npm - @atproto/pds - Versions diffs - 0.5.6 → 0.5.8 - Mend

@atproto/pds 0.5.6 → 0.5.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (243) hide show

package/dist/lexicons/tools/ozone/report/queryActivities.defs.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"queryActivities.defs.js","sourceRoot":"","sources":["../../../../../src/lexicons/tools/ozone/report/queryActivities.defs.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,cAAc,CAAA;AAChC,OAAO,KAAK,UAAU,MAAM,gBAAgB,CAAA;AAE5C,MAAM,KAAK,GAAG,oCAAoC,CAAA;AAElD,OAAO,EAAE,KAAK,EAAE,CAAA;AAEhB,MAAM,CAAC,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5C,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ;IACrC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAChD;IACD,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ;IACpC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAC/C;IACD,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ;IACrC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAC/C;IACD,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ;IACrC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAC3E;IACD,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ;IAC7B,aAAa,CAAC,CAAC,CAAC,WAAW;IACzB,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EACrD,EAAE,CACH,CACF;IACD,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC3D,CAAC,CAAA;AAIF,MAAM,CAAC,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;IACjD,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK;IAC/B,aAAa,CAAC,CAAC,CAAC,GAAG,CACjB,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAQ,CAC7C,CACF;IACD,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC3D,CAAC,CAAA;AAQF,wJAAwJ;AACxJ,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;AAE3D,OAAO,EAAE,IAAI,EAAE,CAAA;AAEf,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,CAAA","sourcesContent":["/*\n * THIS FILE WAS GENERATED BY \"@atproto/lex\". DO NOT EDIT.\n */\n\nimport { l } from '@atproto/lex'\nimport * as ReportDefs from './defs.defs.js'\n\nconst $nsid = 'tools.ozone.report.queryActivities'\n\nexport { $nsid }\n\nexport const $params = /*#__PURE__*/ l.params({\n activityTypes: /*#__PURE__*/ l.optional(\n /*#__PURE__*/ l.array(/*#__PURE__*/ l.string()),\n ),\n createdAfter: /*#__PURE__*/ l.optional(\n /*#__PURE__*/ l.string({ format: 'datetime' }),\n ),\n createdBefore: /*#__PURE__*/ l.optional(\n /*#__PURE__*/ l.string({ format: 'datetime' }),\n ),\n sortDirection: /*#__PURE__*/ l.optional(\n /*#__PURE__*/ l.withDefault(/*#__PURE__*/ l.enum(['asc', 'desc']), 'desc'),\n ),\n limit: /*#__PURE__*/ l.optional(\n /*#__PURE__*/ l.withDefault(\n /*#__PURE__*/ l.integer({ minimum: 1, maximum: 100 }),\n 50,\n ),\n ),\n cursor: /*#__PURE__*/ l.optional(/*#__PURE__*/ l.string()),\n})\n\nexport type $Params = l.InferOutput<typeof $params>\n\nexport const $output = /*#__PURE__*/ l.jsonPayload({\n activities: /*#__PURE__*/ l.array(\n /*#__PURE__*/ l.ref<ReportDefs.ReportActivityView>(\n (() => ReportDefs.reportActivityView) as any,\n ),\n ),\n cursor: /*#__PURE__*/ l.optional(/*#__PURE__*/ l.string()),\n})\n\nexport type $Output<B = l.BinaryData> = l.InferPayload<typeof $output, B>\nexport type $OutputBody<B = l.BinaryData> = l.InferPayloadBody<\n typeof $output,\n B\n>\n\n/** Query report activities across all reports, ordered by createdAt. Used by downstream pollers; for per-report activity history use listActivities. */\nconst main = /*#__PURE__*/ l.query($nsid, $params, $output)\n\nexport { main }\n\nexport const $lxm = $nsid\n"]}

package/dist/lexicons/tools/ozone/report/queryActivities.js ADDED Viewed

@@ -0,0 +1,6 @@
+/*
+ * THIS FILE WAS GENERATED BY "@atproto/lex". DO NOT EDIT.
+ */
+export * from './queryActivities.defs.js';
+export { main as default } from './queryActivities.defs.js';
+//# sourceMappingURL=queryActivities.js.map

package/dist/lexicons/tools/ozone/report/queryActivities.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"queryActivities.js","sourceRoot":"","sources":["../../../../../src/lexicons/tools/ozone/report/queryActivities.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,cAAc,2BAA2B,CAAA;AACzC,OAAO,EAAE,IAAI,IAAI,OAAO,EAAE,MAAM,2BAA2B,CAAA","sourcesContent":["/*\n * THIS FILE WAS GENERATED BY \"@atproto/lex\". DO NOT EDIT.\n */\n\nexport * from './queryActivities.defs.js'\nexport { main as default } from './queryActivities.defs.js'\n"]}

package/dist/lexicons/tools/ozone/report.d.ts CHANGED Viewed

@@ -5,6 +5,7 @@ export * as getLatestReport from './report/getLatestReport.js';
 export * as getLiveStats from './report/getLiveStats.js';
 export * as getReport from './report/getReport.js';
 export * as listActivities from './report/listActivities.js';
+export * as queryActivities from './report/queryActivities.js';
 export * as queryReports from './report/queryReports.js';
 export * as reassignQueue from './report/reassignQueue.js';
 export * as refreshStats from './report/refreshStats.js';

package/dist/lexicons/tools/ozone/report.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../../../src/lexicons/tools/ozone/report.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,eAAe,MAAM,6BAA6B,CAAA;AAC9D,OAAO,KAAK,cAAc,MAAM,4BAA4B,CAAA;AAC5D,OAAO,KAAK,kBAAkB,MAAM,gCAAgC,CAAA;AACpE,OAAO,KAAK,eAAe,MAAM,6BAA6B,CAAA;AAC9D,OAAO,KAAK,YAAY,MAAM,0BAA0B,CAAA;AACxD,OAAO,KAAK,SAAS,MAAM,uBAAuB,CAAA;AAClD,OAAO,KAAK,cAAc,MAAM,4BAA4B,CAAA;AAC5D,OAAO,KAAK,YAAY,MAAM,0BAA0B,CAAA;AACxD,OAAO,KAAK,aAAa,MAAM,2BAA2B,CAAA;AAC1D,OAAO,KAAK,YAAY,MAAM,0BAA0B,CAAA;AACxD,OAAO,KAAK,iBAAiB,MAAM,+BAA+B,CAAA;AAClE,OAAO,KAAK,cAAc,MAAM,4BAA4B,CAAA;AAC5D,OAAO,KAAK,IAAI,MAAM,kBAAkB,CAAA"}
1	+ {"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../../../src/lexicons/tools/ozone/report.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,eAAe,MAAM,6BAA6B,CAAA;AAC9D,OAAO,KAAK,cAAc,MAAM,4BAA4B,CAAA;AAC5D,OAAO,KAAK,kBAAkB,MAAM,gCAAgC,CAAA;AACpE,OAAO,KAAK,eAAe,MAAM,6BAA6B,CAAA;AAC9D,OAAO,KAAK,YAAY,MAAM,0BAA0B,CAAA;AACxD,OAAO,KAAK,SAAS,MAAM,uBAAuB,CAAA;AAClD,OAAO,KAAK,cAAc,MAAM,4BAA4B,CAAA;AAC5D,OAAO,KAAK,eAAe,MAAM,6BAA6B,CAAA;AAC9D,OAAO,KAAK,YAAY,MAAM,0BAA0B,CAAA;AACxD,OAAO,KAAK,aAAa,MAAM,2BAA2B,CAAA;AAC1D,OAAO,KAAK,YAAY,MAAM,0BAA0B,CAAA;AACxD,OAAO,KAAK,iBAAiB,MAAM,+BAA+B,CAAA;AAClE,OAAO,KAAK,cAAc,MAAM,4BAA4B,CAAA;AAC5D,OAAO,KAAK,IAAI,MAAM,kBAAkB,CAAA"}

package/dist/lexicons/tools/ozone/report.js CHANGED Viewed

@@ -8,6 +8,7 @@ export * as getLatestReport from './report/getLatestReport.js';
 export * as getLiveStats from './report/getLiveStats.js';
 export * as getReport from './report/getReport.js';
 export * as listActivities from './report/listActivities.js';
+export * as queryActivities from './report/queryActivities.js';
 export * as queryReports from './report/queryReports.js';
 export * as reassignQueue from './report/reassignQueue.js';
 export * as refreshStats from './report/refreshStats.js';

package/dist/lexicons/tools/ozone/report.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"report.js","sourceRoot":"","sources":["../../../../src/lexicons/tools/ozone/report.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,eAAe,MAAM,6BAA6B,CAAA;AAC9D,OAAO,KAAK,cAAc,MAAM,4BAA4B,CAAA;AAC5D,OAAO,KAAK,kBAAkB,MAAM,gCAAgC,CAAA;AACpE,OAAO,KAAK,eAAe,MAAM,6BAA6B,CAAA;AAC9D,OAAO,KAAK,YAAY,MAAM,0BAA0B,CAAA;AACxD,OAAO,KAAK,SAAS,MAAM,uBAAuB,CAAA;AAClD,OAAO,KAAK,cAAc,MAAM,4BAA4B,CAAA;AAC5D,OAAO,KAAK,YAAY,MAAM,0BAA0B,CAAA;AACxD,OAAO,KAAK,aAAa,MAAM,2BAA2B,CAAA;AAC1D,OAAO,KAAK,YAAY,MAAM,0BAA0B,CAAA;AACxD,OAAO,KAAK,iBAAiB,MAAM,+BAA+B,CAAA;AAClE,OAAO,KAAK,cAAc,MAAM,4BAA4B,CAAA;AAC5D,OAAO,KAAK,IAAI,MAAM,kBAAkB,CAAA","sourcesContent":["/\n THIS FILE WAS GENERATED BY \"@atproto/lex\". DO NOT EDIT.\n /\n\nexport as assignModerator from './report/assignModerator.js'\nexport * as getAssignments from './report/getAssignments.js'\nexport * as getHistoricalStats from './report/getHistoricalStats.js'\nexport * as getLatestReport from './report/getLatestReport.js'\nexport * as getLiveStats from './report/getLiveStats.js'\nexport * as getReport from './report/getReport.js'\nexport * as listActivities from './report/listActivities.js'\nexport * as queryReports from './report/queryReports.js'\nexport * as reassignQueue from './report/reassignQueue.js'\nexport * as refreshStats from './report/refreshStats.js'\nexport * as unassignModerator from './report/unassignModerator.js'\nexport * as createActivity from './report/createActivity.js'\nexport * as defs from './report/defs.js'\n"]}
1	+ {"version":3,"file":"report.js","sourceRoot":"","sources":["../../../../src/lexicons/tools/ozone/report.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,eAAe,MAAM,6BAA6B,CAAA;AAC9D,OAAO,KAAK,cAAc,MAAM,4BAA4B,CAAA;AAC5D,OAAO,KAAK,kBAAkB,MAAM,gCAAgC,CAAA;AACpE,OAAO,KAAK,eAAe,MAAM,6BAA6B,CAAA;AAC9D,OAAO,KAAK,YAAY,MAAM,0BAA0B,CAAA;AACxD,OAAO,KAAK,SAAS,MAAM,uBAAuB,CAAA;AAClD,OAAO,KAAK,cAAc,MAAM,4BAA4B,CAAA;AAC5D,OAAO,KAAK,eAAe,MAAM,6BAA6B,CAAA;AAC9D,OAAO,KAAK,YAAY,MAAM,0BAA0B,CAAA;AACxD,OAAO,KAAK,aAAa,MAAM,2BAA2B,CAAA;AAC1D,OAAO,KAAK,YAAY,MAAM,0BAA0B,CAAA;AACxD,OAAO,KAAK,iBAAiB,MAAM,+BAA+B,CAAA;AAClE,OAAO,KAAK,cAAc,MAAM,4BAA4B,CAAA;AAC5D,OAAO,KAAK,IAAI,MAAM,kBAAkB,CAAA","sourcesContent":["/\n THIS FILE WAS GENERATED BY \"@atproto/lex\". DO NOT EDIT.\n /\n\nexport as assignModerator from './report/assignModerator.js'\nexport * as getAssignments from './report/getAssignments.js'\nexport * as getHistoricalStats from './report/getHistoricalStats.js'\nexport * as getLatestReport from './report/getLatestReport.js'\nexport * as getLiveStats from './report/getLiveStats.js'\nexport * as getReport from './report/getReport.js'\nexport * as listActivities from './report/listActivities.js'\nexport * as queryActivities from './report/queryActivities.js'\nexport * as queryReports from './report/queryReports.js'\nexport * as reassignQueue from './report/reassignQueue.js'\nexport * as refreshStats from './report/refreshStats.js'\nexport * as unassignModerator from './report/unassignModerator.js'\nexport * as createActivity from './report/createActivity.js'\nexport * as defs from './report/defs.js'\n"]}

package/dist/pipethrough.d.ts CHANGED Viewed

@@ -1,8 +1,11 @@
 import { IncomingHttpHeaders } from 'node:http';
 import { Readable } from 'node:stream';
 import { Request } from 'express';
+import { Dispatcher } from 'undici';
 import { CatchallHandler, HandlerPipeThroughBuffer, HandlerPipeThroughStream, XRPCError as XRPCServerError } from '@atproto/xrpc-server';
+import { ProxyConfig } from './config/config.js';
 import { AppContext } from './context.js';
+export declare function buildProxyAgent(cfg: ProxyConfig): Dispatcher;
 export declare const proxyHandler: (ctx: AppContext) => CatchallHandler;
 export type PipethroughOptions = {
     /**

package/dist/pipethrough.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"pipethrough.d.ts","sourceRoot":"","sources":["../src/pipethrough.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAkB,MAAM,WAAW,CAAA;AAC/D,OAAO,EAAe,QAAQ,EAAY,MAAM,aAAa,CAAA;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;~~AASjC~~,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,wBAAwB,EAIxB,SAAS,IAAI,eAAe,EAG7B,MAAM,sBAAsB,CAAA;~~AAG7B~~,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAIzC,eAAO,MAAM,YAAY,QAAS,UAAU,KAAG,eAiG9C,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;IAEZ;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;IAEZ;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,CAAA;AAED,wBAAsB,WAAW,CAC/B,GAAG,EAAE,UAAU,EACf,GAAG,EAAE,OAAO,EACZ,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CACR,wBAAwB,GAAG;IACzB,MAAM,EAAE,QAAQ,CAAA;IAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,QAAQ,EAAE,MAAM,CAAA;CACjB,CACF,CAsDA;AAKD,wBAAgB,cAAc,CAC5B,GAAG,EAAE,UAAU,EACf,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,MAAM,GACV,MAAM,CAUR;AAID,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,wBAAsB,cAAc,CAClC,GAAG,EAAE,UAAU,EACf,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAU1D;AAED,eAAO,MAAM,gBAAgB,QAEtB,IAAI,CAAC,UAAU,EAAE,KAAK,GAAG,YAAY,CAAC,WAClC,MAAM,KACd,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CA6CzD,CAAA;AAoGD,wBAAgB,iBAAiB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAG3E;AAkED,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,wBAAwB,CAAC,CASnC;AA2CD;;;GAGG;AACH,qBAAa,MAAM;IACjB,OAAO,CAAC,KAAK,CAAa;IAC1B,OAAO,CAAC,QAAQ,CAAkB;IAClC,YAAY,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,EAGlC;IACD,GAAG,CAAC,GAAG,EAAE,MAAM,WAEd;IACA,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,CAErC;CACF;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,UAEvC;AAED,eAAO,MAAM,iBAAiB,QAe5B,CAAA;AAEF,eAAO,MAAM,kBAAkB,QAG7B,CAAA;AAKF,eAAO,MAAM,iBAAiB,QAiB5B,CAAA;AA8DF,qBAAa,wBAAyB,SAAQ,eAAe;IAEzD,QAAQ,CAAC,QAAQ,EAAE;QACjB,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,EAAE,mBAAmB,CAAA;KAC7B;IAJH,YACW,QAAQ,EAAE;QACjB,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,EAAE,mBAAmB,CAAA;KAC7B,EACD,OAAO,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,EAC7C,OAAO,CAAC,EAAE,YAAY,EAQvB;IAED,IAAI,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEpC;IAED,IAAI,KAAK,uBAER;CACF"}
1	+ {"version":3,"file":"pipethrough.d.ts","sourceRoot":"","sources":["../src/pipethrough.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAkB,MAAM,WAAW,CAAA;AAC/D,OAAO,EAAe,QAAQ,EAAY,MAAM,aAAa,CAAA;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAS,UAAU,EAAsB,MAAM,QAAQ,CAAA;AAQ9D,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,wBAAwB,EAIxB,SAAS,IAAI,eAAe,EAG7B,MAAM,sBAAsB,CAAA;AAI7B,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAIzC,wBAAgB,eAAe,CAAC,GAAG,EAAE,WAAW,GAAG,UAAU,CAiC5D;AAED,eAAO,MAAM,YAAY,QAAS,UAAU,KAAG,eAiG9C,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;IAEZ;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;IAEZ;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,CAAA;AAED,wBAAsB,WAAW,CAC/B,GAAG,EAAE,UAAU,EACf,GAAG,EAAE,OAAO,EACZ,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CACR,wBAAwB,GAAG;IACzB,MAAM,EAAE,QAAQ,CAAA;IAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,QAAQ,EAAE,MAAM,CAAA;CACjB,CACF,CAsDA;AAKD,wBAAgB,cAAc,CAC5B,GAAG,EAAE,UAAU,EACf,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,MAAM,GACV,MAAM,CAUR;AAID,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,wBAAsB,cAAc,CAClC,GAAG,EAAE,UAAU,EACf,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAU1D;AAED,eAAO,MAAM,gBAAgB,QAEtB,IAAI,CAAC,UAAU,EAAE,KAAK,GAAG,YAAY,CAAC,WAClC,MAAM,KACd,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CA6CzD,CAAA;AAoGD,wBAAgB,iBAAiB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAG3E;AAkED,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,wBAAwB,CAAC,CASnC;AA2CD;;;GAGG;AACH,qBAAa,MAAM;IACjB,OAAO,CAAC,KAAK,CAAa;IAC1B,OAAO,CAAC,QAAQ,CAAkB;IAClC,YAAY,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,EAGlC;IACD,GAAG,CAAC,GAAG,EAAE,MAAM,WAEd;IACA,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,CAErC;CACF;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,UAEvC;AAED,eAAO,MAAM,iBAAiB,QAe5B,CAAA;AAEF,eAAO,MAAM,kBAAkB,QAG7B,CAAA;AAKF,eAAO,MAAM,iBAAiB,QAiB5B,CAAA;AA8DF,qBAAa,wBAAyB,SAAQ,eAAe;IAEzD,QAAQ,CAAC,QAAQ,EAAE;QACjB,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,EAAE,mBAAmB,CAAA;KAC7B;IAJH,YACW,QAAQ,EAAE;QACjB,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,EAAE,mBAAmB,CAAA;KAC7B,EACD,OAAO,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,EAC7C,OAAO,CAAC,EAAE,YAAY,EAQvB;IAED,IAAI,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEpC;IAED,IAAI,KAAK,uBAER;CACF"}

package/dist/pipethrough.js CHANGED Viewed

@@ -1,10 +1,42 @@
 import { PassThrough, finished } from 'node:stream';
+import { Agent, Pool, interceptors } from 'undici';
 import { decodeStream, getServiceEndpoint, omit, streamToNodeBuffer, } from '@atproto/common';
 import { InternalServerError, InvalidRequestError, ResponseType, XRPCError as XRPCServerError, excludeErrorResult, parseReqNsid, } from '@atproto/xrpc-server';
+import { isUnicastIp, unicastLookup } from '@atproto-labs/fetch-node';
 import { buildProxiedContentEncoding } from '@atproto-labs/xrpc-utils';
 import { isAccessPrivileged } from './auth-scope.js';
 import { chat, com, tools } from './lexicons/index.js';
 import { httpLogger } from './logger.js';
+export function buildProxyAgent(cfg) {
+    const agent = new Agent({
+        allowH2: cfg.allowHTTP2,
+        headersTimeout: cfg.headersTimeout,
+        maxResponseSize: cfg.maxResponseSize,
+        bodyTimeout: cfg.bodyTimeout,
+        factory: cfg.disableSsrfProtection
+            ? undefined
+            : (origin, opts) => {
+                const { protocol, hostname } = origin instanceof URL ? origin : new URL(origin);
+                if (protocol !== 'https:') {
+                    throw new Error(`Forbidden protocol "${protocol}"`);
+                }
+                if (isUnicastIp(hostname) === false) {
+                    throw new Error('Hostname resolved to non-unicast address');
+                }
+                return new Pool(origin, opts);
+            },
+        connect: {
+            lookup: cfg.disableSsrfProtection ? undefined : unicastLookup,
+        },
+    });
+    return agent.compose(cfg.maxRetries > 0
+        ? interceptors.retry({
+            statusCodes: [], // Only retry on socket errors
+            methods: ['GET', 'HEAD'],
+            maxRetries: cfg.maxRetries,
+        })
+        : (dispatch) => dispatch);
+}
 export const proxyHandler = (ctx) => {
     const performAuth = ctx.authVerifier.authorization({
         authorize: (permissions, { params }) => permissions.assertRpc(params),

package/dist/pipethrough.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"pipethrough.js","sourceRoot":"","sources":["../src/pipethrough.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAY,QAAQ,EAAE,MAAM,aAAa,CAAA;AAG7D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,IAAI,EACJ,kBAAkB,GACnB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EAIL,mBAAmB,EACnB,mBAAmB,EACnB,YAAY,EACZ,SAAS,IAAI,eAAe,EAC5B,kBAAkB,EAClB,YAAY,GACb,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAA;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAEpD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAe,EAAmB,EAAE;IAC/D,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,aAAa,CAAqB;QACrE,SAAS,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC;KACtE,CAAC,CAAA;IAEF,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9B,eAAe;QACf,IAAI,CAAC;YACH,IACE,GAAG,CAAC,MAAM,KAAK,KAAK;gBACpB,GAAG,CAAC,MAAM,KAAK,MAAM;gBACrB,GAAG,CAAC,MAAM,KAAK,MAAM,EACrB,CAAC;gBACD,MAAM,IAAI,eAAe,CACvB,YAAY,CAAC,cAAc,EAC3B,0CAA0C,CAC3C,CAAA;YACH,CAAC;YAED,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;YACpD,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnC,qDAAqD;gBACrD,MAAM,IAAI,mBAAmB,CAAC,8BAA8B,CAAC,CAAA;YAC/D,CAAC;YAED,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;YAC7B,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;YACnE,CAAC;YAED,MAAM,EACJ,GAAG,EAAE,MAAM,EACX,GAAG,EACH,SAAS,GACV,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YACvC,qEAAqE;YACrE,oEAAoE;YACpE,iEAAiE;YACjE,8BAA8B;YAC9B,MAAM,QAAQ,GAAG,GAAG,GAAG,IAAI,SAAS,EAAE,CAAA;YACtC,MAAM,QAAQ,GAAG,GAAG,CAAA;YAEpB,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC;gBACnC,GAAG;gBACH,GAAG;gBACH,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE;aAC/B,CAAC,CAAA;YAEF,MAAM,EAAE,WAAW,EAAE,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAA;YAEtD,IACE,WAAW,CAAC,IAAI,KAAK,QAAQ;gBAC7B,CAAC,kBAAkB,CAAC,WAAW,CAAC,KAAK,CAAC;gBACtC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,EAC3B,CAAC;gBACD,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;YACnE,CAAC;YAED,MAAM,OAAO,GAAwB;gBACnC,iBAAiB,EAAE,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,UAAU;gBAC/D,iBAAiB,EAAE,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC;gBACjD,yBAAyB,EAAE,GAAG,CAAC,OAAO,CAAC,yBAAyB,CAAC;gBACjE,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC;gBAE7C,cAAc,EAAE,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC;gBACnD,kBAAkB,EAAE,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC;gBAC3D,gBAAgB,EAAE,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC;gBAEvD,aAAa,EAAE,UAAU,MAAM,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE;aACpF,CAAA;YAED,MAAM,eAAe,GAA8B;gBACjD,MAAM;gBACN,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,GAAG,CAAC,WAAW;gBACrB,IAAI;gBACJ,OAAO;aACR,CAAA;YAED,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,QAAQ,EAAE,EAAE;gBAC9D,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;gBAE/B,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC5D,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;gBAC1B,CAAC;gBAED,uEAAuE;gBACvE,wEAAwE;gBACxE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAA;gBAEjC,sEAAsE;gBACtE,OAAO,GAAG,CAAA;YACZ,CAAC,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAA;QACX,CAAC;IACH,CAAC,CAAA;AACH,CAAC,CAAA;AAsBD,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAe,EACf,GAAY,EACZ,OAA4B;IAQ5B,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAClD,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,sEAAsE;QACtE,iEAAiE;QACjE,eAAe;QACf,MAAM,IAAI,mBAAmB,CAC3B,eAAe,GAAG,CAAC,MAAM,4BAA4B,CACtD,CAAA;IACH,CAAC;IAED,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;IAE7B,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IAErE,MAAM,eAAe,GAA8B;QACjD,MAAM;QACN,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,GAAG,CAAC,WAAW;QACrB,OAAO,EAAE;YACP,iBAAiB,EAAE,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC;YACjD,yBAAyB,EAAE,GAAG,CAAC,OAAO,CAAC,yBAAyB,CAAC;YACjE,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC;YAE7C,mEAAmE;YACnE,uEAAuE;YACvE,0EAA0E;YAC1E,wEAAwE;YACxE,kEAAkE;YAClE,iBAAiB,EAAE,2BAA2B,CAC5C,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAC9B,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAC/B;YAED,aAAa,EAAE,OAAO,EAAE,GAAG;gBACzB,CAAC,CAAC,UAAU,MAAM,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE;gBAC3F,CAAC,CAAC,SAAS;SACd;QAED,mEAAmE;QACnE,uEAAuE;QACvE,gDAAgD;QAChD,aAAa,EAAE,CAAC,GAAG,KAAK,EAAE,4BAA4B;KACvD,CAAA;IAED,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,CAAA;IAE7E,OAAO;QACL,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,IAAI,kBAAkB;QACnE,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,EAAE,IAAI;KACb,CAAA;AACH,CAAC;AAED,2BAA2B;AAC3B,sBAAsB;AAEtB,MAAM,UAAU,cAAc,CAC5B,GAAe,EACf,GAAY,EACZ,GAAW;IAEX,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;IACjD,IAAI,aAAa;QAAE,OAAO,aAAa,CAAA;IAEvC,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IACxC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI,OAAO,CAAC,SAAS,EAAE,CAAA;IAC1D,CAAC;IAED,MAAM,IAAI,mBAAmB,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAA;AACnE,CAAC;AAED,yEAAyE;AACzE,qCAAqC;AACrC,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACtC,OAAO,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAe,EACf,GAAY,EACZ,GAAW;IAEX,eAAe;IAEf,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;IACjD,IAAI,aAAa;QAAE,OAAO,gBAAgB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;IAE9D,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAC3D,IAAI,WAAW;QAAE,OAAO,EAAE,GAAG,WAAW,EAAE,SAAS,EAAE,CAAA;IAErD,MAAM,IAAI,mBAAmB,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAA;AACnE,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK;AACnC,kDAAkD;AAClD,GAA2C,EAC3C,OAAe,EAC2C,EAAE;IAC5D,eAAe;IAEf,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAEtC,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,mBAAmB,CAAC,kCAAkC,CAAC,CAAA;IACnE,CAAC;IAED,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,SAAS,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,mBAAmB,CAAC,yCAAyC,CAAC,CAAA;IAC1E,CAAC;IAED,qBAAqB;IACrB,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,mBAAmB,CAAC,6BAA6B,CAAC,CAAA;IAC9D,CAAC;IAED,mBAAmB;IACnB,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,CAAC,CAAA;IACrE,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAA;IAE9C,sFAAsF;IACtF,IACE,GAAG,CAAC,GAAG,CAAC,WAAW;QACnB,OAAO,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,eAAe,EACrD,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,EAAE,CAAA;IACzD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,mBAAmB,CAAC,6BAA6B,CAAC,CAAA;IAC9D,CAAC;IAED,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,SAAS,EAAE,EAAE,CAAC,CAAA;IAC/D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,mBAAmB,CAAC,yCAAyC,CAAC,CAAA;IAC1E,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAA;AAChC,CAAC,CAAA;AAED;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAC9B,GAAe,EACf,GAAY,EACZ,eAA0C,EAC1C,oBAA8C;IAE9C,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,KAAK,GAAG,CAAC,UAAU;aAChB,MAAM,CAAC,eAAe,EAAE,CAAC,QAAQ,EAAE,EAAE;YACpC,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;gBAC/B,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAA;gBAErC,KAAK,eAAe,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;oBAClE,MAAM,SAAS,GAAG,IAAI,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE;wBAC/D,KAAK,EAAE,eAAe;qBACvB,CAAC,CAAA;oBAEF,MAAM,CAAC,SAAS,CAAC,CAAA;gBACnB,CAAC,EAAE,MAAM,CAAC,CAAA;gBAEV,OAAO,WAAW,CAAA;YACpB,CAAC;YAED,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAA;YAE/C,oEAAoE;YACpE,uEAAuE;YACvE,wEAAwE;YACxE,mEAAmE;YACnE,sEAAsE;YACtE,0CAA0C;YAC1C,OAAO,EAAE,CAAA;YAET,OAAO,QAAQ,CAAA;QACjB,CAAC,CAAC;YACF,yEAAyE;YACzE,0EAA0E;YAC1E,yEAAyE;YACzE,sEAAsE;aACrE,KAAK,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;aAC3C,KAAK,CAAC,MAAM,CAAC,CAAA;IAClB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,kBAAkB,CAC/B,GAAe,EACf,GAAY,EACZ,eAA0C;IAE1C,4EAA4E;IAC5E,uDAAuD;IAEvD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,UAAU;SAClC,OAAO,CAAC,eAAe,CAAC;SACxB,KAAK,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IAE9C,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;QAErE,MAAM,IAAI,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE;YACnD,KAAK,EAAE,eAAe;SACvB,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,0BAA0B,CAEjC,GAAY,EACZ,OAAO,GAAG,8BAA8B;IAExC,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAA;IAC9D,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,OAAO,CAAC,CAAA;IAC9B,MAAM,IAAI,eAAe,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE;QAC1E,KAAK,EAAE,GAAG;KACX,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAY;IAGrC,OAAO,OAAQ,GAAqB,CAAC,GAAG,EAAE,KAAK,KAAK,UAAU,CAAA;AAChE,CAAC;AAED,6BAA6B;AAC7B,sBAAsB;AAEtB,MAAM,UAAU,iBAAiB,CAAC,WAAoB;IACpD,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAA;IAClC,OAAO,8BAA8B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;AACzD,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAA4B,EAC5B,QAAkB;IAElB,IAAI,iBAAiB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;QACzD,2EAA2E;QAC3E,kBAAkB;QAElB,yEAAyE;QACzE,wEAAwE;QACxE,4EAA4E;QAC5E,uEAAuE;QACvE,8DAA8D;QAE9D,qEAAqE;QACrE,4EAA4E;QAC5E,kDAAkD;QAElD,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE;YACzB,QAAQ,CAAC,OAAO,EAAE,CAAA;QACpB,CAAC,EAAE,GAAG,CAAC,CAAA;QACP,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;YAC1B,YAAY,CAAC,EAAE,CAAC,CAAA;QAClB,CAAC,CAAC,CAAA;QACF,QAAQ,CAAC,MAAM,EAAE,CAAA;QAEjB,OAAO,EAAE,CAAA;IACX,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,sBAAsB,CACzC,QAAQ,EACR,OAAO,CAAC,kBAAkB,CAAC,CAC5B,CAAA;QAED,MAAM,OAAO,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;QAC5D,OAAO;YACL,KAAK,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;YACrC,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;SAC1C,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wDAAwD;QACxD,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,QAAkB,EAClB,eAAmC;IAEnC,IAAI,CAAC;QACH,OAAO,MAAM,kBAAkB,CAAC,YAAY,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAA;IAC1E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,QAAQ,CAAC,SAAS;YAAE,QAAQ,CAAC,OAAO,EAAE,CAAA;QAE3C,MAAM,IAAI,eAAe,CACvB,YAAY,CAAC,eAAe,EAC5B,GAAG,YAAY,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,+BAA+B,EACxE,SAAS,EACT,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAA+B;IAE/B,OAAO;QACL,MAAM,EAAE,MAAM,sBAAsB,CAClC,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,OAAO,EAAE,CAAC,kBAAkB,CAAC,CACpC;QACD,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC;QACpE,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAA;AACH,CAAC;AAED,8BAA8B;AAC9B,sBAAsB;AAEtB,MAAM,sBAAsB,GAAG;IAC7B,kBAAkB;IAClB,0BAA0B;IAC1B,aAAa;CACd,CAAA;AAED,QAAQ,CAAC,CAAC,eAAe,CACvB,OAA4B,EAC5B,qBAAqB,GAAG,IAAI;IAE5B,IAAI,qBAAqB,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;QACxC,IAAI,MAAM;YAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAA;QAE5C,MAAM,QAAQ,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;QAC5C,IAAI,QAAQ;YAAE,MAAM,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAA;QAElD,MAAM,IAAI,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;QACpC,IAAI,IAAI;YAAE,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,CAAA;QAEtC,MAAM,QAAQ,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;QAC5C,IAAI,QAAQ;YAAE,MAAM,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAA;IACpD,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAAA;QACtC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QAEzB,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;YAChB,MAAM,KAAK,GAAW,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;YAC9D,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;AACH,CAAC;AAED,QAAQ;AACR,sBAAsB;AAEtB;;;GAGG;AACH,MAAM,OAAO,MAAM;IAGjB,YAAY,KAAuB;QACjC,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAA;QACrD,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAA;IACvB,CAAC;IACD,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;IAC1C,CAAC;IACD,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;QAChB,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAA;IACtB,CAAC;CACF;AAED,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,GAAG,CAAC,WAAW,EAAE,CAAA;AAC1B,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAAC;IAC1C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI;IAClC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI;IACtC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI;IACzC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI;IAC7B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI;IACvC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI;IAC3B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI;IAChC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI;IAC/B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI;IAC/B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI;IAC9B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI;IAChC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI;IACrC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI;IAChC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI;CAChC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,MAAM,CAAC;IAC3C,GAAG,iBAAiB;IACpB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;CACtC,CAAC,CAAA;AAEF,+EAA+E;AAC/E,8EAA8E;AAC9E,8BAA8B;AAC9B,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAAC;IAC1C,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI;IAChC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAC,IAAI;IACtD,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI;IAC1C,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI;IACtC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI;IACvC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI;IACpC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI;IACzC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI;IACzC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,IAAI;IAC7C,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI;IAClC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI;IACxC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,IAAI;IAC5C,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,wBAAwB,CAAC,IAAI;IAChD,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI;IAC1C,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI;IACzC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI;CACpC,CAAC,CAAA;AAEF,MAAM,cAAc,GAAG,CACrB,GAAe,EACf,IAAY,EAIZ,EAAE;IACF,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,IAAI,CAAC;QACnD,KAAK,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,IAAI,CAAC;QACnD,KAAK,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC;QAClD,KAAK,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,IAAI,CAAC;QACnD,KAAK,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,sBAAsB,CAAC,IAAI,CAAC;QACxD,KAAK,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC;QAC3C,KAAK,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC;QACpD,KAAK,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC1C,KAAK,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC;QAC3C,KAAK,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;QACzC,KAAK,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,oBAAoB,CAAC,IAAI,CAAC;QACtD,KAAK,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC;QAC7C,KAAK,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC;QAC/C,KAAK,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC;QAChD,KAAK,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC;QAC7C,KAAK,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;QACvC,KAAK,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC;QAC3C,KAAK,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1C,KAAK,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1C,KAAK,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1C,KAAK,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QACrC,KAAK,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;QACxC,KAAK,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;QACvC,KAAK,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;QACxC,KAAK,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,kBAAkB,CAAC,IAAI,CAAC;QACtD,KAAK,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,iBAAiB,CAAC,IAAI,CAAC;QACrD,KAAK,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,mBAAmB,CAAC,IAAI;YACpD,OAAO;gBACL,SAAS,EAAE,iBAAiB;gBAC5B,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,UAAU;aAChC,CAAA;QACH,KAAK,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI;YAC3C,OAAO;gBACL,SAAS,EAAE,iBAAiB;gBAC5B,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,aAAa;aACnC,CAAA;QACH;YACE,OAAO;gBACL,SAAS,EAAE,cAAc;gBACzB,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,WAAW;aACjC,CAAA;IACL,CAAC;AACH,CAAC,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,GAAY,EAAsB,EAAE;IACtD,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;AAClD,CAAC,CAAA;AAED,SAAS,gBAAgB,CAAuB,GAAY;IAC1D,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,oCAAoC,CAAC,CAAA;AAChE,CAAC;AAED,MAAM,OAAO,wBAAyB,SAAQ,eAAe;IAC3D,YACW,QAGR,EACD,OAA6C,EAC7C,OAAsB;QAEtB,MAAM,MAAM,GACV,QAAQ,CAAC,UAAU,KAAK,GAAG;YACzB,CAAC,CAAC,YAAY,CAAC,eAAe;YAC9B,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAA;QAEzB,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;wBAZ7C,QAAQ;IAanB,CAAC;IAED,IAAI,OAAO;QACT,OAAO,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;IAC1E,CAAC;IAED,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,QAAQ,CAAA;IAC9C,CAAC;CACF","sourcesContent":["import { IncomingHttpHeaders, ServerResponse } from 'node:http'\nimport { PassThrough, Readable, finished } from 'node:stream'\nimport { Request } from 'express'\nimport { Dispatcher } from 'undici'\nimport {\n decodeStream,\n getServiceEndpoint,\n omit,\n streamToNodeBuffer,\n} from '@atproto/common'\nimport { RpcPermissionMatch } from '@atproto/oauth-scopes'\nimport {\n CatchallHandler,\n HandlerPipeThroughBuffer,\n HandlerPipeThroughStream,\n InternalServerError,\n InvalidRequestError,\n ResponseType,\n XRPCError as XRPCServerError,\n excludeErrorResult,\n parseReqNsid,\n} from '@atproto/xrpc-server'\nimport { buildProxiedContentEncoding } from '@atproto-labs/xrpc-utils'\nimport { isAccessPrivileged } from './auth-scope.js'\nimport { AppContext } from './context.js'\nimport { chat, com, tools } from './lexicons/index.js'\nimport { httpLogger } from './logger.js'\n\nexport const proxyHandler = (ctx: AppContext): CatchallHandler => {\n const performAuth = ctx.authVerifier.authorization<RpcPermissionMatch>({\n authorize: (permissions, { params }) => permissions.assertRpc(params),\n })\n\n return async (req, res, next) => {\n // /!\\ Hot path\n try {\n if (\n req.method !== 'GET' &&\n req.method !== 'HEAD' &&\n req.method !== 'POST'\n ) {\n throw new XRPCServerError(\n ResponseType.InvalidRequest,\n 'XRPC requests only supports GET and POST',\n )\n }\n\n const body = req.method === 'POST' ? req : undefined\n if (body != null && !body.readable) {\n // Body was already consumed by a previous middleware\n throw new InternalServerError('Request body is not readable')\n }\n\n const lxm = parseReqNsid(req)\n if (PROTECTED_METHODS.has(lxm)) {\n throw new InvalidRequestError('Bad token method', 'InvalidToken')\n }\n\n const {\n url: origin,\n did,\n serviceId,\n } = await parseProxyInfo(ctx, req, lxm)\n // Phase 1 of service auth updates: the scope check sees the combined\n // did#serviceId form (so OAuth callers' rpc:?aud=did#service scopes\n // match), while the outbound service-auth JWT keeps bare-DID aud\n // regardless of session type.\n const scopeAud = `${did}#${serviceId}`\n const tokenAud = did\n\n const authResult = await performAuth({\n req,\n res,\n params: { lxm, aud: scopeAud },\n })\n\n const { credentials } = excludeErrorResult(authResult)\n\n if (\n credentials.type === 'access' &&\n !isAccessPrivileged(credentials.scope) &&\n PRIVILEGED_METHODS.has(lxm)\n ) {\n throw new InvalidRequestError('Bad token method', 'InvalidToken')\n }\n\n const headers: IncomingHttpHeaders = {\n 'accept-encoding': req.headers['accept-encoding'] \|\| 'identity',\n 'accept-language': req.headers['accept-language'],\n 'atproto-accept-labelers': req.headers['atproto-accept-labelers'],\n 'x-bsky-topics': req.headers['x-bsky-topics'],\n\n 'content-type': body && req.headers['content-type'],\n 'content-encoding': body && req.headers['content-encoding'],\n 'content-length': body && req.headers['content-length'],\n\n authorization: `Bearer ${await ctx.serviceAuthJwt(credentials.did, tokenAud, lxm)}`,\n }\n\n const dispatchOptions: Dispatcher.RequestOptions = {\n origin,\n method: req.method,\n path: req.originalUrl,\n body,\n headers,\n }\n\n await pipethroughStream(ctx, req, dispatchOptions, (upstream) => {\n res.status(upstream.statusCode)\n\n for (const [name, val] of responseHeaders(upstream.headers)) {\n res.setHeader(name, val)\n }\n\n // Note that we should not need to manually handle errors here (e.g. by\n // destroying the response), as the http server will handle them for us.\n res.on('error', logResponseError)\n\n // Tell undici to write the upstream response directly to the response\n return res\n })\n } catch (err) {\n next(err)\n }\n }\n}\n\nexport type PipethroughOptions = {\n /*\n Specify the issuer (requester) for service auth. If not provided, no\n * authorization headers will be added to the request.\n /\n iss?: string\n\n /\n Override the audience for service auth. If not provided, the audience will\n * be determined based on the proxy service.\n /\n aud?: string\n\n /\n Override the lexicon method for service auth. If not provided, the lexicon\n * method will be determined based on the request path.\n /\n lxm?: string\n}\n\nexport async function pipethrough(\n ctx: AppContext,\n req: Request,\n options?: PipethroughOptions,\n): Promise<\n HandlerPipeThroughStream & {\n stream: Readable\n headers: Record<string, string>\n encoding: string\n }\n> {\n if (req.method !== 'GET' && req.method !== 'HEAD') {\n // pipethrough() is used from within xrpcServer handlers, which means that\n // the request body either has been parsed or is a readable stream that has\n // been piped for decoding & size limiting. Because of this, forwarding the\n // request body requires re-encoding it. Since we currently do not use\n // pipethrough() with procedures, proxying of request body is not\n // implemented.\n throw new InternalServerError(\n `Proxying of ${req.method} requests is not supported`,\n )\n }\n\n const lxm = parseReqNsid(req)\n\n const { url: origin, did: aud } = await parseProxyInfo(ctx, req, lxm)\n\n const dispatchOptions: Dispatcher.RequestOptions = {\n origin,\n method: req.method,\n path: req.originalUrl,\n headers: {\n 'accept-language': req.headers['accept-language'],\n 'atproto-accept-labelers': req.headers['atproto-accept-labelers'],\n 'x-bsky-topics': req.headers['x-bsky-topics'],\n\n // Because we sometimes need to interpret the response (e.g. during\n // read-after-write, through asPipeThroughBuffer()), we need to ask the\n // upstream server for an encoding that both the requester and the PDS can\n // understand. Since we might have to do the decoding ourselves, we will\n // use our own preferences (and weight) to negotiate the encoding.\n 'accept-encoding': buildProxiedContentEncoding(\n req.headers['accept-encoding'],\n ctx.cfg.proxy.preferCompressed,\n ),\n\n authorization: options?.iss\n ? `Bearer ${await ctx.serviceAuthJwt(options.iss, options.aud ?? aud, options.lxm ?? lxm)}`\n : undefined,\n },\n\n // Use a high water mark to buffer more data while performing async\n // operations before this stream is consumed. This is especially useful\n // while processing read-after-write operations.\n highWaterMark: 2 65536, // twice the default (64KiB)\n }\n\n const { headers, body } = await pipethroughRequest(ctx, req, dispatchOptions)\n\n return {\n encoding: safeString(headers['content-type']) ?? 'application/json',\n headers: Object.fromEntries(responseHeaders(headers)),\n stream: body,\n }\n}\n\n// Request setup/formatting\n// -------------------\n\nexport function computeProxyTo(\n ctx: AppContext,\n req: Request,\n lxm: string,\n): string {\n const proxyToHeader = req.header('atproto-proxy')\n if (proxyToHeader) return proxyToHeader\n\n const service = defaultService(ctx, lxm)\n if (service.serviceInfo) {\n return `${service.serviceInfo.did}#${service.serviceId}`\n }\n\n throw new InvalidRequestError(`No service configured for ${lxm}`)\n}\n\n// Bare-DID portion of `proxyTo`, suitable as a service-auth JWT audience\n// (Phase 1 of service auth updates).\nexport function bareDidFromProxyTo(proxyTo: string): string {\n const hashIndex = proxyTo.indexOf('#')\n return hashIndex === -1 ? proxyTo : proxyTo.slice(0, hashIndex)\n}\n\nexport async function parseProxyInfo(\n ctx: AppContext,\n req: Request,\n lxm: string,\n): Promise<{ url: string; did: string; serviceId: string }> {\n // /!\\ Hot path\n\n const proxyToHeader = req.header('atproto-proxy')\n if (proxyToHeader) return parseProxyHeader(ctx, proxyToHeader)\n\n const { serviceId, serviceInfo } = defaultService(ctx, lxm)\n if (serviceInfo) return { ...serviceInfo, serviceId }\n\n throw new InvalidRequestError(`No service configured for ${lxm}`)\n}\n\nexport const parseProxyHeader = async (\n // Using subset of AppContext for testing purposes\n ctx: Pick<AppContext, 'cfg' \| 'idResolver'>,\n proxyTo: string,\n): Promise<{ did: string; url: string; serviceId: string }> => {\n // /!\\ Hot path\n\n const hashIndex = proxyTo.indexOf('#')\n\n if (hashIndex === 0) {\n throw new InvalidRequestError('no did specified in proxy header')\n }\n\n if (hashIndex === -1 \|\| hashIndex === proxyTo.length - 1) {\n throw new InvalidRequestError('no service id specified in proxy header')\n }\n\n // More than one hash\n if (proxyTo.indexOf('#', hashIndex + 1) !== -1) {\n throw new InvalidRequestError('invalid proxy header format')\n }\n\n // Basic validation\n if (proxyTo.includes(' ')) {\n throw new InvalidRequestError('proxy header cannot contain spaces')\n }\n\n const did = proxyTo.slice(0, hashIndex)\n const serviceId = proxyTo.slice(hashIndex + 1)\n\n // Special case a configured appview, while still proxying correctly any other appview\n if (\n ctx.cfg.bskyAppView &&\n proxyTo === `${ctx.cfg.bskyAppView.did}#bsky_appview`\n ) {\n return { did, url: ctx.cfg.bskyAppView.url, serviceId }\n }\n\n const didDoc = await ctx.idResolver.did.resolve(did)\n if (!didDoc) {\n throw new InvalidRequestError('could not resolve proxy did')\n }\n\n const url = getServiceEndpoint(didDoc, { id: `#${serviceId}` })\n if (!url) {\n throw new InvalidRequestError('could not resolve proxy did service url')\n }\n\n return { did, url, serviceId }\n}\n\n/*\n Utility function that wraps the undici stream() function and handles request\n * and response errors by wrapping them in XRPCError instances. This function is\n * more efficient than \"pipethroughRequest\" when a writable stream to pipe the\n * upstream response to is available.\n /\nasync function pipethroughStream(\n ctx: AppContext,\n req: Request,\n dispatchOptions: Dispatcher.RequestOptions,\n successStreamFactory: Dispatcher.StreamFactory,\n): Promise<void> {\n return new Promise<void>((resolve, reject) => {\n void ctx.proxyAgent\n .stream(dispatchOptions, (upstream) => {\n if (upstream.statusCode >= 400) {\n const passThrough = new PassThrough()\n\n void tryParsingError(upstream.headers, passThrough).then((parsed) => {\n const xrpcError = new PipethroughUpstreamError(upstream, parsed, {\n cause: dispatchOptions,\n })\n\n reject(xrpcError)\n }, reject)\n\n return passThrough\n }\n\n const writable = successStreamFactory(upstream)\n\n // As soon as the control was passed to the writable stream (i.e. by\n // returning the writable hereafter), pipethroughStream() is considered\n // to have succeeded. Any error occurring while writing upstream data to\n // the writable stream should be handled through the stream's error\n // state (i.e. successStreamFactory() must ensure that error events on\n // the returned writable will be handled).\n resolve()\n\n return writable\n })\n // The following catch block will be triggered with either network errors\n // or writable stream errors. In the latter case, the promise will already\n // be resolved, and reject()ing it there after will have no effect. Those\n // error would still be logged by the successStreamFactory() function.\n .catch(handleUpstreamRequestError.bind(req))\n .catch(reject)\n })\n}\n\n/\n Utility function that wraps the undici request() function and handles request\n * and response errors by wrapping them in XRPCError instances.\n /\nasync function pipethroughRequest(\n ctx: AppContext,\n req: Request,\n dispatchOptions: Dispatcher.RequestOptions,\n) {\n // HandlerPipeThroughStream requires a readable stream to be returned, so we\n // use the (less efficient) request() function instead.\n\n const upstream = await ctx.proxyAgent\n .request(dispatchOptions)\n .catch(handleUpstreamRequestError.bind(req))\n\n if (upstream.statusCode >= 400) {\n const parsed = await tryParsingError(upstream.headers, upstream.body)\n\n throw new PipethroughUpstreamError(upstream, parsed, {\n cause: dispatchOptions,\n })\n }\n\n return upstream\n}\n\nfunction handleUpstreamRequestError(\n this: Request,\n err: unknown,\n message = 'Upstream service unreachable',\n): never {\n const logger = isPinoHttpRequest(this) ? this.log : httpLogger\n logger.error({ err }, message)\n throw new XRPCServerError(ResponseType.UpstreamFailure, message, undefined, {\n cause: err,\n })\n}\n\nfunction isPinoHttpRequest(req: Request): req is Request & {\n log: { error: (obj: unknown, msg: string) => void }\n} {\n return typeof (req as { log?: any }).log?.error === 'function'\n}\n\n// Request parsing/forwarding\n// -------------------\n\nexport function isJsonContentType(contentType?: string): boolean \| undefined {\n if (!contentType) return undefined\n return /application\\/(?:\\w+\\+)?json/i.test(contentType)\n}\n\nasync function tryParsingError(\n headers: IncomingHttpHeaders,\n readable: Readable,\n): Promise<{ error?: string; message?: string }> {\n if (isJsonContentType(headers['content-type']) === false) {\n // We don't known how to parse non JSON content types so we can discard the\n // whole response.\n\n // Since we don't care about the response, we would normally just destroy\n // the stream. However, if the underlying HTTP connection is an HTTP/1.1\n // connection, this also destroys the underlying (keep-alive) TCP socket. In\n // order to avoid destroying the TCP socket, while avoiding the cost of\n // consuming too much IO, we give it a chance to finish first.\n\n // @NOTE we need to listen (and ignore) \"error\" events, otherwise the\n // process could crash (since we drain the stream asynchronously here). This\n // is performed through the \"finished\" call below.\n\n const to = setTimeout(() => {\n readable.destroy()\n }, 100)\n finished(readable, (_err) => {\n clearTimeout(to)\n })\n readable.resume()\n\n return {}\n }\n\n try {\n const buffer = await bufferUpstreamResponse(\n readable,\n headers['content-encoding'],\n )\n\n const errInfo: unknown = JSON.parse(buffer.toString('utf8'))\n return {\n error: safeString(errInfo?.['error']),\n message: safeString(errInfo?.['message']),\n }\n } catch (err) {\n // Failed to read, decode, buffer or parse. No big deal.\n return {}\n }\n}\n\nasync function bufferUpstreamResponse(\n readable: Readable,\n contentEncoding?: string \| string[],\n): Promise<Buffer> {\n try {\n return await streamToNodeBuffer(decodeStream(readable, contentEncoding))\n } catch (err) {\n if (!readable.destroyed) readable.destroy()\n\n throw new XRPCServerError(\n ResponseType.UpstreamFailure,\n err instanceof TypeError ? err.message : 'unable to decode request body',\n undefined,\n { cause: err },\n )\n }\n}\n\nexport async function asPipeThroughBuffer(\n input: HandlerPipeThroughStream,\n): Promise<HandlerPipeThroughBuffer> {\n return {\n buffer: await bufferUpstreamResponse(\n input.stream,\n input.headers?.['content-encoding'],\n ),\n headers: omit(input.headers, ['content-encoding', 'content-length']),\n encoding: input.encoding,\n }\n}\n\n// Response parsing/forwarding\n// -------------------\n\nconst RES_HEADERS_TO_FORWARD = [\n 'atproto-repo-rev',\n 'atproto-content-labelers',\n 'retry-after',\n]\n\nfunction responseHeaders(\n headers: IncomingHttpHeaders,\n includeContentHeaders = true,\n): Generator<[string, string]> {\n if (includeContentHeaders) {\n const length = headers['content-length']\n if (length) yield ['content-length', length]\n\n const encoding = headers['content-encoding']\n if (encoding) yield ['content-encoding', encoding]\n\n const type = headers['content-type']\n if (type) yield ['content-type', type]\n\n const language = headers['content-language']\n if (language) yield ['content-language', language]\n }\n\n for (let i = 0; i < RES_HEADERS_TO_FORWARD.length; i++) {\n const name = RES_HEADERS_TO_FORWARD[i]\n const val = headers[name]\n\n if (val != null) {\n const value: string = Array.isArray(val) ? val.join(',') : val\n yield [name, value]\n }\n }\n}\n\n// Utils\n// -------------------\n\n/*\n Performs lexicon method matching on a set of methods,\n * taking into account that they are treated case-insensitively.\n /\nexport class LxmSet {\n private inner: Set<string>\n private original: Iterable<string>\n constructor(items: Iterable<string>) {\n this.inner = new Set(Array.from(items, normalizeLxm))\n this.original = items\n }\n has(lxm: string) {\n return this.inner.has(normalizeLxm(lxm))\n }\n [Symbol.iterator](): Iterator<string> {\n yield* this.original\n }\n}\n\nexport function normalizeLxm(lxm: string) {\n return lxm.toLowerCase()\n}\n\nexport const CHAT_BSKY_METHODS = new LxmSet([\n chat.bsky.actor.deleteAccount.$lxm,\n chat.bsky.actor.exportAccountData.$lxm,\n chat.bsky.convo.deleteMessageForSelf.$lxm,\n chat.bsky.convo.getConvo.$lxm,\n chat.bsky.convo.getConvoForMembers.$lxm,\n chat.bsky.convo.getLog.$lxm,\n chat.bsky.convo.getMessages.$lxm,\n chat.bsky.convo.leaveConvo.$lxm,\n chat.bsky.convo.listConvos.$lxm,\n chat.bsky.convo.muteConvo.$lxm,\n chat.bsky.convo.sendMessage.$lxm,\n chat.bsky.convo.sendMessageBatch.$lxm,\n chat.bsky.convo.unmuteConvo.$lxm,\n chat.bsky.convo.updateRead.$lxm,\n])\n\nexport const PRIVILEGED_METHODS = new LxmSet([\n ...CHAT_BSKY_METHODS,\n com.atproto.server.createAccount.$lxm,\n])\n\n// These endpoints are related to account management and must be used directly,\n// not proxied or service-authed. Service auth may be utilized between PDS and\n// entryway for these methods.\nexport const PROTECTED_METHODS = new LxmSet([\n com.atproto.admin.sendEmail.$lxm,\n com.atproto.identity.requestPlcOperationSignature.$lxm,\n com.atproto.identity.signPlcOperation.$lxm,\n com.atproto.identity.updateHandle.$lxm,\n com.atproto.server.activateAccount.$lxm,\n com.atproto.server.confirmEmail.$lxm,\n com.atproto.server.createAppPassword.$lxm,\n com.atproto.server.deactivateAccount.$lxm,\n com.atproto.server.getAccountInviteCodes.$lxm,\n com.atproto.server.getSession.$lxm,\n com.atproto.server.listAppPasswords.$lxm,\n com.atproto.server.requestAccountDelete.$lxm,\n com.atproto.server.requestEmailConfirmation.$lxm,\n com.atproto.server.requestEmailUpdate.$lxm,\n com.atproto.server.revokeAppPassword.$lxm,\n com.atproto.server.updateEmail.$lxm,\n])\n\nconst defaultService = (\n ctx: AppContext,\n nsid: string,\n): {\n serviceId: string\n serviceInfo: { url: string; did: string } \| null\n} => {\n switch (nsid) {\n case tools.ozone.communication.createTemplate.$lxm:\n case tools.ozone.communication.deleteTemplate.$lxm:\n case tools.ozone.communication.listTemplates.$lxm:\n case tools.ozone.communication.updateTemplate.$lxm:\n case tools.ozone.moderation.cancelScheduledActions.$lxm:\n case tools.ozone.moderation.emitEvent.$lxm:\n case tools.ozone.moderation.getAccountTimeline.$lxm:\n case tools.ozone.moderation.getEvent.$lxm:\n case tools.ozone.moderation.getRecord.$lxm:\n case tools.ozone.moderation.getRepo.$lxm:\n case tools.ozone.moderation.listScheduledActions.$lxm:\n case tools.ozone.moderation.queryEvents.$lxm:\n case tools.ozone.moderation.queryStatuses.$lxm:\n case tools.ozone.moderation.scheduleAction.$lxm:\n case tools.ozone.moderation.searchRepos.$lxm:\n case tools.ozone.safelink.addRule.$lxm:\n case tools.ozone.safelink.queryEvents.$lxm:\n case tools.ozone.safelink.queryRules.$lxm:\n case tools.ozone.safelink.removeRule.$lxm:\n case tools.ozone.safelink.updateRule.$lxm:\n case tools.ozone.team.addMember.$lxm:\n case tools.ozone.team.deleteMember.$lxm:\n case tools.ozone.team.listMembers.$lxm:\n case tools.ozone.team.updateMember.$lxm:\n case tools.ozone.verification.grantVerifications.$lxm:\n case tools.ozone.verification.listVerifications.$lxm:\n case tools.ozone.verification.revokeVerifications.$lxm:\n return {\n serviceId: 'atproto_labeler',\n serviceInfo: ctx.cfg.modService,\n }\n case com.atproto.moderation.createReport.$lxm:\n return {\n serviceId: 'atproto_labeler',\n serviceInfo: ctx.cfg.reportService,\n }\n default:\n return {\n serviceId: 'bsky_appview',\n serviceInfo: ctx.cfg.bskyAppView,\n }\n }\n}\n\nconst safeString = (str: unknown): string \| undefined => {\n return typeof str === 'string' ? str : undefined\n}\n\nfunction logResponseError(this: ServerResponse, err: unknown): void {\n httpLogger.warn({ err }, 'error forwarding upstream response')\n}\n\nexport class PipethroughUpstreamError extends XRPCServerError {\n constructor(\n readonly upstream: {\n statusCode: number\n headers: IncomingHttpHeaders\n },\n payload: { message?: string; error?: string },\n options?: ErrorOptions,\n ) {\n const status =\n upstream.statusCode === 500\n ? ResponseType.UpstreamFailure\n : upstream.statusCode\n\n super(status, payload.message, payload.error, options)\n }\n\n get headers(): Record<string, string> {\n return Object.fromEntries(responseHeaders(this.upstream.headers, false))\n }\n\n get error() {\n return this.customErrorName ?? this.typeName\n }\n}\n"]}
1	+ {"version":3,"file":"pipethrough.js","sourceRoot":"","sources":["../src/pipethrough.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAY,QAAQ,EAAE,MAAM,aAAa,CAAA;AAE7D,OAAO,EAAE,KAAK,EAAc,IAAI,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAA;AAC9D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,IAAI,EACJ,kBAAkB,GACnB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EAIL,mBAAmB,EACnB,mBAAmB,EACnB,YAAY,EACZ,SAAS,IAAI,eAAe,EAC5B,kBAAkB,EAClB,YAAY,GACb,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AACrE,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAA;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAGpD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,MAAM,UAAU,eAAe,CAAC,GAAgB;IAC9C,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC;QACtB,OAAO,EAAE,GAAG,CAAC,UAAU;QACvB,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,OAAO,EAAE,GAAG,CAAC,qBAAqB;YAChC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;gBACf,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAC1B,MAAM,YAAY,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;gBAClD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBAC1B,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,GAAG,CAAC,CAAA;gBACrD,CAAC;gBACD,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC;oBACpC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;gBAC7D,CAAC;gBACD,OAAO,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YAC/B,CAAC;QACL,OAAO,EAAE;YACP,MAAM,EAAE,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa;SAC9D;KACF,CAAC,CAAA;IAEF,OAAO,KAAK,CAAC,OAAO,CAClB,GAAG,CAAC,UAAU,GAAG,CAAC;QAChB,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC;YACjB,WAAW,EAAE,EAAE,EAAE,8BAA8B;YAC/C,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;YACxB,UAAU,EAAE,GAAG,CAAC,UAAU;SAC3B,CAAC;QACJ,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAC3B,CAAA;AACH,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAe,EAAmB,EAAE;IAC/D,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,aAAa,CAAqB;QACrE,SAAS,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC;KACtE,CAAC,CAAA;IAEF,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9B,eAAe;QACf,IAAI,CAAC;YACH,IACE,GAAG,CAAC,MAAM,KAAK,KAAK;gBACpB,GAAG,CAAC,MAAM,KAAK,MAAM;gBACrB,GAAG,CAAC,MAAM,KAAK,MAAM,EACrB,CAAC;gBACD,MAAM,IAAI,eAAe,CACvB,YAAY,CAAC,cAAc,EAC3B,0CAA0C,CAC3C,CAAA;YACH,CAAC;YAED,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;YACpD,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnC,qDAAqD;gBACrD,MAAM,IAAI,mBAAmB,CAAC,8BAA8B,CAAC,CAAA;YAC/D,CAAC;YAED,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;YAC7B,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;YACnE,CAAC;YAED,MAAM,EACJ,GAAG,EAAE,MAAM,EACX,GAAG,EACH,SAAS,GACV,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YACvC,qEAAqE;YACrE,oEAAoE;YACpE,iEAAiE;YACjE,8BAA8B;YAC9B,MAAM,QAAQ,GAAG,GAAG,GAAG,IAAI,SAAS,EAAE,CAAA;YACtC,MAAM,QAAQ,GAAG,GAAG,CAAA;YAEpB,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC;gBACnC,GAAG;gBACH,GAAG;gBACH,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE;aAC/B,CAAC,CAAA;YAEF,MAAM,EAAE,WAAW,EAAE,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAA;YAEtD,IACE,WAAW,CAAC,IAAI,KAAK,QAAQ;gBAC7B,CAAC,kBAAkB,CAAC,WAAW,CAAC,KAAK,CAAC;gBACtC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,EAC3B,CAAC;gBACD,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;YACnE,CAAC;YAED,MAAM,OAAO,GAAwB;gBACnC,iBAAiB,EAAE,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,UAAU;gBAC/D,iBAAiB,EAAE,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC;gBACjD,yBAAyB,EAAE,GAAG,CAAC,OAAO,CAAC,yBAAyB,CAAC;gBACjE,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC;gBAE7C,cAAc,EAAE,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC;gBACnD,kBAAkB,EAAE,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC;gBAC3D,gBAAgB,EAAE,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC;gBAEvD,aAAa,EAAE,UAAU,MAAM,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE;aACpF,CAAA;YAED,MAAM,eAAe,GAA8B;gBACjD,MAAM;gBACN,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,GAAG,CAAC,WAAW;gBACrB,IAAI;gBACJ,OAAO;aACR,CAAA;YAED,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,QAAQ,EAAE,EAAE;gBAC9D,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;gBAE/B,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC5D,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;gBAC1B,CAAC;gBAED,uEAAuE;gBACvE,wEAAwE;gBACxE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAA;gBAEjC,sEAAsE;gBACtE,OAAO,GAAG,CAAA;YACZ,CAAC,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAA;QACX,CAAC;IACH,CAAC,CAAA;AACH,CAAC,CAAA;AAsBD,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAe,EACf,GAAY,EACZ,OAA4B;IAQ5B,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAClD,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,sEAAsE;QACtE,iEAAiE;QACjE,eAAe;QACf,MAAM,IAAI,mBAAmB,CAC3B,eAAe,GAAG,CAAC,MAAM,4BAA4B,CACtD,CAAA;IACH,CAAC;IAED,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;IAE7B,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IAErE,MAAM,eAAe,GAA8B;QACjD,MAAM;QACN,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,GAAG,CAAC,WAAW;QACrB,OAAO,EAAE;YACP,iBAAiB,EAAE,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC;YACjD,yBAAyB,EAAE,GAAG,CAAC,OAAO,CAAC,yBAAyB,CAAC;YACjE,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC;YAE7C,mEAAmE;YACnE,uEAAuE;YACvE,0EAA0E;YAC1E,wEAAwE;YACxE,kEAAkE;YAClE,iBAAiB,EAAE,2BAA2B,CAC5C,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAC9B,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAC/B;YAED,aAAa,EAAE,OAAO,EAAE,GAAG;gBACzB,CAAC,CAAC,UAAU,MAAM,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE;gBAC3F,CAAC,CAAC,SAAS;SACd;QAED,mEAAmE;QACnE,uEAAuE;QACvE,gDAAgD;QAChD,aAAa,EAAE,CAAC,GAAG,KAAK,EAAE,4BAA4B;KACvD,CAAA;IAED,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,CAAA;IAE7E,OAAO;QACL,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,IAAI,kBAAkB;QACnE,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,EAAE,IAAI;KACb,CAAA;AACH,CAAC;AAED,2BAA2B;AAC3B,sBAAsB;AAEtB,MAAM,UAAU,cAAc,CAC5B,GAAe,EACf,GAAY,EACZ,GAAW;IAEX,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;IACjD,IAAI,aAAa;QAAE,OAAO,aAAa,CAAA;IAEvC,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IACxC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI,OAAO,CAAC,SAAS,EAAE,CAAA;IAC1D,CAAC;IAED,MAAM,IAAI,mBAAmB,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAA;AACnE,CAAC;AAED,yEAAyE;AACzE,qCAAqC;AACrC,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACtC,OAAO,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAe,EACf,GAAY,EACZ,GAAW;IAEX,eAAe;IAEf,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;IACjD,IAAI,aAAa;QAAE,OAAO,gBAAgB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;IAE9D,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAC3D,IAAI,WAAW;QAAE,OAAO,EAAE,GAAG,WAAW,EAAE,SAAS,EAAE,CAAA;IAErD,MAAM,IAAI,mBAAmB,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAA;AACnE,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK;AACnC,kDAAkD;AAClD,GAA2C,EAC3C,OAAe,EAC2C,EAAE;IAC5D,eAAe;IAEf,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAEtC,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,mBAAmB,CAAC,kCAAkC,CAAC,CAAA;IACnE,CAAC;IAED,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,SAAS,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,mBAAmB,CAAC,yCAAyC,CAAC,CAAA;IAC1E,CAAC;IAED,qBAAqB;IACrB,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,mBAAmB,CAAC,6BAA6B,CAAC,CAAA;IAC9D,CAAC;IAED,mBAAmB;IACnB,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,CAAC,CAAA;IACrE,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAA;IAE9C,sFAAsF;IACtF,IACE,GAAG,CAAC,GAAG,CAAC,WAAW;QACnB,OAAO,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,eAAe,EACrD,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,EAAE,CAAA;IACzD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,mBAAmB,CAAC,6BAA6B,CAAC,CAAA;IAC9D,CAAC;IAED,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,SAAS,EAAE,EAAE,CAAC,CAAA;IAC/D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,mBAAmB,CAAC,yCAAyC,CAAC,CAAA;IAC1E,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAA;AAChC,CAAC,CAAA;AAED;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAC9B,GAAe,EACf,GAAY,EACZ,eAA0C,EAC1C,oBAA8C;IAE9C,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,KAAK,GAAG,CAAC,UAAU;aAChB,MAAM,CAAC,eAAe,EAAE,CAAC,QAAQ,EAAE,EAAE;YACpC,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;gBAC/B,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAA;gBAErC,KAAK,eAAe,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;oBAClE,MAAM,SAAS,GAAG,IAAI,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE;wBAC/D,KAAK,EAAE,eAAe;qBACvB,CAAC,CAAA;oBAEF,MAAM,CAAC,SAAS,CAAC,CAAA;gBACnB,CAAC,EAAE,MAAM,CAAC,CAAA;gBAEV,OAAO,WAAW,CAAA;YACpB,CAAC;YAED,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAA;YAE/C,oEAAoE;YACpE,uEAAuE;YACvE,wEAAwE;YACxE,mEAAmE;YACnE,sEAAsE;YACtE,0CAA0C;YAC1C,OAAO,EAAE,CAAA;YAET,OAAO,QAAQ,CAAA;QACjB,CAAC,CAAC;YACF,yEAAyE;YACzE,0EAA0E;YAC1E,yEAAyE;YACzE,sEAAsE;aACrE,KAAK,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;aAC3C,KAAK,CAAC,MAAM,CAAC,CAAA;IAClB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,kBAAkB,CAC/B,GAAe,EACf,GAAY,EACZ,eAA0C;IAE1C,4EAA4E;IAC5E,uDAAuD;IAEvD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,UAAU;SAClC,OAAO,CAAC,eAAe,CAAC;SACxB,KAAK,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IAE9C,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;QAErE,MAAM,IAAI,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE;YACnD,KAAK,EAAE,eAAe;SACvB,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,0BAA0B,CAEjC,GAAY,EACZ,OAAO,GAAG,8BAA8B;IAExC,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAA;IAC9D,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,OAAO,CAAC,CAAA;IAC9B,MAAM,IAAI,eAAe,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE;QAC1E,KAAK,EAAE,GAAG;KACX,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAY;IAGrC,OAAO,OAAQ,GAAqB,CAAC,GAAG,EAAE,KAAK,KAAK,UAAU,CAAA;AAChE,CAAC;AAED,6BAA6B;AAC7B,sBAAsB;AAEtB,MAAM,UAAU,iBAAiB,CAAC,WAAoB;IACpD,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAA;IAClC,OAAO,8BAA8B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;AACzD,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAA4B,EAC5B,QAAkB;IAElB,IAAI,iBAAiB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;QACzD,2EAA2E;QAC3E,kBAAkB;QAElB,yEAAyE;QACzE,wEAAwE;QACxE,4EAA4E;QAC5E,uEAAuE;QACvE,8DAA8D;QAE9D,qEAAqE;QACrE,4EAA4E;QAC5E,kDAAkD;QAElD,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE;YACzB,QAAQ,CAAC,OAAO,EAAE,CAAA;QACpB,CAAC,EAAE,GAAG,CAAC,CAAA;QACP,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;YAC1B,YAAY,CAAC,EAAE,CAAC,CAAA;QAClB,CAAC,CAAC,CAAA;QACF,QAAQ,CAAC,MAAM,EAAE,CAAA;QAEjB,OAAO,EAAE,CAAA;IACX,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,sBAAsB,CACzC,QAAQ,EACR,OAAO,CAAC,kBAAkB,CAAC,CAC5B,CAAA;QAED,MAAM,OAAO,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;QAC5D,OAAO;YACL,KAAK,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;YACrC,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;SAC1C,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wDAAwD;QACxD,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,QAAkB,EAClB,eAAmC;IAEnC,IAAI,CAAC;QACH,OAAO,MAAM,kBAAkB,CAAC,YAAY,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAA;IAC1E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,QAAQ,CAAC,SAAS;YAAE,QAAQ,CAAC,OAAO,EAAE,CAAA;QAE3C,MAAM,IAAI,eAAe,CACvB,YAAY,CAAC,eAAe,EAC5B,GAAG,YAAY,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,+BAA+B,EACxE,SAAS,EACT,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAA+B;IAE/B,OAAO;QACL,MAAM,EAAE,MAAM,sBAAsB,CAClC,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,OAAO,EAAE,CAAC,kBAAkB,CAAC,CACpC;QACD,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC;QACpE,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAA;AACH,CAAC;AAED,8BAA8B;AAC9B,sBAAsB;AAEtB,MAAM,sBAAsB,GAAG;IAC7B,kBAAkB;IAClB,0BAA0B;IAC1B,aAAa;CACd,CAAA;AAED,QAAQ,CAAC,CAAC,eAAe,CACvB,OAA4B,EAC5B,qBAAqB,GAAG,IAAI;IAE5B,IAAI,qBAAqB,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;QACxC,IAAI,MAAM;YAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAA;QAE5C,MAAM,QAAQ,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;QAC5C,IAAI,QAAQ;YAAE,MAAM,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAA;QAElD,MAAM,IAAI,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;QACpC,IAAI,IAAI;YAAE,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,CAAA;QAEtC,MAAM,QAAQ,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;QAC5C,IAAI,QAAQ;YAAE,MAAM,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAA;IACpD,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAAA;QACtC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QAEzB,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;YAChB,MAAM,KAAK,GAAW,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;YAC9D,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;AACH,CAAC;AAED,QAAQ;AACR,sBAAsB;AAEtB;;;GAGG;AACH,MAAM,OAAO,MAAM;IAGjB,YAAY,KAAuB;QACjC,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAA;QACrD,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAA;IACvB,CAAC;IACD,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;IAC1C,CAAC;IACD,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;QAChB,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAA;IACtB,CAAC;CACF;AAED,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,GAAG,CAAC,WAAW,EAAE,CAAA;AAC1B,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAAC;IAC1C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI;IAClC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI;IACtC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI;IACzC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI;IAC7B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI;IACvC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI;IAC3B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI;IAChC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI;IAC/B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI;IAC/B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI;IAC9B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI;IAChC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI;IACrC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI;IAChC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI;CAChC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,MAAM,CAAC;IAC3C,GAAG,iBAAiB;IACpB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;CACtC,CAAC,CAAA;AAEF,+EAA+E;AAC/E,8EAA8E;AAC9E,8BAA8B;AAC9B,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAAC;IAC1C,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI;IAChC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAC,IAAI;IACtD,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI;IAC1C,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI;IACtC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI;IACvC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI;IACpC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI;IACzC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI;IACzC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,IAAI;IAC7C,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI;IAClC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI;IACxC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,IAAI;IAC5C,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,wBAAwB,CAAC,IAAI;IAChD,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI;IAC1C,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI;IACzC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI;CACpC,CAAC,CAAA;AAEF,MAAM,cAAc,GAAG,CACrB,GAAe,EACf,IAAY,EAIZ,EAAE;IACF,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,IAAI,CAAC;QACnD,KAAK,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,IAAI,CAAC;QACnD,KAAK,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC;QAClD,KAAK,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,IAAI,CAAC;QACnD,KAAK,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,sBAAsB,CAAC,IAAI,CAAC;QACxD,KAAK,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC;QAC3C,KAAK,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC;QACpD,KAAK,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC1C,KAAK,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC;QAC3C,KAAK,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;QACzC,KAAK,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,oBAAoB,CAAC,IAAI,CAAC;QACtD,KAAK,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC;QAC7C,KAAK,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC;QAC/C,KAAK,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC;QAChD,KAAK,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC;QAC7C,KAAK,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;QACvC,KAAK,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC;QAC3C,KAAK,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1C,KAAK,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1C,KAAK,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1C,KAAK,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QACrC,KAAK,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;QACxC,KAAK,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;QACvC,KAAK,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;QACxC,KAAK,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,kBAAkB,CAAC,IAAI,CAAC;QACtD,KAAK,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,iBAAiB,CAAC,IAAI,CAAC;QACrD,KAAK,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,mBAAmB,CAAC,IAAI;YACpD,OAAO;gBACL,SAAS,EAAE,iBAAiB;gBAC5B,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,UAAU;aAChC,CAAA;QACH,KAAK,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI;YAC3C,OAAO;gBACL,SAAS,EAAE,iBAAiB;gBAC5B,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,aAAa;aACnC,CAAA;QACH;YACE,OAAO;gBACL,SAAS,EAAE,cAAc;gBACzB,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,WAAW;aACjC,CAAA;IACL,CAAC;AACH,CAAC,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,GAAY,EAAsB,EAAE;IACtD,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;AAClD,CAAC,CAAA;AAED,SAAS,gBAAgB,CAAuB,GAAY;IAC1D,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,oCAAoC,CAAC,CAAA;AAChE,CAAC;AAED,MAAM,OAAO,wBAAyB,SAAQ,eAAe;IAC3D,YACW,QAGR,EACD,OAA6C,EAC7C,OAAsB;QAEtB,MAAM,MAAM,GACV,QAAQ,CAAC,UAAU,KAAK,GAAG;YACzB,CAAC,CAAC,YAAY,CAAC,eAAe;YAC9B,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAA;QAEzB,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;wBAZ7C,QAAQ;IAanB,CAAC;IAED,IAAI,OAAO;QACT,OAAO,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;IAC1E,CAAC;IAED,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,QAAQ,CAAA;IAC9C,CAAC;CACF","sourcesContent":["import { IncomingHttpHeaders, ServerResponse } from 'node:http'\nimport { PassThrough, Readable, finished } from 'node:stream'\nimport { Request } from 'express'\nimport { Agent, Dispatcher, Pool, interceptors } from 'undici'\nimport {\n decodeStream,\n getServiceEndpoint,\n omit,\n streamToNodeBuffer,\n} from '@atproto/common'\nimport { RpcPermissionMatch } from '@atproto/oauth-scopes'\nimport {\n CatchallHandler,\n HandlerPipeThroughBuffer,\n HandlerPipeThroughStream,\n InternalServerError,\n InvalidRequestError,\n ResponseType,\n XRPCError as XRPCServerError,\n excludeErrorResult,\n parseReqNsid,\n} from '@atproto/xrpc-server'\nimport { isUnicastIp, unicastLookup } from '@atproto-labs/fetch-node'\nimport { buildProxiedContentEncoding } from '@atproto-labs/xrpc-utils'\nimport { isAccessPrivileged } from './auth-scope.js'\nimport { ProxyConfig } from './config/config.js'\nimport { AppContext } from './context.js'\nimport { chat, com, tools } from './lexicons/index.js'\nimport { httpLogger } from './logger.js'\n\nexport function buildProxyAgent(cfg: ProxyConfig): Dispatcher {\n const agent = new Agent({\n allowH2: cfg.allowHTTP2,\n headersTimeout: cfg.headersTimeout,\n maxResponseSize: cfg.maxResponseSize,\n bodyTimeout: cfg.bodyTimeout,\n factory: cfg.disableSsrfProtection\n ? undefined\n : (origin, opts) => {\n const { protocol, hostname } =\n origin instanceof URL ? origin : new URL(origin)\n if (protocol !== 'https:') {\n throw new Error(`Forbidden protocol \"${protocol}\"`)\n }\n if (isUnicastIp(hostname) === false) {\n throw new Error('Hostname resolved to non-unicast address')\n }\n return new Pool(origin, opts)\n },\n connect: {\n lookup: cfg.disableSsrfProtection ? undefined : unicastLookup,\n },\n })\n\n return agent.compose(\n cfg.maxRetries > 0\n ? interceptors.retry({\n statusCodes: [], // Only retry on socket errors\n methods: ['GET', 'HEAD'],\n maxRetries: cfg.maxRetries,\n })\n : (dispatch) => dispatch,\n )\n}\n\nexport const proxyHandler = (ctx: AppContext): CatchallHandler => {\n const performAuth = ctx.authVerifier.authorization<RpcPermissionMatch>({\n authorize: (permissions, { params }) => permissions.assertRpc(params),\n })\n\n return async (req, res, next) => {\n // /!\\ Hot path\n try {\n if (\n req.method !== 'GET' &&\n req.method !== 'HEAD' &&\n req.method !== 'POST'\n ) {\n throw new XRPCServerError(\n ResponseType.InvalidRequest,\n 'XRPC requests only supports GET and POST',\n )\n }\n\n const body = req.method === 'POST' ? req : undefined\n if (body != null && !body.readable) {\n // Body was already consumed by a previous middleware\n throw new InternalServerError('Request body is not readable')\n }\n\n const lxm = parseReqNsid(req)\n if (PROTECTED_METHODS.has(lxm)) {\n throw new InvalidRequestError('Bad token method', 'InvalidToken')\n }\n\n const {\n url: origin,\n did,\n serviceId,\n } = await parseProxyInfo(ctx, req, lxm)\n // Phase 1 of service auth updates: the scope check sees the combined\n // did#serviceId form (so OAuth callers' rpc:?aud=did#service scopes\n // match), while the outbound service-auth JWT keeps bare-DID aud\n // regardless of session type.\n const scopeAud = `${did}#${serviceId}`\n const tokenAud = did\n\n const authResult = await performAuth({\n req,\n res,\n params: { lxm, aud: scopeAud },\n })\n\n const { credentials } = excludeErrorResult(authResult)\n\n if (\n credentials.type === 'access' &&\n !isAccessPrivileged(credentials.scope) &&\n PRIVILEGED_METHODS.has(lxm)\n ) {\n throw new InvalidRequestError('Bad token method', 'InvalidToken')\n }\n\n const headers: IncomingHttpHeaders = {\n 'accept-encoding': req.headers['accept-encoding'] \|\| 'identity',\n 'accept-language': req.headers['accept-language'],\n 'atproto-accept-labelers': req.headers['atproto-accept-labelers'],\n 'x-bsky-topics': req.headers['x-bsky-topics'],\n\n 'content-type': body && req.headers['content-type'],\n 'content-encoding': body && req.headers['content-encoding'],\n 'content-length': body && req.headers['content-length'],\n\n authorization: `Bearer ${await ctx.serviceAuthJwt(credentials.did, tokenAud, lxm)}`,\n }\n\n const dispatchOptions: Dispatcher.RequestOptions = {\n origin,\n method: req.method,\n path: req.originalUrl,\n body,\n headers,\n }\n\n await pipethroughStream(ctx, req, dispatchOptions, (upstream) => {\n res.status(upstream.statusCode)\n\n for (const [name, val] of responseHeaders(upstream.headers)) {\n res.setHeader(name, val)\n }\n\n // Note that we should not need to manually handle errors here (e.g. by\n // destroying the response), as the http server will handle them for us.\n res.on('error', logResponseError)\n\n // Tell undici to write the upstream response directly to the response\n return res\n })\n } catch (err) {\n next(err)\n }\n }\n}\n\nexport type PipethroughOptions = {\n /*\n Specify the issuer (requester) for service auth. If not provided, no\n * authorization headers will be added to the request.\n /\n iss?: string\n\n /\n Override the audience for service auth. If not provided, the audience will\n * be determined based on the proxy service.\n /\n aud?: string\n\n /\n Override the lexicon method for service auth. If not provided, the lexicon\n * method will be determined based on the request path.\n /\n lxm?: string\n}\n\nexport async function pipethrough(\n ctx: AppContext,\n req: Request,\n options?: PipethroughOptions,\n): Promise<\n HandlerPipeThroughStream & {\n stream: Readable\n headers: Record<string, string>\n encoding: string\n }\n> {\n if (req.method !== 'GET' && req.method !== 'HEAD') {\n // pipethrough() is used from within xrpcServer handlers, which means that\n // the request body either has been parsed or is a readable stream that has\n // been piped for decoding & size limiting. Because of this, forwarding the\n // request body requires re-encoding it. Since we currently do not use\n // pipethrough() with procedures, proxying of request body is not\n // implemented.\n throw new InternalServerError(\n `Proxying of ${req.method} requests is not supported`,\n )\n }\n\n const lxm = parseReqNsid(req)\n\n const { url: origin, did: aud } = await parseProxyInfo(ctx, req, lxm)\n\n const dispatchOptions: Dispatcher.RequestOptions = {\n origin,\n method: req.method,\n path: req.originalUrl,\n headers: {\n 'accept-language': req.headers['accept-language'],\n 'atproto-accept-labelers': req.headers['atproto-accept-labelers'],\n 'x-bsky-topics': req.headers['x-bsky-topics'],\n\n // Because we sometimes need to interpret the response (e.g. during\n // read-after-write, through asPipeThroughBuffer()), we need to ask the\n // upstream server for an encoding that both the requester and the PDS can\n // understand. Since we might have to do the decoding ourselves, we will\n // use our own preferences (and weight) to negotiate the encoding.\n 'accept-encoding': buildProxiedContentEncoding(\n req.headers['accept-encoding'],\n ctx.cfg.proxy.preferCompressed,\n ),\n\n authorization: options?.iss\n ? `Bearer ${await ctx.serviceAuthJwt(options.iss, options.aud ?? aud, options.lxm ?? lxm)}`\n : undefined,\n },\n\n // Use a high water mark to buffer more data while performing async\n // operations before this stream is consumed. This is especially useful\n // while processing read-after-write operations.\n highWaterMark: 2 65536, // twice the default (64KiB)\n }\n\n const { headers, body } = await pipethroughRequest(ctx, req, dispatchOptions)\n\n return {\n encoding: safeString(headers['content-type']) ?? 'application/json',\n headers: Object.fromEntries(responseHeaders(headers)),\n stream: body,\n }\n}\n\n// Request setup/formatting\n// -------------------\n\nexport function computeProxyTo(\n ctx: AppContext,\n req: Request,\n lxm: string,\n): string {\n const proxyToHeader = req.header('atproto-proxy')\n if (proxyToHeader) return proxyToHeader\n\n const service = defaultService(ctx, lxm)\n if (service.serviceInfo) {\n return `${service.serviceInfo.did}#${service.serviceId}`\n }\n\n throw new InvalidRequestError(`No service configured for ${lxm}`)\n}\n\n// Bare-DID portion of `proxyTo`, suitable as a service-auth JWT audience\n// (Phase 1 of service auth updates).\nexport function bareDidFromProxyTo(proxyTo: string): string {\n const hashIndex = proxyTo.indexOf('#')\n return hashIndex === -1 ? proxyTo : proxyTo.slice(0, hashIndex)\n}\n\nexport async function parseProxyInfo(\n ctx: AppContext,\n req: Request,\n lxm: string,\n): Promise<{ url: string; did: string; serviceId: string }> {\n // /!\\ Hot path\n\n const proxyToHeader = req.header('atproto-proxy')\n if (proxyToHeader) return parseProxyHeader(ctx, proxyToHeader)\n\n const { serviceId, serviceInfo } = defaultService(ctx, lxm)\n if (serviceInfo) return { ...serviceInfo, serviceId }\n\n throw new InvalidRequestError(`No service configured for ${lxm}`)\n}\n\nexport const parseProxyHeader = async (\n // Using subset of AppContext for testing purposes\n ctx: Pick<AppContext, 'cfg' \| 'idResolver'>,\n proxyTo: string,\n): Promise<{ did: string; url: string; serviceId: string }> => {\n // /!\\ Hot path\n\n const hashIndex = proxyTo.indexOf('#')\n\n if (hashIndex === 0) {\n throw new InvalidRequestError('no did specified in proxy header')\n }\n\n if (hashIndex === -1 \|\| hashIndex === proxyTo.length - 1) {\n throw new InvalidRequestError('no service id specified in proxy header')\n }\n\n // More than one hash\n if (proxyTo.indexOf('#', hashIndex + 1) !== -1) {\n throw new InvalidRequestError('invalid proxy header format')\n }\n\n // Basic validation\n if (proxyTo.includes(' ')) {\n throw new InvalidRequestError('proxy header cannot contain spaces')\n }\n\n const did = proxyTo.slice(0, hashIndex)\n const serviceId = proxyTo.slice(hashIndex + 1)\n\n // Special case a configured appview, while still proxying correctly any other appview\n if (\n ctx.cfg.bskyAppView &&\n proxyTo === `${ctx.cfg.bskyAppView.did}#bsky_appview`\n ) {\n return { did, url: ctx.cfg.bskyAppView.url, serviceId }\n }\n\n const didDoc = await ctx.idResolver.did.resolve(did)\n if (!didDoc) {\n throw new InvalidRequestError('could not resolve proxy did')\n }\n\n const url = getServiceEndpoint(didDoc, { id: `#${serviceId}` })\n if (!url) {\n throw new InvalidRequestError('could not resolve proxy did service url')\n }\n\n return { did, url, serviceId }\n}\n\n/*\n Utility function that wraps the undici stream() function and handles request\n * and response errors by wrapping them in XRPCError instances. This function is\n * more efficient than \"pipethroughRequest\" when a writable stream to pipe the\n * upstream response to is available.\n /\nasync function pipethroughStream(\n ctx: AppContext,\n req: Request,\n dispatchOptions: Dispatcher.RequestOptions,\n successStreamFactory: Dispatcher.StreamFactory,\n): Promise<void> {\n return new Promise<void>((resolve, reject) => {\n void ctx.proxyAgent\n .stream(dispatchOptions, (upstream) => {\n if (upstream.statusCode >= 400) {\n const passThrough = new PassThrough()\n\n void tryParsingError(upstream.headers, passThrough).then((parsed) => {\n const xrpcError = new PipethroughUpstreamError(upstream, parsed, {\n cause: dispatchOptions,\n })\n\n reject(xrpcError)\n }, reject)\n\n return passThrough\n }\n\n const writable = successStreamFactory(upstream)\n\n // As soon as the control was passed to the writable stream (i.e. by\n // returning the writable hereafter), pipethroughStream() is considered\n // to have succeeded. Any error occurring while writing upstream data to\n // the writable stream should be handled through the stream's error\n // state (i.e. successStreamFactory() must ensure that error events on\n // the returned writable will be handled).\n resolve()\n\n return writable\n })\n // The following catch block will be triggered with either network errors\n // or writable stream errors. In the latter case, the promise will already\n // be resolved, and reject()ing it there after will have no effect. Those\n // error would still be logged by the successStreamFactory() function.\n .catch(handleUpstreamRequestError.bind(req))\n .catch(reject)\n })\n}\n\n/\n Utility function that wraps the undici request() function and handles request\n * and response errors by wrapping them in XRPCError instances.\n /\nasync function pipethroughRequest(\n ctx: AppContext,\n req: Request,\n dispatchOptions: Dispatcher.RequestOptions,\n) {\n // HandlerPipeThroughStream requires a readable stream to be returned, so we\n // use the (less efficient) request() function instead.\n\n const upstream = await ctx.proxyAgent\n .request(dispatchOptions)\n .catch(handleUpstreamRequestError.bind(req))\n\n if (upstream.statusCode >= 400) {\n const parsed = await tryParsingError(upstream.headers, upstream.body)\n\n throw new PipethroughUpstreamError(upstream, parsed, {\n cause: dispatchOptions,\n })\n }\n\n return upstream\n}\n\nfunction handleUpstreamRequestError(\n this: Request,\n err: unknown,\n message = 'Upstream service unreachable',\n): never {\n const logger = isPinoHttpRequest(this) ? this.log : httpLogger\n logger.error({ err }, message)\n throw new XRPCServerError(ResponseType.UpstreamFailure, message, undefined, {\n cause: err,\n })\n}\n\nfunction isPinoHttpRequest(req: Request): req is Request & {\n log: { error: (obj: unknown, msg: string) => void }\n} {\n return typeof (req as { log?: any }).log?.error === 'function'\n}\n\n// Request parsing/forwarding\n// -------------------\n\nexport function isJsonContentType(contentType?: string): boolean \| undefined {\n if (!contentType) return undefined\n return /application\\/(?:\\w+\\+)?json/i.test(contentType)\n}\n\nasync function tryParsingError(\n headers: IncomingHttpHeaders,\n readable: Readable,\n): Promise<{ error?: string; message?: string }> {\n if (isJsonContentType(headers['content-type']) === false) {\n // We don't known how to parse non JSON content types so we can discard the\n // whole response.\n\n // Since we don't care about the response, we would normally just destroy\n // the stream. However, if the underlying HTTP connection is an HTTP/1.1\n // connection, this also destroys the underlying (keep-alive) TCP socket. In\n // order to avoid destroying the TCP socket, while avoiding the cost of\n // consuming too much IO, we give it a chance to finish first.\n\n // @NOTE we need to listen (and ignore) \"error\" events, otherwise the\n // process could crash (since we drain the stream asynchronously here). This\n // is performed through the \"finished\" call below.\n\n const to = setTimeout(() => {\n readable.destroy()\n }, 100)\n finished(readable, (_err) => {\n clearTimeout(to)\n })\n readable.resume()\n\n return {}\n }\n\n try {\n const buffer = await bufferUpstreamResponse(\n readable,\n headers['content-encoding'],\n )\n\n const errInfo: unknown = JSON.parse(buffer.toString('utf8'))\n return {\n error: safeString(errInfo?.['error']),\n message: safeString(errInfo?.['message']),\n }\n } catch (err) {\n // Failed to read, decode, buffer or parse. No big deal.\n return {}\n }\n}\n\nasync function bufferUpstreamResponse(\n readable: Readable,\n contentEncoding?: string \| string[],\n): Promise<Buffer> {\n try {\n return await streamToNodeBuffer(decodeStream(readable, contentEncoding))\n } catch (err) {\n if (!readable.destroyed) readable.destroy()\n\n throw new XRPCServerError(\n ResponseType.UpstreamFailure,\n err instanceof TypeError ? err.message : 'unable to decode request body',\n undefined,\n { cause: err },\n )\n }\n}\n\nexport async function asPipeThroughBuffer(\n input: HandlerPipeThroughStream,\n): Promise<HandlerPipeThroughBuffer> {\n return {\n buffer: await bufferUpstreamResponse(\n input.stream,\n input.headers?.['content-encoding'],\n ),\n headers: omit(input.headers, ['content-encoding', 'content-length']),\n encoding: input.encoding,\n }\n}\n\n// Response parsing/forwarding\n// -------------------\n\nconst RES_HEADERS_TO_FORWARD = [\n 'atproto-repo-rev',\n 'atproto-content-labelers',\n 'retry-after',\n]\n\nfunction responseHeaders(\n headers: IncomingHttpHeaders,\n includeContentHeaders = true,\n): Generator<[string, string]> {\n if (includeContentHeaders) {\n const length = headers['content-length']\n if (length) yield ['content-length', length]\n\n const encoding = headers['content-encoding']\n if (encoding) yield ['content-encoding', encoding]\n\n const type = headers['content-type']\n if (type) yield ['content-type', type]\n\n const language = headers['content-language']\n if (language) yield ['content-language', language]\n }\n\n for (let i = 0; i < RES_HEADERS_TO_FORWARD.length; i++) {\n const name = RES_HEADERS_TO_FORWARD[i]\n const val = headers[name]\n\n if (val != null) {\n const value: string = Array.isArray(val) ? val.join(',') : val\n yield [name, value]\n }\n }\n}\n\n// Utils\n// -------------------\n\n/*\n Performs lexicon method matching on a set of methods,\n * taking into account that they are treated case-insensitively.\n /\nexport class LxmSet {\n private inner: Set<string>\n private original: Iterable<string>\n constructor(items: Iterable<string>) {\n this.inner = new Set(Array.from(items, normalizeLxm))\n this.original = items\n }\n has(lxm: string) {\n return this.inner.has(normalizeLxm(lxm))\n }\n [Symbol.iterator](): Iterator<string> {\n yield* this.original\n }\n}\n\nexport function normalizeLxm(lxm: string) {\n return lxm.toLowerCase()\n}\n\nexport const CHAT_BSKY_METHODS = new LxmSet([\n chat.bsky.actor.deleteAccount.$lxm,\n chat.bsky.actor.exportAccountData.$lxm,\n chat.bsky.convo.deleteMessageForSelf.$lxm,\n chat.bsky.convo.getConvo.$lxm,\n chat.bsky.convo.getConvoForMembers.$lxm,\n chat.bsky.convo.getLog.$lxm,\n chat.bsky.convo.getMessages.$lxm,\n chat.bsky.convo.leaveConvo.$lxm,\n chat.bsky.convo.listConvos.$lxm,\n chat.bsky.convo.muteConvo.$lxm,\n chat.bsky.convo.sendMessage.$lxm,\n chat.bsky.convo.sendMessageBatch.$lxm,\n chat.bsky.convo.unmuteConvo.$lxm,\n chat.bsky.convo.updateRead.$lxm,\n])\n\nexport const PRIVILEGED_METHODS = new LxmSet([\n ...CHAT_BSKY_METHODS,\n com.atproto.server.createAccount.$lxm,\n])\n\n// These endpoints are related to account management and must be used directly,\n// not proxied or service-authed. Service auth may be utilized between PDS and\n// entryway for these methods.\nexport const PROTECTED_METHODS = new LxmSet([\n com.atproto.admin.sendEmail.$lxm,\n com.atproto.identity.requestPlcOperationSignature.$lxm,\n com.atproto.identity.signPlcOperation.$lxm,\n com.atproto.identity.updateHandle.$lxm,\n com.atproto.server.activateAccount.$lxm,\n com.atproto.server.confirmEmail.$lxm,\n com.atproto.server.createAppPassword.$lxm,\n com.atproto.server.deactivateAccount.$lxm,\n com.atproto.server.getAccountInviteCodes.$lxm,\n com.atproto.server.getSession.$lxm,\n com.atproto.server.listAppPasswords.$lxm,\n com.atproto.server.requestAccountDelete.$lxm,\n com.atproto.server.requestEmailConfirmation.$lxm,\n com.atproto.server.requestEmailUpdate.$lxm,\n com.atproto.server.revokeAppPassword.$lxm,\n com.atproto.server.updateEmail.$lxm,\n])\n\nconst defaultService = (\n ctx: AppContext,\n nsid: string,\n): {\n serviceId: string\n serviceInfo: { url: string; did: string } \| null\n} => {\n switch (nsid) {\n case tools.ozone.communication.createTemplate.$lxm:\n case tools.ozone.communication.deleteTemplate.$lxm:\n case tools.ozone.communication.listTemplates.$lxm:\n case tools.ozone.communication.updateTemplate.$lxm:\n case tools.ozone.moderation.cancelScheduledActions.$lxm:\n case tools.ozone.moderation.emitEvent.$lxm:\n case tools.ozone.moderation.getAccountTimeline.$lxm:\n case tools.ozone.moderation.getEvent.$lxm:\n case tools.ozone.moderation.getRecord.$lxm:\n case tools.ozone.moderation.getRepo.$lxm:\n case tools.ozone.moderation.listScheduledActions.$lxm:\n case tools.ozone.moderation.queryEvents.$lxm:\n case tools.ozone.moderation.queryStatuses.$lxm:\n case tools.ozone.moderation.scheduleAction.$lxm:\n case tools.ozone.moderation.searchRepos.$lxm:\n case tools.ozone.safelink.addRule.$lxm:\n case tools.ozone.safelink.queryEvents.$lxm:\n case tools.ozone.safelink.queryRules.$lxm:\n case tools.ozone.safelink.removeRule.$lxm:\n case tools.ozone.safelink.updateRule.$lxm:\n case tools.ozone.team.addMember.$lxm:\n case tools.ozone.team.deleteMember.$lxm:\n case tools.ozone.team.listMembers.$lxm:\n case tools.ozone.team.updateMember.$lxm:\n case tools.ozone.verification.grantVerifications.$lxm:\n case tools.ozone.verification.listVerifications.$lxm:\n case tools.ozone.verification.revokeVerifications.$lxm:\n return {\n serviceId: 'atproto_labeler',\n serviceInfo: ctx.cfg.modService,\n }\n case com.atproto.moderation.createReport.$lxm:\n return {\n serviceId: 'atproto_labeler',\n serviceInfo: ctx.cfg.reportService,\n }\n default:\n return {\n serviceId: 'bsky_appview',\n serviceInfo: ctx.cfg.bskyAppView,\n }\n }\n}\n\nconst safeString = (str: unknown): string \| undefined => {\n return typeof str === 'string' ? str : undefined\n}\n\nfunction logResponseError(this: ServerResponse, err: unknown): void {\n httpLogger.warn({ err }, 'error forwarding upstream response')\n}\n\nexport class PipethroughUpstreamError extends XRPCServerError {\n constructor(\n readonly upstream: {\n statusCode: number\n headers: IncomingHttpHeaders\n },\n payload: { message?: string; error?: string },\n options?: ErrorOptions,\n ) {\n const status =\n upstream.statusCode === 500\n ? ResponseType.UpstreamFailure\n : upstream.statusCode\n\n super(status, payload.message, payload.error, options)\n }\n\n get headers(): Record<string, string> {\n return Object.fromEntries(responseHeaders(this.upstream.headers, false))\n }\n\n get error() {\n return this.customErrorName ?? this.typeName\n }\n}\n"]}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@atproto/pds",
-  "version": "0.5.6",
+  "version": "0.5.8",
   "license": "MIT",
   "description": "Reference implementation of atproto Personal Data Server (PDS)",
   "keywords": [
@@ -40,27 +40,27 @@
     "pino-http": "^8.2.1",
     "typed-emitter": "^2.1.0",
     "uint8arrays": "^5.0.0",
-    "undici": "^6.19.8",
+    "undici": "^8.5.0",
     "zod": "^3.23.8",
-    "@atproto-labs/fetch-node": "^0.3.1",
     "@atproto-labs/simple-store": "^0.4.1",
-    "@atproto-labs/simple-store-memory": "^0.2.1",
-    "@atproto-labs/xrpc-utils": "^0.1.1",
     "@atproto-labs/simple-store-redis": "^0.1.1",
     "@atproto/common": "^0.6.3",
     "@atproto/aws": "^0.3.1",
+    "@atproto-labs/fetch-node": "^0.3.2",
+    "@atproto-labs/xrpc-utils": "^0.1.1",
     "@atproto/crypto": "^0.5.1",
+    "@atproto-labs/simple-store-memory": "^0.2.1",
     "@atproto/did": "^0.5.1",
     "@atproto/identity": "^0.5.1",
-    "@atproto/lex": "^0.1.4",
-    "@atproto/lex-cbor": "^0.1.1",
     "@atproto/lex-data": "^0.1.2",
-    "@atproto/oauth-scopes": "^0.5.1",
-    "@atproto/repo": "^0.10.1",
+    "@atproto/lex-cbor": "^0.1.1",
     "@atproto/lex-json": "^0.1.1",
+    "@atproto/oauth-provider": "^0.19.2",
+    "@atproto/lex": "^0.1.4",
+    "@atproto/repo": "^0.10.1",
+    "@atproto/oauth-scopes": "^0.5.1",
     "@atproto/syntax": "^0.6.2",
     "@atproto/xrpc": "^0.8.1",
-    "@atproto/oauth-provider": "^0.19.0",
     "@atproto/xrpc-server": "^0.11.2"
   },
   "devDependencies": {
@@ -78,10 +78,10 @@
     "puppeteer": "^23.11.1",
     "ts-node": "^10.8.2",
     "ws": "^8.12.0",
-    "@atproto/bsky": "^0.0.243",
+    "@atproto/api": "^0.20.19",
+    "@atproto/bsky": "^0.0.247",
     "@atproto/lex-document": "^0.1.1",
-    "@atproto/oauth-client-browser-example": "^0.1.1",
-    "@atproto/api": "^0.20.16"
+    "@atproto/oauth-client-browser-example": "^0.1.1"
   },
   "type": "module",
   "exports": {

package/src/background.ts CHANGED Viewed

@@ -1,34 +1,65 @@
 import PQueue from 'p-queue'
 import { dbLogger } from './logger.js'
 // A simple queue for in-process, out-of-band/backgrounded work
-export class BackgroundQueue {
-  queue: InstanceType<typeof PQueue> = new PQueue({ concurrency: 5 })
-  destroyed = false
-  constructor() {}
+type Task<TContext> = (ctx: TContext, signal: AbortSignal) => Promise<void>
-  add(task: Task) {
-    if (this.destroyed) {
-      return
-    }
-    this.queue
-      .add(() => task())
-      .catch((err) => {
+export type BackgroundQueueOptions = NonNullable<
+  ConstructorParameters<typeof PQueue>[0]
+> & {
+  concurrency: number
+}
+// @NOTE Keep this in sync with the BackgroundQueue in
+// - packages/bsky/src/data-plane/server/background.ts
+// - packages/ozone/src/background.ts
+// - packages/pds/src/background.ts
+export class BackgroundQueue<TContext = unknown> {
+  private abortController = new AbortController()
+  private queue: PQueue
+  public get signal(): AbortSignal {
+    return this.abortController.signal
+  }
+  public get destroyed() {
+    return this.signal.aborted
+  }
+  constructor(
+    private readonly context: TContext,
+    options?: BackgroundQueueOptions,
+  ) {
+    this.queue = new PQueue(options)
+  }
+  add(task: Task<TContext>) {
+    if (this.destroyed) return
+    this.queue.add<void>(async () => {
+      try {
+        // The task will receive a signal allowing it to abort if the
+        // backgroundQueue is destroyed.
+        await task(this.context, this.signal)
+      } catch (err) {
         dbLogger.error({ err }, 'background queue task failed')
-      })
+      }
+    })
   }
   async processAll() {
-    await this.queue.onIdle()
+    const { queue } = this
+    while (queue.size || queue.pending) await queue.onIdle()
   }
   // On destroy we stop accepting new tasks, but complete all pending/in-progress tasks.
   // The application calls this only once http connections have drained (tasks no longer being added).
   async destroy() {
-    this.destroyed = true
-    await this.queue.onIdle()
+    if (this.destroyed) {
+      dbLogger.warn('BackgroundQueue.destroy() called multiple times')
+    }
+    this.abortController.abort()
+    return this.processAll()
   }
 }
-type Task = () => Promise<void>

package/src/context.ts CHANGED Viewed

@@ -21,12 +21,7 @@ import {
   createServiceAuthHeaders,
   createServiceJwt,
 } from '@atproto/xrpc-server'
-import {
-  Fetch,
-  isUnicastIp,
-  safeFetchWrap,
-  unicastLookup,
-} from '@atproto-labs/fetch-node'
+import { Fetch, safeFetchWrap } from '@atproto-labs/fetch-node'
 import { AccountManager } from './account-manager/account-manager.js'
 import { OAuthStore } from './account-manager/oauth-store.js'
 import { ScopeReferenceGetter } from './account-manager/scope-reference-getter.js'
@@ -47,6 +42,7 @@ import { ImageUrlBuilder } from './image/image-url-builder.js'
 import { fetchLogger, lexiconResolverLogger, oauthLogger } from './logger.js'
 import { ServerMailer } from './mailer/index.js'
 import { ModerationMailer } from './mailer/moderation.js'
+import { buildProxyAgent } from './pipethrough.js'
 import { LocalViewer, LocalViewerCreator } from './read-after-write/viewer.js'
 import { getRedisClient } from './redis.js'
 import { Sequencer } from './sequencer/index.js'
@@ -181,7 +177,7 @@ export class AppContext {
     })
     const plcClient = new plc.Client(cfg.identity.plcUrl)
-    const backgroundQueue = new BackgroundQueue()
+    const backgroundQueue = new BackgroundQueue(undefined, { concurrency: 5 })
     const crawlers = new Crawlers(
       backgroundQueue,
       cfg.service.hostname,
@@ -295,36 +291,7 @@ export class AppContext {
     )
     // An agent for performing HTTP requests based on user provided URLs.
-    const proxyAgentBase = new undici.Agent({
-      allowH2: cfg.proxy.allowHTTP2, // This is experimental
-      headersTimeout: cfg.proxy.headersTimeout,
-      maxResponseSize: cfg.proxy.maxResponseSize,
-      bodyTimeout: cfg.proxy.bodyTimeout,
-      factory: cfg.proxy.disableSsrfProtection
-        ? undefined
-        : (origin, opts) => {
-            const { protocol, hostname } =
-              origin instanceof URL ? origin : new URL(origin)
-            if (protocol !== 'https:') {
-              throw new Error(`Forbidden protocol "${protocol}"`)
-            }
-            if (isUnicastIp(hostname) === false) {
-              throw new Error('Hostname resolved to non-unicast address')
-            }
-            return new undici.Pool(origin, opts)
-          },
-      connect: {
-        lookup: cfg.proxy.disableSsrfProtection ? undefined : unicastLookup,
-      },
-    })
-    const proxyAgent =
-      cfg.proxy.maxRetries > 0
-        ? new undici.RetryAgent(proxyAgentBase, {
-            statusCodes: [], // Only retry on socket errors
-            methods: ['GET', 'HEAD'],
-            maxRetries: cfg.proxy.maxRetries,
-          })
-        : proxyAgentBase
+    const proxyAgent = buildProxyAgent(cfg.proxy)
     /**
      * A fetch() function that protects against SSRF attacks, large responses &

package/src/index.ts CHANGED Viewed

@@ -9,11 +9,8 @@ import http from 'node:http'
 import { PlcClientError } from '@did-plc/lib'
 import cors from 'cors'
 import express from 'express'
-// eslint-disable-next-line import/default, import/no-named-as-default-member
+// eslint-disable-next-line import/default
 import httpTerminator from 'http-terminator'
-// eslint-disable-next-line import/no-named-as-default-member
-const { createHttpTerminator } = httpTerminator
-type HttpTerminator = ReturnType<typeof createHttpTerminator>
 import { DAY, SECOND } from '@atproto/common'
 import {
   MethodHandler,
@@ -64,7 +61,7 @@ export class PDS {
   public ctx: AppContext
   public app: express.Application
   public server?: http.Server
-  private terminator?: HttpTerminator
+  private terminator?: httpTerminator.HttpTerminator
   private dbStatsInterval?: NodeJS.Timeout
   private sequencerStatsInterval?: NodeJS.Timeout
@@ -145,21 +142,42 @@ export class PDS {
     await this.ctx.sequencer.start()
     const server = this.app.listen(this.ctx.cfg.service.port)
     this.server = server
-    this.server.keepAliveTimeout = 90000
-    this.terminator = createHttpTerminator({ server })
+    this.server.keepAliveTimeout = 90_000
+    this.terminator = httpTerminator.createHttpTerminator({ server })
     await events.once(server, 'listening')
     return server
   }
   async destroy(): Promise<void> {
-    await this.ctx.sequencer.destroy()
-    await this.terminator?.terminate()
-    await this.ctx.backgroundQueue.destroy()
-    await this.ctx.accountManager.close()
-    await this.ctx.redisScratch?.quit()
-    await this.ctx.proxyAgent.destroy()
     clearInterval(this.dbStatsInterval)
     clearInterval(this.sequencerStatsInterval)
+    // @TODO Use disposable stack when it becomes available (Node24+)
+    try {
+      await this.terminator?.terminate()
+    } finally {
+      try {
+        await this.ctx.backgroundQueue.destroy()
+      } finally {
+        try {
+          await this.ctx.sequencer.destroy()
+        } finally {
+          try {
+            await this.ctx.accountManager.close()
+          } finally {
+            try {
+              await this.ctx.redisScratch?.quit()
+            } finally {
+              await this.ctx.proxyAgent.destroy()
+            }
+          }
+        }
+      }
+    }
+  }
+  async [Symbol.asyncDispose]() {
+    await this.destroy()
   }
 }