Travel Checkout Demo - Enhanced Security

\r\n \r\n\r\n\r\n\r\n`,\r\n {\r\n headers: {\r\n \"Content-Type\": \"text/html; charset=utf-8\",\r\n },\r\n },\r\n );\r\n}",[],[170,177],[170],{"_107":188,"_100":189,"_151":190,"_153":-5,"_154":138,"_155":191,"_157":158,"_109":192,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_165":193,"_103":194},"a57b9336-57ee-11f0-acd0-f69ea79377d9","docs","a57b9412-57ee-11f0-acd0-f69ea79377d9",4,["D",1751534293857],[],[189],{"_107":196,"_100":197,"_151":198,"_153":-5,"_154":138,"_155":199,"_157":158,"_109":200,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_165":201,"_103":397},"a5c0555c-57ee-11f0-a90d-f69ea79377d9","server","a5c0561a-57ee-11f0-a90d-f69ea79377d9",5,["D",1751534294309],[202,247,291,335,379,387],{"_107":203,"_100":204,"_151":205,"_153":198,"_154":138,"_155":206,"_157":158,"_109":207,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_165":208,"_103":246},"a6107dde-57ee-11f0-a7e4-f69ea79377d9","config","a6107ea6-57ee-11f0-a7e4-f69ea79377d9",6,["D",1751534294830],[209,219,228,237],{"_107":210,"_100":211,"_151":212,"_153":205,"_154":138,"_155":213,"_157":158,"_109":214,"_104":31,"_160":215,"_162":216,"_163":27,"_164":-5,"_165":217,"_103":218},"a76389f6-57ee-11f0-9cff-f69ea79377d9","app-config.ts","a7638ab4-57ee-11f0-9cff-f69ea79377d9",15,["D",1751534297052],"script","// deno-lint-ignore-file no-explicit-any\n/**\n * Central configuration management with Zod validation for SafeHash V2.\n * Loads configuration from environment variables with type safety and validation.\n */\n\nimport { z } from 'https://esm.sh/zod@3.22.4';\nimport type {\n\tAppConfig,\n\tAuthConfig,\n\tCORSConfig,\n\tDatabaseConfig,\n\tEndpointRateLimit,\n\tJWTConfig,\n\tLoggingConfig,\n\tMiddlewareConfig,\n\tRateLimitConfig,\n\tSecurityConfig,\n\tSecurityHeaders,\n\tServerConfig,\n\tTracingConfig,\n} from './app-types.ts';\n\nexport const SERVER_URL = 'https://ianmenethil--69fc148c56a611f09a02f69ea79377d9.web.val.run';\nexport const SERVER_HOST = 'ianmenethil--69fc148c56a611f09a02f69ea79377d9.web.val.run';\nexport const CLIENT_URL = 'https://ianmenethil--704f93e856ad11f09f73f69ea79377d9.web.val.run';\nexport const CLIENT_HOST = 'ianmenethil--704f93e856ad11f09f73f69ea79377d9.web.val.run';\n\nconst ServerConfigSchema = z.object({\n\tport: z.number().int().min(1000).max(65535).default(8000),\n\thost: z.string().default('0.0.0.0'),\n\tenvironment: z.enum(['dev', 'prod']).default(\n\t\t'dev',\n\t),\n\ttimeout: z.number().int().min(1000).default(30000), // 30 seconds\n\tmaxRequestSize: z.number().int().min(1024).default(10 * 1024 * 1024), // 10MB\n});\n\nconst SecurityConfigSchema = z.object({\n\thmacSecret: z.string().min(32, 'HMAC secret must be at least 32 characters'),\n\tallowedOrigins: z.array(z.string().url()).min(1),\n\tnonceExpirationMs: z.number().int().min(60000).default(15 * 60 * 1000), // 15 minutes\n\ttimestampToleranceMs: z.number().int().min(10000).default(5 * 60 * 1000), // 5 minutes\n\tmaxAttemptsPerBooking: z.number().int().min(1).max(20).default(5),\n\trateLimitWindowMs: z.number().int().min(60000).default(15 * 60 * 1000), // 15 minutes\n\tenableHoneypot: z.boolean().default(true),\n\tenableIPValidation: z.boolean().default(true),\n\tenableGeoBlocking: z.boolean().default(false),\n});\n\nconst DatabaseConfigSchema = z.object({\n\ttableName: z.string().default('payment_nonces'),\n\tconnectionString: z.string().optional(),\n\tmaxConnections: z.number().int().min(1).max(100).default(10),\n\ttimeout: z.number().int().min(1000).default(30000), // 30 seconds\n});\n\nconst LoggingConfigSchema = z.object({\n\tlevel: z.enum(['DEBUG', 'INFO', 'WARN', 'ERROR']).default('INFO'),\n\tformat: z.enum(['json', 'text']).default('json'),\n\tenableEmojis: z.boolean().default(true),\n\tenableCorrelationIds: z.boolean().default(true),\n\toutputs: z.array(z.enum(['console', 'file'])).default(['console']),\n\tfileName: z.string().optional(),\n\tmaxFileSize: z.number().int().min(1024).default(10 * 1024 * 1024), // 10MB\n\tmaxFiles: z.number().int().min(1).max(100).default(10),\n});\n\nconst TracingConfigSchema = z.object({\n\tenabled: z.boolean().default(false),\n\tserviceName: z.string().default('safehash-api'),\n\tendpoint: z.string().url().optional(),\n\tsamplingRate: z.number().min(0).max(1).default(0.1), // 10% sampling\n\tenableDistributedTracing: z.boolean().default(false),\n}).optional();\n\nconst CORSConfigSchema = z.object({\n\tallowedOrigins: z.array(z.string()),\n\tallowedMethods: z.array(z.string()).default(['GET', 'POST', 'OPTIONS']),\n\tallowedHeaders: z.array(z.string()).default([\n\t\t'content-type',\n\t\t'x-payment-nonce',\n\t\t'origin',\n\t\t'referer',\n\t]),\n\texposedHeaders: z.array(z.string()).default([\n\t\t'X-Response-Signature',\n\t\t'X-Response-Time',\n\t]),\n\tcredentials: z.boolean().default(true),\n\tmaxAge: z.number().int().min(0).default(86400), // 24 hours\n});\n\nconst JWTConfigSchema = z.object({\n\talgorithm: z.enum(['HS256', 'HS384', 'HS512']).default('HS256'),\n\tissuer: z.string().default('safehash-api'),\n\taudience: z.string().default('safehash-services'),\n\texpirationTime: z.string().default('1h'),\n\tsecret: z.string().min(32, 'JWT secret must be at least 32 characters'),\n});\n\nconst EndpointRateLimitSchema = z.object({\n\tlimit: z.number().int().min(1),\n\twindowMs: z.number().int().min(1000),\n\tskipSuccessfulRequests: z.boolean().default(false),\n\tskipFailedRequests: z.boolean().default(false),\n\tkeyGenerator: z.string().optional(),\n});\n\nconst RateLimitConfigSchema = z.object({\n\tendpoints: z.record(z.string(), EndpointRateLimitSchema),\n\tdefaultLimit: z.number().int().min(1).default(100),\n\twindowMs: z.number().int().min(1000).default(15 * 60 * 1000), // 15 minutes\n\tenableDistributedLimiting: z.boolean().default(false),\n});\n\nconst AuthConfigSchema = z.object({\n\tissuer: z.string().min(1),\n\tinternalJwtSecret: z.string().min(1),\n\texternalJwtSecret: z.string().min(1),\n\tdefaultExpirationMinutes: z.number().min(1).default(60),\n});\n\nconst SecurityHeadersSchema = z.object({\n\tstrictTransportSecurity: z.string(),\n\txContentTypeOptions: z.string(),\n\txFrameOptions: z.string(),\n\txXSSProtection: z.string(),\n\tcontentSecurityPolicy: z.string(),\n\taccessControlExposeHeaders: z.string(),\n});\n\nconst MiddlewareConfigSchema = z.object({\n\tcors: CORSConfigSchema,\n\tsecurityHeaders: SecurityHeadersSchema,\n\tenableRateLimit: z.boolean().default(true),\n\tenableCORS: z.boolean().default(true),\n\tenableSecurityHeaders: z.boolean().default(true),\n});\n\nconst AppConfigSchema = z.object({\n\tserver: ServerConfigSchema,\n\tsecurity: SecurityConfigSchema,\n\tdatabase: DatabaseConfigSchema,\n\tlogging: LoggingConfigSchema,\n\ttracing: TracingConfigSchema,\n\tcors: CORSConfigSchema,\n\tjwt: JWTConfigSchema,\n\tauth: AuthConfigSchema,\n\trateLimit: RateLimitConfigSchema,\n\tmiddleware: MiddlewareConfigSchema,\n});\n\n/**\n * Loads configuration from environment variables with fallbacks and validation.\n * All environment variables are prefixed with SAFEHASH_ for clarity.\n */\nfunction loadFromEnvironment(): Partial {\n\t// Helper function to parse JSON from env with fallback\n\tconst parseEnvJSON = (envVar: string, fallback: T): T => {\n\t\ttry {\n\t\t\tconst value = Deno.env.get(envVar);\n\t\t\treturn value ? JSON.parse(value) : fallback;\n\t\t} catch {\n\t\t\treturn fallback;\n\t\t}\n\t};\n\n\t// Helper function to parse comma-separated values\n\tconst parseEnvArray = (envVar: string, fallback: string[] = []): string[] => {\n\t\tconst value = Deno.env.get(envVar);\n\t\treturn value ? value.split(',').map((s) => s.trim()).filter(Boolean) : fallback;\n\t};\n\n\t// Helper function to parse boolean with fallback\n\tconst parseEnvBoolean = (envVar: string, fallback: boolean): boolean => {\n\t\tconst value = Deno.env.get(envVar)?.toLowerCase();\n\t\tif (value === 'true' || value === '1') return true;\n\t\tif (value === 'false' || value === '0') return false;\n\t\treturn fallback;\n\t};\n\n\t// Helper function to parse integer with fallback\n\tconst parseEnvInt = (envVar: string, fallback: number): number => {\n\t\tconst value = Deno.env.get(envVar);\n\t\tconst parsed = value ? parseInt(value, 10) : NaN;\n\t\treturn isNaN(parsed) ? fallback : parsed;\n\t};\n\n\t// Helper function to parse float with fallback\n\tconst parseEnvFloat = (envVar: string, fallback: number): number => {\n\t\tconst value = Deno.env.get(envVar);\n\t\tconst parsed = value ? parseFloat(value) : NaN;\n\t\treturn isNaN(parsed) ? fallback : parsed;\n\t};\n\n\treturn {\n\t\tserver: {\n\t\t\tport: parseEnvInt('SAFEHASH_PORT', 8000),\n\t\t\thost: Deno.env.get('SAFEHASH_HOST') || '0.0.0.0',\n\t\t\tenvironment: (Deno.env.get('SAFEHASH_ENVIRONMENT') as ServerConfig['environment']) ||\n\t\t\t\t'dev',\n\t\t\ttimeout: parseEnvInt('SAFEHASH_TIMEOUT', 30000),\n\t\t\tmaxRequestSize: parseEnvInt(\n\t\t\t\t'SAFEHASH_MAX_REQUEST_SIZE',\n\t\t\t\t10 * 1024 * 1024,\n\t\t\t),\n\t\t},\n\t\tsecurity: {\n\t\t\thmacSecret: Deno.env.get('HMAC_SECRET') || '', // Required - will fail validation if missing\n\t\t\tallowedOrigins: parseEnvArray('SAFEHASH_ALLOWED_ORIGINS', [\n\t\t\t\tSERVER_URL,\n\t\t\t\tCLIENT_URL,\n\t\t\t]),\n\t\t\tnonceExpirationMs: parseEnvInt(\n\t\t\t\t'SAFEHASH_NONCE_EXPIRATION_MS',\n\t\t\t\t15 * 60 * 1000,\n\t\t\t),\n\t\t\ttimestampToleranceMs: parseEnvInt(\n\t\t\t\t'SAFEHASH_TIMESTAMP_TOLERANCE_MS',\n\t\t\t\t5 * 60 * 1000,\n\t\t\t),\n\t\t\tmaxAttemptsPerBooking: parseEnvInt(\n\t\t\t\t'SAFEHASH_MAX_ATTEMPTS_PER_BOOKING',\n\t\t\t\t5,\n\t\t\t),\n\t\t\trateLimitWindowMs: parseEnvInt(\n\t\t\t\t'SAFEHASH_RATE_LIMIT_WINDOW_MS',\n\t\t\t\t15 * 60 * 1000,\n\t\t\t),\n\t\t\tenableHoneypot: parseEnvBoolean('SAFEHASH_ENABLE_HONEYPOT', true),\n\t\t\tenableIPValidation: parseEnvBoolean(\n\t\t\t\t'SAFEHASH_ENABLE_IP_VALIDATION',\n\t\t\t\ttrue,\n\t\t\t),\n\t\t\tenableGeoBlocking: parseEnvBoolean('SAFEHASH_ENABLE_GEO_BLOCKING', false),\n\t\t},\n\t\tdatabase: {\n\t\t\ttableName: Deno.env.get('SAFEHASH_TABLE_NAME') || 'payment_nonces',\n\t\t\tconnectionString: Deno.env.get('SAFEHASH_DATABASE_URL') || undefined,\n\t\t\tmaxConnections: parseEnvInt('SAFEHASH_MAX_CONNECTIONS', 10),\n\t\t\ttimeout: parseEnvInt('SAFEHASH_DATABASE_TIMEOUT', 30000),\n\t\t},\n\t\tlogging: {\n\t\t\tlevel: (Deno.env.get('SAFEHASH_LOG_LEVEL') as LoggingConfig['level']) || 'INFO',\n\t\t\tformat: (Deno.env.get('SAFEHASH_LOG_FORMAT') as LoggingConfig['format']) || 'json',\n\t\t\tenableEmojis: parseEnvBoolean('SAFEHASH_LOG_EMOJIS', true),\n\t\t\tenableCorrelationIds: parseEnvBoolean(\n\t\t\t\t'SAFEHASH_LOG_CORRELATION_IDS',\n\t\t\t\ttrue,\n\t\t\t),\n\t\t\toutputs: parseEnvArray('SAFEHASH_LOG_OUTPUTS', ['console']) as LoggingConfig['outputs'],\n\t\t\tfileName: Deno.env.get('SAFEHASH_LOG_FILE') || undefined,\n\t\t\tmaxFileSize: parseEnvInt('SAFEHASH_LOG_MAX_FILE_SIZE', 10 * 1024 * 1024),\n\t\t\tmaxFiles: parseEnvInt('SAFEHASH_LOG_MAX_FILES', 10),\n\t\t},\n\t\ttracing: {\n\t\t\tenabled: parseEnvBoolean('SAFEHASH_TRACING_ENABLED', false),\n\t\t\tserviceName: Deno.env.get('SAFEHASH_SERVICE_NAME') || 'safehash-api',\n\t\t\tendpoint: Deno.env.get('SAFEHASH_TRACING_ENDPOINT'),\n\t\t\tsamplingRate: parseEnvFloat('SAFEHASH_TRACING_SAMPLING_RATE', 0.1),\n\t\t\tenableDistributedTracing: parseEnvBoolean(\n\t\t\t\t'SAFEHASH_DISTRIBUTED_TRACING',\n\t\t\t\tfalse,\n\t\t\t),\n\t\t},\n\t\tcors: {\n\t\t\tallowedOrigins: parseEnvArray('SAFEHASH_CORS_ORIGINS', [\n\t\t\t\tSERVER_URL,\n\t\t\t\tCLIENT_URL,\n\t\t\t]),\n\t\t\tallowedMethods: parseEnvArray('SAFEHASH_CORS_METHODS', [\n\t\t\t\t'GET',\n\t\t\t\t'POST',\n\t\t\t\t'OPTIONS',\n\t\t\t]),\n\t\t\tallowedHeaders: parseEnvArray('SAFEHASH_CORS_HEADERS', [\n\t\t\t\t'content-type',\n\t\t\t\t'x-payment-nonce',\n\t\t\t\t'origin',\n\t\t\t\t'referer',\n\t\t\t\t'x-zid',\n\t\t\t]),\n\t\t\texposedHeaders: parseEnvArray('SAFEHASH_CORS_EXPOSED_HEADERS', [\n\t\t\t\t'X-Response-Signature',\n\t\t\t\t'X-Response-Time',\n\t\t\t\t'X-zID',\n\t\t\t]),\n\t\t\tcredentials: parseEnvBoolean('SAFEHASH_CORS_CREDENTIALS', true),\n\t\t\tmaxAge: parseEnvInt('SAFEHASH_CORS_MAX_AGE', 86400),\n\t\t},\n\t\tjwt: {\n\t\t\talgorithm: (Deno.env.get('SAFEHASH_JWT_ALGORITHM') as JWTConfig['algorithm']) || 'HS256',\n\t\t\tissuer: Deno.env.get('SAFEHASH_JWT_ISSUER') || 'safehash-api',\n\t\t\taudience: Deno.env.get('SAFEHASH_JWT_AUDIENCE') || 'safehash-services',\n\t\t\texpirationTime: Deno.env.get('SAFEHASH_JWT_EXPIRATION') || '1h',\n\t\t\tsecret: Deno.env.get('JWT_SECRET') || Deno.env.get('HMAC_SECRET') || '', // Fallback to HMAC secret\n\t\t},\n\t\trateLimit: {\n\t\t\tendpoints: parseEnvJSON>('SAFEHASH_RATE_LIMIT_ENDPOINTS', {\n\t\t\t\t'create-nonce': {\n\t\t\t\t\tlimit: 20, // Total nonces per IP (not per booking)\n\t\t\t\t\twindowMs: 15 * 60 * 1000, // 15 minutes\n\t\t\t\t},\n\t\t\t\t'create-hash': {\n\t\t\t\t\tlimit: 10,\n\t\t\t\t\twindowMs: 60 * 1000, // 1 minute\n\t\t\t\t\tskipSuccessfulRequests: false,\n\t\t\t\t},\n\t\t\t\t'page-nonce': {\n\t\t\t\t\tlimit: 100,\n\t\t\t\t\twindowMs: 15 * 60 * 1000, // 15 minutes\n\t\t\t\t\tskipSuccessfulRequests: true,\n\t\t\t\t},\n\t\t\t\t'fingerprint-status': {\n\t\t\t\t\tlimit: 50,\n\t\t\t\t\twindowMs: 5 * 60 * 1000, // 5 minutes\n\t\t\t\t\tskipSuccessfulRequests: true,\n\t\t\t\t},\n\t\t\t}),\n\t\t\tdefaultLimit: parseEnvInt('SAFEHASH_DEFAULT_RATE_LIMIT', 100),\n\t\t\twindowMs: parseEnvInt('SAFEHASH_RATE_LIMIT_WINDOW', 15 * 60 * 1000),\n\t\t\tenableDistributedLimiting: parseEnvBoolean(\n\t\t\t\t'SAFEHASH_DISTRIBUTED_RATE_LIMITING',\n\t\t\t\tfalse,\n\t\t\t),\n\t\t},\n\t\tauth: {\n\t\t\tissuer: Deno.env.get('SAFEHASH_AUTH_ISSUER') || 'safehash-api',\n\t\t\tinternalJwtSecret: Deno.env.get('SAFEHASH_INTERNAL_JWT_SECRET') || Deno.env.get('JWT_SECRET') || '',\n\t\t\texternalJwtSecret: Deno.env.get('SAFEHASH_EXTERNAL_JWT_SECRET') || Deno.env.get('JWT_SECRET') || '',\n\t\t\tdefaultExpirationMinutes: parseEnvInt('SAFEHASH_JWT_EXPIRATION_MINUTES', 60),\n\t\t},\n\t\tmiddleware: {\n\t\t\tcors: {\n\t\t\t\tallowedOrigins: parseEnvArray('SAFEHASH_CORS_ORIGINS', ['*']),\n\t\t\t\tallowedMethods: parseEnvArray('SAFEHASH_CORS_METHODS', ['GET', 'POST', 'OPTIONS']),\n\t\t\t\tallowedHeaders: parseEnvArray('SAFEHASH_CORS_HEADERS', ['Content-Type', 'Authorization']),\n\t\t\t\texposedHeaders: parseEnvArray('SAFEHASH_CORS_EXPOSED', []),\n\t\t\t\tcredentials: false,\n\t\t\t\tmaxAge: 86400,\n\t\t\t},\n\t\t\tsecurityHeaders: {\n\t\t\t\tstrictTransportSecurity: 'max-age=31536000; includeSubDomains; preload',\n\t\t\t\txContentTypeOptions: 'nosniff',\n\t\t\t\txFrameOptions: 'DENY',\n\t\t\t\txXSSProtection: '1; mode=block',\n\t\t\t\tcontentSecurityPolicy:\n\t\t\t\t\t\"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; media-src 'self'; object-src 'none'; child-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';\",\n\t\t\t\taccessControlExposeHeaders: 'X-Correlation-ID, X-Response-Time',\n\t\t\t},\n\t\t\tenableRateLimit: parseEnvBoolean('SAFEHASH_ENABLE_RATE_LIMIT', true),\n\t\t\tenableCORS: parseEnvBoolean('SAFEHASH_ENABLE_CORS', true),\n\t\t\tenableSecurityHeaders: parseEnvBoolean('SAFEHASH_ENABLE_SECURITY_HEADERS', true),\n\t\t},\n\t};\n}\n\n// ========================================\n// Configuration Loader and Validator\n// ========================================\n\nlet cachedConfig: AppConfig | null = null;\n\n/**\n * Loads and validates the application configuration.\n * Caches the result to avoid repeated environment variable parsing.\n */\nexport function loadConfig(forceReload = false): AppConfig {\n\tif (cachedConfig && !forceReload) {\n\t\treturn cachedConfig;\n\t}\n\n\ttry {\n\t\tconst envConfig = loadFromEnvironment();\n\t\tconst validatedConfig = AppConfigSchema.parse(envConfig);\n\t\tcachedConfig = validatedConfig;\n\t\treturn validatedConfig;\n\t} catch (error) {\n\t\tif (error instanceof z.ZodError) {\n\t\t\tconst errorDetails = error.errors.map((err) => `${err.path.join('.')}: ${err.message}`).join(', ');\n\n\t\t\tthrow new Error(\n\t\t\t\t`Configuration validation failed: ${errorDetails}. ` +\n\t\t\t\t\t`Please check your environment variables.`,\n\t\t\t);\n\t\t}\n\t\tthrow error;\n\t}\n}\n\n/**\n * Validates that all required environment variables are present.\n * Throws detailed error messages for missing configuration.\n */\nexport function validateEnvironment(): void {\n\tconst requiredEnvVars = [\n\t\t{ name: 'HMAC_SECRET', description: 'HMAC secret for response signing' },\n\t];\n\n\tconst missing: string[] = [];\n\tconst invalid: { name: string; reason: string }[] = [];\n\n\tfor (const { name, description } of requiredEnvVars) {\n\t\tconst value = Deno.env.get(name);\n\t\tif (!value) {\n\t\t\tmissing.push(`${name} (${description})`);\n\t\t} else if (name === 'HMAC_SECRET' && value.length < 32) {\n\t\t\tinvalid.push({ name, reason: 'must be at least 32 characters' });\n\t\t}\n\t}\n\n\tif (missing.length > 0 || invalid.length > 0) {\n\t\tlet errorMessage = 'Environment validation failed:\\n';\n\n\t\tif (missing.length > 0) {\n\t\t\terrorMessage += `\\nMissing required environment variables:\\n`;\n\t\t\terrorMessage += missing.map((item) => ` - ${item}`).join('\\n');\n\t\t}\n\n\t\tif (invalid.length > 0) {\n\t\t\terrorMessage += `\\nInvalid environment variables:\\n`;\n\t\t\terrorMessage += invalid.map((item) => ` - ${item.name}: ${item.reason}`)\n\t\t\t\t.join('\\n');\n\t\t}\n\n\t\terrorMessage += `\\n\\nPlease set these environment variables before starting the application.`;\n\n\t\tthrow new Error(errorMessage);\n\t}\n}\n\n/**\n * Gets configuration for a specific service or component.\n * Provides type-safe access to configuration sections.\n */\nexport function getConfig(): AppConfig;\nexport function getConfig(section: K): AppConfig[K];\nexport function getConfig(\n\tsection?: K,\n): AppConfig | AppConfig[K] {\n\tconst config = loadConfig();\n\treturn section ? config[section] : config;\n}\n\n/**\n * Updates configuration at runtime (useful for testing).\n * Note: This only updates the cached config, not environment variables.\n */\nexport function updateConfig(updates: Partial): void {\n\tconst currentConfig = loadConfig();\n\tcachedConfig = { ...currentConfig, ...updates } as AppConfig;\n}\n\n/**\n * Clears the configuration cache, forcing a reload on next access.\n */\nexport function clearConfigCache(): void {\n\tcachedConfig = null;\n}\n\n/**\n * Exports configuration as a JSON object for debugging/logging.\n * Masks sensitive values like secrets and passwords.\n */\nexport function exportConfigForLogging(): Record {\n\tconst config = loadConfig();\n\n\t// Deep clone and mask sensitive values\n\tconst safeCopy = JSON.parse(JSON.stringify(config));\n\n\t// Mask secrets\n\tif (safeCopy.security?.hmacSecret) {\n\t\tsafeCopy.security.hmacSecret = safeCopy.security.hmacSecret.substring(0, 8) + '***';\n\t}\n\tif (safeCopy.jwt?.secret) {\n\t\tsafeCopy.jwt.secret = safeCopy.jwt.secret.substring(0, 8) + '***';\n\t}\n\n\treturn safeCopy;\n}\n\n// ========================================\n// Type Exports for External Use\n// ========================================\n\n// Export all the configuration types for external use\nexport type {\n\tAppConfig,\n\tAuthConfig,\n\tCORSConfig,\n\tDatabaseConfig,\n\tEndpointRateLimit,\n\tJWTConfig,\n\tLoggingConfig,\n\tMiddlewareConfig,\n\tRateLimitConfig,\n\tSecurityConfig,\n\tSecurityHeaders,\n\tServerConfig,\n\tTracingConfig,\n};\n\n// ========================================\n// Default Export\n// ========================================\n\nexport default {\n\tload: loadConfig,\n\tvalidate: validateEnvironment,\n\tget: getConfig,\n\tupdate: updateConfig,\n\tclear: clearConfigCache,\n\texportForLogging: exportConfigForLogging,\n};\n",[],[197,204,211],{"_107":220,"_100":221,"_151":222,"_153":205,"_154":138,"_155":223,"_157":158,"_109":224,"_104":31,"_160":215,"_162":225,"_163":27,"_164":-5,"_165":226,"_103":227},"a781e68a-57ee-11f0-abec-f69ea79377d9","app-types.ts","a781e72a-57ee-11f0-abec-f69ea79377d9",16,["D",1751534297258],"// deno-lint-ignore-file no-explicit-any\n/**\n * Centralized TypeScript types and interfaces for SafeHash V2 modular architecture.\n * All types used across services, utilities, and gateway components.\n */\n\n// ========================================\n// Core Request/Response Types\n// ========================================\n\nexport interface NonceResponse {\n\tnonce: string;\n\ttimestamp: string;\n\tsignature: string;\n}\n\nexport interface PaymentNonceRequest {\n\tbookingId: string;\n\ttimestamp: string;\n\temail_verify?: string; // Honeypot field\n}\n\nexport interface PaymentNonceResponse {\n\tnonce: string;\n\texpiresIn: number;\n\tbookingId?: string;\n\treused?: boolean;\n\ttimestamp: string;\n\tsignature: string;\n}\n\nexport interface PaymentHashRequest {\n\tapikey: string;\n\tusername: string;\n\tpassword: string;\n\tmode: 0 | 1 | 2 | 3;\n\tpaymentAmount: number;\n\tmerchantUniquePaymentId: string;\n\ttimestamp: string;\n}\n\nexport interface PaymentHashResponse {\n\thash: string;\n\ttimestamp: string;\n\tsignature: string;\n}\n\nexport interface FingerprintStatusResponse {\n\tbookingId: string;\n\ttotalAttempts: number;\n\thasUnusedFingerprint: boolean;\n\tcanRetry: boolean;\n\tremainingAttempts: number;\n}\n\nexport interface ErrorResponse {\n\terror: string;\n\tdetails?: string[];\n\tmissing?: string[];\n\tretryAfter?: number;\n}\n\n// ========================================\n// Database/Repository Types\n// ========================================\n\nexport interface NonceRecord {\n\tnonce: string;\n\tissued_at: string;\n\tused: number;\n\tstate: 'unused' | 'attempting' | 'used' | 'expired';\n\tbooking_id: string | null;\n\tip_address: string | null;\n\tuser_agent: string | null;\n\torigin: string | null;\n\tattempt_count: number;\n}\n\nexport interface NonceValidationResult {\n\tvalid: boolean;\n\terror?: string;\n\tneedsNewToken?: boolean;\n\tbookingId?: string;\n}\n\nexport interface RateLimitRecord {\n\tattempts: number;\n\tresetAt: number;\n}\n\nexport interface DatabaseConfig {\n\ttableName: string;\n\tconnectionString?: string;\n\tmaxConnections?: number;\n\ttimeout?: number;\n}\n\n// ========================================\n// Security & Authentication Types\n// ========================================\n\nexport interface SecurityContext {\n\tclientIP: string;\n\torigin: string | null;\n\treferer: string | null;\n\thost: string | null;\n\tuserAgent: string | null;\n\ttimestamp: string;\n\tcorrelationId: string;\n\tauthenticated?: boolean;\n\tauthContext?: AuthContext; // Optional auth context for authenticated requests\n\tpassed?: boolean;\n\terrors?: string[];\n}\n\nexport interface JWTPayload {\n\tsub: string; // Subject (user/service ID)\n\tiat: number; // Issued at\n\texp: number; // Expiration\n\taud: string; // Audience\n\tiss: string; // Issuer\n\tscopes?: string[]; // Permissions/scopes\n\ttype: 'internal' | 'external';\n\tjti?: string; // JWT ID\n}\n\nexport interface AuthResult {\n\tsuccess: boolean;\n\tpayload?: JWTPayload;\n\terror?: string;\n}\n\nexport interface CORSConfig {\n\tallowedOrigins: string[];\n\tallowedMethods: string[];\n\tallowedHeaders: string[];\n\texposedHeaders: string[];\n\tcredentials: boolean;\n\tmaxAge?: number;\n}\n\nexport interface SecurityHeaders {\n\tstrictTransportSecurity: string;\n\txContentTypeOptions: string;\n\txFrameOptions: string;\n\txXSSProtection: string;\n\tcontentSecurityPolicy: string;\n\taccessControlExposeHeaders: string;\n}\n\n// ========================================\n// Configuration Types\n// ========================================\n\nexport interface AppConfig {\n\tserver: ServerConfig;\n\tsecurity: SecurityConfig;\n\tdatabase: DatabaseConfig;\n\tlogging: LoggingConfig;\n\ttracing?: TracingConfig;\n\tcors: CORSConfig;\n\tjwt: JWTConfig;\n\tauth: AuthConfig;\n\trateLimit: RateLimitConfig;\n\tmiddleware: MiddlewareConfig;\n}\n\nexport interface ServerConfig {\n\tport: number;\n\thost: string;\n\tenvironment: 'dev' | 'prod';\n\ttimeout: number;\n\tmaxRequestSize: number;\n}\n\nexport interface SecurityConfig {\n\thmacSecret: string;\n\tallowedOrigins: string[];\n\tnonceExpirationMs: number;\n\ttimestampToleranceMs: number;\n\tmaxAttemptsPerBooking: number;\n\trateLimitWindowMs: number;\n\tenableHoneypot: boolean;\n\tenableIPValidation: boolean;\n\tenableGeoBlocking: boolean;\n}\n\nexport interface LoggingConfig {\n\tlevel: 'DEBUG' | 'INFO' | 'WARN' | 'ERROR';\n\tformat: 'json' | 'text';\n\tenableEmojis: boolean;\n\tenableCorrelationIds: boolean;\n\toutputs: ('console' | 'file')[];\n\tfileName?: string;\n\tmaxFileSize?: number;\n\tmaxFiles?: number;\n}\n\nexport interface TracingConfig {\n\tenabled: boolean;\n\tserviceName: string;\n\tendpoint?: string;\n\tsamplingRate: number;\n\tenableDistributedTracing: boolean;\n}\n\nexport interface JWTConfig {\n\talgorithm: 'HS256' | 'HS384' | 'HS512';\n\tissuer: string;\n\taudience: string;\n\texpirationTime: string; // e.g., '1h', '30m'\n\tsecret: string;\n}\n\nexport interface RateLimitConfig {\n\tendpoints: Record;\n\tdefaultLimit: number;\n\twindowMs: number;\n\tenableDistributedLimiting: boolean;\n}\n\nexport interface MiddlewareConfig {\n\tcors: CORSConfig;\n\tsecurityHeaders: SecurityHeaders;\n\tenableRateLimit: boolean;\n\tenableCORS: boolean;\n\tenableSecurityHeaders: boolean;\n}\n\nexport interface EndpointRateLimit {\n\tlimit: number;\n\twindowMs: number;\n\tskipSuccessfulRequests?: boolean;\n\tskipFailedRequests?: boolean;\n\tkeyGenerator?: string; // Function name for custom key generation\n}\n\n// ========================================\n// Service Interface Types\n// ========================================\n\nexport interface DatabaseService {\n\tinitialize(): Promise;\n\tstoreNonce(nonce: string, context: SecurityContext, bookingId?: string): Promise;\n\tgetNonce(nonce: string): Promise;\n\tupdateNonceState(nonce: string, state: NonceRecord['state'], attemptCount?: number): Promise;\n\tcheckExpiredNonces(): Promise;\n\tcleanupExpiredNonces(): Promise;\n\tgetFingerprintStatus(bookingId: string): Promise;\n\tfindExistingNonce(bookingId: string): Promise;\n\tclose(): void;\n}\n\nexport interface NonceService {\n\tgenerateNonce(): string;\n\tgeneratePageNonce(context: SecurityContext): Promise;\n\tcreatePaymentNonce(request: PaymentNonceRequest, context: SecurityContext): Promise;\n\tvalidateNonceFormat(nonce: string): boolean;\n\tvalidateAndUseNonce(nonce: string, context: SecurityContext): Promise;\n}\n\nexport interface HashService {\n\tgeneratePaymentHash(request: PaymentHashRequest, context: SecurityContext): PaymentHashResponse;\n}\n\nexport interface SecurityService {\n\tvalidateOrigin(origin: string | null): boolean;\n\tvalidateReferer(referer: string | null, origin: string | null): boolean;\n\tvalidateHost(host: string | null): boolean;\n\tvalidateTimestamp(timestamp: string | undefined): boolean;\n\tdetectHoneypot(emailVerify: string | undefined): boolean;\n\tcheckRateLimit(key: string, endpoint: string, customLimit?: number): boolean;\n\textractClientIP(headers: Headers): string;\n\tgetRateLimitStatus(key: string): {\n\t\tattempts: number;\n\t\tresetAt: number;\n\t\tremainingTime: number;\n\t} | null;\n\tperformSecurityCheck(request: Request): SecurityContext;\n\tcreateSecurityContext(request: Request): SecurityContext;\n}\n\nexport interface CryptoService {\n\tgenerateHMAC(data: any, timestamp: string): string;\n\tmakeHash(payload: string): string;\n\tgenerateSecureRandom(length: number): string;\n\tvalidateHMAC(data: any, timestamp: string, signature: string): boolean;\n}\n\nexport interface AuthService {\n\tgenerateInternalToken(\n\t\tsubject: string,\n\t\tadditionalClaims?: Record,\n\t\texpirationMinutes?: number,\n\t): Promise;\n\tvalidateInternalToken(token: string): Promise;\n\tgenerateExternalToken(\n\t\tclientId: string,\n\t\tscopes: string[],\n\t\tadditionalClaims?: Record,\n\t\texpirationMinutes?: number,\n\t): Promise;\n\tvalidateExternalToken(token: string, requiredScopes?: string[]): Promise;\n\tauthenticateRequest(\n\t\trequest: Request,\n\t\trequiredScopes?: string[],\n\t\ttokenType?: 'internal' | 'external' | 'auto',\n\t): Promise;\n}\n\nexport interface AuthValidationResult {\n\tvalid: boolean;\n\terror?: string;\n\tpayload?: JWTPayload;\n\tcontext?: AuthContext;\n}\n\nexport interface AuthContext {\n\tsubject: string;\n\ttokenType: 'internal' | 'external';\n\tscopes: string[];\n\tissuedAt: Date;\n\texpiresAt: Date;\n\tjti?: string;\n\tadditionalClaims?: Record;\n}\n\nexport interface AuthConfig {\n\tissuer: string;\n\tinternalJwtSecret: string;\n\texternalJwtSecret: string;\n\tdefaultExpirationMinutes: number;\n}\n\n// ========================================\n// Gateway & Middleware Types\n// ========================================\n\nexport interface MiddlewareContext {\n\trequest: Request;\n\tresponse?: Response;\n\tsecurity: SecurityContext;\n\tstartTime: number;\n\tcorrelationId: string;\n\tauthenticated: boolean;\n\tuser?: JWTPayload;\n}\n\nexport interface RouteConfig {\n\tpath: string;\n\tmethod: string;\n\toperationId: string;\n\thandler: RouteHandler;\n\tmiddleware: MiddlewareFunction[];\n\tsecurity?: SecurityRequirement[];\n}\n\nexport type RouteHandler = (\n\tcontext: MiddlewareContext,\n) => Promise | Response;\n\nexport type MiddlewareFunction = (\n\tcontext: MiddlewareContext,\n\tnext: () => Promise,\n) => Promise;\n\nexport interface SecurityRequirement {\n\ttype: 'cors' | 'referer' | 'host' | 'nonce' | 'jwt' | 'rateLimit' | 'honeypot' | 'headers' | 'validation';\n\trequired: boolean;\n\tconfig?: any;\n}\n\n// ========================================\n// Utility Types\n// ========================================\n\nexport interface LogEntry {\n\ttimestamp: string;\n\tlevel: 'DEBUG' | 'INFO' | 'WARN' | 'ERROR';\n\tmessage: string;\n\tcorrelationId?: string;\n\tservice: string;\n\toperation?: string;\n\tduration?: number;\n\tmetadata?: Record;\n\terror?: {\n\t\tname: string;\n\t\tmessage: string;\n\t\tstack?: string;\n\t};\n}\n\nexport interface TraceSpan {\n\ttraceId: string;\n\tspanId: string;\n\tparentSpanId?: string;\n\toperationName: string;\n\tstartTime: number;\n\tendTime?: number;\n\ttags: Record;\n\tlogs: { timestamp: number; fields: Record }[];\n}\n\nexport interface ValidationSchema {\n\ttype: string;\n\tproperties?: Record;\n\trequired?: string[];\n\tpattern?: string;\n\tminLength?: number;\n\tmaxLength?: number;\n\tminimum?: number;\n\tmaximum?: number;\n\tenum?: any[];\n}\n\n// ========================================\n// OpenAPI Integration Types\n// ========================================\n\nexport interface OpenAPISpec {\n\topenapi: string;\n\tinfo: any;\n\tpaths?: Record;\n\tsecurity?: any[];\n\tcomponents?: any;\n}\n\nexport interface PathItem {\n\tget?: Operation;\n\tpost?: Operation;\n\tput?: Operation;\n\tpatch?: Operation;\n\tdelete?: Operation;\n\toptions?: Operation;\n\thead?: Operation;\n}\n\nexport interface Operation {\n\toperationId?: string;\n\tsummary?: string;\n\tdescription?: string;\n\tparameters?: any[];\n\trequestBody?: any;\n\tresponses?: any;\n\tsecurity?: any[];\n\ttags?: string[];\n}\n\nexport interface OpenAPIRoute {\n\tpath: string;\n\tmethod: string;\n\toperationId: string;\n\tsummary?: string;\n\tdescription?: string;\n\tparameters?: OpenAPIParameter[];\n\trequestBody?: OpenAPIRequestBody;\n\tresponses: Record;\n\tsecurity?: OpenAPISecurityRequirement[];\n\ttags?: string[];\n}\n\nexport interface OpenAPIParameter {\n\tname: string;\n\tin: 'path' | 'query' | 'header' | 'cookie';\n\trequired?: boolean;\n\tschema: ValidationSchema;\n\tdescription?: string;\n}\n\nexport interface OpenAPIRequestBody {\n\trequired?: boolean;\n\tcontent: Record;\n}\n\nexport interface OpenAPIResponse {\n\tdescription: string;\n\theaders?: Record;\n\tcontent?: Record;\n}\n\nexport interface OpenAPIMediaType {\n\tschema: ValidationSchema;\n\texample?: any;\n\texamples?: Record;\n}\n\nexport interface OpenAPIHeader {\n\tdescription?: string;\n\tschema: ValidationSchema;\n}\n\nexport interface OpenAPISecurityRequirement {\n\t[key: string]: string[];\n}\n\n// ========================================\n// Error Types\n// ========================================\n\nexport class SafeHashError extends Error {\n\tconstructor(\n\t\tmessage: string,\n\t\tpublic code: string,\n\t\tpublic statusCode: number = 500,\n\t\tpublic details?: any,\n\t) {\n\t\tsuper(message);\n\t\tthis.name = 'SafeHashError';\n\t}\n}\n\nexport class ValidationError extends SafeHashError {\n\tconstructor(message: string, details?: string[]) {\n\t\tsuper(message, 'VALIDATION_ERROR', 400, details);\n\t\tthis.name = 'ValidationError';\n\t}\n}\n\nexport class DatabaseError extends SafeHashError {\n\tconstructor(message: string, details?: any) {\n\t\tsuper(message, 'DATABASE_ERROR', 500, details);\n\t\tthis.name = 'DatabaseError';\n\t}\n}\n\n// ========================================\n// Event Types (for observability)\n// ========================================\n\nexport interface SecurityEvent {\n\ttype:\n\t\t| 'honeypot_triggered'\n\t\t| 'rate_limit_exceeded'\n\t\t| 'invalid_origin'\n\t\t| 'suspicious_pattern'\n\t\t| 'ip_blocked'\n\t\t| 'blocked_ip_access'\n\t\t| 'invalid_host'\n\t\t| 'invalid_referer'\n\t\t| 'nonce_reuse_attempt'\n\t\t| 'suspicious_activity';\n\tseverity: 'low' | 'medium' | 'high' | 'critical';\n\ttimestamp: string;\n\tcorrelationId: string;\n\tclientIP: string;\n\tuserAgent?: string;\n\tdetails: Record;\n}\n\nexport interface PerformanceEvent {\n\ttype: 'request_duration' | 'database_query' | 'crypto_operation' | 'external_api_call';\n\toperation: string;\n\tduration: number;\n\ttimestamp: string;\n\tcorrelationId: string;\n\tsuccess: boolean;\n\tmetadata?: Record;\n}\n\n// ========================================\n// Type Guards\n// ========================================\n\nexport function isPaymentNonceRequest(obj: any): obj is PaymentNonceRequest {\n\treturn typeof obj === 'object' &&\n\t\ttypeof obj.bookingId === 'string' &&\n\t\ttypeof obj.timestamp === 'string';\n}\n\nexport function isPaymentHashRequest(obj: any): obj is PaymentHashRequest {\n\treturn typeof obj === 'object' &&\n\t\ttypeof obj.apikey === 'string' &&\n\t\ttypeof obj.username === 'string' &&\n\t\ttypeof obj.password === 'string' &&\n\t\ttypeof obj.mode === 'number' &&\n\t\t[0, 1, 2, 3].includes(obj.mode);\n}\n\nexport function isNonceRecord(obj: any): obj is NonceRecord {\n\treturn typeof obj === 'object' &&\n\t\ttypeof obj.nonce === 'string' &&\n\t\ttypeof obj.state === 'string' &&\n\t\t['unused', 'attempting', 'used', 'expired'].includes(obj.state);\n}\n\n// ========================================\n// Constants\n// ========================================\n\nexport const NONCE_LENGTH = 32;\nexport const NONCE_PATTERN = /^[a-f0-9]{32}$/;\nexport const BOOKING_ID_PATTERN = /^[a-z0-9_-]{1,64}$/i;\nexport const TIMESTAMP_PATTERN = /^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}$/;\n\nexport const HTTP_METHODS = ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS', 'HEAD'] as const;\nexport type HttpMethod = typeof HTTP_METHODS[number];\n\nexport const LOG_LEVELS = ['DEBUG', 'INFO', 'WARN', 'ERROR'] as const;\nexport type LogLevel = typeof LOG_LEVELS[number];\n\nexport const NONCE_STATES = ['unused', 'attempting', 'used', 'expired'] as const;\nexport type NonceState = typeof NONCE_STATES[number];\n\nexport const PAYMENT_MODES = [0, 1, 2, 3] as const;\nexport type PaymentMode = typeof PAYMENT_MODES[number];\n",[],[197,204,221],{"_107":229,"_100":230,"_151":231,"_153":205,"_154":138,"_155":232,"_157":158,"_109":233,"_104":31,"_160":215,"_162":234,"_163":27,"_164":-5,"_165":235,"_103":236},"a7881910-57ee-11f0-a324-f69ea79377d9","env-loader.ts","a78819b0-57ee-11f0-a324-f69ea79377d9",17,["D",1751534297298],"// server/config/env-loader.ts (or server/utils/env-loader.ts, depending on where you put it)\n\nimport { existsSync } from 'https://deno.land/std/fs/exists.ts';\nimport { dirname, join } from 'https://deno.land/std/path/mod.ts';\nimport { parse } from 'https://deno.land/std/dotenv/mod.ts';\n\n/**\n * Loads environment variables from a .env.dev file if it exists\n * in the same directory as the main script.\n */\nexport async function loadDevEnvironment(): Promise {\n\t// Determine the directory of the main script (server/main.ts)\n\t// Deno.mainModule is the URL of the main script\n\tconst mainScriptPath = new URL(Deno.mainModule).pathname;\n\tconst mainScriptDir = dirname(mainScriptPath);\n\n\t// Construct the path to the .env.dev file\n\tconst devEnvPath = join(mainScriptDir, '.env.dev');\n\tconsole.log(devEnvPath);\n\n\t// Check if the .env.dev file exists\n\tif (existsSync(devEnvPath)) {\n\t\tconsole.log(`Loading environment variables from ${devEnvPath}`);\n\t\ttry {\n\t\t\t// Read and parse the .env.dev file\n\t\t\tconst envConfig = await parse(await Deno.readTextFile(devEnvPath));\n\n\t\t\t// Set environment variables\n\t\t\tfor (const key in envConfig) {\n\t\t\t\tif (Object.prototype.hasOwnProperty.call(envConfig, key)) {\n\t\t\t\t\tDeno.env.set(key, envConfig[key]);\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Explicitly set a dev environment flag\n\t\t\tDeno.env.set('APP_ENV', 'dev');\n\t\t\tconsole.log('Environment set to dev.');\n\t\t} catch (error) {\n\t\t\tconsole.error(`Failed to load .env.dev file: ${error}`);\n\t\t}\n\t} else {\n\t\tconsole.log('.env.dev file not found. Running in default environment.');\n\t}\n}\n",[],[197,204,230],{"_107":238,"_100":239,"_151":240,"_153":205,"_154":138,"_155":241,"_157":158,"_109":242,"_104":31,"_160":215,"_162":243,"_163":27,"_164":-5,"_165":244,"_103":245},"a7958ef6-57ee-11f0-abec-f69ea79377d9","openapi-loader.ts","a7959018-57ee-11f0-abec-f69ea79377d9",18,["D",1751534297369],"// deno-lint-ignore-file no-explicit-any\n/**\n * OpenAPI specification loader and dynamic route generator for SafeHash V2.\n * Loads OpenAPI YAML and generates type-safe routes, validation, and documentation.\n */\nimport { logError, logInfo, logWarn } from '../utils/logging.ts';\n\nimport { parse as parseYAML } from 'https://deno.land/std@0.210.0/yaml/mod.ts';\nimport { z } from 'https://esm.sh/zod@3.22.4';\nimport type {\n\tHttpMethod,\n\tMiddlewareFunction,\n\tOpenAPIParameter,\n\tOpenAPIRequestBody,\n\tOpenAPIResponse,\n\tOpenAPIRoute,\n\tOpenAPISecurityRequirement,\n\tRouteConfig,\n\tRouteHandler,\n\tSecurityRequirement,\n\tValidationSchema,\n} from './app-types.ts';\n\n// ========================================\n// OpenAPI Specification Types\n// ========================================\n\nexport interface OpenAPISpec {\n\topenapi: string;\n\tinfo: {\n\t\ttitle: string;\n\t\tversion: string;\n\t\tdescription?: string;\n\t};\n\tservers: Array<{\n\t\turl: string;\n\t\tdescription?: string;\n\t}>;\n\tpaths: Record>;\n\tcomponents?: {\n\t\tschemas?: Record;\n\t\tresponses?: Record;\n\t\tparameters?: Record;\n\t\tsecuritySchemes?: Record;\n\t};\n\tsecurity?: OpenAPISecurityRequirement[];\n\ttags?: Array<{\n\t\tname: string;\n\t\tdescription?: string;\n\t}>;\n}\n\n// ========================================\n// Schema to Zod Converter\n// ========================================\n\n/**\n * Converts OpenAPI schema to Zod validation schema.\n * Supports common OpenAPI types and validation rules.\n */\nfunction convertSchemaToZod(schema: ValidationSchema): z.ZodTypeAny {\n\tif (!schema.type) {\n\t\treturn z.any();\n\t}\n\n\tswitch (schema.type) {\n\t\tcase 'string': {\n\t\t\tlet zodString = z.string();\n\n\t\t\tif (schema.minLength !== undefined) {\n\t\t\t\tzodString = zodString.min(schema.minLength);\n\t\t\t}\n\t\t\tif (schema.maxLength !== undefined) {\n\t\t\t\tzodString = zodString.max(schema.maxLength);\n\t\t\t}\n\t\t\tif (schema.pattern) {\n\t\t\t\tzodString = zodString.regex(new RegExp(schema.pattern));\n\t\t\t}\n\t\t\tif (schema.enum) {\n\t\t\t\treturn z.enum(schema.enum as [string, ...string[]]);\n\t\t\t}\n\n\t\t\treturn zodString;\n\t\t}\n\n\t\tcase 'number':\n\t\tcase 'integer': {\n\t\t\tlet zodNumber = schema.type === 'integer' ? z.number().int() : z.number();\n\n\t\t\tif (schema.minimum !== undefined) {\n\t\t\t\tzodNumber = zodNumber.min(schema.minimum);\n\t\t\t}\n\t\t\tif (schema.maximum !== undefined) {\n\t\t\t\tzodNumber = zodNumber.max(schema.maximum);\n\t\t\t}\n\n\t\t\treturn zodNumber;\n\t\t}\n\n\t\tcase 'boolean':\n\t\t\treturn z.boolean();\n\n\t\tcase 'array': {\n\t\t\tif (schema.properties?.items) {\n\t\t\t\tconst itemSchema = convertSchemaToZod(schema.properties.items);\n\t\t\t\treturn z.array(itemSchema);\n\t\t\t}\n\t\t\treturn z.array(z.any());\n\t\t}\n\n\t\tcase 'object': {\n\t\t\tif (!schema.properties) {\n\t\t\t\treturn z.record(z.any());\n\t\t\t}\n\n\t\t\tconst zodObject: Record = {};\n\n\t\t\tfor (const [key, propSchema] of Object.entries(schema.properties)) {\n\t\t\t\tzodObject[key] = convertSchemaToZod(propSchema as ValidationSchema);\n\t\t\t}\n\n\t\t\tlet objectSchema = z.object(zodObject);\n\n\t\t\t// Handle required fields\n\t\t\tif (schema.required && schema.required.length > 0) {\n\t\t\t\t// Zod objects are required by default, we need to make non-required fields optional\n\t\t\t\tconst requiredFields = new Set(schema.required);\n\t\t\t\tconst modifiedObject: Record = {};\n\n\t\t\t\tfor (const [key, zodType] of Object.entries(zodObject)) {\n\t\t\t\t\tmodifiedObject[key] = requiredFields.has(key) ? zodType : zodType.optional();\n\t\t\t\t}\n\n\t\t\t\tobjectSchema = z.object(modifiedObject);\n\t\t\t}\n\n\t\t\treturn objectSchema;\n\t\t}\n\n\t\tdefault:\n\t\t\tlogWarn(`Unknown schema type: ${schema.type}`, 'openapi_schema_conversion');\n\t\t\treturn z.any();\n\t}\n}\n\n// ========================================\n// Route Validation Generator\n// ========================================\n\n/**\n * Creates validation functions for route parameters, query, and body.\n */\nfunction createRouteValidators(route: OpenAPIRoute) {\n\tconst validators: {\n\t\tparams?: z.ZodSchema;\n\t\tquery?: z.ZodSchema;\n\t\tbody?: z.ZodSchema;\n\t\theaders?: z.ZodSchema;\n\t} = {};\n\n\t// Path parameters validation\n\tconst pathParams = route.parameters?.filter((param) => param.in === 'path') || [];\n\tif (pathParams.length > 0) {\n\t\tconst paramsObject: Record = {};\n\t\tfor (const param of pathParams) {\n\t\t\tparamsObject[param.name] = convertSchemaToZod(param.schema);\n\t\t\tif (!param.required) {\n\t\t\t\tparamsObject[param.name] = paramsObject[param.name].optional();\n\t\t\t}\n\t\t}\n\t\tvalidators.params = z.object(paramsObject);\n\t}\n\n\t// Query parameters validation\n\tconst queryParams = route.parameters?.filter((param) => param.in === 'query') || [];\n\tif (queryParams.length > 0) {\n\t\tconst queryObject: Record = {};\n\t\tfor (const param of queryParams) {\n\t\t\tqueryObject[param.name] = convertSchemaToZod(param.schema);\n\t\t\tif (!param.required) {\n\t\t\t\tqueryObject[param.name] = queryObject[param.name].optional();\n\t\t\t}\n\t\t}\n\t\tvalidators.query = z.object(queryObject);\n\t}\n\n\t// Request body validation\n\tif (route.requestBody) {\n\t\tconst requestBody: OpenAPIRequestBody = route.requestBody;\n\t\tif (requestBody.content?.['application/json']?.schema) {\n\t\t\tvalidators.body = convertSchemaToZod(requestBody.content['application/json'].schema);\n\t\t}\n\t}\n\n\t// Header validation\n\tconst headerParams = route.parameters?.filter((param) => param.in === 'header') || [];\n\tif (headerParams.length > 0) {\n\t\tconst headersObject: Record = {};\n\t\tfor (const param of headerParams) {\n\t\t\t// Convert header names to lowercase for consistency\n\t\t\tconst headerName = param.name.toLowerCase();\n\t\t\theadersObject[headerName] = convertSchemaToZod(param.schema);\n\t\t\tif (!param.required) {\n\t\t\t\theadersObject[headerName] = headersObject[headerName].optional();\n\t\t\t}\n\t\t}\n\t\tvalidators.headers = z.object(headersObject);\n\t}\n\n\treturn validators;\n}\n\n// ========================================\n// Security Requirements Converter\n// ========================================\n\n/**\n * Converts OpenAPI security requirements to middleware security config.\n *\n * Note: In OpenAPI, security requirements have the structure:\n * { schemeName: scopes[] } where scopes is an array of permission strings.\n *\n * Scopes are ONLY used for OAuth 2.0 and OpenID Connect schemes.\n * For all other security schemes (apiKey, http, custom), scopes is an empty array [].\n */\nfunction convertSecurityRequirements(\n\tsecurity: OpenAPISecurityRequirement[] = [],\n): SecurityRequirement[] {\n\tconst requirements: SecurityRequirement[] = [];\n\n\tfor (const securityItem of security) {\n\t\t// OpenAPI security structure: { schemeName: scopes[] }\n\t\t// _scopes is prefixed with _ because it's intentionally unused for our security schemes\n\t\tfor (const [schemeName, _scopes] of Object.entries(securityItem)) {\n\t\t\tswitch (schemeName) {\n\t\t\t\tcase 'NonceAuth':\n\t\t\t\t\trequirements.push({\n\t\t\t\t\t\ttype: 'nonce',\n\t\t\t\t\t\trequired: true,\n\t\t\t\t\t\tconfig: { header: 'X-Payment-Nonce' },\n\t\t\t\t\t});\n\t\t\t\t\tbreak;\n\n\t\t\t\tcase 'RateLimiting':\n\t\t\t\t\trequirements.push({\n\t\t\t\t\t\ttype: 'rateLimit',\n\t\t\t\t\t\trequired: true,\n\t\t\t\t\t\tconfig: { enabled: true },\n\t\t\t\t\t});\n\t\t\t\t\tbreak;\n\n\t\t\t\tcase 'OriginValidation':\n\t\t\t\t\trequirements.push({\n\t\t\t\t\t\ttype: 'cors',\n\t\t\t\t\t\trequired: true,\n\t\t\t\t\t\tconfig: { checkOrigin: true },\n\t\t\t\t\t});\n\t\t\t\t\tbreak;\n\n\t\t\t\tcase 'HoneypotProtection':\n\t\t\t\t\trequirements.push({\n\t\t\t\t\t\ttype: 'honeypot',\n\t\t\t\t\t\trequired: true,\n\t\t\t\t\t\tconfig: { enabled: true },\n\t\t\t\t\t});\n\t\t\t\t\tbreak;\n\n\t\t\t\tcase 'SecurityHeaders':\n\t\t\t\t\trequirements.push({\n\t\t\t\t\t\ttype: 'headers',\n\t\t\t\t\t\trequired: true,\n\t\t\t\t\t\tconfig: { enabled: true },\n\t\t\t\t\t});\n\t\t\t\t\tbreak;\n\n\t\t\t\tcase 'RequestValidation':\n\t\t\t\t\trequirements.push({\n\t\t\t\t\t\ttype: 'validation',\n\t\t\t\t\t\trequired: true,\n\t\t\t\t\t\tconfig: { enabled: true },\n\t\t\t\t\t});\n\t\t\t\t\tbreak;\n\n\t\t\t\tcase 'corsOrigin':\n\t\t\t\t\t// Legacy CORS validation - not OAuth, so _scopes is ignored (would be [])\n\t\t\t\t\trequirements.push({\n\t\t\t\t\t\ttype: 'cors',\n\t\t\t\t\t\trequired: true,\n\t\t\t\t\t\tconfig: { checkOrigin: true },\n\t\t\t\t\t});\n\t\t\t\t\tbreak;\n\n\t\t\t\tcase 'refererValidation':\n\t\t\t\t\t// Custom referer validation - not OAuth, so _scopes is ignored (would be [])\n\t\t\t\t\trequirements.push({\n\t\t\t\t\t\ttype: 'referer',\n\t\t\t\t\t\trequired: true,\n\t\t\t\t\t\tconfig: { strict: true },\n\t\t\t\t\t});\n\t\t\t\t\tbreak;\n\n\t\t\t\tcase 'hostValidation':\n\t\t\t\t\t// Custom host validation - not OAuth, so _scopes is ignored (would be [])\n\t\t\t\t\trequirements.push({\n\t\t\t\t\t\ttype: 'host',\n\t\t\t\t\t\trequired: true,\n\t\t\t\t\t\tconfig: { strict: true },\n\t\t\t\t\t});\n\t\t\t\t\tbreak;\n\n\t\t\t\tcase 'nonceHeader':\n\t\t\t\t\t// Custom nonce validation - not OAuth, so _scopes is ignored (would be [])\n\t\t\t\t\trequirements.push({\n\t\t\t\t\t\ttype: 'nonce',\n\t\t\t\t\t\trequired: true,\n\t\t\t\t\t\tconfig: { header: 'x-payment-nonce' },\n\t\t\t\t\t});\n\t\t\t\t\tbreak;\n\n\t\t\t\tdefault:\n\t\t\t\t\tlogWarn(`Unknown security scheme: ${schemeName}`, 'openapi_security_conversion', {\n\t\t\t\t\t\tschemeName,\n\t\t\t\t\t\tscopes: _scopes, // Include scopes in warning for debugging\n\t\t\t\t\t});\n\t\t\t}\n\t\t}\n\t}\n\n\treturn requirements;\n}\n\n// ========================================\n// OpenAPI Loader Class\n// ========================================\n\nexport class OpenAPILoader {\n\tprivate spec: OpenAPISpec | null = null;\n\tprivate routes: Map = new Map();\n\tprivate routeHandlers: Map = new Map();\n\n\t/**\n\t * Loads OpenAPI specification from YAML file.\n\t */\n\tasync loadSpec(specPath: string): Promise {\n\t\ttry {\n\t\t\tconst yamlContent = await Deno.readTextFile(specPath);\n\t\t\tthis.spec = parseYAML(yamlContent) as OpenAPISpec;\n\n\t\t\tlogInfo(`✅ Loaded OpenAPI spec: ${this.spec.info.title} v${this.spec.info.version}`);\n\n\t\t\t// Validate the spec\n\t\t\tthis.validateSpec();\n\n\t\t\t// Generate routes\n\t\t\tthis.generateRoutes();\n\t\t} catch (error) {\n\t\t\tconst err = error instanceof Error ? error : new Error(String(error));\n\t\t\tthrow new Error(`Failed to load OpenAPI spec from ${specPath}: ${err.message}`);\n\t\t}\n\t}\n\n\t/**\n\t * Validates the loaded OpenAPI specification.\n\t */\n\tprivate validateSpec(): void {\n\t\tif (!this.spec) {\n\t\t\tthrow new Error('No OpenAPI spec loaded');\n\t\t}\n\n\t\tif (!this.spec.openapi.startsWith('3.')) {\n\t\t\tthrow new Error(`Unsupported OpenAPI version: ${this.spec.openapi}. Only 3.x is supported.`);\n\t\t}\n\n\t\tif (!this.spec.paths || Object.keys(this.spec.paths).length === 0) {\n\t\t\tthrow new Error('OpenAPI spec must contain at least one path');\n\t\t}\n\n\t\tlogInfo(`✅ OpenAPI spec validation passed`);\n\t}\n\n\t/**\n\t * Generates route configurations from OpenAPI paths.\n\t */\n\tprivate generateRoutes(): void {\n\t\tif (!this.spec) {\n\t\t\tthrow new Error('No OpenAPI spec loaded');\n\t\t}\n\n\t\tthis.routes.clear();\n\n\t\tfor (const [path, methods] of Object.entries(this.spec.paths)) {\n\t\t\tfor (const [method, route] of Object.entries(methods)) {\n\t\t\t\tconst httpMethod = method.toLowerCase() as HttpMethod;\n\t\t\t\tconst routeKey = `${httpMethod}:${path}`;\n\n\t\t\t\tconst validators = createRouteValidators(route);\n\t\t\t\tconst security = convertSecurityRequirements(route.security);\n\n\t\t\t\tconst routeConfig: RouteConfig = {\n\t\t\t\t\tpath,\n\t\t\t\t\tmethod: httpMethod,\n\t\t\t\t\toperationId: route.operationId,\n\t\t\t\t\thandler: this.createUnregisteredHandler(route.operationId),\n\t\t\t\t\tmiddleware: this.createMiddleware(security, validators),\n\t\t\t\t\tsecurity,\n\t\t\t\t};\n\n\t\t\t\tthis.routes.set(routeKey, routeConfig);\n\n\t\t\t\tlogInfo(`📍 Generated route: ${httpMethod.toUpperCase()} ${path} (${route.operationId})`);\n\t\t\t}\n\t\t}\n\n\t\tlogInfo(`✅ Generated ${this.routes.size} routes from OpenAPI spec`);\n\t}\n\n\t/**\n\t * Creates a handler that indicates the operation requires explicit registration.\n\t * This should never be called in production - all handlers must be registered.\n\t */\n\tprivate createUnregisteredHandler(operationId: string): RouteHandler {\n\t\treturn (context) => {\n\t\t\t// Extract request information from context for better error logging\n\t\t\tconst method = context.request.method;\n\t\t\tconst url = context.request.url;\n\t\t\tconst userAgent = context.request.headers.get('user-agent') || 'unknown';\n\n\t\t\t// Log critical error with request details - this should never happen in production\n\t\t\tlogError(\n\t\t\t\t`🚨 CRITICAL: Unregistered handler called for operation: ${operationId}`,\n\t\t\t\tundefined, // No Error object to pass\n\t\t\t\t'unregistered_handler_called',\n\t\t\t\t{\n\t\t\t\t\tmethod,\n\t\t\t\t\turl,\n\t\t\t\t\tuserAgent,\n\t\t\t\t\toperationId,\n\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t},\n\t\t\t);\n\n\t\t\treturn new Response(\n\t\t\t\tJSON.stringify({\n\t\t\t\t\terror: 'Service temporarily unavailable',\n\t\t\t\t\tmessage: 'This endpoint is not properly configured',\n\t\t\t\t\toperationId,\n\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t}),\n\t\t\t\t{\n\t\t\t\t\tstatus: 503,\n\t\t\t\t\theaders: {\n\t\t\t\t\t\t'content-type': 'application/json',\n\t\t\t\t\t\t'cache-control': 'no-store, no-cache, must-revalidate, private',\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t);\n\t\t};\n\t}\n\n\t/**\n\t * Creates middleware stack for a route based on security requirements and validation.\n\t *\n\t * 1. This function stores middleware in RouteConfig.middleware property (line 356)\n\t * 2. RouteConfig objects are stored in this.routes Map but never consumed\n\t * 3. The actual router (router.ts:179) directly calls this.handleOperation()\n\t * 4. No code anywhere calls loader.getRoutes() or uses RouteConfig.middleware\n\t * 5. Validation happens manually in tp-plugin-handler.ts using PaymentNonceRequestSchema\n\t *\n\t * - router.ts:179: \"(this.app as any)[method](honoPath, async (c: any) => { return await this.handleOperation(operationId, c); });\"\n\t * - tp-plugin-handler.ts:143: \"const validationResult = PaymentNonceRequestSchema.safeParse(body);\"\n\t * - No grep results for \"getRoutes\\|RouteConfig\\.middleware\" in router.ts\n\t *\n\t * @param _security - Security requirements from OpenAPI spec (unused - security is handled globally)\n\t * @param _validators - Request validation schemas (unused - validation happens in handlers)\n\t */\n\tprivate createMiddleware(\n\t\t_security: SecurityRequirement[],\n\t\tvalidators: any,\n\t): MiddlewareFunction[] {\n\t\tconst middleware: MiddlewareFunction[] = [];\n\n\t\t// Add validation middleware if validators exist\n\t\tif (Object.keys(validators).length > 0) {\n\t\t\tmiddleware.push(this.createValidationMiddleware(validators));\n\t\t}\n\n\t\t// Security middleware is handled by global middleware stack\n\t\t// so no route-specific security middleware needed here\n\n\t\treturn middleware;\n\t}\n\n\t/**\n\t * Creates validation middleware for request validation.\n\t */\n\tprivate createValidationMiddleware(validators: any): MiddlewareFunction {\n\t\treturn async (context, next) => {\n\t\t\ttry {\n\t\t\t\tconst url = new URL(context.request.url);\n\n\t\t\t\t// Validate path parameters\n\t\t\t\tif (validators.params) {\n\t\t\t\t\t// Note: Path parameters are extracted by Hono's routing system\n\t\t\t\t\t// and available via c.req.param() in handlers. For validation,\n\t\t\t\t\t// we use extractRequestParams() from router.ts\n\t\t\t\t\tconst pathParams = this.extractPathParams(url.pathname, context.request);\n\t\t\t\t\tvalidators.params.parse(pathParams);\n\t\t\t\t}\n\n\t\t\t\t// Validate query parameters\n\t\t\t\tif (validators.query) {\n\t\t\t\t\tconst queryParams = Object.fromEntries(url.searchParams.entries());\n\t\t\t\t\tvalidators.query.parse(queryParams);\n\t\t\t\t}\n\n\t\t\t\t// Validate request body\n\t\t\t\tif (validators.body && context.request.method !== 'GET') {\n\t\t\t\t\tconst contentType = context.request.headers.get('content-type');\n\t\t\t\t\tif (contentType?.includes('application/json')) {\n\t\t\t\t\t\tconst body = await context.request.json();\n\t\t\t\t\t\tvalidators.body.parse(body);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\t// Validate headers\n\t\t\t\tif (validators.headers) {\n\t\t\t\t\tconst headers = Object.fromEntries(\n\t\t\t\t\t\tArray.from(context.request.headers.entries()).map(([k, v]) => [k.toLowerCase(), v]),\n\t\t\t\t\t);\n\t\t\t\t\tvalidators.headers.parse(headers);\n\t\t\t\t}\n\n\t\t\t\treturn await next();\n\t\t\t} catch (error) {\n\t\t\t\tif (error instanceof z.ZodError) {\n\t\t\t\t\tconst errors = error.errors.map((err) => `${err.path.join('.')}: ${err.message}`);\n\n\t\t\t\t\treturn new Response(\n\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\terror: 'Validation failed',\n\t\t\t\t\t\t\tdetails: errors,\n\t\t\t\t\t\t}),\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tstatus: 400,\n\t\t\t\t\t\t\theaders: { 'content-type': 'application/json' },\n\t\t\t\t\t\t},\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t};\n\t}\n\n\t/**\n\t * Extracts path parameters from URL path for validation middleware.\n\t * This runs before Hono's routing, so we need to manually extract parameters.\n\t */\n\tprivate extractPathParams(pathname: string, request: Request): Record {\n\t\tconst params: Record = {};\n\n\t\t// Find the matching route pattern to extract parameters\n\t\tfor (const [routeKey, config] of this.routes.entries()) {\n\t\t\tconst method = request.method.toLowerCase();\n\t\t\tif (!routeKey.startsWith(`${method}:`)) continue;\n\n\t\t\tconst routePath = config.path;\n\n\t\t\t// Convert OpenAPI path pattern to regex and extract parameters\n\t\t\tif (routePath.includes('{') && routePath.includes('}')) {\n\t\t\t\tconst paramNames: string[] = [];\n\t\t\t\tconst pattern = routePath.replace(/\\{([^}]+)\\}/g, (_, paramName) => {\n\t\t\t\t\tparamNames.push(paramName);\n\t\t\t\t\treturn '([^/]+)';\n\t\t\t\t});\n\n\t\t\t\tconst regex = new RegExp(`^${pattern}$`);\n\t\t\t\tconst match = pathname.match(regex);\n\n\t\t\t\tif (match) {\n\t\t\t\t\t// Extract parameter values\n\t\t\t\t\tfor (let i = 0; i < paramNames.length; i++) {\n\t\t\t\t\t\tparams[paramNames[i]] = match[i + 1];\n\t\t\t\t\t}\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\treturn params;\n\t}\n\n\t/**\n\t * Registers a handler for a specific operation ID.\n\t */\n\tregisterHandler(operationId: string, handler: RouteHandler): void {\n\t\tthis.routeHandlers.set(operationId, handler);\n\n\t\t// Update the route config with the actual handler\n\t\tfor (const [routeKey, config] of this.routes.entries()) {\n\t\t\tif (config.operationId === operationId) {\n\t\t\t\tconfig.handler = handler;\n\t\t\t\tlogInfo(`🔗 Registered handler for ${operationId} (${routeKey})`);\n\t\t\t\tbreak;\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Gets all generated routes.\n\t */\n\tgetRoutes(): Map {\n\t\treturn new Map(this.routes);\n\t}\n\n\t/**\n\t * Gets a specific route configuration.\n\t */\n\tgetRoute(method: string, path: string): RouteConfig | undefined {\n\t\tconst routeKey = `${method.toLowerCase()}:${path}`;\n\t\treturn this.routes.get(routeKey);\n\t}\n\n\t/**\n\t * Gets the loaded OpenAPI specification.\n\t */\n\tgetSpec(): OpenAPISpec | null {\n\t\treturn this.spec;\n\t}\n\n\t/**\n\t * Exports the specification as JSON for API documentation.\n\t */\n\texportSpecAsJSON(): string {\n\t\tif (!this.spec) {\n\t\t\tthrow new Error('No OpenAPI spec loaded');\n\t\t}\n\t\treturn JSON.stringify(this.spec, null, 2);\n\t}\n\n\t/**\n\t * Validates that all operations have registered handlers.\n\t */\n\tvalidateHandlers(): string[] {\n\t\tconst missingHandlers: string[] = [];\n\n\t\tfor (const [routeKey, config] of this.routes.entries()) {\n\t\t\tif (!this.routeHandlers.has(config.operationId)) {\n\t\t\t\tmissingHandlers.push(`${config.operationId} (${routeKey})`);\n\t\t\t}\n\t\t}\n\n\t\treturn missingHandlers;\n\t}\n\n\t/**\n\t * Validates that all handlers are registered and throws error if any are missing.\n\t * Call this before starting the server to ensure production readiness.\n\t */\n\tensureAllHandlersRegistered(): void {\n\t\tconst missingHandlers = this.validateHandlers();\n\n\t\tif (missingHandlers.length > 0) {\n\t\t\tconst errorMessage = `🚨 CRITICAL: Missing handlers for operations:\\n${\n\t\t\t\tmissingHandlers.map((h) => ` - ${h}`).join('\\n')\n\t\t\t}`;\n\t\t\tlogError(errorMessage);\n\t\t\tthrow new Error(`Production server cannot start: ${missingHandlers.length} handlers not registered`);\n\t\t}\n\n\t\tlogInfo(`✅ All ${this.routeHandlers.size} operation handlers properly registered`);\n\t}\n\n\t/**\n\t * Gets route statistics for monitoring.\n\t */\n\tgetStats(): {\n\t\ttotalRoutes: number;\n\t\tregisteredHandlers: number;\n\t\tmissingHandlers: number;\n\t\tendpoints: string[];\n\t} {\n\t\tconst missingHandlers = this.validateHandlers();\n\n\t\treturn {\n\t\t\ttotalRoutes: this.routes.size,\n\t\t\tregisteredHandlers: this.routeHandlers.size,\n\t\t\tmissingHandlers: missingHandlers.length,\n\t\t\tendpoints: Array.from(this.routes.keys()),\n\t\t};\n\t}\n\n\t/**\n\t * Generates and prints a report of loaded endpoints and their security requirements.\n\t */\n\tpublic generateEndpointReport(): void {\n\t\tif (this.routes.size === 0) {\n\t\t\tconsole.log('❌ No routes loaded from OpenAPI spec.');\n\t\t\treturn;\n\t\t}\n\n\t\t// Collect all endpoint data\n\t\tconst endpointsData = [];\n\t\tfor (const routeConfig of this.routes.values()) {\n\t\t\tconst endpointData = {\n\t\t\t\tmethod: routeConfig.method.toUpperCase(),\n\t\t\t\tpath: routeConfig.path,\n\t\t\t\toperationId: routeConfig.operationId,\n\t\t\t\tsecurity: routeConfig.security || [],\n\t\t\t\tmiddlewareCount: routeConfig.middleware?.length || 0,\n\t\t\t};\n\t\t\tendpointsData.push(endpointData);\n\t\t}\n\n\t\tconst reportData = {\n\t\t\ttotalEndpoints: this.routes.size,\n\t\t\ttimestamp: new Date().toISOString(),\n\t\t\tendpoints: endpointsData,\n\t\t};\n\n\t\t// Output as single JSON line for parsing\n\t\tconsole.log('📋 ENDPOINTS_JSON:', JSON.stringify(reportData));\n\n\t\t// Output as readable table with security details\n\t\tconsole.log('\\n🔍 --- OpenAPI Loaded Endpoints Report ---');\n\t\tconsole.log(`📊 Total endpoints loaded: ${this.routes.size}`);\n\t\tconsole.log(\n\t\t\t'┌───────────────────────────────────────────────────────────────────────────────────────────────────────┐',\n\t\t);\n\t\tconsole.log(\n\t\t\t'│ METHOD │ PATH │ OPERATION ID │COR│REF│HST│NON│RAT│HPT│HDR│VAL│ TOT │',\n\t\t);\n\t\tconsole.log(\n\t\t\t'├───────────────────────────────────────────────────────────────────────────────────────────────────────┤',\n\t\t);\n\n\t\tfor (const endpoint of endpointsData) {\n\t\t\tconst method = endpoint.method.padEnd(6);\n\t\t\tconst path = endpoint.path.length > 32 ? endpoint.path.substring(0, 29) + '...' : endpoint.path.padEnd(32);\n\t\t\tconst operationId = endpoint.operationId.length > 19\n\t\t\t\t? endpoint.operationId.substring(0, 16) + '...'\n\t\t\t\t: endpoint.operationId.padEnd(19);\n\n\t\t\t// Check for each security type\n\t\t\tconst hasCors = endpoint.security.some((s) => s.type === 'cors') ? '✅' : '❌';\n\t\t\tconst hasReferer = endpoint.security.some((s) => s.type === 'referer') ? '✅' : '❌';\n\t\t\tconst hasHost = endpoint.security.some((s) => s.type === 'host') ? '✅' : '❌';\n\t\t\tconst hasNonce = endpoint.security.some((s) => s.type === 'nonce') ? '✅' : '❌';\n\t\t\tconst hasRateLimit = endpoint.security.some((s) => s.type === 'rateLimit') ? '✅' : '❌';\n\t\t\tconst hasHoneypot = endpoint.security.some((s) => s.type === 'honeypot') ? '✅' : '❌';\n\t\t\tconst hasHeaders = endpoint.security.some((s) => s.type === 'headers') ? '✅' : '❌';\n\t\t\tconst hasValidation = endpoint.security.some((s) => s.type === 'validation') ? '✅' : '❌';\n\n\t\t\tconst totalSec = endpoint.security.length.toString().padStart(3);\n\n\t\t\tconsole.log(\n\t\t\t\t`│ ${method} │ ${path} │ ${operationId} │${hasCors}│${hasReferer}│${hasHost}│${hasNonce}│${hasRateLimit}│${hasHoneypot}│${hasHeaders}│${hasValidation}│ ${totalSec} │`,\n\t\t\t);\n\t\t}\n\n\t\tconsole.log(\n\t\t\t'└─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘',\n\t\t);\n\t\tconsole.log('Legend: CORS=Origin Validation, REF=Referer Check, HOST=Host Check, NONCE=Payment Nonce,');\n\t\tconsole.log(' RATE=Rate Limiting, HPOT=Honeypot, HDR=Security Headers, VALD=Request Validation');\n\n\t\t// Detailed security breakdown\n\t\tconsole.log('\\n🔒 Security Requirements Detail:');\n\t\tfor (const endpoint of endpointsData) {\n\t\t\tconsole.log(`\\n• ${endpoint.method} ${endpoint.path} (${endpoint.operationId})`);\n\t\t\tif (endpoint.security.length > 0) {\n\t\t\t\tfor (const sec of endpoint.security) {\n\t\t\t\t\tconst config = sec.config && Object.keys(sec.config).length > 0 ? ` - ${JSON.stringify(sec.config)}` : '';\n\t\t\t\t\tconsole.log(` ├─ ${sec.type}${config}`);\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tconsole.log(' └─ No specific security requirements');\n\t\t\t}\n\t\t}\n\n\t\tconsole.log('\\n─────────────────────────────────────────\\n');\n\t}\n}\n\n// ========================================\n// Factory Functions\n// ========================================\n\n/**\n * Creates and loads an OpenAPI loader instance.\n */\nexport async function createOpenAPILoader(specPath: string): Promise {\n\tconst loader = new OpenAPILoader();\n\tawait loader.loadSpec(specPath);\n\treturn loader;\n}\n\n/**\n * Creates a router function that matches requests to OpenAPI routes.\n */\nexport function createOpenAPIRouter(loader: OpenAPILoader) {\n\treturn (request: Request): RouteConfig | null => {\n\t\tconst url = new URL(request.url);\n\t\tconst method = request.method.toLowerCase();\n\t\tconst path = url.pathname;\n\n\t\t// Try exact path match first\n\t\tconst exactRoute = loader.getRoute(method, path);\n\t\tif (exactRoute) {\n\t\t\treturn exactRoute;\n\t\t}\n\n\t\t// Try pattern matching for parameterized paths\n\t\tfor (const [routeKey, config] of loader.getRoutes().entries()) {\n\t\t\tif (!routeKey.startsWith(`${method}:`)) continue;\n\n\t\t\tconst routePath = config.path;\n\n\t\t\t// Simple pattern matching for {param} style parameters\n\t\t\tif (routePath.includes('{') && routePath.includes('}')) {\n\t\t\t\tconst pattern = routePath.replace(/\\{[^}]+\\}/g, '([^/]+)');\n\t\t\t\tconst regex = new RegExp(`^${pattern}$`);\n\n\t\t\t\tif (regex.test(path)) {\n\t\t\t\t\treturn config;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\treturn null;\n\t};\n}\n\n// ========================================\n// Default Export\n// ========================================\n\nexport default {\n\tOpenAPILoader,\n\tcreateOpenAPILoader,\n\tcreateOpenAPIRouter,\n};\n",[],[197,204,239],[197,204],{"_107":248,"_100":249,"_151":250,"_153":198,"_154":138,"_155":251,"_157":158,"_109":252,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_165":253,"_103":290},"a65ea4f0-57ee-11f0-acd0-f69ea79377d9","gateway","a65ea59a-57ee-11f0-acd0-f69ea79377d9",7,["D",1751534295347],[254,263,272,281],{"_107":255,"_100":256,"_151":257,"_153":250,"_154":138,"_155":258,"_157":158,"_109":259,"_104":31,"_160":215,"_162":260,"_163":27,"_164":-5,"_165":261,"_103":262},"a7a1e944-57ee-11f0-85d7-f69ea79377d9","auth.ts","a7a1ea16-57ee-11f0-85d7-f69ea79377d9",19,["D",1751534297466],"// deno-lint-ignore-file no-explicit-any\n/**\n * JWT authentication gateway for SafeHash V2.\n * Handles internal and external token authentication, validation, and management.\n */\n\nimport { create, getNumericDate, verify } from 'https://deno.land/x/djwt@v3.0.2/mod.ts';\nimport { getConfig } from '../config/app-config.ts';\nimport { generateCorrelationId, logAuthEvent, logError, logWarn } from '../utils/logging.ts';\nimport { addSpanTags, finishSpan, setSpanError, traceSecurityCheck } from '../utils/tracing.ts';\nimport type {\n\tAuthConfig,\n\tAuthContext,\n\tAuthService,\n\tAuthValidationResult,\n\tJWTPayload,\n\tSecurityContext,\n\tTraceSpan,\n} from '../config/app-types.ts';\n\n// ========================================\n// JWT Authentication Service\n// ========================================\n\nexport class AuthServiceImpl implements AuthService {\n\tprivate internalKey: CryptoKey | null = null;\n\tprivate externalKey: CryptoKey | null = null;\n\tprivate readonly config: AuthConfig;\n\tprivate initialized = false;\n\n\tconstructor() {\n\t\tthis.config = getConfig('auth');\n\t}\n\n\t/**\n\t * Initializes the auth service by deriving crypto keys.\n\t */\n\tprivate async initialize(): Promise {\n\t\tif (this.initialized) return;\n\n\t\tthis.internalKey = await this.deriveKey(this.config.internalJwtSecret);\n\t\tthis.externalKey = await this.deriveKey(this.config.externalJwtSecret);\n\t\tthis.initialized = true;\n\t}\n\n\t/**\n\t * Derives a CryptoKey from a secret string for JWT signing.\n\t */\n\tprivate async deriveKey(secret: string): Promise {\n\t\tconst encoder = new TextEncoder();\n\t\tconst keyData = encoder.encode(secret.padEnd(32, '0').substring(0, 32));\n\n\t\treturn await crypto.subtle.importKey(\n\t\t\t'raw',\n\t\t\tkeyData,\n\t\t\t{ name: 'HMAC', hash: 'SHA-256' },\n\t\t\tfalse,\n\t\t\t['sign', 'verify'],\n\t\t);\n\t}\n\n\t// ========================================\n\t// Internal Token Management\n\t// ========================================\n\n\t/**\n\t * Generates an internal JWT token for inter-service communication.\n\t */\n\tasync generateInternalToken(\n\t\tsubject: string,\n\t\tadditionalClaims: Record = {},\n\t\texpirationMinutes: number = 60,\n\t): Promise {\n\t\tawait this.initialize();\n\t\tlet span: TraceSpan | null = null;\n\n\t\ttry {\n\t\t\tspan = traceSecurityCheck('generate_internal_token');\n\t\t\taddSpanTags(span, {\n\t\t\t\tsubject,\n\t\t\t\texpiration_minutes: expirationMinutes,\n\t\t\t\tadditional_claims_count: Object.keys(additionalClaims).length,\n\t\t\t});\n\n\t\t\tconst now = Date.now();\n\t\t\tconst payload = {\n\t\t\t\tiss: this.config.issuer,\n\t\t\t\tsub: subject,\n\t\t\t\taud: 'internal',\n\t\t\t\tiat: getNumericDate(now),\n\t\t\t\texp: getNumericDate(now + (expirationMinutes * 60 * 1000)),\n\t\t\t\tjti: generateCorrelationId(),\n\t\t\t\ttype: 'internal',\n\t\t\t\t...additionalClaims,\n\t\t\t};\n\n\t\t\tconst token = await create(\n\t\t\t\t{ alg: 'HS256', typ: 'JWT' },\n\t\t\t\t{ ...payload },\n\t\t\t\tthis.internalKey!,\n\t\t\t);\n\n\t\t\taddSpanTags(span, { success: true, token_length: token.length });\n\n\t\t\tlogAuthEvent('generate', 'internal', subject, {\n\t\t\t\tjti: payload.jti,\n\t\t\t\texpires_in: expirationMinutes * 60,\n\t\t\t});\n\n\t\t\treturn token;\n\t\t} catch (error) {\n\t\t\tconst err = error instanceof Error ? error : new Error(String(error));\n\t\t\tsetSpanError(span, err);\n\n\t\t\tlogError(\n\t\t\t\t`Failed to generate internal token: ${err.message}`,\n\t\t\t\terr,\n\t\t\t\t'internal_token_generation_failed',\n\t\t\t\t{ subject },\n\t\t\t);\n\n\t\t\tthrow err;\n\t\t} finally {\n\t\t\tfinishSpan(span);\n\t\t}\n\t}\n\n\t/**\n\t * Validates an internal JWT token.\n\t */\n\tasync validateInternalToken(token: string): Promise {\n\t\tlet span: TraceSpan | null = null;\n\n\t\ttry {\n\t\t\tspan = traceSecurityCheck('validate_internal_token');\n\t\t\taddSpanTags(span, { token_length: token.length });\n\n\t\t\tconst payload = await verify(token, this.internalKey!) as unknown as JWTPayload;\n\n\t\t\t// Validate token type\n\t\t\tif (payload.type !== 'internal') {\n\t\t\t\taddSpanTags(span, { validation_result: 'invalid_type' });\n\t\t\t\treturn { valid: false, error: 'Invalid token type' };\n\t\t\t}\n\n\t\t\t// Validate audience\n\t\t\tif (payload.aud !== 'internal') {\n\t\t\t\taddSpanTags(span, { validation_result: 'invalid_audience' });\n\t\t\t\treturn { valid: false, error: 'Invalid token audience' };\n\t\t\t}\n\n\t\t\t// Validate issuer\n\t\t\tif (payload.iss !== this.config.issuer) {\n\t\t\t\taddSpanTags(span, { validation_result: 'invalid_issuer' });\n\t\t\t\treturn { valid: false, error: 'Invalid token issuer' };\n\t\t\t}\n\n\t\t\taddSpanTags(span, {\n\t\t\t\tvalidation_result: 'success',\n\t\t\t\tsubject: payload.sub,\n\t\t\t\tjti: payload.jti,\n\t\t\t});\n\n\t\t\tlogAuthEvent('validate', 'internal', payload.sub || 'unknown', {\n\t\t\t\tjti: payload.jti,\n\t\t\t\tresult: 'success',\n\t\t\t});\n\n\t\t\treturn {\n\t\t\t\tvalid: true,\n\t\t\t\tpayload,\n\t\t\t\tcontext: this.createAuthContext(payload, 'internal'),\n\t\t\t};\n\t\t} catch (error) {\n\t\t\tconst err = error instanceof Error ? error : new Error(String(error));\n\t\t\tsetSpanError(span, err);\n\n\t\t\taddSpanTags(span, { validation_result: 'token_invalid' });\n\n\t\t\tlogWarn(\n\t\t\t\t`Internal token validation failed: ${err.message}`,\n\t\t\t\t'internal_token_validation_failed',\n\t\t\t\t{ error: err.message },\n\t\t\t);\n\n\t\t\treturn { valid: false, error: 'Invalid or expired token' };\n\t\t} finally {\n\t\t\tfinishSpan(span);\n\t\t}\n\t}\n\n\t// ========================================\n\t// External Token Management\n\t// ========================================\n\n\t/**\n\t * Generates an external JWT token for client authentication.\n\t */\n\tasync generateExternalToken(\n\t\tclientId: string,\n\t\tscopes: string[],\n\t\tadditionalClaims: Record = {},\n\t\texpirationMinutes: number = 15,\n\t): Promise {\n\t\tlet span: TraceSpan | null = null;\n\n\t\ttry {\n\t\t\tspan = traceSecurityCheck('generate_external_token');\n\t\t\taddSpanTags(span, {\n\t\t\t\tclient_id: clientId,\n\t\t\t\tscopes: scopes.join(','),\n\t\t\t\texpiration_minutes: expirationMinutes,\n\t\t\t});\n\n\t\t\tconst now = Date.now();\n\t\t\tconst payload: JWTPayload = {\n\t\t\t\tiss: this.config.issuer,\n\t\t\t\tsub: clientId,\n\t\t\t\taud: 'external',\n\t\t\t\tiat: getNumericDate(now),\n\t\t\t\texp: getNumericDate(now + (expirationMinutes * 60 * 1000)),\n\t\t\t\tjti: generateCorrelationId(),\n\t\t\t\ttype: 'external',\n\t\t\t\tscopes,\n\t\t\t\t...additionalClaims,\n\t\t\t};\n\n\t\t\tconst token = await create(\n\t\t\t\t{ alg: 'HS256', typ: 'JWT' },\n\t\t\t\t{ ...payload },\n\t\t\t\tthis.externalKey!,\n\t\t\t);\n\n\t\t\taddSpanTags(span, { success: true, token_length: token.length });\n\n\t\t\tlogAuthEvent('generate', 'external', clientId, {\n\t\t\t\tjti: payload.jti,\n\t\t\t\tscopes: scopes.join(','),\n\t\t\t\texpires_in: expirationMinutes * 60,\n\t\t\t});\n\n\t\t\treturn token;\n\t\t} catch (error) {\n\t\t\tconst err = error instanceof Error ? error : new Error(String(error));\n\t\t\tsetSpanError(span, err);\n\n\t\t\tlogError(\n\t\t\t\t`Failed to generate external token: ${err.message}`,\n\t\t\t\terr,\n\t\t\t\t'external_token_generation_failed',\n\t\t\t\t{ client_id: clientId },\n\t\t\t);\n\n\t\t\tthrow err;\n\t\t} finally {\n\t\t\tfinishSpan(span);\n\t\t}\n\t}\n\n\t/**\n\t * Validates an external JWT token.\n\t */\n\tasync validateExternalToken(token: string, requiredScopes: string[] = []): Promise {\n\t\tlet span: TraceSpan | null = null;\n\n\t\ttry {\n\t\t\tspan = traceSecurityCheck('validate_external_token');\n\t\t\taddSpanTags(span, {\n\t\t\t\ttoken_length: token.length,\n\t\t\t\trequired_scopes: requiredScopes.join(','),\n\t\t\t});\n\n\t\t\tconst payload = await verify(token, this.externalKey!) as unknown as JWTPayload;\n\n\t\t\t// Validate token type\n\t\t\tif (payload.type !== 'external') {\n\t\t\t\taddSpanTags(span, { validation_result: 'invalid_type' });\n\t\t\t\treturn { valid: false, error: 'Invalid token type' };\n\t\t\t}\n\n\t\t\t// Validate audience\n\t\t\tif (payload.aud !== 'external') {\n\t\t\t\taddSpanTags(span, { validation_result: 'invalid_audience' });\n\t\t\t\treturn { valid: false, error: 'Invalid token audience' };\n\t\t\t}\n\n\t\t\t// Validate issuer\n\t\t\tif (payload.iss !== this.config.issuer) {\n\t\t\t\taddSpanTags(span, { validation_result: 'invalid_issuer' });\n\t\t\t\treturn { valid: false, error: 'Invalid token issuer' };\n\t\t\t}\n\n\t\t\t// Validate scopes\n\t\t\tconst tokenScopes = payload.scopes || [];\n\t\t\tconst missingScopes = requiredScopes.filter((scope) => !tokenScopes.includes(scope));\n\n\t\t\tif (missingScopes.length > 0) {\n\t\t\t\taddSpanTags(span, {\n\t\t\t\t\tvalidation_result: 'insufficient_scopes',\n\t\t\t\t\tmissing_scopes: missingScopes.join(','),\n\t\t\t\t});\n\n\t\t\t\tlogWarn(\n\t\t\t\t\t`Token missing required scopes: ${missingScopes.join(', ')}`,\n\t\t\t\t\t'insufficient_token_scopes',\n\t\t\t\t\t{\n\t\t\t\t\t\tclient_id: payload.sub,\n\t\t\t\t\t\trequired: requiredScopes,\n\t\t\t\t\t\tavailable: tokenScopes,\n\t\t\t\t\t\tmissing: missingScopes,\n\t\t\t\t\t},\n\t\t\t\t);\n\n\t\t\t\treturn { valid: false, error: 'Insufficient permissions' };\n\t\t\t}\n\n\t\t\taddSpanTags(span, {\n\t\t\t\tvalidation_result: 'success',\n\t\t\t\tclient_id: payload.sub,\n\t\t\t\tjti: payload.jti,\n\t\t\t\tscopes: tokenScopes.join(','),\n\t\t\t});\n\n\t\t\tlogAuthEvent('validate', 'external', payload.sub, {\n\t\t\t\tjti: payload.jti,\n\t\t\t\tscopes: tokenScopes.join(','),\n\t\t\t\tresult: 'success',\n\t\t\t});\n\n\t\t\treturn {\n\t\t\t\tvalid: true,\n\t\t\t\tpayload,\n\t\t\t\tcontext: this.createAuthContext(payload, 'external'),\n\t\t\t};\n\t\t} catch (error) {\n\t\t\tconst err = error instanceof Error ? error : new Error(String(error));\n\t\t\tsetSpanError(span, err);\n\n\t\t\taddSpanTags(span, { validation_result: 'token_invalid' });\n\n\t\t\tlogWarn(\n\t\t\t\t`External token validation failed: ${err.message}`,\n\t\t\t\t'external_token_validation_failed',\n\t\t\t\t{ error: err.message },\n\t\t\t);\n\n\t\t\treturn { valid: false, error: 'Invalid or expired token' };\n\t\t} finally {\n\t\t\tfinishSpan(span);\n\t\t}\n\t}\n\n\t// ========================================\n\t// Request Authentication\n\t// ========================================\n\n\t/**\n\t * Authenticates a request based on Authorization header.\n\t */\n\tasync authenticateRequest(\n\t\trequest: Request,\n\t\trequiredScopes: string[] = [],\n\t\ttokenType: 'internal' | 'external' | 'auto' = 'auto',\n\t): Promise {\n\t\tlet span: TraceSpan | null = null;\n\n\t\ttry {\n\t\t\tspan = traceSecurityCheck('authenticate_request');\n\t\t\tconst authHeader = request.headers.get('Authorization');\n\n\t\t\taddSpanTags(span, {\n\t\t\t\thas_auth_header: !!authHeader,\n\t\t\t\ttoken_type: tokenType,\n\t\t\t\trequired_scopes: requiredScopes.join(','),\n\t\t\t});\n\n\t\t\tif (!authHeader) {\n\t\t\t\taddSpanTags(span, { auth_result: 'missing_header' });\n\t\t\t\treturn { valid: false, error: 'Authorization header required' };\n\t\t\t}\n\n\t\t\tif (!authHeader.startsWith('Bearer ')) {\n\t\t\t\taddSpanTags(span, { auth_result: 'invalid_format' });\n\t\t\t\treturn { valid: false, error: 'Invalid authorization format' };\n\t\t\t}\n\n\t\t\tconst token = authHeader.slice(7);\n\n\t\t\tif (tokenType === 'auto') {\n\t\t\t\t// Try external first, then internal\n\t\t\t\tconst externalResult = await this.validateExternalToken(token, requiredScopes);\n\t\t\t\tif (externalResult.valid) {\n\t\t\t\t\taddSpanTags(span, { auth_result: 'success', detected_type: 'external' });\n\t\t\t\t\treturn externalResult;\n\t\t\t\t}\n\n\t\t\t\tconst internalResult = await this.validateInternalToken(token);\n\t\t\t\tif (internalResult.valid) {\n\t\t\t\t\taddSpanTags(span, { auth_result: 'success', detected_type: 'internal' });\n\t\t\t\t\treturn internalResult;\n\t\t\t\t}\n\n\t\t\t\taddSpanTags(span, { auth_result: 'both_failed' });\n\t\t\t\treturn { valid: false, error: 'Invalid token' };\n\t\t\t} else if (tokenType === 'external') {\n\t\t\t\treturn await this.validateExternalToken(token, requiredScopes);\n\t\t\t} else {\n\t\t\t\treturn await this.validateInternalToken(token);\n\t\t\t}\n\t\t} catch (error) {\n\t\t\tconst err = error instanceof Error ? error : new Error(String(error));\n\t\t\tsetSpanError(span, err);\n\n\t\t\tlogError(\n\t\t\t\t`Request authentication failed: ${err.message}`,\n\t\t\t\terr,\n\t\t\t\t'request_authentication_failed',\n\t\t\t);\n\n\t\t\treturn { valid: false, error: 'Authentication failed' };\n\t\t} finally {\n\t\t\tfinishSpan(span);\n\t\t}\n\t}\n\n\t// ========================================\n\t// Utility Methods\n\t// ========================================\n\n\t/**\n\t * Creates an authentication context from JWT payload.\n\t */\n\tprivate createAuthContext(payload: JWTPayload, tokenType: 'internal' | 'external'): AuthContext {\n\t\treturn {\n\t\t\tsubject: payload.sub,\n\t\t\ttokenType,\n\t\t\tscopes: payload.scopes || [],\n\t\t\tissuedAt: new Date((payload.iat || 0) * 1000),\n\t\t\texpiresAt: new Date((payload.exp || 0) * 1000),\n\t\t\tjti: payload.jti,\n\t\t\tadditionalClaims: Object.fromEntries(\n\t\t\t\tObject.entries(payload).filter(([key]) =>\n\t\t\t\t\t!['iss', 'sub', 'aud', 'iat', 'exp', 'jti', 'type', 'scopes'].includes(key)\n\t\t\t\t),\n\t\t\t),\n\t\t};\n\t}\n\n\t/**\n\t * Refreshes a token if it's close to expiration.\n\t */\n\tasync refreshTokenIfNeeded(\n\t\ttoken: string,\n\t\ttokenType: 'internal' | 'external',\n\t\trefreshThresholdMinutes: number = 5,\n\t): Promise<{ refreshed: boolean; token?: string; payload?: JWTPayload }> {\n\t\ttry {\n\t\t\tconst validation = tokenType === 'internal'\n\t\t\t\t? await this.validateInternalToken(token)\n\t\t\t\t: await this.validateExternalToken(token);\n\n\t\t\tif (!validation.valid || !validation.payload) {\n\t\t\t\treturn { refreshed: false };\n\t\t\t}\n\n\t\t\tconst now = Date.now();\n\t\t\tconst expiresAt = (validation.payload.exp || 0) * 1000;\n\t\t\tconst timeUntilExpiry = expiresAt - now;\n\t\t\tconst refreshThreshold = refreshThresholdMinutes * 60 * 1000;\n\n\t\t\tif (timeUntilExpiry > refreshThreshold) {\n\t\t\t\treturn { refreshed: false, payload: validation.payload };\n\t\t\t}\n\n\t\t\t// Generate new token with same claims\n\t\t\tconst newToken = tokenType === 'internal'\n\t\t\t\t? await this.generateInternalToken(\n\t\t\t\t\tvalidation.payload.sub,\n\t\t\t\t\tvalidation.context?.additionalClaims || {},\n\t\t\t\t)\n\t\t\t\t: await this.generateExternalToken(\n\t\t\t\t\tvalidation.payload.sub,\n\t\t\t\t\tvalidation.payload.scopes || [],\n\t\t\t\t\tvalidation.context?.additionalClaims || {},\n\t\t\t\t);\n\n\t\t\tlogAuthEvent('refresh', tokenType, validation.payload.sub, {\n\t\t\t\told_jti: validation.payload.jti,\n\t\t\t\ttime_until_expiry: timeUntilExpiry,\n\t\t\t});\n\n\t\t\treturn { refreshed: true, token: newToken, payload: validation.payload };\n\t\t} catch (error) {\n\t\t\tlogWarn(\n\t\t\t\t`Token refresh failed: ${error instanceof Error ? error.message : String(error)}`,\n\t\t\t\t'token_refresh_failed',\n\t\t\t\t{ token_type: tokenType },\n\t\t\t);\n\n\t\t\treturn { refreshed: false };\n\t\t}\n\t}\n\n\t/**\n\t * Extracts token from various sources (header, query, cookie).\n\t */\n\textractToken(request: Request): { token: string | null; source: string } {\n\t\t// Try Authorization header first\n\t\tconst authHeader = request.headers.get('Authorization');\n\t\tif (authHeader && authHeader.startsWith('Bearer ')) {\n\t\t\treturn { token: authHeader.slice(7), source: 'header' };\n\t\t}\n\n\t\t// Try query parameter\n\t\tconst url = new URL(request.url);\n\t\tconst queryToken = url.searchParams.get('token');\n\t\tif (queryToken) {\n\t\t\treturn { token: queryToken, source: 'query' };\n\t\t}\n\n\t\t// Try cookie\n\t\tconst cookies = request.headers.get('Cookie');\n\t\tif (cookies) {\n\t\t\tconst tokenMatch = cookies.match(/(?:^|; )token=([^;]*)/);\n\t\t\tif (tokenMatch) {\n\t\t\t\treturn { token: tokenMatch[1], source: 'cookie' };\n\t\t\t}\n\t\t}\n\n\t\treturn { token: null, source: 'none' };\n\t}\n\n\t/**\n\t * Validates token payload structure.\n\t */\n\tvalidateTokenPayload(payload: any): payload is JWTPayload {\n\t\treturn (\n\t\t\ttypeof payload === 'object' &&\n\t\t\tpayload !== null &&\n\t\t\ttypeof payload.iss === 'string' &&\n\t\t\ttypeof payload.sub === 'string' &&\n\t\t\ttypeof payload.aud === 'string' &&\n\t\t\ttypeof payload.iat === 'number' &&\n\t\t\ttypeof payload.exp === 'number' &&\n\t\t\t(payload.type === 'internal' || payload.type === 'external')\n\t\t);\n\t}\n}\n\n// ========================================\n// Authentication Middleware\n// ========================================\n\n/**\n * Creates authentication middleware for Hono or similar frameworks.\n */\nexport function createAuthMiddleware(\n\tauthService: AuthService,\n\toptions: {\n\t\trequiredScopes?: string[];\n\t\ttokenType?: 'internal' | 'external' | 'auto';\n\t\toptional?: boolean;\n\t} = {},\n) {\n\treturn async (c: any, next: any) => {\n\t\tconst { requiredScopes = [], tokenType = 'auto', optional = false } = options;\n\n\t\tconst result = await authService.authenticateRequest(\n\t\t\tc.req.raw,\n\t\t\trequiredScopes,\n\t\t\ttokenType,\n\t\t);\n\n\t\tif (!result.valid) {\n\t\t\tif (optional) {\n\t\t\t\tc.set('auth', null);\n\t\t\t\treturn next();\n\t\t\t}\n\n\t\t\treturn c.json(\n\t\t\t\t{\n\t\t\t\t\terror: 'Authentication failed',\n\t\t\t\t\tmessage: result.error,\n\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t},\n\t\t\t\t401,\n\t\t\t);\n\t\t}\n\n\t\t// Set authentication context\n\t\tc.set('auth', result.context);\n\t\tc.set('jwt_payload', result.payload);\n\n\t\treturn next();\n\t};\n}\n\n// ========================================\n// Utility Functions\n// ========================================\n\n/**\n * Creates a security context from authentication context.\n */\nexport function createSecurityContextFromAuth(\n\tauthContext: AuthContext,\n\trequest: Request,\n): SecurityContext {\n\tconst url = new URL(request.url);\n\n\treturn {\n\t\tclientIP: 'authenticated-client', // Would extract from reverse proxy headers\n\t\torigin: request.headers.get('origin') || url.origin, // Use URL origin as fallback\n\t\treferer: request.headers.get('referer'),\n\t\thost: request.headers.get('host') || url.hostname, // Use URL hostname as fallback\n\t\tuserAgent: request.headers.get('user-agent'),\n\t\ttimestamp: new Date().toISOString(),\n\t\tcorrelationId: generateCorrelationId(),\n\t\tauthenticated: true,\n\t\tauthContext,\n\t};\n}\n\n/**\n * Validates JWT signature without full verification (for debugging).\n */\nexport function validateJWTStructure(token: string): {\n\tvalid: boolean;\n\theader?: any;\n\tpayload?: any;\n\terror?: string;\n} {\n\ttry {\n\t\tconst parts = token.split('.');\n\t\tif (parts.length !== 3) {\n\t\t\treturn { valid: false, error: 'Invalid JWT structure' };\n\t\t}\n\n\t\tconst header = JSON.parse(atob(parts[0].replace(/-/g, '+').replace(/_/g, '/')));\n\t\tconst payload = JSON.parse(atob(parts[1].replace(/-/g, '+').replace(/_/g, '/')));\n\n\t\treturn { valid: true, header, payload };\n\t} catch (error) {\n\t\treturn {\n\t\t\tvalid: false,\n\t\t\terror: error instanceof Error ? error.message : 'Invalid JWT format',\n\t\t};\n\t}\n}\n\n/**\n * Gets token expiration info.\n */\nexport function getTokenExpiration(token: string): {\n\tvalid: boolean;\n\texpiresAt?: Date;\n\tisExpired?: boolean;\n\ttimeUntilExpiry?: number;\n} {\n\tconst structure = validateJWTStructure(token);\n\tif (!structure.valid || !structure.payload?.exp) {\n\t\treturn { valid: false };\n\t}\n\n\tconst expiresAt = new Date(structure.payload.exp * 1000);\n\tconst now = new Date();\n\tconst isExpired = expiresAt <= now;\n\tconst timeUntilExpiry = expiresAt.getTime() - now.getTime();\n\n\treturn {\n\t\tvalid: true,\n\t\texpiresAt,\n\t\tisExpired,\n\t\ttimeUntilExpiry: Math.max(0, timeUntilExpiry),\n\t};\n}\n\n// ========================================\n// Factory Function\n// ========================================\n\n/**\n * Creates a new authentication service instance.\n */\nexport function createAuthService(): AuthService {\n\treturn new AuthServiceImpl();\n}\n\n// ========================================\n// Default Export\n// ========================================\n\nexport default {\n\tAuthServiceImpl,\n\tcreateAuthService,\n\tcreateAuthMiddleware,\n\tcreateSecurityContextFromAuth,\n\tvalidateJWTStructure,\n\tgetTokenExpiration,\n};\n",[],[197,249,256],{"_107":264,"_100":265,"_151":266,"_153":250,"_154":138,"_155":267,"_157":158,"_109":268,"_104":31,"_160":215,"_162":269,"_163":27,"_164":-5,"_165":270,"_103":271},"a7b5612c-57ee-11f0-9f8c-f69ea79377d9","middleware.ts","a7b5621c-57ee-11f0-9f8c-f69ea79377d9",20,["D",1751534297593],"// deno-lint-ignore-file no-explicit-any\n/**\n * Middleware gateway for SafeHash V2.\n * Handles CORS, security headers, rate limiting, request validation, and response processing.\n */\n\nimport { getConfig } from '../config/app-config.ts';\nimport {\n\tgenerateCorrelationId,\n\tlogError,\n\tlogInfo,\n\tlogRequestCompletion as logRequest,\n\tlogWarn,\n} from '../utils/logging.ts';\nimport { clearRequestContext, setRequestSpan, traceHttpRequest, traceHttpResponse } from '../utils/tracing.ts';\nimport { createSecurityService } from '../services/security-service.ts';\nimport { createRateLimitKey } from '../services/security-service.ts';\nimport type { MiddlewareConfig, SecurityContext, SecurityService, TraceSpan } from '../config/app-types.ts';\n\n// ========================================\n// Middleware Configuration\n// ========================================\n\ninterface MiddlewareOptions {\n\tenableCORS?: boolean;\n\tenableSecurityHeaders?: boolean;\n\tenableRateLimit?: boolean;\n\tenableTracing?: boolean;\n\tenableRequestLogging?: boolean;\n\tcorsOrigins?: string[];\n\tcustomHeaders?: Record;\n}\n\n// ========================================\n// Security Headers Middleware\n// ========================================\n\n/**\n * Adds comprehensive security headers to responses.\n */\nexport function securityHeadersMiddleware(options: { customHeaders?: Record } = {}) {\n\treturn async (c: any, next: any) => {\n\t\tawait next();\n\n\t\tconst config: MiddlewareConfig = getConfig('middleware');\n\t\tconst headers = {\n\t\t\t// Content Security Policy\n\t\t\t'Content-Security-Policy': config.securityHeaders.contentSecurityPolicy,\n\n\t\t\t// XSS Protection\n\t\t\t'X-Content-Type-Options': 'nosniff',\n\t\t\t'X-Frame-Options': 'DENY',\n\t\t\t'X-XSS-Protection': '1; mode=block',\n\n\t\t\t// HTTPS and Transport Security\n\t\t\t'Strict-Transport-Security': 'max-age=31536000; includeSubDomains; preload',\n\n\t\t\t// Cache Control for sensitive endpoints\n\t\t\t'Cache-Control': 'no-store, no-cache, must-revalidate, private',\n\t\t\t'Pragma': 'no-cache',\n\t\t\t'Expires': '0',\n\n\t\t\t// Additional Security\n\t\t\t'Referrer-Policy': 'strict-origin-when-cross-origin',\n\t\t\t'Permissions-Policy': 'geolocation=(), microphone=(), camera=()',\n\n\t\t\t// Custom Server Header\n\t\t\t'Server': 'SafeHash-API/2.0',\n\n\t\t\t// Rate Limit Information\n\t\t\t'X-RateLimit-Policy': 'sliding-window',\n\n\t\t\t// Security Notices\n\t\t\t'X-Content-Security-Policy': config.securityHeaders.contentSecurityPolicy,\n\t\t\t'X-WebKit-CSP': config.securityHeaders.contentSecurityPolicy,\n\n\t\t\t// Custom headers\n\t\t\t...options.customHeaders,\n\t\t};\n\n\t\t// Apply headers\n\t\tObject.entries(headers).forEach(([key, value]) => {\n\t\t\tif (value) {\n\t\t\t\tc.header(key, value);\n\t\t\t}\n\t\t});\n\n\t\t// Add correlation ID to response headers\n\t\tconst correlationId = c.get('correlationId');\n\t\tif (correlationId) {\n\t\t\tc.header('X-Correlation-ID', correlationId);\n\t\t}\n\t};\n}\n\n// ========================================\n// CORS Middleware\n// ========================================\n\n/**\n * Handles Cross-Origin Resource Sharing (CORS) with configurable origins.\n */\nexport function corsMiddleware(options: {\n\tallowedOrigins?: string[];\n\tallowedMethods?: string[];\n\tallowedHeaders?: string[];\n\tmaxAge?: number;\n} = {}) {\n\treturn async (c: any, next: any) => {\n\t\tconst config: MiddlewareConfig = getConfig('middleware');\n\t\tconst {\n\t\t\tallowedOrigins = config.cors.allowedOrigins,\n\t\t\tallowedMethods = ['GET', 'POST', 'OPTIONS'],\n\t\t\tallowedHeaders = ['Content-Type', 'Authorization', 'X-Requested-With'],\n\t\t\tmaxAge = 86400, // 24 hours\n\t\t} = options;\n\n\t\tconst origin = c.req.header('Origin');\n\t\tconst method = c.req.method;\n\n\t\t// Handle preflight requests\n\t\tif (method === 'OPTIONS') {\n\t\t\t// Check if origin is allowed\n\t\t\tconst isAllowedOrigin = allowedOrigins.includes('*') ||\n\t\t\t\t(origin && allowedOrigins.includes(origin));\n\n\t\t\tif (isAllowedOrigin) {\n\t\t\t\tc.header('Access-Control-Allow-Origin', origin || '*');\n\t\t\t\tc.header('Access-Control-Allow-Methods', allowedMethods.join(', '));\n\t\t\t\tc.header('Access-Control-Allow-Headers', allowedHeaders.join(', '));\n\t\t\t\tc.header('Access-Control-Max-Age', maxAge.toString());\n\t\t\t\tc.header('Access-Control-Allow-Credentials', 'false');\n\n\t\t\t\tlogInfo(\n\t\t\t\t\t`CORS preflight handled for origin: ${origin}`,\n\t\t\t\t\t'cors_preflight',\n\t\t\t\t\t{ origin, allowed: true },\n\t\t\t\t);\n\n\t\t\t\treturn c.text('', 204);\n\t\t\t} else {\n\t\t\t\tlogWarn(\n\t\t\t\t\t`CORS preflight rejected for origin: ${origin}`,\n\t\t\t\t\t'cors_preflight_rejected',\n\t\t\t\t\t{ origin, allowed_origins: allowedOrigins },\n\t\t\t\t);\n\n\t\t\t\treturn c.text('CORS policy violation', 403);\n\t\t\t}\n\t\t}\n\n\t\t// Handle actual requests\n\t\tif (origin) {\n\t\t\tconst isAllowedOrigin = allowedOrigins.includes('*') || allowedOrigins.includes(origin);\n\n\t\t\tif (isAllowedOrigin) {\n\t\t\t\tc.header('Access-Control-Allow-Origin', origin);\n\t\t\t\tc.header('Access-Control-Allow-Credentials', 'false');\n\t\t\t\tc.header('Vary', 'Origin');\n\t\t\t} else {\n\t\t\t\tlogWarn(\n\t\t\t\t\t`CORS request rejected for origin: ${origin}`,\n\t\t\t\t\t'cors_request_rejected',\n\t\t\t\t\t{ origin, method, allowed_origins: allowedOrigins },\n\t\t\t\t);\n\n\t\t\t\treturn c.json(\n\t\t\t\t\t{\n\t\t\t\t\t\terror: 'CORS policy violation',\n\t\t\t\t\t\tmessage: 'Origin not allowed',\n\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t},\n\t\t\t\t\t403,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\tawait next();\n\t};\n}\n\n// ========================================\n// Rate Limiting Middleware\n// ========================================\n\n/**\n * Implements rate limiting with configurable windows and limits.\n */\nexport function rateLimitMiddleware(options: {\n\tkeyGenerator?: (c: any) => string;\n\tskipSuccessfulRequests?: boolean;\n\tskipFailedRequests?: boolean;\n\tonLimitReached?: (c: any, info: any) => Response;\n} = {}) {\n\tconst securityService: SecurityService = createSecurityService();\n\n\treturn async (c: any, next: any) => {\n\t\tconst {\n\t\t\tkeyGenerator = (c: any) => {\n\t\t\t\tconst ip = c.req.header('x-forwarded-for') ||\n\t\t\t\t\tc.req.header('x-real-ip') ||\n\t\t\t\t\t'unknown';\n\t\t\t\treturn ip.split(',')[0].trim();\n\t\t\t},\n\t\t\tskipSuccessfulRequests = false,\n\t\t\tskipFailedRequests = false,\n\t\t\tonLimitReached,\n\t\t} = options;\n\n\t\tconst rateLimitKey = keyGenerator(c);\n\t\tconst endpoint = new URL(c.req.url).pathname;\n\t\tconst fullKey = createRateLimitKey(rateLimitKey, endpoint); // bookingId removed in security-service\n\n\t\t// Check rate limit\n\t\tconst allowed = securityService.checkRateLimit(fullKey, endpoint);\n\n\t\tif (!allowed) {\n\t\t\tconst status = securityService.getRateLimitStatus(fullKey);\n\t\t\tconst remainingTime = status ? Math.ceil(status.remainingTime / 1000) : 60;\n\n\t\t\t// Add rate limit headers\n\t\t\tc.header('X-RateLimit-Limit', '60'); // Default limit\n\t\t\tc.header('X-RateLimit-Remaining', '0');\n\t\t\tc.header('X-RateLimit-Reset', Date.now() + (remainingTime * 1000));\n\t\t\tc.header('Retry-After', remainingTime.toString());\n\n\t\t\tlogWarn(\n\t\t\t\t`Rate limit exceeded for ${rateLimitKey}`,\n\t\t\t\t'rate_limit_exceeded',\n\t\t\t\t{\n\t\t\t\t\tkey: rateLimitKey,\n\t\t\t\t\tendpoint,\n\t\t\t\t\tremaining_time: remainingTime,\n\t\t\t\t\tattempts: status?.attempts || 0,\n\t\t\t\t},\n\t\t\t);\n\n\t\t\tif (onLimitReached) {\n\t\t\t\treturn onLimitReached(c, {\n\t\t\t\t\tkey: rateLimitKey,\n\t\t\t\t\tremainingTime,\n\t\t\t\t\tattempts: status?.attempts || 0,\n\t\t\t\t});\n\t\t\t}\n\n\t\t\treturn c.json(\n\t\t\t\t{\n\t\t\t\t\terror: 'Rate limit exceeded',\n\t\t\t\t\tmessage: `Too many requests. Try again in ${remainingTime} seconds.`,\n\t\t\t\t\tretryAfter: remainingTime,\n\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t},\n\t\t\t\t429,\n\t\t\t);\n\t\t}\n\n\t\t// Add rate limit info to headers\n\t\tconst status = securityService.getRateLimitStatus(fullKey);\n\t\tif (status) {\n\t\t\tconst config = getConfig('rateLimit');\n\t\t\tconst endpointConfig = config.endpoints[endpoint];\n\t\t\tconst limit = endpointConfig?.limit || config.defaultLimit;\n\n\t\t\tc.header('X-RateLimit-Limit', limit.toString());\n\t\t\tc.header('X-RateLimit-Remaining', Math.max(0, limit - status.attempts).toString());\n\t\t\tc.header('X-RateLimit-Reset', status.resetAt.toString());\n\t\t}\n\n\t\tawait next();\n\n\t\t// Optionally skip counting based on response status\n\t\tconst responseStatus = c.res.status;\n\t\tconst shouldSkip = (skipSuccessfulRequests && responseStatus < 400) ||\n\t\t\t(skipFailedRequests && responseStatus >= 400);\n\n\t\tif (shouldSkip) {\n\t\t\t// Would need to decrement counter here if we tracked it\n\t\t\tlogInfo(\n\t\t\t\t`Rate limit count skipped for ${rateLimitKey}`,\n\t\t\t\t'rate_limit_skipped',\n\t\t\t\t{ key: rateLimitKey, status: responseStatus, reason: responseStatus < 400 ? 'success' : 'failure' },\n\t\t\t);\n\t\t}\n\t};\n}\n\n// ========================================\n// Request Logging Middleware\n// ========================================\n\n/**\n * Logs incoming requests with correlation IDs and timing.\n */\nexport function requestLoggingMiddleware(options: {\n\tlogBody?: boolean;\n\tlogHeaders?: boolean;\n\tsensitiveHeaders?: string[];\n} = {}) {\n\treturn async (c: any, next: any) => {\n\t\tconst {\n\t\t\tlogBody = false,\n\t\t\tlogHeaders = false,\n\t\t\tsensitiveHeaders = ['authorization', 'cookie', 'x-api-key'],\n\t\t} = options;\n\n\t\tconst startTime = performance.now();\n\t\tconst correlationId = generateCorrelationId();\n\t\tconst method = c.req.method;\n\t\tconst url = c.req.url;\n\t\tconst userAgent = c.req.header('user-agent');\n\t\tconst origin = c.req.header('origin');\n\t\tconst ip = c.req.header('x-forwarded-for') ||\n\t\t\tc.req.header('x-real-ip') ||\n\t\t\t'unknown';\n\n\t\t// Store correlation ID for other middleware\n\t\tc.set('correlationId', correlationId);\n\n\t\t// Log request start\n\t\tconst requestData: any = {\n\t\t\tmethod,\n\t\t\turl,\n\t\t\tuser_agent: userAgent,\n\t\t\torigin,\n\t\t\tclient_ip: ip.split(',')[0].trim(),\n\t\t\tcorrelation_id: correlationId,\n\t\t};\n\n\t\tif (logHeaders) {\n\t\t\tconst headers: Record = {};\n\t\t\tfor (const [key, value] of c.req.raw.headers.entries()) {\n\t\t\t\tif (!sensitiveHeaders.includes(key.toLowerCase())) {\n\t\t\t\t\theaders[key] = value;\n\t\t\t\t} else {\n\t\t\t\t\theaders[key] = '[REDACTED]';\n\t\t\t\t}\n\t\t\t}\n\t\t\trequestData.headers = headers;\n\t\t}\n\n\t\tif (logBody && ['POST', 'PUT', 'PATCH'].includes(method)) {\n\t\t\ttry {\n\t\t\t\t// Clone request to avoid consuming the body stream\n\t\t\t\tconst clonedRequest = c.req.raw.clone();\n\t\t\t\tconst body = await clonedRequest.text();\n\t\t\t\trequestData.body_size = body.length;\n\n\t\t\t\t// Only log body if it's not too large\n\t\t\t\tif (body.length < 1024) {\n\t\t\t\t\trequestData.body = body;\n\t\t\t\t}\n\t\t\t} catch {\n\t\t\t\trequestData.body = '[ERROR_READING_BODY]';\n\t\t\t}\n\t\t}\n\n\t\tlogRequest(method, url, requestData);\n\n\t\ttry {\n\t\t\tawait next();\n\t\t} catch (error) {\n\t\t\tconst duration = performance.now() - startTime;\n\n\t\t\tlogError(\n\t\t\t\t`Request failed: ${error instanceof Error ? error.message : String(error)}`,\n\t\t\t\terror instanceof Error ? error : new Error(String(error)),\n\t\t\t\t'request_failed',\n\t\t\t\t{\n\t\t\t\t\tmethod,\n\t\t\t\t\turl,\n\t\t\t\t\tduration,\n\t\t\t\t\tcorrelation_id: correlationId,\n\t\t\t\t},\n\t\t\t);\n\n\t\t\tthrow error;\n\t\t}\n\n\t\t// Log response\n\t\tconst duration = performance.now() - startTime;\n\t\tconst status = c.res.status;\n\t\tconst contentLength = c.res.headers.get('content-length');\n\n\t\tlogInfo(\n\t\t\t`${method} ${url} - ${status} (${duration.toFixed(2)}ms)`,\n\t\t\t'request_completed',\n\t\t\t{\n\t\t\t\tmethod,\n\t\t\t\turl,\n\t\t\t\tstatus,\n\t\t\t\tduration,\n\t\t\t\tcontent_length: contentLength ? parseInt(contentLength) : undefined,\n\t\t\t\tcorrelation_id: correlationId,\n\t\t\t\tclient_ip: ip.split(',')[0].trim(),\n\t\t\t},\n\t\t);\n\t};\n}\n\n// ========================================\n// Distributed Tracing Middleware\n// ========================================\n\n/**\n * Handles distributed tracing for requests.\n */\nexport function tracingMiddleware() {\n\treturn async (c: any, next: any) => {\n\t\tconst method = c.req.method;\n\t\tconst path = new URL(c.req.url).pathname;\n\t\tconst headers = c.req.raw.headers;\n\n\t\t// Start HTTP request span\n\t\tconst span: TraceSpan | null = traceHttpRequest(method, path, headers);\n\t\tconst correlationId = c.get('correlationId') || generateCorrelationId();\n\n\t\t// Set request span for context\n\t\tsetRequestSpan(correlationId, span);\n\n\t\ttry {\n\t\t\tawait next();\n\n\t\t\t// Trace successful response\n\t\t\tconst status = c.res.status;\n\t\t\tconst contentLength = c.res.headers.get('content-length');\n\t\t\tconst responseSize = contentLength ? parseInt(contentLength) : undefined;\n\n\t\t\tif (span) {\n\t\t\t\ttraceHttpResponse(span, status, responseSize);\n\t\t\t}\n\t\t} catch (error) {\n\t\t\t// Trace error response\n\t\t\tif (span) {\n\t\t\t\ttraceHttpResponse(span, 500);\n\t\t\t}\n\t\t\tthrow error;\n\t\t} finally {\n\t\t\t// Clean up request context\n\t\t\tclearRequestContext(correlationId);\n\t\t}\n\t};\n}\n\n// ========================================\n// Error Handling Middleware\n// ========================================\n\n/**\n * Handles errors and converts them to appropriate JSON responses.\n */\nexport function errorHandlingMiddleware() {\n\treturn async (c: any, next: any) => {\n\t\ttry {\n\t\t\tawait next();\n\t\t} catch (error) {\n\t\t\tconst correlationId = c.get('correlationId');\n\t\t\tconst err = error instanceof Error ? error : new Error(String(error));\n\n\t\t\tlogError(\n\t\t\t\t`Unhandled error: ${err.message}`,\n\t\t\t\terr,\n\t\t\t\t'unhandled_error',\n\t\t\t\t{ correlation_id: correlationId },\n\t\t\t);\n\n\t\t\t// Security-focused error response (don't leak internal details)\n\t\t\tconst isDevelopment = getConfig('server').environment === 'dev';\n\n\t\t\treturn c.json(\n\t\t\t\t{\n\t\t\t\t\terror: 'Internal server error',\n\t\t\t\t\tmessage: isDevelopment ? err.message : 'An unexpected error occurred',\n\t\t\t\t\tcorrelationId,\n\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t...(isDevelopment && { stack: err.stack }),\n\t\t\t\t},\n\t\t\t\t500,\n\t\t\t);\n\t\t}\n\t};\n}\n\n// ========================================\n// Security Context Middleware\n// ========================================\n\n/**\n * Creates and attaches security context to requests.\n */\nexport function securityContextMiddleware() {\n\tconst securityService: SecurityService = createSecurityService();\n\n\treturn async (c: any, next: any) => {\n\t\t// Create security context\n\t\tconst context: SecurityContext = securityService.createSecurityContext(c.req.raw);\n\t\tc.set('securityContext', context);\n\n\t\t// Perform basic security checks\n\t\tconst securityCheck: SecurityContext = await securityService.performSecurityCheck(c.req.raw);\n\n\t\tif (!securityCheck.passed) {\n\t\t\tconst errors = securityCheck.errors || [];\n\t\t\tlogWarn(\n\t\t\t\t`Security check failed: ${errors.join(', ')}`,\n\t\t\t\t'security_check_failed',\n\t\t\t\t{\n\t\t\t\t\tclient_ip: context.clientIP,\n\t\t\t\t\terrors: errors,\n\t\t\t\t\torigin: context.origin,\n\t\t\t\t},\n\t\t\t);\n\n\t\t\treturn c.json(\n\t\t\t\t{\n\t\t\t\t\terror: 'Security validation failed',\n\t\t\t\t\tmessage: 'Request does not meet security requirements',\n\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t},\n\t\t\t\t403,\n\t\t\t);\n\t\t}\n\n\t\tawait next();\n\t};\n}\n\n// ========================================\n// Request Validation Middleware\n// ========================================\n\n/**\n * Validates request structure and content type.\n */\nexport function requestValidationMiddleware() {\n\treturn async (c: any, next: any) => {\n\t\tconst method = c.req.method;\n\t\tconst contentType = c.req.header('content-type');\n\n\t\t// Validate content type for POST requests\n\t\tif (['POST', 'PUT', 'PATCH'].includes(method)) {\n\t\t\tif (!contentType) {\n\t\t\t\treturn c.json(\n\t\t\t\t\t{\n\t\t\t\t\t\terror: 'Missing Content-Type header',\n\t\t\t\t\t\tmessage: 'Content-Type header is required for this request',\n\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t},\n\t\t\t\t\t400,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tif (!contentType.startsWith('application/json')) {\n\t\t\t\treturn c.json(\n\t\t\t\t\t{\n\t\t\t\t\t\terror: 'Invalid Content-Type',\n\t\t\t\t\t\tmessage: 'Content-Type must be application/json',\n\t\t\t\t\t\texpected: 'application/json',\n\t\t\t\t\t\treceived: contentType,\n\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t},\n\t\t\t\t\t415,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\tawait next();\n\t};\n}\n\n// ========================================\n// Combined Middleware Stack\n// ========================================\n\n/**\n * Creates a complete middleware stack with all security and operational features.\n */\nexport function createMiddlewareStack(options: MiddlewareOptions = {}) {\n\tconst {\n\t\tenableCORS = true,\n\t\tenableSecurityHeaders = true,\n\t\tenableRateLimit = true,\n\t\tenableTracing = true,\n\t\tenableRequestLogging = true,\n\t\tcorsOrigins,\n\t\tcustomHeaders = {},\n\t} = options;\n\n\tconst middlewares: any[] = [];\n\n\t// Error handling should be first\n\tmiddlewares.push(errorHandlingMiddleware());\n\n\t// Request logging early for observability\n\tif (enableRequestLogging) {\n\t\tmiddlewares.push(requestLoggingMiddleware({\n\t\t\tlogHeaders: true,\n\t\t\tlogBody: false, // Don't log body by default for security\n\t\t}));\n\t}\n\n\t// Distributed tracing\n\tif (enableTracing) {\n\t\tmiddlewares.push(tracingMiddleware());\n\t}\n\n\t// CORS handling\n\tif (enableCORS) {\n\t\tmiddlewares.push(corsMiddleware({\n\t\t\tallowedOrigins: corsOrigins,\n\t\t}));\n\t}\n\n\t// Security headers\n\tif (enableSecurityHeaders) {\n\t\tmiddlewares.push(securityHeadersMiddleware({\n\t\t\tcustomHeaders,\n\t\t}));\n\t}\n\n\t// Security context creation\n\tmiddlewares.push(securityContextMiddleware());\n\n\t// Request validation\n\tmiddlewares.push(requestValidationMiddleware());\n\n\t// Rate limiting (after security checks)\n\tif (enableRateLimit) {\n\t\tmiddlewares.push(rateLimitMiddleware());\n\t}\n\n\treturn middlewares;\n}\n\n// ========================================\n// Utility Functions\n// ========================================\n\n/**\n * Extracts client IP from request headers.\n */\nexport function extractClientIP(headers: Headers): string {\n\tconst forwarded = headers.get('x-forwarded-for');\n\tif (forwarded) {\n\t\treturn forwarded.split(',')[0].trim();\n\t}\n\n\tconst realIP = headers.get('x-real-ip');\n\tif (realIP) {\n\t\treturn realIP;\n\t}\n\n\tconst cfConnectingIP = headers.get('cf-connecting-ip');\n\tif (cfConnectingIP) {\n\t\treturn cfConnectingIP;\n\t}\n\n\treturn 'unknown';\n}\n\n/**\n * Creates a response with security headers.\n */\nexport function createSecureResponse(\n\tbody: any,\n\tstatus: number = 200,\n\theaders: Record = {},\n): Response {\n\tconst secureHeaders = {\n\t\t'Content-Type': 'application/json',\n\t\t'Cache-Control': 'no-store, no-cache, must-revalidate, private',\n\t\t'X-Content-Type-Options': 'nosniff',\n\t\t'X-Frame-Options': 'DENY',\n\t\t...headers,\n\t};\n\n\treturn new Response(\n\t\ttypeof body === 'string' ? body : JSON.stringify(body),\n\t\t{ status, headers: secureHeaders },\n\t);\n}\n\n// ========================================\n// Default Export\n// ========================================\n\nexport default {\n\t// Individual middleware\n\tsecurityHeadersMiddleware,\n\tcorsMiddleware,\n\trateLimitMiddleware,\n\trequestLoggingMiddleware,\n\ttracingMiddleware,\n\terrorHandlingMiddleware,\n\tsecurityContextMiddleware,\n\trequestValidationMiddleware,\n\n\t// Middleware stack\n\tcreateMiddlewareStack,\n\n\t// Utilities\n\textractClientIP,\n\tcreateSecureResponse,\n};\n",[],[197,249,265],{"_107":273,"_100":274,"_151":275,"_153":250,"_154":138,"_155":276,"_157":158,"_109":277,"_104":31,"_160":215,"_162":278,"_163":27,"_164":-5,"_165":279,"_103":280},"a7c55488-57ee-11f0-91ce-f69ea79377d9","router.ts","a7c55532-57ee-11f0-91ce-f69ea79377d9",21,["D",1751534297695],"// deno-lint-ignore-file no-explicit-any\n/**\n * Dynamic OpenAPI-driven router for SafeHash V2.\n * Automatically generates routes from OpenAPI specification and handles endpoint logic.\n */\n\nimport { Hono } from 'https://esm.sh/hono@4.2.7';\nimport { createOpenAPILoader } from '../config/openapi-loader.ts';\nimport { getConfig } from '../config/app-config.ts';\nimport { createAuthMiddleware } from './auth.ts';\nimport { createMiddlewareStack } from './middleware.ts';\nimport { createDatabaseService } from '../services/database-service.ts';\nimport { createNonceService } from '../services/nonce-service.ts';\nimport { createHashService } from '../services/hash-service.ts';\nimport { createSecurityService } from '../services/security-service.ts';\nimport { createAuthService } from './auth.ts';\nimport { createTpPluginHandler, type TpPluginServices } from './tp-plugin-handler.ts';\nimport { logError, logInfo, logWarn } from '../utils/logging.ts';\nimport type {\n\tAuthService,\n\tDatabaseService,\n\tHashService,\n\tNonceService,\n\tOpenAPISpec,\n\tOperation,\n\tPathItem,\n\tSecurityService,\n} from '../config/app-types.ts';\n\n// ========================================\n// Router Configuration\n// ========================================\n\ninterface RouterServices {\n\tdatabase: DatabaseService;\n\tnonce: NonceService;\n\thash: HashService;\n\tsecurity: SecurityService;\n\tauth: AuthService;\n}\n\n// ========================================\n// Dynamic Router Implementation\n// ========================================\n\nexport class OpenAPIRouter {\n\tprivate app: Hono;\n\tprivate spec: OpenAPISpec;\n\tprivate services: RouterServices;\n\tprivate tpPluginHandler: ReturnType;\n\tprivate openAPILoader: any; // Store loader to access RouteConfig objects\n\n\tconstructor() {\n\t\tthis.app = new Hono();\n\t\tthis.spec = {} as OpenAPISpec; // Will be loaded asynchronously\n\t\tthis.services = this.initializeServices();\n\t\tthis.tpPluginHandler = createTpPluginHandler(this.services as TpPluginServices);\n\t\tthis.setupMiddleware();\n\t}\n\n\t/**\n\t * Initializes the router with OpenAPI spec loading.\n\t */\n\tasync initializeRouter(specPath: string): Promise {\n\t\tthis.openAPILoader = await createOpenAPILoader(specPath);\n\t\tthis.spec = this.openAPILoader.getSpec() || {} as OpenAPISpec;\n\t\tthis.setupRoutes();\n\t}\n\n\t/**\n\t * Initializes all required services.\n\t */\n\tprivate initializeServices(): RouterServices {\n\t\tconst database = createDatabaseService();\n\t\tconst nonce = createNonceService(database);\n\t\tconst hash = createHashService();\n\t\tconst security = createSecurityService();\n\t\tconst auth = createAuthService();\n\n\t\treturn { database, nonce, hash, security, auth };\n\t}\n\n\t/**\n\t * Sets up global middleware stack.\n\t */\n\tprivate setupMiddleware(): void {\n\t\tconst config = getConfig('middleware');\n\n\t\t// Apply middleware stack\n\t\tconst middlewares = createMiddlewareStack({\n\t\t\tenableCORS: true,\n\t\t\tenableSecurityHeaders: true,\n\t\t\tenableRateLimit: true,\n\t\t\tenableTracing: true,\n\t\t\tenableRequestLogging: true,\n\t\t\tcorsOrigins: config.cors.allowedOrigins,\n\t\t});\n\n\t\tmiddlewares.forEach((middleware) => this.app.use('*', middleware));\n\n\t\t// Error handling specifically for Hono\n\t\tthis.app.onError((err, c) => {\n\t\t\tlogError(\n\t\t\t\t`Hono error: ${err.message}`,\n\t\t\t\terr,\n\t\t\t\t'hono_error',\n\t\t\t\t{ path: c.req.path, method: c.req.method },\n\t\t\t);\n\n\t\t\tthrow err; // Re-throw to let our error middleware handle it\n\t\t});\n\n\t\tlogInfo('Router middleware stack initialized', 'router_init');\n\t}\n\n\t/**\n\t * Dynamically sets up routes from OpenAPI specification.\n\t */\n\tprivate setupRoutes(): void {\n\t\tif (!this.spec.paths) {\n\t\t\tlogWarn('No paths found in OpenAPI specification', 'router_setup_warning');\n\t\t\treturn;\n\t\t}\n\n\t\tfor (const [path, pathItem] of Object.entries(this.spec.paths)) {\n\t\t\tthis.setupPathRoutes(path, pathItem);\n\t\t}\n\n\t\tlogInfo(`Router setup complete with ${Object.keys(this.spec.paths).length} paths`, 'router_setup');\n\t}\n\n\t/**\n\t * Sets up routes for a specific path item.\n\t */\n\tprivate setupPathRoutes(path: string, pathItem: PathItem): void {\n\t\tconst methods = ['get', 'post', 'put', 'patch', 'delete'] as const;\n\n\t\tfor (const method of methods) {\n\t\t\tconst operation = pathItem[method];\n\t\t\tif (operation) {\n\t\t\t\tthis.setupOperationRoute(method, path, operation);\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Sets up a route for a specific HTTP operation.\n\t */\n\tprivate setupOperationRoute(method: string, path: string, operation: Operation): void {\n\t\tconst operationId = operation.operationId;\n\n\t\tif (!operationId) {\n\t\t\tlogWarn(`No operationId found for ${method.toUpperCase()} ${path}`, 'router_setup_warning');\n\t\t\treturn;\n\t\t}\n\n\t\t// Convert OpenAPI path to Hono path format\n\t\tconst honoPath = this.convertPathToHono(path);\n\n\t\t// Get RouteConfig with OpenAPI-generated validation middleware\n\t\tconst routeConfig = this.openAPILoader?.getRoute(method, path);\n\n\t\t// Setup authentication if required\n\t\tconst securityRequirements = operation.security || this.spec.security || [];\n\t\tconst authMiddleware = this.createAuthMiddlewareForOperation(securityRequirements);\n\n\t\tif (authMiddleware) {\n\t\t\tthis.app.use(honoPath, authMiddleware);\n\t\t}\n\n\t\t// Apply OpenAPI validation middleware for this route\n\t\tif (routeConfig?.middleware && routeConfig.middleware.length > 0) {\n\t\t\tfor (const middleware of routeConfig.middleware) {\n\t\t\t\tthis.app.use(honoPath, async (c: any, next: any) => {\n\t\t\t\t\treturn await middleware({ request: c.req.raw }, next);\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\n\t\t// Setup the actual route handler\n\t\t(this.app as any)[method](honoPath, async (c: any) => {\n\t\t\treturn await this.handleOperation(operationId, c);\n\t\t});\n\n\t\tlogInfo(\n\t\t\t`Route registered: ${method.toUpperCase()} ${honoPath} -> ${operationId}${\n\t\t\t\trouteConfig?.middleware?.length ? ` with ${routeConfig.middleware.length} validation middleware` : ''\n\t\t\t}`,\n\t\t\t'route_registered',\n\t\t\t{ method, path: honoPath, operation_id: operationId, middleware_count: routeConfig?.middleware?.length || 0 },\n\t\t);\n\t}\n\n\t/**\n\t * Converts OpenAPI path parameters to Hono format.\n\t */\n\tprivate convertPathToHono(path: string): string {\n\t\t// Convert {param} to :param\n\t\treturn path.replace(/\\{([^}]+)\\}/g, ':$1');\n\t}\n\n\t/**\n\t * Creates authentication middleware for an operation.\n\t */\n\tprivate createAuthMiddlewareForOperation(securityRequirements: any[]): any {\n\t\tif (securityRequirements.length === 0) {\n\t\t\treturn null; // No authentication required\n\t\t}\n\n\t\t// Check for NonceAuth (X-Payment-Nonce header required)\n\t\tconst hasNonceAuth = securityRequirements.some((req) => req.NonceAuth !== undefined);\n\n\t\tif (hasNonceAuth) {\n\t\t\t// Return middleware that validates X-Payment-Nonce header\n\t\t\treturn async (c: any, next: any) => {\n\t\t\t\tconst nonce = c.req.header('X-Payment-Nonce') || c.req.header('x-payment-nonce');\n\t\t\t\tif (!nonce) {\n\t\t\t\t\treturn c.json({\n\t\t\t\t\t\terror: 'Missing required X-Payment-Nonce header',\n\t\t\t\t\t\tmessage: 'A valid payment nonce is required for this endpoint',\n\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t}, 401);\n\t\t\t\t}\n\n\t\t\t\t// Validate nonce format (32 hex characters)\n\t\t\t\tif (!/^[a-f0-9]{32}$/.test(nonce)) {\n\t\t\t\t\treturn c.json({\n\t\t\t\t\t\terror: 'Invalid nonce format',\n\t\t\t\t\t\tmessage: 'Nonce must be 32 hexadecimal characters',\n\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t}, 400);\n\t\t\t\t}\n\n\t\t\t\t// Store nonce in context for handler to validate and use\n\t\t\t\tc.set('paymentNonce', nonce);\n\t\t\t\tawait next();\n\t\t\t};\n\t\t}\n\n\t\t// Check for bearer token authentication (legacy support)\n\t\tconst hasBearerAuth = securityRequirements.some((req) => req.bearerAuth !== undefined);\n\n\t\tif (hasBearerAuth) {\n\t\t\treturn createAuthMiddleware(this.services.auth, {\n\t\t\t\ttokenType: 'auto',\n\t\t\t\toptional: false,\n\t\t\t});\n\t\t}\n\n\t\treturn null;\n\t}\n\n\t/**\n\t * Dispatches operations to the appropriate TravelPay plugin handler.\n\t */\n\tprivate async handleOperation(operationId: string, c: any): Promise {\n\t\ttry {\n\t\t\t// Dispatch to TravelPay plugin handler based on operationId\n\t\t\tswitch (operationId) {\n\t\t\t\tcase 'validateTurnstileToken':\n\t\t\t\t\treturn await this.tpPluginHandler.handleValidateTurnstile(c);\n\n\t\t\t\tcase 'getPageNonce':\n\t\t\t\t\treturn await this.tpPluginHandler.handleGeneratePageNonce(c);\n\n\t\t\t\tcase 'createPaymentNonce':\n\t\t\t\t\treturn await this.tpPluginHandler.handleCreatePaymentNonce(c);\n\n\t\t\t\tcase 'createPaymentHash':\n\t\t\t\t\treturn await this.tpPluginHandler.handleGeneratePaymentHash(c);\n\n\t\t\t\tcase 'getFingerprintStatus':\n\t\t\t\t\treturn await this.tpPluginHandler.handleGetFingerprintStatus(c);\n\n\t\t\t\tdefault:\n\t\t\t\t\tlogError(\n\t\t\t\t\t\t`Unknown operation attempted: ${operationId}`,\n\t\t\t\t\t\tnew Error(`Unknown operation: ${operationId}`),\n\t\t\t\t\t\t'unknown_operation',\n\t\t\t\t\t\t{ operation_id: operationId },\n\t\t\t\t\t);\n\n\t\t\t\t\treturn c.json(\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\terror: 'Operation not supported',\n\t\t\t\t\t\t\tmessage: 'The requested operation is not available',\n\t\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t\t},\n\t\t\t\t\t\t404,\n\t\t\t\t\t);\n\t\t\t}\n\t\t} catch (error) {\n\t\t\tconst err = error instanceof Error ? error : new Error(String(error));\n\n\t\t\tlogError(\n\t\t\t\t`Router dispatch failed for ${operationId}: ${err.message}`,\n\t\t\t\terr,\n\t\t\t\t'router_dispatch_failed',\n\t\t\t\t{ operation_id: operationId },\n\t\t\t);\n\n\t\t\treturn c.json(\n\t\t\t\t{\n\t\t\t\t\terror: 'Internal server error',\n\t\t\t\t\tmessage: 'An unexpected error occurred',\n\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t},\n\t\t\t\t500,\n\t\t\t);\n\t\t}\n\t}\n\n\t// ========================================\n\t// Router Interface\n\t// ========================================\n\n\t/**\n\t * Gets the configured Hono app instance.\n\t */\n\tgetApp(): Hono {\n\t\treturn this.app;\n\t}\n\n\t/**\n\t * Gets the OpenAPI specification.\n\t */\n\tgetSpec(): OpenAPISpec {\n\t\treturn this.spec;\n\t}\n\n\t/**\n\t * Gets the router services.\n\t */\n\tgetServices(): RouterServices {\n\t\treturn this.services;\n\t}\n\n\t/**\n\t * Initializes all services (database, etc.).\n\t */\n\tasync initialize(): Promise {\n\t\tawait this.services.database.initialize();\n\t\tlogInfo('Router services initialized', 'router_services_init');\n\t}\n\n\t/**\n\t * Shuts down the router and cleans up resources.\n\t */\n\tshutdown(): void {\n\t\tthis.services.database.close();\n\t\tlogInfo('Router shutdown complete', 'router_shutdown');\n\t}\n}\n\n// ========================================\n// Route Utilities\n// ========================================\n\n/**\n * Validates request timing to prevent replay attacks.\n */\nexport function validateRequestTiming(timestamp: string, toleranceMs: number = 5 * 60 * 1000): boolean {\n\ttry {\n\t\tconst requestTime = new Date(timestamp).getTime();\n\t\tconst now = Date.now();\n\n\t\tif (isNaN(requestTime)) {\n\t\t\treturn false;\n\t\t}\n\n\t\treturn (now - requestTime) <= toleranceMs && (now - requestTime) >= 0;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\n/**\n * Creates a standardized error response.\n */\nexport function createErrorResponse(\n\terror: string,\n\tmessage: string,\n\tstatus: number = 400,\n\tdetails?: any,\n): Response {\n\tconst response = {\n\t\terror,\n\t\tmessage,\n\t\ttimestamp: new Date().toISOString(),\n\t\t...(details && { details }),\n\t};\n\n\treturn new Response(JSON.stringify(response), {\n\t\tstatus,\n\t\theaders: {\n\t\t\t'Content-Type': 'application/json',\n\t\t\t'Cache-Control': 'no-store, no-cache, must-revalidate, private',\n\t\t},\n\t});\n}\n\n/**\n * Extracts and validates request parameters.\n */\nexport function extractRequestParams(c: any): {\n\tbody?: any;\n\tparams: Record;\n\tquery: Record;\n} {\n\tconst url = new URL(c.req.url);\n\tconst params: Record = {};\n\tconst query: Record = {};\n\n\t// Extract path parameters\n\tfor (const [key, value] of Object.entries(c.req.param())) {\n\t\tparams[key] = value as string;\n\t}\n\n\t// Extract query parameters\n\tfor (const [key, value] of url.searchParams.entries()) {\n\t\tquery[key] = value;\n\t}\n\n\treturn { params, query };\n}\n\n// ========================================\n// Factory Functions\n// ========================================\n\n/**\n * Creates a new OpenAPI router instance.\n */\nexport function createOpenAPIRouter(): OpenAPIRouter {\n\treturn new OpenAPIRouter();\n}\n\n/**\n * Creates and initializes a new OpenAPI router instance with spec loading.\n */\nexport async function createInitializedOpenAPIRouter(specPath: string): Promise {\n\tconst router = new OpenAPIRouter();\n\tawait router.initializeRouter(specPath);\n\treturn router;\n}\n\n/**\n * Creates a basic router with minimal setup (for testing).\n */\nexport function createBasicRouter(): Hono {\n\tconst app = new Hono();\n\n\treturn app;\n}\n\n// ========================================\n// Default Export\n// ========================================\n\nexport default {\n\tOpenAPIRouter,\n\tcreateOpenAPIRouter,\n\tcreateInitializedOpenAPIRouter,\n\tcreateBasicRouter,\n\tvalidateRequestTiming,\n\tcreateErrorResponse,\n\textractRequestParams,\n};\n",[],[197,249,274],{"_107":282,"_100":283,"_151":284,"_153":250,"_154":138,"_155":285,"_157":158,"_109":286,"_104":31,"_160":215,"_162":287,"_163":27,"_164":-5,"_165":288,"_103":289},"a7d1fc10-57ee-11f0-bb18-f69ea79377d9","tp-plugin-handler.ts","a7d1fce2-57ee-11f0-bb18-f69ea79377d9",22,["D",1751534297779],"// deno-lint-ignore-file no-explicit-any\n/**\n * TravelPay plugin handler for SafeHash V2.\n * Contains all business logic for TravelPay plugin initialization endpoints.\n */\n\n// Manual validation schemas removed - now using OpenAPI-generated validation middleware\nimport { generateCorrelationId, logError, logInfo } from '../utils/logging.ts';\nimport { addSpanTags, finishSpan, setSpanError, traceBusinessOperation } from '../utils/tracing.ts';\nimport type {\n\tAuthService,\n\tDatabaseService,\n\tHashService,\n\tNonceService,\n\tPaymentHashRequest,\n\tSecurityContext,\n\tSecurityService,\n\tTraceSpan,\n} from '../config/app-types.ts';\n\n// ========================================\n// Handler Configuration\n// ========================================\n\nexport interface TpPluginServices {\n\tdatabase: DatabaseService;\n\tnonce: NonceService;\n\thash: HashService;\n\tsecurity: SecurityService;\n\tauth: AuthService;\n}\n\nexport interface TpPluginContext {\n\tservices: TpPluginServices;\n\tcorrelationId: string;\n\tsecurityContext: SecurityContext;\n}\n\n// ========================================\n// TravelPay Plugin Handler Implementation\n// ========================================\n\nexport class TpPluginHandler {\n\tprivate services: TpPluginServices;\n\n\tconstructor(services: TpPluginServices) {\n\t\tthis.services = services;\n\t}\n\n\t/**\n\t * Creates context for TravelPay plugin operations.\n\t */\n\tprivate createContext(c: any): TpPluginContext {\n\t\treturn {\n\t\t\tservices: this.services,\n\t\t\tcorrelationId: c.get('correlationId') || generateCorrelationId(),\n\t\t\tsecurityContext: c.get('securityContext'),\n\t\t};\n\t}\n\n\t// ========================================\n\t// TravelPay Plugin Endpoint Handlers\n\t// ========================================\n\n\t/**\n\t * Handles POST /api/v1/validate-turnstile - Validate Cloudflare Turnstile token.\n\t */\n\tasync handleValidateTurnstile(c: any): Promise {\n\t\tconst context = this.createContext(c);\n\t\tlet span: TraceSpan | null = null;\n\n\t\ttry {\n\t\t\tspan = traceBusinessOperation('validate_turnstile', undefined, {\n\t\t\t\tcorrelation_id: context.correlationId,\n\t\t\t\tclient_ip: context.securityContext.clientIP,\n\t\t\t});\n\n\t\t\t// Get request body (validation handled by OpenAPI middleware)\n\t\t\tconst body = await c.req.json();\n\t\t\tconst { token } = body;\n\n\t\t\t// For now, return a simple success response\n\t\t\t// In production, this would validate with Cloudflare Siteverify API\n\t\t\tconst response = {\n\t\t\t\tsuccess: true,\n\t\t\t\tchallenge_ts: new Date().toISOString(),\n\t\t\t\thostname: new URL(c.req.url).hostname,\n\t\t\t\taction: 'payment',\n\t\t\t};\n\n\t\t\taddSpanTags(span, {\n\t\t\t\tsuccess: true,\n\t\t\t\ttoken_present: !!token,\n\t\t\t});\n\n\t\t\treturn c.json(response);\n\t\t} catch (error) {\n\t\t\tconst err = error instanceof Error ? error : new Error(String(error));\n\t\t\tsetSpanError(span, err);\n\n\t\t\tlogError(\n\t\t\t\t`Turnstile validation failed: ${err.message}`,\n\t\t\t\terr,\n\t\t\t\t'turnstile_validation_failed',\n\t\t\t\t{\n\t\t\t\t\tcorrelation_id: context.correlationId,\n\t\t\t\t\tclient_ip: context.securityContext.clientIP,\n\t\t\t\t},\n\t\t\t);\n\n\t\t\treturn c.json(\n\t\t\t\t{\n\t\t\t\t\terror: 'Validation failed',\n\t\t\t\t\tmessage: 'Unable to validate Turnstile token',\n\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t},\n\t\t\t\t500,\n\t\t\t);\n\t\t} finally {\n\t\t\tfinishSpan(span);\n\t\t}\n\t}\n\n\t/**\n\t * Handles GET /api/v1/page-nonce - Generate page-load nonce.\n\t */\n\tasync handleGeneratePageNonce(c: any): Promise {\n\t\tconst context = this.createContext(c);\n\t\tlet span: TraceSpan | null = null;\n\n\t\ttry {\n\t\t\tspan = traceBusinessOperation('generate_page_nonce', undefined, {\n\t\t\t\tcorrelation_id: context.correlationId,\n\t\t\t\tclient_ip: context.securityContext.clientIP,\n\t\t\t});\n\n\t\t\tconst response = await context.services.nonce.generatePageNonce(\n\t\t\t\tcontext.securityContext,\n\t\t\t);\n\n\t\t\taddSpanTags(span, { success: true });\n\n\t\t\tlogInfo(\n\t\t\t\t'Page nonce generated for TravelPay plugin',\n\t\t\t\t'tp_page_nonce_success',\n\t\t\t\t{\n\t\t\t\t\tcorrelationId: context.correlationId,\n\t\t\t\t\tclientIP: context.securityContext.clientIP,\n\t\t\t\t\tnonceMasked: `${response.nonce.substring(0, 8)}...`,\n\t\t\t\t},\n\t\t\t);\n\n\t\t\treturn c.json(response);\n\t\t} catch (error) {\n\t\t\tconst err = error instanceof Error ? error : new Error(String(error));\n\t\t\tsetSpanError(span, err);\n\n\t\t\tlogError(\n\t\t\t\t`TravelPay page nonce generation failed: ${err.message}`,\n\t\t\t\terr,\n\t\t\t\t'tp_page_nonce_failed',\n\t\t\t\t{\n\t\t\t\t\tcorrelationId: context.correlationId,\n\t\t\t\t\tclientIP: context.securityContext.clientIP,\n\t\t\t\t},\n\t\t\t);\n\n\t\t\treturn c.json(\n\t\t\t\t{\n\t\t\t\t\terror: 'Failed to generate page nonce',\n\t\t\t\t\tmessage: err.message,\n\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t},\n\t\t\t\t500,\n\t\t\t);\n\t\t} finally {\n\t\t\tfinishSpan(span);\n\t\t}\n\t}\n\n\t/**\n\t * Handles POST /api/v1/create-payment-nonce - Create payment nonce.\n\t */\n\tasync handleCreatePaymentNonce(c: any): Promise {\n\t\tconst context = this.createContext(c);\n\t\tlet span: TraceSpan | null = null;\n\n\t\ttry {\n\t\t\tspan = traceBusinessOperation('create_payment_nonce', undefined, {\n\t\t\t\tcorrelation_id: context.correlationId,\n\t\t\t\tclient_ip: context.securityContext.clientIP,\n\t\t\t});\n\n\t\t\tconst body = await c.req.json();\n\n\t\t\t// Request validation now handled by OpenAPI middleware\n\t\t\tconst response = await context.services.nonce.createPaymentNonce(\n\t\t\t\tbody, // Body is already validated by OpenAPI middleware\n\t\t\t\tcontext.securityContext,\n\t\t\t);\n\n\t\t\taddSpanTags(span, {\n\t\t\t\tsuccess: true,\n\t\t\t\tbooking_id: body.bookingId,\n\t\t\t\treused: response.reused,\n\t\t\t});\n\n\t\t\tlogInfo(\n\t\t\t\t'Payment nonce created for TravelPay booking',\n\t\t\t\t'tp_payment_nonce_success',\n\t\t\t\t{\n\t\t\t\t\tcorrelationId: context.correlationId,\n\t\t\t\t\tbookingId: body.bookingId,\n\t\t\t\t\tclientIP: context.securityContext.clientIP,\n\t\t\t\t\treused: response.reused,\n\t\t\t\t\tnonceMasked: `${response.nonce.substring(0, 8)}...`,\n\t\t\t\t},\n\t\t\t);\n\n\t\t\treturn c.json(response);\n\t\t} catch (error) {\n\t\t\tconst err = error instanceof Error ? error : new Error(String(error));\n\t\t\tsetSpanError(span, err);\n\n\t\t\tlogError(\n\t\t\t\t`TravelPay payment nonce creation failed: ${err.message}`,\n\t\t\t\terr,\n\t\t\t\t'tp_payment_nonce_failed',\n\t\t\t\t{\n\t\t\t\t\tcorrelationId: context.correlationId,\n\t\t\t\t\tclientIP: context.securityContext.clientIP,\n\t\t\t\t},\n\t\t\t);\n\n\t\t\treturn c.json(\n\t\t\t\t{\n\t\t\t\t\terror: 'Failed to create payment nonce',\n\t\t\t\t\tmessage: err.message,\n\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t},\n\t\t\t\t500,\n\t\t\t);\n\t\t} finally {\n\t\t\tfinishSpan(span);\n\t\t}\n\t}\n\n\t/**\n\t * Handles POST /api/v1/create-fingerprint - Generate payment hash.\n\t */\n\tasync handleGeneratePaymentHash(c: any): Promise {\n\t\tconst context = this.createContext(c);\n\t\tlet span: TraceSpan | null = null;\n\n\t\ttry {\n\t\t\tspan = traceBusinessOperation('generate_payment_hash', undefined, {\n\t\t\t\tcorrelation_id: context.correlationId,\n\t\t\t\tclient_ip: context.securityContext.clientIP,\n\t\t\t});\n\n\t\t\tconst body = await c.req.json();\n\n\t\t\t// Request validation now handled by OpenAPI middleware\n\t\t\t// Get nonce from header (header validation also handled by OpenAPI middleware)\n\t\t\tconst nonce = c.req.header('x-payment-nonce');\n\n\t\t\t// Validate and use the nonce\n\t\t\tconst nonceValidation = await context.services.nonce.validateAndUseNonce(\n\t\t\t\tnonce,\n\t\t\t\tcontext.securityContext,\n\t\t\t);\n\n\t\t\tif (!nonceValidation.valid) {\n\t\t\t\taddSpanTags(span, { nonce_validation_failed: true });\n\n\t\t\t\tlogError(\n\t\t\t\t\t'TravelPay payment hash nonce validation failed',\n\t\t\t\t\tnew Error('Nonce validation failed'),\n\t\t\t\t\t'tp_payment_hash_nonce_invalid',\n\t\t\t\t\t{\n\t\t\t\t\t\tcorrelationId: context.correlationId,\n\t\t\t\t\t\tnonceMasked: `${nonce.substring(0, 8)}...`,\n\t\t\t\t\t\terror: nonceValidation.error,\n\t\t\t\t\t},\n\t\t\t\t);\n\n\t\t\t\treturn c.json(\n\t\t\t\t\t{\n\t\t\t\t\t\terror: 'Nonce validation failed',\n\t\t\t\t\t\tmessage: nonceValidation.error,\n\t\t\t\t\t\tneedsNewToken: nonceValidation.needsNewToken,\n\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t},\n\t\t\t\t\t400,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\t// Generate the payment hash\n\t\t\tconst response = context.services.hash.generatePaymentHash(\n\t\t\t\tbody as PaymentHashRequest,\n\t\t\t\tcontext.securityContext,\n\t\t\t);\n\n\t\t\taddSpanTags(span, {\n\t\t\t\tsuccess: true,\n\t\t\t\tmerchant_payment_id: body.merchantUniquePaymentId,\n\t\t\t\tmode: body.mode,\n\t\t\t});\n\n\t\t\tlogInfo(\n\t\t\t\t'Payment hash generated for TravelPay transaction',\n\t\t\t\t'tp_payment_hash_success',\n\t\t\t\t{\n\t\t\t\t\tcorrelationId: context.correlationId,\n\t\t\t\t\tmerchantPaymentId: body.merchantUniquePaymentId,\n\t\t\t\t\tmode: body.mode,\n\t\t\t\t\tclientIP: context.securityContext.clientIP,\n\t\t\t\t\thashPrefix: response.hash.substring(0, 16),\n\t\t\t\t},\n\t\t\t);\n\n\t\t\treturn c.json(response);\n\t\t} catch (error) {\n\t\t\tconst err = error instanceof Error ? error : new Error(String(error));\n\t\t\tsetSpanError(span, err);\n\n\t\t\tlogError(\n\t\t\t\t`TravelPay payment hash generation failed: ${err.message}`,\n\t\t\t\terr,\n\t\t\t\t'tp_payment_hash_failed',\n\t\t\t\t{\n\t\t\t\t\tcorrelationId: context.correlationId,\n\t\t\t\t\tclientIP: context.securityContext.clientIP,\n\t\t\t\t},\n\t\t\t);\n\n\t\t\treturn c.json(\n\t\t\t\t{\n\t\t\t\t\terror: 'Failed to generate payment hash',\n\t\t\t\t\tmessage: err.message,\n\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t},\n\t\t\t\t500,\n\t\t\t);\n\t\t} finally {\n\t\t\tfinishSpan(span);\n\t\t}\n\t}\n\n\t/**\n\t * Handles GET /api/v1/fingerprint-status/{bookingId} - Check fingerprint status.\n\t */\n\tasync handleGetFingerprintStatus(c: any): Promise {\n\t\tconst context = this.createContext(c);\n\t\tlet span: TraceSpan | null = null;\n\n\t\ttry {\n\t\t\tspan = traceBusinessOperation('get_fingerprint_status', undefined, {\n\t\t\t\tcorrelation_id: context.correlationId,\n\t\t\t\tclient_ip: context.securityContext.clientIP,\n\t\t\t});\n\n\t\t\t// Path parameter validation now handled by OpenAPI middleware\n\t\t\tconst bookingId = c.req.param('bookingId');\n\n\t\t\tconst response = await context.services.database.getFingerprintStatus(\n\t\t\t\tbookingId,\n\t\t\t);\n\n\t\t\taddSpanTags(span, {\n\t\t\t\tsuccess: true,\n\t\t\t\tbooking_id: bookingId,\n\t\t\t\ttotal_attempts: response.totalAttempts,\n\t\t\t\tcan_retry: response.canRetry,\n\t\t\t});\n\n\t\t\tlogInfo(\n\t\t\t\t'Fingerprint status retrieved for TravelPay booking',\n\t\t\t\t'tp_fingerprint_status_success',\n\t\t\t\t{\n\t\t\t\t\tcorrelationId: context.correlationId,\n\t\t\t\t\tbookingId: bookingId,\n\t\t\t\t\ttotalAttempts: response.totalAttempts,\n\t\t\t\t\tcanRetry: response.canRetry,\n\t\t\t\t\tclientIP: context.securityContext.clientIP,\n\t\t\t\t},\n\t\t\t);\n\n\t\t\treturn c.json(response);\n\t\t} catch (error) {\n\t\t\tconst err = error instanceof Error ? error : new Error(String(error));\n\t\t\tsetSpanError(span, err);\n\n\t\t\tlogError(\n\t\t\t\t`TravelPay fingerprint status retrieval failed: ${err.message}`,\n\t\t\t\terr,\n\t\t\t\t'tp_fingerprint_status_failed',\n\t\t\t\t{\n\t\t\t\t\tcorrelationId: context.correlationId,\n\t\t\t\t\tclientIP: context.securityContext.clientIP,\n\t\t\t\t},\n\t\t\t);\n\n\t\t\treturn c.json(\n\t\t\t\t{\n\t\t\t\t\terror: 'Failed to get fingerprint status',\n\t\t\t\t\tmessage: err.message,\n\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t},\n\t\t\t\t500,\n\t\t\t);\n\t\t} finally {\n\t\t\tfinishSpan(span);\n\t\t}\n\t}\n}\n\n// ========================================\n// Factory Function\n// ========================================\n\n/**\n * Creates a new TravelPay plugin handler instance.\n */\nexport function createTpPluginHandler(services: TpPluginServices): TpPluginHandler {\n\treturn new TpPluginHandler(services);\n}\n\n// ========================================\n// Default Export\n// ========================================\n\nexport default {\n\tTpPluginHandler,\n\tcreateTpPluginHandler,\n};\n",[],[197,249,283],[197,249],{"_107":292,"_100":293,"_151":294,"_153":198,"_154":138,"_155":295,"_157":158,"_109":296,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_165":297,"_103":334},"a698c3ba-57ee-11f0-acd0-f69ea79377d9","services","a698c46e-57ee-11f0-acd0-f69ea79377d9",8,["D",1751534295727],[298,307,316,325],{"_107":299,"_100":300,"_151":301,"_153":294,"_154":138,"_155":302,"_157":158,"_109":303,"_104":31,"_160":215,"_162":304,"_163":27,"_164":-5,"_165":305,"_103":306},"a802276e-57ee-11f0-84b9-f69ea79377d9","database-service.ts","a8022818-57ee-11f0-84b9-f69ea79377d9",25,["D",1751534298095],"/**\n * Database service for SafeHash V2 using repository pattern.\n * Provides abstracted access to SQLite operations with enhanced error handling and logging.\n */\n\nimport { sqlite } from 'https://esm.town/v/std/sqlite';\nimport { getConfig } from '../config/app-config.ts';\nimport { sanitizeSQL } from '../utils/validation.ts';\nimport { logDatabaseOperation, logError, logInfo, logWarn } from '../utils/logging.ts';\nimport { addSpanTags, finishSpan, setSpanError, traceDatabaseOperation } from '../utils/tracing.ts';\nimport { DatabaseError, DatabaseService } from '../config/app-types.ts';\n\nimport type {\n\tFingerprintStatusResponse,\n\tNonceRecord,\n\tNonceValidationResult,\n\tSecurityContext,\n\tTraceSpan,\n} from '../config/app-types.ts';\n\n// ========================================\n// Database Service Implementation\n// ========================================\n\nexport class DatabaseServiceImpl implements DatabaseService {\n\tprivate tableName: string;\n\tprivate isInitialized = false;\n\n\tconstructor() {\n\t\tconst config = getConfig('database');\n\t\tthis.tableName = config.tableName;\n\t}\n\n\t/**\n\t * Initializes the database and creates required tables.\n\t */\n\tasync initialize(): Promise {\n\t\tif (this.isInitialized) {\n\t\t\treturn;\n\t\t}\n\n\t\tconst startTime = performance.now();\n\t\tlet span: TraceSpan | null = null;\n\n\t\ttry {\n\t\t\tspan = traceDatabaseOperation('initialize', this.tableName);\n\n\t\t\tconst createTableSQL = `CREATE TABLE IF NOT EXISTS ${this.tableName} (\n nonce TEXT PRIMARY KEY,\n issued_at TEXT NOT NULL,\n used INTEGER NOT NULL DEFAULT 0,\n state TEXT NOT NULL DEFAULT 'unused',\n booking_id TEXT,\n ip_address TEXT,\n user_agent TEXT,\n origin TEXT,\n attempt_count INTEGER DEFAULT 0\n )`;\n\n\t\t\tawait sqlite.execute({ sql: createTableSQL, args: [] });\n\n\t\t\t// Create indexes for performance\n\t\t\tconst indexes = [\n\t\t\t\t`CREATE INDEX IF NOT EXISTS idx_${this.tableName}_booking_id ON ${this.tableName}(booking_id)`,\n\t\t\t\t`CREATE INDEX IF NOT EXISTS idx_${this.tableName}_state ON ${this.tableName}(state)`,\n\t\t\t\t`CREATE INDEX IF NOT EXISTS idx_${this.tableName}_issued_at ON ${this.tableName}(issued_at)`,\n\t\t\t\t`CREATE INDEX IF NOT EXISTS idx_${this.tableName}_ip_address ON ${this.tableName}(ip_address)`,\n\t\t\t];\n\n\t\t\tfor (const indexSQL of indexes) {\n\t\t\t\tawait sqlite.execute({ sql: indexSQL, args: [] });\n\t\t\t}\n\n\t\t\tthis.isInitialized = true;\n\t\t\tconst duration = performance.now() - startTime;\n\n\t\t\taddSpanTags(span, { success: true, indexes_created: indexes.length });\n\t\t\tlogDatabaseOperation('initialize', this.tableName, duration);\n\t\t\tlogInfo(`Database initialized with table: ${this.tableName}`, 'db_init');\n\t\t} catch (error) {\n\t\t\tconst duration = performance.now() - startTime;\n\t\t\tconst err = error instanceof Error ? error : new Error(String(error));\n\t\t\tconst dbError = new DatabaseError(\n\t\t\t\t`Failed to initialize database: ${err.message}`,\n\t\t\t\t{ tableName: this.tableName, error: err },\n\t\t\t);\n\n\t\t\tsetSpanError(span, dbError);\n\t\t\tlogError(\n\t\t\t\t`Database initialization failed for table ${this.tableName}`,\n\t\t\t\terr,\n\t\t\t\t'database_init_failed',\n\t\t\t\t{ tableName: this.tableName, duration },\n\t\t\t);\n\t\t\tlogDatabaseOperation('initialize', this.tableName, duration, undefined, dbError);\n\t\t\tthrow dbError;\n\t\t} finally {\n\t\t\tfinishSpan(span);\n\t\t}\n\t}\n\n\t/**\n\t * Stores a nonce in the database with security context.\n\t */\n\tasync storeNonce(nonce: string, context: SecurityContext, bookingId?: string): Promise {\n\t\tawait this.ensureInitialized();\n\n\t\tconst startTime = performance.now();\n\t\tlet span: TraceSpan | null = null;\n\n\t\ttry {\n\t\t\tspan = traceDatabaseOperation('insert_nonce', this.tableName);\n\t\t\taddSpanTags(span, {\n\t\t\t\tnonce_masked: `${nonce.substring(0, 8)}...`,\n\t\t\t\tbooking_id: bookingId,\n\t\t\t\tclient_ip: context.clientIP,\n\t\t\t});\n\n\t\t\tconst timestamp = this.getTimestamp();\n\t\t\tconst sanitizedBookingId = bookingId ? sanitizeSQL(bookingId) : 'session_' + this.generateSessionId();\n\n\t\t\tconst sanitizedValues = {\n\t\t\t\tnonce: sanitizeSQL(nonce),\n\t\t\t\ttimestamp,\n\t\t\t\tbookingId: sanitizedBookingId,\n\t\t\t\tipAddress: sanitizeSQL(context.clientIP),\n\t\t\t\torigin: sanitizeSQL(context.origin || 'unknown'),\n\t\t\t\tuserAgent: sanitizeSQL(context.userAgent || 'unknown'),\n\t\t\t};\n\n\t\t\tconst insertSQL = `INSERT INTO ${this.tableName}\n (nonce, issued_at, used, state, booking_id, ip_address, origin, user_agent, attempt_count)\n VALUES (?, ?, 0, 'unused', ?, ?, ?, ?, 0)`;\n\n\t\t\tawait sqlite.execute({\n\t\t\t\tsql: insertSQL,\n\t\t\t\targs: [\n\t\t\t\t\tsanitizedValues.nonce,\n\t\t\t\t\tsanitizedValues.timestamp,\n\t\t\t\t\tsanitizedValues.bookingId,\n\t\t\t\t\tsanitizedValues.ipAddress,\n\t\t\t\t\tsanitizedValues.origin,\n\t\t\t\t\tsanitizedValues.userAgent,\n\t\t\t\t],\n\t\t\t});\n\n\t\t\tconst duration = performance.now() - startTime;\n\t\t\taddSpanTags(span, { success: true });\n\t\t\tlogDatabaseOperation('insert_nonce', this.tableName, duration, 1);\n\t\t} catch (error) {\n\t\t\tconst duration = performance.now() - startTime;\n\t\t\tconst err = error instanceof Error ? error : new Error(String(error));\n\t\t\tconst dbError = new DatabaseError(\n\t\t\t\t`Failed to store nonce: ${err.message}`,\n\t\t\t\t{ nonce: `${nonce.substring(0, 8)}...`, bookingId, error },\n\t\t\t);\n\n\t\t\tsetSpanError(span, dbError);\n\t\t\tlogError(\n\t\t\t\t`Failed to store nonce for booking ${bookingId}`,\n\t\t\t\terr,\n\t\t\t\t'database_store_nonce_failed',\n\t\t\t\t{\n\t\t\t\t\ttableName: this.tableName,\n\t\t\t\t\tbookingId,\n\t\t\t\t\tnonceMasked: `${nonce.substring(0, 8)}...`,\n\t\t\t\t\tduration,\n\t\t\t\t},\n\t\t\t);\n\t\t\tlogDatabaseOperation('insert_nonce', this.tableName, duration, 0, dbError);\n\t\t\tthrow dbError;\n\t\t} finally {\n\t\t\tfinishSpan(span);\n\t\t}\n\t}\n\n\t/**\n\t * Gets a nonce record from database (data access only).\n\t */\n\tasync getNonce(nonce: string): Promise {\n\t\tawait this.ensureInitialized();\n\n\t\tconst startTime = performance.now();\n\t\tlet span: TraceSpan | null = null;\n\n\t\ttry {\n\t\t\tspan = traceDatabaseOperation('get_nonce', this.tableName);\n\t\t\taddSpanTags(span, {\n\t\t\t\tnonce_masked: `${nonce.substring(0, 8)}...`,\n\t\t\t});\n\n\t\t\tconst selectSQL = `SELECT nonce, issued_at, used, state, ip_address, booking_id, attempt_count, user_agent, origin\n FROM ${this.tableName} WHERE nonce = ?`;\n\n\t\t\tconst result = await sqlite.execute({\n\t\t\t\tsql: selectSQL,\n\t\t\t\targs: [sanitizeSQL(nonce)],\n\t\t\t});\n\n\t\t\tif (result.rows.length === 0) {\n\t\t\t\taddSpanTags(span, { found: false });\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\tconst nonceRecord: NonceRecord = {\n\t\t\t\tnonce: result.rows[0][0] as string,\n\t\t\t\tissued_at: result.rows[0][1] as string,\n\t\t\t\tused: result.rows[0][2] as number,\n\t\t\t\tstate: result.rows[0][3] as NonceRecord['state'],\n\t\t\t\tip_address: result.rows[0][4] as string,\n\t\t\t\tbooking_id: result.rows[0][5] as string,\n\t\t\t\tattempt_count: result.rows[0][6] as number,\n\t\t\t\tuser_agent: result.rows[0][7] as string | null,\n\t\t\t\torigin: result.rows[0][8] as string | null,\n\t\t\t};\n\n\t\t\tconst duration = performance.now() - startTime;\n\t\t\taddSpanTags(span, { found: true, state: nonceRecord.state });\n\t\t\tlogDatabaseOperation('get_nonce', this.tableName, duration, 1);\n\n\t\t\treturn nonceRecord;\n\t\t} catch (error) {\n\t\t\tconst duration = performance.now() - startTime;\n\t\t\tconst err = error instanceof Error ? error : new Error(String(error));\n\t\t\tconst dbError = new DatabaseError(\n\t\t\t\t`Failed to get nonce: ${err.message}`,\n\t\t\t\t{ error },\n\t\t\t);\n\n\t\t\tsetSpanError(span, dbError);\n\t\t\tlogError(\n\t\t\t\t`Failed to get nonce from table ${this.tableName}`,\n\t\t\t\terr,\n\t\t\t\t'database_get_nonce_failed',\n\t\t\t\t{ tableName: this.tableName, duration },\n\t\t\t);\n\t\t\tlogDatabaseOperation('get_nonce', this.tableName, duration, 0, dbError);\n\t\t\tthrow dbError;\n\t\t} finally {\n\t\t\tfinishSpan(span);\n\t\t}\n\t}\n\n\t/**\n\t * DEPRECATED: Use nonce service validateAndUseNonce instead.\n\t * This method violates separation of concerns by mixing business logic with data access.\n\t */\n\tasync validateAndUseNonce(nonce: string, context: SecurityContext): Promise {\n\t\tawait this.ensureInitialized();\n\n\t\tconst startTime = performance.now();\n\t\tlet span: TraceSpan | null = null;\n\n\t\ttry {\n\t\t\tspan = traceDatabaseOperation('validate_nonce', this.tableName);\n\t\t\taddSpanTags(span, {\n\t\t\t\tnonce_masked: `${nonce.substring(0, 8)}...`,\n\t\t\t\tclient_ip: context.clientIP,\n\t\t\t});\n\n\t\t\t// First, find the nonce record\n\t\t\tconst selectSQL = `SELECT nonce, issued_at, used, state, ip_address, booking_id, attempt_count, user_agent, origin\n FROM ${this.tableName} WHERE nonce = ?`;\n\n\t\t\tconst result = await sqlite.execute({\n\t\t\t\tsql: selectSQL,\n\t\t\t\targs: [sanitizeSQL(nonce)],\n\t\t\t});\n\n\t\t\tif (result.rows.length === 0) {\n\t\t\t\taddSpanTags(span, { validation_result: 'not_found' });\n\t\t\t\treturn { valid: false, error: 'Invalid nonce' };\n\t\t\t}\n\n\t\t\tconst nonceRecord: NonceRecord = {\n\t\t\t\tnonce: result.rows[0][0] as string,\n\t\t\t\tissued_at: result.rows[0][1] as string,\n\t\t\t\tused: result.rows[0][2] as number,\n\t\t\t\tstate: result.rows[0][3] as NonceRecord['state'],\n\t\t\t\tip_address: result.rows[0][4] as string,\n\t\t\t\tbooking_id: result.rows[0][5] as string,\n\t\t\t\tattempt_count: result.rows[0][6] as number,\n\t\t\t\tuser_agent: result.rows[0][7] as string | null,\n\t\t\t\torigin: result.rows[0][8] as string | null,\n\t\t\t};\n\n\t\t\t// Verify IP address matches\n\t\t\tif (nonceRecord.ip_address && nonceRecord.ip_address !== context.clientIP) {\n\t\t\t\taddSpanTags(span, {\n\t\t\t\t\tvalidation_result: 'ip_mismatch',\n\t\t\t\t\tstored_ip: nonceRecord.ip_address,\n\t\t\t\t\trequest_ip: context.clientIP,\n\t\t\t\t});\n\t\t\t\tlogWarn(\n\t\t\t\t\t`IP mismatch for nonce validation`,\n\t\t\t\t\t'security_ip_mismatch',\n\t\t\t\t\t{\n\t\t\t\t\t\tnonce: `${nonce.substring(0, 8)}...`,\n\t\t\t\t\t\tstoredIP: nonceRecord.ip_address,\n\t\t\t\t\t\trequestIP: context.clientIP,\n\t\t\t\t\t},\n\t\t\t\t);\n\t\t\t\treturn { valid: false, error: 'Security validation failed' };\n\t\t\t}\n\n\t\t\t// Check if nonce is already used or attempting\n\t\t\tif (nonceRecord.used === 1 || nonceRecord.state === 'used' || nonceRecord.state === 'attempting') {\n\t\t\t\taddSpanTags(span, { validation_result: 'already_used', state: nonceRecord.state });\n\t\t\t\treturn {\n\t\t\t\t\tvalid: false,\n\t\t\t\t\terror: 'Nonce already used or in use. Please request a new secure token.',\n\t\t\t\t\tneedsNewToken: true,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\t// Check if expired\n\t\t\tif (nonceRecord.state === 'expired') {\n\t\t\t\taddSpanTags(span, { validation_result: 'expired' });\n\t\t\t\treturn {\n\t\t\t\t\tvalid: false,\n\t\t\t\t\terror: 'Nonce has expired. Please request a new secure token.',\n\t\t\t\t\tneedsNewToken: true,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\t// Check timestamp expiration\n\t\t\tconst issuedAt = new Date(nonceRecord.issued_at).getTime();\n\t\t\tconst now = Date.now();\n\t\t\tconst fifteenMinutes = 15 * 60 * 1000;\n\n\t\t\tif (now - issuedAt > fifteenMinutes) {\n\t\t\t\taddSpanTags(span, { validation_result: 'timestamp_expired', age_ms: now - issuedAt });\n\n\t\t\t\t// Mark as expired\n\t\t\t\tawait this.updateNonceState(nonce, 'expired');\n\n\t\t\t\treturn {\n\t\t\t\t\tvalid: false,\n\t\t\t\t\terror: 'Nonce expired. Please try again to get a new secure token.',\n\t\t\t\t\tneedsNewToken: true,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\t// Mark as attempting first (in case payment fails)\n\t\t\tawait this.updateNonceState(nonce, 'attempting', nonceRecord.attempt_count + 1);\n\n\t\t\t// After hash generation, mark as used (since provider burns on any attempt)\n\t\t\tawait this.updateNonceState(nonce, 'used');\n\n\t\t\tconst duration = performance.now() - startTime;\n\t\t\taddSpanTags(span, {\n\t\t\t\tvalidation_result: 'success',\n\t\t\t\tbooking_id: nonceRecord.booking_id,\n\t\t\t});\n\t\t\tlogDatabaseOperation('validate_nonce', this.tableName, duration, 2); // 2 updates\n\n\t\t\treturn {\n\t\t\t\tvalid: true,\n\t\t\t\tbookingId: nonceRecord.booking_id || undefined,\n\t\t\t};\n\t\t} catch (error) {\n\t\t\tconst duration = performance.now() - startTime;\n\t\t\tconst err = error instanceof Error ? error : new Error(String(error));\n\t\t\tconst dbError = error instanceof DatabaseError ? error : new DatabaseError(\n\t\t\t\t`Failed to validate nonce: ${err.message}`,\n\t\t\t\t{ nonce: `${nonce.substring(0, 8)}...`, error },\n\t\t\t);\n\n\t\t\tsetSpanError(span, dbError);\n\t\t\tlogError(\n\t\t\t\t`Nonce validation failed in database`,\n\t\t\t\terr,\n\t\t\t\t'database_validate_nonce_failed',\n\t\t\t\t{\n\t\t\t\t\ttableName: this.tableName,\n\t\t\t\t\tnonceMasked: `${nonce.substring(0, 8)}...`,\n\t\t\t\t\tclientIP: context.clientIP,\n\t\t\t\t\tduration,\n\t\t\t\t},\n\t\t\t);\n\t\t\tlogDatabaseOperation('validate_nonce', this.tableName, duration, 0, dbError);\n\t\t\treturn { valid: false, error: 'Internal server error' };\n\t\t} finally {\n\t\t\tfinishSpan(span);\n\t\t}\n\t}\n\n\t/**\n\t * Updates nonce state and attempt count.\n\t */\n\tasync updateNonceState(\n\t\tnonce: string,\n\t\tstate: NonceRecord['state'],\n\t\tattemptCount?: number,\n\t): Promise {\n\t\tconst sanitizedNonce = sanitizeSQL(nonce);\n\n\t\tif (attemptCount !== undefined) {\n\t\t\tconst updateSQL = `UPDATE ${this.tableName}\n SET state = ?, attempt_count = ?\n WHERE nonce = ?`;\n\t\t\tawait sqlite.execute({\n\t\t\t\tsql: updateSQL,\n\t\t\t\targs: [state, attemptCount, sanitizedNonce],\n\t\t\t});\n\t\t} else {\n\t\t\tconst updateSQL = `UPDATE ${this.tableName}\n SET state = ?, used = ?\n WHERE nonce = ?`;\n\t\t\tawait sqlite.execute({\n\t\t\t\tsql: updateSQL,\n\t\t\t\targs: [state, state === 'used' ? 1 : 0, sanitizedNonce],\n\t\t\t});\n\t\t}\n\t}\n\n\t/**\n\t * Checks for expired nonces and updates their state.\n\t */\n\tasync checkExpiredNonces(): Promise {\n\t\tawait this.ensureInitialized();\n\n\t\tconst startTime = performance.now();\n\t\tlet span: TraceSpan | null = null;\n\n\t\ttry {\n\t\t\tspan = traceDatabaseOperation('check_expired', this.tableName);\n\n\t\t\tconst fifteenMinutesAgo = new Date(Date.now() - 15 * 60 * 1000)\n\t\t\t\t.toISOString()\n\t\t\t\t.slice(0, 19);\n\n\t\t\tconst updateSQL = `UPDATE ${this.tableName}\n SET state = 'expired'\n WHERE state = 'unused' AND issued_at < ?`;\n\n\t\t\tconst result = await sqlite.execute({\n\t\t\t\tsql: updateSQL,\n\t\t\t\targs: [fifteenMinutesAgo],\n\t\t\t});\n\t\t\tconst rowsAffected = result.rowsAffected || 0;\n\n\t\t\tconst duration = performance.now() - startTime;\n\t\t\taddSpanTags(span, { success: true, expired_count: rowsAffected });\n\t\t\tlogDatabaseOperation('check_expired', this.tableName, duration, rowsAffected);\n\n\t\t\tif (rowsAffected > 0) {\n\t\t\t\tlogInfo(`Marked ${rowsAffected} nonces as expired`, 'nonce_expiry');\n\t\t\t}\n\t\t} catch (error) {\n\t\t\tconst duration = performance.now() - startTime;\n\t\t\tconst err = error instanceof Error ? error : new Error(String(error));\n\t\t\tconst dbError = new DatabaseError(\n\t\t\t\t`Failed to check expired nonces: ${err.message}`,\n\t\t\t\t{ error },\n\t\t\t);\n\n\t\t\tsetSpanError(span, dbError);\n\t\t\tlogError(\n\t\t\t\t`Failed to check expired nonces for table ${this.tableName}`,\n\t\t\t\terr,\n\t\t\t\t'database_check_expired_failed',\n\t\t\t\t{ tableName: this.tableName, duration },\n\t\t\t);\n\t\t\tlogDatabaseOperation('check_expired', this.tableName, duration, 0, dbError);\n\t\t\tthrow dbError;\n\t\t} finally {\n\t\t\tfinishSpan(span);\n\t\t}\n\t}\n\n\t/**\n\t * Cleans up expired nonces from the database.\n\t */\n\tasync cleanupExpiredNonces(): Promise {\n\t\tawait this.ensureInitialized();\n\n\t\tconst startTime = performance.now();\n\t\tlet span: TraceSpan | null = null;\n\n\t\ttry {\n\t\t\tspan = traceDatabaseOperation('cleanup_expired', this.tableName);\n\n\t\t\tconst fifteenMinutesAgo = new Date(Date.now() - 15 * 60 * 1000)\n\t\t\t\t.toISOString()\n\t\t\t\t.slice(0, 19);\n\n\t\t\tconst deleteSQL = `DELETE FROM ${this.tableName} WHERE issued_at < ?`;\n\t\t\tconst result = await sqlite.execute({\n\t\t\t\tsql: deleteSQL,\n\t\t\t\targs: [fifteenMinutesAgo],\n\t\t\t});\n\t\t\tconst rowsAffected = result.rowsAffected || 0;\n\n\t\t\tconst duration = performance.now() - startTime;\n\t\t\taddSpanTags(span, { success: true, deleted_count: rowsAffected });\n\t\t\tlogDatabaseOperation('cleanup_expired', this.tableName, duration, rowsAffected);\n\n\t\t\tif (rowsAffected > 0) {\n\t\t\t\tlogInfo(`Cleaned up ${rowsAffected} expired nonces`, 'nonce_cleanup');\n\t\t\t}\n\t\t} catch (error) {\n\t\t\tconst duration = performance.now() - startTime;\n\t\t\tconst err = error instanceof Error ? error : new Error(String(error));\n\t\t\tconst dbError = new DatabaseError(\n\t\t\t\t`Failed to cleanup expired nonces: ${err.message}`,\n\t\t\t\t{ error },\n\t\t\t);\n\n\t\t\tsetSpanError(span, dbError);\n\t\t\tlogError(\n\t\t\t\t`Failed to cleanup expired nonces for table ${this.tableName}`,\n\t\t\t\terr,\n\t\t\t\t'database_cleanup_expired_failed',\n\t\t\t\t{ tableName: this.tableName, duration },\n\t\t\t);\n\t\t\tlogDatabaseOperation('cleanup_expired', this.tableName, duration, 0, dbError);\n\t\t\tthrow dbError;\n\t\t} finally {\n\t\t\tfinishSpan(span);\n\t\t}\n\t}\n\n\t/**\n\t * Gets fingerprint status for a booking ID.\n\t */\n\tasync getFingerprintStatus(bookingId: string): Promise {\n\t\tawait this.ensureInitialized();\n\n\t\tconst startTime = performance.now();\n\t\tlet span: TraceSpan | null = null;\n\n\t\ttry {\n\t\t\tspan = traceDatabaseOperation('fingerprint_status', this.tableName);\n\t\t\taddSpanTags(span, { booking_id: bookingId });\n\n\t\t\tconst sanitizedBookingId = sanitizeSQL(bookingId);\n\t\t\tconst fifteenMinutesAgo = new Date(Date.now() - 15 * 60 * 1000)\n\t\t\t\t.toISOString()\n\t\t\t\t.slice(0, 19);\n\n\t\t\tconst statusSQL = `SELECT\n COUNT(*) as total_attempts,\n SUM(CASE WHEN state = 'unused' THEN 1 ELSE 0 END) as unused_count\n FROM ${this.tableName}\n WHERE booking_id = ? AND issued_at > ?`;\n\n\t\t\tconst result = await sqlite.execute({\n\t\t\t\tsql: statusSQL,\n\t\t\t\targs: [sanitizedBookingId, fifteenMinutesAgo],\n\t\t\t});\n\n\t\t\tconst totalAttempts = Number(result.rows[0][0]) || 0;\n\t\t\tconst unusedCount = Number(result.rows[0][1]) || 0;\n\t\t\tconst hasUnusedFingerprint = unusedCount > 0;\n\t\t\tconst canRetry = totalAttempts < 5;\n\n\t\t\tconst response: FingerprintStatusResponse = {\n\t\t\t\tbookingId,\n\t\t\t\ttotalAttempts,\n\t\t\t\thasUnusedFingerprint,\n\t\t\t\tcanRetry,\n\t\t\t\tremainingAttempts: Math.max(0, 5 - totalAttempts),\n\t\t\t};\n\n\t\t\tconst duration = performance.now() - startTime;\n\t\t\taddSpanTags(span, {\n\t\t\t\tsuccess: true,\n\t\t\t\ttotal_attempts: totalAttempts,\n\t\t\t\tunused_count: unusedCount,\n\t\t\t\tcan_retry: canRetry,\n\t\t\t});\n\t\t\tlogDatabaseOperation('fingerprint_status', this.tableName, duration, 1);\n\n\t\t\treturn response;\n\t\t} catch (error) {\n\t\t\tconst duration = performance.now() - startTime;\n\t\t\tconst err = error instanceof Error ? error : new Error(String(error));\n\t\t\tconst dbError = new DatabaseError(\n\t\t\t\t`Failed to get fingerprint status: ${err.message}`,\n\t\t\t\t{ bookingId, error },\n\t\t\t);\n\n\t\t\tsetSpanError(span, dbError);\n\t\t\tlogError(\n\t\t\t\t`Failed to get fingerprint status for booking ${bookingId}`,\n\t\t\t\terr,\n\t\t\t\t'database_fingerprint_status_failed',\n\t\t\t\t{ tableName: this.tableName, bookingId, duration },\n\t\t\t);\n\t\t\tlogDatabaseOperation('fingerprint_status', this.tableName, duration, 0, dbError);\n\t\t\tthrow dbError;\n\t\t} finally {\n\t\t\tfinishSpan(span);\n\t\t}\n\t}\n\n\t/**\n\t * Finds existing unused nonce for a booking ID.\n\t */\n\tasync findExistingNonce(bookingId: string): Promise {\n\t\tawait this.ensureInitialized();\n\n\t\tconst startTime = performance.now();\n\t\tlet span: TraceSpan | null = null;\n\n\t\ttry {\n\t\t\tspan = traceDatabaseOperation('find_existing_nonce', this.tableName);\n\t\t\taddSpanTags(span, { booking_id: bookingId });\n\n\t\t\tconst sanitizedBookingId = sanitizeSQL(bookingId);\n\t\t\tconst fifteenMinutesAgo = new Date(Date.now() - 15 * 60 * 1000)\n\t\t\t\t.toISOString()\n\t\t\t\t.slice(0, 19);\n\n\t\t\tconst selectSQL = `SELECT nonce FROM ${this.tableName}\n WHERE booking_id = ? AND state = 'unused' AND issued_at > ?\n ORDER BY issued_at DESC LIMIT 1`;\n\n\t\t\tconst result = await sqlite.execute({\n\t\t\t\tsql: selectSQL,\n\t\t\t\targs: [sanitizedBookingId, fifteenMinutesAgo],\n\t\t\t});\n\n\t\t\tconst existingNonce = result.rows.length > 0 ? result.rows[0][0] as string : null;\n\n\t\t\tconst duration = performance.now() - startTime;\n\t\t\taddSpanTags(span, {\n\t\t\t\tsuccess: true,\n\t\t\t\tfound_existing: !!existingNonce,\n\t\t\t});\n\t\t\tlogDatabaseOperation('find_existing_nonce', this.tableName, duration, result.rows.length);\n\n\t\t\treturn existingNonce;\n\t\t} catch (error) {\n\t\t\tconst duration = performance.now() - startTime;\n\t\t\tconst err = error instanceof Error ? error : new Error(String(error));\n\t\t\tconst dbError = new DatabaseError(\n\t\t\t\t`Failed to find existing nonce: ${err.message}`,\n\t\t\t\t{ bookingId, error },\n\t\t\t);\n\n\t\t\tsetSpanError(span, dbError);\n\t\t\tlogError(\n\t\t\t\t`Failed to find existing nonce for booking ${bookingId}`,\n\t\t\t\terr,\n\t\t\t\t'database_find_existing_nonce_failed',\n\t\t\t\t{ tableName: this.tableName, bookingId, duration },\n\t\t\t);\n\t\t\tlogDatabaseOperation('find_existing_nonce', this.tableName, duration, 0, dbError);\n\t\t\treturn null;\n\t\t} finally {\n\t\t\tfinishSpan(span);\n\t\t}\n\t}\n\n\t/**\n\t * Closes the database connection.\n\t */\n\tclose(): void {\n\t\t// SQLite via Val Town doesn't require explicit closing\n\t\tthis.isInitialized = false;\n\t\tlogInfo('Database service closed', 'db_close');\n\t}\n\n\t// ========================================\n\t// Private Utility Methods\n\t// ========================================\n\n\t/**\n\t * Ensures the database is initialized before operations.\n\t */\n\tprivate async ensureInitialized(): Promise {\n\t\tif (!this.isInitialized) {\n\t\t\tawait this.initialize();\n\t\t}\n\t}\n\n\t/**\n\t * Gets current timestamp in database format.\n\t */\n\tprivate getTimestamp(): string {\n\t\treturn new Date().toISOString().slice(0, 19);\n\t}\n\n\t/**\n\t * Generates a session ID for anonymous bookings.\n\t */\n\tprivate generateSessionId(): string {\n\t\tconst bytes = crypto.getRandomValues(new Uint8Array(4));\n\t\treturn Array.from(bytes)\n\t\t\t.map((b) => b.toString(16).padStart(2, '0'))\n\t\t\t.join('');\n\t}\n}\n\n// ========================================\n// Factory Function\n// ========================================\n\n/**\n * Creates a new database service instance.\n */\nexport function createDatabaseService(): DatabaseService {\n\treturn new DatabaseServiceImpl();\n}\n\n// ========================================\n// Default Export\n// ========================================\n\nexport default {\n\tDatabaseServiceImpl,\n\tcreateDatabaseService,\n};\n",[],[197,293,300],{"_107":308,"_100":309,"_151":310,"_153":294,"_154":138,"_155":311,"_157":158,"_109":312,"_104":31,"_160":215,"_162":313,"_163":27,"_164":-5,"_165":314,"_103":315},"a80dc01a-57ee-11f0-84b9-f69ea79377d9","hash-service.ts","a80dc0b0-57ee-11f0-84b9-f69ea79377d9",26,["D",1751534298173],"/**\n * Hash service for SafeHash V2.\n * Handles payment hash generation logic with validation and security.\n */\n\nimport { createCryptoService } from '../utils/crypto.ts';\nimport { logError, logInfo } from '../utils/logging.ts';\nimport { addSpanTags, finishSpan, setSpanError, traceBusinessOperation } from '../utils/tracing.ts';\nimport type {\n\tCryptoService,\n\tHashService,\n\tPaymentHashRequest,\n\tPaymentHashResponse,\n\tSecurityContext,\n\tTraceSpan,\n} from '../config/app-types.ts';\n\n// ========================================\n// Hash Service Implementation\n// ========================================\n\nexport class HashServiceImpl implements HashService {\n\tprivate cryptoService: CryptoService;\n\n\tconstructor() {\n\t\tthis.cryptoService = createCryptoService();\n\t}\n\n\t/**\n\t * Generates payment hash from request parameters.\n\t */\n\tgeneratePaymentHash(\n\t\trequest: PaymentHashRequest,\n\t\tcontext: SecurityContext,\n\t): PaymentHashResponse {\n\t\tlet span: TraceSpan | null = null;\n\n\t\ttry {\n\t\t\tspan = traceBusinessOperation('generate_payment_hash', undefined, {\n\t\t\t\tclient_ip: context.clientIP,\n\t\t\t\tmode: request.mode,\n\t\t\t\tpayment_amount: request.paymentAmount,\n\t\t\t\tmerchant_id: request.merchantUniquePaymentId,\n\t\t\t});\n\n\t\t\t// Request validation now handled by OpenAPI middleware\n\n\t\t\t// Create the payload according to the original server format\n\t\t\tconst payload = [\n\t\t\t\trequest.apikey,\n\t\t\t\trequest.username,\n\t\t\t\trequest.password,\n\t\t\t\trequest.mode,\n\t\t\t\trequest.paymentAmount,\n\t\t\t\trequest.merchantUniquePaymentId,\n\t\t\t\trequest.timestamp,\n\t\t\t].join('|');\n\n\t\t\t// Generate the SHA3-512 hash\n\t\t\tconst hash = this.cryptoService.makeHash(payload);\n\n\t\t\t// Generate server-side signature for response\n\t\t\tconst responseTimestamp = Date.now().toString();\n\t\t\tconst responseData = { hash };\n\t\t\tconst signature = this.cryptoService.generateHMAC(responseData, responseTimestamp);\n\n\t\t\tconst response: PaymentHashResponse = {\n\t\t\t\thash,\n\t\t\t\ttimestamp: responseTimestamp,\n\t\t\t\tsignature,\n\t\t\t};\n\n\t\t\taddSpanTags(span, {\n\t\t\t\tsuccess: true,\n\t\t\t\thash_length: hash.length,\n\t\t\t\tpayload_length: payload.length,\n\t\t\t});\n\n\t\t\tlogInfo(\n\t\t\t\t`Payment hash generated successfully`,\n\t\t\t\t'payment_hash_generated',\n\t\t\t\t{\n\t\t\t\t\tmerchant_payment_id: request.merchantUniquePaymentId,\n\t\t\t\t\tmode: request.mode,\n\t\t\t\t\tamount: request.paymentAmount,\n\t\t\t\t\tclient_ip: context.clientIP,\n\t\t\t\t\thash_prefix: hash.substring(0, 16),\n\t\t\t\t},\n\t\t\t);\n\n\t\t\treturn response;\n\t\t} catch (error) {\n\t\t\tconst err = error instanceof Error ? error : new Error(String(error));\n\t\t\tsetSpanError(span, err);\n\n\t\t\tlogError(\n\t\t\t\t`Failed to generate payment hash: ${err.message}`,\n\t\t\t\terr,\n\t\t\t\t'payment_hash_failed',\n\t\t\t\t{\n\t\t\t\t\tmerchant_payment_id: request.merchantUniquePaymentId,\n\t\t\t\t\tclient_ip: context.clientIP,\n\t\t\t\t},\n\t\t\t);\n\n\t\t\tthrow err;\n\t\t} finally {\n\t\t\tfinishSpan(span);\n\t\t}\n\t}\n\n\t// validatePaymentRequest removed - validation now handled by OpenAPI middleware\n\n\t// ========================================\n\t// Additional Hash Utilities\n\t// ========================================\n\n\t// hasNoDecimals removed - decimal validation handled by OpenAPI integer type\n\n\t// getModeDescription removed - not used in current implementation\n\n\t// isTimestampRecent removed - timestamp validation handled by OpenAPI pattern\n\n\t/**\n\t * Generates test hash for validation purposes.\n\t */\n\tgenerateTestHash(testData: Partial): string {\n\t\tconst defaultTestData = {\n\t\t\tapikey: 'test_api_key',\n\t\t\tusername: 'test_user',\n\t\t\tpassword: 'test_pass',\n\t\t\tmode: 0,\n\t\t\tpaymentAmount: 100000,\n\t\t\tmerchantUniquePaymentId: 'test_payment_123',\n\t\t\ttimestamp: '2024-01-01T12:00:00',\n\t\t};\n\n\t\tconst payload = [\n\t\t\ttestData.apikey || defaultTestData.apikey,\n\t\t\ttestData.username || defaultTestData.username,\n\t\t\ttestData.password || defaultTestData.password,\n\t\t\ttestData.mode ?? defaultTestData.mode,\n\t\t\ttestData.paymentAmount ?? defaultTestData.paymentAmount,\n\t\t\ttestData.merchantUniquePaymentId || defaultTestData.merchantUniquePaymentId,\n\t\t\ttestData.timestamp || defaultTestData.timestamp,\n\t\t].join('|');\n\n\t\treturn this.cryptoService.makeHash(payload);\n\t}\n\n\t/**\n\t * Validates hash format.\n\t */\n\tisValidHashFormat(hash: string): boolean {\n\t\t// SHA3-512 produces 128 hex characters\n\t\treturn /^[a-f0-9]{128}$/i.test(hash);\n\t}\n}\n\n// ========================================\n// Validation Helpers\n// ========================================\n\n// validatePaymentHashRequest removed - validation now handled by OpenAPI middleware\n\n// checkForDecimals removed - decimal validation handled by OpenAPI integer type\n\n/**\n * Converts dollar amount to cents for hash generation.\n */\nexport function dollarsToCents(dollars: number): number {\n\treturn Math.round(dollars * 100);\n}\n\n/**\n * Converts cents to dollar string for display.\n */\nexport function centsToDollars(cents: number): string {\n\treturn (cents / 100).toFixed(2);\n}\n\n// isValidPaymentMode removed - mode validation handled by OpenAPI enum\n\n/**\n * Gets payment mode description.\n */\nexport function getPaymentModeDescription(mode: number): string {\n\tconst descriptions = {\n\t\t0: 'Payment Mode (Static Amount)',\n\t\t1: 'Tokenization Mode',\n\t\t2: 'Payment Mode (Dynamic Amount)',\n\t\t3: 'Preauth Mode',\n\t};\n\treturn descriptions[mode as keyof typeof descriptions] || `Unknown Mode (${mode})`;\n}\n\n// ========================================\n// Testing Utilities\n// ========================================\n\n/**\n * Creates a test payment hash request for testing.\n */\nexport function createTestPaymentRequest(overrides: Partial = {}): PaymentHashRequest {\n\treturn {\n\t\tapikey: 'LFc3-qneWUmL2bIWSSZZGA',\n\t\tusername: 'testuser',\n\t\tpassword: 'testpass',\n\t\tmode: 0,\n\t\tpaymentAmount: 100000, // $1000.00 in cents\n\t\tmerchantUniquePaymentId: 'test_payment_' + Date.now(),\n\t\ttimestamp: new Date().toISOString().slice(0, 19),\n\t\t...overrides,\n\t};\n}\n\n/**\n * Validates hash against expected pattern.\n */\nexport function validateHashOutput(hash: string): { valid: boolean; details: string } {\n\tif (!hash) {\n\t\treturn { valid: false, details: 'Hash is empty or undefined' };\n\t}\n\n\tif (typeof hash !== 'string') {\n\t\treturn { valid: false, details: 'Hash must be a string' };\n\t}\n\n\tif (hash.length !== 128) {\n\t\treturn { valid: false, details: `Hash must be 128 characters, got ${hash.length}` };\n\t}\n\n\tif (!/^[a-f0-9]+$/i.test(hash)) {\n\t\treturn { valid: false, details: 'Hash must contain only hexadecimal characters' };\n\t}\n\n\treturn { valid: true, details: 'Hash format is valid' };\n}\n\n// ========================================\n// Factory Function\n// ========================================\n\n/**\n * Creates a new hash service instance.\n */\nexport function createHashService(): HashService {\n\treturn new HashServiceImpl();\n}\n\n// ========================================\n// Default Export\n// ========================================\n\nexport default {\n\tHashServiceImpl,\n\tcreateHashService,\n\tdollarsToCents,\n\tcentsToDollars,\n\tgetPaymentModeDescription,\n\tcreateTestPaymentRequest,\n\tvalidateHashOutput,\n};\n",[],[197,293,309],{"_107":317,"_100":318,"_151":319,"_153":294,"_154":138,"_155":320,"_157":158,"_109":321,"_104":31,"_160":215,"_162":322,"_163":27,"_164":-5,"_165":323,"_103":324},"a81bc566-57ee-11f0-af1c-f69ea79377d9","nonce-service.ts","a81bc610-57ee-11f0-af1c-f69ea79377d9",27,["D",1751534298264],"/**\n * Nonce service for SafeHash V2.\n * Handles nonce generation, validation, and storage logic with business rules.\n */\n\nimport { getConfig } from '../config/app-config.ts';\nimport { generateNonce } from '../utils/crypto.ts';\nimport { createCryptoService } from '../utils/crypto.ts';\nimport { logInfo, logNonceOperation, logWarn } from '../utils/logging.ts';\nimport { addSpanTags, finishSpan, setSpanError, traceBusinessOperation } from '../utils/tracing.ts';\nimport type {\n\tCryptoService,\n\tDatabaseService,\n\tNonceResponse,\n\tNonceService,\n\tNonceValidationResult,\n\tPaymentNonceRequest,\n\tPaymentNonceResponse,\n\tSecurityContext,\n\tTraceSpan,\n} from '../config/app-types.ts';\n\n// ========================================\n// Nonce Service Implementation\n// ========================================\n\nexport class NonceServiceImpl implements NonceService {\n\tprivate cryptoService: CryptoService;\n\tprivate databaseService: DatabaseService;\n\n\tconstructor(databaseService: DatabaseService) {\n\t\tthis.cryptoService = createCryptoService();\n\t\tthis.databaseService = databaseService;\n\t}\n\n\t/**\n\t * Generates a cryptographically secure nonce.\n\t */\n\tgenerateNonce(): string {\n\t\treturn generateNonce();\n\t}\n\n\t/**\n\t * Validates nonce format (32 hex characters).\n\t */\n\tvalidateNonceFormat(nonce: string): boolean {\n\t\treturn /^[a-f0-9]{32}$/.test(nonce);\n\t}\n\n\t/**\n\t * Generates a page-load nonce for meta-tag security.\n\t */\n\tasync generatePageNonce(context: SecurityContext): Promise {\n\t\tlet span: TraceSpan | null = null;\n\n\t\ttry {\n\t\t\tspan = traceBusinessOperation('generate_page_nonce', undefined, {\n\t\t\t\tclient_ip: context.clientIP,\n\t\t\t\torigin: context.origin,\n\t\t\t});\n\n\t\t\tconst nonce = this.generateNonce();\n\n\t\t\t// Store the page nonce in database\n\t\t\tawait this.databaseService.storeNonce(nonce, context);\n\n\t\t\t// Generate server-side signature for response\n\t\t\tconst responseTimestamp = Date.now().toString();\n\t\t\tconst responseData = { nonce };\n\t\t\tconst signature = this.cryptoService.generateHMAC(responseData, responseTimestamp);\n\n\t\t\tconst response: NonceResponse = {\n\t\t\t\tnonce,\n\t\t\t\ttimestamp: responseTimestamp,\n\t\t\t\tsignature,\n\t\t\t};\n\n\t\t\taddSpanTags(span, {\n\t\t\t\tsuccess: true,\n\t\t\t\tnonce_masked: `${nonce.substring(0, 8)}...`,\n\t\t\t});\n\n\t\t\tlogNonceOperation('generate', nonce, undefined, {\n\t\t\t\ttype: 'page_nonce',\n\t\t\t\tclient_ip: context.clientIP,\n\t\t\t});\n\n\t\t\tlogInfo(\n\t\t\t\t`Page nonce generated successfully`,\n\t\t\t\t'page_nonce_generated',\n\t\t\t\t{\n\t\t\t\t\tnonceMasked: `${nonce.substring(0, 8)}...`,\n\t\t\t\t\tclientIP: context.clientIP,\n\t\t\t\t\torigin: context.origin,\n\t\t\t\t},\n\t\t\t);\n\n\t\t\treturn response;\n\t\t} catch (error) {\n\t\t\tconst err = error instanceof Error ? error : new Error(String(error));\n\t\t\tsetSpanError(span, err);\n\n\t\t\tlogWarn(\n\t\t\t\t`Failed to generate page nonce: ${err.message}`,\n\t\t\t\t'nonce_generation_failed',\n\t\t\t\t{\n\t\t\t\t\tclient_ip: context.clientIP,\n\t\t\t\t\terror: err.message,\n\t\t\t\t},\n\t\t\t);\n\n\t\t\tthrow err;\n\t\t} finally {\n\t\t\tfinishSpan(span);\n\t\t}\n\t}\n\n\t/**\n\t * Creates a payment nonce with booking validation and honeypot detection.\n\t */\n\tasync createPaymentNonce(\n\t\trequest: PaymentNonceRequest,\n\t\tcontext: SecurityContext,\n\t): Promise {\n\t\tlet span: TraceSpan | null = null;\n\n\t\ttry {\n\t\t\tspan = traceBusinessOperation('create_payment_nonce', undefined, {\n\t\t\t\tclient_ip: context.clientIP,\n\t\t\t\tbooking_id: request.bookingId,\n\t\t\t\thas_honeypot: !!request.email_verify,\n\t\t\t});\n\n\t\t\tconst { bookingId, email_verify } = request;\n\n\t\t\t// Check for honeypot trigger\n\t\t\tif (email_verify && email_verify.trim().length > 0) {\n\t\t\t\treturn this.handleHoneypotResponse(bookingId, context, span || undefined);\n\t\t\t}\n\n\t\t\t// Check if we already have an unused nonce for this booking\n\t\t\tconst existingNonce = await this.databaseService.findExistingNonce(bookingId);\n\n\t\t\tif (existingNonce) {\n\t\t\t\treturn this.reuseExistingNonce(existingNonce, bookingId, context, span || undefined);\n\t\t\t}\n\n\t\t\t// Generate new nonce\n\t\t\tconst nonce = this.generateNonce();\n\t\t\tawait this.databaseService.storeNonce(nonce, context, bookingId);\n\n\t\t\t// Generate server-side signature for response\n\t\t\tconst responseTimestamp = Date.now().toString();\n\t\t\tconst responseData = {\n\t\t\t\tnonce,\n\t\t\t\texpiresIn: this.getNonceExpirationSeconds(),\n\t\t\t\tbookingId,\n\t\t\t};\n\t\t\tconst signature = this.cryptoService.generateHMAC(responseData, responseTimestamp);\n\n\t\t\tconst response: PaymentNonceResponse = {\n\t\t\t\tnonce,\n\t\t\t\texpiresIn: this.getNonceExpirationSeconds(),\n\t\t\t\tbookingId,\n\t\t\t\treused: false,\n\t\t\t\ttimestamp: responseTimestamp,\n\t\t\t\tsignature,\n\t\t\t};\n\n\t\t\taddSpanTags(span, {\n\t\t\t\tsuccess: true,\n\t\t\t\tnonce_masked: `${nonce.substring(0, 8)}...`,\n\t\t\t\tis_reused: false,\n\t\t\t});\n\n\t\t\tlogNonceOperation('generate', nonce, bookingId, {\n\t\t\t\ttype: 'payment_nonce',\n\t\t\t\tclient_ip: context.clientIP,\n\t\t\t\treused: false,\n\t\t\t});\n\n\t\t\tlogInfo(\n\t\t\t\t`Payment nonce generated successfully`,\n\t\t\t\t'payment_nonce_generated',\n\t\t\t\t{\n\t\t\t\t\tbookingId,\n\t\t\t\t\tnonceMasked: `${nonce.substring(0, 8)}...`,\n\t\t\t\t\tclientIP: context.clientIP,\n\t\t\t\t\treused: false,\n\t\t\t\t},\n\t\t\t);\n\n\t\t\treturn response;\n\t\t} catch (error) {\n\t\t\tconst err = error instanceof Error ? error : new Error(String(error));\n\t\t\tsetSpanError(span, err);\n\n\t\t\tlogWarn(\n\t\t\t\t`Failed to create payment nonce: ${err.message}`,\n\t\t\t\t'nonce_creation_failed',\n\t\t\t\t{\n\t\t\t\t\tbooking_id: request.bookingId,\n\t\t\t\t\tclient_ip: context.clientIP,\n\t\t\t\t\terror: err.message,\n\t\t\t\t},\n\t\t\t);\n\n\t\t\tthrow err;\n\t\t} finally {\n\t\t\tfinishSpan(span);\n\t\t}\n\t}\n\n\t// ========================================\n\t// Private Helper Methods\n\t// ========================================\n\n\t/**\n\t * Handles honeypot-triggered requests by returning fake response.\n\t */\n\tprivate handleHoneypotResponse(\n\t\tbookingId: string,\n\t\tcontext: SecurityContext,\n\t\tparentSpan?: TraceSpan,\n\t): PaymentNonceResponse {\n\t\tlet span: TraceSpan | null = null;\n\n\t\ttry {\n\t\t\tspan = traceBusinessOperation('honeypot_response', parentSpan, {\n\t\t\t\tclient_ip: context.clientIP,\n\t\t\t\tbooking_id: bookingId,\n\t\t\t\thoneypot_triggered: true,\n\t\t\t});\n\n\t\t\tlogWarn(\n\t\t\t\t`Honeypot triggered`,\n\t\t\t\t'honeypot_triggered',\n\t\t\t\t{\n\t\t\t\t\tclient_ip: context.clientIP,\n\t\t\t\t\tbooking_id: bookingId,\n\t\t\t\t\tuser_agent: context.userAgent,\n\t\t\t\t},\n\t\t\t);\n\n\t\t\t// Generate fake but realistic-looking response\n\t\t\tconst fakeTimestamp = Date.now().toString();\n\t\t\tconst fakeRandom = crypto.getRandomValues(new Uint8Array(8));\n\t\t\tconst fakePayload = fakeTimestamp +\n\t\t\t\tArray.from(fakeRandom).map((b) => b.toString(16).padStart(2, '0')).join('');\n\n\t\t\t// Use SHA3-512 to generate fake hash, then take first 32 chars for nonce format\n\t\t\tconst fakeHashFull = this.cryptoService.makeHash(fakePayload);\n\t\t\tconst fakeNonce = fakeHashFull.substring(0, 32);\n\n\t\t\tconst responseData = {\n\t\t\t\tnonce: fakeNonce,\n\t\t\t\texpiresIn: this.getNonceExpirationSeconds(),\n\t\t\t\tbookingId: bookingId || 'session_' + fakeHashFull.substring(0, 8),\n\t\t\t\treused: false,\n\t\t\t};\n\n\t\t\t// Generate fake signature\n\t\t\tconst signature = this.cryptoService.generateHMAC(responseData, fakeTimestamp);\n\n\t\t\tconst response: PaymentNonceResponse = {\n\t\t\t\t...responseData,\n\t\t\t\ttimestamp: fakeTimestamp,\n\t\t\t\tsignature,\n\t\t\t};\n\n\t\t\taddSpanTags(span, {\n\t\t\t\tsuccess: true,\n\t\t\t\thoneypot_response: true,\n\t\t\t\tfake_nonce_masked: `${fakeNonce.substring(0, 8)}...`,\n\t\t\t});\n\n\t\t\treturn response;\n\t\t} catch (error) {\n\t\t\tconst err = error instanceof Error ? error : new Error(String(error));\n\t\t\tsetSpanError(span, err);\n\t\t\tthrow err;\n\t\t} finally {\n\t\t\tfinishSpan(span);\n\t\t}\n\t}\n\n\t/**\n\t * Reuses an existing unused nonce for the same booking.\n\t */\n\tprivate reuseExistingNonce(\n\t\texistingNonce: string,\n\t\tbookingId: string,\n\t\tcontext: SecurityContext,\n\t\tparentSpan?: TraceSpan,\n\t): PaymentNonceResponse {\n\t\tlet span: TraceSpan | null = null;\n\n\t\ttry {\n\t\t\tspan = traceBusinessOperation('reuse_existing_nonce', parentSpan, {\n\t\t\t\tclient_ip: context.clientIP,\n\t\t\t\tbooking_id: bookingId,\n\t\t\t\texisting_nonce_masked: `${existingNonce.substring(0, 8)}...`,\n\t\t\t});\n\n\t\t\tlogNonceOperation('reuse', existingNonce, bookingId, {\n\t\t\t\ttype: 'payment_nonce',\n\t\t\t\tclient_ip: context.clientIP,\n\t\t\t\treused: true,\n\t\t\t});\n\n\t\t\tlogInfo(\n\t\t\t\t`Existing nonce reused for booking`,\n\t\t\t\t'payment_nonce_reused',\n\t\t\t\t{\n\t\t\t\t\tbookingId,\n\t\t\t\t\tnonceMasked: `${existingNonce.substring(0, 8)}...`,\n\t\t\t\t\tclientIP: context.clientIP,\n\t\t\t\t\treused: true,\n\t\t\t\t},\n\t\t\t);\n\n\t\t\t// Generate server-side signature for response\n\t\t\tconst responseTimestamp = Date.now().toString();\n\t\t\tconst responseData = {\n\t\t\t\tnonce: existingNonce,\n\t\t\t\texpiresIn: this.getNonceExpirationSeconds(),\n\t\t\t\treused: true,\n\t\t\t\tbookingId,\n\t\t\t};\n\t\t\tconst signature = this.cryptoService.generateHMAC(responseData, responseTimestamp);\n\n\t\t\tconst response: PaymentNonceResponse = {\n\t\t\t\tnonce: existingNonce,\n\t\t\t\texpiresIn: this.getNonceExpirationSeconds(),\n\t\t\t\tbookingId,\n\t\t\t\treused: true,\n\t\t\t\ttimestamp: responseTimestamp,\n\t\t\t\tsignature,\n\t\t\t};\n\n\t\t\taddSpanTags(span, {\n\t\t\t\tsuccess: true,\n\t\t\t\tis_reused: true,\n\t\t\t\tnonce_masked: `${existingNonce.substring(0, 8)}...`,\n\t\t\t});\n\n\t\t\treturn response;\n\t\t} catch (error) {\n\t\t\tconst err = error instanceof Error ? error : new Error(String(error));\n\t\t\tsetSpanError(span, err);\n\t\t\tthrow err;\n\t\t} finally {\n\t\t\tfinishSpan(span);\n\t\t}\n\t}\n\n\t/**\n\t * Validates nonce expiration time.\n\t */\n\tprivate isNonceExpired(issuedAt: string): boolean {\n\t\tconst config = getConfig('security');\n\t\tconst issuedTime = new Date(issuedAt).getTime();\n\t\tconst now = Date.now();\n\n\t\treturn (now - issuedTime) > config.nonceExpirationMs;\n\t}\n\n\t/**\n\t * Gets nonce expiration time in seconds.\n\t */\n\tprivate getNonceExpirationSeconds(): number {\n\t\tconst config = getConfig('security');\n\t\treturn Math.floor(config.nonceExpirationMs / 1000);\n\t}\n\n\t/**\n\t * Validates and uses a nonce (moved from database service for proper separation of concerns).\n\t */\n\tasync validateAndUseNonce(nonce: string, context: SecurityContext): Promise {\n\t\tlet span: TraceSpan | null = null;\n\n\t\ttry {\n\t\t\tspan = traceBusinessOperation('validate_and_use_nonce', undefined, {\n\t\t\t\tnonce_masked: `${nonce.substring(0, 8)}...`,\n\t\t\t\tclient_ip: context.clientIP,\n\t\t\t});\n\n\t\t\t// 1. Validate nonce format first (business rule)\n\t\t\tif (!this.validateNonceFormat(nonce)) {\n\t\t\t\taddSpanTags(span, { validation_result: 'invalid_format' });\n\t\t\t\treturn { valid: false, error: 'Invalid nonce format' };\n\t\t\t}\n\n\t\t\t// 2. Get nonce record from database (data access)\n\t\t\tconst nonceRecord = await this.databaseService.getNonce(nonce);\n\n\t\t\tif (!nonceRecord) {\n\t\t\t\taddSpanTags(span, { validation_result: 'not_found' });\n\t\t\t\treturn { valid: false, error: 'Invalid nonce' };\n\t\t\t}\n\n\t\t\t// 3. Verify IP address matches (business rule)\n\t\t\tif (nonceRecord.ip_address && nonceRecord.ip_address !== context.clientIP) {\n\t\t\t\taddSpanTags(span, {\n\t\t\t\t\tvalidation_result: 'ip_mismatch',\n\t\t\t\t\tstored_ip: nonceRecord.ip_address,\n\t\t\t\t\trequest_ip: context.clientIP,\n\t\t\t\t});\n\t\t\t\tlogWarn(\n\t\t\t\t\t`IP mismatch for nonce validation`,\n\t\t\t\t\t'security_ip_mismatch',\n\t\t\t\t\t{\n\t\t\t\t\t\tnonce: `${nonce.substring(0, 8)}...`,\n\t\t\t\t\t\tstoredIP: nonceRecord.ip_address,\n\t\t\t\t\t\trequestIP: context.clientIP,\n\t\t\t\t\t},\n\t\t\t\t);\n\t\t\t\treturn { valid: false, error: 'Security validation failed' };\n\t\t\t}\n\n\t\t\t// 4. Check if nonce is already used (business rule)\n\t\t\tif (nonceRecord.used === 1 || nonceRecord.state === 'used' || nonceRecord.state === 'attempting') {\n\t\t\t\taddSpanTags(span, { validation_result: 'already_used', state: nonceRecord.state });\n\t\t\t\treturn {\n\t\t\t\t\tvalid: false,\n\t\t\t\t\terror: 'Nonce already used or in use. Please request a new secure token.',\n\t\t\t\t\tneedsNewToken: true,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\t// 5. Check if expired (business rule)\n\t\t\tif (nonceRecord.state === 'expired') {\n\t\t\t\taddSpanTags(span, { validation_result: 'expired' });\n\t\t\t\treturn {\n\t\t\t\t\tvalid: false,\n\t\t\t\t\terror: 'Nonce has expired. Please request a new secure token.',\n\t\t\t\t\tneedsNewToken: true,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\t// 6. Check timestamp expiration using our business logic\n\t\t\tif (this.isNonceExpired(nonceRecord.issued_at)) {\n\t\t\t\taddSpanTags(span, { validation_result: 'timestamp_expired' });\n\n\t\t\t\t// Mark as expired in database\n\t\t\t\tawait this.databaseService.updateNonceState(nonce, 'expired');\n\n\t\t\t\treturn {\n\t\t\t\t\tvalid: false,\n\t\t\t\t\terror: 'Nonce expired. Please try again to get a new secure token.',\n\t\t\t\t\tneedsNewToken: true,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\t// 7. Mark as attempting first (in case payment fails)\n\t\t\tawait this.databaseService.updateNonceState(nonce, 'attempting', nonceRecord.attempt_count + 1);\n\n\t\t\t// 8. After hash generation, mark as used (since provider burns on any attempt)\n\t\t\tawait this.databaseService.updateNonceState(nonce, 'used');\n\n\t\t\taddSpanTags(span, {\n\t\t\t\tvalidation_result: 'success',\n\t\t\t\tbooking_id: nonceRecord.booking_id,\n\t\t\t});\n\n\t\t\treturn {\n\t\t\t\tvalid: true,\n\t\t\t\tbookingId: nonceRecord.booking_id || undefined,\n\t\t\t};\n\t\t} catch (error) {\n\t\t\tconst err = error instanceof Error ? error : new Error(String(error));\n\t\t\tsetSpanError(span, err);\n\n\t\t\tlogWarn(\n\t\t\t\t`Failed to validate and use nonce: ${err.message}`,\n\t\t\t\t'nonce_validation_failed',\n\t\t\t\t{\n\t\t\t\t\tnonce_masked: `${nonce.substring(0, 8)}...`,\n\t\t\t\t\tclient_ip: context.clientIP,\n\t\t\t\t\terror: err.message,\n\t\t\t\t},\n\t\t\t);\n\n\t\t\tthrow err;\n\t\t} finally {\n\t\t\tfinishSpan(span);\n\t\t}\n\t}\n}\n\n// ========================================\n// Validation and Business Rules\n// ========================================\n\n// validatePaymentNonceRequest removed - validation now handled by OpenAPI middleware\n\n// checkBookingRateLimit removed - rate limiting is now IP-based only (not booking-based)\n\n/**\n * Estimates remaining time for nonce expiration.\n */\nexport function estimateNonceExpiration(issuedAt: string): {\n\tisExpired: boolean;\n\tremainingSeconds: number;\n} {\n\tconst config = getConfig('security');\n\tconst issuedTime = new Date(issuedAt).getTime();\n\tconst now = Date.now();\n\tconst age = now - issuedTime;\n\tconst remainingMs = config.nonceExpirationMs - age;\n\n\treturn {\n\t\tisExpired: remainingMs <= 0,\n\t\tremainingSeconds: Math.max(0, Math.floor(remainingMs / 1000)),\n\t};\n}\n\n// ========================================\n// Factory Function\n// ========================================\n\n/**\n * Creates a new nonce service instance.\n */\nexport function createNonceService(databaseService: DatabaseService): NonceService {\n\treturn new NonceServiceImpl(databaseService);\n}\n\n// ========================================\n// Default Export\n// ========================================\n\nexport default {\n\tNonceServiceImpl,\n\tcreateNonceService,\n\testimateNonceExpiration,\n};\n",[],[197,293,318],{"_107":326,"_100":327,"_151":328,"_153":294,"_154":138,"_155":329,"_157":158,"_109":330,"_104":31,"_160":215,"_162":331,"_163":27,"_164":-5,"_165":332,"_103":333},"a81ff3ca-57ee-11f0-a5ed-f69ea79377d9","security-service.ts","a81ff488-57ee-11f0-a5ed-f69ea79377d9",28,["D",1751534298281],"/**\n * Security service for SafeHash V2.\n * Handles security validation, rate limiting, honeypot detection, and threat prevention.\n */\n\nimport { getConfig } from '../config/app-config.ts';\nimport {\n\textractAndValidateIP,\n\tisHoneypotTriggered,\n\tisValidHost,\n\tisValidOrigin,\n\tisValidReferer,\n} from '../utils/validation.ts';\nimport { logInfo, logSecurityEvent, logWarn } from '../utils/logging.ts';\nimport { generateCorrelationId } from '../utils/logging.ts';\nimport type { RateLimitRecord, SecurityContext, SecurityEvent, SecurityService } from '../config/app-types.ts';\n\n// ========================================\n// Security Service Implementation\n// ========================================\n\nexport class SecurityServiceImpl implements SecurityService {\n\tprivate rateLimits = new Map();\n\tprivate suspiciousIPs = new Set();\n\tprivate blockedIPs = new Set();\n\n\t/**\n\t * Validates origin header against allowed origins.\n\t */\n\tvalidateOrigin(origin: string | null): boolean {\n\t\tconst config = getConfig('security');\n\t\treturn isValidOrigin(origin, config.allowedOrigins);\n\t}\n\n\t/**\n\t * Validates referer header against origin.\n\t */\n\tvalidateReferer(referer: string | null, origin: string | null): boolean {\n\t\treturn isValidReferer(referer, origin);\n\t}\n\n\t/**\n\t * Validates host header against expected host.\n\t */\n\tvalidateHost(host: string | null): boolean {\n\t\tconst config = getConfig('server');\n\t\tconst expectedHost = new URL(`http://${config.host}:${config.port}`).host;\n\t\treturn isValidHost(host, expectedHost);\n\t}\n\n\t/**\n\t * Validates timestamp for replay attack prevention.\n\t */\n\tvalidateTimestamp(timestamp: string | undefined): boolean {\n\t\tif (!timestamp) {\n\t\t\treturn false; // Timestamp is required for security\n\t\t}\n\n\t\tconst config = getConfig('security');\n\n\t\ttry {\n\t\t\tconst requestTime = new Date(timestamp).getTime();\n\t\t\tconst now = Date.now();\n\n\t\t\tif (isNaN(requestTime)) {\n\t\t\t\treturn false;\n\t\t\t}\n\n\t\t\treturn (now - requestTime) <= config.timestampToleranceMs && (now - requestTime) >= 0;\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t}\n\n\t/**\n\t * Detects honeypot field manipulation.\n\t */\n\tdetectHoneypot(emailVerify: string | undefined): boolean {\n\t\treturn isHoneypotTriggered(emailVerify);\n\t}\n\n\t/**\n\t * Checks rate limit for IP/endpoint combination.\n\t */\n\tcheckRateLimit(\n\t\tkey: string,\n\t\tendpoint: string,\n\t\tcustomLimit?: number,\n\t): boolean {\n\t\tconst config = getConfig('rateLimit');\n\t\tconst endpointConfig = config.endpoints[endpoint];\n\n\t\tconst limit = customLimit || endpointConfig?.limit || config.defaultLimit;\n\t\tconst windowMs = endpointConfig?.windowMs || config.windowMs;\n\n\t\tconst now = Date.now();\n\t\tconst record = this.rateLimits.get(key);\n\n\t\tif (!record || now > record.resetAt) {\n\t\t\tthis.rateLimits.set(key, {\n\t\t\t\tattempts: 1,\n\t\t\t\tresetAt: now + windowMs,\n\t\t\t});\n\t\t\treturn true;\n\t\t}\n\n\t\tif (record.attempts >= limit) {\n\t\t\t// Log rate limit exceeded\n\t\t\tthis.logSecurityEvent('rate_limit_exceeded', 'medium', key, {\n\t\t\t\tendpoint,\n\t\t\t\tattempts: record.attempts,\n\t\t\t\tlimit,\n\t\t\t\twindowMs,\n\t\t\t});\n\n\t\t\treturn false;\n\t\t}\n\n\t\trecord.attempts++;\n\t\treturn true;\n\t}\n\n\t/**\n\t * Extracts client IP from request headers.\n\t */\n\textractClientIP(headers: Headers): string {\n\t\treturn extractAndValidateIP(headers);\n\t}\n\n\t/**\n\t * Creates security context from request.\n\t */\n\tcreateSecurityContext(request: Request): SecurityContext {\n\t\tconst url = new URL(request.url);\n\n\t\treturn {\n\t\t\tclientIP: this.extractClientIP(request.headers),\n\t\t\torigin: request.headers.get('origin') || url.origin,\n\t\t\treferer: request.headers.get('referer'),\n\t\t\thost: request.headers.get('host') || url.hostname,\n\t\t\tuserAgent: request.headers.get('user-agent'),\n\t\t\ttimestamp: new Date().toISOString(),\n\t\t\tcorrelationId: generateCorrelationId(),\n\t\t\tauthenticated: request.headers.get('x-authenticated') === 'true',\n\t\t};\n\t}\n\n\t// ========================================\n\t// Advanced Security Features\n\t// ========================================\n\n\t/**\n\t * Performs comprehensive security check for a request.\n\t */\n\tperformSecurityCheck(request: Request): SecurityContext {\n\t\tconst context = this.createSecurityContext(request);\n\t\tconst errors: string[] = [];\n\n\t\t// Check if IP is blocked\n\t\tif (this.isIPBlocked(context.clientIP)) {\n\t\t\terrors.push('IP address is blocked');\n\t\t\tthis.logSecurityEvent('blocked_ip_access', 'high', context.clientIP, {\n\t\t\t\torigin: context.origin,\n\t\t\t\tuser_agent: context.userAgent,\n\t\t\t});\n\t\t}\n\n\t\t// Perform security checks\n\t\tif (!this.validateOrigin(context.origin)) {\n\t\t\terrors.push('Invalid origin');\n\t\t\tthis.logSecurityEvent('invalid_origin', 'medium', context.clientIP, {\n\t\t\t\torigin: context.origin,\n\t\t\t\treferer: context.referer,\n\t\t\t});\n\t\t}\n\n\t\tif (!this.validateReferer(context.referer, context.origin)) {\n\t\t\terrors.push('Invalid referer');\n\t\t\tthis.logSecurityEvent('invalid_referer', 'medium', context.clientIP, {\n\t\t\t\torigin: context.origin,\n\t\t\t\treferer: context.referer,\n\t\t\t});\n\t\t}\n\n\t\tif (!this.validateHost(context.host)) {\n\t\t\terrors.push('Invalid host');\n\t\t\tthis.logSecurityEvent('invalid_host', 'medium', context.clientIP, {\n\t\t\t\thost: context.host,\n\t\t\t\texpected: getConfig('server').host,\n\t\t\t});\n\t\t}\n\n\t\t// Check for suspicious patterns\n\t\tif (this.isSuspiciousRequest(request, context)) {\n\t\t\terrors.push('Suspicious request pattern detected');\n\t\t\tthis.markIPAsSuspicious(context.clientIP);\n\t\t}\n\n\t\t// Add security check results to context\n\t\tcontext.passed = errors.length === 0;\n\t\tcontext.errors = errors;\n\n\t\treturn context;\n\t}\n\n\t/**\n\t * Performs comprehensive security check with detailed results.\n\t * Returns full security check results including pass/fail status and errors.\n\t */\n\tperformDetailedSecurityCheck(\n\t\trequest: Request,\n\t\trequiredChecks: string[] = ['origin', 'referer', 'host'],\n\t): { passed: boolean; errors: string[]; context: SecurityContext } {\n\t\tconst context = this.createSecurityContext(request);\n\t\tconst errors: string[] = [];\n\n\t\t// Check if IP is blocked\n\t\tif (this.isIPBlocked(context.clientIP)) {\n\t\t\terrors.push('IP address is blocked');\n\t\t\tthis.logSecurityEvent('blocked_ip_access', 'high', context.clientIP, {\n\t\t\t\torigin: context.origin,\n\t\t\t\tuser_agent: context.userAgent,\n\t\t\t});\n\t\t}\n\n\t\t// Perform only the required security checks\n\t\tif (requiredChecks.includes('origin') && !this.validateOrigin(context.origin)) {\n\t\t\terrors.push('Invalid origin');\n\t\t\tthis.logSecurityEvent('invalid_origin', 'medium', context.clientIP, {\n\t\t\t\torigin: context.origin,\n\t\t\t\treferer: context.referer,\n\t\t\t});\n\t\t}\n\n\t\tif (requiredChecks.includes('referer') && !this.validateReferer(context.referer, context.origin)) {\n\t\t\terrors.push('Invalid referer');\n\t\t\tthis.logSecurityEvent('invalid_referer', 'medium', context.clientIP, {\n\t\t\t\torigin: context.origin,\n\t\t\t\treferer: context.referer,\n\t\t\t});\n\t\t}\n\n\t\tif (requiredChecks.includes('host') && !this.validateHost(context.host)) {\n\t\t\terrors.push('Invalid host');\n\t\t\tthis.logSecurityEvent('invalid_host', 'medium', context.clientIP, {\n\t\t\t\thost: context.host,\n\t\t\t\texpected: getConfig('server').host,\n\t\t\t});\n\t\t}\n\n\t\t// Check for suspicious patterns if requested\n\t\tif (requiredChecks.includes('suspicious') && this.isSuspiciousRequest(request, context)) {\n\t\t\terrors.push('Suspicious request pattern detected');\n\t\t\tthis.markIPAsSuspicious(context.clientIP);\n\t\t}\n\n\t\treturn {\n\t\t\tpassed: errors.length === 0,\n\t\t\terrors,\n\t\t\tcontext,\n\t\t};\n\t}\n\n\t/**\n\t * Checks if request contains suspicious patterns.\n\t */\n\tprivate isSuspiciousRequest(request: Request, context: SecurityContext): boolean {\n\t\tconst suspiciousPatterns = [\n\t\t\t// Check for common attack patterns in headers\n\t\t\t/script/i,\n\t\t\t/javascript/i,\n\t\t\t/vbscript/i,\n\t\t\t/onload/i,\n\t\t\t/onerror/i,\n\t\t\t/<.*>/,\n\t\t\t/\\.\\.\\//,\n\t\t\t/etc\\/passwd/,\n\t\t\t/cmd\\.exe/,\n\t\t\t/powershell/i,\n\t\t];\n\n\t\t// Check headers from context\n\t\tconst headersToCheck = [\n\t\t\tcontext.userAgent,\n\t\t\tcontext.referer,\n\t\t\tcontext.origin,\n\t\t].filter(Boolean);\n\n\t\tfor (const header of headersToCheck) {\n\t\t\tfor (const pattern of suspiciousPatterns) {\n\t\t\t\tif (pattern.test(header!)) {\n\t\t\t\t\tthis.logSecurityEvent('suspicious_pattern', 'medium', context.clientIP, {\n\t\t\t\t\t\tpattern: pattern.toString(),\n\t\t\t\t\t\theader_value: header,\n\t\t\t\t\t\tuser_agent: context.userAgent,\n\t\t\t\t\t});\n\t\t\t\t\treturn true;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\t// Check request URL for suspicious patterns\n\t\tconst url = new URL(request.url);\n\t\tconst pathAndQuery = url.pathname + url.search;\n\n\t\tfor (const pattern of suspiciousPatterns) {\n\t\t\tif (pattern.test(pathAndQuery)) {\n\t\t\t\tthis.logSecurityEvent('suspicious_activity', 'medium', context.clientIP, {\n\t\t\t\t\tpattern: pattern.toString(),\n\t\t\t\t\turl_path: pathAndQuery,\n\t\t\t\t\tuser_agent: context.userAgent,\n\t\t\t\t});\n\t\t\t\treturn true;\n\t\t\t}\n\t\t}\n\n\t\t// Check request method - suspicious if not GET/POST for API endpoints\n\t\tif (\n\t\t\t['TRACE', 'OPTIONS', 'DELETE', 'PUT', 'PATCH'].includes(request.method) &&\n\t\t\turl.pathname.startsWith('/api/')\n\t\t) {\n\t\t\tthis.logSecurityEvent('suspicious_activity', 'low', context.clientIP, {\n\t\t\t\tmethod: request.method,\n\t\t\t\tpath: url.pathname,\n\t\t\t\tuser_agent: context.userAgent,\n\t\t\t});\n\t\t\treturn true;\n\t\t}\n\n\t\t// Check for suspicious request frequency\n\t\tif (this.isSuspiciousIP(context.clientIP)) {\n\t\t\treturn true;\n\t\t}\n\n\t\treturn false;\n\t}\n\n\t/**\n\t * Marks an IP as suspicious.\n\t */\n\tprivate markIPAsSuspicious(ip: string): void {\n\t\tthis.suspiciousIPs.add(ip);\n\n\t\tlogWarn(\n\t\t\t`IP marked as suspicious: ${ip}`,\n\t\t\t'ip_marked_suspicious',\n\t\t\t{ ip, suspicious_count: this.suspiciousIPs.size },\n\t\t);\n\n\t\t// Auto-block after multiple suspicious activities\n\t\tconst suspiciousCount = this.getSuspiciousActivityCount(ip);\n\t\tif (suspiciousCount >= 5) {\n\t\t\tthis.blockIP(ip, 'Automatic block after suspicious activity');\n\t\t}\n\t}\n\n\t/**\n\t * Checks if an IP is marked as suspicious.\n\t */\n\tprivate isSuspiciousIP(ip: string): boolean {\n\t\treturn this.suspiciousIPs.has(ip);\n\t}\n\n\t/**\n\t * Blocks an IP address.\n\t */\n\tprivate blockIP(ip: string, reason: string): void {\n\t\tthis.blockedIPs.add(ip);\n\n\t\tthis.logSecurityEvent('ip_blocked', 'high', ip, {\n\t\t\treason,\n\t\t\tblocked_count: this.blockedIPs.size,\n\t\t});\n\n\t\tlogWarn(\n\t\t\t`IP blocked: ${ip} - ${reason}`,\n\t\t\t'ip_blocked',\n\t\t\t{ ip, reason, total_blocked: this.blockedIPs.size },\n\t\t);\n\t}\n\n\t/**\n\t * Checks if an IP is blocked.\n\t */\n\tprivate isIPBlocked(ip: string): boolean {\n\t\treturn this.blockedIPs.has(ip);\n\t}\n\n\t/**\n\t * Gets suspicious activity count for an IP.\n\t */\n\tprivate getSuspiciousActivityCount(ip: string): number {\n\t\t// This is a simplified implementation\n\t\t// In production, you'd want to track this in a more sophisticated way\n\t\treturn this.isSuspiciousIP(ip) ? 1 : 0;\n\t}\n\n\t// ========================================\n\t// Rate Limiting Management\n\t// ========================================\n\n\t/**\n\t * Gets current rate limit status for a key.\n\t */\n\tgetRateLimitStatus(key: string): {\n\t\tattempts: number;\n\t\tresetAt: number;\n\t\tremainingTime: number;\n\t} | null {\n\t\tconst record = this.rateLimits.get(key);\n\t\tif (!record) {\n\t\t\treturn null;\n\t\t}\n\n\t\treturn {\n\t\t\tattempts: record.attempts,\n\t\t\tresetAt: record.resetAt,\n\t\t\tremainingTime: Math.max(0, record.resetAt - Date.now()),\n\t\t};\n\t}\n\n\t/**\n\t * Clears rate limit for a key (admin function).\n\t */\n\tclearRateLimit(key: string): boolean {\n\t\treturn this.rateLimits.delete(key);\n\t}\n\n\t/**\n\t * Cleans up expired rate limit entries.\n\t */\n\tcleanupExpiredRateLimits(): void {\n\t\tconst now = Date.now();\n\t\tconst expired: string[] = [];\n\n\t\tfor (const [key, record] of this.rateLimits.entries()) {\n\t\t\tif (now > record.resetAt) {\n\t\t\t\texpired.push(key);\n\t\t\t}\n\t\t}\n\n\t\tfor (const key of expired) {\n\t\t\tthis.rateLimits.delete(key);\n\t\t}\n\n\t\tif (expired.length > 0) {\n\t\t\tlogInfo(\n\t\t\t\t`Cleaned up ${expired.length} expired rate limit entries`,\n\t\t\t\t'rate_limit_cleanup',\n\t\t\t\t{ expired_count: expired.length },\n\t\t\t);\n\t\t}\n\t}\n\n\t// ========================================\n\t// Security Event Logging\n\t// ========================================\n\n\t/**\n\t * Logs a security event.\n\t */\n\tprivate logSecurityEvent(\n\t\ttype: SecurityEvent['type'],\n\t\tseverity: SecurityEvent['severity'],\n\t\tclientIP: string,\n\t\tdetails: Record,\n\t): void {\n\t\tconst event: SecurityEvent = {\n\t\t\ttype,\n\t\t\tseverity,\n\t\t\ttimestamp: new Date().toISOString(),\n\t\t\tcorrelationId: generateCorrelationId(),\n\t\t\tclientIP,\n\t\t\tuserAgent: details.user_agent,\n\t\t\tdetails,\n\t\t};\n\n\t\tlogSecurityEvent(event);\n\t}\n\n\t// ========================================\n\t// Security Statistics\n\t// ========================================\n\n\t/**\n\t * Gets security statistics.\n\t */\n\tgetSecurityStats(): {\n\t\trateLimitEntries: number;\n\t\tsuspiciousIPs: number;\n\t\tblockedIPs: number;\n\t\tactiveRateLimits: number;\n\t} {\n\t\tconst now = Date.now();\n\t\tconst activeRateLimits = Array.from(this.rateLimits.values())\n\t\t\t.filter((record) => now <= record.resetAt)\n\t\t\t.length;\n\n\t\treturn {\n\t\t\trateLimitEntries: this.rateLimits.size,\n\t\t\tsuspiciousIPs: this.suspiciousIPs.size,\n\t\t\tblockedIPs: this.blockedIPs.size,\n\t\t\tactiveRateLimits,\n\t\t};\n\t}\n\n\t/**\n\t * Gets list of blocked IPs (admin function).\n\t */\n\tgetBlockedIPs(): string[] {\n\t\treturn Array.from(this.blockedIPs);\n\t}\n\n\t/**\n\t * Gets list of suspicious IPs (admin function).\n\t */\n\tgetSuspiciousIPs(): string[] {\n\t\treturn Array.from(this.suspiciousIPs);\n\t}\n\n\t/**\n\t * Unblocks an IP address (admin function).\n\t */\n\tunblockIP(ip: string): boolean {\n\t\tconst wasBlocked = this.blockedIPs.delete(ip);\n\t\tif (wasBlocked) {\n\t\t\tlogInfo(\n\t\t\t\t`IP unblocked: ${ip}`,\n\t\t\t\t'ip_unblocked',\n\t\t\t\t{ ip, remaining_blocked: this.blockedIPs.size },\n\t\t\t);\n\t\t}\n\t\treturn wasBlocked;\n\t}\n\n\t/**\n\t * Clears suspicious status for an IP (admin function).\n\t */\n\tclearSuspiciousIP(ip: string): boolean {\n\t\tconst wasSuspicious = this.suspiciousIPs.delete(ip);\n\t\tif (wasSuspicious) {\n\t\t\tlogInfo(\n\t\t\t\t`IP suspicious status cleared: ${ip}`,\n\t\t\t\t'ip_suspicious_cleared',\n\t\t\t\t{ ip, remaining_suspicious: this.suspiciousIPs.size },\n\t\t\t);\n\t\t}\n\t\treturn wasSuspicious;\n\t}\n}\n\n// ========================================\n// Utility Functions\n// ========================================\n\n/**\n * Creates a rate limit key for IP and endpoint.\n */\nexport function createRateLimitKey(\n\tip: string,\n\tendpoint: string,\n): string {\n\treturn `${ip}:${endpoint}`;\n}\n\n/**\n * Validates security headers comprehensively.\n */\nexport function validateSecurityHeaders(headers: Headers): {\n\tvalid: boolean;\n\tissues: string[];\n\trecommendations: string[];\n} {\n\tconst issues: string[] = [];\n\tconst recommendations: string[] = [];\n\n\tconst origin = headers.get('origin');\n\tconst referer = headers.get('referer');\n\tconst host = headers.get('host');\n\tconst userAgent = headers.get('user-agent');\n\n\tif (!origin) {\n\t\tissues.push('Missing Origin header');\n\t}\n\n\tif (!referer) {\n\t\tissues.push('Missing Referer header');\n\t}\n\n\tif (!host) {\n\t\tissues.push('Missing Host header');\n\t}\n\n\tif (!userAgent || userAgent.length < 10) {\n\t\tissues.push('Missing or suspicious User-Agent header');\n\t\trecommendations.push('User-Agent should be a valid browser string');\n\t}\n\n\t// Check for common attack patterns\n\tconst headersToCheck = [origin, referer, userAgent].filter(Boolean);\n\tfor (const header of headersToCheck) {\n\t\tif (/ pattern.test(userAgent));\n}\n\n/**\n * Extracts geolocation info from IP (placeholder).\n */\nexport function getIPGeolocation(ip: string): {\n\tcountry?: string;\n\tregion?: string;\n\tcity?: string;\n\tisVPN?: boolean;\n\tisTor?: boolean;\n} {\n\t// This is a placeholder implementation\n\t// In production, you'd integrate with a geolocation service like MaxMind or IPStack\n\n\t// Basic IP validation and local IP detection\n\tif (\n\t\tip === '127.0.0.1' || ip === '::1' || ip.startsWith('192.168.') ||\n\t\tip.startsWith('10.') || ip.startsWith('172.')\n\t) {\n\t\treturn {\n\t\t\tcountry: 'Local',\n\t\t\tregion: 'Private Network',\n\t\t\tcity: 'localhost',\n\t\t\tisVPN: false,\n\t\t\tisTor: false,\n\t\t};\n\t}\n\n\t// For public IPs, return unknown (would query external service in production)\n\treturn {\n\t\tcountry: 'Unknown',\n\t\tregion: 'Unknown',\n\t\tcity: 'Unknown',\n\t\tisVPN: false,\n\t\tisTor: false,\n\t};\n}\n\n// ========================================\n// Factory Function\n// ========================================\n\n/**\n * Creates a new security service instance.\n */\nexport function createSecurityService(): SecurityService {\n\treturn new SecurityServiceImpl();\n}\n\n// ========================================\n// Default Export\n// ========================================\n\nexport default {\n\tSecurityServiceImpl,\n\tcreateSecurityService,\n\tcreateRateLimitKey,\n\tvalidateSecurityHeaders,\n\tisKnownBot,\n\tgetIPGeolocation,\n};\n",[],[197,293,327],[197,293],{"_107":336,"_100":337,"_151":338,"_153":198,"_154":138,"_155":339,"_157":158,"_109":340,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_165":341,"_103":378},"a6e0ffea-57ee-11f0-a269-f69ea79377d9","utils","a6e10094-57ee-11f0-a269-f69ea79377d9",9,["D",1751534296203],[342,351,360,369],{"_107":343,"_100":344,"_151":345,"_153":338,"_154":138,"_155":346,"_157":158,"_109":347,"_104":31,"_160":215,"_162":348,"_163":27,"_164":-5,"_165":349,"_103":350},"a83beaee-57ee-11f0-91ce-f69ea79377d9","crypto.ts","a83bebca-57ee-11f0-91ce-f69ea79377d9",29,["D",1751534298473],"// deno-lint-ignore-file no-explicit-any\n/**\n * Cryptographic utilities for SafeHash V2.\n * Provides secure hashing, HMAC, and random number generation using Deno standard library.\n */\n\n// import { crypto as denoStdCrypto } from \"https://deno.land/std@0.210.0/crypto/mod.ts\";\nimport sha3 from 'https://esm.sh/js-sha3@0.9.3';\nimport { getConfig } from '../config/app-config.ts';\nimport type { CryptoService } from '../config/app-types.ts';\n\nconst { sha3_512, sha3_256 } = sha3;\n\n// ========================================\n// Crypto Service Implementation\n// ========================================\n\nexport class CryptoServiceImpl implements CryptoService {\n\tprivate hmacSecret: string;\n\n\tconstructor() {\n\t\tconst config = getConfig('security');\n\t\tthis.hmacSecret = config.hmacSecret;\n\n\t\tif (!this.hmacSecret) {\n\t\t\tthrow new Error('HMAC secret is required for crypto operations');\n\t\t}\n\t}\n\n\t/**\n\t * Generates SHA3-512 hash of the provided payload.\n\t * Used for payment fingerprint generation.\n\t */\n\tmakeHash(payload: string): string {\n\t\tif (typeof payload !== 'string') {\n\t\t\tthrow new Error('Payload must be a string');\n\t\t}\n\n\t\treturn sha3_512(payload);\n\t}\n\n\t/**\n\t * Generates HMAC signature for server responses using proper HMAC construction.\n\t * Uses SHA3-256 as the underlying hash function.\n\t */\n\tgenerateHMAC(data: any, timestamp: string): string {\n\t\tconst message = `${JSON.stringify(data)}:${timestamp}`;\n\n\t\t// Proper HMAC construction: HMAC(K, m) = H((K ⊕ opad) || H((K ⊕ ipad) || m))\n\t\tconst key = this.hmacSecret.padEnd(128, '\\0').substring(0, 128); // Ensure key is exactly 128 bytes\n\t\tconst ipad = new Array(128).fill(0x36).map((x, i) => x ^ key.charCodeAt(i)).map((x) => String.fromCharCode(x)).join(\n\t\t\t'',\n\t\t);\n\t\tconst opad = new Array(128).fill(0x5c).map((x, i) => x ^ key.charCodeAt(i)).map((x) => String.fromCharCode(x)).join(\n\t\t\t'',\n\t\t);\n\n\t\tconst inner = sha3_256(ipad + message);\n\t\treturn sha3_256(opad + inner);\n\t}\n\n\t/**\n\t * Validates HMAC signature for incoming requests or responses.\n\t */\n\tvalidateHMAC(data: any, timestamp: string, signature: string): boolean {\n\t\ttry {\n\t\t\tconst expectedSignature = this.generateHMAC(data, timestamp);\n\t\t\treturn this.constantTimeEquals(signature, expectedSignature);\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t}\n\n\t/**\n\t * Generates cryptographically secure random string.\n\t * Uses Deno's secure random number generator.\n\t */\n\tgenerateSecureRandom(length: number): string {\n\t\tif (length <= 0 || !Number.isInteger(length)) {\n\t\t\tthrow new Error('Length must be a positive integer');\n\t\t}\n\n\t\tconst bytes = crypto.getRandomValues(new Uint8Array(Math.ceil(length / 2)));\n\t\treturn Array.from(bytes)\n\t\t\t.map((b) => b.toString(16).padStart(2, '0'))\n\t\t\t.join('')\n\t\t\t.substring(0, length);\n\t}\n\n\t/**\n\t * Constant-time string comparison to prevent timing attacks.\n\t */\n\tprivate constantTimeEquals(a: string, b: string): boolean {\n\t\tif (a.length !== b.length) {\n\t\t\treturn false;\n\t\t}\n\n\t\tlet result = 0;\n\t\tfor (let i = 0; i < a.length; i++) {\n\t\t\tresult |= a.charCodeAt(i) ^ b.charCodeAt(i);\n\t\t}\n\n\t\treturn result === 0;\n\t}\n}\n\n// ========================================\n// Additional Crypto Utilities\n// ========================================\n\n/**\n * Generates a secure nonce (32 hex characters).\n */\nexport function generateNonce(): string {\n\tconst bytes = crypto.getRandomValues(new Uint8Array(16));\n\treturn Array.from(bytes)\n\t\t.map((b) => b.toString(16).padStart(2, '0'))\n\t\t.join('');\n}\n\n/**\n * Generates a secure random UUID v4.\n */\nexport function generateUUID(): string {\n\treturn crypto.randomUUID();\n}\n\n/**\n * Generates a secure random string of specified length using given character set.\n */\nexport function generateRandomString(\n\tlength: number,\n\tcharset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789',\n): string {\n\tif (length <= 0 || !Number.isInteger(length)) {\n\t\tthrow new Error('Length must be a positive integer');\n\t}\n\n\tconst bytes = crypto.getRandomValues(new Uint8Array(length));\n\treturn Array.from(bytes)\n\t\t.map((byte) => charset[byte % charset.length])\n\t\t.join('');\n}\n\n/**\n * Hashes a password using a secure algorithm with salt.\n * Uses Deno's built-in crypto API for PBKDF2.\n */\nexport async function hashPassword(password: string, salt?: string): Promise<{\n\thash: string;\n\tsalt: string;\n}> {\n\tconst passwordSalt = salt || generateRandomString(32);\n\tconst encoder = new TextEncoder();\n\n\t// Import password as key material\n\tconst keyMaterial = await crypto.subtle.importKey(\n\t\t'raw',\n\t\tencoder.encode(password),\n\t\t'PBKDF2',\n\t\tfalse,\n\t\t['deriveBits'],\n\t);\n\n\t// Derive key using PBKDF2\n\tconst derivedKey = await crypto.subtle.deriveBits(\n\t\t{\n\t\t\tname: 'PBKDF2',\n\t\t\tsalt: encoder.encode(passwordSalt),\n\t\t\titerations: 100000,\n\t\t\thash: 'SHA-256',\n\t\t},\n\t\tkeyMaterial,\n\t\t256, // 32 bytes\n\t);\n\n\tconst hashArray = new Uint8Array(derivedKey);\n\tconst hashHex = Array.from(hashArray)\n\t\t.map((b) => b.toString(16).padStart(2, '0'))\n\t\t.join('');\n\n\treturn {\n\t\thash: hashHex,\n\t\tsalt: passwordSalt,\n\t};\n}\n\n/**\n * Verifies a password against a hash.\n */\nexport async function verifyPassword(\n\tpassword: string,\n\thash: string,\n\tsalt: string,\n): Promise {\n\ttry {\n\t\tconst { hash: newHash } = await hashPassword(password, salt);\n\n\t\t// Use constant-time comparison\n\t\tif (newHash.length !== hash.length) {\n\t\t\treturn false;\n\t\t}\n\n\t\tlet result = 0;\n\t\tfor (let i = 0; i < newHash.length; i++) {\n\t\t\tresult |= newHash.charCodeAt(i) ^ hash.charCodeAt(i);\n\t\t}\n\n\t\treturn result === 0;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\n/**\n * Creates a SHA-256 hash of data using Deno's built-in crypto.\n */\nexport async function sha256(data: string): Promise {\n\tconst encoder = new TextEncoder();\n\tconst dataBuffer = encoder.encode(data);\n\tconst hashBuffer = await crypto.subtle.digest('SHA-256', dataBuffer);\n\tconst hashArray = new Uint8Array(hashBuffer);\n\n\treturn Array.from(hashArray)\n\t\t.map((b) => b.toString(16).padStart(2, '0'))\n\t\t.join('');\n}\n\n/**\n * Creates a SHA-512 hash of data using Deno's built-in crypto.\n */\nexport async function sha512(data: string): Promise {\n\tconst encoder = new TextEncoder();\n\tconst dataBuffer = encoder.encode(data);\n\tconst hashBuffer = await crypto.subtle.digest('SHA-512', dataBuffer);\n\tconst hashArray = new Uint8Array(hashBuffer);\n\n\treturn Array.from(hashArray)\n\t\t.map((b) => b.toString(16).padStart(2, '0'))\n\t\t.join('');\n}\n\n/**\n * Generates cryptographically secure random bytes.\n */\nexport function getRandomBytes(length: number): Uint8Array {\n\tif (length <= 0 || !Number.isInteger(length)) {\n\t\tthrow new Error('Length must be a positive integer');\n\t}\n\n\treturn crypto.getRandomValues(new Uint8Array(length));\n}\n\n/**\n * Generates a secure timestamp-based token.\n */\nexport function generateTimestampToken(): string {\n\tconst timestamp = Date.now().toString();\n\tconst randomBytes = getRandomBytes(8);\n\tconst randomHex = Array.from(randomBytes)\n\t\t.map((b) => b.toString(16).padStart(2, '0'))\n\t\t.join('');\n\n\treturn `${timestamp}_${randomHex}`;\n}\n\n/**\n * Validates a timestamp token and extracts the timestamp.\n */\nexport function validateTimestampToken(\n\ttoken: string,\n\tmaxAgeMs: number = 15 * 60 * 1000,\n): { valid: boolean; timestamp?: number; age?: number } {\n\ttry {\n\t\tconst parts = token.split('_');\n\t\tif (parts.length !== 2) {\n\t\t\treturn { valid: false };\n\t\t}\n\n\t\tconst timestamp = parseInt(parts[0], 10);\n\t\tif (isNaN(timestamp)) {\n\t\t\treturn { valid: false };\n\t\t}\n\n\t\tconst now = Date.now();\n\t\tconst age = now - timestamp;\n\n\t\tif (age > maxAgeMs || age < 0) {\n\t\t\treturn { valid: false, timestamp, age };\n\t\t}\n\n\t\treturn { valid: true, timestamp, age };\n\t} catch {\n\t\treturn { valid: false };\n\t}\n}\n\n/**\n * Creates an encrypted token using AES-GCM.\n */\nexport async function encryptToken(\n\tdata: string,\n\tkey: CryptoKey,\n): Promise<{ encrypted: string; iv: string }> {\n\tconst encoder = new TextEncoder();\n\tconst dataBuffer = encoder.encode(data);\n\tconst iv = crypto.getRandomValues(new Uint8Array(12)); // 96-bit IV for GCM\n\n\tconst encryptedBuffer = await crypto.subtle.encrypt(\n\t\t{\n\t\t\tname: 'AES-GCM',\n\t\t\tiv: iv,\n\t\t},\n\t\tkey,\n\t\tdataBuffer,\n\t);\n\n\tconst encrypted = Array.from(new Uint8Array(encryptedBuffer))\n\t\t.map((b) => b.toString(16).padStart(2, '0'))\n\t\t.join('');\n\n\tconst ivHex = Array.from(iv)\n\t\t.map((b) => b.toString(16).padStart(2, '0'))\n\t\t.join('');\n\n\treturn { encrypted, iv: ivHex };\n}\n\n/**\n * Decrypts a token using AES-GCM.\n */\nexport async function decryptToken(\n\tencrypted: string,\n\tiv: string,\n\tkey: CryptoKey,\n): Promise {\n\t// Convert hex strings back to Uint8Array\n\tconst encryptedBytes = new Uint8Array(\n\t\tencrypted.match(/.{1,2}/g)?.map((byte) => parseInt(byte, 16)) || [],\n\t);\n\n\tconst ivBytes = new Uint8Array(\n\t\tiv.match(/.{1,2}/g)?.map((byte) => parseInt(byte, 16)) || [],\n\t);\n\n\tconst decryptedBuffer = await crypto.subtle.decrypt(\n\t\t{\n\t\t\tname: 'AES-GCM',\n\t\t\tiv: ivBytes,\n\t\t},\n\t\tkey,\n\t\tencryptedBytes,\n\t);\n\n\tconst decoder = new TextDecoder();\n\treturn decoder.decode(decryptedBuffer);\n}\n\n/**\n * Generates an AES-GCM key for encryption/decryption.\n */\nexport async function generateEncryptionKey(): Promise {\n\treturn await crypto.subtle.generateKey(\n\t\t{\n\t\t\tname: 'AES-GCM',\n\t\t\tlength: 256,\n\t\t},\n\t\ttrue, // extractable\n\t\t['encrypt', 'decrypt'],\n\t);\n}\n\n/**\n * Imports an encryption key from raw bytes.\n */\nexport async function importEncryptionKey(keyBytes: Uint8Array): Promise {\n\treturn await crypto.subtle.importKey(\n\t\t'raw',\n\t\tkeyBytes,\n\t\t{\n\t\t\tname: 'AES-GCM',\n\t\t\tlength: 256,\n\t\t},\n\t\ttrue,\n\t\t['encrypt', 'decrypt'],\n\t);\n}\n\n// ========================================\n// Factory Function\n// ========================================\n\n/**\n * Creates a new CryptoService instance.\n */\nexport function createCryptoService(): CryptoService {\n\treturn new CryptoServiceImpl();\n}\n\n// ========================================\n// Default Export\n// ========================================\n\nexport default {\n\tCryptoServiceImpl,\n\tcreateCryptoService,\n\tgenerateNonce,\n\tgenerateUUID,\n\tgenerateRandomString,\n\tgenerateTimestampToken,\n\tvalidateTimestampToken,\n\thashPassword,\n\tverifyPassword,\n\tsha256,\n\tsha512,\n\tgetRandomBytes,\n\tencryptToken,\n\tdecryptToken,\n\tgenerateEncryptionKey,\n\timportEncryptionKey,\n};\n",[],[197,337,344],{"_107":352,"_100":353,"_151":354,"_153":338,"_154":138,"_155":355,"_157":158,"_109":356,"_104":31,"_160":215,"_162":357,"_163":27,"_164":-5,"_165":358,"_103":359},"a84aac14-57ee-11f0-ba53-f69ea79377d9","logging.ts","a84aacaa-57ee-11f0-ba53-f69ea79377d9",30,["D",1751534298573],"// deno-lint-ignore-file no-explicit-any\n/**\n * Structured logging utilities for SafeHash V2.\n * Provides centralized logging with emoji support, correlation IDs, and configurable outputs.\n */\n\nimport { getLogger, handlers, LevelName, LogRecord, setup } from 'https://deno.land/std@0.210.0/log/mod.ts';\nimport { getConfig } from '../config/app-config.ts';\nimport type { LogEntry, LogLevel, PerformanceEvent, SecurityEvent } from '../config/app-types.ts';\n\n// ========================================\n// Logger Configuration\n// ========================================\n\nlet isInitialized = false;\nlet currentCorrelationId: string | null = null;\n\n/**\n * Initializes the logging system with configuration.\n */\nexport async function initializeLogging(): Promise {\n\tif (isInitialized) {\n\t\treturn;\n\t}\n\n\tconst config = getConfig('logging');\n\n\t// Configure Deno standard logger\n\tawait setup({\n\t\thandlers: {\n\t\t\tconsole: new handlers.ConsoleHandler(config.level as LevelName, {\n\t\t\t\tformatter: config.format === 'json' ? formatAsJSON : formatAsText,\n\t\t\t}),\n\t\t\t...(config.outputs.includes('file') && config.fileName\n\t\t\t\t? {\n\t\t\t\t\tfile: new handlers.FileHandler(config.level as LevelName, {\n\t\t\t\t\t\tfilename: config.fileName,\n\t\t\t\t\t\tformatter: formatAsJSON, // Always use JSON for file output\n\t\t\t\t\t}),\n\t\t\t\t}\n\t\t\t\t: {}),\n\t\t},\n\t\tloggers: {\n\t\t\tdefault: {\n\t\t\t\tlevel: config.level as LevelName,\n\t\t\t\thandlers: config.outputs.includes('console') ? ['console'] : [],\n\t\t\t},\n\t\t\t...(config.outputs.includes('file')\n\t\t\t\t? {\n\t\t\t\t\tfile: {\n\t\t\t\t\t\tlevel: config.level as LevelName,\n\t\t\t\t\t\thandlers: ['file'],\n\t\t\t\t\t},\n\t\t\t\t}\n\t\t\t\t: {}),\n\t\t},\n\t});\n\n\tisInitialized = true;\n\tlogInfo(`✅ Logging initialized - Level: ${config.level}, Format: ${config.format}`);\n}\n\n// ========================================\n// Correlation ID Management\n// ========================================\n\n/**\n * Generates a new correlation ID for request tracking.\n */\nexport function generateCorrelationId(): string {\n\treturn crypto.randomUUID();\n}\n\n/**\n * Sets the correlation ID for the current context.\n */\nexport function setCorrelationId(correlationId: string): void {\n\tcurrentCorrelationId = correlationId;\n}\n\n/**\n * Gets the current correlation ID.\n */\nexport function getCorrelationId(): string | null {\n\treturn currentCorrelationId;\n}\n\n/**\n * Clears the current correlation ID.\n */\nexport function clearCorrelationId(): void {\n\tcurrentCorrelationId = null;\n}\n\n/**\n * Executes a function with a specific correlation ID context.\n */\nexport async function withCorrelationId(\n\tcorrelationId: string,\n\tfn: () => Promise | T,\n): Promise {\n\tconst previousId = currentCorrelationId;\n\tsetCorrelationId(correlationId);\n\n\ttry {\n\t\treturn await fn();\n\t} finally {\n\t\tcurrentCorrelationId = previousId;\n\t}\n}\n\n// ========================================\n// Emoji Mappings\n// ========================================\n\nconst LEVEL_EMOJIS: Record = {\n\tDEBUG: '🔍',\n\tINFO: 'ℹ️',\n\tWARN: '⚠️',\n\tERROR: '❌',\n};\n\nconst OPERATION_EMOJIS: Record = {\n\t// HTTP Operations\n\t'http_request': '📨',\n\t'http_response': '📤',\n\t'http_error': '💥',\n\n\t// Security Operations\n\t'security_check': '🔐',\n\t'auth_success': '✅',\n\t'auth_failure': '🚫',\n\t'honeypot_trigger': '🍯',\n\t'rate_limit': '⏱️',\n\t'cors_check': '🌐',\n\n\t// Database Operations\n\t'db_query': '💾',\n\t'db_insert': '➕',\n\t'db_update': '✏️',\n\t'db_delete': '🗑️',\n\t'db_error': '💿',\n\n\t// Crypto Operations\n\t'crypto_hash': '🔒',\n\t'crypto_sign': '✍️',\n\t'crypto_verify': '🔍',\n\t'crypto_random': '🎲',\n\n\t// Business Logic\n\t'nonce_generate': '🎫',\n\t'nonce_validate': '🔍',\n\t'nonce_expire': '⏰',\n\t'payment_hash': '💳',\n\t'booking_check': '📋',\n\n\t// System Operations\n\t'startup': '🚀',\n\t'shutdown': '🛑',\n\t'health_check': '💚',\n\t'cleanup': '🧹',\n\t'config_load': '⚙️',\n};\n\n// ========================================\n// Log Formatters\n// ========================================\n\n/**\n * Formats log entry as JSON.\n */\nfunction formatAsJSON(logRecord: LogRecord): string {\n\tconst config = getConfig('logging');\n\n\tconst entry: LogEntry = {\n\t\ttimestamp: new Date().toISOString(),\n\t\tlevel: logRecord.levelName as LogLevel,\n\t\tmessage: logRecord.msg,\n\t\tservice: 'safehash-api',\n\t\t...(config.enableCorrelationIds && currentCorrelationId\n\t\t\t? {\n\t\t\t\tcorrelationId: currentCorrelationId,\n\t\t\t}\n\t\t\t: {}),\n\t\t...(logRecord.args.length > 0\n\t\t\t? {\n\t\t\t\tmetadata: logRecord.args[0] as Record,\n\t\t\t}\n\t\t\t: {}),\n\t};\n\n\treturn JSON.stringify(entry);\n}\n\n/**\n * Formats log entry as human-readable text.\n */\nfunction formatAsText(logRecord: LogRecord): string {\n\tconst config = getConfig('logging');\n\tconst timestamp = new Date().toISOString();\n\tconst level = logRecord.levelName as LogLevel;\n\n\tlet message = `[${timestamp}] ${level}`;\n\n\tif (config.enableEmojis) {\n\t\tmessage = `${LEVEL_EMOJIS[level]} ${message}`;\n\t}\n\n\tif (config.enableCorrelationIds && currentCorrelationId) {\n\t\tmessage += ` [${currentCorrelationId}]`;\n\t}\n\n\tmessage += `: ${logRecord.msg}`;\n\n\tif (logRecord.args.length > 0) {\n\t\tmessage += ` ${JSON.stringify(logRecord.args[0])}`;\n\t}\n\n\treturn message;\n}\n\n// ========================================\n// Core Logging Functions\n// ========================================\n\n/**\n * Creates a structured log entry.\n */\nfunction createLogEntry(\n\tlevel: LogLevel,\n\tmessage: string,\n\toperation?: string,\n\tmetadata?: Record,\n\terror?: Error,\n): void {\n\tconst config = getConfig('logging');\n\n\t// Add emoji to message if enabled\n\tif (config.enableEmojis && operation && OPERATION_EMOJIS[operation]) {\n\t\tmessage = `${OPERATION_EMOJIS[operation]} ${message}`;\n\t}\n\n\tconst logData: any = {\n\t\t...(operation ? { operation } : {}),\n\t\t...(metadata ? metadata : {}),\n\t\t...(error\n\t\t\t? {\n\t\t\t\terror: {\n\t\t\t\t\tname: error.name,\n\t\t\t\t\tmessage: error.message,\n\t\t\t\t\tstack: error.stack,\n\t\t\t\t},\n\t\t\t}\n\t\t\t: {}),\n\t};\n\n\t// Use Deno standard logger\n\tconst logger = getLogger();\n\n\tswitch (level) {\n\t\tcase 'DEBUG':\n\t\t\tlogger.debug(message, logData);\n\t\t\tbreak;\n\t\tcase 'INFO':\n\t\t\tlogger.info(message, logData);\n\t\t\tbreak;\n\t\tcase 'WARN':\n\t\t\tlogger.warning(message, logData);\n\t\t\tbreak;\n\t\tcase 'ERROR':\n\t\t\tlogger.error(message, logData);\n\t\t\tbreak;\n\t}\n}\n\n/**\n * Logs debug information.\n */\nexport function logDebug(\n\tmessage: string,\n\toperation?: string,\n\tmetadata?: Record,\n): void {\n\tcreateLogEntry('DEBUG', message, operation, metadata);\n}\n\n/**\n * Logs general information.\n */\nexport function logInfo(\n\tmessage: string,\n\toperation?: string,\n\tmetadata?: Record,\n): void {\n\tcreateLogEntry('INFO', message, operation, metadata);\n}\n\n/**\n * Logs warning messages.\n */\nexport function logWarn(\n\tmessage: string,\n\toperation?: string,\n\tmetadata?: Record,\n): void {\n\tcreateLogEntry('WARN', message, operation, metadata);\n}\n\n/**\n * Logs error messages.\n */\nexport function logError(\n\tmessage: string,\n\terror?: Error,\n\toperation?: string,\n\tmetadata?: Record,\n): void {\n\tcreateLogEntry('ERROR', message, operation, metadata, error);\n}\n\n// ========================================\n// Specialized Logging Functions\n// ========================================\n\n/**\n * Logs HTTP request information.\n */\nexport function logHttpRequest(\n\tmethod: string,\n\tpath: string,\n\tclientIP: string,\n\tuserAgent?: string,\n): void {\n\tlogInfo(\n\t\t`${method} ${path}`,\n\t\t'http_request',\n\t\t{\n\t\t\tmethod,\n\t\t\tpath,\n\t\t\tclientIP,\n\t\t\tuserAgent,\n\t\t},\n\t);\n}\n\n/**\n * Logs HTTP response information.\n */\nexport function logHttpResponse(\n\tmethod: string,\n\tpath: string,\n\tstatus: number,\n\tduration: number,\n): void {\n\tconst level = status >= 400 ? 'WARN' : 'INFO';\n\tconst operation = status >= 500 ? 'http_error' : 'http_response';\n\n\tcreateLogEntry(\n\t\tlevel,\n\t\t`${method} ${path} - ${status} (${duration}ms)`,\n\t\toperation,\n\t\t{\n\t\t\tmethod,\n\t\t\tpath,\n\t\t\tstatus,\n\t\t\tduration,\n\t\t},\n\t);\n}\n\n/**\n * Logs security events.\n */\nexport function logSecurityEvent(event: SecurityEvent): void {\n\tconst level = event.severity === 'critical' || event.severity === 'high' ? 'ERROR' : 'WARN';\n\n\tcreateLogEntry(\n\t\tlevel,\n\t\t`Security event: ${event.type}`,\n\t\t'security_check',\n\t\t{\n\t\t\ttype: event.type,\n\t\t\tseverity: event.severity,\n\t\t\tclientIP: event.clientIP,\n\t\t\tuserAgent: event.userAgent,\n\t\t\tdetails: event.details,\n\t\t},\n\t);\n}\n\n/**\n * Logs performance events.\n */\nexport function logPerformanceEvent(event: PerformanceEvent): void {\n\tconst level = event.success ? 'DEBUG' : 'WARN';\n\n\tcreateLogEntry(\n\t\tlevel,\n\t\t`${event.operation} completed in ${event.duration}ms`,\n\t\tevent.type,\n\t\t{\n\t\t\toperation: event.operation,\n\t\t\tduration: event.duration,\n\t\t\tsuccess: event.success,\n\t\t\tmetadata: event.metadata,\n\t\t},\n\t);\n}\n\n/**\n * Logs database operations.\n */\nexport function logDatabaseOperation(\n\toperation: string,\n\ttable: string,\n\tduration: number,\n\trowsAffected?: number,\n\terror?: Error,\n): void {\n\tif (error) {\n\t\tlogError(\n\t\t\t`Database ${operation} failed on ${table}`,\n\t\t\terror,\n\t\t\t'db_error',\n\t\t\t{ table, duration, rowsAffected },\n\t\t);\n\t} else {\n\t\tlogDebug(\n\t\t\t`Database ${operation} on ${table} (${duration}ms)`,\n\t\t\t'db_query',\n\t\t\t{ table, duration, rowsAffected },\n\t\t);\n\t}\n}\n\n/**\n * Logs nonce operations.\n */\nexport function logNonceOperation(\n\toperation: 'generate' | 'validate' | 'expire' | 'reuse',\n\tnonce: string,\n\tbookingId?: string,\n\tmetadata?: Record,\n): void {\n\tconst maskedNonce = `${nonce.substring(0, 8)}...`;\n\tconst operationMap = {\n\t\tgenerate: 'nonce_generate',\n\t\tvalidate: 'nonce_validate',\n\t\texpire: 'nonce_expire',\n\t\treuse: 'nonce_validate',\n\t};\n\n\tlogInfo(\n\t\t`Nonce ${operation}: ${maskedNonce}${bookingId ? ` for booking ${bookingId}` : ''}`,\n\t\toperationMap[operation],\n\t\t{\n\t\t\toperation,\n\t\t\tnonce: maskedNonce,\n\t\t\tbookingId,\n\t\t\t...metadata,\n\t\t},\n\t);\n}\n\n/**\n * Logs authentication events.\n */\nexport function logAuthEvent(\n\ttype: 'success' | 'failure' | 'generate' | 'validate' | 'exchange' | 'refresh' | 'internal',\n\tmethod: string,\n\tclientIP: string,\n\tdetails?: Record,\n): void {\n\tconst operation = type === 'success' ? 'auth_success' : 'auth_failure';\n\tconst level = type === 'success' ? 'INFO' : 'WARN';\n\n\tcreateLogEntry(\n\t\tlevel,\n\t\t`Authentication ${type} via ${method}`,\n\t\toperation,\n\t\t{\n\t\t\ttype,\n\t\t\tmethod,\n\t\t\tclientIP,\n\t\t\t...details,\n\t\t},\n\t);\n}\n\n/**\n * Logs crypto operations.\n */\nexport function logCryptoOperation(\n\toperation: 'hash' | 'sign' | 'verify' | 'random',\n\talgorithm: string,\n\tsuccess: boolean,\n\tduration?: number,\n): void {\n\tconst operationMap = {\n\t\thash: 'crypto_hash',\n\t\tsign: 'crypto_sign',\n\t\tverify: 'crypto_verify',\n\t\trandom: 'crypto_random',\n\t};\n\n\tlogDebug(\n\t\t`Crypto ${operation} (${algorithm}) - ${success ? 'success' : 'failed'}`,\n\t\toperationMap[operation],\n\t\t{\n\t\t\toperation,\n\t\t\talgorithm,\n\t\t\tsuccess,\n\t\t\tduration,\n\t\t},\n\t);\n}\n\n// ========================================\n// Performance Monitoring\n// ========================================\n\n/**\n * Measures and logs the duration of an operation.\n */\nexport async function measureAndLog(\n\toperation: string,\n\tfn: () => Promise | T,\n\tlogLevel: LogLevel = 'DEBUG',\n): Promise {\n\tconst startTime = performance.now();\n\tlet success = true;\n\tlet error: Error | undefined;\n\n\ttry {\n\t\tconst result = await fn();\n\t\treturn result;\n\t} catch (e) {\n\t\tsuccess = false;\n\t\terror = e instanceof Error ? e : new Error(String(e));\n\t\tthrow error;\n\t} finally {\n\t\tconst duration = Math.round(performance.now() - startTime);\n\n\t\tif (error) {\n\t\t\tlogError(\n\t\t\t\t`${operation} failed (${duration}ms)`,\n\t\t\t\terror,\n\t\t\t\toperation,\n\t\t\t\t{ duration, success },\n\t\t\t);\n\t\t} else {\n\t\t\tcreateLogEntry(\n\t\t\t\tlogLevel,\n\t\t\t\t`${operation} completed (${duration}ms)`,\n\t\t\t\toperation,\n\t\t\t\t{ duration, success },\n\t\t\t);\n\t\t}\n\t}\n}\n\n/**\n * Creates a performance timer for manual measurement.\n */\nexport function createTimer(operation: string) {\n\tconst startTime = performance.now();\n\n\treturn {\n\t\tstop: (metadata?: Record) => {\n\t\t\tconst duration = Math.round(performance.now() - startTime);\n\t\t\tlogDebug(\n\t\t\t\t`${operation} completed (${duration}ms)`,\n\t\t\t\toperation,\n\t\t\t\t{ duration, ...metadata },\n\t\t\t);\n\t\t\treturn duration;\n\t\t},\n\t};\n}\n\n// ========================================\n// Request Logging Middleware Helper\n// ========================================\n\n/**\n * Creates request logging data for middleware.\n */\nexport function createRequestLog(request: Request): {\n\tcorrelationId: string;\n\tstartTime: number;\n\tlogData: Record;\n} {\n\tconst correlationId = generateCorrelationId();\n\tconst startTime = performance.now();\n\tconst url = new URL(request.url);\n\n\tconst logData = {\n\t\tmethod: request.method,\n\t\tpath: url.pathname,\n\t\tquery: url.search,\n\t\tuserAgent: request.headers.get('user-agent'),\n\t\torigin: request.headers.get('origin'),\n\t\treferer: request.headers.get('referer'),\n\t};\n\n\treturn { correlationId, startTime, logData };\n}\n\n/**\n * Logs request completion.\n */\nexport function logRequestCompletion(\n\tlogData: Record,\n\tresponse: Response,\n\tstartTime: number,\n): void {\n\tconst duration = Math.round(performance.now() - startTime);\n\n\tlogHttpResponse(\n\t\tlogData.method,\n\t\tlogData.path,\n\t\tresponse.status,\n\t\tduration,\n\t);\n}\n\n// ========================================\n// Health Check Logging\n// ========================================\n\n/**\n * Logs application startup.\n */\nexport function logStartup(version: string, environment: string): void {\n\tlogInfo(\n\t\t`SafeHash API v${version} starting in ${environment} mode`,\n\t\t'startup',\n\t\t{ version, environment },\n\t);\n}\n\n/**\n * Logs application shutdown.\n */\nexport function logShutdown(reason: string): void {\n\tlogInfo(\n\t\t`SafeHash API shutting down: ${reason}`,\n\t\t'shutdown',\n\t\t{ reason },\n\t);\n}\n\n/**\n * Logs health check results.\n */\nexport function logHealthCheck(\n\tservice: string,\n\thealthy: boolean,\n\tdetails?: Record,\n): void {\n\tconst level = healthy ? 'INFO' : 'ERROR';\n\tcreateLogEntry(\n\t\tlevel,\n\t\t`Health check ${service}: ${healthy ? 'healthy' : 'unhealthy'}`,\n\t\t'health_check',\n\t\t{ service, healthy, ...details },\n\t);\n}\n\n// ========================================\n// Default Export\n// ========================================\n\nexport default {\n\t// Initialization\n\tinitializeLogging,\n\n\t// Correlation ID management\n\tgenerateCorrelationId,\n\tsetCorrelationId,\n\tgetCorrelationId,\n\tclearCorrelationId,\n\twithCorrelationId,\n\n\t// Core logging\n\tlogDebug,\n\tlogInfo,\n\tlogWarn,\n\tlogError,\n\n\t// Specialized logging\n\tlogHttpRequest,\n\tlogHttpResponse,\n\tlogSecurityEvent,\n\tlogPerformanceEvent,\n\tlogDatabaseOperation,\n\tlogNonceOperation,\n\tlogAuthEvent,\n\tlogCryptoOperation,\n\n\t// Performance monitoring\n\tmeasureAndLog,\n\tcreateTimer,\n\n\t// Request logging\n\tcreateRequestLog,\n\tlogRequestCompletion,\n\n\t// System logging\n\tlogStartup,\n\tlogShutdown,\n\tlogHealthCheck,\n};\n",[],[197,337,353],{"_107":361,"_100":362,"_151":363,"_153":338,"_154":138,"_155":364,"_157":158,"_109":365,"_104":31,"_160":215,"_162":366,"_163":27,"_164":-5,"_165":367,"_103":368},"a8504d4a-57ee-11f0-a739-f69ea79377d9","tracing.ts","a8504eda-57ee-11f0-a739-f69ea79377d9",31,["D",1751534298609],"// deno-lint-ignore-file no-explicit-any\n/**\n * Distributed tracing utilities for SafeHash V2.\n * Provides request tracing, span management, and observability features.\n */\n\nimport { getConfig } from '../config/app-config.ts';\nimport { generateCorrelationId, logDebug, logInfo, logWarn } from './logging.ts';\nimport type { TraceSpan, TracingConfig } from '../config/app-types.ts';\n\n// ========================================\n// Tracing Configuration\n// ========================================\n\nlet tracingConfig: TracingConfig | null = null;\nlet isTracingEnabled = false;\nlet activeSpans = new Map();\nlet rootSpan: TraceSpan | null = null;\n\n/**\n * Initializes the tracing system.\n */\nexport function initializeTracing(): void {\n\tconst config = getConfig();\n\ttracingConfig = config.tracing || null;\n\tisTracingEnabled = tracingConfig?.enabled || false;\n\n\tif (isTracingEnabled) {\n\t\tlogInfo(\n\t\t\t`Tracing initialized - Service: ${tracingConfig?.serviceName}, Sampling: ${\n\t\t\t\t(tracingConfig?.samplingRate || 0) * 100\n\t\t\t}%`,\n\t\t\t'tracing_init',\n\t\t);\n\t}\n}\n\n/**\n * Checks if tracing is enabled and should sample this request.\n */\nfunction shouldTrace(): boolean {\n\tif (!isTracingEnabled || !tracingConfig) {\n\t\treturn false;\n\t}\n\n\t// Apply sampling rate\n\treturn Math.random() < tracingConfig.samplingRate;\n}\n\n// ========================================\n// Span Management\n// ========================================\n\n/**\n * Generates a unique span ID.\n */\nfunction generateSpanId(): string {\n\tconst bytes = crypto.getRandomValues(new Uint8Array(8));\n\treturn Array.from(bytes)\n\t\t.map((b) => b.toString(16).padStart(2, '0'))\n\t\t.join('');\n}\n\n/**\n * Generates a unique trace ID.\n */\nfunction generateTraceId(): string {\n\tconst bytes = crypto.getRandomValues(new Uint8Array(16));\n\treturn Array.from(bytes)\n\t\t.map((b) => b.toString(16).padStart(2, '0'))\n\t\t.join('');\n}\n\n/**\n * Creates a new trace span.\n */\nexport function createSpan(\n\toperationName: string,\n\tparentSpan?: TraceSpan,\n\ttags: Record = {},\n): TraceSpan | null {\n\tif (!shouldTrace()) {\n\t\treturn null;\n\t}\n\n\tconst correlationId = generateCorrelationId();\n\n\tconst span: TraceSpan = {\n\t\ttraceId: parentSpan?.traceId || generateTraceId(),\n\t\tspanId: generateSpanId(),\n\t\tparentSpanId: parentSpan?.spanId,\n\t\toperationName,\n\t\tstartTime: performance.now(),\n\t\ttags: {\n\t\t\tservice: tracingConfig?.serviceName || 'safehash-api',\n\t\t\tcorrelationId,\n\t\t\t...tags,\n\t\t},\n\t\tlogs: [],\n\t};\n\n\tactiveSpans.set(span.spanId, span);\n\n\tif (!parentSpan) {\n\t\trootSpan = span;\n\t}\n\n\tlogDebug(\n\t\t`Started span: ${operationName}`,\n\t\t'tracing_span_start',\n\t\t{\n\t\t\ttraceId: span.traceId,\n\t\t\tspanId: span.spanId,\n\t\t\tparentSpanId: span.parentSpanId,\n\t\t\tcorrelationId,\n\t\t\ttags: span.tags,\n\t\t},\n\t);\n\n\treturn span;\n}\n\n/**\n * Finishes a trace span.\n */\nexport function finishSpan(span: TraceSpan | null, tags: Record = {}): void {\n\tif (!span || !isTracingEnabled) {\n\t\treturn;\n\t}\n\n\tspan.endTime = performance.now();\n\tspan.tags = { ...span.tags, ...tags };\n\n\tconst duration = span.endTime - span.startTime;\n\n\tlogDebug(\n\t\t`Finished span: ${span.operationName} (${duration.toFixed(2)}ms)`,\n\t\t'tracing_span_finish',\n\t\t{\n\t\t\ttraceId: span.traceId,\n\t\t\tspanId: span.spanId,\n\t\t\tduration,\n\t\t\tcorrelationId: span.tags.correlationId,\n\t\t\ttags: span.tags,\n\t\t},\n\t);\n\n\t// Export span if endpoint is configured\n\tif (tracingConfig?.endpoint) {\n\t\texportSpan(span).catch((error) => {\n\t\t\tlogWarn(\n\t\t\t\t`Failed to export span to ${tracingConfig?.endpoint}`,\n\t\t\t\t'tracing_export_error',\n\t\t\t\t{\n\t\t\t\t\terror: error.message,\n\t\t\t\t\tspanId: span.spanId,\n\t\t\t\t\tcorrelationId: span.tags.correlationId,\n\t\t\t\t},\n\t\t\t);\n\t\t});\n\t}\n\n\tactiveSpans.delete(span.spanId);\n\n\tif (span === rootSpan) {\n\t\trootSpan = null;\n\t}\n}\n\n/**\n * Adds a log entry to a span.\n */\nexport function addSpanLog(\n\tspan: TraceSpan | null,\n\tlevel: string,\n\tmessage: string,\n\tfields: Record = {},\n): void {\n\tif (!span || !isTracingEnabled) {\n\t\treturn;\n\t}\n\n\tspan.logs.push({\n\t\ttimestamp: Date.now(),\n\t\tfields: {\n\t\t\tlevel,\n\t\t\tmessage,\n\t\t\t...fields,\n\t\t},\n\t});\n}\n\n/**\n * Adds tags to a span.\n */\nexport function addSpanTags(span: TraceSpan | null, tags: Record): void {\n\tif (!span || !isTracingEnabled) {\n\t\treturn;\n\t}\n\n\tspan.tags = { ...span.tags, ...tags };\n}\n\n/**\n * Sets an error tag on a span.\n */\nexport function setSpanError(span: TraceSpan | null, error: Error): void {\n\tif (!span || !isTracingEnabled) {\n\t\treturn;\n\t}\n\n\taddSpanTags(span, {\n\t\terror: true,\n\t\t'error.name': error.name,\n\t\t'error.message': error.message,\n\t});\n\n\taddSpanLog(span, 'error', error.message, {\n\t\tstack: error.stack,\n\t});\n}\n\n// ========================================\n// High-Level Tracing Functions\n// ========================================\n\n/**\n * Traces an HTTP request.\n */\nexport function traceHttpRequest(\n\tmethod: string,\n\tpath: string,\n\theaders: Headers,\n): TraceSpan | null {\n\tconst span = createSpan('http_request', undefined, {\n\t\t'http.method': method,\n\t\t'http.path': path,\n\t\t'http.user_agent': headers.get('user-agent'),\n\t\t'http.origin': headers.get('origin'),\n\t});\n\n\treturn span;\n}\n\n/**\n * Traces an HTTP response.\n */\nexport function traceHttpResponse(\n\tspan: TraceSpan | null,\n\tstatus: number,\n\tresponseSize?: number,\n): void {\n\tif (!span) return;\n\n\taddSpanTags(span, {\n\t\t'http.status_code': status,\n\t\t...(responseSize ? { 'http.response_size': responseSize } : {}),\n\t});\n\n\tif (status >= 400) {\n\t\taddSpanTags(span, { error: true });\n\t\taddSpanLog(span, 'error', `HTTP ${status} response`);\n\t}\n\n\tfinishSpan(span);\n}\n\n/**\n * Traces a database operation.\n */\nexport function traceDatabaseOperation(\n\toperation: string,\n\ttable: string,\n\tparentSpan?: TraceSpan,\n): TraceSpan | null {\n\treturn createSpan('db_operation', parentSpan, {\n\t\t'db.operation': operation,\n\t\t'db.table': table,\n\t\t'db.type': 'sqlite',\n\t});\n}\n\n/**\n * Traces a security check.\n */\nexport function traceSecurityCheck(\n\tcheckType: string,\n\tparentSpan?: TraceSpan,\n): TraceSpan | null {\n\treturn createSpan('security_check', parentSpan, {\n\t\t'security.check_type': checkType,\n\t});\n}\n\n/**\n * Traces a crypto operation.\n */\nexport function traceCryptoOperation(\n\toperation: string,\n\talgorithm: string,\n\tparentSpan?: TraceSpan,\n): TraceSpan | null {\n\treturn createSpan('crypto_operation', parentSpan, {\n\t\t'crypto.operation': operation,\n\t\t'crypto.algorithm': algorithm,\n\t});\n}\n\n/**\n * Traces a business logic operation.\n */\nexport function traceBusinessOperation(\n\toperation: string,\n\tparentSpan?: TraceSpan,\n\ttags: Record = {},\n): TraceSpan | null {\n\treturn createSpan('business_operation', parentSpan, {\n\t\t'business.operation': operation,\n\t\t...tags,\n\t});\n}\n\n// ========================================\n// Async Function Tracing\n// ========================================\n\n/**\n * Wraps an async function with tracing.\n */\nexport function withTracing(\n\toperationName: string,\n\tfn: (...args: T) => Promise,\n\tparentSpan?: TraceSpan,\n\ttags: Record = {},\n): (...args: T) => Promise {\n\treturn async (...args: T): Promise => {\n\t\tconst span = createSpan(operationName, parentSpan, tags);\n\n\t\ttry {\n\t\t\tconst result = await fn(...args);\n\t\t\taddSpanTags(span, { success: true });\n\t\t\treturn result;\n\t\t} catch (error) {\n\t\t\tsetSpanError(span, error instanceof Error ? error : new Error(String(error)));\n\t\t\taddSpanTags(span, { success: false });\n\t\t\tthrow error;\n\t\t} finally {\n\t\t\tfinishSpan(span);\n\t\t}\n\t};\n}\n\n/**\n * Executes a function with a new span context.\n */\nexport async function inSpan(\n\toperationName: string,\n\tfn: (span: TraceSpan | null) => Promise | T,\n\tparentSpan?: TraceSpan,\n\ttags: Record = {},\n): Promise {\n\tconst span = createSpan(operationName, parentSpan, tags);\n\n\ttry {\n\t\tconst result = await fn(span);\n\t\taddSpanTags(span, { success: true });\n\t\treturn result;\n\t} catch (error) {\n\t\tsetSpanError(span, error instanceof Error ? error : new Error(String(error)));\n\t\taddSpanTags(span, { success: false });\n\t\tthrow error;\n\t} finally {\n\t\tfinishSpan(span);\n\t}\n}\n\n// ========================================\n// Request Context Management\n// ========================================\n\nconst requestContexts = new Map();\n\n/**\n * Sets the root span for a request context.\n */\nexport function setRequestSpan(correlationId: string, span: TraceSpan | null): void {\n\tif (span) {\n\t\trequestContexts.set(correlationId, span);\n\t} else {\n\t\trequestContexts.delete(correlationId);\n\t}\n}\n\n/**\n * Gets the root span for a request context.\n */\nexport function getRequestSpan(correlationId: string): TraceSpan | null {\n\treturn requestContexts.get(correlationId) || null;\n}\n\n/**\n * Clears the request context.\n */\nexport function clearRequestContext(correlationId: string): void {\n\tconst span = requestContexts.get(correlationId);\n\tif (span) {\n\t\tfinishSpan(span);\n\t\trequestContexts.delete(correlationId);\n\t}\n}\n\n// ========================================\n// Span Export\n// ========================================\n\n/**\n * Exports a span to the configured tracing endpoint.\n */\nasync function exportSpan(span: TraceSpan): Promise {\n\tif (!tracingConfig?.endpoint) {\n\t\treturn;\n\t}\n\n\ttry {\n\t\tconst spanData = {\n\t\t\ttraceId: span.traceId,\n\t\t\tspanId: span.spanId,\n\t\t\tparentSpanId: span.parentSpanId,\n\t\t\toperationName: span.operationName,\n\t\t\tstartTime: Math.floor(span.startTime * 1000), // Convert to microseconds\n\t\t\tduration: span.endTime ? Math.floor((span.endTime - span.startTime) * 1000) : 0,\n\t\t\ttags: span.tags,\n\t\t\tlogs: span.logs.map((log) => ({\n\t\t\t\ttimestamp: log.timestamp * 1000, // Convert to microseconds\n\t\t\t\tfields: log.fields,\n\t\t\t})),\n\t\t};\n\n\t\tconst response = await fetch(tracingConfig.endpoint, {\n\t\t\tmethod: 'POST',\n\t\t\theaders: {\n\t\t\t\t'Content-Type': 'application/json',\n\t\t\t},\n\t\t\tbody: JSON.stringify({ spans: [spanData] }),\n\t\t});\n\n\t\tif (!response.ok) {\n\t\t\tthrow new Error(`HTTP ${response.status}: ${response.statusText}`);\n\t\t}\n\n\t\tlogDebug('Span exported successfully', 'tracing_export', {\n\t\t\tspanId: span.spanId,\n\t\t\tendpoint: tracingConfig.endpoint,\n\t\t\tcorrelationId: span.tags.correlationId,\n\t\t});\n\t} catch (error) {\n\t\tthrow new Error(`Failed to export span: ${error instanceof Error ? error.message : String(error)}`);\n\t}\n}\n\n/**\n * Exports all active spans (useful for shutdown).\n */\nexport async function exportAllSpans(): Promise {\n\tif (!tracingConfig?.endpoint || activeSpans.size === 0) {\n\t\treturn;\n\t}\n\n\tconst spans = Array.from(activeSpans.values());\n\n\t// Finish all active spans\n\tfor (const span of spans) {\n\t\tif (!span.endTime) {\n\t\t\tspan.endTime = performance.now();\n\t\t}\n\t}\n\n\t// Export in parallel\n\tawait Promise.allSettled(\n\t\tspans.map((span) => exportSpan(span)),\n\t);\n\n\tactiveSpans.clear();\n\trootSpan = null;\n}\n\n// ========================================\n// Tracing Metrics\n// ========================================\n\n/**\n * Gets tracing statistics.\n */\nexport function getTracingStats(): {\n\tenabled: boolean;\n\tactiveSpans: number;\n\tsamplingRate: number;\n\tserviceName: string;\n\tendpoint?: string;\n} {\n\treturn {\n\t\tenabled: isTracingEnabled,\n\t\tactiveSpans: activeSpans.size,\n\t\tsamplingRate: tracingConfig?.samplingRate || 0,\n\t\tserviceName: tracingConfig?.serviceName || 'unknown',\n\t\tendpoint: tracingConfig?.endpoint,\n\t};\n}\n\n/**\n * Gets the current root span.\n */\nexport function getRootSpan(): TraceSpan | null {\n\treturn rootSpan;\n}\n\n/**\n * Gets all active spans.\n */\nexport function getActiveSpans(): TraceSpan[] {\n\treturn Array.from(activeSpans.values());\n}\n\n// ========================================\n// Cleanup\n// ========================================\n\n/**\n * Cleans up expired spans (older than 1 hour).\n */\nexport function cleanupExpiredSpans(): void {\n\tconst oneHourAgo = performance.now() - (60 * 60 * 1000);\n\tconst expiredSpanIds: string[] = [];\n\n\tfor (const [spanId, span] of activeSpans) {\n\t\tif (span.startTime < oneHourAgo) {\n\t\t\texpiredSpanIds.push(spanId);\n\t\t}\n\t}\n\n\tfor (const spanId of expiredSpanIds) {\n\t\tconst span = activeSpans.get(spanId);\n\t\tif (span) {\n\t\t\tlogWarn(\n\t\t\t\t`Cleaning up expired span: ${span.operationName}`,\n\t\t\t\t'tracing_cleanup',\n\t\t\t\t{\n\t\t\t\t\tspanId,\n\t\t\t\t\toperationName: span.operationName,\n\t\t\t\t\tcorrelationId: span.tags.correlationId,\n\t\t\t\t},\n\t\t\t);\n\n\t\t\tfinishSpan(span, { expired: true });\n\t\t}\n\t}\n}\n\n// ========================================\n// Default Export\n// ========================================\n\nexport default {\n\t// Initialization\n\tinitializeTracing,\n\n\t// Span management\n\tcreateSpan,\n\tfinishSpan,\n\taddSpanLog,\n\taddSpanTags,\n\tsetSpanError,\n\n\t// High-level tracing\n\ttraceHttpRequest,\n\ttraceHttpResponse,\n\ttraceDatabaseOperation,\n\ttraceSecurityCheck,\n\ttraceCryptoOperation,\n\ttraceBusinessOperation,\n\n\t// Async tracing\n\twithTracing,\n\tinSpan,\n\n\t// Request context\n\tsetRequestSpan,\n\tgetRequestSpan,\n\tclearRequestContext,\n\n\t// Utilities\n\tgetTracingStats,\n\tgetRootSpan,\n\tgetActiveSpans,\n\texportAllSpans,\n\tcleanupExpiredSpans,\n};\n",[],[197,337,362],{"_107":370,"_100":371,"_151":372,"_153":338,"_154":138,"_155":373,"_157":158,"_109":374,"_104":31,"_160":215,"_162":375,"_163":27,"_164":-5,"_165":376,"_103":377},"a88887c8-57ee-11f0-a324-f69ea79377d9","validation.ts","a8888872-57ee-11f0-a324-f69ea79377d9",32,["D",1751534298973],"// deno-lint-ignore-file no-explicit-any\n\n/**\n * Validation utilities and Zod schemas for SafeHash V2.\n * Provides type-safe validation for all input data and business rules.\n */\n\nimport { z } from 'https://esm.sh/zod@3.22.4';\nimport type { PaymentMode } from '../config/app-types.ts';\nimport { BOOKING_ID_PATTERN, NONCE_PATTERN, TIMESTAMP_PATTERN } from '../config/app-types.ts';\n\n// ========================================\n// Core Validation Schemas\n// ========================================\n\n/**\n * Validates nonce format (32 hex characters).\n */\nexport const NonceSchema = z.string()\n\t.length(32, 'Nonce must be exactly 32 characters')\n\t.regex(NONCE_PATTERN, 'Nonce must contain only lowercase hexadecimal characters');\n\n/**\n * Validates booking ID format.\n */\nexport const BookingIdSchema = z.string()\n\t.min(1, 'Booking ID cannot be empty')\n\t.max(64, 'Booking ID cannot exceed 64 characters')\n\t.regex(BOOKING_ID_PATTERN, 'Booking ID can only contain alphanumeric characters, underscores, and hyphens');\n\n/**\n * Validates timestamp format for payment requests.\n */\nexport const PaymentTimestampSchema = z.string()\n\t.regex(TIMESTAMP_PATTERN, 'Timestamp must be in YYYY-MM-DDTHH:MM:SS format');\n\n/**\n * Validates ISO timestamp format for general use.\n */\nexport const ISOTimestampSchema = z.string()\n\t.datetime({ message: 'Must be a valid ISO datetime string' });\n\n/**\n * Validates payment mode.\n */\nexport const PaymentModeSchema = z.union([\n\tz.literal(0),\n\tz.literal(1),\n\tz.literal(2),\n\tz.literal(3),\n], {\n\terrorMap: () => ({ message: 'Payment mode must be 0, 1, 2, or 3' }),\n});\n\n/**\n * Validates payment amount (must be integer, no decimals).\n */\nexport const PaymentAmountSchema = z.number()\n\t.int('Payment amount must be an integer (no decimals)')\n\t.positive('Payment amount must be positive')\n\t.max(999999999, 'Payment amount too large'); // 999,999,999 cents = $9,999,999.99\n\n/**\n * Validates API key format.\n */\nexport const ApiKeySchema = z.string()\n\t.min(10, 'API key too short')\n\t.max(128, 'API key too long')\n\t.regex(/^[A-Za-z0-9_-]+$/, 'API key contains invalid characters');\n\n/**\n * Validates username format.\n */\nexport const UsernameSchema = z.string()\n\t.min(3, 'Username must be at least 3 characters')\n\t.max(50, 'Username cannot exceed 50 characters')\n\t.regex(/^[A-Za-z0-9_-]+$/, 'Username can only contain alphanumeric characters, underscores, and hyphens');\n\n/**\n * Validates password (basic length check).\n */\nexport const PasswordSchema = z.string()\n\t.min(6, 'Password must be at least 6 characters')\n\t.max(128, 'Password cannot exceed 128 characters');\n\n/**\n * Validates merchant unique payment ID.\n */\nexport const MerchantPaymentIdSchema = z.string()\n\t.min(1, 'Merchant payment ID cannot be empty')\n\t.max(100, 'Merchant payment ID cannot exceed 100 characters')\n\t.regex(/^[A-Za-z0-9_-]+$/, 'Merchant payment ID can only contain alphanumeric characters, underscores, and hyphens');\n\n/**\n * Validates email format (honeypot detection).\n */\nexport const EmailSchema = z.string()\n\t.email('Invalid email format')\n\t.optional();\n\n/**\n * Validates IP address format.\n */\nexport const IPAddressSchema = z.string()\n\t.ip({ message: 'Invalid IP address format' });\n\n/**\n * Validates correlation ID format.\n */\nexport const CorrelationIdSchema = z.string()\n\t.uuid('Correlation ID must be a valid UUID');\n\n// ========================================\n// Request Validation Schemas\n// ========================================\n\n// PaymentNonceRequestSchema removed - now defined in OpenAPI spec as CreatePaymentNonceRequest\n\n// PaymentHashRequestSchema removed - now defined in OpenAPI spec as CreatePaymentHashRequest\n\n// FingerprintStatusParamsSchema removed - path validation handled by OpenAPI middleware\n\n/**\n * Validates headers that require specific formats.\n */\nexport const SecurityHeadersSchema = z.object({\n\torigin: z.string().url().optional(),\n\treferer: z.string().url().optional(),\n\thost: z.string().min(1).optional(),\n\t'user-agent': z.string().optional(),\n\t'x-payment-nonce': NonceSchema.optional(),\n});\n\n// ========================================\n// Response Validation Schemas\n// ========================================\n\n/**\n * Validates nonce response format.\n */\nexport const NonceResponseSchema = z.object({\n\tnonce: NonceSchema,\n\ttimestamp: z.string(),\n\tsignature: z.string().min(1),\n});\n\n/**\n * Validates payment nonce response format.\n */\nexport const PaymentNonceResponseSchema = z.object({\n\tnonce: NonceSchema,\n\texpiresIn: z.number().int().positive(),\n\tbookingId: BookingIdSchema.optional(),\n\treused: z.boolean().optional(),\n\ttimestamp: z.string(),\n\tsignature: z.string().min(1),\n});\n\n/**\n * Validates payment hash response format.\n */\nexport const PaymentHashResponseSchema = z.object({\n\thash: z.string().min(64), // SHA3-512 is 128 hex characters\n\ttimestamp: z.string(),\n\tsignature: z.string().min(1),\n});\n\n// FingerprintStatusResponseSchema removed - now defined in OpenAPI spec as FingerprintStatusResponse\n\n/**\n * Validates error response format.\n */\nexport const ErrorResponseSchema = z.object({\n\terror: z.string().min(1),\n\tdetails: z.array(z.string()).optional(),\n\tmissing: z.array(z.string()).optional(),\n\tretryAfter: z.number().int().positive().optional(),\n});\n\n// ========================================\n// SQL Sanitization\n// ========================================\n\n/**\n * Sanitizes SQL string to prevent injection attacks.\n * Throws error for invalid input types to ensure type safety.\n */\nexport function sanitizeSQL(str: string): string {\n\tif (typeof str !== 'string') {\n\t\tthrow new Error('sanitizeSQL expects a string input');\n\t}\n\n\treturn str\n\t\t.replace(/'/g, \"''\") // Escape single quotes\n\t\t.replace(/\\0/g, '') // Remove null bytes\n\t\t.replace(/;.*$/g, '') // Prevent query chaining\n\t\t.slice(0, 255); // Limit input length\n}\n\n/**\n * Validates and sanitizes SQL string with Zod schema.\n */\nexport const SQLStringSchema = z.string()\n\t.max(255, 'Input too long for SQL field')\n\t.transform(sanitizeSQL);\n\n// ========================================\n// Business Logic Validation\n// ========================================\n\n/**\n * Validates nonce format using the pattern from constants.\n */\nexport function isValidNonceFormat(nonce: string): boolean {\n\ttry {\n\t\tNonceSchema.parse(nonce);\n\t\treturn true;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\n/**\n * Validates booking ID format using the pattern from constants.\n */\nexport function isValidBookingId(id: string): boolean {\n\ttry {\n\t\tBookingIdSchema.parse(id);\n\t\treturn true;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\n/**\n * Validates payment timestamp format.\n */\nexport function isValidPaymentTimestamp(timestamp: string): boolean {\n\ttry {\n\t\tPaymentTimestampSchema.parse(timestamp);\n\t\treturn true;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\n/**\n * Validates timestamp for replay attack prevention.\n */\nexport function isRequestTimestampValid(\n\ttimestamp: string | undefined,\n\ttoleranceMs: number = 5 * 60 * 1000, // 5 minutes\n): boolean {\n\tif (!timestamp) {\n\t\treturn false; // Timestamp is required for security\n\t}\n\n\ttry {\n\t\tconst requestTime = new Date(timestamp).getTime();\n\t\tconst now = Date.now();\n\n\t\tif (isNaN(requestTime)) {\n\t\t\treturn false;\n\t\t}\n\n\t\treturn (now - requestTime) <= toleranceMs && (now - requestTime) >= 0;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\n/**\n * Validates payment mode value.\n */\nexport function isValidPaymentMode(mode: any): mode is PaymentMode {\n\ttry {\n\t\tPaymentModeSchema.parse(mode);\n\t\treturn true;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\n/**\n * Validates payment amount (no decimals, positive integer).\n */\nexport function isValidPaymentAmount(amount: any): boolean {\n\ttry {\n\t\tPaymentAmountSchema.parse(amount);\n\t\treturn true;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\n/**\n * Validates that payment amount string doesn't contain decimals.\n */\nexport function hasNoDecimals(amountString: string): boolean {\n\treturn !/[.,]/.test(amountString);\n}\n\n// ========================================\n// Security Validation\n// ========================================\n\n/**\n * Validates email_verify field for honeypot detection.\n */\nexport function isHoneypotTriggered(emailVerify: string | undefined): boolean {\n\t// Honeypot is triggered if the field is filled (it should be empty)\n\treturn !!(emailVerify && emailVerify.trim().length > 0);\n}\n\n/**\n * Validates origin header against allowed origins.\n */\nexport function isValidOrigin(origin: string | null, allowedOrigins: string[]): boolean {\n\tif (!origin) return false;\n\treturn allowedOrigins.includes(origin);\n}\n\n/**\n * Validates referer header against origin.\n */\nexport function isValidReferer(referer: string | null, origin: string | null): boolean {\n\tif (!referer || !origin) return false;\n\ttry {\n\t\treturn referer.startsWith(origin);\n\t} catch {\n\t\treturn false;\n\t}\n}\n\n/**\n * Validates host header against expected host.\n */\nexport function isValidHost(host: string | null, expectedHost: string): boolean {\n\tif (!host) return false;\n\treturn host === expectedHost;\n}\n\n/**\n * Validates IP address format and extracts from headers.\n */\nexport function extractAndValidateIP(headers: Headers): string {\n\t// Check for Cloudflare headers first\n\tconst cfConnectingIP = headers.get('cf-connecting-ip');\n\tif (cfConnectingIP) {\n\t\ttry {\n\t\t\tIPAddressSchema.parse(cfConnectingIP);\n\t\t\treturn cfConnectingIP;\n\t\t} catch {\n\t\t\t// Fall through to next option\n\t\t}\n\t}\n\n\tconst trueClientIP = headers.get('true-client-ip');\n\tif (trueClientIP) {\n\t\ttry {\n\t\t\tIPAddressSchema.parse(trueClientIP);\n\t\t\treturn trueClientIP;\n\t\t} catch {\n\t\t\t// Fall through to next option\n\t\t}\n\t}\n\n\t// Check X-Forwarded-For (may contain multiple IPs)\n\tconst xForwardedFor = headers.get('x-forwarded-for');\n\tif (xForwardedFor) {\n\t\tconst firstIP = xForwardedFor.split(',')[0].trim();\n\t\ttry {\n\t\t\tIPAddressSchema.parse(firstIP);\n\t\t\treturn firstIP;\n\t\t} catch {\n\t\t\t// Fall through to unknown\n\t\t}\n\t}\n\n\treturn 'unknown';\n}\n\n// ========================================\n// Validation Error Helpers\n// ========================================\n\n/**\n * Formats Zod validation errors into user-friendly messages.\n */\nexport function formatValidationErrors(error: z.ZodError): string[] {\n\treturn error.errors.map((err) => {\n\t\tconst path = err.path.length > 0 ? `${err.path.join('.')}: ` : '';\n\t\treturn `${path}${err.message}`;\n\t});\n}\n\n/**\n * Validates request data and returns formatted errors if validation fails.\n */\nexport function validateRequestData(\n\tschema: z.ZodSchema,\n\tdata: unknown,\n): { success: true; data: T } | { success: false; errors: string[] } {\n\ttry {\n\t\tconst validatedData = schema.parse(data);\n\t\treturn { success: true, data: validatedData };\n\t} catch (error) {\n\t\tif (error instanceof z.ZodError) {\n\t\t\treturn { success: false, errors: formatValidationErrors(error) };\n\t\t}\n\t\treturn { success: false, errors: ['Validation failed: Unknown error'] };\n\t}\n}\n\n/**\n * Validates required fields are present in request.\n */\nexport function checkRequiredFields>(\n\tdata: T,\n\trequiredFields: string[],\n): string[] {\n\tconst missing: string[] = [];\n\n\tfor (const field of requiredFields) {\n\t\tif (data[field] === undefined || data[field] === null || data[field] === '') {\n\t\t\tmissing.push(field);\n\t\t}\n\t}\n\n\treturn missing;\n}\n\n// ========================================\n// Type Guards with Validation\n// ========================================\n\n// isPaymentNonceRequest removed - validation now handled by OpenAPI middleware\n\n// isPaymentHashRequest removed - validation now handled by OpenAPI middleware\n\n// ========================================\n// Custom Validation Rules\n// ========================================\n\n/**\n * Creates a custom Zod schema for conditional validation.\n */\nexport function conditionalValidation(\n\tcondition: (data: any) => boolean,\n\tschema: z.ZodSchema,\n\tfallbackSchema: z.ZodSchema,\n) {\n\treturn z.any().superRefine((data, ctx) => {\n\t\tconst targetSchema = condition(data) ? schema : fallbackSchema;\n\t\tconst result = targetSchema.safeParse(data);\n\n\t\tif (!result.success) {\n\t\t\tfor (const issue of result.error.issues) {\n\t\t\t\tctx.addIssue(issue);\n\t\t\t}\n\t\t}\n\t});\n}\n\n/**\n * Creates a Zod schema for array validation with size limits.\n */\nexport function createArraySchema(\n\titemSchema: z.ZodSchema,\n\tminItems: number = 0,\n\tmaxItems: number = 100,\n) {\n\treturn z.array(itemSchema)\n\t\t.min(minItems, `Array must contain at least ${minItems} items`)\n\t\t.max(maxItems, `Array cannot contain more than ${maxItems} items`);\n}\n\n// Note: All schemas are already exported at their declaration points above\n\n// ========================================\n// Default Export\n// ========================================\n\nexport default {\n\t// Schemas (core schemas kept, request/response schemas moved to OpenAPI)\n\tNonceSchema,\n\tBookingIdSchema,\n\n\t// Validation functions\n\tisValidNonceFormat,\n\tisValidBookingId,\n\tisValidPaymentTimestamp,\n\tisRequestTimestampValid,\n\tisValidPaymentMode,\n\tisValidPaymentAmount,\n\thasNoDecimals,\n\n\t// Security validation\n\tisHoneypotTriggered,\n\tisValidOrigin,\n\tisValidReferer,\n\tisValidHost,\n\textractAndValidateIP,\n\n\t// SQL sanitization\n\tsanitizeSQL,\n\n\t// Error handling\n\tformatValidationErrors,\n\tvalidateRequestData,\n\tcheckRequiredFields,\n\n\t// Type guards (removed - validation now handled by OpenAPI middleware)\n\n\t// Utilities\n\tconditionalValidation,\n\tcreateArraySchema,\n};\n",[],[197,337,371],[197,337],{"_107":380,"_100":381,"_151":382,"_153":198,"_154":138,"_155":137,"_157":158,"_109":383,"_104":181,"_160":182,"_162":384,"_163":27,"_164":-5,"_165":385,"_103":386},"dda6e666-57ee-11f0-961c-f69ea79377d9","main.ts","a7de63d8-57ee-11f0-bb18-f69ea79377d9",["D",1751534388091],"/**\n * Main orchestrator for SafeHash V2 modular architecture.\n * Initializes all services, sets up routing, and serves as the primary entry point.\n */\nimport { loadDevEnvironment } from './config/env-loader.ts';\nimport { getConfig, loadConfig } from './config/app-config.ts';\nimport { initializeTracing } from './utils/tracing.ts';\nimport { initializeLogging, logError, logInfo, logWarn } from './utils/logging.ts';\nimport { createOpenAPIRouter } from './gateway/router.ts';\nimport type { OpenAPIRouter } from './gateway/router.ts';\nimport { createOpenAPILoader } from './config/openapi-loader.ts';\nimport type { SecurityService, ServerConfig } from './config/app-types.ts';\n\n// Define ExecutionContext for Val Town/Cloudflare Workers compatibility\ninterface ExecutionContext {\n\twaitUntil(promise: Promise): void;\n\tpassThroughOnException(): void;\n}\n\n// ========================================\n// Application State\n// ========================================\n\ninterface AppState {\n\trouter?: OpenAPIRouter;\n\tserver?: Deno.HttpServer;\n\tisShuttingDown: boolean;\n\tstartTime: Date;\n}\n\nconst appState: AppState = {\n\tisShuttingDown: false,\n\tstartTime: new Date(),\n};\n\n// ========================================\n// Application Lifecycle\n// ========================================\n\n/**\n * Initializes the entire SafeHash V2 application.\n */\nasync function initializeApplication(): Promise {\n\ttry {\n\t\tlogInfo('🚀 Starting SafeHash V2 initialization...', 'app_init_start');\n\n\t\t// Step 1: Initialize configuration\n\t\tlogInfo('📋 Initializing configuration...', 'config_init');\n\t\tconst config = loadConfig();\n\n\t\t// Validate environment variables\n\t\tconst { validateEnvironment } = await import('./config/app-config.ts');\n\t\tvalidateEnvironment();\n\n\t\t// Step 2: Initialize logging system\n\t\tlogInfo('📝 Initializing logging system...', 'logging_init');\n\t\tinitializeLogging();\n\n\t\t// Step 3: Initialize distributed tracing\n\t\tlogInfo('🔍 Initializing distributed tracing...', 'tracing_init');\n\t\tinitializeTracing();\n\n\t\t// Step 4: Create OpenAPI loader and generate report\n\t\tlogInfo('🛣️ Loading OpenAPI specification...', 'openapi_init');\n\t\tconst openAPILoader = await createOpenAPILoader('./openapi.yaml');\n\n\t\t// Generate endpoint report to show what was loaded from OpenAPI\n\t\topenAPILoader.generateEndpointReport();\n\n\t\t// Step 5: Create and initialize router\n\t\tlogInfo('🛣️ Creating OpenAPI router...', 'router_init');\n\t\tappState.router = createOpenAPIRouter();\n\t\t// await appState.router.initialize();\n\n\t\tlogInfo('✅ SafeHash V2 initialization complete!', 'app_init_complete', {\n\t\t\tversion: '2.0.0',\n\t\t\tenvironment: config.server.environment,\n\t\t\tport: config.server.port,\n\t\t\thost: config.server.host,\n\t\t});\n\t} catch (error) {\n\t\tconst err = error instanceof Error ? error : new Error(String(error));\n\t\tlogError(\n\t\t\t`Failed to initialize application: ${err.message}`,\n\t\t\terr,\n\t\t\t'app_init_failed',\n\t\t);\n\t\tthrow err;\n\t}\n}\n\n/**\n * Starts the HTTP server.\n */\nfunction startServer():\n\t| void\n\t| ((\n\t\trequest: Request,\n\t\tenv?: Record,\n\t\texecutionCtx?: ExecutionContext,\n\t) => Response | Promise) {\n\tif (!appState.router) {\n\t\tthrow new Error('Router not initialized. Call initializeApplication() first.');\n\t}\n\n\tconst config: ServerConfig = getConfig('server');\n\tconst app = appState.router.getApp();\n\n\ttry {\n\t\tlogInfo('🌐 Starting HTTP server...', 'server_start', {\n\t\t\thost: config.host,\n\t\t\tport: config.port,\n\t\t\tenvironment: config.environment,\n\t\t});\n\n\t\t// For Val Town deployment, we need to export the fetch handler\n\t\tif (typeof Deno !== 'undefined' && Deno.serve) {\n\t\t\t// Deno 1.38+ serve API\n\t\t\tappState.server = Deno.serve({\n\t\t\t\thostname: config.host,\n\t\t\t\tport: config.port,\n\t\t\t\tonListen: ({ hostname, port }) => {\n\t\t\t\t\tlogInfo(\n\t\t\t\t\t\t`🎉 SafeHash V2 server running at http://${hostname}:${port}`,\n\t\t\t\t\t\t'server_listening',\n\t\t\t\t\t\t{ hostname, port, pid: Deno.pid },\n\t\t\t\t\t);\n\t\t\t\t},\n\t\t\t}, app.fetch);\n\t\t\treturn;\n\t\t} else {\n\t\t\t// Fallback for Val Town or other environments\n\t\t\tlogInfo('🔧 Using fallback server mode for Val Town compatibility', 'server_fallback');\n\t\t\treturn app.fetch;\n\t\t}\n\t} catch (error) {\n\t\tconst err = error instanceof Error ? error : new Error(String(error));\n\t\tlogError(\n\t\t\t`Failed to start server: ${err.message}`,\n\t\t\terr,\n\t\t\t'server_start_failed',\n\t\t\t{ host: config.host, port: config.port },\n\t\t);\n\t\tthrow err;\n\t}\n}\n\n/**\n * Gracefully shuts down the application.\n */\nasync function shutdownApplication(signal?: string): Promise {\n\tif (appState.isShuttingDown) {\n\t\tlogWarn('Shutdown already in progress', 'shutdown_already_in_progress');\n\t\treturn;\n\t}\n\n\tappState.isShuttingDown = true;\n\n\tlogInfo(`🛑 Shutting down SafeHash V2 (signal: ${signal || 'manual'})...`, 'app_shutdown_start');\n\n\ttry {\n\t\t// Close server\n\t\tif (appState.server) {\n\t\t\tlogInfo('🌐 Closing HTTP server...', 'server_shutdown');\n\t\t\tawait appState.server.shutdown();\n\t\t}\n\n\t\t// Shutdown router and services\n\t\tif (appState.router) {\n\t\t\tlogInfo('🛣️ Shutting down router and services...', 'router_shutdown');\n\t\t\tawait appState.router.shutdown();\n\t\t}\n\n\t\t// Cleanup any remaining tasks\n\t\tawait cleanupOnShutdown();\n\n\t\tconst uptime = Date.now() - appState.startTime.getTime();\n\t\tlogInfo(\n\t\t\t`✅ SafeHash V2 shutdown complete (uptime: ${Math.round(uptime / 1000)}s)`,\n\t\t\t'app_shutdown_complete',\n\t\t\t{ uptime_ms: uptime, signal },\n\t\t);\n\t} catch (error) {\n\t\tconst err = error instanceof Error ? error : new Error(String(error));\n\t\tlogError(\n\t\t\t`Error during shutdown: ${err.message}`,\n\t\t\terr,\n\t\t\t'shutdown_error',\n\t\t);\n\t}\n}\n\n/**\n * Performs cleanup tasks during shutdown.\n */\nasync function cleanupOnShutdown(): Promise {\n\ttry {\n\t\t// Export any remaining tracing spans\n\t\tconst { exportAllSpans } = await import('./utils/tracing.ts');\n\t\tawait exportAllSpans();\n\n\t\t// Cleanup expired rate limits\n\t\tif (appState.router) {\n\t\t\tconst services = appState.router.getServices();\n\t\t\t// Cleanup expired rate limits if method exists\n\t\t\tif ('cleanupExpiredRateLimits' in services.security) {\n\t\t\t\t(services.security as SecurityService & { cleanupExpiredRateLimits: () => void }).cleanupExpiredRateLimits();\n\t\t\t}\n\n\t\t\t// Cleanup expired nonces\n\t\t\tawait services.database.cleanupExpiredNonces();\n\t\t}\n\n\t\tlogInfo('🧹 Cleanup tasks completed', 'cleanup_complete');\n\t} catch (error) {\n\t\tlogWarn(\n\t\t\t`Cleanup tasks failed: ${error instanceof Error ? error.message : String(error)}`,\n\t\t\t'cleanup_failed',\n\t\t);\n\t}\n}\n\n/**\n * Sets up signal handlers for graceful shutdown.\n */\n/**\n * Sets up signal handlers for graceful shutdown.\n * Only uses signals supported by the current OS.\n */\nfunction setupSignalHandlers(): void {\n\tif (typeof Deno !== 'undefined') {\n\t\tconst isWindows = Deno.build?.os === 'windows';\n\t\tif (isWindows) {\n\t\t\tDeno.addSignalListener('SIGINT', () => shutdownApplication('SIGINT'));\n\t\t\tDeno.addSignalListener('SIGBREAK', () => shutdownApplication('SIGBREAK'));\n\t\t\tDeno.addSignalListener('SIGHUP', () => shutdownApplication('SIGHUP'));\n\t\t} else {\n\t\t\tDeno.addSignalListener('SIGINT', () => shutdownApplication('SIGINT'));\n\t\t\tDeno.addSignalListener('SIGTERM', () => shutdownApplication('SIGTERM'));\n\t\t}\n\t}\n\n\t// Handle uncaught exceptions\n\tglobalThis.addEventListener('error', (event) => {\n\t\tlogError(\n\t\t\t`Uncaught exception: ${event.error?.message || 'Unknown error'}`,\n\t\t\tevent.error,\n\t\t\t'uncaught_exception',\n\t\t);\n\t});\n\n\tglobalThis.addEventListener('unhandledrejection', (event) => {\n\t\tlogError(\n\t\t\t`Unhandled promise rejection: ${event.reason?.message || event.reason}`,\n\t\t\tevent.reason instanceof Error ? event.reason : new Error(String(event.reason)),\n\t\t\t'unhandled_rejection',\n\t\t);\n\t});\n\n\tlogInfo('📡 Signal handlers configured', 'signal_handlers_ready');\n}\n\n// ========================================\n// Main Application Entry Point\n// ========================================\n\n/**\n * Main application entry point.\n */\nasync function main(): Promise<\n\t| ((request: Request, env?: Record, executionCtx?: ExecutionContext) => Response | Promise)\n\t| void\n> {\n\ttry {\n\t\tconsole.log('🚀 SafeHash V2 - Payment Security API');\n\t\tconsole.log('=====================================');\n\t\tawait loadDevEnvironment();\n\t\t// Setup signal handlers first\n\t\tsetupSignalHandlers();\n\n\t\t// Initialize the application\n\t\tawait initializeApplication();\n\n\t\t// Start the server\n\t\tconst fetchHandler = startServer();\n\n\t\t// For Val Town deployment, return the fetch handler\n\t\tif (fetchHandler && typeof fetchHandler === 'function') {\n\t\t\treturn fetchHandler;\n\t\t}\n\t} catch (error) {\n\t\tconst err = error instanceof Error ? error : new Error(String(error));\n\t\tconsole.error('❌ Failed to start SafeHash V2:', err.message);\n\t\tconsole.error(err.stack);\n\n\t\t// Attempt graceful shutdown even on startup failure\n\t\tawait shutdownApplication('startup_error');\n\n\t\t// Exit with error code\n\t\tif (typeof Deno !== 'undefined') {\n\t\t\tDeno.exit(1);\n\t\t}\n\t}\n}\n\nexport default main;\n\nif (import.meta.main) {\n\tmain().catch((error) => {\n\t\tconsole.error('Fatal error:', error);\n\t\tif (typeof Deno !== 'undefined') {\n\t\t\tDeno.exit(1);\n\t\t}\n\t});\n}\n",[],[197,381],{"_107":388,"_100":389,"_151":390,"_153":198,"_154":138,"_155":391,"_157":158,"_109":392,"_104":31,"_160":393,"_162":394,"_163":27,"_164":-5,"_165":395,"_103":396},"a7e9fae0-57ee-11f0-9006-f69ea79377d9","openapi.yaml","a7e9fbb2-57ee-11f0-9006-f69ea79377d9",24,["D",1751534297937],"file","openapi: 3.1.0\ninfo:\n title: SafeHash Payment Security API\n version: 2.0.0\n description: |\n Enhanced payment security API with nonce-based fingerprint generation.\n Prevents mass harvesting of payment fingerprints through server-controlled\n single-use tokens and comprehensive security validation.\n contact:\n name: SafeHash API Support\n email: support@safehash.example.com\n license:\n name: MIT\n url: https://opensource.org/licenses/MIT\n\nservers:\n - url: https://ianmenethil--704f93e856ad11f09f73f69ea79377d9.web.val.run\n description: Production server\n - url: http://localhost:8000\n description: Development server\n\npaths:\n /api/v1/page-nonce:\n get:\n summary: Generate page-load nonce\n description: |\n Generates a page-load nonce for meta-tag security.\n Used for client-side initialization and basic page security.\n operationId: generatePageNonce\n tags:\n - Security\n security:\n - corsOrigin: []\n responses:\n '200':\n description: Page nonce generated successfully\n headers:\n X-Response-Signature:\n description: HMAC signature of the response\n schema:\n type: string\n example: 'a1b2c3d4e5f6...'\n X-Response-Time:\n description: Response timestamp\n schema:\n type: string\n example: '1703123456789'\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/NonceResponse'\n example:\n nonce: 'a1b2c3d4e5f67890abcdef1234567890'\n timestamp: '1703123456789'\n signature: 'a1b2c3d4e5f6...'\n '500':\n $ref: '#/components/responses/InternalServerError'\n\n /api/v1/create-payment-nonce:\n post:\n summary: Create payment nonce\n description: |\n Issues a one-time payment nonce for secure payment hash generation.\n Includes booking validation, honeypot detection, and rate limiting.\n Maximum 5 attempts per booking ID within 15 minutes.\n operationId: createPaymentNonce\n tags:\n - Payments\n security:\n - corsOrigin: []\n - refererValidation: []\n requestBody:\n required: true\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/PaymentNonceRequest'\n example:\n bookingId: 'booking_12345678-1234-1234-1234-123456789012'\n timestamp: '2024-01-01T12:00:00'\n email_verify: ''\n responses:\n '200':\n description: Payment nonce created successfully\n headers:\n X-Response-Signature:\n description: HMAC signature of the response\n schema:\n type: string\n X-Response-Time:\n description: Response timestamp\n schema:\n type: string\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/PaymentNonceResponse'\n example:\n nonce: 'b2c3d4e5f67890abcdef1234567890ab'\n expiresIn: 900\n bookingId: 'booking_12345678-1234-1234-1234-123456789012'\n reused: false\n timestamp: '1703123456789'\n signature: 'b2c3d4e5f67890...'\n '400':\n $ref: '#/components/responses/BadRequest'\n '403':\n $ref: '#/components/responses/Forbidden'\n '429':\n $ref: '#/components/responses/RateLimited'\n '500':\n $ref: '#/components/responses/InternalServerError'\n\n /api/v1/create-fingerprint:\n post:\n summary: Generate payment hash\n description: |\n Creates a payment fingerprint hash using a valid nonce.\n Consumes the nonce (single-use) and validates all payment parameters.\n Returns SHA3-512 hash for payment gateway integration.\n operationId: createPaymentHash\n tags:\n - Payments\n security:\n - corsOrigin: []\n - refererValidation: []\n - hostValidation: []\n - nonceHeader: []\n requestBody:\n required: true\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/PaymentHashRequest'\n example:\n apikey: 'LFc3-qneWUmL2bIWSSZZGA'\n username: 'testuser'\n password: 'testpass'\n mode: 0\n paymentAmount: 100000\n merchantUniquePaymentId: 'payment_12345'\n timestamp: '2024-01-01T12:00:00'\n responses:\n '200':\n description: Payment hash generated successfully\n headers:\n X-Response-Signature:\n description: HMAC signature of the response\n schema:\n type: string\n X-Response-Time:\n description: Response timestamp\n schema:\n type: string\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/PaymentHashResponse'\n example:\n hash: 'c3d4e5f67890abcdef1234567890abcd...'\n timestamp: '1703123456789'\n signature: 'c3d4e5f67890...'\n '400':\n $ref: '#/components/responses/BadRequest'\n '403':\n $ref: '#/components/responses/Forbidden'\n '429':\n $ref: '#/components/responses/RateLimited'\n '500':\n $ref: '#/components/responses/InternalServerError'\n\n /api/v1/fingerprint-status/{bookingId}:\n get:\n summary: Check fingerprint status\n description: |\n Checks the status of fingerprint attempts for a specific booking.\n Returns attempt count, unused fingerprints, and retry availability.\n operationId: getFingerprintStatus\n tags:\n - Status\n parameters:\n - name: bookingId\n in: path\n required: true\n description: Booking ID to check status for\n schema:\n type: string\n pattern: '^[a-z0-9_-]{1,64}$'\n example: 'booking_12345678-1234-1234-1234-123456789012'\n responses:\n '200':\n description: Fingerprint status retrieved successfully\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/FingerprintStatusResponse'\n example:\n bookingId: 'booking_12345678-1234-1234-1234-123456789012'\n totalAttempts: 2\n hasUnusedFingerprint: true\n canRetry: true\n remainingAttempts: 3\n '400':\n $ref: '#/components/responses/BadRequest'\n '500':\n $ref: '#/components/responses/InternalServerError'\n\ncomponents:\n schemas:\n NonceResponse:\n type: object\n required:\n - nonce\n - timestamp\n - signature\n properties:\n nonce:\n type: string\n pattern: '^[a-f0-9]{32}$'\n description: 32-character hex nonce\n example: 'a1b2c3d4e5f67890abcdef1234567890'\n timestamp:\n type: string\n description: Response timestamp\n example: '1703123456789'\n signature:\n type: string\n description: HMAC signature of response\n example: 'a1b2c3d4e5f6...'\n\n PaymentNonceRequest:\n type: object\n required:\n - bookingId\n - timestamp\n properties:\n bookingId:\n type: string\n pattern: '^[a-z0-9_-]{1,64}$'\n description: Unique booking identifier\n example: 'booking_12345678-1234-1234-1234-123456789012'\n timestamp:\n type: string\n format: date-time\n description: Request timestamp for replay protection\n example: '2024-01-01T12:00:00'\n email_verify:\n type: string\n description: Honeypot field (should be empty)\n example: ''\n\n PaymentNonceResponse:\n type: object\n required:\n - nonce\n - expiresIn\n - timestamp\n - signature\n properties:\n nonce:\n type: string\n pattern: '^[a-f0-9]{32}$'\n description: Single-use payment nonce\n example: 'b2c3d4e5f67890abcdef1234567890ab'\n expiresIn:\n type: integer\n description: Expiration time in seconds\n example: 900\n bookingId:\n type: string\n description: Associated booking ID\n example: 'booking_12345678-1234-1234-1234-123456789012'\n reused:\n type: boolean\n description: Whether this nonce was reused\n example: false\n timestamp:\n type: string\n description: Response timestamp\n example: '1703123456789'\n signature:\n type: string\n description: HMAC signature of response\n example: 'b2c3d4e5f67890...'\n\n PaymentHashRequest:\n type: object\n required:\n - apikey\n - username\n - password\n - mode\n - paymentAmount\n - merchantUniquePaymentId\n - timestamp\n properties:\n apikey:\n type: string\n description: Payment gateway API key\n example: 'LFc3-qneWUmL2bIWSSZZGA'\n username:\n type: string\n description: Payment gateway username\n example: 'testuser'\n password:\n type: string\n description: Payment gateway password\n example: 'testpass'\n mode:\n type: integer\n enum: [0, 1, 2, 3]\n description: Payment mode (0=Static, 1=Token, 2=Dynamic, 3=Preauth)\n example: 0\n paymentAmount:\n type: integer\n description: Payment amount in cents (no decimals)\n example: 100000\n merchantUniquePaymentId:\n type: string\n description: Unique payment identifier\n example: 'payment_12345'\n timestamp:\n type: string\n pattern: '^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}$'\n description: Timestamp in YYYY-MM-DDTHH:MM:SS format\n example: '2024-01-01T12:00:00'\n\n PaymentHashResponse:\n type: object\n required:\n - hash\n - timestamp\n - signature\n properties:\n hash:\n type: string\n description: SHA3-512 payment fingerprint hash\n example: 'c3d4e5f67890abcdef1234567890abcd...'\n timestamp:\n type: string\n description: Response timestamp\n example: '1703123456789'\n signature:\n type: string\n description: HMAC signature of response\n example: 'c3d4e5f67890...'\n\n FingerprintStatusResponse:\n type: object\n required:\n - bookingId\n - totalAttempts\n - hasUnusedFingerprint\n - canRetry\n - remainingAttempts\n properties:\n bookingId:\n type: string\n description: Booking identifier\n example: 'booking_12345678-1234-1234-1234-123456789012'\n totalAttempts:\n type: integer\n description: Total number of attempts\n example: 2\n hasUnusedFingerprint:\n type: boolean\n description: Whether unused fingerprints exist\n example: true\n canRetry:\n type: boolean\n description: Whether more attempts are allowed\n example: true\n remainingAttempts:\n type: integer\n description: Number of attempts remaining\n example: 3\n\n ErrorResponse:\n type: object\n required:\n - error\n properties:\n error:\n type: string\n description: Error message\n example: 'Invalid request parameters'\n details:\n type: array\n items:\n type: string\n description: Additional error details\n example: ['Missing required field: bookingId']\n missing:\n type: array\n items:\n type: string\n description: Missing required fields\n example: ['apikey', 'username']\n retryAfter:\n type: integer\n description: Retry delay in seconds\n example: 900\n\n responses:\n BadRequest:\n description: Bad request - invalid parameters\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/ErrorResponse'\n example:\n error: 'Invalid request parameters'\n details: ['bookingId must match pattern ^[a-z0-9_-]{1,64}$']\n\n Forbidden:\n description: Forbidden - security validation failed\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/ErrorResponse'\n example:\n error: 'Invalid origin'\n\n RateLimited:\n description: Too many requests\n headers:\n retry-after:\n description: Seconds to wait before retrying\n schema:\n type: integer\n example: 900\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/ErrorResponse'\n example:\n error: 'Too many requests. Please wait before trying again.'\n retryAfter: 900\n\n InternalServerError:\n description: Internal server error\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/ErrorResponse'\n example:\n error: 'Internal server error'\n\n # Added responses below\n MethodNotAllowed:\n description: Method not allowed for this endpoint\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/ErrorResponse'\n example:\n error: 'Method Not Allowed'\n details: ['The requested HTTP method is not supported for this resource.']\n\n TemporaryRedirect:\n description: Resource temporarily moved\n headers:\n Location:\n description: The URL to redirect to\n schema:\n type: string\n format: url\n example: 'https://new.example.com/resource'\n content:\n application/json:\n schema:\n type: object\n properties:\n message:\n type: string\n example: 'Resource has been temporarily moved.'\n\n NotImplemented:\n description: The requested functionality is not yet implemented\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/ErrorResponse'\n example:\n error: 'Not Implemented'\n details: ['This endpoint is defined but the server functionality is not yet available.']\n\n securitySchemes:\n corsOrigin:\n type: apiKey\n in: header\n name: Origin\n description: CORS origin validation\n refererValidation:\n type: apiKey\n in: header\n name: Referer\n description: Referer header validation\n hostValidation:\n type: apiKey\n in: header\n name: Host\n description: Host header validation\n nonceHeader:\n type: apiKey\n in: header\n name: X-Payment-Nonce\n description: Payment nonce header\n\ntags:\n - name: Security\n description: Security-related endpoints\n - name: Payments\n description: Payment processing endpoints\n - name: Status\n description: Status checking endpoints\n\nx-deno-config:\n permissions:\n - --allow-net\n - --allow-env\n dependencies:\n - 'https://deno.land/std@0.210.0/http/server.ts'\n - 'https://deno.land/std@0.210.0/crypto/mod.ts'\n - 'https://deno.land/std@0.210.0/log/mod.ts'\n - 'https://esm.sh/zod@3.22.4'\n",[],[197,389],[197],{"_107":399,"_100":400,"_151":401,"_153":-5,"_154":138,"_155":402,"_157":158,"_109":403,"_104":31,"_160":393,"_162":404,"_163":27,"_164":-5,"_165":405,"_103":406},"a7253502-57ee-11f0-9006-f69ea79377d9",".gitignore","a72535ca-57ee-11f0-9006-f69ea79377d9",11,["D",1751534296586],".git\n.vscode\n.cursorrules\n.DS_Store\nnode_modules\nvendor\n*.md\n*.txt\n.env.dev\n.env\n**.env**\ntests/\nclient/_builder.ts\nclient/build.ps1\nclient/build.sh\n.claude/\ntests/\n.cursorrules\nserver/.env.example\n.bak/\n.bak\ntests\n.bak/old-server.ts\nold-server.ts.bak\nserver/old-server.ts.bak",[],[400],{"_107":408,"_100":409,"_151":410,"_153":-5,"_154":138,"_155":411,"_157":158,"_109":412,"_104":31,"_160":393,"_162":413,"_163":27,"_164":-5,"_165":414,"_103":415},"a71b34da-57ee-11f0-a324-f69ea79377d9",".vtignore","a71b35d4-57ee-11f0-a324-f69ea79377d9",10,["D",1751534296584],".git\n.vscode\n.cursorrules\n.DS_Store\nnode_modules\nvendor\ndeno.json\nserver/deno.json\n.git\n.vscode\n.cursorrules\n.DS_Store\nnode_modules\nvendor\n*.md\n*.txt\n.env.dev\n.env\n**.env**\ntests/\nclient/_builder.ts\nclient/build.ps1\nclient/build.sh\n.claude/\ntests/\n.cursorrules\nserver/.env.example\n.bak/\n.bak\ntests\n.bak/old-server.ts\nold-server.ts.bak\nserver/old-server.ts.bak",[],[409],{"_107":417,"_100":418,"_151":419,"_153":-5,"_154":138,"_155":420,"_157":158,"_109":421,"_104":31,"_160":393,"_162":422,"_163":27,"_164":-5,"_165":423,"_103":424},"a74dc2c4-57ee-11f0-aa99-f69ea79377d9","extensions.json","a74dc35a-57ee-11f0-aa99-f69ea79377d9",13,["D",1751534296900],"{\n \"recommendations\": [\n \"denoland.vscode-deno\"\n ]\n}",[],[418],{"_107":426,"_100":427,"_151":428,"_153":-5,"_154":138,"_155":181,"_157":158,"_109":429,"_104":31,"_160":215,"_162":73,"_163":27,"_164":-5,"_165":430,"_103":431},"4a4234a2-57ee-11f0-9706-f69ea79377d9","main.tsx","4a423560-57ee-11f0-9706-f69ea79377d9",["D",1751534140808],[],[427],{"_107":433,"_100":389,"_151":434,"_153":-5,"_154":138,"_155":435,"_157":158,"_109":436,"_104":31,"_160":393,"_162":437,"_163":27,"_164":-5,"_165":438,"_103":439},"a752c3b4-57ee-11f0-a176-f69ea79377d9","a752c44a-57ee-11f0-a176-f69ea79377d9",14,["D",1751534296950],"openapi: 3.1.0\ninfo:\n title: Payment Gateway Security API\n version: 1.1.0\n description: |\n This API provides a comprehensive security layer for a payment gateway. It is responsible for three primary functions:\n 1. **CAPTCHA Validation**: Verifies a user has passed a Cloudflare Turnstile challenge.\n 2. **Nonce Generation**: Creates secure, single-use tokens (nonces) that authorize a client to perform a sensitive action. This includes protections against replay attacks, rate limiting, and bot detection.\n 3. **Payment Hash Creation**: Generates a cryptographic hash (fingerprint) of payment details, which is the sensitive action protected by the nonce.\n\n ## Security Architecture\n\n **Multi-Layer Defense Strategy:**\n Every request passes through multiple security layers implemented as middleware:\n\n 1. **CORS & Origin Validation**: Validates request origin, referer, and host headers\n 2. **Security Headers**: Applies comprehensive security headers (HSTS, CSP, etc.)\n 3. **Rate Limiting**: IP-based rate limiting to prevent abuse and harvesting attacks\n 4. **Request Validation**: OpenAPI schema validation for all request/response data\n 5. **Honeypot Protection**: Bot detection via hidden form fields (where applicable)\n 6. **Nonce Authentication**: Single-use tokens for accessing sensitive operations\n\n **Public Access Model:**\n This API is designed for **shareable booking links** that work without user authentication.\n Security is achieved through rate limiting and nonces rather than user login systems.\n\n **No JWT Required:**\n While JWT tokens exist for internal service communication, **client endpoints are intentionally public**\n to support the business requirement of shareable payment links via email/SMS.\n\n The server is located at `https://ianmenethil--704f93e856ad11f09f73f69ea79377d9.web.val.run`.\nservers:\n - url: https://ianmenethil--704f93e856ad11f09f73f69ea79377d9.web.val.run\n description: Production Environment\nsecurity:\n - RateLimiting: []\n - OriginValidation: []\n - SecurityHeaders: []\n - RequestValidation: []\n\ntags:\n - name: Nonce\n description: Operations related to generating and managing secure nonces.\n - name: Payment\n description: Operations related to creating payment hashes.\n - name: Verification\n description: Operations related to user verification, such as CAPTCHA.\npaths:\n /api/v1/validate-turnstile:\n post:\n summary: Validate Cloudflare Turnstile Token\n description: |\n Validates a CAPTCHA token received from the Cloudflare Turnstile widget on the frontend.\n This must be called and return a success response before sensitive operations (like creating a payment hash) can be attempted.\n The server validates this token with the Cloudflare Siteverify API.\n tags:\n - Verification\n operationId: validateTurnstileToken\n security:\n - RateLimiting: []\n - OriginValidation: []\n - SecurityHeaders: []\n - RequestValidation: []\n requestBody:\n description: The Turnstile token obtained from the frontend widget.\n required: true\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/TurnstileValidationRequest\"\n example:\n token: \"0.AAAA...B123.gAAAA...xyz\"\n responses:\n \"200\":\n description: The result of the validation. The `success` field indicates if the token was valid.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/TurnstileValidationResponse\"\n examples:\n success:\n summary: Successful Validation\n value:\n success: true\n challenge_ts: \"2025-07-02T20:00:00.123Z\"\n hostname: \"ianmenethil--69fc148c56a611f09a02f69ea79377d9.web.val.run\"\n action: \"payment\"\n cdata: \"session-abc-123\"\n failure:\n summary: Failed Validation\n value:\n success: false\n error-codes\": [\"invalid-input-response\"]\n \"400\":\n description: Bad Request. The request body is missing the required `token` field.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/Error\"\n example:\n error: Missing required token field\n /api/v1/page-nonce:\n get:\n summary: Get Page-Load Nonce\n description: Issues a nonce intended to be embedded in a web page (e.g., in a meta tag) for initial security setup. This nonce is stored on the server.\n tags:\n - Nonce\n operationId: getPageNonce\n security:\n - RateLimiting: []\n - OriginValidation: []\n - SecurityHeaders: []\n - RequestValidation: []\n responses:\n \"200\":\n description: Successfully generated and returned a page-load nonce.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/PageNonceResponse\"\n example:\n nonce: a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4\n \"500\":\n description: Internal server error, likely due to a failure to store the generated nonce in the database.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/Error\"\n example:\n error: Failed to generate secure token\n /api/v1/create-payment-nonce:\n post:\n summary: Create One-Time Payment Nonce\n description: |\n Creates a secure, single-use payment nonce required to authorize a call to the `/api/create-fingerprint` endpoint.\n - Includes anti-replay protection via a request timestamp.\n - If a valid, unused nonce already exists for the given `bookingId`, it will be returned.\n - Contains a honeypot field (`email_verify`) for bot detection.\n tags:\n - Nonce\n operationId: createPaymentNonce\n security:\n - RateLimiting: []\n - OriginValidation: []\n - HoneypotProtection: []\n - SecurityHeaders: []\n - RequestValidation: []\n requestBody:\n description: A timestamp is required to prevent replay attacks. A `bookingId` can be provided to associate the nonce with a specific transaction.\n required: true\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/CreatePaymentNonceRequest\"\n example:\n bookingId: booking-xyz-789\n timestamp: \"2025-07-02T18:30:00Z\"\n responses:\n \"200\":\n description: Successfully created or reused a payment nonce. The response is signed with an HMAC signature.\n headers:\n X-Response-Signature:\n $ref: \"#/components/headers/X-Response-Signature\"\n X-Response-Time:\n $ref: \"#/components/headers/X-Response-Time\"\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/CreatePaymentNonceResponse\"\n example:\n nonce: 112233445566778899aabbccddeeff00\n expiresIn: 900\n bookingId: booking-xyz-789\n timestamp: \"1720000000000\"\n signature: \"hmac_sha256_signature_of_the_response_body\"\n \"400\":\n description: Bad Request. The request body is malformed, the timestamp is invalid/expired, or the booking ID has an invalid format.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/Error\"\n examples:\n invalidTimestamp:\n summary: Expired Timestamp\n value:\n error: Request expired or invalid timestamp\n invalidBookingId:\n summary: Invalid Booking ID\n value:\n error: Invalid booking ID format\n \"403\":\n description: Forbidden. The request was blocked due to security validation failures, such as an invalid `Origin` or `Referer` header.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/Error\"\n example:\n error: Invalid origin\n \"429\":\n description: Too many requests for this IP or booking ID. The client should wait before retrying.\n headers:\n Retry-After:\n description: The number of seconds to wait before making a new request.\n schema:\n type: integer\n example: 900\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/RateLimitError\"\n example:\n error: Too many requests. Please wait before trying again.\n retryAfter: 900\n \"500\":\n description: Internal server error, likely due to a failure to store the generated nonce in the database.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/Error\"\n example:\n error: Failed to generate secure token\n /api/v1/create-fingerprint:\n post:\n summary: Create Payment Hash\n description: |\n Generates a SHA3-512 hash (fingerprint) from sensitive payment details.\n This endpoint is protected and requires a valid, unused payment nonce obtained from `/api/create-payment-nonce` to be passed in the `X-Payment-Nonce` header. The nonce is consumed upon successful use.\n tags:\n - Payment\n operationId: createPaymentHash\n security:\n - NonceAuth: []\n - RateLimiting: []\n - OriginValidation: []\n - SecurityHeaders: []\n - RequestValidation: []\n requestBody:\n description: The payment details to be hashed. All fields are required.\n required: true\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/CreatePaymentHashRequest\"\n example:\n apikey: \"your_api_key\"\n username: \"your_username\"\n password: \"your_secret_password\"\n mode\": 0\n paymentAmount: 15000\n merchantUniquePaymentId: \"order-id-12345\"\n timestamp: \"2025-07-02T19:10:00\"\n responses:\n \"200\":\n description: Successfully generated the payment hash. The response is signed with an HMAC signature.\n headers:\n X-Response-Signature:\n $ref: \"#/components/headers/X-Response-Signature\"\n X-Response-Time:\n $ref: \"#/components/headers/X-Response-Time\"\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/CreatePaymentHashResponse\"\n example:\n hash: 2b8d8db9c5a473d09a5b...\n timestamp: \"1720000050000\"\n signature: \"hmac_sha256_signature_of_the_response_body\"\n \"400\":\n description: Bad Request. The request is missing required parameters or contains fields with invalid formats.\n content:\n application/json:\n schema:\n oneOf:\n - $ref: \"#/components/schemas/MissingParametersError\"\n - $ref: \"#/components/schemas/ValidationError\"\n examples:\n missingParams:\n summary: Missing Parameters\n value:\n error: Missing parameters\n missing: [\"apikey\", \"password\"]\n validationFailed:\n summary: Validation Failed\n value:\n error: Validation failed\n details: [\n \"paymentAmount must be an integer without ',' or '.'\",\n ]\n \"403\":\n description: Forbidden. The provided `X-Payment-Nonce` is missing, invalid, expired, or has already been used.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/Error\"\n example:\n error: Nonce already used or in use. Please request a new secure token.\n \"429\":\n description: Too many requests. The client should wait before retrying.\n headers:\n Retry-After:\n description: The number of seconds to wait before making a new request.\n schema:\n type: integer\n example: 30\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/RateLimitError\"\n example:\n error: Too many requests. Please wait before trying again.\n retryAfter: 30\n /api/v1/fingerprint-status/{bookingId}:\n get:\n summary: Get Fingerprint Status\n description: Retrieves the status of payment nonces (referred to as fingerprints) for a specific booking ID, including the number of generation attempts and whether a valid, unused nonce is available.\n tags:\n - Nonce\n operationId: getFingerprintStatus\n security:\n - RateLimiting: []\n - OriginValidation: []\n - SecurityHeaders: []\n - RequestValidation: []\n parameters:\n - name: bookingId\n in: path\n required: true\n description: The booking identifier to check the status for.\n schema:\n type: string\n example: booking-xyz-789\n responses:\n \"200\":\n description: Successfully retrieved the fingerprint status.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/FingerprintStatusResponse\"\n example:\n bookingId: \"booking-xyz-789\"\n totalAttempts: 2\n hasUnusedFingerprint\": true\n canRetry: true\n remainingAttempts: 3\n \"400\":\n description: Bad Request. The booking ID was missing from the URL path.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/Error\"\n example:\n error: Missing booking ID\n \"500\":\n description: Internal server error, likely due to a database query failure.\n content:\n application/json:\n schema:\n $ref: \"#/components/schemas/Error\"\n example:\n error: Failed to check status\ncomponents:\n schemas:\n TurnstileValidationRequest:\n type: object\n required:\n - token\n properties:\n token:\n type: string\n description: The `cf-turnstile-response` token from the client-side widget.\n TurnstileValidationResponse:\n type: object\n required:\n - success\n properties:\n success:\n type: boolean\n description: True if the token is valid, false otherwise.\n challenge_ts:\n type: string\n format: date-time\n description: Timestamp of the challenge solved.\n hostname:\n type: string\n description: The hostname for which the challenge was solved.\n \"error-codes\":\n type: array\n items:\n type: string\n description: A list of error codes if validation fails.\n action:\n type: string\n description: The custom action specified for the widget.\n cdata:\n type: string\n description: The custom data specified for the widget.\n PageNonceResponse:\n type: object\n properties:\n nonce:\n type: string\n description: A 32-character hexadecimal nonce.\n example: a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4\n CreatePaymentNonceRequest:\n type: object\n properties:\n bookingId:\n type: string\n description: An optional identifier for a booking or session.\n example: session-abc-123\n timestamp:\n type: string\n format: date-time\n description: The ISO 8601 timestamp of the request, used for anti-replay protection.\n example: \"2025-07-02T18:30:00Z\"\n email_verify:\n type: string\n description: A honeypot field. This should ALWAYS be empty. If it's filled, the server will treat the request as a bot.\n required:\n - timestamp\n CreatePaymentNonceResponse:\n type: object\n properties:\n nonce:\n type: string\n description: The generated 32-character hexadecimal payment nonce.\n example: 112233445566778899aabbccddeeff00\n expiresIn:\n type: integer\n description: The validity duration of the nonce in seconds.\n example: 900\n bookingId:\n type: string\n description: The booking ID associated with this nonce.\n example: booking-xyz-789\n timestamp:\n type: string\n description: The server-side timestamp used to generate the response signature.\n example: \"1720000000000\"\n signature:\n type: string\n description: An HMAC-SHA256 signature of the response body, used for verifying response integrity.\n example: 2f3...\n reused:\n type: boolean\n description: Indicates if an existing, unused nonce was returned instead of creating a new one.\n example: true\n CreatePaymentHashRequest:\n type: object\n required:\n - apikey\n - username\n - password\n - mode\n - paymentAmount\n - merchantUniquePaymentId\n - timestamp\n properties:\n apikey:\n type: string\n minLength: 10\n maxLength: 128\n pattern: '^[A-Za-z0-9_-]+$'\n description: The merchant's API key (10-128 characters, alphanumeric, underscore, hyphen only).\n username:\n type: string\n minLength: 3\n maxLength: 50\n pattern: '^[A-Za-z0-9_-]+$'\n description: The merchant's username (3-50 characters, alphanumeric, underscore, hyphen only).\n password:\n type: string\n minLength: 6\n maxLength: 128\n description: The merchant's password (6-128 characters).\n mode:\n type: integer\n enum: [0, 1, 2, 3]\n description: The payment mode (must be exactly 0, 1, 2, or 3).\n paymentAmount:\n type: integer\n minimum: 1\n maximum: 999999999\n description: The payment amount in cents as a whole number (1-999999999, no decimals).\n example: 15000\n merchantUniquePaymentId:\n type: string\n minLength: 1\n maxLength: 100\n pattern: '^[A-Za-z0-9_-]+$'\n description: A unique payment identifier (1-100 characters, alphanumeric, underscore, hyphen only).\n timestamp:\n type: string\n pattern: '^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}$'\n description: The timestamp in exact format yyyy-mm-ddThh:mm:ss (e.g., 2025-07-02T19:10:00).\n example: \"2025-07-02T19:10:00\"\n CreatePaymentHashResponse:\n type: object\n properties:\n hash:\n type: string\n description: The resulting SHA3-512 hash of the payment payload.\n timestamp:\n type: string\n description: The server-side timestamp used to generate the response signature.\n signature:\n type: string\n description: An HMAC-SHA256 signature of the response body.\n FingerprintStatusResponse:\n type: object\n properties:\n bookingId:\n type: string\n description: The booking ID for which the status was checked.\n totalAttempts:\n type: integer\n description: Total number of nonces generated for this booking ID within the expiry window.\n hasUnusedFingerprint:\n type: boolean\n description: True if there is at least one valid, unused nonce available for this booking.\n canRetry:\n type: boolean\n description: True if the number of attempts is less than the maximum allowed limit.\n remainingAttempts:\n type: integer\n description: The number of remaining nonce generation attempts before being rate-limited.\n Error:\n type: object\n properties:\n error:\n type: string\n description: A description of the error.\n RateLimitError:\n type: object\n properties:\n error:\n type: string\n example: Too many requests. Please wait before trying again.\n retryAfter:\n type: integer\n description: The number of seconds to wait before making a new request.\n example: 900\n MissingParametersError:\n type: object\n properties:\n error:\n type: string\n example: Missing parameters\n missing:\n type: array\n items:\n type: string\n example: [\"apikey\", \"password\"]\n ValidationError:\n type: object\n properties:\n error:\n type: string\n example: Validation failed\n details:\n type: array\n items:\n type: string\n example: [\"paymentAmount must be an integer without ',' or '.'\"]\n securitySchemes:\n NonceAuth:\n type: apiKey\n in: header\n name: X-Payment-Nonce\n description: A secure, single-use token obtained from the `/api/create-payment-nonce` endpoint. It is required to authorize calls to the `/apicreate-fingerprint` endpoint.\n \n RateLimiting:\n type: http\n scheme: bearer\n description: |\n IP-based rate limiting enforced by middleware:\n - `/api/v1/create-payment-nonce`: 20 requests per 15 minutes per IP\n - `/api/v1create-fingerprint`: 10 requests per 1 minute per IP\n - `/api/v1/page-nonce`: 100 requests per 15 minutes per IP\n - `/api/v1/fingerprint-status`: 50 requests per 5 minutes per IP\n - `/api/v1/validate-turnstile`: Uses default rate limiting\n \n Rate limits are enforced regardless of booking ID to prevent harvesting attacks.\n \n OriginValidation:\n type: http\n scheme: bearer\n description: |\n CORS and origin validation enforced by middleware:\n - Origin header must match allowed origins from server configuration\n - Referer header must match origin (if present)\n - Host header must match expected server host\n - Preflight OPTIONS requests handled automatically\n \n HoneypotProtection:\n type: http\n scheme: bearer\n description: |\n Bot detection via honeypot fields:\n - `email_verify` field in nonce requests must be empty\n - If honeypot is triggered, server returns fake but valid-looking responses\n - Suspicious IPs are logged and may be blocked after repeated violations\n \n SecurityHeaders:\n type: http\n scheme: bearer\n description: |\n Security headers automatically applied to all responses:\n - `Strict-Transport-Security`: HSTS for HTTPS enforcement\n - `X-Content-Type-Options`: nosniff\n - `X-Frame-Options`: DENY\n - `X-XSS-Protection`: 1; mode=block\n - `Content-Security-Policy`: Restrictive CSP\n - `Access-Control-Expose-Headers`: Correlation and response time headers\n \n RequestValidation:\n type: http\n scheme: bearer\n description: |\n OpenAPI-driven request validation:\n - All request bodies validated against schemas before reaching handlers\n - Path parameters validated for format and constraints\n - Query parameters validated if defined\n - Invalid requests rejected with 400 status and detailed error messages\n headers:\n X-Response-Signature:\n description: An HMAC-SHA256 signature generated by the server for the response body. Clients can use this to verify the integrity and authenticity of the response. The signature is computed over the JSON response body and the `X-Response-Time` header.\n schema:\n type: string\n X-Response-Time:\n description: The Unix millisecond timestamp when the server generated the response and its signature. This is used as part of the data for the HMAC signature.\n schema:\n type: string\n",[],[389],"files",[148,168,175,187,195,202,209,219,228,237,247,254,263,272,281,291,298,307,316,325,335,342,351,360,369,379,387,398,407,416,425,432],"counts",{"_444":31,"_445":181,"_446":31,"_447":156},"pulls","branches","forks","envVars","contents",[450,453,456,459,462,465,468,471,474],{"_107":149,"_100":150,"_151":152,"_153":-5,"_154":138,"_155":156,"_157":158,"_109":451,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_103":452},["D",1751534293074],[150],{"_107":169,"_100":170,"_151":171,"_153":-5,"_154":138,"_155":172,"_157":158,"_109":454,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_103":455},["D",1751534293470],[170],{"_107":188,"_100":189,"_151":190,"_153":-5,"_154":138,"_155":191,"_157":158,"_109":457,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_103":458},["D",1751534293857],[189],{"_107":196,"_100":197,"_151":198,"_153":-5,"_154":138,"_155":199,"_157":158,"_109":460,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_103":461},["D",1751534294309],[197],{"_107":399,"_100":400,"_151":401,"_153":-5,"_154":138,"_155":402,"_157":158,"_109":463,"_104":31,"_160":393,"_162":404,"_163":27,"_164":-5,"_103":464},["D",1751534296586],[400],{"_107":408,"_100":409,"_151":410,"_153":-5,"_154":138,"_155":411,"_157":158,"_109":466,"_104":31,"_160":393,"_162":413,"_163":27,"_164":-5,"_103":467},["D",1751534296584],[409],{"_107":417,"_100":418,"_151":419,"_153":-5,"_154":138,"_155":420,"_157":158,"_109":469,"_104":31,"_160":393,"_162":422,"_163":27,"_164":-5,"_103":470},["D",1751534296900],[418],{"_107":426,"_100":427,"_151":428,"_153":-5,"_154":138,"_155":181,"_157":158,"_109":472,"_104":31,"_160":215,"_162":73,"_163":27,"_164":-5,"_103":473},["D",1751534140808],[427],{"_107":433,"_100":389,"_151":434,"_153":-5,"_154":138,"_155":435,"_157":158,"_109":475,"_104":31,"_160":393,"_162":437,"_163":27,"_164":-5,"_103":476},["D",1751534296950],[389],"upstreamProject","upstreamBranch","emptyEnvVars","isNew","routes/_app.x.$handle.$name._index",{"_98":99,"_100":101,"_102":-7,"_104":-7,"_105":483,"_448":487,"_506":-7,"_507":-5,"_508":-5,"_440":509,"_606":607},{"_107":108,"_100":101,"_109":484,"_111":-5,"_112":27,"_113":114,"_115":-5,"_116":-5,"_12":117,"_118":-5,"_119":27,"_120":-5,"_121":31,"_122":123,"_124":123,"_125":126,"_127":126,"_128":126,"_129":123,"_130":123,"_131":27,"_21":485,"_135":486},["D",1751534140795],{"_98":99,"_133":134},{"_104":137,"_100":42,"_107":138,"_139":108,"_140":-5,"_141":-5,"_142":-5,"_143":-5,"_144":101,"_145":99},[488,490,492,494,496,498,500,502,504],{"_107":149,"_100":150,"_151":152,"_153":-5,"_154":138,"_155":156,"_157":158,"_109":451,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_103":489},[150],{"_107":169,"_100":170,"_151":171,"_153":-5,"_154":138,"_155":172,"_157":158,"_109":454,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_103":491},[170],{"_107":188,"_100":189,"_151":190,"_153":-5,"_154":138,"_155":191,"_157":158,"_109":457,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_103":493},[189],{"_107":196,"_100":197,"_151":198,"_153":-5,"_154":138,"_155":199,"_157":158,"_109":460,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_103":495},[197],{"_107":399,"_100":400,"_151":401,"_153":-5,"_154":138,"_155":402,"_157":158,"_109":463,"_104":31,"_160":393,"_162":404,"_163":27,"_164":-5,"_103":497},[400],{"_107":408,"_100":409,"_151":410,"_153":-5,"_154":138,"_155":411,"_157":158,"_109":466,"_104":31,"_160":393,"_162":413,"_163":27,"_164":-5,"_103":499},[409],{"_107":417,"_100":418,"_151":419,"_153":-5,"_154":138,"_155":420,"_157":158,"_109":469,"_104":31,"_160":393,"_162":422,"_163":27,"_164":-5,"_103":501},[418],{"_107":426,"_100":427,"_151":428,"_153":-5,"_154":138,"_155":181,"_157":158,"_109":472,"_104":31,"_160":215,"_162":73,"_163":27,"_164":-5,"_103":503},[427],{"_107":433,"_100":389,"_151":434,"_153":-5,"_154":138,"_155":435,"_157":158,"_109":475,"_104":31,"_160":393,"_162":437,"_163":27,"_164":-5,"_103":505},[389],"readme","upstream","pull",[510,513,515,519,522,524,526,529,532,535,539,541,544,547,550,554,556,559,562,565,569,571,574,577,580,584,587,591,594,597,600,603],{"_107":149,"_100":150,"_151":152,"_153":-5,"_154":138,"_155":156,"_157":158,"_109":159,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_165":511,"_103":512},[],[150],{"_107":169,"_100":170,"_151":171,"_153":-5,"_154":138,"_155":172,"_157":158,"_109":173,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_165":514,"_103":518},[515],{"_107":176,"_100":177,"_151":178,"_153":171,"_154":138,"_155":179,"_157":158,"_109":180,"_104":181,"_160":182,"_162":183,"_163":27,"_164":-5,"_165":516,"_103":517},[],[170,177],[170],{"_107":188,"_100":189,"_151":190,"_153":-5,"_154":138,"_155":191,"_157":158,"_109":192,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_165":520,"_103":521},[],[189],{"_107":196,"_100":197,"_151":198,"_153":-5,"_154":138,"_155":199,"_157":158,"_109":200,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_165":523,"_103":590},[524,539,554,569,584,587],{"_107":203,"_100":204,"_151":205,"_153":198,"_154":138,"_155":206,"_157":158,"_109":207,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_165":525,"_103":538},[526,529,532,535],{"_107":210,"_100":211,"_151":212,"_153":205,"_154":138,"_155":213,"_157":158,"_109":214,"_104":31,"_160":215,"_162":216,"_163":27,"_164":-5,"_165":527,"_103":528},[],[197,204,211],{"_107":220,"_100":221,"_151":222,"_153":205,"_154":138,"_155":223,"_157":158,"_109":224,"_104":31,"_160":215,"_162":225,"_163":27,"_164":-5,"_165":530,"_103":531},[],[197,204,221],{"_107":229,"_100":230,"_151":231,"_153":205,"_154":138,"_155":232,"_157":158,"_109":233,"_104":31,"_160":215,"_162":234,"_163":27,"_164":-5,"_165":533,"_103":534},[],[197,204,230],{"_107":238,"_100":239,"_151":240,"_153":205,"_154":138,"_155":241,"_157":158,"_109":242,"_104":31,"_160":215,"_162":243,"_163":27,"_164":-5,"_165":536,"_103":537},[],[197,204,239],[197,204],{"_107":248,"_100":249,"_151":250,"_153":198,"_154":138,"_155":251,"_157":158,"_109":252,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_165":540,"_103":553},[541,544,547,550],{"_107":255,"_100":256,"_151":257,"_153":250,"_154":138,"_155":258,"_157":158,"_109":259,"_104":31,"_160":215,"_162":260,"_163":27,"_164":-5,"_165":542,"_103":543},[],[197,249,256],{"_107":264,"_100":265,"_151":266,"_153":250,"_154":138,"_155":267,"_157":158,"_109":268,"_104":31,"_160":215,"_162":269,"_163":27,"_164":-5,"_165":545,"_103":546},[],[197,249,265],{"_107":273,"_100":274,"_151":275,"_153":250,"_154":138,"_155":276,"_157":158,"_109":277,"_104":31,"_160":215,"_162":278,"_163":27,"_164":-5,"_165":548,"_103":549},[],[197,249,274],{"_107":282,"_100":283,"_151":284,"_153":250,"_154":138,"_155":285,"_157":158,"_109":286,"_104":31,"_160":215,"_162":287,"_163":27,"_164":-5,"_165":551,"_103":552},[],[197,249,283],[197,249],{"_107":292,"_100":293,"_151":294,"_153":198,"_154":138,"_155":295,"_157":158,"_109":296,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_165":555,"_103":568},[556,559,562,565],{"_107":299,"_100":300,"_151":301,"_153":294,"_154":138,"_155":302,"_157":158,"_109":303,"_104":31,"_160":215,"_162":304,"_163":27,"_164":-5,"_165":557,"_103":558},[],[197,293,300],{"_107":308,"_100":309,"_151":310,"_153":294,"_154":138,"_155":311,"_157":158,"_109":312,"_104":31,"_160":215,"_162":313,"_163":27,"_164":-5,"_165":560,"_103":561},[],[197,293,309],{"_107":317,"_100":318,"_151":319,"_153":294,"_154":138,"_155":320,"_157":158,"_109":321,"_104":31,"_160":215,"_162":322,"_163":27,"_164":-5,"_165":563,"_103":564},[],[197,293,318],{"_107":326,"_100":327,"_151":328,"_153":294,"_154":138,"_155":329,"_157":158,"_109":330,"_104":31,"_160":215,"_162":331,"_163":27,"_164":-5,"_165":566,"_103":567},[],[197,293,327],[197,293],{"_107":336,"_100":337,"_151":338,"_153":198,"_154":138,"_155":339,"_157":158,"_109":340,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_165":570,"_103":583},[571,574,577,580],{"_107":343,"_100":344,"_151":345,"_153":338,"_154":138,"_155":346,"_157":158,"_109":347,"_104":31,"_160":215,"_162":348,"_163":27,"_164":-5,"_165":572,"_103":573},[],[197,337,344],{"_107":352,"_100":353,"_151":354,"_153":338,"_154":138,"_155":355,"_157":158,"_109":356,"_104":31,"_160":215,"_162":357,"_163":27,"_164":-5,"_165":575,"_103":576},[],[197,337,353],{"_107":361,"_100":362,"_151":363,"_153":338,"_154":138,"_155":364,"_157":158,"_109":365,"_104":31,"_160":215,"_162":366,"_163":27,"_164":-5,"_165":578,"_103":579},[],[197,337,362],{"_107":370,"_100":371,"_151":372,"_153":338,"_154":138,"_155":373,"_157":158,"_109":374,"_104":31,"_160":215,"_162":375,"_163":27,"_164":-5,"_165":581,"_103":582},[],[197,337,371],[197,337],{"_107":380,"_100":381,"_151":382,"_153":198,"_154":138,"_155":137,"_157":158,"_109":383,"_104":181,"_160":182,"_162":384,"_163":27,"_164":-5,"_165":585,"_103":586},[],[197,381],{"_107":388,"_100":389,"_151":390,"_153":198,"_154":138,"_155":391,"_157":158,"_109":392,"_104":31,"_160":393,"_162":394,"_163":27,"_164":-5,"_165":588,"_103":589},[],[197,389],[197],{"_107":399,"_100":400,"_151":401,"_153":-5,"_154":138,"_155":402,"_157":158,"_109":403,"_104":31,"_160":393,"_162":404,"_163":27,"_164":-5,"_165":592,"_103":593},[],[400],{"_107":408,"_100":409,"_151":410,"_153":-5,"_154":138,"_155":411,"_157":158,"_109":412,"_104":31,"_160":393,"_162":413,"_163":27,"_164":-5,"_165":595,"_103":596},[],[409],{"_107":417,"_100":418,"_151":419,"_153":-5,"_154":138,"_155":420,"_157":158,"_109":421,"_104":31,"_160":393,"_162":422,"_163":27,"_164":-5,"_165":598,"_103":599},[],[418],{"_107":426,"_100":427,"_151":428,"_153":-5,"_154":138,"_155":181,"_157":158,"_109":429,"_104":31,"_160":215,"_162":73,"_163":27,"_164":-5,"_165":601,"_103":602},[],[427],{"_107":433,"_100":389,"_151":434,"_153":-5,"_154":138,"_155":435,"_157":158,"_109":436,"_104":31,"_160":393,"_162":437,"_163":27,"_164":-5,"_165":604,"_103":605},[],[389],"previews",[515,584],"routes/_app","actionData","errors"]