@ac-kit/node 0.1.0 → 0.2.0

package/dist/net/tls-server.js

@@ -0,0 +1,103 @@
+import * as tls from "node:tls";
+import { TcpServer } from "./tcp-server.js";
+import { TlsSocket } from "./tls-socket.js";
+/**
+ * TLS server accepting encrypted incoming connections.
+ *
+ * Example usage:
+ *
+ * ```ts
+ * const server = TlsServer.from({ key, cert });
+ * server.subscribe("secureConnection", (socket) => {
+ * 	console.log("Client cipher:", socket.getCipher().name);
+ * });
+ * await server.listen(8443, "0.0.0.0");
+ * // ... later
+ * await server.close();
+ * ```
+ *
+ * Every event of {@link TcpServer} is still emitted, so
+ * {@link TcpServerEvents.connection} reports the plaintext socket accepted
+ * _before_ the handshake. Wait for {@link TlsServerEvents.secureConnection} to
+ * read or write application data.
+ *
+ * The session-resumption events Node.js exposes with a completion callback
+ * (`newSession`, `resumeSession` and `OCSPRequest`) are deliberately not
+ * forwarded: Node.js falls back to its default behaviour only while no listener
+ * is attached, so forwarding them would stall every handshake that nobody
+ * subscribed to.
+ */
+export class TlsServer extends TcpServer {
+    /**
+     * Creates a new {@link TlsServer} instance.
+     *
+     * @param options Options for creating the underlying Node.js server,
+     *   including the certificate chain and private key to serve.
+     * @returns A new `TlsServer` instance.
+     */
+    static from(options) {
+        return new TlsServer(tls.createServer(options ?? {}));
+    }
+    /**
+     * Adds a secure context to serve when a client requests `hostname` through
+     * SNI.
+     *
+     * @param hostname The server name to match, which may contain wildcards.
+     * @param context The secure context or the options to build one from.
+     */
+    addContext(hostname, context) {
+        this.server.addContext(hostname, context);
+    }
+    /**
+     * Replaces the default secure context, affecting connections established
+     * after the call.
+     *
+     * @param context The options to build the secure context from.
+     */
+    setSecureContext(context) {
+        this.server.setSecureContext(context);
+    }
+    /**
+     * Returns the keys used to encrypt session tickets.
+     *
+     * Sharing them across server instances lets clients resume a session on any
+     * of them; they are sensitive key material and must be handled as secrets.
+     *
+     * @returns The 48-byte session ticket keys.
+     */
+    getTicketKeys() {
+        return this.server.getTicketKeys();
+    }
+    /**
+     * Sets the keys used to encrypt session tickets, affecting connections
+     * established after the call.
+     *
+     * @param keys The 48-byte session ticket keys.
+     */
+    setTicketKeys(keys) {
+        this.server.setTicketKeys(keys);
+    }
+    setupEventForwarding() {
+        super.setupEventForwarding();
+        this.server.on("secureConnection", (socket) => {
+            this.dispatch("secureConnection", [wrap_(socket)]);
+        });
+        this.server.on("tlsClientError", (error, socket) => {
+            this.dispatch("tlsClientError", [error, wrap_(socket)]);
+        });
+        this.server.on("keylog", (line, socket) => {
+            this.dispatch("keylog", [line, wrap_(socket)]);
+        });
+    }
+}
+/** Keeps one wrapper per accepted socket, so subscribers can correlate events. */
+const wrappers_ = new WeakMap();
+function wrap_(socket) {
+    let wrapper = wrappers_.get(socket);
+    if (wrapper === undefined) {
+        wrapper = new TlsSocket(socket);
+        wrappers_.set(socket, wrapper);
+    }
+    return wrapper;
+}
+//# sourceMappingURL=tls-server.js.map

package/dist/net/tls-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tls-server.js","sourceRoot":"","sources":["../../src/net/tls-server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAIhC,OAAO,EAAE,SAAS,EAAwB,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAC;AAoBnE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,OAAO,SAAU,SAAQ,SAAsC;IACpE;;;;;;OAMG;IACH,MAAM,CAAU,IAAI,CAAC,OAA0B;QAC9C,OAAO,IAAI,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;OAMG;IACH,UAAU,CAAC,QAAgB,EAAE,OAAyB;QACrD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,OAAiC;QACjD,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;;OAOG;IACH,aAAa;QACZ,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;IACpC,CAAC;IAED;;;;;OAKG;IACH,aAAa,CAAC,IAAY;QACzB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAEkB,oBAAoB;QACtC,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAE7B,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,kBAAkB,EAAE,CAAC,MAAM,EAAE,EAAE;YAC7C,IAAI,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YAClD,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACzC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;IACJ,CAAC;CACD;AAED,kFAAkF;AAClF,MAAM,SAAS,GAAG,IAAI,OAAO,EAA4B,CAAC;AAE1D,SAAS,KAAK,CAAC,MAAqB;IACnC,IAAI,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAEpC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;QAChC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,OAAO,CAAC;AAChB,CAAC"}

package/dist/net/tls-socket.d.ts

@@ -2,44 +2,265 @@ import type { X509Certificate } from "node:crypto";
 import type { Duplex } from "node:stream";
 import * as tls from "node:tls";
 import type { Except } from "type-fest";
-import type { StreamSocketEvents } from "./stream-socket.js";
-import { StreamSocket } from "./stream-socket.js";
-export type TlsSocketEvents = StreamSocketEvents & {
+import { InetSocket, type InetSocketEvents } from "./inet-socket.js";
+/** Event map for {@link TlsSocket}. */
+export type TlsSocketEvents = InetSocketEvents & {
+    /** Emitted once the handshake completed and the connection is usable. */
     secureConnect: [];
+    /**
+     * Emitted once the handshake completed, including after a renegotiation.
+     *
+     * Unlike {@link TlsSocketEvents.secureConnect} this also fires on sockets
+     * accepted by a server.
+     */
+    secure: [];
+    /**
+     * Emitted with the stapled OCSP response, or `null` when the server sent
+     * none. Only emitted when `requestOCSP` was set.
+     */
     ocspResponse: [response: Buffer | null];
+    /** Emitted with each line of TLS key material, for traffic decryption. */
     keylog: [line: Buffer];
+    /** Emitted with a session ticket that can be reused to resume the session. */
     session: [session: Buffer];
 };
-export type TlsSocketOptions = Except<tls.TLSSocketOptions, "isServer" | "server" | keyof tls.SecureContextOptions>;
-export type TlsSocketConnectOptions = Except<tls.ConnectionOptions, "port"> & {
+/** Options accepted by {@link TlsSocket.from}. */
+export type TlsSocketOptions = Except<tls.TLSSocketOptions, "isServer" | "server">;
+/** Options accepted by {@link TlsSocket.connect}. */
+export type TlsSocketConnectOptions = Except<tls.ConnectionOptions, "port" | "path" | "socket"> & {
+    /** Aborts the connection attempt and destroys the socket. */
     signal?: AbortSignal;
 };
-export declare class TlsSocket extends StreamSocket<tls.TLSSocket, TlsSocketEvents> {
+/** Options accepted by {@link TlsSocket.renegotiate}. */
+export type TlsSocketRenegotiateOptions = {
+    /** Whether to reject a peer certificate that fails verification. */
+    rejectUnauthorized?: boolean;
+    /** Whether to request a certificate from the peer. */
+    requestCert?: boolean;
+};
+/** A ready-made secure context, or the options to build one from. */
+export type TlsSecureContext = tls.SecureContextOptions | tls.SecureContext;
+/**
+ * TLS socket for establishing encrypted connections to TLS servers.
+ *
+ * Unlike {@link TcpSocket}, a TLS connection cannot be established on an
+ * existing instance: Node.js creates the socket as part of the handshake. The
+ * connection therefore starts from the static {@link TlsSocket.connect}, which
+ * resolves only once the handshake completed and the peer certificate has been
+ * verified.
+ *
+ * ```ts
+ * const socket = await TlsSocket.connect(443, { host: "example.com" });
+ * ```
+ *
+ * The same method upgrades an already-connected plaintext stream, which is what
+ * `STARTTLS`-style protocols need. The plaintext transport is destroyed if the
+ * handshake fails, so a failed upgrade can never fall back to cleartext.
+ *
+ * ```ts
+ * const plain = TcpSocket.from();
+ * await plain.connect(587, { host: "mail.example.com" });
+ * // ... negotiate STARTTLS over the plaintext connection ...
+ * const secure = await TlsSocket.connect(plain.stream, {
+ * 	servername: "mail.example.com",
+ * });
+ * ```
+ *
+ * Accessors that report handshake results ({@link TlsSocket.authorized},
+ * {@link TlsSocket.getPeerCertificate}, {@link TlsSocket.getCipher}, …) are
+ * only meaningful once the handshake completed.
+ */
+export declare class TlsSocket extends InetSocket<tls.TLSSocket, TlsSocketEvents> {
+    /**
+     * Wraps an existing stream in a TLS socket without waiting for the handshake.
+     *
+     * The handshake starts immediately and its outcome is reported through the
+     * {@link TlsSocketEvents.secureConnect} and {@link StreamSocketEvents.error}
+     * events. Prefer {@link TlsSocket.connect}, which reports both through the
+     * returned promise; use this method only to drive the handshake manually.
+     *
+     * @param stream The plaintext stream to encrypt.
+     * @param options Options for the underlying Node.js TLS socket.
+     * @returns A new `TlsSocket` instance whose handshake is in progress.
+     */
     static from(stream: Duplex, options?: TlsSocketOptions): TlsSocket;
+    /**
+     * Connects to a TLS server and resolves once the handshake completed.
+     *
+     * @param port The port to connect to.
+     * @param options Connection options, including the host, the secure context
+     *   and an optional abort signal.
+     * @returns A promise that resolves with the connected socket.
+     */
     static connect(port: number, options?: TlsSocketConnectOptions): Promise<TlsSocket>;
+    /**
+     * Connects to a TLS server listening on a local endpoint and resolves once
+     * the handshake completed.
+     *
+     * @param path Filesystem path of the Unix domain socket, or the name of the
+     *   Windows named pipe.
+     * @param options Connection options, including the secure context and an
+     *   optional abort signal.
+     * @returns A promise that resolves with the connected socket.
+     */
+    static connect(path: string, options?: TlsSocketConnectOptions): Promise<TlsSocket>;
+    /**
+     * Upgrades an already-connected stream to TLS and resolves once the handshake
+     * completed.
+     *
+     * @param stream The plaintext stream to encrypt.
+     * @param options Connection options, including the secure context and an
+     *   optional abort signal.
+     * @returns A promise that resolves with the secured socket.
+     */
+    static connect(stream: Duplex, options?: TlsSocketConnectOptions): Promise<TlsSocket>;
+    /** Always `true`; distinguishes a TLS socket from a plaintext one. */
     get encrypted(): boolean;
+    /** Whether the peer certificate was signed by one of the configured CAs. */
     get authorized(): boolean;
+    /**
+     * Reason why the peer certificate was rejected, or `null` when the peer is
+     * authorized or the handshake has not completed yet.
+     */
     get authorizationError(): Error | null;
+    /**
+     * Protocol selected through ALPN, or `null` before the handshake completed
+     * and when no protocol was negotiated.
+     */
     get alpnProtocol(): string | null;
+    /**
+     * Server name requested through SNI, or `null` when the peer sent none.
+     *
+     * Only set on sockets accepted by a server.
+     */
+    get servername(): string | null;
+    /**
+     * Returns the local certificate, or `null` when none was presented.
+     *
+     * @returns The local certificate or `null`.
+     */
     getCertificate(): tls.PeerCertificate | null;
+    /**
+     * Returns the peer certificate, or `null` when the peer presented none.
+     *
+     * @param detailed Whether to include the full issuer chain.
+     * @returns The peer certificate or `null`.
+     */
+    getPeerCertificate(detailed: true): tls.DetailedPeerCertificate | null;
+    getPeerCertificate(detailed?: false): tls.PeerCertificate | null;
+    /**
+     * Returns the peer certificate as an `X509Certificate`, or `null` when the
+     * peer presented none.
+     *
+     * @returns The peer certificate or `null`.
+     */
+    getPeerX509Certificate(): X509Certificate | null;
+    /**
+     * Returns the local certificate as an `X509Certificate`, or `null` when none
+     * was presented.
+     *
+     * @returns The local certificate or `null`.
+     */
+    getX509Certificate(): X509Certificate | null;
+    /**
+     * Returns the negotiated cipher suite.
+     *
+     * @returns The cipher name, standard name and protocol version.
+     */
     getCipher(): tls.CipherNameAndProtocol;
-    getEphemeralKeyInfo(): tls.EphemeralKeyInfo | object | null;
+    /**
+     * Returns the type, name and size of the ephemeral key exchange, or `null`
+     * when the key exchange was not ephemeral.
+     *
+     * @returns The ephemeral key information or `null`.
+     */
+    getEphemeralKeyInfo(): tls.EphemeralKeyInfo | null;
+    /**
+     * Returns the latest `Finished` message sent to the peer, or `null` when no
+     * handshake completed.
+     *
+     * @returns The message or `null`.
+     */
     getFinished(): Buffer | null;
-    getPeerCertificate<T extends boolean | undefined, R = T extends true ? tls.DetailedPeerCertificate : tls.PeerCertificate>(detailed?: T): R;
+    /**
+     * Returns the latest `Finished` message received from the peer, or `null`
+     * when no handshake completed.
+     *
+     * @returns The message or `null`.
+     */
     getPeerFinished(): Buffer | null;
+    /**
+     * Returns the negotiated protocol version, or `null` before the handshake
+     * completed.
+     *
+     * @returns The protocol version such as `TLSv1.3`, or `null`.
+     */
     getProtocol(): string | null;
+    /**
+     * Returns the negotiated session, which can be passed back as the `session`
+     * connect option to resume it.
+     *
+     * @returns The session or `null`.
+     */
     getSession(): Buffer | null;
+    /**
+     * Returns the session ticket, or `null` when the peer issued none.
+     *
+     * @returns The session ticket or `null`.
+     */
+    getTLSTicket(): Buffer | null;
+    /**
+     * Returns the signature algorithms shared between client and server, in
+     * descending order of preference.
+     *
+     * @returns The shared signature algorithms.
+     */
     getSharedSigalgs(): string[];
-    getTicket(): Buffer | null;
+    /**
+     * Indicates whether the session was resumed rather than renegotiated.
+     *
+     * @returns `true` when the session was reused.
+     */
     isSessionReused(): boolean;
-    renegotiate(options: Parameters<tls.TLSSocket["renegotiate"]>[0]): Promise<void>;
-    setKeyCert(context: tls.SecureContext): void;
+    /**
+     * Keying material for the connection, as defined by RFC 5705.
+     *
+     * @param length Number of bytes to derive.
+     * @param label Application-specific label.
+     * @param context Optional application-specific context.
+     * @returns The derived keying material.
+     */
+    exportKeyingMaterial(length: number, label: string, context?: Buffer): Buffer;
+    /**
+     * Renegotiates the TLS session and resolves once the new handshake completed.
+     *
+     * @param options Renegotiation options.
+     * @returns A promise that resolves once renegotiation completed.
+     * @throws {ConnectionClosedError} When the socket is already destroyed, since
+     *   Node.js would never invoke the completion callback.
+     */
+    renegotiate(options?: TlsSocketRenegotiateOptions): Promise<void>;
+    /**
+     * Sets the private key and certificate to use for this socket, overriding the
+     * ones inherited from the secure context.
+     *
+     * @param context The secure context or the options to build one from.
+     */
+    setKeyCert(context: TlsSecureContext): void;
+    /**
+     * Sets the maximum TLS fragment size.
+     *
+     * @param size The maximum fragment size, between 512 and 16384.
+     * @returns `true` when the limit was set.
+     */
     setMaxSendFragment(size: number): boolean;
+    /**
+     * Disables renegotiation. Any further renegotiation attempt by the peer emits
+     * an error instead.
+     */
     disableRenegotiation(): void;
+    /** Enables OpenSSL trace output on standard error, for debugging. */
     enableTrace(): void;
-    getPeerX509Certificate(): X509Certificate | null;
-    getX509Certificate(): X509Certificate | null;
-    exportKeyingMaterial(length: number, label: string, context: Buffer): Buffer;
     protected setupEventForwarding(): void;
 }
 //# sourceMappingURL=tls-socket.d.ts.map

package/dist/net/tls-socket.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tls-socket.d.ts","sourceRoot":"","sources":["../../src/net/tls-socket.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAGhC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,MAAM,eAAe,GAAG,kBAAkB,GAAG;IAClD,aAAa,EAAE,EAAE,CAAC;IAClB,YAAY,EAAE,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IACxC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvB,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG,MAAM,CACpC,GAAG,CAAC,gBAAgB,EACpB,UAAU,GAAG,QAAQ,GAAG,MAAM,GAAG,CAAC,oBAAoB,CACtD,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,GAAG;IAC7E,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,qBAAa,SAAU,SAAQ,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC;IAC1E,OAAgB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAE1E;IAED,MAAM,CAAC,OAAO,CACb,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,uBAAuB,GAC/B,OAAO,CAAC,SAAS,CAAC,CA8BpB;IAED,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,IAAI,UAAU,IAAI,OAAO,CAExB;IAED,IAAI,kBAAkB,IAAI,KAAK,GAAG,IAAI,CAErC;IAED,IAAI,YAAY,IAAI,MAAM,GAAG,IAAI,CAGhC;IAED,cAAc,IAAI,GAAG,CAAC,eAAe,GAAG,IAAI,CAa3C;IAED,SAAS,IAAI,GAAG,CAAC,qBAAqB,CAErC;IAED,mBAAmB,IAAI,GAAG,CAAC,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAE1D;IAED,WAAW,IAAI,MAAM,GAAG,IAAI,CAG3B;IAED,kBAAkB,CACjB,CAAC,SAAS,OAAO,GAAG,SAAS,EAC7B,CAAC,GAAG,CAAC,SAAS,IAAI,GAAG,GAAG,CAAC,uBAAuB,GAAG,GAAG,CAAC,eAAe,EACrE,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,CAEjB;IAED,eAAe,IAAI,MAAM,GAAG,IAAI,CAG/B;IAED,WAAW,IAAI,MAAM,GAAG,IAAI,CAE3B;IAED,UAAU,IAAI,MAAM,GAAG,IAAI,CAG1B;IAED,gBAAgB,IAAI,MAAM,EAAE,CAE3B;IAED,SAAS,IAAI,MAAM,GAAG,IAAI,CAGzB;IAED,eAAe,IAAI,OAAO,CAEzB;IAEK,WAAW,CAChB,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,GAClD,OAAO,CAAC,IAAI,CAAC,CAiBf;IAED,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,GAAG,IAAI,CAE3C;IAED,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExC;IAED,oBAAoB,IAAI,IAAI,CAE3B;IAED,WAAW,IAAI,IAAI,CAElB;IAED,sBAAsB,IAAI,eAAe,GAAG,IAAI,CAG/C;IAED,kBAAkB,IAAI,eAAe,GAAG,IAAI,CAG3C;IAED,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAE3E;IAED,UAAmB,oBAAoB,IAAI,IAAI,CAkB9C;CACD"}
+{"version":3,"file":"tls-socket.d.ts","sourceRoot":"","sources":["../../src/net/tls-socket.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAGhC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAGxC,OAAO,EAAE,UAAU,EAAE,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAErE,uCAAuC;AACvC,MAAM,MAAM,eAAe,GAAG,gBAAgB,GAAG;IAChD,yEAAyE;IACzE,aAAa,EAAE,EAAE,CAAC;IAElB;;;;;OAKG;IACH,MAAM,EAAE,EAAE,CAAC;IAEX;;;OAGG;IACH,YAAY,EAAE,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IAExC,0EAA0E;IAC1E,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvB,8EAA8E;IAC9E,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;CAC3B,CAAC;AAEF,kDAAkD;AAClD,MAAM,MAAM,gBAAgB,GAAG,MAAM,CACpC,GAAG,CAAC,gBAAgB,EACpB,UAAU,GAAG,QAAQ,CACrB,CAAC;AAEF,qDAAqD;AACrD,MAAM,MAAM,uBAAuB,GAAG,MAAM,CAC3C,GAAG,CAAC,iBAAiB,EACrB,MAAM,GAAG,MAAM,GAAG,QAAQ,CAC1B,GAAG;IACH,6DAA6D;IAC7D,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,yDAAyD;AACzD,MAAM,MAAM,2BAA2B,GAAG;IACzC,oEAAoE;IACpE,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B,sDAAsD;IACtD,WAAW,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,qEAAqE;AACrE,MAAM,MAAM,gBAAgB,GAAG,GAAG,CAAC,oBAAoB,GAAG,GAAG,CAAC,aAAa,CAAC;AAE5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAAa,SAAU,SAAQ,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC;IACxE;;;;;;;;;;;OAWG;IACH,OAAgB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAE1E;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,OAAO,CACb,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,uBAAuB,GAC/B,OAAO,CAAC,SAAS,CAAC,CAAC;IACtB;;;;;;;;;OASG;IACH,MAAM,CAAC,OAAO,CACb,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,uBAAuB,GAC/B,OAAO,CAAC,SAAS,CAAC,CAAC;IACtB;;;;;;;;OAQG;IACH,MAAM,CAAC,OAAO,CACb,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,uBAAuB,GAC/B,OAAO,CAAC,SAAS,CAAC,CAAC;IAgCtB,sEAAsE;IACtE,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,4EAA4E;IAC5E,IAAI,UAAU,IAAI,OAAO,CAExB;IAED;;;OAGG;IACH,IAAI,kBAAkB,IAAI,KAAK,GAAG,IAAI,CAErC;IAED;;;OAGG;IACH,IAAI,YAAY,IAAI,MAAM,GAAG,IAAI,CAGhC;IAED;;;;OAIG;IACH,IAAI,UAAU,IAAI,MAAM,GAAG,IAAI,CAG9B;IAED;;;;OAIG;IACH,cAAc,IAAI,GAAG,CAAC,eAAe,GAAG,IAAI,CAK3C;IAED;;;;;OAKG;IACH,kBAAkB,CAAC,QAAQ,EAAE,IAAI,GAAG,GAAG,CAAC,uBAAuB,GAAG,IAAI,CAAC;IACvE,kBAAkB,CAAC,QAAQ,CAAC,EAAE,KAAK,GAAG,GAAG,CAAC,eAAe,GAAG,IAAI,CAAC;IAOjE;;;;;OAKG;IACH,sBAAsB,IAAI,eAAe,GAAG,IAAI,CAE/C;IAED;;;;;OAKG;IACH,kBAAkB,IAAI,eAAe,GAAG,IAAI,CAE3C;IAED;;;;OAIG;IACH,SAAS,IAAI,GAAG,CAAC,qBAAqB,CAErC;IAED;;;;;OAKG;IACH,mBAAmB,IAAI,GAAG,CAAC,gBAAgB,GAAG,IAAI,CAIjD;IAED;;;;;OAKG;IACH,WAAW,IAAI,MAAM,GAAG,IAAI,CAE3B;IAED;;;;;OAKG;IACH,eAAe,IAAI,MAAM,GAAG,IAAI,CAE/B;IAED;;;;;OAKG;IACH,WAAW,IAAI,MAAM,GAAG,IAAI,CAE3B;IAED;;;;;OAKG;IACH,UAAU,IAAI,MAAM,GAAG,IAAI,CAE1B;IAED;;;;OAIG;IACH,YAAY,IAAI,MAAM,GAAG,IAAI,CAE5B;IAED;;;;;OAKG;IACH,gBAAgB,IAAI,MAAM,EAAE,CAE3B;IAED;;;;OAIG;IACH,eAAe,IAAI,OAAO,CAEzB;IAED;;;;;;;OAOG;IACH,oBAAoB,CACnB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,GACd,MAAM,CAGR;IAED;;;;;;;OAOG;IACH,WAAW,CAAC,OAAO,CAAC,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBhE;IAED;;;;;OAKG;IACH,UAAU,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAE1C;IAED;;;;;OAKG;IACH,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExC;IAED;;;OAGG;IACH,oBAAoB,IAAI,IAAI,CAE3B;IAED,qEAAqE;IACrE,WAAW,IAAI,IAAI,CAElB;IAED,UAAmB,oBAAoB,IAAI,IAAI,CAsB9C;CACD"}