@antasphere/chassis-server 1.0.2 → 1.2.0

package/dist/webhooks/match.js

@@ -0,0 +1,40 @@
+/**
+ * The subscription rule, pure and unit-tested (`webhook-match.test.ts`): an
+ * endpoint's `events` are matched against an event's type, its `filters`
+ * against the event's subjects. The chassis never knows what a subject IS,
+ * only that it is a key with one or several ids.
+ */
+/** `*` matches every type; `family.*` matches the family; a type matches itself. */
+export function matchesEventType(patterns, type) {
+    const family = type.slice(0, type.indexOf('.'));
+    for (const pattern of patterns) {
+        if (pattern === '*' || pattern === type)
+            return true;
+        if (pattern.endsWith('.*') && pattern.slice(0, -2) === family)
+            return true;
+    }
+    return false;
+}
+/**
+ * AND across the filter's keys, OR within a key's ids. An event that does not
+ * carry a filtered subject does not match (a filter on `project` excludes an
+ * event with no project). An empty filter matches everything.
+ */
+export function matchesFilters(filters, subjects) {
+    for (const [key, ids] of Object.entries(filters)) {
+        if (ids.length === 0)
+            continue;
+        const value = subjects[key];
+        if (value === undefined)
+            return false;
+        const values = typeof value === 'string' ? [value] : value;
+        if (!values.some((v) => ids.includes(v)))
+            return false;
+    }
+    return true;
+}
+/** Whether an endpoint takes this event: enabled, the type subscribed, the filters satisfied. */
+export function endpointWants(endpoint, type, subjects) {
+    return (endpoint.enabled && matchesEventType(endpoint.events, type) && matchesFilters(endpoint.filters, subjects));
+}
+//# sourceMappingURL=match.js.map

package/dist/webhooks/match.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"match.js","sourceRoot":"","sources":["../../src/webhooks/match.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,oFAAoF;AACpF,MAAM,UAAU,gBAAgB,CAAC,QAA2B,EAAE,IAAY;IACxE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACrD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAoD,EACpD,QAAuD;IAEvD,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACtC,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,aAAa,CAC3B,QAIC,EACD,IAAY,EACZ,QAAuD;IAEvD,OAAO,CACL,QAAQ,CAAC,OAAO,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAC1G,CAAC;AACJ,CAAC"}

package/dist/webhooks/safe-fetch.d.ts

@@ -0,0 +1,94 @@
+import { type Readable } from 'node:stream';
+/**
+ * The guarded outbound POST the webhook delivery worker uses. A webhook's
+ * address is somebody else's choice, so the one rule that is not negotiable:
+ * a POST never reaches the instance's own network unless the operator opened
+ * it (`allowPrivateNetworks`, a self-hoster's LAN).
+ *
+ *  - Up front, before any request (`checkWebhookUrl`): `http:`/`https:` only
+ *    (`https:` alone under `httpsOnly`), the scheme's default port only, no
+ *    userinfo, a hostname, and a literal IP host must be public.
+ *  - A name is resolved with ALL its addresses, and the connection is refused
+ *    (`WebhookUrlRefusedError`) when ANY of them is not public. The check is
+ *    the socket's own `lookup`, so the address connected to IS the one
+ *    checked: no gap for a name that answers differently the second time.
+ *  - No redirect is ever followed: a 3xx comes back as its status.
+ *  - One timeout over the whole call (resolution, connection, the body read).
+ *  - The response body is read up to `maxResponseBytes`, then the stream is
+ *    destroyed.
+ */
+export type WebhookUrlRefusal = 'scheme' | 'port' | 'userinfo' | 'private_address' | 'https_required' | 'unresolvable' | 'malformed';
+/** A webhook URL the guard refused (a scheme, a port, userinfo, an address). */
+export declare class WebhookUrlRefusedError extends Error {
+    readonly code: WebhookUrlRefusal;
+    constructor(code: WebhookUrlRefusal, message?: string);
+}
+export interface SafeFetchPolicy {
+    /** Private, loopback, link-local and other non-public addresses are reachable (a self-hoster's LAN). Default false. */
+    allowPrivateNetworks: boolean;
+    /** Only https: URLs are accepted (the cloud edition). Default false. */
+    httpsOnly: boolean;
+}
+export interface LookupAddress {
+    address: string;
+    family: number;
+}
+/** Every address a name resolves to (`dns.lookup(host, { all: true })` by default). */
+export type SafeLookup = (hostname: string) => Promise<LookupAddress[]>;
+export interface SafeFetchResponse {
+    status: number;
+    headers: Record<string, string | string[] | undefined>;
+    body: Readable;
+}
+/**
+ * One POST, no redirect followed. The default speaks `node:http`/`node:https`
+ * with the guarded lookup in the socket; a test hands its own, and the
+ * address check then runs before it.
+ */
+export type SafeTransport = (url: URL, init: {
+    method: 'POST';
+    headers: Record<string, string>;
+    body: string;
+}, signal: AbortSignal) => Promise<SafeFetchResponse>;
+export interface SafeFetchOptions {
+    lookup?: SafeLookup;
+    transport?: SafeTransport;
+    /** Over the whole call. Default 10 000. */
+    timeoutMs?: number;
+    /** The response body is cut there. Default 65 536. */
+    maxResponseBytes?: number;
+}
+export interface SafeFetchResult {
+    status: number;
+    /** the response body, utf8, cut at maxResponseBytes */
+    bodyText: string;
+    durationMs: number;
+}
+/**
+ * Whether an address is on the public internet: false for loopback, private,
+ * link-local (the metadata address), carrier-grade NAT, multicast, reserved,
+ * and every IPv6 outside global unicast (`2000::/3`): `::`, `::1`, `fc00::/7`,
+ * `fe80::/10`, `ff00::/8`. An IPv4-mapped (`::ffff:a.b.c.d`) or a 6to4
+ * (`2002::/16`) address is judged by the IPv4 inside it. Unparseable: false.
+ */
+export declare function isPublicAddress(ip: string): boolean;
+/**
+ * The checks that need no lookup: `http:`/`https:` only (`https:` alone under
+ * `httpsOnly`), the scheme's default port only (`url.port === ''`, so an
+ * explicit default port, which the URL parser drops, passes), no userinfo, a
+ * non-empty hostname, a literal IP public unless `allowPrivateNetworks`.
+ * Throws `WebhookUrlRefusedError`; returns the parsed URL.
+ */
+export declare function checkWebhookUrl(url: string, policy: SafeFetchPolicy): URL;
+/**
+ * One POST, no redirect followed (a 3xx comes back as its status), the address
+ * check inside the socket's own lookup (ALL resolved addresses must be public
+ * unless `allowPrivateNetworks`; an empty resolution is `unresolvable`),
+ * `AbortSignal.timeout(timeoutMs)` over the whole call, the response body read
+ * up to `maxResponseBytes` then the stream destroyed. Rejects with
+ * `WebhookUrlRefusedError` on a refused address, with the transport's error
+ * (ECONNREFUSED, the timeout's AbortError…) otherwise. Sets no `user-agent`:
+ * that is the caller's.
+ */
+export declare function safePost(url: string, headers: Record<string, string>, body: string, policy: SafeFetchPolicy, options?: SafeFetchOptions): Promise<SafeFetchResult>;
+//# sourceMappingURL=safe-fetch.d.ts.map

package/dist/webhooks/safe-fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-fetch.d.ts","sourceRoot":"","sources":["../../src/webhooks/safe-fetch.ts"],"names":[],"mappings":"AAIA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE5D;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,MAAM,iBAAiB,GAC3B,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,cAAc,GAAG,WAAW,CAAC;AAYvG,gFAAgF;AAChF,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;gBACrB,IAAI,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,MAAM;CAKtD;AAED,MAAM,WAAW,eAAe;IAC9B,uHAAuH;IACvH,oBAAoB,EAAE,OAAO,CAAC;IAC9B,wEAAwE;IACxE,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AACD,uFAAuF;AACvF,MAAM,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;AAExE,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,IAAI,EAAE,QAAQ,CAAC;CAChB;AACD;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,CAC1B,GAAG,EAAE,GAAG,EACR,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACvE,MAAM,EAAE,WAAW,KAChB,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEhC,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAkDD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAanD;AAOD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,GAAG,CAoBzE;AAuFD;;;;;;;;;GASG;AACH,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,eAAe,EACvB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,eAAe,CAAC,CAmC1B"}

package/dist/webhooks/safe-fetch.js

@@ -0,0 +1,263 @@
+import { promises as dns } from 'node:dns';
+import http from 'node:http';
+import https from 'node:https';
+import { isIP } from 'node:net';
+import { addAbortSignal } from 'node:stream';
+const REFUSAL_MESSAGES = {
+    scheme: 'the webhook URL must use http: or https:',
+    port: "the webhook URL must use its scheme's default port",
+    userinfo: 'the webhook URL must not carry a user name or a password',
+    private_address: 'the webhook URL resolves to an address that is not on the public internet',
+    https_required: 'the webhook URL must use https:',
+    unresolvable: 'the webhook URL names a host that resolves to no address',
+    malformed: 'the webhook URL is not a valid URL'
+};
+/** A webhook URL the guard refused (a scheme, a port, userinfo, an address). */
+export class WebhookUrlRefusedError extends Error {
+    code;
+    constructor(code, message) {
+        super(message ?? REFUSAL_MESSAGES[code]);
+        this.name = 'WebhookUrlRefusedError';
+        this.code = code;
+    }
+}
+const DEFAULT_TIMEOUT_MS = 10_000;
+const DEFAULT_MAX_RESPONSE_BYTES = 65_536;
+// ── The address check ────────────────────────────────────────────────────────
+function ipv4(ip) {
+    const parts = ip.split('.');
+    if (parts.length !== 4)
+        return null;
+    const bytes = parts.map((p) => (/^\d{1,3}$/.test(p) ? Number(p) : NaN));
+    return bytes.every((b) => b >= 0 && b <= 255) ? bytes : null;
+}
+function isPublicV4(b) {
+    const [a, c] = [b[0], b[1]];
+    if (a === 0 || a === 10 || a === 127)
+        return false; // this network, private, loopback
+    if (a === 100 && c >= 64 && c <= 127)
+        return false; // carrier-grade NAT
+    if (a === 169 && c === 254)
+        return false; // link-local, the cloud metadata address
+    if (a === 172 && c >= 16 && c <= 31)
+        return false; // private
+    if (a === 192 && c === 0 && b[2] === 0)
+        return false; // IETF protocol assignments
+    if (a === 192 && c === 0 && b[2] === 2)
+        return false; // documentation
+    if (a === 192 && c === 168)
+        return false; // private
+    if (a === 198 && (c === 18 || c === 19))
+        return false; // benchmarking
+    if (a === 198 && c === 51 && b[2] === 100)
+        return false; // documentation
+    if (a === 203 && c === 0 && b[2] === 113)
+        return false; // documentation
+    return a < 224; // multicast, reserved, broadcast
+}
+/** The eight 16-bit groups of an IPv6 address (a trailing dotted IPv4 folded in), or null. */
+function ipv6(ip) {
+    let s = ip.toLowerCase().replace(/%.*$/, '');
+    const dotted = /(\d+\.\d+\.\d+\.\d+)$/.exec(s);
+    if (dotted) {
+        const v4 = ipv4(dotted[1]);
+        if (!v4)
+            return null;
+        s = `${s.slice(0, -dotted[1].length)}${((v4[0] << 8) | v4[1]).toString(16)}:${((v4[2] << 8) | v4[3]).toString(16)}`;
+    }
+    const halves = s.split('::');
+    if (halves.length > 2)
+        return null;
+    const parse = (h) => (h === '' ? [] : h.split(':'));
+    const head = parse(halves[0]);
+    const tail = halves.length === 2 ? parse(halves[1]) : [];
+    const fill = 8 - head.length - tail.length;
+    if (halves.length === 2 ? fill < 1 : fill !== 0)
+        return null;
+    const groups = [...head, ...Array(halves.length === 2 ? fill : 0).fill('0'), ...tail];
+    if (!groups.every((g) => /^[0-9a-f]{1,4}$/.test(g)))
+        return null;
+    return groups.map((g) => Number.parseInt(g, 16));
+}
+/**
+ * Whether an address is on the public internet: false for loopback, private,
+ * link-local (the metadata address), carrier-grade NAT, multicast, reserved,
+ * and every IPv6 outside global unicast (`2000::/3`): `::`, `::1`, `fc00::/7`,
+ * `fe80::/10`, `ff00::/8`. An IPv4-mapped (`::ffff:a.b.c.d`) or a 6to4
+ * (`2002::/16`) address is judged by the IPv4 inside it. Unparseable: false.
+ */
+export function isPublicAddress(ip) {
+    if (isIP(ip) === 4) {
+        const b = ipv4(ip);
+        return b !== null && isPublicV4(b);
+    }
+    const g = ipv6(ip);
+    if (!g)
+        return false;
+    const embedded = (hi, lo) => isPublicV4([hi >> 8, hi & 255, lo >> 8, lo & 255]);
+    if (g.slice(0, 5).every((x) => x === 0) && g[5] === 0xffff)
+        return embedded(g[6], g[7]);
+    if ((g[0] & 0xe000) !== 0x2000)
+        return false; // not global unicast
+    if (g[0] === 0x2002)
+        return embedded(g[1], g[2]); // 6to4
+    if (g[0] === 0x2001 && (g[1] === 0 || g[1] === 0xdb8))
+        return false; // Teredo, documentation
+    return true;
+}
+/** The URL's host without the brackets of an IPv6 literal. */
+function bareHost(hostname) {
+    return hostname.replace(/^\[|\]$/g, '');
+}
+/**
+ * The checks that need no lookup: `http:`/`https:` only (`https:` alone under
+ * `httpsOnly`), the scheme's default port only (`url.port === ''`, so an
+ * explicit default port, which the URL parser drops, passes), no userinfo, a
+ * non-empty hostname, a literal IP public unless `allowPrivateNetworks`.
+ * Throws `WebhookUrlRefusedError`; returns the parsed URL.
+ */
+export function checkWebhookUrl(url, policy) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new WebhookUrlRefusedError('malformed');
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
+        throw new WebhookUrlRefusedError('scheme');
+    if (policy.httpsOnly && parsed.protocol !== 'https:')
+        throw new WebhookUrlRefusedError('https_required');
+    if (parsed.username || parsed.password)
+        throw new WebhookUrlRefusedError('userinfo');
+    // The scheme's default port only on the public internet; an operator who
+    // opened private networks addresses services on their own ports (an n8n on
+    // 5678), so the port rule lifts with the address rule.
+    if (parsed.port !== '' && !policy.allowPrivateNetworks)
+        throw new WebhookUrlRefusedError('port');
+    const host = bareHost(parsed.hostname);
+    if (host === '')
+        throw new WebhookUrlRefusedError('malformed');
+    if (isIP(host) && !policy.allowPrivateNetworks && !isPublicAddress(host)) {
+        throw new WebhookUrlRefusedError('private_address');
+    }
+    return parsed;
+}
+/**
+ * The address to connect to, once EVERY address the name resolves to is
+ * public (or the policy opens private networks); an empty resolution is
+ * `unresolvable`. A failing resolver's own error passes through.
+ */
+async function checkedAddress(hostname, policy, lookup) {
+    const host = bareHost(hostname);
+    const family = isIP(host);
+    if (family) {
+        if (!policy.allowPrivateNetworks && !isPublicAddress(host)) {
+            throw new WebhookUrlRefusedError('private_address');
+        }
+        return { address: host, family };
+    }
+    const all = await lookup(host);
+    if (all.length === 0)
+        throw new WebhookUrlRefusedError('unresolvable');
+    if (!policy.allowPrivateNetworks && !all.every((a) => isPublicAddress(a.address))) {
+        throw new WebhookUrlRefusedError('private_address');
+    }
+    return all[0];
+}
+/** The promise, or the signal's reason once it aborts first. */
+function abortable(promise, signal) {
+    if (signal.aborted)
+        return Promise.reject(signal.reason);
+    return new Promise((resolve, reject) => {
+        const onAbort = () => reject(signal.reason);
+        signal.addEventListener('abort', onAbort, { once: true });
+        promise.then((v) => {
+            signal.removeEventListener('abort', onAbort);
+            resolve(v);
+        }, (e) => {
+            signal.removeEventListener('abort', onAbort);
+            reject(e);
+        });
+    });
+}
+/** At most `max` bytes of the body; the rest is never read. */
+async function readCapped(body, max) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of body) {
+        const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        if (size + buf.length >= max) {
+            chunks.push(buf.subarray(0, max - size));
+            break;
+        }
+        chunks.push(buf);
+        size += buf.length;
+    }
+    return Buffer.concat(chunks);
+}
+function nodeTransport(policy, resolve) {
+    return (url, init, signal) => {
+        const lookup = (hostname, options, callback) => {
+            checkedAddress(hostname, policy, resolve).then((first) => {
+                if (options.all)
+                    callback(null, [first]);
+                else
+                    callback(null, first.address, first.family);
+            }, (e) => callback(e, '', 0));
+        };
+        const request = url.protocol === 'https:' ? https.request : http.request;
+        return new Promise((done, fail) => {
+            const req = request(url, { method: init.method, headers: init.headers, lookup, signal, agent: false }, (res) => done({ status: res.statusCode ?? 0, headers: res.headers, body: res }));
+            req.on('error', fail);
+            req.end(init.body);
+        });
+    };
+}
+/**
+ * One POST, no redirect followed (a 3xx comes back as its status), the address
+ * check inside the socket's own lookup (ALL resolved addresses must be public
+ * unless `allowPrivateNetworks`; an empty resolution is `unresolvable`),
+ * `AbortSignal.timeout(timeoutMs)` over the whole call, the response body read
+ * up to `maxResponseBytes` then the stream destroyed. Rejects with
+ * `WebhookUrlRefusedError` on a refused address, with the transport's error
+ * (ECONNREFUSED, the timeout's AbortError…) otherwise. Sets no `user-agent`:
+ * that is the caller's.
+ */
+export async function safePost(url, headers, body, policy, options = {}) {
+    const started = performance.now();
+    const target = checkWebhookUrl(url, policy);
+    const lookup = options.lookup ?? ((host) => dns.lookup(host, { all: true }));
+    const signal = AbortSignal.timeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+    const maxBytes = options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES;
+    const sent = {};
+    for (const [name, value] of Object.entries(headers)) {
+        if (name.toLowerCase() !== 'content-length')
+            sent[name] = value;
+    }
+    sent['content-length'] = String(Buffer.byteLength(body, 'utf8'));
+    const init = { method: 'POST', headers: sent, body };
+    let transport;
+    if (options.transport) {
+        // The test seam: the same check the socket's lookup makes, made first.
+        await abortable(checkedAddress(target.hostname, policy, lookup), signal);
+        transport = options.transport;
+    }
+    else {
+        transport = nodeTransport(policy, lookup);
+    }
+    const res = await abortable(transport(target, init, signal), signal);
+    try {
+        addAbortSignal(signal, res.body);
+        const bytes = await readCapped(res.body, maxBytes);
+        return {
+            status: res.status,
+            bodyText: bytes.toString('utf8'),
+            durationMs: Math.round(performance.now() - started)
+        };
+    }
+    finally {
+        res.body.destroy();
+    }
+}
+//# sourceMappingURL=safe-fetch.js.map

package/dist/webhooks/safe-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-fetch.js","sourceRoot":"","sources":["../../src/webhooks/safe-fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,GAAG,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,EAAE,IAAI,EAAuB,MAAM,UAAU,CAAC;AACrD,OAAO,EAAE,cAAc,EAAiB,MAAM,aAAa,CAAC;AAwB5D,MAAM,gBAAgB,GAAsC;IAC1D,MAAM,EAAE,0CAA0C;IAClD,IAAI,EAAE,oDAAoD;IAC1D,QAAQ,EAAE,0DAA0D;IACpE,eAAe,EAAE,2EAA2E;IAC5F,cAAc,EAAE,iCAAiC;IACjD,YAAY,EAAE,0DAA0D;IACxE,SAAS,EAAE,oCAAoC;CAChD,CAAC;AAEF,gFAAgF;AAChF,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,IAAI,CAAoB;IACjC,YAAY,IAAuB,EAAE,OAAgB;QACnD,KAAK,CAAC,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAgDD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAE1C,gFAAgF;AAEhF,SAAS,IAAI,CAAC,EAAU;IACtB,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/D,CAAC;AAED,SAAS,UAAU,CAAC,CAAW;IAC7B,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC,CAAC,kCAAkC;IACtF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC,CAAC,oBAAoB;IACxE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC,CAAC,yCAAyC;IACnF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC,CAAC,UAAU;IAC7D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,4BAA4B;IAClF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,gBAAgB;IACtE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC,CAAC,UAAU;IACpD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,eAAe;IACtE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC,CAAC,gBAAgB;IACzE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC,CAAC,gBAAgB;IACxE,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,iCAAiC;AACnD,CAAC;AAED,8FAA8F;AAC9F,SAAS,IAAI,CAAC,EAAU;IACtB,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACrB,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;IAC3H,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAS,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IAC9F,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,EAAU;IACxC,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,OAAO,CAAC,KAAK,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;IACnB,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAE,EAAU,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,GAAG,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;IAChG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IAC1F,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC,CAAC,qBAAqB;IACpE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,OAAO;IAC3D,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,wBAAwB;IAC7F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8DAA8D;AAC9D,SAAS,QAAQ,CAAC,QAAgB;IAChC,OAAO,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,MAAuB;IAClE,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAC5G,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IACzG,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ;QAAE,MAAM,IAAI,sBAAsB,CAAC,UAAU,CAAC,CAAC;IACrF,yEAAyE;IACzE,2EAA2E;IAC3E,uDAAuD;IACvD,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB;QAAE,MAAM,IAAI,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACjG,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,IAAI,KAAK,EAAE;QAAE,MAAM,IAAI,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAC/D,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,sBAAsB,CAAC,iBAAiB,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAC3B,QAAgB,EAChB,MAAuB,EACvB,MAAkB;IAElB,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC,MAAM,CAAC,oBAAoB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,sBAAsB,CAAC,iBAAiB,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACnC,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,sBAAsB,CAAC,cAAc,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM,CAAC,oBAAoB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,sBAAsB,CAAC,iBAAiB,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,GAAG,CAAC,CAAC,CAAE,CAAC;AACjB,CAAC;AAED,gEAAgE;AAChE,SAAS,SAAS,CAAI,OAAmB,EAAE,MAAmB;IAC5D,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAe,CAAC,CAAC;IAClE,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAe,CAAC,CAAC;QACrD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CACV,CAAC,CAAC,EAAE,EAAE;YACJ,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO,CAAC,CAAC,CAAC,CAAC;QACb,CAAC,EACD,CAAC,CAAU,EAAE,EAAE;YACb,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,MAAM,CAAC,CAAU,CAAC,CAAC;QACrB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+DAA+D;AAC/D,KAAK,UAAU,UAAU,CAAC,IAAc,EAAE,GAAW;IACnD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAmB,CAAC,CAAC;QAC9E,IAAI,IAAI,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC;YACzC,MAAM;QACR,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,aAAa,CAAC,MAAuB,EAAE,OAAmB;IACjE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;QAC3B,MAAM,MAAM,GAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;YAC7D,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAC5C,CAAC,KAAK,EAAE,EAAE;gBACR,IAAI,OAAO,CAAC,GAAG;oBAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;;oBACpC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACnD,CAAC,EACD,CAAC,CAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,CAA0B,EAAE,EAAE,EAAE,CAAC,CAAC,CAC1D,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;QACzE,OAAO,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;YAChC,MAAM,GAAG,GAAG,OAAO,CACjB,GAAG,EACH,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAC5E,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAChF,CAAC;YACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACtB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,GAAW,EACX,OAA+B,EAC/B,IAAY,EACZ,MAAuB,EACvB,UAA4B,EAAE;IAE9B,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAe,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACzF,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;IAExE,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,gBAAgB;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,MAAe,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAE9D,IAAI,SAAwB,CAAC;IAC7B,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,uEAAuE;QACvE,MAAM,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QACzE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,SAAS,GAAG,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnD,OAAO;YACL,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;YAChC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;SACpD,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;IACrB,CAAC;AACH,CAAC"}