
+                source: 'appsec',
+                listen_addr: `0.0.0.0:${CROWDSEC_APPSEC_PORT}`,
+                path: '/',
+                appsec_configs: configs,
+                labels: { type: 'appsec' },
+            },
+        ],
+        configs: { [CROWDSEC_GENERATED_FILES.appsecPolicy]: renderCrowdsecAppsecPolicy(options) },
+        env: [{ name: 'COLLECTIONS', value: appsecCollections.join(' ') }],
+        // The chart mounts parsers only on agents; AppSec alerts are allowlisted
+        // after the overflow instead.
+        postoverflows: {
+            's01-whitelist': allowlist ? { [CROWDSEC_GENERATED_FILES.allowlist]: allowlist } : {},
+        },
+        // The chart mounts simulation.yaml only on agents; AppSec scenarios
+        // (out-of-band CRS bans) must honour it too.
+        ...(simulation
+            ? {
+                extraVolumes: [
+                    { name: 'typekro-simulation', configMap: { name: 'crowdsec-simulation' } },
+                ],
+                extraVolumeMounts: [
+                    {
+                        name: 'typekro-simulation',
+                        mountPath: '/etc/crowdsec/simulation.yaml',
+                        subPath: 'simulation.yaml',
+                    },
+                ],
+            }
+            : {}),
+        resources: Cel.default(spec.appsec?.resources, DEFAULT_APPSEC_RESOURCES),
+        metrics,
+        ...placementValues(appsec.placement, softSpread(spec.name, 'appsec')),
+    };
+}
+//# sourceMappingURL=helm-values-mapper.js.map

package/dist/factories/crowdsec/utils/helm-values-mapper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helm-values-mapper.js","sourceRoot":"","sources":["../../../../src/factories/crowdsec/utils/helm-values-mapper.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAE/B,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,GAAG,EAAE,MAAM,iCAAiC,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACjF,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AASzB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAExC,8EAA8E;AAC9E,2EAA2E;AAC3E,0EAA0E;AAC1E,MAAM,sBAAsB,GAAsB;IAChD,QAAQ,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;IAC1C,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;CAC5B,CAAC;AACF,MAAM,uBAAuB,GAAsB;IACjD,QAAQ,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;IAC1C,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;CAC5B,CAAC;AACF,MAAM,wBAAwB,GAAsB;IAClD,QAAQ,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;IAC1C,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;CAC5B,CAAC;AAEF,6EAA6E;AAC7E,MAAM,gCAAgC,GAAG;IACvC,cAAc;IACd,gBAAgB;IAChB,YAAY;IACZ,eAAe;CAChB,CAAC;AAEF,kFAAkF;AAClF,MAAM,CAAC,MAAM,6BAA6B,GAAmC;IAC3E,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE;CAC/C,CAAC;AAEF,mEAAmE;AACnE,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,SAAS,EAAE,wBAAwB;IACnC,YAAY,EAAE,4BAA4B;CAClC,CAAC;AAEX,2EAA2E;AAC3E,MAAM,CAAC,MAAM,2BAA2B,GAAG,uBAAuB,CAAC;AAEnE,MAAM,YAAY,GAAG,iBAAiB,CAAC;AACvC,MAAM,SAAS,GAAG,+CAA+C,CAAC;AAElE,SAAS,IAAI,CAAC,OAAe,EAAE,OAAiC;IAC9D,MAAM,IAAI,YAAY,CAAC,OAAO,EAAE,0BAA0B,EAAE,OAAO,CAAC,CAAC;AACvE,CAAC;AAED,kFAAkF;AAClF,SAAS,WAAW,CAAC,OAAiC;IACpD,MAAM,OAAO,GAA2B;QACtC,OAAO,CAAC,SAAS,EAAE,MAAM;QACzB,OAAO,CAAC,UAAU,EAAE,UAAU,EAAE,YAAY;QAC5C,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC;QAC/C,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;QAC9B,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM;YAClD,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,IAAI,EAAE,CAAC;YACrC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,sBAAsB,IAAI,EAAE,CAAC;QAC/C,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;QAC3F,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,KAAK,UAAU;YACtC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YACxE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;YAChF,GAAG,CAAC,IAAI;YACR,GAAG,CAAC,KAAK;YACT,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC;SACtC,CAAC;QACF,OAAO,CAAC,aAAa,EAAE,gBAAgB;QACvC,OAAO,CAAC,aAAa,EAAE,gBAAgB;KACxC,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,IAAI,KAAK,iDAAiD,CAAC,CAAC;IAC9F,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAAC,OAAiC;IAC9E,WAAW,CAAC,OAAO,CAAC,CAAC;IACrB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,iDAAiD,QAAQ,GAAG,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,QAAQ,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,IAAI,CACF,4FAA4F,CAC7F,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,6BAA6B,CAAC;IAC3E,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,uCAAuC,CAAC,CAAC;IAC7E,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,gDAAgD;QAChD,IACE,CAAC,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;YAC5C,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAC3C,CAAC;YACD,IAAI,CACF,eAAe,WAAW,CAAC,SAAS,IAAI,WAAW,CAAC,OAAO,wCAAwC,CACpG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,SAAS,IAAI;QACtB,OAAO,CAAC,aAAa,EAAE,gBAAgB;QACvC,OAAO,CAAC,aAAa,EAAE,gBAAgB;KACxC,EAAE,CAAC;QACF,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1D,IAAI,CAAC,4BAA4B,SAAS,4BAA4B,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC7C,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,iBAAiB,OAAO,CAAC,IAAI,gBAAgB,YAAY,0BAA0B,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,YAAY,OAAO,CAAC,IAAI,sBAAsB,CAAC,CAAC;QAClF,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,SAAS,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,IAAI,CAAC,iBAAiB,EAAE,mCAAmC,CAAC,CAAC;IAC9E,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,mBAAmB,IAAI,yBAAyB,CAAC,CAAC;IAC5E,CAAC;IAED,uEAAuE;IACvE,sEAAsE;IACtE,MAAM,MAAM,GAAI,OAAO,CAAC,MAAsD,EAAE,GAAG,CAAC;IACpF,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,kFAAkF,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC;IAClD,IAAI,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC,8DAA8D,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,MAAM,CAAC,eAAe,KAAK,KAAK,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;YAC7D,IAAI,CAAC,iEAAiE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC;QAChC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC;YACjE,IAAI,CAAC,sDAAsD,IAAI,GAAG,CAAC,CAAC;QACtE,CAAC;QACD,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YAChD,MAAM,SAAS,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM,CAChF,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAC/B,CAAC;YACF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,IAAI,CAAC,wEAAwE,CAAC,CAAC;YACjF,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjF,IAAI,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChD,IAAI,CAAC,2BAA2B,IAAI,oDAAoD,CAAC,CAAC;gBAC5F,CAAC;YACH,CAAC;YACD,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChF,IAAI,CAAC,gCAAgC,SAAS,CAAC,UAAU,wBAAwB,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,eAAe,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,CACL,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAC7F,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,SAAS,KAAK,CAAC,IAA6B,EAAE,QAAiC;IAC7E,MAAM,MAAM,GAA4B,EAAE,GAAG,IAAI,EAAE,CAAC;IACpD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,MAAM,GAAG,KAAK;IAC1C,OAAO,IAAI,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,eAAe,CACtB,SAAwC,EACxC,aAAoD;IAEpD,MAAM,MAAM,GAAG,SAAS,EAAE,yBAAyB,IAAI,aAAa,CAAC;IACrE,OAAO;QACL,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,GAAG,SAAS,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,SAAS,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5F,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAa,EAAE,SAAiB;IAClD,OAAO;QACL;YACE,OAAO,EAAE,CAAC;YACV,WAAW,EAAE,wBAAwB;YACrC,iBAAiB,EAAE,gBAAgB;YACnC,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;SACrE;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,GAAkC;IACjE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC;AACjF,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,uBAAuB,CACrC,SAAgD;IAEhD,MAAM,GAAG,GAAG,SAAS,EAAE,GAAG,IAAI,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC;IACrC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7D,OAAO,IAAI,CAAC;QACV,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,8DAA8D;QAC3E,SAAS,EAAE;YACT,MAAM,EAAE,SAAS,EAAE,MAAM,IAAI,mBAAmB;YAChD,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD;KACF,CAAC,CAAC;AACL,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,wBAAwB,CACtC,UAAkD;IAElD,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IAC3B,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC;IAChF,OAAO,IAAI,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,aAAa,CAAC,SAAkC,EAAE,IAA0B;IACnF,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,IAAI,YAAY,SAAS,CAAC,MAAM,GAAG,CAAC;IACxF,IAAI,SAAS,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,IAAI,eAAe,SAAS,CAAC,QAAQ,IAAI,CAAC;IAChG,OAAO,SAAS,IAAI,cAAc,SAAS,CAAC,OAAO,IAAI,CAAC;AAC1D,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,0BAA0B,CAAC,OAAiC;IAC1E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;IACpC,MAAM,WAAW,GAAG,MAAM,CAAC,iBAAiB,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC/F,MAAM,MAAM,GAAa;QACvB,kBAAkB,MAAM,CAAC,WAAW,IAAI,UAAU,GAAG;QACrD,8BAA8B,MAAM,CAAC,sBAAsB,IAAI,SAAS,IAAI;KAC7E,CAAC;IACF,MAAM,OAAO,GAA0C,EAAE,CAAC;IAC1D,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,IAAI,MAAM,CAAC;QACxC,MAAM,KAAK,GAAG;YACZ,GAAG,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;YACtE,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;SACrE,CAAC;QACF,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;;YAE5D,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,4BAA4B,SAAS,CAAC,UAAU,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,IAAI,CAAC;QACV,IAAI,EAAE,2BAA2B;QACjC,sEAAsE;QACtE,mBAAmB,EAAE,WAAW;QAChC,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAC5B,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC;AAC3F,CAAC;AAED,SAAS,eAAe,CAAC,OAAiC;IACxD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACtD,MAAM,MAAM,GAA4B;QACtC,iBAAiB,EAAE;YACjB,OAAO,EAAE,IAAI;YACb,iFAAiF;YACjF,KAAK,EAAE,qBAAqB;YAC5B,cAAc,EAAE;gBACd,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,sBAAsB,IAAI,gCAAgC,CAAC;aAC9E;SACF;KACF,CAAC;IACF,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,kBAAkB,KAAK,KAAK,EAAE,CAAC;QAC1E,MAAM,CAAC,aAAa,GAAG,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC;IACxD,CAAC;IACD,6EAA6E;IAC7E,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,yEAAyE;IACzE,6EAA6E;IAC7E,8EAA8E;IAC9E,+EAA+E;IAC/E,2BAA2B;IAC3B,OAAO,IAAI,CACT;QACE,GAAG,EAAE,EAAE,MAAM,EAAE;QACf,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU;YAC7B,CAAC,CAAC;gBACE,SAAS,EAAE;oBACT,IAAI,EAAE,YAAY;oBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,QAAQ,EAAE,cAAc;oBACxB,OAAO,EAAE,OAAO,CAAC,QAAQ;oBACzB,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;oBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,SAAS;iBACtC;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,EACD,IAAI,CACL,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,OAAiC;IACpD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,4BAA4B,EAAE,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAC3C,IAA6B,EAC7B,UAAoC,EAAE;IAEtC,8BAA8B,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACtD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC;IACzC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,6BAA6B,CAAC;IAC3E,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,wBAAwB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG;QACd,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,cAAc,IAAI,KAAK,EAAE;QACrE,UAAU,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE;KAC9D,CAAC;IAEF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC;IAClD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;QAC/D,IAAI,UAAU,CAAC,YAAY,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,EAAE,MAAM;YACzB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,OAAO,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU;QAC7B,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACpE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;IAE3C,MAAM,MAAM,GAA4B;QACtC,iBAAiB,EAAE,OAAO,CAAC,KAAK,EAAE,gBAAgB,IAAI,YAAY;QAClE,kEAAkE;QAClE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,0BAA0B,EAAE,EAAE;QACvD,MAAM,EAAE;YACN,OAAO,EAAE;gBACP,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,wBAAwB,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE;aACnF;YACD,iBAAiB,EAAE,UAAU;YAC7B,mBAAmB,EAAE,eAAe,CAAC,OAAO,CAAC;SAC9C;QACD,IAAI,EAAE;YACJ,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC;YACrC,GAAG,EAAE,OAAO;YACZ,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,sBAAsB,CAAC;YACpE,qEAAqE;YACrE,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,eAAe,EAAE;YACzD,gBAAgB,EAAE;gBAChB,IAAI,EAAE;oBACJ,OAAO,EAAE,MAAM;oBACf,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzD,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,gBAAgB;wBACpC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE;wBAChD,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,iEAAiE;gBACjE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;aAC3B;YACD,yEAAyE;YACzE,oEAAoE;YACpE,4BAA4B,EAAE,IAAI;YAClC,iCAAiC,EAAE,IAAI;YACvC,OAAO;YACP,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;SAC3E;QACD,KAAK,EAAE;YACL,YAAY,EAAE,KAAK;YACnB,WAAW,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACpC,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,SAAS;aAChC,CAAC,CAAC;YACH,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;YAC1F,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,uBAAuB,CAAC;YACtE,OAAO;YACP,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC;SACxD;QACD,MAAM,EAAE,MAAM;YACZ,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC;YAC7D,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE;KACvB,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5D,OAAO,KAAK,CAAC,MAAM,EAAE;QACnB,wEAAwE;QACxE,uEAAuE;QACvE,2EAA2E;QAC3E,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE;QAC/D,KAAK,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE;QACnC,MAAM,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE;QACpC,kFAAkF;QAClF,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;KACxB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CACnB,IAA6B,EAC7B,OAAiC,EACjC,SAA6B,EAC7B,UAAkB,EAClB,OAAgC;IAEhC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG;QACd,GAAG,CAAC,MAAM,CAAC,eAAe,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC;QAC7E,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;QACtD,2BAA2B;KAC5B,CAAC;IACF,MAAM,iBAAiB,GAAG;QACxB,+DAA+D;QAC/D,GAAG,CAAC,MAAM,CAAC,eAAe,KAAK,KAAK;YAClC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,uCAAuC,EAAE,oCAAoC,CAAC,CAAC;QACpF,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;KAC9D,CAAC;IACF,OAAO;QACL,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/C,QAAQ,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE;QACnC,YAAY,EAAE;YACZ;gBACE,MAAM,EAAE,QAAQ;gBAChB,WAAW,EAAE,WAAW,oBAAoB,EAAE;gBAC9C,IAAI,EAAE,GAAG;gBACT,cAAc,EAAE,OAAO;gBACvB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aAC3B;SACF;QACD,OAAO,EAAE,EAAE,CAAC,wBAAwB,CAAC,YAAY,CAAC,EAAE,0BAA0B,CAAC,OAAO,CAAC,EAAE;QACzF,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,yEAAyE;QACzE,8BAA8B;QAC9B,aAAa,EAAE;YACb,eAAe,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,wBAAwB,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE;SACtF;QACD,oEAAoE;QACpE,6CAA6C;QAC7C,GAAG,CAAC,UAAU;YACZ,CAAC,CAAC;gBACE,YAAY,EAAE;oBACZ,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,EAAE;iBAC3E;gBACD,iBAAiB,EAAE;oBACjB;wBACE,IAAI,EAAE,oBAAoB;wBAC1B,SAAS,EAAE,+BAA+B;wBAC1C,OAAO,EAAE,iBAAiB;qBAC3B;iBACF;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,wBAAwB,CAAC;QACxE,OAAO;QACP,GAAG,eAAe,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;KACtE,CAAC;AACJ,CAAC"}

package/dist/factories/crowdsec/utils/index.d.ts

@@ -0,0 +1,3 @@
+export * from './helm-values-mapper.js';
+export * from './traefik-bouncer.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/factories/crowdsec/utils/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/factories/crowdsec/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC"}

package/dist/factories/crowdsec/utils/index.js

@@ -0,0 +1,3 @@
+export * from './helm-values-mapper.js';
+export * from './traefik-bouncer.js';
+//# sourceMappingURL=index.js.map

package/dist/factories/crowdsec/utils/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/factories/crowdsec/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC"}

package/dist/factories/crowdsec/utils/net.js

@@ -0,0 +1,68 @@
+// Address and value-shape checks shared by the CrowdSec values mapper and the
+// Traefik bouncer helper. Internal: not re-exported from `typekro/crowdsec`.
+import { isIP } from 'node:net';
+import { REQUIRED_FIELD_SENTINEL } from '../../../core/serialization/schema.js';
+import { isCelExpression, isKubernetesRef } from '../../../utils/type-guards.js';
+// What a schema proxy stringifies to inside a template literal.
+const KUBERNETES_REF_MARKER_PREFIX = '__KUBERNETES_REF_';
+/**
+ * A value only known at reconcile time: a schema or resource reference, a CEL
+ * expression, a template literal over a reference, or the placeholder the
+ * defaults-extraction pass substitutes for required fields. Never validated or
+ * branched on as if it were the user's value.
+ */
+export function isDeferredValue(value) {
+    return (isKubernetesRef(value) ||
+        isCelExpression(value) ||
+        (typeof value === 'string' &&
+            (value.includes(KUBERNETES_REF_MARKER_PREFIX) || value.includes(REQUIRED_FIELD_SENTINEL))));
+}
+/**
+ * An IPv4 or IPv6 address as Go's `net.ParseIP` reads it: no port, no zone, no
+ * leading zeros in IPv4 octets; IPv4-mapped IPv6 (`::ffff:192.0.2.1`) is fine.
+ */
+export function isIp(value) {
+    return !value.includes('%') && isIP(value) !== 0;
+}
+/** An `address/bits` range, as Go's `net.ParseCIDR` reads it. */
+export function isCidr(value) {
+    const [address, bits, extra] = value.split('/');
+    if (address === undefined || bits === undefined || extra !== undefined || !/^\d+$/.test(bits)) {
+        return false;
+    }
+    return isIp(address) && Number(bits) <= (isIP(address) === 6 ? 128 : 32);
+}
+// The eight 16-bit groups of a valid IPv6 address (dotted IPv4 tail included).
+function ipv6Groups(address) {
+    let text = address.toLowerCase();
+    const dotted = /^(.*:)(\d+)\.(\d+)\.(\d+)\.(\d+)$/.exec(text);
+    if (dotted) {
+        const [, head = '', a, b, c, d] = dotted;
+        const octets = [a, b, c, d].map(Number);
+        text = `${head}${((octets[0] << 8) | octets[1]).toString(16)}:${((octets[2] << 8) | octets[3]).toString(16)}`;
+    }
+    const [head = '', tail] = text.split('::');
+    const left = head === '' ? [] : head.split(':');
+    const right = tail === undefined || tail === '' ? [] : tail.split(':');
+    const fill = tail === undefined ? [] : Array(8 - left.length - right.length).fill('0');
+    return [...left, ...fill, ...right].map((group) => Number.parseInt(group, 16));
+}
+/** An IPv4-mapped IPv6 address (`::ffff:a.b.c.d`), which Go treats as IPv4. */
+function isIpv4Mapped(address) {
+    if (isIP(address) !== 6)
+        return false;
+    const groups = ipv6Groups(address);
+    return groups.slice(0, 5).every((group) => group === 0) && groups[5] === 0xffff;
+}
+/**
+ * A range that matches every address: any `/0`, or an IPv4-mapped range with
+ * at most 96 bits (`::ffff:0.0.0.0/96`). Go's `net.IPNet` matches IPv4 clients
+ * against the last 32 bits of such a mask, which are then all zero.
+ */
+export function isAnyAddressRange(value) {
+    if (!isCidr(value))
+        return false;
+    const [address = '', bits = ''] = value.split('/');
+    return Number(bits) === 0 || (isIpv4Mapped(address) && Number(bits) <= 96);
+}
+//# sourceMappingURL=net.js.map

package/dist/factories/crowdsec/utils/net.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"net.js","sourceRoot":"","sources":["../../../../src/factories/crowdsec/utils/net.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,6EAA6E;AAE7E,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEjF,gEAAgE;AAChE,MAAM,4BAA4B,GAAG,mBAAmB,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,CACL,eAAe,CAAC,KAAK,CAAC;QACtB,eAAe,CAAC,KAAK,CAAC;QACtB,CAAC,OAAO,KAAK,KAAK,QAAQ;YACxB,CAAC,KAAK,CAAC,QAAQ,CAAC,4BAA4B,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAC7F,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,IAAI,CAAC,KAAa;IAChC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACnD,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,OAAO,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9F,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,+EAA+E;AAC/E,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC;QACzC,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAqC,CAAC;QAC5E,IAAI,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;IAChH,CAAC;IACD,MAAM,CAAC,IAAI,GAAG,EAAE,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,+EAA+E;AAC/E,SAAS,YAAY,CAAC,OAAe;IACnC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,CAAC,OAAO,GAAG,EAAE,EAAE,IAAI,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AAC7E,CAAC"}

package/dist/factories/crowdsec/utils/traefik-bouncer.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Traefik side of CrowdSec: the bouncer plugin declaration and a Middleware
+ * spec that runs it. Both are plain objects; pass them to `makeTraefikBootstrap`
+ * (`plugins`) and `traefikMiddleware`. The only thing taken from the Traefik
+ * factories is the plugin-name rule, a runtime constant that appears in no
+ * CrowdSec type, so `typekro/crowdsec` declarations stay free of Traefik.
+ */
+import type { CrowdsecBouncerMiddlewareOptions, CrowdsecBouncerMiddlewareSpec, CrowdsecSecretKeyRef, CrowdsecTraefikPluginDeclaration } from '../types.js';
+/**
+ * Declare the bouncer plugin for Traefik's `experimental.plugins`.
+ *
+ * Defaults to the pinned v1.7.1 and its archive hash. Another version needs
+ * its own `hash`: the SHA-256 of the archive Traefik downloads.
+ *
+ * @throws {TypeKroError} `CROWDSEC_INVALID_PLUGIN` for a missing or malformed hash or version.
+ */
+export declare function crowdsecTraefikPlugin(options?: {
+    version?: string;
+    hash?: string;
+}): CrowdsecTraefikPluginDeclaration;
+/**
+ * A `urn:k8s:secret:<name>:<key>` reference, which Traefik's CRD provider
+ * resolves inside plugin configuration from the Middleware's namespace.
+ *
+ * @throws {TypeKroError} `CROWDSEC_INVALID_SECRET_REF` for an empty name or key, or one with ":".
+ */
+export declare function crowdsecSecretUrn(secret: CrowdsecSecretKeyRef): string;
+/**
+ * Build a Traefik `Middleware.spec` that runs the bouncer in stream mode.
+ *
+ * It only ever bans: no captcha provider is configured, so a captcha decision
+ * is enforced as a ban. `failOpen` (the default) lets traffic through while
+ * LAPI or AppSec is unreachable; `failOpen: false` blocks it instead.
+ *
+ * @example
+ * ```typescript
+ * traefikMiddleware({
+ *   name: 'crowdsec',
+ *   namespace: 'traefik',
+ *   spec: crowdsecBouncerMiddleware({
+ *     lapiHost: 'crowdsec-service.crowdsec.svc.cluster.local:8080',
+ *     apiKeySecret: { name: 'crowdsec-bouncer', key: 'api-key' },
+ *   }),
+ * });
+ * ```
+ */
+export declare function crowdsecBouncerMiddleware(options: CrowdsecBouncerMiddlewareOptions): CrowdsecBouncerMiddlewareSpec;
+//# sourceMappingURL=traefik-bouncer.d.ts.map

package/dist/factories/crowdsec/utils/traefik-bouncer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"traefik-bouncer.d.ts","sourceRoot":"","sources":["../../../../src/factories/crowdsec/utils/traefik-bouncer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAgBH,OAAO,KAAK,EACV,gCAAgC,EAChC,6BAA6B,EAC7B,oBAAoB,EACpB,gCAAgC,EACjC,MAAM,aAAa,CAAC;AAqGrB;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GAChD,gCAAgC,CAsBlC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAyBtE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,gCAAgC,GACxC,6BAA6B,CA+I/B"}