axiodb 11.9.16 → 12.10.18

package/README.md

@@ -29,6 +29,7 @@
 - [AxioDBCloud — Connecting Remotely](#-axiodbcloud--connecting-remotely)
   - [Simple: connect without authentication](#simple-connect-without-authentication)
   - [Advanced: TCP authentication](#advanced-tcp-authentication)
+  - [Advanced: TLS encryption](#advanced-tls-encryption)
 - [Troubleshooting](#-troubleshooting)
 - [Docker Deployment](#-docker-deployment)
   - [Simple: run the container](#simple-run-the-container)
@@ -212,7 +213,9 @@ await session.withTransaction(async (tx) => {
 - **🔁 Auto-Reconnect:** exponential backoff, up to 10 retry attempts
 - **💓 Heartbeat Monitoring:** `PING`/`PONG` every 30 seconds
 - **🆔 Request Correlation:** UUID-based request/response matching
-- **🧵 Connection Pooling:** client keeps a pool of `maxPoolSize` concurrent connections (default: 10, mirrors MongoDB's driver option) and distributes commands round-robin; server accepts 1,000+ concurrent connections total
+- **🧵 Connection Pooling:** client keeps a pool of `maxPoolSize` concurrent connections (default: 10, mirrors MongoDB's driver option) and routes each command to the least-busy connected member (fewest in-flight requests); server accepts 1,000+ concurrent connections total, capped at 100 per remote IP (see the [file descriptor limit note](#connection-refused--too-many-open-files-errors-at-high-concurrency) below if you're running near that scale)
+- **🛡️ Connection-Level DoS Protection:** per-IP concurrent connection cap (100) plus a separate per-IP connection-*attempt* rate limiter (300 attempts / 10s → 30s cooldown), so one client can't starve the server either by holding too many sockets open or by rapidly opening and dropping them
+- **🔒 Optional TLS Encryption:** encrypt the wire protocol with your own cert (see [Advanced: TLS](#advanced-tls-encryption) below) — off by default, so existing plaintext deployments are unaffected unless you turn it on
 - **📐 TypeScript Support:** full type definitions included
 
 **Use cases:** microservices sharing one AxioDB instance, Electron apps connecting to a local or remote database, teams sharing a development database, container/cloud deployments (AWS, Azure, GCP, DigitalOcean).
@@ -280,7 +283,56 @@ await client.login('admin', 'admin');
 - **Accounts that still need their forced password change are rejected outright (`403`)**, not allowed through with a warning — there's no TCP command to change a password today, so log into the GUI (`http://localhost:27018`) to complete it first, or authenticate with an account that already has.
 - If a Super Admin resets a user's password, changes their role, or deletes them via the GUI while that user has an open TCP connection, the TCP connection is immediately forced to re-authenticate on its next command.
 
-**Known limitations:** the TCP protocol itself is unencrypted (no TLS) — deploy behind a private network, VPN, or your own TLS termination if connecting over an untrusted network. There's currently no TCP command to change a password; that must go through the GUI.
+**Known limitations:** there's currently no TCP command to change a password; that must go through the GUI.
+
+### Advanced: TLS encryption
+
+By default, the TCP protocol is **plaintext** — anyone who can capture the network traffic between client and server (e.g. Wireshark on a shared network) can read your data and, if `TCPAuth` is on, your password. TLS fixes this. It's **off by default** — nothing below is required, and existing plaintext deployments keep working exactly as before unless you turn it on.
+
+**You must provide your own certificate + key.** AxioDB never generates one for you — that's a security decision only you can make (a real cert from a CA, or a self-signed one for local/private use).
+
+**Step 1 — get a cert + key.** For local/dev/private use, generate a self-signed one (one-time, takes a second):
+```bash
+openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes -subj "/CN=localhost"
+```
+This creates two files, `cert.pem` and `key.pem`, in your current folder. For a real production deployment reachable from the internet, use a cert from a real CA (Let's Encrypt, your org's CA, your cloud provider's managed cert) instead — the rest of the setup below is identical either way.
+
+**Step 2 — point the server at them:**
+```javascript
+const { AxioDB } = require('axiodb');
+const db = new AxioDB({
+  TCP: true,
+  TLS: true,
+  TLSCertPath: './cert.pem', // path to the file from step 1
+  TLSKeyPath: './key.pem',
+});
+```
+If `TLS: true` but either path is missing or unreadable, AxioDB throws immediately at startup — it never silently falls back to plaintext.
+
+**Step 3 — point the client at the same cert** (only needed because it's self-signed; a real CA-issued cert wouldn't need this step, the same way your browser trusts `https://` sites without extra setup):
+```javascript
+const { AxioDBCloud } = require('axiodb');
+const client = new AxioDBCloud("axiodb://localhost:27019", {
+  tls: true,
+  tlsCAPath: './cert.pem', // same cert.pem from step 1 - proves this server is the real one
+});
+await client.connect();
+```
+Without `tlsCAPath`, the client refuses to connect to a self-signed server by default (`tlsRejectUnauthorized` defaults to `true`) — this is intentional, it's the same protection that stops your browser from silently trusting a fake `https://` site. Only set `tlsRejectUnauthorized: false` for local/dev testing, never in production, since it turns that protection off entirely.
+
+**Running this in Docker?** The cert/key files need to get *into* the container. The simplest way to think about it: your cert files live on your real machine; a Docker **bind mount** (`-v`) makes a folder from your machine visible inside the container at whatever path you choose, and you point `AXIODB_TLS_CERT_PATH`/`AXIODB_TLS_KEY_PATH` at *that in-container path*, not your real machine's path:
+```bash
+# cert.pem and key.pem are really at /home/you/mycerts/ on your machine.
+# "/certs" below is just a name we're choosing for where they'll appear inside the container.
+docker run -d --name axiodb-server \
+  -p 27018:27018 -p 27019:27019 \
+  -v /home/you/mycerts:/certs:ro \
+  -e AXIODB_TLS=true \
+  -e AXIODB_TLS_CERT_PATH=/certs/cert.pem \
+  -e AXIODB_TLS_KEY_PATH=/certs/key.pem \
+  theankansaha/axiodb
+```
+The rule: the `-e AXIODB_TLS_CERT_PATH=...` value must always match the *right-hand side* of the `-v` mount (`/certs/...`), never the real path on your machine (`/home/you/mycerts/...`) — the container can't see your machine's filesystem directly, only whatever you've explicitly mounted into it.
 
 👉 **[Full AxioDBCloud Documentation](https://axiodb.in/cloud)** — setup guides, API reference, Docker examples
 
@@ -316,6 +368,27 @@ Your credentials are correct, but that account is still flagged for a forced pas
 
 Five failed logins from your IP within 15 minutes trigger a 15-minute lockout, shared between TCP and the GUI. Double check the credentials you're sending, wait out the cooldown, or fix the underlying typo/config issue causing repeated failures — there's no way to clear the lockout early.
 
+### `429` — "Too many concurrent connections from this IP address"
+
+Unrelated to the login lockout above — this fires at connection time, before any `AUTHENTICATE`, once a single remote IP has 100 concurrent open TCP sockets to the server (`MAX_CONNECTIONS_PER_IP`), regardless of whether any of those connections are authenticated. This caps how much of the server's total 1,000-connection budget one IP can claim, so one client can't starve every other client. It's per-*connection*, not per-*request* — a single `AxioDBCloud` client at the default `maxPoolSize: 10` is nowhere near this limit; you'd only hit it by running many separate client processes behind the same IP/NAT gateway, or a runaway reconnect loop leaking sockets. If you legitimately need more than 100 concurrent connections from one IP, that's a server-side constant (`MAX_CONNECTIONS_PER_IP` in `source/tcp/config/keys.ts`) — there's no runtime option to raise it yet.
+
+If you do set a `maxPoolSize` that pushes past this cap (or any other subset of the pool fails for another reason, e.g. a network blip), `connect()` doesn't throw as long as at least one pool member connected — it resolves with a smaller-than-requested pool and emits a `poolDegraded` event so you know about it instead of silently running under capacity:
+
+```javascript
+client.on('poolDegraded', ({ requested, connected, failed, errors }) => {
+  console.warn(`Pool came up smaller than requested: ${connected}/${requested} connected, ${failed} failed`);
+  console.warn(errors[0].message); // e.g. "Too many concurrent connections from this IP address"
+});
+
+await client.connect(); // resolves even if some pool members were rejected
+```
+
+(The very first connection in the pool is the exception — if *that* one fails, `connect()` rejects entirely, since it's the signal that the server is reachable and credentials are valid at all.)
+
+### `429` — "Too many connection attempts from this IP address. Try again later."
+
+Different from both `429`s above, and checked first: this guards against rapid connect-then-drop *churn*, which the concurrent-connection cap (`MAX_CONNECTIONS_PER_IP`) doesn't catch on its own — an attacker who never holds more than a few sockets open at once could still hammer the server with a high rate of connection attempts, each costing a TCP handshake and an accept/reject cycle, and stay under that cap the whole time. This is tracked separately, per IP, as a sliding window: once an IP crosses 300 connection attempts (successful or rejected, it doesn't matter which) within a trailing 10-second window, every new connection from that IP is rejected outright for the next 30 seconds. A normal `AxioDBCloud` client, even reconnecting a full `maxPoolSize: 10` pool repeatedly, is nowhere near this threshold — you'd only hit it via a genuine connection flood or a reconnect loop gone very wrong (e.g. retrying without backoff). There's no runtime option to raise these thresholds yet; they're constants in `source/tcp/config/keys.ts` (`CONNECTION_RATE_LIMIT_*`).
+
 ### `403` — "This is a reserved system database"
 
 You (or a client) tried to read/write a database literally named `config` — that name is reserved for AxioDB's own RBAC storage (`users`/`roles`/`permissions`) and is blocked on both the GUI and TCP, authenticated or not. Use a different database name.
@@ -330,6 +403,37 @@ You (or a client) tried to read/write a database literally named `config` — th
 
 See the [Docker Deployment](#-docker-deployment) section below, and `Docker/README.md` in the repository for a fuller Docker-specific troubleshooting guide (`docker logs`, port-conflict remapping, volume-mounting checklist).
 
+### Connection refused / "Too many open files" errors at high concurrency
+
+Each `AxioDBCloud` client opens `maxPoolSize` TCP sockets (default: 10), and the server holds one socket per connected client — both count against the OS's open-file-descriptor limit. Most Linux distros default `ulimit -n` to 1024 per process, which is enough for only ~100 clients at the default pool size before the server starts refusing new connections with `EMFILE`/`ENFILE`.
+
+If you're deploying towards the 1,000+ concurrent connections the server supports, raise the limit before starting the process:
+
+```bash
+ulimit -n 65536          # current shell / process
+node lib/config/DB.js
+```
+
+In Docker, set it on the container instead of the host shell:
+
+```bash
+docker run --ulimit nofile=65536:65536 -p 27018:27018 -p 27019:27019 theankansaha/axiodb
+```
+
+or, in Compose:
+
+```yaml
+services:
+  axiodb:
+    image: theankansaha/axiodb
+    ulimits:
+      nofile:
+        soft: 65536
+        hard: 65536
+```
+
+On the client side, prefer a smaller `maxPoolSize` per instance rather than raising it — the least-busy routing (see [Connection Pooling](#-axiodbcloud--connecting-remotely) above) already avoids the head-of-line blocking a bigger pool would otherwise compensate for.
+
 ---
 
 ## 🐳 Docker Deployment
@@ -362,12 +466,15 @@ Every option below has a default matching the image's previous fixed behavior
 | `AXIODB_GUI` | `true` | Enable the HTTP Control Server / web GUI on port 27018 |
 | `AXIODB_TCP` | `true` | Enable the AxioDBCloud TCP server on port 27019 |
 | `AXIODB_TCP_AUTH` | `true` | Require username/password authentication on TCP connections (same RBAC accounts as the GUI) |
+| `AXIODB_TLS` | `false` | Encrypt TCP connections with TLS instead of plaintext (see [Advanced: TLS encryption](#advanced-tls-encryption)) |
+| `AXIODB_TLS_CERT_PATH` | *(none)* | Path **inside the container** to a PEM cert file - required when `AXIODB_TLS=true`. Mount the real file in with `-v` first (see the TLS section above) |
+| `AXIODB_TLS_KEY_PATH` | *(none)* | Path **inside the container** to the matching PEM private key - required when `AXIODB_TLS=true` |
 | `AXIODB_ROOT_NAME` | `AxioDB` | Name of the root database folder created under the data volume |
 | `AXIODB_CUSTOM_PATH` | *(container's working directory)* | Custom path for database storage inside the container |
 
 > Ports themselves (27018/27019) aren't configurable via environment variable — remap them at the Docker layer with `-p <host-port>:27018` / `-p <host-port>:27019`.
 
-**Disabling TCP authentication** (only on a trusted private network — the wire is unencrypted; see [Known limitations](#advanced-tcp-authentication)):
+**Disabling TCP authentication** (only on a trusted private network — the wire is plaintext unless you also enable `AXIODB_TLS`; see [Advanced: TLS encryption](#advanced-tls-encryption)):
 ```bash
 docker run -d \
   --name axiodb-server \
@@ -402,6 +509,34 @@ volumes:
   axiodb-data:
 ```
 
+**The same, with TLS enabled** — note the two different kinds of entry under `volumes:`: `./mycerts:/certs:ro` is *your real folder* on the machine running Compose (because it contains a `/`), mounted read-only at `/certs` inside the container; `axiodb-data:/app` is a Docker-managed named volume (no `/`, just a label) for the actual database files:
+```yaml
+version: "3.8"
+
+services:
+  axiodb:
+    image: theankansaha/axiodb
+    container_name: axiodb-server
+    ports:
+      - "27018:27018"
+      - "27019:27019"
+    environment:
+      - AXIODB_GUI=true
+      - AXIODB_TCP=true
+      - AXIODB_TCP_AUTH=true
+      - AXIODB_TLS=true
+      - AXIODB_TLS_CERT_PATH=/certs/cert.pem
+      - AXIODB_TLS_KEY_PATH=/certs/key.pem
+      - AXIODB_ROOT_NAME=AxioDB
+    volumes:
+      - ./mycerts:/certs:ro      # your real cert.pem/key.pem folder -> /certs in the container
+      - axiodb-data:/app         # Docker-managed volume for database files
+    restart: unless-stopped
+
+volumes:
+  axiodb-data:
+```
+
 **Building the image from source, and a fuller Docker troubleshooting guide** (container won't start, port-in-use, data-persistence checks) live in [`Docker/README.md`](Docker/README.md) — the canonical Docker doc, not duplicated here in full.
 
 ---
@@ -445,7 +580,7 @@ A Super Admin can create additional roles from the predefined permission catalog
 
 **Index management:** the Control Server also exposes `GET /api/index/list`, `POST /api/index/create`, and `DELETE /api/index/delete`, gated by the same `index:view` / `index:create` / `index:delete` permissions (View role gets view-only, Admin and Super Admin get all three).
 
-> **Security note:** RBAC protects the Control Server's HTTP API and TCP server; both are still intended for trusted local/network access, not public internet exposure. See [Troubleshooting](#-troubleshooting) for the TLS caveat on TCP.
+> **Security note:** RBAC protects the Control Server's HTTP API and TCP server, but the HTTP GUI itself has no TLS support - keep it on a trusted local/private network, not public internet exposure. The TCP server *can* be encrypted (see [Advanced: TLS encryption](#advanced-tls-encryption)), which is recommended if it's reachable over any untrusted network.
 
 ---
 
@@ -764,7 +899,7 @@ Yes. Full type definitions are included — no separate `@types` package needed.
 No. AxioDB requires Node.js (v20+) and the filesystem — server-side and desktop only.
 
 **Q: What is AxioDBCloud?**
-TCP-based remote access for AxioDB. Deploy AxioDB in Docker, connect from multiple clients with the exact same API. Supports 1,000+ concurrent connections with auto-reconnect. Optional username/password authentication (`TCPAuth: true`) reuses the same RBAC accounts as the GUI — see [AxioDBCloud](#-axiodbcloud--connecting-remotely) above.
+TCP-based remote access for AxioDB. Deploy AxioDB in Docker, connect from multiple clients with the exact same API. Supports 1,000+ concurrent connections with auto-reconnect. Optional username/password authentication (`TCPAuth: true`) reuses the same RBAC accounts as the GUI, and optional TLS encryption (`TLS: true`) protects the wire protocol on untrusted networks — see [AxioDBCloud](#-axiodbcloud--connecting-remotely) above.
 
 ---
 

package/lib/Helper/Converter.helper.d.ts

@@ -1,34 +1,9 @@
 export default class Converter {
     static ToObject(): string;
     constructor();
-    /**
-     * Converts a string to a boolean.
-     * @param value The string to convert.
-     * @returns The boolean value.
-     */
     ToBoolean(value: string): boolean;
-    /**
-     * Converts a string to a number.
-     * @param value The string to convert.
-     * @returns The number value.
-     */
     ToNumber(value: string): number;
-    /**
-     * Converts a string to a JSON object.
-     * @param value The string to convert.
-     * @returns The JSON object.
-     */
     ToObject(value: string): any;
-    /**
-     * Converts a JSON object to a string.
-     * @param value The JSON object to convert.
-     * @returns The string.
-     */
     ToString(value: object): string;
-    /**
-     * Converts a string to a string array.
-     * @param value The string to convert.
-     * @returns The string array.
-     */
     ToStringArray(value: string): string[];
 }

package/lib/Helper/Converter.helper.js

@@ -5,44 +5,19 @@ class Converter {
     static ToObject() {
         throw new Error("Method not implemented.");
     }
-    constructor() { } // Empty constructor
-    /**
-     * Converts a string to a boolean.
-     * @param value The string to convert.
-     * @returns The boolean value.
-     */
+    constructor() { }
     ToBoolean(value) {
         return value === "true";
     }
-    /**
-     * Converts a string to a number.
-     * @param value The string to convert.
-     * @returns The number value.
-     */
     ToNumber(value) {
         return parseInt(value);
     }
-    /**
-     * Converts a string to a JSON object.
-     * @param value The string to convert.
-     * @returns The JSON object.
-     */
     ToObject(value) {
         return JSON.parse(value);
     }
-    /**
-     * Converts a JSON object to a string.
-     * @param value The JSON object to convert.
-     * @returns The string.
-     */
     ToString(value) {
         return JSON.stringify(value);
     }
-    /**
-     * Converts a string to a string array.
-     * @param value The string to convert.
-     * @returns The string array.
-     */
     ToStringArray(value) {
         return value.split(",");
     }

package/lib/Helper/Converter.helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"Converter.helper.js","sourceRoot":"","sources":["../../source/Helper/Converter.helper.ts"],"names":[],"mappings":";;AAAA,uDAAuD;AACvD;IACE,MAAM,CAAC,QAAQ;QACb,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IACD,gBAAe,CAAC,CAAC,oBAAoB;IAErC;;;;OAIG;IACI,SAAS,CAAC,KAAa;QAC5B,OAAO,KAAK,KAAK,MAAM,CAAC;IAC1B,CAAC;IAED;;;;OAIG;IAEI,QAAQ,CAAC,KAAa;QAC3B,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED;;;;OAIG;IACI,QAAQ,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACI,QAAQ,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED;;;;OAIG;IAEI,aAAa,CAAC,KAAa;QAChC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;CACF"}
+{"version":3,"file":"Converter.helper.js","sourceRoot":"","sources":["../../source/Helper/Converter.helper.ts"],"names":[],"mappings":";;AAAA,uDAAuD;AACvD;IACE,MAAM,CAAC,QAAQ;QACb,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IACD,gBAAe,CAAC;IAET,SAAS,CAAC,KAAa;QAC5B,OAAO,KAAK,KAAK,MAAM,CAAC;IAC1B,CAAC;IAEM,QAAQ,CAAC,KAAa;QAC3B,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAEM,QAAQ,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAEM,QAAQ,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAEM,aAAa,CAAC,KAAa;QAChC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;CACF"}

package/lib/Helper/Crypto.helper.d.ts

@@ -1,57 +1,14 @@
 import { SuccessInterface } from "../config/Interfaces/Helper/response.helper.interface";
-/**
- * Helper class for cryptographic operations such as encryption and decryption.
- */
 export declare class CryptoHelper {
-    /**
-     * The encryption key used for cryptographic operations.
-     */
     private encryptionKey;
-    /**
-     * Instance of ResponseHelper to handle responses.
-     */
     private readonly responseHelper;
-    /**
-     * Instance of Cryptography class for performing cryptographic operations.
-     */
     private readonly Cryptography;
-    /**
-     * Instance of Converter class for converting data formats.
-     */
     private readonly Converter;
-    /**
-     * Constructor to initialize the CryptoHelper class.
-     * @param encryptionKey - Optional encryption key. If not provided, a default key based on hostname and platform will be used.
-     */
+    /** If no encryptionKey is given, falls back to a default key derived from hostname + platform. */
     constructor(encryptionKey?: string);
-    /**
-     * Sets a new encryption key.
-     * @param encryptionKey - The new encryption key to be set.
-     * @returns A promise that resolves to a success response.
-     */
     setEncryptionKey(encryptionKey: string): Promise<SuccessInterface>;
-    /**
-     * Encrypts data asynchronously.
-     * @param data - The data to be encrypted.
-     * @returns A promise that resolves to the encrypted data as a string.
-     */
     encrypt(data: string): Promise<string>;
-    /**
-     * Decrypts data asynchronously.
-     * @param data - The data to be decrypted.
-     * @returns A promise that resolves to the decrypted data as an object.
-     */
     decrypt(data: string): Promise<any>;
-    /**
-     * Encrypts data synchronously.
-     * @param data - The data to be encrypted.
-     * @returns The encrypted data as a string.
-     */
     encryptSync(data: string): string;
-    /**
-     * Decrypts data synchronously.
-     * @param data - The data to be decrypted.
-     * @returns The decrypted data as an object.
-     */
     decryptSync(data: string): object;
 }

package/lib/Helper/Crypto.helper.js

@@ -14,78 +14,39 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CryptoHelper = void 0;
 /* eslint-disable @typescript-eslint/no-explicit-any */
-// All Imports
 const node_os_1 = require("node:os");
 const response_helper_1 = __importDefault(require("./response.helper"));
 const CryptoGraphy_helper_1 = __importDefault(require("./CryptoGraphy.helper"));
 const Converter_helper_1 = __importDefault(require("./Converter.helper"));
-/**
- * Helper class for cryptographic operations such as encryption and decryption.
- */
 class CryptoHelper {
-    /**
-     * Constructor to initialize the CryptoHelper class.
-     * @param encryptionKey - Optional encryption key. If not provided, a default key based on hostname and platform will be used.
-     */
+    /** If no encryptionKey is given, falls back to a default key derived from hostname + platform. */
     constructor(encryptionKey) {
-        /**
-         * Instance of ResponseHelper to handle responses.
-         */
         this.responseHelper = new response_helper_1.default();
-        /**
-         * Instance of Converter class for converting data formats.
-         */
         this.Converter = new Converter_helper_1.default();
         this.encryptionKey = encryptionKey || `${(0, node_os_1.hostname)()}-${(0, node_os_1.platform)()}`;
         this.responseHelper = new response_helper_1.default();
         this.Cryptography = new CryptoGraphy_helper_1.default(this.encryptionKey);
         this.Converter = new Converter_helper_1.default();
     }
-    // methods
-    /**
-     * Sets a new encryption key.
-     * @param encryptionKey - The new encryption key to be set.
-     * @returns A promise that resolves to a success response.
-     */
     setEncryptionKey(encryptionKey) {
         return __awaiter(this, void 0, void 0, function* () {
             this.encryptionKey = encryptionKey;
             return this.responseHelper.Success("Encryption key has been set successfully");
         });
     }
-    /**
-     * Encrypts data asynchronously.
-     * @param data - The data to be encrypted.
-     * @returns A promise that resolves to the encrypted data as a string.
-     */
     encrypt(data) {
         return __awaiter(this, void 0, void 0, function* () {
             return yield this.Cryptography.Encrypt(data);
         });
     }
-    /**
-     * Decrypts data asynchronously.
-     * @param data - The data to be decrypted.
-     * @returns A promise that resolves to the decrypted data as an object.
-     */
     decrypt(data) {
         return __awaiter(this, void 0, void 0, function* () {
             return this.Converter.ToObject(yield this.Cryptography.Decrypt(data));
         });
     }
-    /**
-     * Encrypts data synchronously.
-     * @param data - The data to be encrypted.
-     * @returns The encrypted data as a string.
-     */
     encryptSync(data) {
         return this.Cryptography.EncryptSync(data);
     }
-    /**
-     * Decrypts data synchronously.
-     * @param data - The data to be decrypted.
-     * @returns The decrypted data as an object.
-     */
     decryptSync(data) {
         return this.Converter.ToObject(this.Cryptography.DecryptSync(data));
     }

package/lib/Helper/Crypto.helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"Crypto.helper.js","sourceRoot":"","sources":["../../source/Helper/Crypto.helper.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,uDAAuD;AACvD,cAAc;AACd,qCAA6C;AAC7C,wEAA+C;AAE/C,gFAAiD;AACjD,0EAA2C;AAE3C;;GAEG;AACH;IAsBE;;;OAGG;IACH,YAAY,aAAsB;QAnBlC;;WAEG;QACc,mBAAc,GAAmB,IAAI,yBAAc,EAAE,CAAC;QAOvE;;WAEG;QACc,cAAS,GAAG,IAAI,0BAAS,EAAE,CAAC;QAO3C,IAAI,CAAC,aAAa,GAAG,aAAa,IAAI,GAAG,IAAA,kBAAQ,GAAE,IAAI,IAAA,kBAAQ,GAAE,EAAE,CAAC;QACpE,IAAI,CAAC,cAAc,GAAG,IAAI,yBAAc,EAAE,CAAC;QAC3C,IAAI,CAAC,YAAY,GAAG,IAAI,6BAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACzD,IAAI,CAAC,SAAS,GAAG,IAAI,0BAAS,EAAE,CAAC;IACnC,CAAC;IAED,UAAU;IACV;;;;OAIG;IACU,gBAAgB,CAC3B,aAAqB;;YAErB,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;YACnC,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAChC,0CAA0C,CAC3C,CAAC;QACJ,CAAC;KAAA;IAED;;;;OAIG;IACU,OAAO,CAAC,IAAY;;YAC/B,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/C,CAAC;KAAA;IAED;;;;OAIG;IACU,OAAO,CAAC,IAAY;;YAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACxE,CAAC;KAAA;IAED;;;;OAIG;IACI,WAAW,CAAC,IAAY;QAC7B,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACI,WAAW,CAAC,IAAY;QAC7B,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,CAAC;CACF"}
+{"version":3,"file":"Crypto.helper.js","sourceRoot":"","sources":["../../source/Helper/Crypto.helper.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,uDAAuD;AACvD,qCAA6C;AAC7C,wEAA+C;AAE/C,gFAAiD;AACjD,0EAA2C;AAE3C;IAME,kGAAkG;IAClG,YAAY,aAAsB;QALjB,mBAAc,GAAmB,IAAI,yBAAc,EAAE,CAAC;QAEtD,cAAS,GAAG,IAAI,0BAAS,EAAE,CAAC;QAI3C,IAAI,CAAC,aAAa,GAAG,aAAa,IAAI,GAAG,IAAA,kBAAQ,GAAE,IAAI,IAAA,kBAAQ,GAAE,EAAE,CAAC;QACpE,IAAI,CAAC,cAAc,GAAG,IAAI,yBAAc,EAAE,CAAC;QAC3C,IAAI,CAAC,YAAY,GAAG,IAAI,6BAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACzD,IAAI,CAAC,SAAS,GAAG,IAAI,0BAAS,EAAE,CAAC;IACnC,CAAC;IAEY,gBAAgB,CAC3B,aAAqB;;YAErB,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;YACnC,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAChC,0CAA0C,CAC3C,CAAC;QACJ,CAAC;KAAA;IAEY,OAAO,CAAC,IAAY;;YAC/B,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/C,CAAC;KAAA;IAEY,OAAO,CAAC,IAAY;;YAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACxE,CAAC;KAAA;IAEM,WAAW,CAAC,IAAY;QAC7B,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IAEM,WAAW,CAAC,IAAY;QAC7B,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,CAAC;CACF"}

package/lib/Helper/DocumentLoader.helper.d.ts

@@ -1,45 +1,10 @@
 import { SuccessInterface, ErrorInterface } from '../config/Interfaces/Helper/response.helper.interface';
 /**
- * DocumentLoader - Shared utility for loading documents from collection directories
- *
- * Provides a centralized method for loading document files using worker threads,
- * replacing duplicated code in Reader, Update, Delete, and Aggregation operations.
- *
- * @class DocumentLoader
+ * Centralizes document-loading logic that used to be duplicated across the Reader,
+ * Update, Delete, and Aggregation operations - handles both a direct file list and
+ * full directory scanning (filtered to `.axiodb` files), loaded via worker threads.
  */
 export default class DocumentLoader {
     private static readonly ResponseHelper;
-    /**
-     * Loads all documents from a collection directory using worker threads
-     *
-     * This method consolidates the LoadAllBufferRawData logic that was previously
-     * duplicated across multiple CRUD operations. It handles both direct file
-     * specification and directory scanning with .axiodb file filtering.
-     *
-     * @param collectionPath - Full path to collection directory
-     * @param encryptionKey - Optional encryption key for encrypted documents
-     * @param isEncrypted - Whether documents are encrypted (default: false)
-     * @param documentFiles - Optional specific file names to load
-     * @param includeFileName - Whether to include fileName in result (default: false)
-     * @returns Success with document array or Error
-     *
-     * @example
-     * // Load all documents from a collection
-     * const result = await DocumentLoader.loadDocuments(
-     *   '/path/to/collection',
-     *   undefined,
-     *   false
-     * );
-     *
-     * @example
-     * // Load specific documents with filenames included
-     * const result = await DocumentLoader.loadDocuments(
-     *   '/path/to/collection',
-     *   'encryption-key',
-     *   true,
-     *   ['doc1.axiodb', 'doc2.axiodb'],
-     *   true
-     * );
-     */
     static loadDocuments(collectionPath: string, encryptionKey?: string, isEncrypted?: boolean, documentFiles?: string[], includeFileName?: boolean): Promise<SuccessInterface | ErrorInterface>;
 }

package/lib/Helper/DocumentLoader.helper.js

@@ -16,59 +16,21 @@ const FolderManager_1 = __importDefault(require("../engine/Filesystem/FolderMana
 const BufferLoaderWithWorker_utils_1 = __importDefault(require("../utility/BufferLoaderWithWorker.utils"));
 const response_helper_1 = __importDefault(require("./response.helper"));
 /**
- * DocumentLoader - Shared utility for loading documents from collection directories
- *
- * Provides a centralized method for loading document files using worker threads,
- * replacing duplicated code in Reader, Update, Delete, and Aggregation operations.
- *
- * @class DocumentLoader
+ * Centralizes document-loading logic that used to be duplicated across the Reader,
+ * Update, Delete, and Aggregation operations - handles both a direct file list and
+ * full directory scanning (filtered to `.axiodb` files), loaded via worker threads.
  */
 class DocumentLoader {
-    /**
-     * Loads all documents from a collection directory using worker threads
-     *
-     * This method consolidates the LoadAllBufferRawData logic that was previously
-     * duplicated across multiple CRUD operations. It handles both direct file
-     * specification and directory scanning with .axiodb file filtering.
-     *
-     * @param collectionPath - Full path to collection directory
-     * @param encryptionKey - Optional encryption key for encrypted documents
-     * @param isEncrypted - Whether documents are encrypted (default: false)
-     * @param documentFiles - Optional specific file names to load
-     * @param includeFileName - Whether to include fileName in result (default: false)
-     * @returns Success with document array or Error
-     *
-     * @example
-     * // Load all documents from a collection
-     * const result = await DocumentLoader.loadDocuments(
-     *   '/path/to/collection',
-     *   undefined,
-     *   false
-     * );
-     *
-     * @example
-     * // Load specific documents with filenames included
-     * const result = await DocumentLoader.loadDocuments(
-     *   '/path/to/collection',
-     *   'encryption-key',
-     *   true,
-     *   ['doc1.axiodb', 'doc2.axiodb'],
-     *   true
-     * );
-     */
     static loadDocuments(collectionPath_1, encryptionKey_1) {
         return __awaiter(this, arguments, void 0, function* (collectionPath, encryptionKey, isEncrypted = false, documentFiles, includeFileName = false) {
             try {
                 const dataFilesList = [];
                 if (documentFiles !== undefined) {
-                    // Use provided file list
                     dataFilesList.push(...documentFiles);
                 }
                 else {
-                    // Scan directory for .axiodb files
                     const readResponse = yield new FolderManager_1.default().ListDirectory(collectionPath);
                     if ("data" in readResponse) {
-                        // Filter for .axiodb files only
                         const axiodbFiles = readResponse.data.filter((file) => file.endsWith(".axiodb"));
                         dataFilesList.push(...axiodbFiles);
                     }
@@ -76,7 +38,7 @@ class DocumentLoader {
                         return this.ResponseHelper.Error("Failed to read directory");
                     }
                 }
-                // Load all files using worker threads (parallel processing)
+                // Loaded via worker threads for parallelism
                 const resultData = yield (0, BufferLoaderWithWorker_utils_1.default)(dataFilesList, encryptionKey, collectionPath, isEncrypted, includeFileName);
                 return this.ResponseHelper.Success(resultData);
             }

package/lib/Helper/DocumentLoader.helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"DocumentLoader.helper.js","sourceRoot":"","sources":["../../source/Helper/DocumentLoader.helper.ts"],"names":[],"mappings":";;;;;;;;;;;;;;AACA,uFAA+D;AAC/D,2GAAuE;AACvE,wEAA+C;AAE/C;;;;;;;GAOG;AACH,MAAqB,cAAc;IAGjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,MAAM,CAAO,aAAa;6DACxB,cAAsB,EACtB,aAAsB,EACtB,WAAW,GAAY,KAAK,EAC5B,aAAwB,EACxB,eAAe,GAAY,KAAK;YAEhC,IAAI,CAAC;gBACH,MAAM,aAAa,GAAa,EAAE,CAAC;gBAEnC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;oBAChC,yBAAyB;oBACzB,aAAa,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC;gBACvC,CAAC;qBAAM,CAAC;oBACN,mCAAmC;oBACnC,MAAM,YAAY,GAAG,MAAM,IAAI,uBAAa,EAAE,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;oBAE7E,IAAI,MAAM,IAAI,YAAY,EAAE,CAAC;wBAC3B,gCAAgC;wBAChC,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE,CAC5D,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CACzB,CAAC;wBACF,aAAa,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC;oBACrC,CAAC;yBAAM,CAAC;wBACN,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;oBAC/D,CAAC;gBACH,CAAC;gBAED,4DAA4D;gBAC5D,MAAM,UAAU,GAAG,MAAM,IAAA,sCAAgB,EACvC,aAAa,EACb,aAAa,EACb,cAAc,EACd,WAAW,EACX,eAAe,CAChB,CAAC;gBAEF,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACjD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;KAAA;CACF;AA5EyB,6BAAc,GAAG,IAAI,yBAAc,EAAE,CAAC"}
+{"version":3,"file":"DocumentLoader.helper.js","sourceRoot":"","sources":["../../source/Helper/DocumentLoader.helper.ts"],"names":[],"mappings":";;;;;;;;;;;;;;AACA,uFAA+D;AAC/D,2GAAuE;AACvE,wEAA+C;AAE/C;;;;GAIG;AACH,MAAqB,cAAc;IAGjC,MAAM,CAAO,aAAa;6DACxB,cAAsB,EACtB,aAAsB,EACtB,WAAW,GAAY,KAAK,EAC5B,aAAwB,EACxB,eAAe,GAAY,KAAK;YAEhC,IAAI,CAAC;gBACH,MAAM,aAAa,GAAa,EAAE,CAAC;gBAEnC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;oBAChC,aAAa,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC;gBACvC,CAAC;qBAAM,CAAC;oBACN,MAAM,YAAY,GAAG,MAAM,IAAI,uBAAa,EAAE,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;oBAE7E,IAAI,MAAM,IAAI,YAAY,EAAE,CAAC;wBAC3B,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE,CAC5D,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CACzB,CAAC;wBACF,aAAa,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC;oBACrC,CAAC;yBAAM,CAAC;wBACN,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;oBAC/D,CAAC;gBACH,CAAC;gBAED,4CAA4C;gBAC5C,MAAM,UAAU,GAAG,MAAM,IAAA,sCAAgB,EACvC,aAAa,EACb,aAAa,EACb,cAAc,EACd,WAAW,EACX,eAAe,CAChB,CAAC;gBAEF,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACjD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;KAAA;CACF;AAzCyB,6BAAc,GAAG,IAAI,yBAAc,EAAE,CAAC"}

package/lib/Helper/PathSanitizer.helper.js

@@ -37,20 +37,17 @@ class PathSanitizer {
         if (!userInput || typeof userInput !== 'string') {
             throw new Error('Invalid path component: must be a non-empty string');
         }
-        // Remove all directory traversal attempts
         let sanitized = userInput
-            .replace(/\.\./g, '_') // Remove .. (parent directory)
-            .replace(/\//g, '_') // Remove / (Unix path separator)
-            .replace(/\\/g, '_') // Remove \ (Windows path separator)
-            .replace(/\0/g, '_'); // Remove null bytes
-        // Allow only alphanumeric, dash, underscore, and dot (for file extensions)
-        // Note: We preserve dots for file extensions but removed '..' above
+            .replace(/\.\./g, '_') // parent directory
+            .replace(/\//g, '_') // Unix path separator
+            .replace(/\\/g, '_') // Windows path separator
+            .replace(/\0/g, '_'); // null bytes
+        // Dots are preserved (for file extensions) since '..' was already stripped above
         sanitized = sanitized.replace(/[^a-zA-Z0-9-_.]/g, '_');
-        // Prevent empty result
         if (sanitized.length === 0) {
             throw new Error('Invalid path component: results in empty string after sanitization');
         }
-        // Prevent starting with dot (hidden files) to avoid potential issues
+        // Avoid producing a hidden file
         if (sanitized.startsWith('.')) {
             sanitized = '_' + sanitized.substring(1);
         }
@@ -100,11 +97,8 @@ class PathSanitizer {
      * // Throws: Security violation (after sanitization and validation)
      */
     static safePath(basePath, ...components) {
-        // Sanitize each component
         const sanitizedComponents = components.map(c => this.sanitizePathComponent(c));
-        // Join paths using Node.js path.join (handles platform differences)
         const fullPath = path_1.default.join(basePath, ...sanitizedComponents);
-        // Validate final path is within base (defense in depth)
         this.validatePath(basePath, fullPath);
         return fullPath;
     }

package/lib/Helper/PathSanitizer.helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"PathSanitizer.helper.js","sourceRoot":"","sources":["../../source/Helper/PathSanitizer.helper.ts"],"names":[],"mappings":";;;;;AAAA,gDAAwB;AAExB;;;;;;;;;;GAUG;AACH;IACE;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,CAAC,qBAAqB,CAAC,SAAiB;QAC5C,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QAED,0CAA0C;QAC1C,IAAI,SAAS,GAAG,SAAS;aACtB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAI,+BAA+B;aACxD,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAM,iCAAiC;aAC1D,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAM,oCAAoC;aAC7D,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAK,oBAAoB;QAEhD,2EAA2E;QAC3E,oEAAoE;QACpE,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAEvD,uBAAuB;QACvB,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACxF,CAAC;QAED,qEAAqE;QACrE,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,SAAS,GAAG,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,CAAC,YAAY,CAAC,QAAgB,EAAE,QAAgB;QACpD,MAAM,YAAY,GAAG,cAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,cAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAE5C,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,CAAC,QAAQ,CAAC,QAAgB,EAAE,GAAG,UAAoB;QACvD,0BAA0B;QAC1B,MAAM,mBAAmB,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC;QAE/E,oEAAoE;QACpE,MAAM,QAAQ,GAAG,cAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,mBAAmB,CAAC,CAAC;QAE7D,wDAAwD;QACxD,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAEtC,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}
+{"version":3,"file":"PathSanitizer.helper.js","sourceRoot":"","sources":["../../source/Helper/PathSanitizer.helper.ts"],"names":[],"mappings":";;;;;AAAA,gDAAwB;AAExB;;;;;;;;;;GAUG;AACH;IACE;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,CAAC,qBAAqB,CAAC,SAAiB;QAC5C,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,SAAS,GAAG,SAAS;aACtB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAI,mBAAmB;aAC5C,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAM,sBAAsB;aAC/C,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAM,yBAAyB;aAClD,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAK,aAAa;QAEzC,iFAAiF;QACjF,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAEvD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACxF,CAAC;QAED,gCAAgC;QAChC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,SAAS,GAAG,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,CAAC,YAAY,CAAC,QAAgB,EAAE,QAAgB;QACpD,MAAM,YAAY,GAAG,cAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,cAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAE5C,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,CAAC,QAAQ,CAAC,QAAgB,EAAE,GAAG,UAAoB;QACvD,MAAM,mBAAmB,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,MAAM,QAAQ,GAAG,cAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,mBAAmB,CAAC,CAAC;QAC7D,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAEtC,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}