xypriss 9.11.13 → 9.12.0

package/dist/src/plugins/const/PluginHookIds.js

@@ -0,0 +1,185 @@
+/**
+ * Plugin Hook Identifiers
+ *
+ * Defines the unique identifiers for all plugin hooks used in the permission system.
+ * These IDs are used in the server configuration to allow/deny specific hooks.
+ */
+export const PluginHookIds = {
+    // Lifecycle Hooks
+    ON_REGISTER: "XHS.HOOK.LIFECYCLE.REGISTER",
+    ON_SERVER_START: "XHS.HOOK.LIFECYCLE.SERVER_START",
+    ON_SERVER_READY: "XHS.HOOK.LIFECYCLE.SERVER_READY",
+    ON_SERVER_STOP: "XHS.HOOK.LIFECYCLE.SERVER_STOP",
+    // HTTP Request/Response Hooks
+    ON_REQUEST: "XHS.HOOK.HTTP.REQUEST",
+    ON_RESPONSE: "XHS.HOOK.HTTP.RESPONSE",
+    ON_ERROR: "XHS.HOOK.HTTP.ERROR",
+    // Security Hooks
+    ON_SECURITY_ATTACK: "XHS.HOOK.SECURITY.ATTACK",
+    ON_RATE_LIMIT: "XHS.HOOK.SECURITY.RATE_LIMIT",
+    ACCESS_CONFIGS: "XHS.PERM.SECURITY.CONFIGS",
+    ACCESS_SENSITIVE_DATA: "XHS.PERM.SECURITY.SENSITIVE_DATA",
+    // Metrics & Monitoring Hooks
+    ON_RESPONSE_TIME: "XHS.HOOK.METRICS.RESPONSE_TIME",
+    ON_ROUTE_ERROR: "XHS.HOOK.METRICS.ROUTE_ERROR",
+    // Routing & Middleware
+    REGISTER_ROUTES: "XHS.PERM.ROUTING.REGISTER_ROUTES",
+    MIDDLEWARE: "XHS.PERM.HTTP.MIDDLEWARE",
+    BYPASS_NAMESPACE: "XHS.PERM.ROUTING.BYPASS_NAMESPACE",
+    OVERWRITE_PROTECTED: "XHS.PERM.ROUTING.OVERWRITE_PROTECTED",
+    GLOBAL_MIDDLEWARE: "XHS.PERM.HTTP.GLOBAL_MIDDLEWARE",
+    // Management Hooks
+    MANAGE_PLUGINS: "PLG.MANAGEMENT.MANAGE_PLUGINS",
+    // Ops Hooks
+    ON_AUXILIARY_SERVER_DEPLOY: "XHS.PERM.OPS.AUXILIARY_SERVER",
+    // Logging Hooks
+    ON_CONSOLE_INTERCEPT: "XHS.PERM.LOGGING.CONSOLE_INTERCEPT",
+};
+/**
+ * Mapping from internal hook method names to public PluginHookIds
+ */
+export const HOOK_ID_MAP = {
+    // Lifecycle
+    onRegister: PluginHookIds.ON_REGISTER,
+    onServerStart: PluginHookIds.ON_SERVER_START,
+    onServerReady: PluginHookIds.ON_SERVER_READY,
+    onServerStop: PluginHookIds.ON_SERVER_STOP,
+    // HTTP
+    onRequest: PluginHookIds.ON_REQUEST,
+    onResponse: PluginHookIds.ON_RESPONSE,
+    onError: PluginHookIds.ON_ERROR,
+    // Security
+    onSecurityAttack: PluginHookIds.ON_SECURITY_ATTACK,
+    onRateLimit: PluginHookIds.ON_RATE_LIMIT,
+    // Metrics
+    onResponseTime: PluginHookIds.ON_RESPONSE_TIME,
+    onRouteError: PluginHookIds.ON_ROUTE_ERROR,
+    // Routing
+    registerRoutes: PluginHookIds.REGISTER_ROUTES,
+    bypassNamespace: PluginHookIds.BYPASS_NAMESPACE,
+    overwriteProtected: PluginHookIds.OVERWRITE_PROTECTED,
+    // Middleware property (special case)
+    middleware: PluginHookIds.MIDDLEWARE,
+    globalMiddleware: PluginHookIds.GLOBAL_MIDDLEWARE,
+    // Management
+    managePlugins: PluginHookIds.MANAGE_PLUGINS,
+    // Ops
+    onAuxiliaryServerDeploy: PluginHookIds.ON_AUXILIARY_SERVER_DEPLOY,
+    // Logging
+    onConsoleIntercept: PluginHookIds.ON_CONSOLE_INTERCEPT,
+    // Security (Permissions only)
+    configs: PluginHookIds.ACCESS_CONFIGS,
+    sensitiveData: PluginHookIds.ACCESS_SENSITIVE_DATA,
+};
+/**
+ * Detailed metadata for each plugin hook.
+ * Used for descriptive error messages and documentation.
+ */
+export const HOOK_METADATA = {
+    [PluginHookIds.ON_REGISTER]: {
+        name: "Plugin Registration",
+        action: "register itself with the system",
+        description: "Executed when the plugin is first added to the server.",
+    },
+    [PluginHookIds.ON_SERVER_START]: {
+        name: "Server Startup",
+        action: "participate in server initialization",
+        description: "Executed during the initial phase of server startup.",
+    },
+    [PluginHookIds.ON_SERVER_READY]: {
+        name: "Server Ready Alert",
+        action: "execute logic after the server is fully ready",
+        description: "Executed once the server is listening for connections.",
+    },
+    [PluginHookIds.ON_SERVER_STOP]: {
+        name: "Server Shutdown",
+        action: "perform cleanup during shutdown",
+        description: "Executed when the server is closing down.",
+    },
+    [PluginHookIds.ON_REQUEST]: {
+        name: "Request Interception",
+        action: "intercept and process incoming requests",
+        description: "Executed for every incoming HTTP request.",
+    },
+    [PluginHookIds.ON_RESPONSE]: {
+        name: "Response Interception",
+        action: "intercept and process outgoing responses",
+        description: "Executed just before the response is sent to the client.",
+    },
+    [PluginHookIds.ON_ERROR]: {
+        name: "Error Handling",
+        action: "capture and handle application errors",
+        description: "Executed when an unhandled error occurs during a request.",
+    },
+    [PluginHookIds.ON_SECURITY_ATTACK]: {
+        name: "Security Attack Monitoring",
+        action: "monitor and respond to security threats",
+        description: "Executed when a potential security attack is detected.",
+    },
+    [PluginHookIds.ON_RATE_LIMIT]: {
+        name: "Rate Limit Tracking",
+        action: "respond to rate-limiting events",
+        description: "Executed when a client exceeds request rate limits.",
+    },
+    [PluginHookIds.ON_RESPONSE_TIME]: {
+        name: "Performance Monitoring",
+        action: "track request response times",
+        description: "Provides performance data for every completed request.",
+    },
+    [PluginHookIds.ON_ROUTE_ERROR]: {
+        name: "Route Error Tracking",
+        action: "monitor specific route failures",
+        description: "Executed when a specific route execution fails.",
+    },
+    [PluginHookIds.REGISTER_ROUTES]: {
+        name: "API Route Registration",
+        action: "register its own API endpoints",
+        description: "Allows the plugin to add new routes to the application.",
+    },
+    [PluginHookIds.MIDDLEWARE]: {
+        name: "Middleware Injection",
+        action: "inject scoped middleware into the pipe",
+        description: "Allows the plugin to add middleware to the request flow.",
+    },
+    [PluginHookIds.BYPASS_NAMESPACE]: {
+        name: "Namespace Bypass",
+        action: "register routes outside of its own namespace",
+        description: "Privileged: Allows a plugin to register routes on paths that don't start with its own ID.",
+    },
+    [PluginHookIds.OVERWRITE_PROTECTED]: {
+        name: "Route Overwrite",
+        action: "overwrite existing system or plugin routes",
+        description: "Privileged: Allows a plugin to replace an already registered route (high risk).",
+    },
+    [PluginHookIds.GLOBAL_MIDDLEWARE]: {
+        name: "Global Middleware",
+        action: "inject global middleware affecting all routes",
+        description: "Privileged: Allows a plugin to register middleware that applies to every request on the server.",
+    },
+    [PluginHookIds.MANAGE_PLUGINS]: {
+        name: "Plugin Orchestration",
+        action: "manage or configure other plugins",
+        description: "Privileged: Allows a plugin to influence other plugins in the system.",
+    },
+    [PluginHookIds.ON_AUXILIARY_SERVER_DEPLOY]: {
+        name: "Auxiliary Server Deployment",
+        action: "deploy an isolated server",
+        description: "Privileged: Allows creating independent servers (e.g., Swagger, Admin Panel).",
+    },
+    [PluginHookIds.ON_CONSOLE_INTERCEPT]: {
+        name: "Console Logging Interception",
+        action: "intercept and process console output",
+        description: "Privileged: Allows the plugin to capture all console activity.",
+    },
+    [PluginHookIds.ACCESS_CONFIGS]: {
+        name: "Server Configuration Access",
+        action: "read the full server configuration",
+        description: "Privileged: Allows reading sensitive server settings and environmental data.",
+    },
+    [PluginHookIds.ACCESS_SENSITIVE_DATA]: {
+        name: "Sensitive Request Data Access",
+        action: "read sensitive request data like body, query, and cookies",
+        description: "Privileged: Allows reading unmasked request data containing potentially sensitive information (PII, tokens, etc).",
+    },
+};
+//# sourceMappingURL=PluginHookIds.js.map

package/dist/src/plugins/const/PluginHookIds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PluginHookIds.js","sourceRoot":"","sources":["../../../../src/plugins/const/PluginHookIds.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG;IACzB,kBAAkB;IAClB,WAAW,EAAE,6BAA6B;IAC1C,eAAe,EAAE,iCAAiC;IAClD,eAAe,EAAE,iCAAiC;IAClD,cAAc,EAAE,gCAAgC;IAEhD,8BAA8B;IAC9B,UAAU,EAAE,uBAAuB;IACnC,WAAW,EAAE,wBAAwB;IACrC,QAAQ,EAAE,qBAAqB;IAE/B,iBAAiB;IACjB,kBAAkB,EAAE,0BAA0B;IAC9C,aAAa,EAAE,8BAA8B;IAC7C,cAAc,EAAE,2BAA2B;IAC3C,qBAAqB,EAAE,kCAAkC;IAEzD,6BAA6B;IAC7B,gBAAgB,EAAE,gCAAgC;IAClD,cAAc,EAAE,8BAA8B;IAE9C,uBAAuB;IACvB,eAAe,EAAE,kCAAkC;IACnD,UAAU,EAAE,0BAA0B;IACtC,gBAAgB,EAAE,mCAAmC;IACrD,mBAAmB,EAAE,sCAAsC;IAC3D,iBAAiB,EAAE,iCAAiC;IAEpD,mBAAmB;IACnB,cAAc,EAAE,+BAA+B;IAE/C,YAAY;IACZ,0BAA0B,EAAE,+BAA+B;IAE3D,gBAAgB;IAChB,oBAAoB,EAAE,oCAAoC;CACpD,CAAC;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,WAAW,GAA2B;IAC/C,YAAY;IACZ,UAAU,EAAE,aAAa,CAAC,WAAW;IACrC,aAAa,EAAE,aAAa,CAAC,eAAe;IAC5C,aAAa,EAAE,aAAa,CAAC,eAAe;IAC5C,YAAY,EAAE,aAAa,CAAC,cAAc;IAE1C,OAAO;IACP,SAAS,EAAE,aAAa,CAAC,UAAU;IACnC,UAAU,EAAE,aAAa,CAAC,WAAW;IACrC,OAAO,EAAE,aAAa,CAAC,QAAQ;IAE/B,WAAW;IACX,gBAAgB,EAAE,aAAa,CAAC,kBAAkB;IAClD,WAAW,EAAE,aAAa,CAAC,aAAa;IAExC,UAAU;IACV,cAAc,EAAE,aAAa,CAAC,gBAAgB;IAC9C,YAAY,EAAE,aAAa,CAAC,cAAc;IAE1C,UAAU;IACV,cAAc,EAAE,aAAa,CAAC,eAAe;IAC7C,eAAe,EAAE,aAAa,CAAC,gBAAgB;IAC/C,kBAAkB,EAAE,aAAa,CAAC,mBAAmB;IAErD,qCAAqC;IACrC,UAAU,EAAE,aAAa,CAAC,UAAU;IACpC,gBAAgB,EAAE,aAAa,CAAC,iBAAiB;IAEjD,aAAa;IACb,aAAa,EAAE,aAAa,CAAC,cAAc;IAE3C,MAAM;IACN,uBAAuB,EAAE,aAAa,CAAC,0BAA0B;IAEjE,UAAU;IACV,kBAAkB,EAAE,aAAa,CAAC,oBAAoB;IAEtD,8BAA8B;IAC9B,OAAO,EAAE,aAAa,CAAC,cAAc;IACrC,aAAa,EAAE,aAAa,CAAC,qBAAqB;CACrD,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAGtB;IACA,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE;QACzB,IAAI,EAAE,qBAAqB;QAC3B,MAAM,EAAE,iCAAiC;QACzC,WAAW,EAAE,wDAAwD;KACxE;IACD,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE;QAC7B,IAAI,EAAE,gBAAgB;QACtB,MAAM,EAAE,sCAAsC;QAC9C,WAAW,EAAE,sDAAsD;KACtE;IACD,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE;QAC7B,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,+CAA+C;QACvD,WAAW,EAAE,wDAAwD;KACxE;IACD,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE;QAC5B,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,iCAAiC;QACzC,WAAW,EAAE,2CAA2C;KAC3D;IACD,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE;QACxB,IAAI,EAAE,sBAAsB;QAC5B,MAAM,EAAE,yCAAyC;QACjD,WAAW,EAAE,2CAA2C;KAC3D;IACD,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE;QACzB,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,0CAA0C;QAClD,WAAW,EAAE,0DAA0D;KAC1E;IACD,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE;QACtB,IAAI,EAAE,gBAAgB;QACtB,MAAM,EAAE,uCAAuC;QAC/C,WAAW,EACP,2DAA2D;KAClE;IACD,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE;QAChC,IAAI,EAAE,4BAA4B;QAClC,MAAM,EAAE,yCAAyC;QACjD,WAAW,EAAE,wDAAwD;KACxE;IACD,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE;QAC3B,IAAI,EAAE,qBAAqB;QAC3B,MAAM,EAAE,iCAAiC;QACzC,WAAW,EAAE,qDAAqD;KACrE;IACD,CAAC,aAAa,CAAC,gBAAgB,CAAC,EAAE;QAC9B,IAAI,EAAE,wBAAwB;QAC9B,MAAM,EAAE,8BAA8B;QACtC,WAAW,EAAE,wDAAwD;KACxE;IACD,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE;QAC5B,IAAI,EAAE,sBAAsB;QAC5B,MAAM,EAAE,iCAAiC;QACzC,WAAW,EAAE,iDAAiD;KACjE;IACD,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE;QAC7B,IAAI,EAAE,wBAAwB;QAC9B,MAAM,EAAE,gCAAgC;QACxC,WAAW,EAAE,yDAAyD;KACzE;IACD,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE;QACxB,IAAI,EAAE,sBAAsB;QAC5B,MAAM,EAAE,wCAAwC;QAChD,WAAW,EAAE,0DAA0D;KAC1E;IACD,CAAC,aAAa,CAAC,gBAAgB,CAAC,EAAE;QAC9B,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,8CAA8C;QACtD,WAAW,EACP,2FAA2F;KAClG;IACD,CAAC,aAAa,CAAC,mBAAmB,CAAC,EAAE;QACjC,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,4CAA4C;QACpD,WAAW,EACP,iFAAiF;KACxF;IACD,CAAC,aAAa,CAAC,iBAAiB,CAAC,EAAE;QAC/B,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,+CAA+C;QACvD,WAAW,EACP,iGAAiG;KACxG;IACD,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE;QAC5B,IAAI,EAAE,sBAAsB;QAC5B,MAAM,EAAE,mCAAmC;QAC3C,WAAW,EACP,uEAAuE;KAC9E;IACD,CAAC,aAAa,CAAC,0BAA0B,CAAC,EAAE;QACxC,IAAI,EAAE,6BAA6B;QACnC,MAAM,EAAE,2BAA2B;QACnC,WAAW,EACP,+EAA+E;KACtF;IACD,CAAC,aAAa,CAAC,oBAAoB,CAAC,EAAE;QAClC,IAAI,EAAE,8BAA8B;QACpC,MAAM,EAAE,sCAAsC;QAC9C,WAAW,EACP,gEAAgE;KACvE;IACD,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE;QAC5B,IAAI,EAAE,6BAA6B;QACnC,MAAM,EAAE,oCAAoC;QAC5C,WAAW,EACP,8EAA8E;KACrF;IACD,CAAC,aAAa,CAAC,qBAAqB,CAAC,EAAE;QACnC,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,2DAA2D;QACnE,WAAW,EACP,mHAAmH;KAC1H;CACJ,CAAC"}

package/dist/src/plugins/const/PluginHookMetadataJson.d.ts

@@ -0,0 +1,2 @@
+export declare const PluginHookMetadataJson: string;
+//# sourceMappingURL=PluginHookMetadataJson.d.ts.map

package/dist/src/plugins/const/PluginHookMetadataJson.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PluginHookMetadataJson.d.ts","sourceRoot":"","sources":["../../../../src/plugins/const/PluginHookMetadataJson.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,sBAAsB,QAA4B,CAAC"}

package/dist/src/plugins/const/PluginHookMetadataJson.js

@@ -0,0 +1,6 @@
+// convert into json
+import { XStringify } from "xypriss-security";
+import { HOOK_METADATA } from "./PluginHookIds";
+export const PluginHookMetadataJson = XStringify(HOOK_METADATA);
+console.log(PluginHookMetadataJson);
+//# sourceMappingURL=PluginHookMetadataJson.js.map

package/dist/src/plugins/const/PluginHookMetadataJson.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PluginHookMetadataJson.js","sourceRoot":"","sources":["../../../../src/plugins/const/PluginHookMetadataJson.ts"],"names":[],"mappings":"AAAA,oBAAoB;AAEpB,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;AAEhE,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC"}

package/dist/src/plugins/const/XyprissTempDir.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Returns the absolute path to the XyPriss shared temp directory.
+ *
+ * @returns {string} Path to `<os.tmpdir>/nehonix.xypriss.data`
+ */
+export declare function getXyprissTempDir(): string;
+/**
+ * Resolves and ensures a sub-path within the XyPriss temp directory exists.
+ *
+ * @param {string | string[]} _p - Sub-path segment(s) to append.
+ * @returns {string} The absolute resolved temp sub-path.
+ */
+export declare function createXyprissTempDir(_p: string | string[]): string;
+/**
+ * Returns the process-scoped user temp directory path.
+ *
+ * Generates a 4-byte hex identifier once and caches it for the lifetime
+ * of the process. Subsequent calls always return the same path.
+ *
+ * @returns {string} Absolute path, e.g. `/tmp/nehonix.xypriss.data/xuser/a3f1`
+ */
+export declare function generateXUserTmpDir(): string;
+//# sourceMappingURL=XyprissTempDir.d.ts.map

package/dist/src/plugins/const/XyprissTempDir.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"XyprissTempDir.d.ts","sourceRoot":"","sources":["../../../../src/plugins/const/XyprissTempDir.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAG1C;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,MAAM,CAuBlE;AAcD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAU5C"}

package/dist/src/plugins/const/XyprissTempDir.js

@@ -0,0 +1,65 @@
+import { getRandomBytes } from "xypriss-security";
+import { getSysApi } from "./getSysApi";
+/**
+ * Returns the absolute path to the XyPriss shared temp directory.
+ *
+ * @returns {string} Path to `<os.tmpdir>/nehonix.xypriss.data`
+ */
+export function getXyprissTempDir() {
+    const sys = getSysApi();
+    return sys.path.join(sys.path.tempDir(), "nehonix.xypriss.data");
+}
+/**
+ * Resolves and ensures a sub-path within the XyPriss temp directory exists.
+ *
+ * @param {string | string[]} _p - Sub-path segment(s) to append.
+ * @returns {string} The absolute resolved temp sub-path.
+ */
+export function createXyprissTempDir(_p) {
+    const sys = getSysApi();
+    const base = getXyprissTempDir();
+    const segment = typeof _p === "string"
+        ? _p
+        : _p.includes("/")
+            ? _p.map((p) => p.replace("/", "")).join("/")
+            : _p.join("/");
+    // Use the native corrective layer to prevent doubling or redundant separators
+    const rawPath = segment.startsWith(base)
+        ? segment
+        : sys.path.join(base, segment);
+    const normalisedPath = sys.path.correct(rawPath, { tentative: 2 });
+    // console.log("normalisedPath: ", normalisedPath);
+    if (!sys.fs.exists(normalisedPath)) {
+        sys.fs.mkdir(normalisedPath, { parents: true });
+    }
+    return normalisedPath;
+}
+/**
+ * **Session Temp Directory (singleton)**
+ *
+ * Unique sub-path generated once per process lifetime under the XyPriss
+ * temp root (`<os.tmpdir>/nehonix.xypriss.data/xuser/<hex4>`).
+ *
+ * The value is memoized on first access and remains stable for the entire
+ * duration of the running process, ensuring all callers within the same
+ * session share the same isolated scratch space.
+ */
+let _sessionTmpDir = null;
+/**
+ * Returns the process-scoped user temp directory path.
+ *
+ * Generates a 4-byte hex identifier once and caches it for the lifetime
+ * of the process. Subsequent calls always return the same path.
+ *
+ * @returns {string} Absolute path, e.g. `/tmp/nehonix.xypriss.data/xuser/a3f1`
+ */
+export function generateXUserTmpDir() {
+    if (_sessionTmpDir !== null) {
+        return _sessionTmpDir;
+    }
+    const sys = getSysApi();
+    const hex = getRandomBytes(16).slice(0, 4).toString("hex");
+    _sessionTmpDir = sys.path.join(getXyprissTempDir(), "xuser", hex);
+    return _sessionTmpDir;
+}
+//# sourceMappingURL=XyprissTempDir.js.map

package/dist/src/plugins/const/XyprissTempDir.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"XyprissTempDir.js","sourceRoot":"","sources":["../../../../src/plugins/const/XyprissTempDir.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC;;;;GAIG;AACH,MAAM,UAAU,iBAAiB;IAC7B,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,sBAAsB,CAAC,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,EAAqB;IACtD,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAC;IAEjC,MAAM,OAAO,GACT,OAAO,EAAE,KAAK,QAAQ;QAClB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;YAChB,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAC7C,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEzB,8EAA8E;IAC9E,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QACpC,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACnC,MAAM,cAAc,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IACnE,mDAAmD;IAEnD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,cAAc,CAAC;AAC1B,CAAC;AAED;;;;;;;;;GASG;AACH,IAAI,cAAc,GAAkB,IAAI,CAAC;AAEzC;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB;IAC/B,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC1B,OAAO,cAAc,CAAC;IAC1B,CAAC;IAED,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC3D,cAAc,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAElE,OAAO,cAAc,CAAC;AAC1B,CAAC"}

package/dist/src/plugins/const/getSysApi.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Lazy accessor for `localSysApi`.
+ *
+ * Deferred to call-time to break the circular initialization chain:
+ * `xhsc.ts` -> `PathApi` -> `XyprissTempDir` -> `xhsc` (localSysApi)
+ */
+export declare function getSysApi(): import("../../xhsc").XyPrissXHSC;
+//# sourceMappingURL=getSysApi.d.ts.map

package/dist/src/plugins/const/getSysApi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getSysApi.d.ts","sourceRoot":"","sources":["../../../../src/plugins/const/getSysApi.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,SAAS,qCAExB"}

package/dist/src/plugins/const/getSysApi.js

@@ -0,0 +1,10 @@
+/**
+ * Lazy accessor for `localSysApi`.
+ *
+ * Deferred to call-time to break the circular initialization chain:
+ * `xhsc.ts` -> `PathApi` -> `XyprissTempDir` -> `xhsc` (localSysApi)
+ */
+export function getSysApi() {
+    return require("../../xhsc").localSysApi;
+}
+//# sourceMappingURL=getSysApi.js.map

package/dist/src/plugins/const/getSysApi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getSysApi.js","sourceRoot":"","sources":["../../../../src/plugins/const/getSysApi.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,SAAS;IACrB,OAAQ,OAAO,CAAC,YAAY,CAAiC,CAAC,WAAW,CAAC;AAC9E,CAAC"}

package/dist/src/plugins/core/PermissionManager.d.ts

@@ -0,0 +1,46 @@
+/***************************************************************************
+ * XyPrissJS - Fast And Secure
+ *
+ * @author Nehonix
+ * @license Nehonix OSL (NOSL)
+ *
+ * Copyright (c) 2025 Nehonix. All rights reserved.
+ ***************************************************************************** */
+import { Logger } from "../../shared/logger/Logger";
+import type { XyPrissServer } from "../types/PluginTypes";
+/**
+ * PermissionManager handles all security-related checks for the plugin system.
+ * It enforces hook policies and masks sensitive data.
+ */
+export declare class PermissionManager {
+    private server;
+    private logger;
+    private disabledPlugins;
+    constructor(server: XyPrissServer, logger?: Logger);
+    /**
+     * Disable a plugin globally.
+     * @param pluginName - Name of the plugin to disable.
+     */
+    disablePlugin(pluginName: string): void;
+    /**
+     * Enable a plugin globally.
+     * @param pluginName - Name of the plugin to enable.
+     */
+    enablePlugin(pluginName: string): void;
+    /**
+     * Check if a plugin is disabled and log a warning if it is.
+     */
+    isPluginDisabled(pluginName: string, internalHookName: string): boolean;
+    /**
+     * Check if a plugin is allowed to execute a specific hook.
+     * Enforces strict policies for privileged hooks.
+     */
+    checkPermission(pluginName: string, internalHookName: string): boolean;
+    /**
+     * Creates a masked version of the request object for security in plugin hooks.
+     * Prevents plugins from accessing sensitive data like body, query, and cookies
+     * unless explicitly authorized with ACCESS_SENSITIVE_DATA permission.
+     */
+    maskRequest(req: any, pluginName?: string): any;
+}
+//# sourceMappingURL=PermissionManager.d.ts.map

package/dist/src/plugins/core/PermissionManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionManager.d.ts","sourceRoot":"","sources":["../../../../src/plugins/core/PermissionManager.ts"],"names":[],"mappings":"AAAA;;;;;;;iFAOiF;AAEjF,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAMpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAK1D;;;GAGG;AACH,qBAAa,iBAAiB;IAKtB,OAAO,CAAC,MAAM;IAJlB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,eAAe,CAA0B;gBAGrC,MAAM,EAAE,aAAa,EAC7B,MAAM,CAAC,EAAE,MAAM;IAKnB;;;OAGG;IACI,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAI9C;;;OAGG;IACI,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAI7C;;OAEG;IACI,gBAAgB,CACnB,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,MAAM,GACzB,OAAO;IAmBV;;;OAGG;IACI,eAAe,CAClB,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,MAAM,GACzB,OAAO;IAiIV;;;;OAIG;IACI,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,GAAG;CAiGzD"}

package/dist/src/plugins/core/PermissionManager.js

@@ -0,0 +1,232 @@
+/***************************************************************************
+ * XyPrissJS - Fast And Secure
+ *
+ * @author Nehonix
+ * @license Nehonix OSL (NOSL)
+ *
+ * Copyright (c) 2025 Nehonix. All rights reserved.
+ ***************************************************************************** */
+import { Logger } from "../../shared/logger/Logger";
+import { PluginHookIds, HOOK_ID_MAP, HOOK_METADATA, } from "../const/PluginHookIds";
+import { __sys__ } from "../../xhsc";
+import { OFFICIAL_PLUGINS } from "../const/OFFICIAL_PLUGINS";
+/**
+ * PermissionManager handles all security-related checks for the plugin system.
+ * It enforces hook policies and masks sensitive data.
+ */
+export class PermissionManager {
+    constructor(server, logger) {
+        this.server = server;
+        this.disabledPlugins = new Set();
+        this.logger = logger || new Logger();
+    }
+    /**
+     * Disable a plugin globally.
+     * @param pluginName - Name of the plugin to disable.
+     */
+    disablePlugin(pluginName) {
+        this.disabledPlugins.add(pluginName);
+    }
+    /**
+     * Enable a plugin globally.
+     * @param pluginName - Name of the plugin to enable.
+     */
+    enablePlugin(pluginName) {
+        this.disabledPlugins.delete(pluginName);
+    }
+    /**
+     * Check if a plugin is disabled and log a warning if it is.
+     */
+    isPluginDisabled(pluginName, internalHookName) {
+        if (this.disabledPlugins.has(pluginName)) {
+            const hookId = HOOK_ID_MAP[internalHookName] || internalHookName;
+            const meta = HOOK_METADATA[hookId];
+            let message = `Plugin '${pluginName}' is disabled but tried to execute hook '${hookId}'.`;
+            if (meta) {
+                message = `Plugin '${pluginName}' is disabled and cannot ${meta.action} (Hook: ${hookId} - ${meta.name}).`;
+            }
+            this.logger.error("plugins", `${message} Please enable it if you want to use its features.`);
+            return true;
+        }
+        return false;
+    }
+    /**
+     * Check if a plugin is allowed to execute a specific hook.
+     * Enforces strict policies for privileged hooks.
+     */
+    checkPermission(pluginName, internalHookName) {
+        if (this.isPluginDisabled(pluginName, internalHookName)) {
+            return false;
+        }
+        // --- BUILT-IN PLUGINS BYPASS ---
+        // Built-in (official) plugins always bypass security checks for full capabilities.
+        if (OFFICIAL_PLUGINS.includes(pluginName)) {
+            return true;
+        }
+        const hookId = HOOK_ID_MAP[internalHookName] || internalHookName;
+        const meta = HOOK_METADATA[hookId];
+        const permissions = __sys__?.vars.get("pluginPermissions");
+        // Special case: Privileged hooks are denied by default unless explicitly allowed
+        const isPrivilegedHook = [
+            PluginHookIds.MANAGE_PLUGINS,
+            PluginHookIds.ON_CONSOLE_INTERCEPT,
+            PluginHookIds.ON_AUXILIARY_SERVER_DEPLOY,
+            PluginHookIds.BYPASS_NAMESPACE,
+            PluginHookIds.OVERWRITE_PROTECTED,
+            PluginHookIds.GLOBAL_MIDDLEWARE,
+            PluginHookIds.ACCESS_CONFIGS,
+            PluginHookIds.ACCESS_SENSITIVE_DATA,
+            PluginHookIds.ON_REQUEST,
+            PluginHookIds.ON_RESPONSE,
+        ].includes(hookId);
+        // Helper to log denials
+        const logDenial = (reason, solution) => {
+            let message = `Plugin '${pluginName}' is denied access to hook '${hookId}'.`;
+            if (meta) {
+                const typeSuffix = isPrivilegedHook
+                    ? "This is a privileged action restricted by the engine."
+                    : "This action is currently not allowed by the security policy.";
+                message = `Plugin '${pluginName}' is attempting to ${meta.action} using hook '${hookId}' (${meta.name}).\n${meta.description}\n${typeSuffix}`;
+            }
+            this.logger.error("plugins", `${message}${solution ? `\nTo allow this: ${solution}` : ""}`);
+        };
+        const solutionPrivileged = `Add '${hookId}' to 'allowedHooks' in the server configuration for plugin '${pluginName}'.`;
+        const isLifecycleHook = hookId.startsWith("XHS.HOOK.LIFECYCLE.");
+        // If no permissions configured
+        if (!permissions || permissions.length === 0) {
+            if (isPrivilegedHook) {
+                logDenial("Privileged hook denied by default.", solutionPrivileged);
+                return false;
+            }
+            // Allow lifecycle hooks by default to permit boot, deny everything else
+            return isLifecycleHook;
+        }
+        const pluginPerm = permissions.find((p) => p.name === pluginName);
+        // If plugin is not listed in permissions
+        if (!pluginPerm) {
+            if (isPrivilegedHook) {
+                logDenial("Privileged hook denied by default.", solutionPrivileged);
+                return false;
+            }
+            // Allow lifecycle hooks by default to permit boot, deny everything else
+            return isLifecycleHook;
+        }
+        // Check explicitly denied hooks first (they override everything)
+        if (pluginPerm.deniedHooks?.includes(hookId)) {
+            logDenial("Explicitly denied in configuration.", `Remove '${hookId}' from 'deniedHooks' for plugin '${pluginName}'.`);
+            return false;
+        }
+        const policy = pluginPerm.policy || "deny"; // G3 Security: Default to 'deny' (Whitelist)
+        const allowedHooks = pluginPerm.allowedHooks;
+        // 1. Strict Enforcement for Privileged Hooks
+        if (isPrivilegedHook) {
+            if (Array.isArray(allowedHooks) && allowedHooks.includes(hookId)) {
+                return true;
+            }
+            // WILDWACRD STOP GAP: '*' should never grant privileged capabilities.
+            logDenial("Privileged hook must be explicitly whitelisted by string declaration. Wildcard '*' does not grant privileged capabilities.", solutionPrivileged);
+            return false;
+        }
+        // 2. Lifecycle Hooks: Engines stability fallback
+        const allowLifecycle = this.server.options?.plugins?.allowLifecycleByDefault ?? false;
+        if (isLifecycleHook && allowLifecycle)
+            return true;
+        // 3. Standard Hook Logic
+        if (policy === "deny") {
+            // "deny" policy = Whitelist mode
+            // Whitelist mode: only allow if in allowedHooks (or explicitly enabled by server options above)
+            if (allowedHooks === "*")
+                return true;
+            if (Array.isArray(allowedHooks) && allowedHooks.includes(hookId)) {
+                return true;
+            }
+            logDenial("Denied by 'deny' policy (Whitelist mode).", `Add '${hookId}' to 'allowedHooks' for plugin '${pluginName}'.`);
+            return false;
+        }
+        // "allow" policy = Blacklist mode
+        return true;
+    }
+    /**
+     * Creates a masked version of the request object for security in plugin hooks.
+     * Prevents plugins from accessing sensitive data like body, query, and cookies
+     * unless explicitly authorized with ACCESS_SENSITIVE_DATA permission.
+     */
+    maskRequest(req, pluginName) {
+        if (!req)
+            return req;
+        if (pluginName) {
+            const permissions = __sys__?.vars.get("pluginPermissions");
+            if (permissions) {
+                const pluginPerm = permissions.find((p) => p.name === pluginName);
+                if (pluginPerm) {
+                    const allowedHooks = pluginPerm.allowedHooks || [];
+                    const isAllowed = Array.isArray(allowedHooks) &&
+                        allowedHooks.includes(PluginHookIds.ACCESS_SENSITIVE_DATA);
+                    const isDenied = pluginPerm.deniedHooks?.includes(PluginHookIds.ACCESS_SENSITIVE_DATA);
+                    if (isAllowed && !isDenied) {
+                        return req; // Explicitly allowed: return unmasked real request
+                    }
+                }
+            }
+        }
+        const maskedMessage = `${pluginName} is trying to access sensitive request data, which is restricted for security reasons. Requires XHS.PERM.SECURITY.SENSITIVE_DATA permission.`;
+        const sensitiveFields = [
+            "body",
+            "query",
+            "cookies",
+            "params",
+            "headers",
+        ];
+        return new Proxy(req, {
+            get(target, prop) {
+                if (typeof prop === "string" && prop === "headers") {
+                    const originalHeaders = target[prop] || {};
+                    const safeHeaders = [
+                        "user-agent",
+                        "referer",
+                        "host",
+                        "accept",
+                        "content-type",
+                        "content-length",
+                        "connection",
+                        "x-forwarded-for",
+                        "cf-connecting-ip",
+                    ];
+                    const maskedHeaders = {};
+                    for (const [key, value] of Object.entries(originalHeaders)) {
+                        const lowerKey = key.toLowerCase();
+                        if (safeHeaders.includes(lowerKey)) {
+                            maskedHeaders[key] = value;
+                        }
+                    }
+                    return maskedHeaders;
+                }
+                if (typeof prop === "string" &&
+                    sensitiveFields.includes(prop)) {
+                    return `[${pluginName}] Access to sensitive request data '${prop}' is restricted for security reasons. Requires XHS.PERM.SECURITY.SENSITIVE_DATA.`;
+                }
+                const value = target[prop];
+                if (typeof value === "function") {
+                    return value.bind(target);
+                }
+                return value;
+            },
+            ownKeys(target) {
+                return Reflect.ownKeys(target);
+            },
+            getOwnPropertyDescriptor(target, prop) {
+                if (typeof prop === "string" &&
+                    sensitiveFields.includes(prop)) {
+                    return {
+                        value: maskedMessage,
+                        enumerable: true,
+                        configurable: true,
+                        writable: false,
+                    };
+                }
+                return Reflect.getOwnPropertyDescriptor(target, prop);
+            },
+        });
+    }
+}
+//# sourceMappingURL=PermissionManager.js.map

package/dist/src/plugins/core/PermissionManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionManager.js","sourceRoot":"","sources":["../../../../src/plugins/core/PermissionManager.ts"],"names":[],"mappings":"AAAA;;;;;;;iFAOiF;AAEjF,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EACH,aAAa,EACb,WAAW,EACX,aAAa,GAChB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAErC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D;;;GAGG;AACH,MAAM,OAAO,iBAAiB;IAI1B,YACY,MAAqB,EAC7B,MAAe;QADP,WAAM,GAAN,MAAM,CAAe;QAHzB,oBAAe,GAAgB,IAAI,GAAG,EAAE,CAAC;QAM7C,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;IACzC,CAAC;IAED;;;OAGG;IACI,aAAa,CAAC,UAAkB;QACnC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC;IAED;;;OAGG;IACI,YAAY,CAAC,UAAkB;QAClC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACI,gBAAgB,CACnB,UAAkB,EAClB,gBAAwB;QAExB,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,WAAW,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,CAAC;YACjE,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;YAEnC,IAAI,OAAO,GAAG,WAAW,UAAU,4CAA4C,MAAM,IAAI,CAAC;YAC1F,IAAI,IAAI,EAAE,CAAC;gBACP,OAAO,GAAG,WAAW,UAAU,4BAA4B,IAAI,CAAC,MAAM,WAAW,MAAM,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC;YAC/G,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,KAAK,CACb,SAAS,EACT,GAAG,OAAO,oDAAoD,CACjE,CAAC;YACF,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;;OAGG;IACI,eAAe,CAClB,UAAkB,EAClB,gBAAwB;QAExB,IAAI,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,gBAAgB,CAAC,EAAE,CAAC;YACtD,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,kCAAkC;QAClC,mFAAmF;QACnF,IAAI,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,CAAC;QACjE,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,WAAW,GAAG,OAAO,EAAE,IAAI,CAAC,GAAG,CACjC,mBAAmB,CACA,CAAC;QAExB,iFAAiF;QACjF,MAAM,gBAAgB,GAAG;YACrB,aAAa,CAAC,cAAc;YAC5B,aAAa,CAAC,oBAAoB;YAClC,aAAa,CAAC,0BAA0B;YACxC,aAAa,CAAC,gBAAgB;YAC9B,aAAa,CAAC,mBAAmB;YACjC,aAAa,CAAC,iBAAiB;YAC/B,aAAa,CAAC,cAAc;YAC5B,aAAa,CAAC,qBAAqB;YACnC,aAAa,CAAC,UAAU;YACxB,aAAa,CAAC,WAAW;SAC5B,CAAC,QAAQ,CAAC,MAAa,CAAC,CAAC;QAE1B,wBAAwB;QACxB,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,QAAiB,EAAE,EAAE;YACpD,IAAI,OAAO,GAAG,WAAW,UAAU,+BAA+B,MAAM,IAAI,CAAC;YAE7E,IAAI,IAAI,EAAE,CAAC;gBACP,MAAM,UAAU,GAAG,gBAAgB;oBAC/B,CAAC,CAAC,uDAAuD;oBACzD,CAAC,CAAC,8DAA8D,CAAC;gBACrE,OAAO,GAAG,WAAW,UAAU,sBAAsB,IAAI,CAAC,MAAM,gBAAgB,MAAM,MAAM,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;YAClJ,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,KAAK,CACb,SAAS,EACT,GAAG,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,oBAAoB,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAChE,CAAC;QACN,CAAC,CAAC;QAEF,MAAM,kBAAkB,GAAG,QAAQ,MAAM,+DAA+D,UAAU,IAAI,CAAC;QAEvH,MAAM,eAAe,GAAG,MAAM,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;QAEjE,+BAA+B;QAC/B,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3C,IAAI,gBAAgB,EAAE,CAAC;gBACnB,SAAS,CACL,oCAAoC,EACpC,kBAAkB,CACrB,CAAC;gBACF,OAAO,KAAK,CAAC;YACjB,CAAC;YACD,wEAAwE;YACxE,OAAO,eAAe,CAAC;QAC3B,CAAC;QAED,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;QAElE,yCAAyC;QACzC,IAAI,CAAC,UAAU,EAAE,CAAC;YACd,IAAI,gBAAgB,EAAE,CAAC;gBACnB,SAAS,CACL,oCAAoC,EACpC,kBAAkB,CACrB,CAAC;gBACF,OAAO,KAAK,CAAC;YACjB,CAAC;YACD,wEAAwE;YACxE,OAAO,eAAe,CAAC;QAC3B,CAAC;QAED,iEAAiE;QACjE,IAAI,UAAU,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3C,SAAS,CACL,qCAAqC,EACrC,WAAW,MAAM,oCAAoC,UAAU,IAAI,CACtE,CAAC;YACF,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,6CAA6C;QACzF,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAE7C,6CAA6C;QAC7C,IAAI,gBAAgB,EAAE,CAAC;YACnB,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/D,OAAO,IAAI,CAAC;YAChB,CAAC;YAED,sEAAsE;YACtE,SAAS,CACL,4HAA4H,EAC5H,kBAAkB,CACrB,CAAC;YACF,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,iDAAiD;QACjD,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,uBAAuB,IAAI,KAAK,CAAC;QACtF,IAAI,eAAe,IAAI,cAAc;YAAE,OAAO,IAAI,CAAC;QAEnD,yBAAyB;QACzB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACpB,iCAAiC;YACjC,gGAAgG;YAChG,IAAI,YAAY,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtC,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/D,OAAO,IAAI,CAAC;YAChB,CAAC;YACD,SAAS,CACL,2CAA2C,EAC3C,QAAQ,MAAM,mCAAmC,UAAU,IAAI,CAClE,CAAC;YACF,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,kCAAkC;QAClC,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACI,WAAW,CAAC,GAAQ,EAAE,UAAmB;QAC5C,IAAI,CAAC,GAAG;YAAE,OAAO,GAAG,CAAC;QAErB,IAAI,UAAU,EAAE,CAAC;YACb,MAAM,WAAW,GAAG,OAAO,EAAE,IAAI,CAAC,GAAG,CACjC,mBAAmB,CACA,CAAC;YACxB,IAAI,WAAW,EAAE,CAAC;gBACd,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAC/B,CAAC;gBACF,IAAI,UAAU,EAAE,CAAC;oBACb,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,IAAI,EAAE,CAAC;oBACnD,MAAM,SAAS,GACX,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;wBAC3B,YAAY,CAAC,QAAQ,CACjB,aAAa,CAAC,qBAAqB,CACtC,CAAC;oBACN,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,EAAE,QAAQ,CAC7C,aAAa,CAAC,qBAAqB,CACtC,CAAC;oBAEF,IAAI,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACzB,OAAO,GAAG,CAAC,CAAC,mDAAmD;oBACnE,CAAC;gBACL,CAAC;YACL,CAAC;QACL,CAAC;QAED,MAAM,aAAa,GAAG,GAAG,UAAU,8IAA8I,CAAC;QAClL,MAAM,eAAe,GAAG;YACpB,MAAM;YACN,OAAO;YACP,SAAS;YACT,QAAQ;YACR,SAAS;SACZ,CAAC;QAEF,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE;YAClB,GAAG,CAAC,MAAM,EAAE,IAAI;gBACZ,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACjD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;oBAC3C,MAAM,WAAW,GAAG;wBAChB,YAAY;wBACZ,SAAS;wBACT,MAAM;wBACN,QAAQ;wBACR,cAAc;wBACd,gBAAgB;wBAChB,YAAY;wBACZ,iBAAiB;wBACjB,kBAAkB;qBACrB,CAAC;oBAEF,MAAM,aAAa,GAA2B,EAAE,CAAC;oBACjD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CACrC,eAAe,CAClB,EAAE,CAAC;wBACA,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;wBACnC,IAAI,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;4BACjC,aAAa,CAAC,GAAG,CAAC,GAAG,KAAe,CAAC;wBACzC,CAAC;oBACL,CAAC;oBACD,OAAO,aAAa,CAAC;gBACzB,CAAC;gBAED,IACI,OAAO,IAAI,KAAK,QAAQ;oBACxB,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,EAChC,CAAC;oBACC,OAAO,IAAI,UAAU,uCAAuC,IAAI,kFAAkF,CAAC;gBACvJ,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC3B,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;oBAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC9B,CAAC;gBACD,OAAO,KAAK,CAAC;YACjB,CAAC;YACD,OAAO,CAAC,MAAM;gBACV,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACnC,CAAC;YACD,wBAAwB,CAAC,MAAM,EAAE,IAAI;gBACjC,IACI,OAAO,IAAI,KAAK,QAAQ;oBACxB,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,EAChC,CAAC;oBACC,OAAO;wBACH,KAAK,EAAE,aAAa;wBACpB,UAAU,EAAE,IAAI;wBAChB,YAAY,EAAE,IAAI;wBAClB,QAAQ,EAAE,KAAK;qBAClB,CAAC;gBACN,CAAC;gBACD,OAAO,OAAO,CAAC,wBAAwB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC1D,CAAC;SACJ,CAAC,CAAC;IACP,CAAC;CACJ"}