@harperfast/harper 5.0.0-alpha.10

package/dist/security/jsLoader.js

@@ -0,0 +1,522 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scopedImport = scopedImport;
+exports.preventFunctionConstructor = preventFunctionConstructor;
+const Resource_ts_1 = require("../resources/Resource.js");
+const transaction_ts_1 = require("../resources/transaction.js");
+const RequestTarget_ts_1 = require("../resources/RequestTarget.js");
+const databases_ts_1 = require("../resources/databases.js");
+const promises_1 = require("node:fs/promises");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const node_url_1 = require("node:url");
+const node_vm_1 = require("node:vm");
+const harper_logger_js_1 = __importDefault(require("../utility/logging/harper_logger.js"));
+const node_module_1 = require("node:module");
+const env = __importStar(require("../utility/environment/environmentManager"));
+const hdbTerms_ts_1 = require("../utility/hdbTerms.js");
+const contentTypes_ts_1 = require("../server/serverHelpers/contentTypes.js");
+const APPLICATIONS_LOCKDOWN = env.get(hdbTerms_ts_1.CONFIG_PARAMS.APPLICATIONS_LOCKDOWN);
+let lockedDown = false;
+/**
+ * This is the main entry point for loading plugin and application modules that may be executed in a
+ * separate top level scope. The scope indicates if we use a different top level scope or a standard import.
+ * @param moduleUrl
+ * @param scope
+ */
+async function scopedImport(filePath, scope) {
+    if (!lockedDown && APPLICATIONS_LOCKDOWN && APPLICATIONS_LOCKDOWN !== 'none') {
+        lockedDown = true;
+        if (APPLICATIONS_LOCKDOWN === 'ses') {
+            require('ses'); // load the lockdown function
+            lockdown({
+                domainTaming: 'unsafe',
+                consoleTaming: 'unsafe',
+                errorTaming: 'unsafe',
+                errorTrapping: 'none',
+                stackFiltering: 'verbose',
+            });
+        }
+        else {
+            preventFunctionConstructor();
+            for (let name of Object.getOwnPropertyNames(Object.prototype)) {
+                if (name === '__proto__')
+                    continue;
+                overridableProperty(Object.prototype, name);
+            }
+            overridableProperty(Promise.prototype, 'then');
+            overridableProperty(Date, 'now');
+            for (let Intrinsic of [
+                Object,
+                Array,
+                Promise,
+                BigInt,
+                String,
+                Number,
+                Boolean,
+                Symbol,
+                RegExp,
+                Date,
+                Map,
+                Set,
+                WeakMap,
+                WeakSet,
+                Math,
+                JSON,
+                Reflect,
+                Atomics,
+                SharedArrayBuffer,
+                WeakRef,
+                FinalizationRegistry,
+            ]) {
+                Object.freeze(Intrinsic);
+                Object.freeze(Intrinsic.prototype);
+            }
+            Object.freeze(Function);
+        }
+    }
+    const moduleUrl = (filePath instanceof URL ? filePath : (0, node_url_1.pathToFileURL)(filePath)).toString();
+    try {
+        const containmentMode = scope?.mode;
+        if (scope && containmentMode !== 'none') {
+            if (containmentMode === 'compartment') {
+                // use SES Compartments
+                // note that we use a single compartment per scope and we load it on-demand, only
+                // loading if necessary (since it is actually very heavy)
+                const globals = getGlobalObject(scope);
+                if (!scope.compartment)
+                    scope.compartment = getCompartment(scope, globals);
+                const result = await (await scope.compartment).import(moduleUrl);
+                return result.namespace;
+            } // else use standard node:vm module to do containment
+            return await loadModuleWithVM(moduleUrl, scope);
+        }
+        else {
+            // important! we need to await the import, otherwise the error will not be caught
+            return await import(__rewriteRelativeImportExtension(moduleUrl));
+        }
+    }
+    catch (err) {
+        try {
+            // the actual parse error (internally known as the "arrow message")
+            // is hidden behind a private symbol (arrowMessagePrivateSymbol)
+            // on the error object and the only way to access it is to use the
+            // internal util.decorateErrorStack() function
+            const util = await import('internal/util');
+            util.default.decorateErrorStack(err);
+        }
+        catch {
+            // maybe --expose-internals was not set?
+        }
+        throw err;
+    }
+}
+/**
+ * Load a module using Node's vm.Module API with (not really secure) sandboxing
+ */
+async function loadModuleWithVM(moduleUrl, scope) {
+    const moduleCache = new Map();
+    // Create a secure context with limited globals
+    const contextObject = getGlobalObject(scope);
+    const context = (0, node_vm_1.createContext)(contextObject);
+    /**
+     * Resolve module specifier to absolute URL
+     */
+    function resolveModule(specifier, referrer) {
+        if (specifier === 'harperdb' || specifier === 'harper')
+            return 'harper';
+        if (specifier.startsWith('harper/') || specifier.startsWith('harperdb/')) {
+            throw new Error(`Module ${specifier} is not allowed, may only access the 'harper' module`);
+        }
+        if (specifier.startsWith('file://')) {
+            return specifier;
+        }
+        const resolved = (0, node_module_1.createRequire)(referrer).resolve(specifier);
+        if ((0, node_path_1.isAbsolute)(resolved)) {
+            return (0, node_url_1.pathToFileURL)(resolved).toString();
+        }
+        return resolved;
+    }
+    /**
+     * Load a CommonJS module in our private context
+     */
+    function loadCJS(url, source) {
+        const cjsModule = { exports: {} };
+        if (url.endsWith('.json')) {
+            cjsModule.exports = JSON.parse(source);
+            return cjsModule;
+        }
+        const require = (0, node_module_1.createRequire)(url);
+        const cjsRequire = (spec) => {
+            const resolvedPath = require.resolve(spec);
+            if ((0, node_path_1.isAbsolute)(resolvedPath)) {
+                const source = (0, node_fs_1.readFileSync)(resolvedPath, { encoding: 'utf-8' });
+                return loadCJS(resolvedPath, source).exports;
+            }
+            else {
+                return require(spec);
+            }
+        };
+        cjsRequire.resolve = require.resolve;
+        const cjsWrapper = `
+			(function(module, exports, require, __filename, __dirname) {
+				${source}
+			})
+		`;
+        const wrappedFn = (0, node_vm_1.runInContext)(cjsWrapper, contextObject, {
+            filename: url,
+            async importModuleDynamically(specifier, script) {
+                const resolvedUrl = resolveModule(specifier, script.sourceURL);
+                const useContainment = specifier.startsWith('.') || scope.dependencyContainment;
+                const dynamicModule = await loadModuleWithCache(resolvedUrl, useContainment);
+                return dynamicModule;
+            },
+        });
+        wrappedFn(cjsModule, cjsModule.exports, cjsRequire, url, (0, node_path_1.dirname)(url.startsWith('file://') ? (0, node_url_1.fileURLToPath)(url) : url));
+        return cjsModule;
+    }
+    function loadCJSModule(url, source, usePrivateGlobal) {
+        const cjsModule = usePrivateGlobal ? loadCJS(url, source) : { exports: require(url) };
+        const exportNames = Object.keys(cjsModule.exports);
+        const synModule = new node_vm_1.SyntheticModule(exportNames.length > 0 ? exportNames : ['default'], function () {
+            if (exportNames.length > 0) {
+                for (const key of exportNames) {
+                    this.setExport(key, cjsModule.exports[key]);
+                }
+            }
+            else {
+                this.setExport('default', cjsModule.exports);
+            }
+        }, { identifier: url, context });
+        moduleCache.set(url, synModule);
+        return synModule;
+    }
+    /**
+     * Linker function for module resolution during instantiation
+     */
+    async function linker(specifier, referencingModule) {
+        const resolvedUrl = resolveModule(specifier, referencingModule.identifier);
+        // Check cache first
+        if (moduleCache.has(resolvedUrl)) {
+            return moduleCache.get(resolvedUrl);
+        }
+        const useContainment = specifier.startsWith('.') || scope.dependencyContainment;
+        // Load the module
+        return await loadModuleWithCache(resolvedUrl, useContainment);
+    }
+    function loadModuleWithCache(url, usePrivateGlobal) {
+        // Check cache
+        if (moduleCache.has(url)) {
+            return moduleCache.get(url);
+        }
+        const loadingModule = loadModule(url, usePrivateGlobal);
+        moduleCache.set(url, loadingModule);
+        return loadingModule;
+    }
+    /**
+     * Load a module from URL and create appropriate vm.Module
+     */
+    async function loadModule(url, usePrivateGlobal) {
+        let module;
+        // Handle special built-in modules
+        if (url === 'harper') {
+            let harperExports = getHarperExports(scope);
+            module = new node_vm_1.SyntheticModule(Object.keys(harperExports), function () {
+                for (let key in harperExports) {
+                    this.setExport(key, harperExports[key]);
+                }
+            }, { identifier: url, context });
+        }
+        else if (usePrivateGlobal && url.startsWith('file://')) {
+            checkAllowedModulePath(url, scope.verifyPath);
+            // Load source text from file
+            const source = await (0, promises_1.readFile)(new URL(url), { encoding: 'utf-8' });
+            // Try to parse as ESM first
+            try {
+                module = new node_vm_1.SourceTextModule(source, {
+                    identifier: url,
+                    context,
+                    initializeImportMeta(meta) {
+                        meta.url = url;
+                    },
+                    async importModuleDynamically(specifier) {
+                        const resolvedUrl = resolveModule(specifier, url);
+                        const dynamicModule = await loadModuleWithCache(resolvedUrl, true);
+                        return dynamicModule;
+                    },
+                });
+                // Cache the module
+                moduleCache.set(url, module);
+                // Link the module (resolve all imports)
+                await module.link(linker);
+                // Evaluate the module
+                await module.evaluate();
+                return module;
+            }
+            catch (err) {
+                // If ESM parsing fails, try to load as CommonJS
+                // but first try the cache again
+                if (err.message?.includes('require is not defined') ||
+                    source.includes('module.exports') ||
+                    source.includes('exports.')) {
+                    module = loadCJSModule(url, source, usePrivateGlobal);
+                }
+                else {
+                    throw err;
+                }
+            }
+        }
+        else {
+            checkAllowedModulePath(url, scope.verifyPath);
+            // For Node.js built-in modules (node:) and npm packages, use dynamic import
+            const importedModule = await import(__rewriteRelativeImportExtension(url));
+            const exportNames = Object.keys(importedModule);
+            module = new node_vm_1.SyntheticModule(exportNames, function () {
+                for (const key of exportNames) {
+                    this.setExport(key, importedModule[key]);
+                }
+            }, { identifier: url, context });
+        }
+        // Link the module (resolve all imports)
+        await module.link(linker);
+        // Evaluate the module
+        await module.evaluate();
+        return module;
+    }
+    // Load the entry module
+    const entryModule = await loadModuleWithCache(moduleUrl, true);
+    // Return the module namespace (exports)
+    return entryModule.namespace;
+}
+async function getCompartment(scope, globals) {
+    const { StaticModuleRecord } = await import('@endo/static-module-record');
+    require('ses');
+    const compartment = new Compartment(globals, {
+    //harperdb: { Resource, tables, databases }
+    }, {
+        name: 'harper-app',
+        resolveHook(moduleSpecifier, moduleReferrer) {
+            if (moduleSpecifier === 'harperdb' || moduleSpecifier === 'harper')
+                return 'harper';
+            const resolved = (0, node_module_1.createRequire)(moduleReferrer).resolve(moduleSpecifier);
+            if ((0, node_path_1.isAbsolute)(resolved)) {
+                const resolvedURL = (0, node_url_1.pathToFileURL)(resolved).toString();
+                return resolvedURL;
+            }
+            return moduleSpecifier;
+        },
+        importHook: async (moduleSpecifier) => {
+            if (moduleSpecifier === 'harper') {
+                const harperExports = getHarperExports(scope);
+                return {
+                    imports: [],
+                    exports: Object.keys(harperExports),
+                    execute(exports) {
+                        Object.assign(exports, harperExports);
+                    },
+                };
+            }
+            else if (moduleSpecifier.startsWith('file:') && !moduleSpecifier.includes('node_modules')) {
+                const moduleText = await (0, promises_1.readFile)(new URL(moduleSpecifier), { encoding: 'utf-8' });
+                return new StaticModuleRecord(moduleText, moduleSpecifier);
+            }
+            else {
+                checkAllowedModulePath(moduleSpecifier, scope.verifyPath);
+                const moduleExports = await import(__rewriteRelativeImportExtension(moduleSpecifier));
+                return {
+                    imports: [],
+                    exports: Object.keys(moduleExports),
+                    execute(exports) {
+                        for (const key of Object.keys(moduleExports)) {
+                            exports[key] = moduleExports[key];
+                        }
+                    },
+                };
+            }
+        },
+    });
+    return compartment;
+}
+/**
+ * This a constrained fetch. It certainly is not guaranteed to be safe, but requiring https may
+ * be a good heuristic for preventing access to unsecured resources within a private network.
+ * @param resource
+ * @param options
+ */
+function secureOnlyFetch(resource, options) {
+    // TODO: or maybe we should constrain by doing a DNS lookup and having disallow list of IP addresses that includes
+    // this server
+    const url = typeof resource === 'string' || resource.url;
+    if (new URL(url).protocol != 'https')
+        throw new Error('Only https is allowed in fetch');
+    return fetch(resource, options);
+}
+let defaultJSGlobalNames;
+// get the global variable names that are intrinsically present in a VM context (so we don't override them)
+function getDefaultJSGlobalNames() {
+    if (!defaultJSGlobalNames) {
+        defaultJSGlobalNames = (0, node_vm_1.runInContext)('Object.getOwnPropertyNames((function() { return this })())', (0, node_vm_1.createContext)({}));
+    }
+    return defaultJSGlobalNames;
+}
+/**
+ * Get the set of global variables that should be available to modules that run in scoped compartments/contexts.
+ */
+function getGlobalObject(scope) {
+    const appGlobal = {};
+    // create the new global object, assigning all the global variables from this global
+    // except those that will be natural intrinsics of the new VM
+    for (let name of Object.getOwnPropertyNames(global)) {
+        if (getDefaultJSGlobalNames().includes(name))
+            continue;
+        appGlobal[name] = global[name];
+    }
+    // now assign Harper scope-specific variables
+    Object.assign(appGlobal, {
+        server: scope.server ?? server,
+        logger: scope.logger ?? harper_logger_js_1.default,
+        resources: scope.resources,
+        config: scope.config ?? {},
+        fetch: APPLICATIONS_LOCKDOWN === 'ses' ? secureOnlyFetch : fetch,
+        console,
+        global: appGlobal,
+        harper: getHarperExports(scope),
+    });
+    return appGlobal;
+}
+function getHarperExports(scope) {
+    return {
+        server: scope.server ?? server,
+        logger: scope.logger ?? harper_logger_js_1.default,
+        resources: scope.resources,
+        config: scope.config ?? {},
+        Resource: Resource_ts_1.Resource,
+        tables: databases_ts_1.tables,
+        databases: databases_ts_1.databases,
+        createBlob,
+        RequestTarget: RequestTarget_ts_1.RequestTarget,
+        getContext,
+        transaction: transaction_ts_1.transaction,
+        getResponse,
+        getUser,
+        authenticateUser: server.authenticateUser,
+        operation: server.operation,
+        contentTypes: contentTypes_ts_1.contentTypes,
+    };
+}
+const ALLOWED_NODE_BUILTIN_MODULES = new Set([
+    'assert',
+    'http',
+    'https',
+    'path',
+    'url',
+    'util',
+    'stream',
+    'crypto',
+    'buffer',
+    'string_decoder',
+    'querystring',
+    'punycode',
+    'zlib',
+    'events',
+    'timers',
+    'process',
+    'async_hooks',
+    'console',
+    'perf_hooks',
+    'diagnostics_channel',
+    'fs',
+]);
+function checkAllowedModulePath(moduleUrl, containingFolder) {
+    if (moduleUrl.startsWith('file:')) {
+        const path = moduleUrl.slice(7);
+        if (!containingFolder || path.startsWith(containingFolder)) {
+            return true;
+        }
+        throw new Error(`Can not load module outside of application folder ${containingFolder}`);
+    }
+    let simpleName = moduleUrl.startsWith('node:') ? moduleUrl.slice(5) : moduleUrl;
+    simpleName = simpleName.split('/')[0];
+    if (ALLOWED_NODE_BUILTIN_MODULES.has(simpleName))
+        return true;
+    throw new Error(`Module ${moduleUrl} is not allowed to be imported`);
+}
+function getContext() {
+    return transaction_ts_1.contextStorage.getStore() ?? {};
+}
+function getUser() {
+    return transaction_ts_1.contextStorage.getStore()?.user;
+}
+function getResponse() {
+    return transaction_ts_1.contextStorage.getStore()?.response;
+}
+function preventFunctionConstructor() {
+    Function.prototype.constructor = function () { }; // prevent this from being used to eval data in a parent context
+}
+/**
+ * This can redefine a property into a getter/setter that will allow derivatives of a prototype to assign
+ * a value to the property without incurring an error from the property being frozen and readonly.
+ * @param target
+ * @param name
+ * @param value
+ */
+function overridableProperty(target, name, value = target[name]) {
+    Object.defineProperty(target, name, {
+        get() {
+            return value;
+        },
+        set(value) {
+            Object.defineProperty(this, name, {
+                value,
+                configurable: true,
+                enumerable: true,
+                writable: true,
+            });
+        },
+    });
+}
+//# sourceMappingURL=jsLoader.js.map

package/dist/security/jsLoader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsLoader.js","sourceRoot":"","sources":["../../security/jsLoader.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,oCAgFC;AA6XD,gEAEC;AA1eD,0DAAoD;AACpD,gEAA0E;AAC1E,oEAA8D;AAC9D,4DAA8D;AAC9D,+CAA4C;AAC5C,qCAAuC;AACvC,yCAAgD;AAChD,uCAAwD;AACxD,qCAAyF;AAEzF,2FAAyD;AACzD,6CAA4C;AAC5C,+EAAiE;AACjE,wDAAuD;AACvD,6EAAuE;AAIvE,MAAM,qBAAqB,GAAa,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,qBAAqB,CAAC,CAAC;AAErF,IAAI,UAAU,GAAG,KAAK,CAAC;AACvB;;;;;GAKG;AACI,KAAK,UAAU,YAAY,CAAC,QAAsB,EAAE,KAAwB;IAClF,IAAI,CAAC,UAAU,IAAI,qBAAqB,IAAI,qBAAqB,KAAK,MAAM,EAAE,CAAC;QAC9E,UAAU,GAAG,IAAI,CAAC;QAClB,IAAI,qBAAqB,KAAK,KAAK,EAAE,CAAC;YACrC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,6BAA6B;YAC7C,QAAQ,CAAC;gBACR,YAAY,EAAE,QAAQ;gBACtB,aAAa,EAAE,QAAQ;gBACvB,WAAW,EAAE,QAAQ;gBACrB,aAAa,EAAE,MAAM;gBACrB,cAAc,EAAE,SAAS;aACzB,CAAC,CAAC;QACJ,CAAC;aAAM,CAAC;YACP,0BAA0B,EAAE,CAAC;YAC7B,KAAK,IAAI,IAAI,IAAI,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC/D,IAAI,IAAI,KAAK,WAAW;oBAAE,SAAS;gBACnC,mBAAmB,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAC7C,CAAC;YACD,mBAAmB,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAC/C,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACjC,KAAK,IAAI,SAAS,IAAI;gBACrB,MAAM;gBACN,KAAK;gBACL,OAAO;gBACP,MAAM;gBACN,MAAM;gBACN,MAAM;gBACN,OAAO;gBACP,MAAM;gBACN,MAAM;gBACN,IAAI;gBACJ,GAAG;gBACH,GAAG;gBACH,OAAO;gBACP,OAAO;gBACP,IAAI;gBACJ,IAAI;gBACJ,OAAO;gBACP,OAAO;gBACP,iBAAiB;gBACjB,OAAO;gBACP,oBAAoB;aACpB,EAAE,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACzB,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACpC,CAAC;YACD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;IACF,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,QAAQ,YAAY,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAA,wBAAa,EAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5F,IAAI,CAAC;QACJ,MAAM,eAAe,GAAG,KAAK,EAAE,IAAI,CAAC;QACpC,IAAI,KAAK,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;YACzC,IAAI,eAAe,KAAK,aAAa,EAAE,CAAC;gBACvC,uBAAuB;gBACvB,iFAAiF;gBACjF,yDAAyD;gBACzD,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;gBACvC,IAAI,CAAC,KAAK,CAAC,WAAW;oBAAE,KAAK,CAAC,WAAW,GAAG,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC3E,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACjE,OAAO,MAAM,CAAC,SAAS,CAAC;YACzB,CAAC,CAAC,qDAAqD;YACvD,OAAO,MAAM,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACP,iFAAiF;YACjF,OAAO,MAAM,MAAM,kCAAC,SAAS,EAAC,CAAC;QAChC,CAAC;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACJ,mEAAmE;YACnE,gEAAgE;YAChE,kEAAkE;YAClE,8CAA8C;YAC9C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;YAC3C,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACR,wCAAwC;QACzC,CAAC;QACD,MAAM,GAAG,CAAC;IACX,CAAC;AACF,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,gBAAgB,CAAC,SAAiB,EAAE,KAAuB;IACzE,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuD,CAAC;IAEnF,+CAA+C;IAC/C,MAAM,aAAa,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAA,uBAAa,EAAC,aAAa,CAAC,CAAC;IAE7C;;OAEG;IACH,SAAS,aAAa,CAAC,SAAiB,EAAE,QAAgB;QACzD,IAAI,SAAS,KAAK,UAAU,IAAI,SAAS,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAC;QACxE,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,UAAU,SAAS,sDAAsD,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,MAAM,QAAQ,GAAG,IAAA,2BAAa,EAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,IAAA,sBAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAA,wBAAa,EAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3C,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,SAAS,OAAO,CAAC,GAAW,EAAE,MAAc;QAC3C,MAAM,SAAS,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAClC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACvC,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,IAAA,2BAAa,EAAC,GAAG,CAAC,CAAC;QAEnC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE;YACnC,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,IAAA,sBAAU,EAAC,YAAY,CAAC,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,IAAA,sBAAY,EAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;gBACjE,OAAO,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACP,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;QACF,CAAC,CAAC;QACF,UAAU,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAErC,MAAM,UAAU,GAAG;;MAEf,MAAM;;GAET,CAAC;QAEF,MAAM,SAAS,GAAG,IAAA,sBAAY,EAAC,UAAU,EAAE,aAAa,EAAE;YACzD,QAAQ,EAAE,GAAG;YACb,KAAK,CAAC,uBAAuB,CAAC,SAAiB,EAAE,MAAM;gBACtD,MAAM,WAAW,GAAG,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC/D,MAAM,cAAc,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC;gBAChF,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;gBAC7E,OAAO,aAAa,CAAC;YACtB,CAAC;SACD,CAAC,CAAC;QACH,SAAS,CACR,SAAS,EACT,SAAS,CAAC,OAAO,EACjB,UAAU,EACV,GAAG,EACH,IAAA,mBAAO,EAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAA,wBAAa,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAC7D,CAAC;QAEF,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,SAAS,aAAa,CAAC,GAAW,EAAE,MAAc,EAAE,gBAAyB;QAC5E,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,IAAI,yBAAe,CACpC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAClD;YACC,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;oBAC/B,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC7C,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;YAC9C,CAAC;QACF,CAAC,EACD,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,CAC5B,CAAC;QACF,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAChC,OAAO,SAAS,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,MAAM,CAAC,SAAiB,EAAE,iBAAqD;QAC7F,MAAM,WAAW,GAAG,aAAa,CAAC,SAAS,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAE3E,oBAAoB;QACpB,IAAI,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAClC,OAAO,WAAW,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,CAAC;QAED,MAAM,cAAc,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC;QAChF,kBAAkB;QAClB,OAAO,MAAM,mBAAmB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAC/D,CAAC;IAED,SAAS,mBAAmB,CAAC,GAAW,EAAE,gBAAyB;QAClE,cAAc;QACd,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,WAAW,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;QAC9B,CAAC;QACD,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACxD,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QACpC,OAAO,aAAa,CAAC;IACtB,CAAC;IACD;;OAEG;IACH,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,gBAAyB;QAC/D,IAAI,MAA0C,CAAC;QAE/C,kCAAkC;QAClC,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACtB,IAAI,aAAa,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,GAAG,IAAI,yBAAe,CAC3B,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,EAC1B;gBACC,KAAK,IAAI,GAAG,IAAI,aAAa,EAAE,CAAC;oBAC/B,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;gBACzC,CAAC;YACF,CAAC,EACD,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,CAC5B,CAAC;QACH,CAAC;aAAM,IAAI,gBAAgB,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1D,sBAAsB,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;YAC9C,6BAA6B;YAC7B,MAAM,MAAM,GAAG,MAAM,IAAA,mBAAQ,EAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YAEnE,4BAA4B;YAC5B,IAAI,CAAC;gBACJ,MAAM,GAAG,IAAI,0BAAgB,CAAC,MAAM,EAAE;oBACrC,UAAU,EAAE,GAAG;oBACf,OAAO;oBACP,oBAAoB,CAAC,IAAI;wBACxB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;oBAChB,CAAC;oBACD,KAAK,CAAC,uBAAuB,CAAC,SAAiB;wBAC9C,MAAM,WAAW,GAAG,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;wBAClD,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;wBACnE,OAAO,aAAa,CAAC;oBACtB,CAAC;iBACD,CAAC,CAAC;gBACH,mBAAmB;gBACnB,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC7B,wCAAwC;gBACxC,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAE1B,sBAAsB;gBACtB,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACxB,OAAO,MAAM,CAAC;YACf,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,gDAAgD;gBAChD,gCAAgC;gBAChC,IACC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,wBAAwB,CAAC;oBAC/C,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC;oBACjC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAC1B,CAAC;oBACF,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;gBACvD,CAAC;qBAAM,CAAC;oBACP,MAAM,GAAG,CAAC;gBACX,CAAC;YACF,CAAC;QACF,CAAC;aAAM,CAAC;YACP,sBAAsB,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;YAC9C,4EAA4E;YAC5E,MAAM,cAAc,GAAG,MAAM,MAAM,kCAAC,GAAG,EAAC,CAAC;YACzC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAEhD,MAAM,GAAG,IAAI,yBAAe,CAC3B,WAAW,EACX;gBACC,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;oBAC/B,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1C,CAAC;YACF,CAAC,EACD,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,CAC5B,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE1B,sBAAsB;QACtB,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;QAExB,OAAO,MAAM,CAAC;IACf,CAAC;IAED,wBAAwB;IACxB,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAE/D,wCAAwC;IACxC,OAAO,WAAW,CAAC,SAAS,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAAuB,EAAE,OAAO;IAC7D,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;IAC1E,OAAO,CAAC,KAAK,CAAC,CAAC;IACf,MAAM,WAAW,GAAuB,IAAK,WAAyC,CACrF,OAAO,EACP;IACC,2CAA2C;KAC3C,EACD;QACC,IAAI,EAAE,YAAY;QAClB,WAAW,CAAC,eAAe,EAAE,cAAc;YAC1C,IAAI,eAAe,KAAK,UAAU,IAAI,eAAe,KAAK,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YACpF,MAAM,QAAQ,GAAG,IAAA,2BAAa,EAAC,cAAc,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACxE,IAAI,IAAA,sBAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1B,MAAM,WAAW,GAAG,IAAA,wBAAa,EAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;gBACvD,OAAO,WAAW,CAAC;YACpB,CAAC;YACD,OAAO,eAAe,CAAC;QACxB,CAAC;QACD,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE;YACrC,IAAI,eAAe,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,aAAa,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;gBAC9C,OAAO;oBACN,OAAO,EAAE,EAAE;oBACX,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC;oBACnC,OAAO,CAAC,OAAO;wBACd,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;oBACvC,CAAC;iBACD,CAAC;YACH,CAAC;iBAAM,IAAI,eAAe,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC7F,MAAM,UAAU,GAAG,MAAM,IAAA,mBAAQ,EAAC,IAAI,GAAG,CAAC,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;gBACnF,OAAO,IAAI,kBAAkB,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;YAC5D,CAAC;iBAAM,CAAC;gBACP,sBAAsB,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC1D,MAAM,aAAa,GAAG,MAAM,MAAM,kCAAC,eAAe,EAAC,CAAC;gBACpD,OAAO;oBACN,OAAO,EAAE,EAAE;oBACX,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC;oBACnC,OAAO,CAAC,OAAO;wBACd,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;4BAC9C,OAAO,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;wBACnC,CAAC;oBACF,CAAC;iBACD,CAAC;YACH,CAAC;QACF,CAAC;KACD,CACD,CAAC;IACF,OAAO,WAAW,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,QAAQ,EAAE,OAAO;IACzC,kHAAkH;IAClH,cAAc;IACd,MAAM,GAAG,GAAG,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,GAAG,CAAC;IACzD,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACxF,OAAO,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,IAAI,oBAA8B,CAAC;AACnC,2GAA2G;AAC3G,SAAS,uBAAuB;IAC/B,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC3B,oBAAoB,GAAG,IAAA,sBAAY,EAClC,4DAA4D,EAC5D,IAAA,uBAAa,EAAC,EAAE,CAAC,CACjB,CAAC;IACH,CAAC;IACD,OAAO,oBAAoB,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,KAAuB;IAC/C,MAAM,SAAS,GAAG,EAAE,CAAC;IACrB,oFAAoF;IACpF,6DAA6D;IAC7D,KAAK,IAAI,IAAI,IAAI,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,IAAI,uBAAuB,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QACvD,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IACD,6CAA6C;IAC7C,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,MAAM;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,0BAAM;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;QAC1B,KAAK,EAAE,qBAAqB,KAAK,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK;QAChE,OAAO;QACP,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC;KAC/B,CAAC,CAAC;IACH,OAAO,SAAS,CAAC;AAClB,CAAC;AACD,SAAS,gBAAgB,CAAC,KAAuB;IAChD,OAAO;QACN,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,MAAM;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,0BAAM;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;QAC1B,QAAQ,EAAR,sBAAQ;QACR,MAAM,EAAN,qBAAM;QACN,SAAS,EAAT,wBAAS;QACT,UAAU;QACV,aAAa,EAAb,gCAAa;QACb,UAAU;QACV,WAAW,EAAX,4BAAW;QACX,WAAW;QACX,OAAO;QACP,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,YAAY,EAAZ,8BAAY;KACZ,CAAC;AACH,CAAC;AACD,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC;IAC5C,QAAQ;IACR,MAAM;IACN,OAAO;IACP,MAAM;IACN,KAAK;IACL,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,gBAAgB;IAChB,aAAa;IACb,UAAU;IACV,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,aAAa;IACb,SAAS;IACT,YAAY;IACZ,qBAAqB;IACrB,IAAI;CACJ,CAAC,CAAC;AACH,SAAS,sBAAsB,CAAC,SAAiB,EAAE,gBAAyB;IAC3E,IAAI,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC5D,OAAO,IAAI,CAAC;QACb,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,gBAAgB,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,4BAA4B,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,IAAI,KAAK,CAAC,UAAU,SAAS,gCAAgC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,UAAU;IAClB,OAAO,+BAAc,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;AACxC,CAAC;AACD,SAAS,OAAO;IACf,OAAO,+BAAc,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC;AACxC,CAAC;AACD,SAAS,WAAW;IACnB,OAAO,+BAAc,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC;AAC5C,CAAC;AAED,SAAgB,0BAA0B;IACzC,QAAQ,CAAC,SAAS,CAAC,WAAW,GAAG,cAAa,CAAC,CAAC,CAAC,gEAAgE;AAClH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;IAC9D,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE;QACnC,GAAG;YACF,OAAO,KAAK,CAAC;QACd,CAAC;QACD,GAAG,CAAC,KAAK;YACR,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE;gBACjC,KAAK;gBACL,YAAY,EAAE,IAAI;gBAClB,UAAU,EAAE,IAAI;gBAChB,QAAQ,EAAE,IAAI;aACd,CAAC,CAAC;QACJ,CAAC;KACD,CAAC,CAAC;AACJ,CAAC"}

package/dist/security/keys.d.ts

@@ -0,0 +1,119 @@
+export function getPrivateKeys(): Map<any, any>;
+export function generateKeys(): Promise<{
+    publicKey: any;
+    privateKey: any;
+}>;
+export function updateConfigCert(): void;
+export function setCertTable(certRecord: any): Promise<void>;
+export function getCertTable(): any;
+/**
+ * This is responsible for loading any certificates that are in the harperdb-config.yaml file and putting them into the hdbCertificate table.
+ * @return {*}
+ */
+export function loadCertificates(): any;
+export function reviewSelfSignedCert(): Promise<void>;
+/**
+ * Create a TLS selector that will choose the best TLS configuration/context for a given hostname
+ * @param type
+ * @param mtlsOptions
+ * @return {(function(*, *): (*|undefined))|*}
+ */
+export function createTLSSelector(type: any, mtlsOptions: any): ((arg0: any, arg1: any) => (any | undefined)) | any;
+/**
+ * List all the records in hdbCertificate table
+ * @returns {Promise<*[]>}
+ */
+export function listCertificates(): Promise<any[]>;
+export function generateCertsKeys(): Promise<void>;
+export function getReplicationCert(): Promise<any>;
+export function getReplicationCertAuth(): Promise<any>;
+/**
+ * Delete any existing self-signed certs (including CA) and create new ones
+ * @returns {Promise<void>}
+ */
+export function renewSelfSigned(): Promise<void>;
+export function hostnamesFromCert(cert: any): any;
+export function getHostnamesFromCertificate(certificate: any): any[];
+export function getPrimaryHostName(cert: any): any;
+/**
+ * Generates a cryptographically secure serial number for X.509 certificates.
+ *
+ * Returns a hex string as expected by node-forge. Ensures the high bit is cleared
+ * to create a positive ASN.1 INTEGER per RFC 5280 requirements.
+ *
+ * @returns {string} 16-character hex string
+ */
+export function generateSerialNumber(): string;
+export function getCertAuthority(): Promise<{
+    ca: any;
+    private_key: any;
+}>;
+export function certExtensions(): ({
+    name: string;
+    cA: boolean;
+    critical: boolean;
+    digitalSignature?: undefined;
+    keyEncipherment?: undefined;
+    serverAuth?: undefined;
+    clientAuth?: undefined;
+    client?: undefined;
+    server?: undefined;
+    altNames?: undefined;
+} | {
+    name: string;
+    digitalSignature: boolean;
+    keyEncipherment: boolean;
+    critical: boolean;
+    cA?: undefined;
+    serverAuth?: undefined;
+    clientAuth?: undefined;
+    client?: undefined;
+    server?: undefined;
+    altNames?: undefined;
+} | {
+    name: string;
+    serverAuth: boolean;
+    clientAuth: boolean;
+    cA?: undefined;
+    critical?: undefined;
+    digitalSignature?: undefined;
+    keyEncipherment?: undefined;
+    client?: undefined;
+    server?: undefined;
+    altNames?: undefined;
+} | {
+    name: string;
+    client: boolean;
+    server: boolean;
+    cA?: undefined;
+    critical?: undefined;
+    digitalSignature?: undefined;
+    keyEncipherment?: undefined;
+    serverAuth?: undefined;
+    clientAuth?: undefined;
+    altNames?: undefined;
+} | {
+    name: string;
+    altNames: ({
+        type: number;
+        ip: string;
+        value?: undefined;
+    } | {
+        type: number;
+        value: string;
+        ip?: undefined;
+    })[];
+    cA?: undefined;
+    critical?: undefined;
+    digitalSignature?: undefined;
+    keyEncipherment?: undefined;
+    serverAuth?: undefined;
+    clientAuth?: undefined;
+    client?: undefined;
+    server?: undefined;
+})[];
+export function getCommonName(): string;
+export const CERT_ATTRIBUTES: {
+    name: string;
+    value: string;
+}[];