raffel 0.2.3 → 1.0.0-next.f81d4db

package/dist/middleware/session/interceptor.js

@@ -0,0 +1,264 @@
+/**
+ * Session Interceptor
+ *
+ * Injects a live Session handle into `ctx.session` for every request.
+ * The session is loaded from the store at the start of the request and
+ * persisted (if dirty) after the handler returns.
+ *
+ * Session IDs are read from / written to cookies by default.
+ */
+import { createMemorySessionDriver } from './drivers/memory.js';
+// ============================================================================
+// Session ID generation
+// ============================================================================
+function generateSessionId() {
+    // Use crypto.randomUUID() if available (Node 15+), fall back to randomBytes
+    if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+        return crypto.randomUUID().replace(/-/g, '');
+    }
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    const nodeCrypto = require('crypto');
+    return nodeCrypto.randomBytes(16).toString('hex');
+}
+// ============================================================================
+// Cookie helpers
+// ============================================================================
+function parseCookies(cookieHeader) {
+    const cookies = {};
+    for (const part of cookieHeader.split(';')) {
+        const eqIdx = part.indexOf('=');
+        if (eqIdx === -1)
+            continue;
+        const name = part.slice(0, eqIdx).trim();
+        const value = part.slice(eqIdx + 1).trim();
+        cookies[name] = decodeURIComponent(value);
+    }
+    return cookies;
+}
+function buildSetCookieHeader(name, value, options = {}) {
+    let cookie = `${name}=${encodeURIComponent(value)}`;
+    if (options.maxAge != null)
+        cookie += `; Max-Age=${options.maxAge}`;
+    if (options.httpOnly !== false)
+        cookie += '; HttpOnly';
+    if (options.secure !== false)
+        cookie += '; Secure';
+    cookie += `; SameSite=${options.sameSite ?? 'Lax'}`;
+    cookie += `; Path=${options.path ?? '/'}`;
+    if (options.domain)
+        cookie += `; Domain=${options.domain}`;
+    return cookie;
+}
+function buildDeleteCookieHeader(name, path = '/') {
+    return `${name}=; Max-Age=0; Path=${path}; HttpOnly`;
+}
+// ============================================================================
+// HMAC signing (optional)
+// ============================================================================
+function signId(id, secret) {
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    const crypto = require('crypto');
+    const sig = crypto.createHmac('sha256', secret).update(id).digest('base64url');
+    return `${id}.${sig}`;
+}
+function unsignId(signed, secret) {
+    const lastDot = signed.lastIndexOf('.');
+    if (lastDot === -1)
+        return null;
+    const id = signed.slice(0, lastDot);
+    const expected = signId(id, secret);
+    // Constant-time comparison
+    if (signed.length !== expected.length)
+        return null;
+    let ok = true;
+    for (let i = 0; i < signed.length; i++) {
+        if (signed.charCodeAt(i) !== expected.charCodeAt(i))
+            ok = false;
+    }
+    return ok ? id : null;
+}
+// ============================================================================
+// Session handle factory
+// ============================================================================
+function createSession(id, data) {
+    let dirty = false;
+    let destroyed = false;
+    let pendingAction = null;
+    let sessionId = id;
+    return {
+        get id() { return sessionId; },
+        data,
+        touch() {
+            dirty = true;
+            if (pendingAction !== 'destroy')
+                pendingAction = 'save';
+        },
+        get isDirty() { return dirty; },
+        destroy() {
+            destroyed = true;
+            pendingAction = 'destroy';
+        },
+        get isDestroyed() { return destroyed; },
+        async regenerate() {
+            sessionId = generateSessionId();
+            dirty = true;
+            pendingAction = 'save';
+        },
+        get _pending() { return pendingAction; },
+        get _id() { return sessionId; },
+        setId(newId) { sessionId = newId; },
+    };
+}
+// ============================================================================
+// Store factory
+// ============================================================================
+function resolveStore(config) {
+    const { driver } = config;
+    if (driver === 'memory') {
+        return createMemorySessionDriver();
+    }
+    if (driver === 'custom') {
+        throw new Error('Session driver "custom" requires a store instance. Pass it via driver: myStore (a SessionStore object).');
+    }
+    if (typeof driver === 'object' && driver !== null) {
+        return driver;
+    }
+    throw new Error('Invalid session driver. Use "memory" or pass a custom SessionStore instance to session.driver.');
+}
+// ============================================================================
+// createSessionInterceptor
+// ============================================================================
+/**
+ * Create a session interceptor that injects `ctx.session` into every request.
+ *
+ * The session is loaded lazily from the store when first accessed,
+ * and persisted automatically after the handler completes (if dirty).
+ *
+ * @example
+ * ```typescript
+ * import { createSessionInterceptor } from 'raffel/session'
+ *
+ * const server = createServer({ port: 3000 })
+ *
+ * server.use(createSessionInterceptor({
+ *   driver: 'memory',
+ *   ttl: 3600,
+ *   cookie: { name: 'sid', secure: true },
+ * }))
+ *
+ * server.procedure('auth.login').handler(async (input, ctx) => {
+ *   ctx.session.data.userId = input.userId
+ *   ctx.session.touch()
+ *   return { ok: true }
+ * })
+ *
+ * server.procedure('auth.me').handler(async (_input, ctx) => {
+ *   return { userId: ctx.session.data.userId }
+ * })
+ * ```
+ */
+export function createSessionInterceptor(config) {
+    const store = resolveStore(config);
+    const ttl = config.ttl ?? 3600;
+    const rolling = config.rolling ?? false;
+    const cookieName = config.cookie?.name ?? 'sid';
+    const cookieOptions = config.cookie ?? {};
+    return async (envelope, ctx, next) => {
+        // --- Read session ID from cookie ---
+        const cookieHeader = envelope.metadata?.['cookie'] ??
+            envelope.metadata?.['Cookie'] ??
+            '';
+        const cookies = parseCookies(cookieHeader);
+        const cookieValue = cookies[cookieName] ?? null;
+        let sessionId;
+        // Unsign if secret configured — may return null if tampered
+        const rawSid = (cookieValue && config.secret)
+            ? unsignId(cookieValue, config.secret)
+            : cookieValue;
+        // Load or create session
+        let sessionData;
+        let isNew = false;
+        if (rawSid) {
+            const stored = await store.get(rawSid);
+            if (stored) {
+                sessionId = rawSid;
+                sessionData = stored;
+            }
+            else {
+                // Expired or not found → new session
+                sessionId = generateSessionId();
+                sessionData = {};
+                isNew = true;
+            }
+        }
+        else {
+            sessionId = generateSessionId();
+            sessionData = {};
+            isNew = true;
+        }
+        const session = createSession(sessionId, sessionData);
+        ctx['session'] = session;
+        // --- Run handler ---
+        let result;
+        try {
+            result = await next();
+        }
+        finally {
+            // --- Persist session after handler ---
+            const pending = session._pending;
+            const currentId = session._id;
+            if (pending === 'destroy') {
+                await store.delete(sessionId);
+                // Set delete cookie header
+                const delCookie = buildDeleteCookieHeader(cookieName, cookieOptions.path);
+                appendSetCookieHeader(envelope, delCookie);
+            }
+            else if (pending === 'save' || (rolling && !isNew && !session.isDestroyed)) {
+                if (pending === 'save' || session.isDirty || config.saveUninitialized) {
+                    await store.set(currentId, session.data, ttl);
+                }
+                if (rolling && !isNew) {
+                    await store.touch(currentId, ttl);
+                }
+                const maxAge = cookieOptions.maxAge ?? ttl;
+                const finalId = config.secret ? signId(currentId, config.secret) : currentId;
+                const setCookie = buildSetCookieHeader(cookieName, finalId, { ...cookieOptions, maxAge });
+                appendSetCookieHeader(envelope, setCookie);
+            }
+            else if (isNew && (session.isDirty || config.saveUninitialized)) {
+                await store.set(currentId, session.data, ttl);
+                const maxAge = cookieOptions.maxAge ?? ttl;
+                const finalId = config.secret ? signId(currentId, config.secret) : currentId;
+                const setCookie = buildSetCookieHeader(cookieName, finalId, { ...cookieOptions, maxAge });
+                appendSetCookieHeader(envelope, setCookie);
+            }
+        }
+        return result;
+    };
+}
+/**
+ * Append a Set-Cookie header to the response.
+ * Tries to use the envelope's response metadata (httpResponseHeaders) if available.
+ */
+function appendSetCookieHeader(envelope, value) {
+    const meta = envelope.metadata;
+    if (!meta)
+        return;
+    const existing = meta['httpResponseHeaders'];
+    if (existing) {
+        const current = existing['set-cookie'];
+        if (Array.isArray(current)) {
+            current.push(value);
+        }
+        else if (typeof current === 'string') {
+            existing['set-cookie'] = [current, value];
+        }
+        else {
+            existing['set-cookie'] = value;
+        }
+    }
+    else {
+        meta['httpResponseHeaders'] = { 'set-cookie': value };
+    }
+}
+//# sourceMappingURL=interceptor.js.map

package/dist/middleware/session/interceptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interceptor.js","sourceRoot":"","sources":["../../../src/middleware/session/interceptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AAE/D,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E,SAAS,iBAAiB;IACxB,4EAA4E;IAC5E,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACvD,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAC9C,CAAC;IACD,8DAA8D;IAC9D,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAA4B,CAAA;IAC/D,OAAO,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AACnD,CAAC;AAED,+EAA+E;AAC/E,iBAAiB;AACjB,+EAA+E;AAE/E,SAAS,YAAY,CAAC,YAAoB;IACxC,MAAM,OAAO,GAA2B,EAAE,CAAA;IAC1C,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAQ;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAA;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC1C,OAAO,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;IAC3C,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,oBAAoB,CAC3B,IAAY,EACZ,KAAa,EACb,UAAyD,EAAE;IAE3D,IAAI,MAAM,GAAG,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAA;IAEnD,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI;QAAE,MAAM,IAAI,aAAa,OAAO,CAAC,MAAM,EAAE,CAAA;IACnE,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK;QAAE,MAAM,IAAI,YAAY,CAAA;IACtD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;QAAE,MAAM,IAAI,UAAU,CAAA;IAClD,MAAM,IAAI,cAAc,OAAO,CAAC,QAAQ,IAAI,KAAK,EAAE,CAAA;IACnD,MAAM,IAAI,UAAU,OAAO,CAAC,IAAI,IAAI,GAAG,EAAE,CAAA;IACzC,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,YAAY,OAAO,CAAC,MAAM,EAAE,CAAA;IAE1D,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY,EAAE,IAAI,GAAG,GAAG;IACvD,OAAO,GAAG,IAAI,sBAAsB,IAAI,YAAY,CAAA;AACtD,CAAC;AAED,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E,SAAS,MAAM,CAAC,EAAU,EAAE,MAAc;IACxC,8DAA8D;IAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAA4B,CAAA;IAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IAC9E,OAAO,GAAG,EAAE,IAAI,GAAG,EAAE,CAAA;AACvB,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc,EAAE,MAAc;IAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACvC,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAE/B,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;IACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;IAEnC,2BAA2B;IAC3B,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IAClD,IAAI,EAAE,GAAG,IAAI,CAAA;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,EAAE,GAAG,KAAK,CAAA;IACjE,CAAC;IACD,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AACvB,CAAC;AAED,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAE/E,SAAS,aAAa,CAAC,EAAU,EAAE,IAAiB;IAKlD,IAAI,KAAK,GAAG,KAAK,CAAA;IACjB,IAAI,SAAS,GAAG,KAAK,CAAA;IACrB,IAAI,aAAa,GAA8B,IAAI,CAAA;IACnD,IAAI,SAAS,GAAG,EAAE,CAAA;IAElB,OAAO;QACL,IAAI,EAAE,KAAK,OAAO,SAAS,CAAA,CAAC,CAAC;QAE7B,IAAI;QAEJ,KAAK;YACH,KAAK,GAAG,IAAI,CAAA;YACZ,IAAI,aAAa,KAAK,SAAS;gBAAE,aAAa,GAAG,MAAM,CAAA;QACzD,CAAC;QAED,IAAI,OAAO,KAAK,OAAO,KAAK,CAAA,CAAC,CAAC;QAE9B,OAAO;YACL,SAAS,GAAG,IAAI,CAAA;YAChB,aAAa,GAAG,SAAS,CAAA;QAC3B,CAAC;QAED,IAAI,WAAW,KAAK,OAAO,SAAS,CAAA,CAAC,CAAC;QAEtC,KAAK,CAAC,UAAU;YACd,SAAS,GAAG,iBAAiB,EAAE,CAAA;YAC/B,KAAK,GAAG,IAAI,CAAA;YACZ,aAAa,GAAG,MAAM,CAAA;QACxB,CAAC;QAED,IAAI,QAAQ,KAAK,OAAO,aAAa,CAAA,CAAC,CAAC;QACvC,IAAI,GAAG,KAAK,OAAO,SAAS,CAAA,CAAC,CAAC;QAC9B,KAAK,CAAC,KAAa,IAAI,SAAS,GAAG,KAAK,CAAA,CAAC,CAAC;KAC3C,CAAA;AACH,CAAC;AAED,+EAA+E;AAC/E,gBAAgB;AAChB,+EAA+E;AAE/E,SAAS,YAAY,CAAC,MAAqB;IACzC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAA;IAEzB,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO,yBAAyB,EAAE,CAAA;IACpC,CAAC;IAED,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,yGAAyG,CAC1G,CAAA;IACH,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,OAAO,MAAsB,CAAA;IAC/B,CAAC;IAED,MAAM,IAAI,KAAK,CACb,gGAAgG,CACjG,CAAA;AACH,CAAC;AAED,+EAA+E;AAC/E,2BAA2B;AAC3B,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAqB;IAC5D,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;IAClC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,IAAI,CAAA;IAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,KAAK,CAAA;IACvC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,KAAK,CAAA;IAC/C,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAA;IAEzC,OAAO,KAAK,EAAE,QAAkB,EAAE,GAAY,EAAE,IAA4B,EAAE,EAAE;QAC9E,sCAAsC;QACtC,MAAM,YAAY,GACf,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAwB;YACpD,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAwB;YACrD,EAAE,CAAA;QAEJ,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,CAAC,CAAA;QAC1C,MAAM,WAAW,GAAkB,OAAO,CAAC,UAAU,CAAC,IAAI,IAAI,CAAA;QAC9D,IAAI,SAAiB,CAAA;QAErB,4DAA4D;QAC5D,MAAM,MAAM,GAAkB,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC;YAC1D,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC;YACtC,CAAC,CAAC,WAAW,CAAA;QAEf,yBAAyB;QACzB,IAAI,WAAwB,CAAA;QAC5B,IAAI,KAAK,GAAG,KAAK,CAAA;QAEjB,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACtC,IAAI,MAAM,EAAE,CAAC;gBACX,SAAS,GAAG,MAAM,CAAA;gBAClB,WAAW,GAAG,MAAM,CAAA;YACtB,CAAC;iBAAM,CAAC;gBACN,qCAAqC;gBACrC,SAAS,GAAG,iBAAiB,EAAE,CAAA;gBAC/B,WAAW,GAAG,EAAE,CAAA;gBAChB,KAAK,GAAG,IAAI,CAAA;YACd,CAAC;QACH,CAAC;aAAM,CAAC;YACN,SAAS,GAAG,iBAAiB,EAAE,CAAA;YAC/B,WAAW,GAAG,EAAE,CAAA;YAChB,KAAK,GAAG,IAAI,CAAA;QACd,CAAC;QAED,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,EAAE,WAAW,CAAC,CAGpD;QAAC,GAA0C,CAAC,SAAS,CAAC,GAAG,OAAO,CAAA;QAEjE,sBAAsB;QACtB,IAAI,MAAe,CAAA;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,EAAE,CAAA;QACvB,CAAC;gBAAS,CAAC;YACT,wCAAwC;YACxC,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAA;YAChC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAA;YAE7B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;gBAE7B,2BAA2B;gBAC3B,MAAM,SAAS,GAAG,uBAAuB,CAAC,UAAU,EAAE,aAAa,CAAC,IAAI,CAAC,CAAA;gBACzE,qBAAqB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;YAC5C,CAAC;iBAAM,IAAI,OAAO,KAAK,MAAM,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7E,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;oBACtE,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;gBAC/C,CAAC;gBAED,IAAI,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;oBACtB,MAAM,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;gBACnC,CAAC;gBAED,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,IAAI,GAAG,CAAA;gBAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;gBAC5E,MAAM,SAAS,GAAG,oBAAoB,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,GAAG,aAAa,EAAE,MAAM,EAAE,CAAC,CAAA;gBACzF,qBAAqB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;YAC5C,CAAC;iBAAM,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBAClE,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;gBAC7C,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,IAAI,GAAG,CAAA;gBAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;gBAC5E,MAAM,SAAS,GAAG,oBAAoB,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,GAAG,aAAa,EAAE,MAAM,EAAE,CAAC,CAAA;gBACzF,qBAAqB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;YAC5C,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,QAAkB,EAAE,KAAa;IAC9D,MAAM,IAAI,GAAG,QAAQ,CAAC,QAA+C,CAAA;IACrE,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,QAAQ,GAAG,IAAI,CAAC,qBAAqB,CAAwC,CAAA;IACnF,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAA;QACtC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;aAAM,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YACvC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QAC3C,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,YAAY,CAAC,GAAG,KAAK,CAAA;QAChC,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,CAAA;IACvD,CAAC;AACH,CAAC"}

package/dist/middleware/session/types.d.ts

@@ -0,0 +1,116 @@
+/**
+ * Session Store Types
+ *
+ * Interfaces for the dedicated Session Store abstraction.
+ * The session store manages user sessions across requests,
+ * providing a uniform API regardless of backing storage.
+ */
+/**
+ * Session data bag — arbitrary key/value pairs persisted per session.
+ */
+export type SessionData = Record<string, unknown>;
+/**
+ * Session store interface.
+ * Implement this to provide a custom backing store.
+ */
+export interface SessionStore {
+    /** Retrieve session data by session ID. Returns null if not found or expired. */
+    get(id: string): Promise<SessionData | null>;
+    /** Persist session data. `ttl` is in seconds; store must honour it. */
+    set(id: string, data: SessionData, ttl?: number): Promise<void>;
+    /** Delete a session. No-op if not found. */
+    delete(id: string): Promise<void>;
+    /**
+     * Touch a session — reset its expiry without changing data.
+     * Used for sliding-window TTL.
+     */
+    touch(id: string, ttl?: number): Promise<void>;
+}
+/**
+ * Cookie options for the session cookie.
+ */
+export interface SessionCookieOptions {
+    /** Cookie name (default: 'sid') */
+    name?: string;
+    /** Max age in seconds (takes precedence over `ttl` for cookie expiry). Defaults to `ttl`. */
+    maxAge?: number;
+    /** HttpOnly flag (default: true) */
+    httpOnly?: boolean;
+    /** Secure flag — set cookies only over HTTPS (default: true in production) */
+    secure?: boolean;
+    /** SameSite policy (default: 'lax') */
+    sameSite?: 'strict' | 'lax' | 'none';
+    /** Cookie path (default: '/') */
+    path?: string;
+    /** Cookie domain */
+    domain?: string;
+}
+/**
+ * Session store driver type (built-in drivers).
+ *
+ * - `'memory'`  — in-memory Map + TTL (dev, single-instance)
+ * - `'custom'`  — explicit alias for passing any `SessionStore` instance
+ */
+export type SessionDriverType = 'memory' | 'custom';
+/**
+ * Session configuration passed to `createServer()`.
+ */
+export interface SessionConfig {
+    /**
+     * Built-in driver type, OR a custom store instance.
+     *
+     * @example
+     * // Built-in memory driver (dev)
+     * driver: 'memory'
+     *
+     * @example
+     * // Custom store
+     * driver: myCustomStore
+     */
+    driver: SessionDriverType | SessionStore;
+    /**
+     * Session TTL in seconds (default: 3600 — 1 hour).
+     * Applies to both store expiry and cookie maxAge (unless overridden in `cookie.maxAge`).
+     */
+    ttl?: number;
+    /**
+     * Whether to use a sliding-window TTL: each access resets the TTL.
+     * (default: false — fixed TTL)
+     */
+    rolling?: boolean;
+    /**
+     * Whether to save sessions that have never been modified.
+     * (default: false — lazy save)
+     */
+    saveUninitialized?: boolean;
+    /**
+     * Secret for signing session IDs (HMAC-SHA256).
+     * If not set, session IDs are unsigned.
+     */
+    secret?: string;
+    /** Cookie configuration */
+    cookie?: SessionCookieOptions;
+}
+/**
+ * Live session handle injected into `ctx.session` by the session interceptor.
+ */
+export interface Session {
+    /** Session ID */
+    readonly id: string;
+    /** Session data (mutable) */
+    data: SessionData;
+    /**
+     * Mark session as modified so it will be persisted at response time.
+     * Called automatically when `data` is mutated via `set()`.
+     */
+    touch(): void;
+    /** Whether the session has been modified this request */
+    readonly isDirty: boolean;
+    /** Destroy the session (delete from store, clear cookie on response) */
+    destroy(): void;
+    /** Whether the session has been destroyed */
+    readonly isDestroyed: boolean;
+    /** Regenerate session ID (for security after privilege escalation) */
+    regenerate(): Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/middleware/session/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/middleware/session/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAEjD;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,iFAAiF;IACjF,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;IAE5C,uEAAuE;IACvE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE/D,4CAA4C;IAC5C,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjC;;;OAGG;IACH,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC/C;AAMD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,mCAAmC;IACnC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,6FAA6F;IAC7F,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,oCAAoC;IACpC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAA;IACpC,iCAAiC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,oBAAoB;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAEnD;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;;;;;;OAUG;IACH,MAAM,EAAE,iBAAiB,GAAG,YAAY,CAAA;IAExC;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;IAEZ;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IAEjB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAE3B;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf,2BAA2B;IAC3B,MAAM,CAAC,EAAE,oBAAoB,CAAA;CAE9B;AAMD;;GAEG;AACH,MAAM,WAAW,OAAO;IACtB,iBAAiB;IACjB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IAEnB,6BAA6B;IAC7B,IAAI,EAAE,WAAW,CAAA;IAEjB;;;OAGG;IACH,KAAK,IAAI,IAAI,CAAA;IAEb,yDAAyD;IACzD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IAEzB,wEAAwE;IACxE,OAAO,IAAI,IAAI,CAAA;IAEf,6CAA6C;IAC7C,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;IAE7B,sEAAsE;IACtE,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAC5B"}

package/dist/middleware/session/types.js

@@ -0,0 +1,9 @@
+/**
+ * Session Store Types
+ *
+ * Interfaces for the dedicated Session Store abstraction.
+ * The session store manages user sessions across requests,
+ * providing a uniform API regardless of backing storage.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/middleware/session/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/middleware/session/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/proxy/connect-tunnel.d.ts

@@ -0,0 +1,50 @@
+/**
+ * HTTPS CONNECT Tunnel
+ *
+ * Attaches to an existing http.Server via the 'connect' event.
+ * Supports two modes:
+ *   - forward: transparent TCP tunnel (HTTP CONNECT proxy)
+ *   - mitm: TLS termination for inspection (MITM proxy)
+ *
+ * Usage:
+ *   const tunnel = createConnectTunnel({ mode: 'forward' })
+ *   tunnel.attachTo(httpServer)
+ */
+import { type Socket } from 'node:net';
+import type { IncomingMessage, Server as HttpServer } from 'node:http';
+import type { ProxyAuth, ProxyStats } from './types.js';
+export type ConnectMode = 'forward' | 'mitm';
+export interface TunnelInfo {
+    host: string;
+    port: number;
+    clientAddress: string;
+}
+export interface ConnectTunnelOptions {
+    /** 'forward' = transparent tunnel, 'mitm' = TLS termination. Default: 'forward' */
+    mode?: ConnectMode;
+    auth?: ProxyAuth;
+    /** Upstream connection timeout in ms. Default: 10_000 */
+    connectTimeout?: number;
+    /** Custom CA for MITM mode (defaults to built-in CA) */
+    ca?: {
+        key: string;
+        cert: string;
+    };
+    onConnect?: (info: TunnelInfo) => void;
+    onDisconnect?: (info: TunnelInfo & {
+        reason: string;
+    }) => void;
+}
+export interface ConnectTunnel {
+    /** Raw connect handler — attach manually or use attachTo(). */
+    connectHandler(req: IncomingMessage, socket: Socket, head: Buffer): void;
+    /** Attach this tunnel's connect handler to an http.Server. */
+    attachTo(server: HttpServer): void;
+    /** Detach this tunnel's connect handler from an http.Server. */
+    detachFrom(server: HttpServer): void;
+    /** The CA certificate PEM for MITM mode (null in forward mode). */
+    readonly caCert: string | null;
+    readonly stats: ProxyStats;
+}
+export declare function createConnectTunnel(options?: ConnectTunnelOptions): ConnectTunnel;
+//# sourceMappingURL=connect-tunnel.d.ts.map

package/dist/proxy/connect-tunnel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-tunnel.d.ts","sourceRoot":"","sources":["../../src/proxy/connect-tunnel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAyB,KAAK,MAAM,EAAE,MAAM,UAAU,CAAA;AAE7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,WAAW,CAAA;AACtE,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAKvD,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,MAAM,CAAA;AAE5C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,mFAAmF;IACnF,IAAI,CAAC,EAAE,WAAW,CAAA;IAClB,IAAI,CAAC,EAAE,SAAS,CAAA;IAChB,yDAAyD;IACzD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,wDAAwD;IACxD,EAAE,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IAClC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,CAAA;IACtC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,UAAU,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAA;CAC/D;AAED,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,cAAc,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACxE,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAAA;IAClC,gEAAgE;IAChE,UAAU,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAAA;IACpC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;CAC3B;AAED,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,oBAAyB,GAAG,aAAa,CAgMrF"}

package/dist/proxy/connect-tunnel.js

@@ -0,0 +1,163 @@
+/**
+ * HTTPS CONNECT Tunnel
+ *
+ * Attaches to an existing http.Server via the 'connect' event.
+ * Supports two modes:
+ *   - forward: transparent TCP tunnel (HTTP CONNECT proxy)
+ *   - mitm: TLS termination for inspection (MITM proxy)
+ *
+ * Usage:
+ *   const tunnel = createConnectTunnel({ mode: 'forward' })
+ *   tunnel.attachTo(httpServer)
+ */
+import { connect as netConnect } from 'node:net';
+import { TLSSocket, connect as tlsConnect } from 'node:tls';
+import { parseBasicProxyAuth, verifyProxyAuth, createProxyStats } from './utils/auth.js';
+import { pipeBidirectional } from './utils/pipe.js';
+import { generateCertificate, getDefaultCA } from '../utils/certs.js';
+export function createConnectTunnel(options = {}) {
+    const { mode = 'forward', auth, connectTimeout = 10_000, ca: customCa, onConnect, onDisconnect, } = options;
+    const { mutable, snapshot } = createProxyStats();
+    const certCache = new Map();
+    // Pre-compute caCert for MITM mode
+    let caCertPem = null;
+    if (mode === 'mitm') {
+        const ca = customCa ?? getDefaultCA();
+        caCertPem = ca.cert;
+    }
+    async function handleConnect(req, clientSocket, head) {
+        const hostPort = req.url ?? ':443';
+        const colonIdx = hostPort.lastIndexOf(':');
+        const host = hostPort.slice(0, colonIdx);
+        const port = parseInt(hostPort.slice(colonIdx + 1) || '443', 10);
+        const clientAddress = clientSocket.remoteAddress ?? 'unknown';
+        // Auth check
+        const creds = parseBasicProxyAuth(req.headers['proxy-authorization']);
+        const authed = await verifyProxyAuth(auth, creds);
+        if (!authed) {
+            mutable.authFailures++;
+            clientSocket.write('HTTP/1.1 407 Proxy Authentication Required\r\nProxy-Authenticate: Basic realm="proxy"\r\n\r\n');
+            clientSocket.destroy();
+            return;
+        }
+        mutable.connectionsTotal++;
+        mutable.connectionsActive++;
+        const info = { host, port, clientAddress };
+        onConnect?.(info);
+        function onEnd(reason) {
+            mutable.connectionsActive--;
+            onDisconnect?.({ ...info, reason });
+        }
+        if (mode === 'forward') {
+            handleForward(host, port, clientSocket, head, onEnd);
+        }
+        else {
+            await handleMitm(host, port, clientSocket, head, onEnd);
+        }
+    }
+    function handleForward(host, port, clientSocket, head, onEnd) {
+        const upstream = netConnect({ host, port });
+        upstream.setTimeout(connectTimeout);
+        upstream.on('connect', () => {
+            upstream.setTimeout(0);
+            clientSocket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
+            if (head.length > 0)
+                upstream.write(head);
+            pipeBidirectional(clientSocket, upstream, {
+                onStats: (s) => {
+                    mutable.bytesFromClient += s.bytesFromA;
+                    mutable.bytesToClient += s.bytesToA;
+                },
+                onEnd: () => onEnd('closed'),
+                onError: (err) => {
+                    mutable.connectionsErrored++;
+                    onEnd(err.message);
+                },
+            });
+        });
+        upstream.on('timeout', () => {
+            upstream.destroy(new Error('connect timeout'));
+        });
+        upstream.on('error', () => {
+            mutable.connectionsErrored++;
+            onEnd('upstream error');
+            if (!clientSocket.destroyed)
+                clientSocket.destroy();
+        });
+        clientSocket.on('error', () => {
+            upstream.destroy();
+        });
+    }
+    async function handleMitm(host, port, clientSocket, _head, onEnd) {
+        // Get or generate cert for this host
+        let certInfo = certCache.get(host);
+        if (!certInfo) {
+            const ca = customCa ?? getDefaultCA();
+            const generated = await generateCertificate(host, {
+                caKey: ca.key,
+                caCert: ca.cert,
+            });
+            certInfo = { key: generated.key, cert: generated.cert };
+            certCache.set(host, certInfo);
+        }
+        // Tell client tunnel is ready
+        clientSocket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
+        // Wrap client socket in TLS (server side)
+        const tlsClient = new TLSSocket(clientSocket, {
+            isServer: true,
+            key: certInfo.key,
+            cert: certInfo.cert,
+        });
+        tlsClient.on('error', () => {
+            mutable.connectionsErrored++;
+            onEnd('tls client error');
+        });
+        // Connect to real upstream via TLS
+        const tlsUpstream = tlsConnect({
+            host,
+            port,
+            rejectUnauthorized: false,
+            timeout: connectTimeout,
+        });
+        tlsUpstream.on('secureConnect', () => {
+            pipeBidirectional(tlsClient, tlsUpstream, {
+                onStats: (s) => {
+                    mutable.bytesFromClient += s.bytesFromA;
+                    mutable.bytesToClient += s.bytesToA;
+                },
+                onEnd: () => onEnd('closed'),
+                onError: (err) => {
+                    mutable.connectionsErrored++;
+                    onEnd(err.message);
+                },
+            });
+        });
+        tlsUpstream.on('error', () => {
+            mutable.connectionsErrored++;
+            onEnd('upstream tls error');
+            tlsClient.destroy();
+        });
+        clientSocket.on('error', () => {
+            tlsUpstream.destroy();
+        });
+    }
+    const handler = (req, socket, head) => {
+        void handleConnect(req, socket, head);
+    };
+    return {
+        connectHandler: handler,
+        attachTo(server) {
+            server.on('connect', handler);
+        },
+        detachFrom(server) {
+            server.off('connect', handler);
+        },
+        get caCert() {
+            return caCertPem;
+        },
+        get stats() {
+            return snapshot();
+        },
+    };
+}
+//# sourceMappingURL=connect-tunnel.js.map

package/dist/proxy/connect-tunnel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-tunnel.js","sourceRoot":"","sources":["../../src/proxy/connect-tunnel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,OAAO,IAAI,UAAU,EAAe,MAAM,UAAU,CAAA;AAC7D,OAAO,EAAE,SAAS,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,UAAU,CAAA;AAG3D,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AACxF,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAkCrE,MAAM,UAAU,mBAAmB,CAAC,UAAgC,EAAE;IACpE,MAAM,EACJ,IAAI,GAAG,SAAS,EAChB,IAAI,EACJ,cAAc,GAAG,MAAM,EACvB,EAAE,EAAE,QAAQ,EACZ,SAAS,EACT,YAAY,GACb,GAAG,OAAO,CAAA;IAEX,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,gBAAgB,EAAE,CAAA;IAChD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAyC,CAAA;IAElE,mCAAmC;IACnC,IAAI,SAAS,GAAkB,IAAI,CAAA;IACnC,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,EAAE,GAAG,QAAQ,IAAI,YAAY,EAAE,CAAA;QACrC,SAAS,GAAG,EAAE,CAAC,IAAI,CAAA;IACrB,CAAC;IAED,KAAK,UAAU,aAAa,CAC1B,GAAoB,EACpB,YAAoB,EACpB,IAAY;QAEZ,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,IAAI,MAAM,CAAA;QAClC,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;QACxC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC,CAAA;QAChE,MAAM,aAAa,GAAG,YAAY,CAAC,aAAa,IAAI,SAAS,CAAA;QAE7D,aAAa;QACb,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAuB,CAAC,CAAA;QAC3F,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,YAAY,EAAE,CAAA;YACtB,YAAY,CAAC,KAAK,CAChB,+FAA+F,CAChG,CAAA;YACD,YAAY,CAAC,OAAO,EAAE,CAAA;YACtB,OAAM;QACR,CAAC;QAED,OAAO,CAAC,gBAAgB,EAAE,CAAA;QAC1B,OAAO,CAAC,iBAAiB,EAAE,CAAA;QAC3B,MAAM,IAAI,GAAe,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;QACtD,SAAS,EAAE,CAAC,IAAI,CAAC,CAAA;QAEjB,SAAS,KAAK,CAAC,MAAc;YAC3B,OAAO,CAAC,iBAAiB,EAAE,CAAA;YAC3B,YAAY,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;QACrC,CAAC;QAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;QACtD,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;QACzD,CAAC;IACH,CAAC;IAED,SAAS,aAAa,CACpB,IAAY,EACZ,IAAY,EACZ,YAAoB,EACpB,IAAY,EACZ,KAA+B;QAE/B,MAAM,QAAQ,GAAG,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3C,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,CAAA;QAEnC,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YAC1B,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;YACtB,YAAY,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAA;YACjE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACzC,iBAAiB,CAAC,YAAY,EAAE,QAAQ,EAAE;gBACxC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;oBACb,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC,UAAU,CAAA;oBACvC,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC,QAAQ,CAAA;gBACrC,CAAC;gBACD,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;gBAC5B,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;oBACf,OAAO,CAAC,kBAAkB,EAAE,CAAA;oBAC5B,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;gBACpB,CAAC;aACF,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YAC1B,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAA;QAChD,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACxB,OAAO,CAAC,kBAAkB,EAAE,CAAA;YAC5B,KAAK,CAAC,gBAAgB,CAAC,CAAA;YACvB,IAAI,CAAC,YAAY,CAAC,SAAS;gBAAE,YAAY,CAAC,OAAO,EAAE,CAAA;QACrD,CAAC,CAAC,CAAA;QAEF,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YAC5B,QAAQ,CAAC,OAAO,EAAE,CAAA;QACpB,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,UAAU,UAAU,CACvB,IAAY,EACZ,IAAY,EACZ,YAAoB,EACpB,KAAa,EACb,KAA+B;QAE/B,qCAAqC;QACrC,IAAI,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,EAAE,GAAG,QAAQ,IAAI,YAAY,EAAE,CAAA;YACrC,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE;gBAChD,KAAK,EAAE,EAAE,CAAC,GAAG;gBACb,MAAM,EAAE,EAAE,CAAC,IAAI;aAChB,CAAC,CAAA;YACF,QAAQ,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAA;YACvD,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QAC/B,CAAC;QAED,8BAA8B;QAC9B,YAAY,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAA;QAEjE,0CAA0C;QAC1C,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,YAAY,EAAE;YAC5C,QAAQ,EAAE,IAAI;YACd,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,IAAI,EAAE,QAAQ,CAAC,IAAI;SACpB,CAAC,CAAA;QAEF,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACzB,OAAO,CAAC,kBAAkB,EAAE,CAAA;YAC5B,KAAK,CAAC,kBAAkB,CAAC,CAAA;QAC3B,CAAC,CAAC,CAAA;QAEF,mCAAmC;QACnC,MAAM,WAAW,GAAG,UAAU,CAAC;YAC7B,IAAI;YACJ,IAAI;YACJ,kBAAkB,EAAE,KAAK;YACzB,OAAO,EAAE,cAAc;SACxB,CAAC,CAAA;QAEF,WAAW,CAAC,EAAE,CAAC,eAAe,EAAE,GAAG,EAAE;YACnC,iBAAiB,CAAC,SAA8B,EAAE,WAAgC,EAAE;gBAClF,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;oBACb,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC,UAAU,CAAA;oBACvC,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC,QAAQ,CAAA;gBACrC,CAAC;gBACD,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;gBAC5B,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;oBACf,OAAO,CAAC,kBAAkB,EAAE,CAAA;oBAC5B,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;gBACpB,CAAC;aACF,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YAC3B,OAAO,CAAC,kBAAkB,EAAE,CAAA;YAC5B,KAAK,CAAC,oBAAoB,CAAC,CAAA;YAC3B,SAAS,CAAC,OAAO,EAAE,CAAA;QACrB,CAAC,CAAC,CAAA;QAEF,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YAC5B,WAAW,CAAC,OAAO,EAAE,CAAA;QACvB,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,GAAoB,EAAE,MAAc,EAAE,IAAY,EAAE,EAAE;QACrE,KAAK,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;IACvC,CAAC,CAAA;IAED,OAAO;QACL,cAAc,EAAE,OAAO;QAEvB,QAAQ,CAAC,MAAkB;YACzB,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QAC/B,CAAC;QAED,UAAU,CAAC,MAAkB;YAC3B,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QAChC,CAAC;QAED,IAAI,MAAM;YACR,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,IAAI,KAAK;YACP,OAAO,QAAQ,EAAE,CAAA;QACnB,CAAC;KACF,CAAA;AACH,CAAC"}