@bjorntech/key-ferry 0.0.0-stage → 0.1.4

package/dist/relay/index.js

@@ -0,0 +1,480 @@
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { Agent as HttpAgent, createServer, request as httpRequest, } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { PassThrough } from "node:stream";
+import { connect as tlsConnect } from "node:tls";
+import { Data, Effect } from "effect";
+export const RELAY_AUTH_HEADER = "x-varlock-relay-token";
+export class RelayError extends Data.TaggedError("RelayError") {
+}
+const maxDefault = 4 * 1024 * 1024;
+const connectDefault = 10_000;
+const idleDefault = 120_000;
+const connectionsDefault = 32;
+const routesDefault = 256;
+const hopByHop = new Set([
+    "connection",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+]);
+const rejectedCredentialHeaders = new Set(["authorization", "cookie", "proxy-authorization"]);
+const failure = (code) => new RelayError({ code, message: `relay ${code}` });
+const parseUrl = (value, allowHttps) => {
+    try {
+        const url = new URL(value);
+        if ((!allowHttps && url.protocol !== "http:" && url.protocol !== "https:") ||
+            (allowHttps && url.protocol !== "https:"))
+            return undefined;
+        if (url.username || url.password || url.hash)
+            return undefined;
+        return url;
+    }
+    catch {
+        return undefined;
+    }
+};
+const isLoopback = (address) => address === "127.0.0.1" || address === "::1" || address === "::ffff:127.0.0.1";
+const cleanHeaders = (headers, configured, target) => {
+    const result = {};
+    for (const [name, value] of Object.entries(headers)) {
+        const lower = name.toLowerCase();
+        if (lower === RELAY_AUTH_HEADER || hopByHop.has(lower) || lower === "host")
+            continue;
+        const replacement = configured[lower];
+        if (replacement !== undefined) {
+            result[lower] = replacement;
+            continue;
+        }
+        if (rejectedCredentialHeaders.has(lower))
+            continue;
+        if (value !== undefined)
+            result[lower] = value;
+    }
+    // The native MCP adapter deliberately does not carry credential headers.
+    // Inject the complete allowlisted set here, including headers absent from
+    // the downstream request, so authentication does not depend on clients
+    // echoing a header name back to the relay.
+    for (const [name, value] of Object.entries(configured))
+        result[name.toLowerCase()] = value;
+    result.host = target.host;
+    result["accept-encoding"] = "identity";
+    return result;
+};
+const responseHeaders = (headers, upstream, localOrigin, register) => {
+    const result = {};
+    for (const [name, value] of Object.entries(headers)) {
+        const lower = name.toLowerCase();
+        if (hopByHop.has(lower))
+            continue;
+        if (value === undefined)
+            continue;
+        if (lower === "location") {
+            const location = Array.isArray(value) ? value[0] : value;
+            if (location === undefined)
+                continue;
+            try {
+                const target = new URL(location, upstream);
+                if (target.protocol !== "https:" ||
+                    target.origin !== upstream.origin ||
+                    target.username ||
+                    target.password ||
+                    target.hash)
+                    continue;
+                register(target);
+                result["location"] = `${localOrigin}${target.pathname}${target.search}`;
+            }
+            catch {
+                continue;
+            }
+        }
+        else
+            result[lower] = value;
+    }
+    return result;
+};
+const write = (res, chunk, signal) => {
+    if (res.write(chunk))
+        return Promise.resolve();
+    return new Promise((resolve, reject) => {
+        const done = () => {
+            cleanup();
+            resolve();
+        };
+        const fail = () => {
+            cleanup();
+            reject(failure("closed"));
+        };
+        const cleanup = () => {
+            res.removeListener("drain", done);
+            res.removeListener("close", fail);
+            signal.removeEventListener("abort", fail);
+        };
+        res.once("drain", done);
+        res.once("close", fail);
+        signal.addEventListener("abort", fail, { once: true });
+    });
+};
+const endpointRewrite = async function* (source, upstream, localOrigin, register, maxFrame) {
+    const decoder = new TextDecoder();
+    let pending = "";
+    let frame = "";
+    const emit = (value) => new TextEncoder().encode(value);
+    for await (const chunk of source) {
+        pending += decoder.decode(chunk, { stream: true });
+        if (pending.length > maxFrame * 2)
+            throw failure("body-too-large");
+        let index;
+        while ((index = pending.indexOf("\n")) >= 0) {
+            const line = pending.slice(0, index + 1);
+            pending = pending.slice(index + 1);
+            frame += line;
+            if (frame.length > maxFrame)
+                throw failure("body-too-large");
+            if (line === "\n" || line === "\r\n") {
+                const match = frame.match(/(^|\r?\n)event:\s*endpoint\s*\r?\n(?:data:\s*)([^\r\n]+)(?:\r?\n|$)/);
+                if (match) {
+                    let endpoint;
+                    try {
+                        endpoint = new URL(match[2], upstream);
+                    }
+                    catch {
+                        throw failure("path-denied");
+                    }
+                    if (endpoint.protocol !== "https:" ||
+                        endpoint.origin !== upstream.origin ||
+                        endpoint.username ||
+                        endpoint.password ||
+                        endpoint.hash)
+                        throw failure("path-denied");
+                    register(endpoint);
+                    frame = frame.replace(match[2], `${localOrigin}${endpoint.pathname}${endpoint.search}`);
+                }
+                yield emit(frame);
+                frame = "";
+            }
+        }
+    }
+    pending += decoder.decode();
+    if (pending)
+        frame += pending;
+    if (frame)
+        yield emit(frame);
+};
+const throughProxy = (target, proxy, ca, method, headers, body, connectTimeout, idleTimeout, signal) => new Promise((resolve, reject) => {
+    const connectRequest = (proxy.protocol === "https:" ? httpsRequest : httpRequest)({
+        hostname: proxy.hostname,
+        port: proxy.port || (proxy.protocol === "https:" ? 443 : 80),
+        method: "CONNECT",
+        path: `${target.hostname}:${target.port || 443}`,
+        timeout: connectTimeout,
+    });
+    let settled = false;
+    let tls;
+    let request;
+    const fail = () => {
+        if (!settled) {
+            settled = true;
+            reject(failure("upstream-connect-failed"));
+        }
+    };
+    const cancel = () => {
+        connectRequest.destroy();
+        tls?.destroy();
+        request?.destroy();
+        if (!settled) {
+            settled = true;
+            reject(failure("closed"));
+        }
+    };
+    signal.addEventListener("abort", cancel, { once: true });
+    connectRequest.once("error", fail);
+    connectRequest.once("timeout", () => {
+        connectRequest.destroy();
+        if (!settled) {
+            settled = true;
+            reject(failure("timeout"));
+        }
+    });
+    connectRequest.once("connect", (response, socket) => {
+        if (response.statusCode !== 200) {
+            socket.destroy();
+            fail();
+            return;
+        }
+        try {
+            tls = tlsConnect({ socket, servername: target.hostname, ca, rejectUnauthorized: true });
+        }
+        catch {
+            socket.destroy();
+            if (!settled) {
+                settled = true;
+                reject(failure("upstream-tls-failed"));
+            }
+            return;
+        }
+        tls.once("error", () => {
+            if (!settled) {
+                settled = true;
+                reject(failure("upstream-tls-failed"));
+            }
+        });
+        tls.once("secureConnect", () => {
+            // The CONNECT socket is already a verified TLS connection to the
+            // Varlock MITM endpoint. Pass that socket to the plain HTTP framing
+            // API so no second TLS layer is created or validated.
+            class TunnelAgent extends HttpAgent {
+                createConnection(_options, callback) {
+                    const socket = tls;
+                    callback?.(null, socket);
+                    return socket;
+                }
+            }
+            const socketAgent = new TunnelAgent({ keepAlive: false });
+            request = httpRequest({
+                hostname: target.hostname,
+                port: target.port || 443,
+                path: `${target.pathname}${target.search}`,
+                method,
+                headers,
+                agent: socketAgent,
+                timeout: idleTimeout,
+            });
+            request.once("error", () => {
+                if (!settled) {
+                    settled = true;
+                    reject(failure("upstream-connect-failed"));
+                }
+            });
+            const clientRequest = request;
+            clientRequest.once("timeout", () => clientRequest.destroy(failure("timeout")));
+            request.once("response", (upstreamResponse) => {
+                settled = true;
+                signal.removeEventListener("abort", cancel);
+                resolve({
+                    statusCode: upstreamResponse.statusCode ?? 502,
+                    headers: upstreamResponse.headers,
+                    body: upstreamResponse,
+                });
+            });
+            if (body)
+                body.pipe(request);
+            else
+                request.end();
+        });
+    });
+    connectRequest.end();
+});
+const start = (config) => {
+    const upstream = parseUrl(config.upstreamUrl, true);
+    const proxy = parseUrl(config.proxyUrl, false);
+    if (!upstream || !proxy || config.oauth !== false || !config.managerCaPem)
+        return Effect.fail(failure("invalid-config"));
+    const maxBytes = config.maxRequestBytes ?? maxDefault;
+    const maxConnections = config.maxConnections ?? connectionsDefault;
+    if (!Number.isSafeInteger(maxBytes) ||
+        maxBytes < 1 ||
+        !Number.isSafeInteger(maxConnections) ||
+        maxConnections < 1)
+        return Effect.fail(failure("invalid-config"));
+    return Effect.acquireRelease(Effect.callback((resume) => {
+        let server;
+        const token = randomBytes(32).toString("base64url");
+        const tokenBytes = Buffer.from(token);
+        const sockets = new Set();
+        const routes = new Map();
+        const baseKey = `${upstream.pathname}${upstream.search}`;
+        routes.set(baseKey, upstream);
+        let active = 0;
+        let listening = false;
+        let stopped = false;
+        const controllers = new Set();
+        const localOrigin = () => {
+            const address = server.address();
+            return address && typeof address !== "string"
+                ? `http://127.0.0.1:${address.port}`
+                : "http://127.0.0.1";
+        };
+        const register = (target) => {
+            const key = `${target.pathname}${target.search}`;
+            if (routes.has(key))
+                return;
+            if (routes.size >= routesDefault)
+                throw failure("path-denied");
+            routes.set(key, target);
+        };
+        const reject = (res, status) => {
+            if (!res.headersSent)
+                res.writeHead(status, { "content-type": "text/plain", "content-length": "0" });
+            res.end();
+        };
+        const handle = (req, res) => Effect.tryPromise({
+            try: async () => {
+                if (stopped || !isLoopback(req.socket.remoteAddress))
+                    return reject(res, 403);
+                const supplied = req.headers[RELAY_AUTH_HEADER];
+                const received = typeof supplied === "string" ? Buffer.from(supplied) : Buffer.alloc(0);
+                if (received.length !== tokenBytes.length || !timingSafeEqual(received, tokenBytes))
+                    return reject(res, 401);
+                const rawPath = req.url ?? "/";
+                const target = routes.get(rawPath);
+                if (!target || target.origin !== upstream.origin)
+                    return reject(res, 404);
+                if (!new Set(["GET", "POST", "DELETE"]).has(req.method ?? "GET"))
+                    return reject(res, 405);
+                if (active >= maxConnections)
+                    return reject(res, 429);
+                const length = req.headers["content-length"];
+                if (length && Number(length) > maxBytes)
+                    return reject(res, 413);
+                active++;
+                const controller = new AbortController();
+                controllers.add(controller);
+                let finished = false;
+                const cancel = () => {
+                    if (!finished && !res.writableEnded)
+                        controller.abort();
+                };
+                req.once("aborted", cancel);
+                res.once("close", cancel);
+                const body = new PassThrough();
+                let bytes = 0;
+                let oversized = false;
+                let bodyTimer;
+                const resetBodyTimer = () => {
+                    if (bodyTimer)
+                        clearTimeout(bodyTimer);
+                    bodyTimer = setTimeout(() => {
+                        controller.abort();
+                        body.destroy(failure("timeout"));
+                        req.destroy();
+                    }, config.idleTimeoutMs ?? idleDefault);
+                };
+                resetBodyTimer();
+                req.on("data", (chunk) => {
+                    resetBodyTimer();
+                    bytes += chunk.byteLength;
+                    if (bytes > maxBytes && !oversized) {
+                        oversized = true;
+                        body.destroy(failure("body-too-large"));
+                        req.destroy();
+                    }
+                });
+                req.on("end", () => {
+                    if (bodyTimer)
+                        clearTimeout(bodyTimer);
+                    body.end();
+                });
+                req.on("error", (cause) => body.destroy(cause));
+                req.pipe(body);
+                try {
+                    const upstreamResponse = await throughProxy(target, proxy, config.managerCaPem, req.method ?? "GET", cleanHeaders(req.headers, Object.fromEntries(Object.entries(config.placeholderHeaders).map(([k, v]) => [k.toLowerCase(), v])), target), req.method === "GET" || req.method === "HEAD" ? undefined : body, config.connectTimeoutMs ?? connectDefault, config.idleTimeoutMs ?? idleDefault, controller.signal);
+                    controller.signal.addEventListener("abort", () => upstreamResponse.body.destroy(), {
+                        once: true,
+                    });
+                    const headers = responseHeaders(upstreamResponse.headers, upstream, localOrigin(), register);
+                    const contentType = typeof headers["content-type"] === "string" ? headers["content-type"] : "";
+                    const rewrittenSse = contentType.toLowerCase().includes("text/event-stream");
+                    if (rewrittenSse &&
+                        headers["content-encoding"] !== undefined &&
+                        headers["content-encoding"] !== "identity")
+                        throw failure("unsupported");
+                    if (rewrittenSse) {
+                        delete headers["content-length"];
+                        delete headers["content-encoding"];
+                    }
+                    const stream = rewrittenSse
+                        ? endpointRewrite(upstreamResponse.body, upstream, localOrigin(), register, maxBytes)
+                        : upstreamResponse.body;
+                    const iterator = stream[Symbol.asyncIterator]();
+                    const first = await iterator.next();
+                    res.writeHead(upstreamResponse.statusCode, headers);
+                    if (!first.done)
+                        await write(res, first.value, controller.signal);
+                    for await (const chunk of { [Symbol.asyncIterator]: () => iterator })
+                        await write(res, chunk, controller.signal);
+                    res.end();
+                }
+                catch (cause) {
+                    // A response may already have been obtained when SSE rewriting,
+                    // backpressure, or endpoint validation fails. Abort the shared
+                    // controller in every failure path so the CONNECT tunnel and
+                    // upstream response cannot outlive this request.
+                    controller.abort();
+                    if (!res.headersSent)
+                        reject(res, oversized ? 413 : 502);
+                    else
+                        res.destroy();
+                }
+                finally {
+                    finished = true;
+                    controllers.delete(controller);
+                    req.removeListener("aborted", cancel);
+                    res.removeListener("close", cancel);
+                    if (bodyTimer)
+                        clearTimeout(bodyTimer);
+                    active--;
+                }
+            },
+            catch: () => failure("io"),
+        }).pipe(Effect.asVoid, Effect.catch(() => Effect.void));
+        server = createServer((req, res) => {
+            void Effect.runFork(handle(req, res));
+        });
+        server.maxConnections = maxConnections;
+        server.on("connection", (socket) => {
+            sockets.add(socket);
+            socket.once("close", () => sockets.delete(socket));
+        });
+        server.once("error", () => {
+            if (!listening)
+                resume(Effect.fail(failure("bind-failed")));
+        });
+        server.listen(0, "127.0.0.1", () => {
+            listening = true;
+            const address = server.address();
+            if (!address || typeof address === "string") {
+                resume(Effect.fail(failure("bind-failed")));
+                return;
+            }
+            const localUrl = `http://127.0.0.1:${address.port}${upstream.pathname}${upstream.search}`;
+            const stop = Effect.suspend(() => {
+                if (stopped)
+                    return Effect.void;
+                stopped = true;
+                for (const controller of controllers)
+                    controller.abort();
+                for (const socket of sockets)
+                    socket.destroy();
+                return Effect.tryPromise({
+                    try: () => new Promise((resolve) => server.close(() => resolve())),
+                    catch: () => failure("closed"),
+                }).pipe(Effect.asVoid);
+            });
+            resume(Effect.succeed({
+                localUrl,
+                downstreamToken: token,
+                health: Effect.sync(() => ({
+                    listening: listening && !stopped,
+                    activeRequests: active,
+                    localUrl,
+                })),
+                stop,
+            }));
+        });
+        return Effect.sync(() => {
+            stopped = true;
+            for (const controller of controllers)
+                controller.abort();
+            for (const socket of sockets)
+                socket.destroy();
+            server?.close();
+        });
+    }), (relay) => relay.stop.pipe(Effect.catch(() => Effect.void)));
+};
+export const startRelay = start;
+//# sourceMappingURL=index.js.map

package/dist/relay/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/relay/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EACL,KAAK,IAAI,SAAS,EAClB,YAAY,EACZ,OAAO,IAAI,WAAW,GAIvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AAErD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEtC,MAAM,CAAC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAezD,MAAM,OAAO,UAAW,SAAQ,IAAI,CAAC,WAAW,CAAC,YAAY,CAG3D;CAAG;AA4BL,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACnC,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,WAAW,GAAG,OAAO,CAAC;AAC5B,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;IACvB,YAAY;IACZ,YAAY;IACZ,oBAAoB;IACpB,qBAAqB;IACrB,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;CACV,CAAC,CAAC;AACH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,QAAQ,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAE9F,MAAM,OAAO,GAAG,CAAC,IAAoB,EAAc,EAAE,CACnD,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC;AAErD,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAE,UAAmB,EAAmB,EAAE;IACvE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IACE,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;YACtE,CAAC,UAAU,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;YAEzC,OAAO,SAAS,CAAC;QACnB,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC/D,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,OAA2B,EAAW,EAAE,CAC1D,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,kBAAkB,CAAC;AAEjF,MAAM,YAAY,GAAG,CACnB,OAAmC,EACnC,UAA4C,EAC5C,MAAW,EACwB,EAAE;IACrC,MAAM,MAAM,GAAsC,EAAE,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,KAAK,KAAK,iBAAiB,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,MAAM;YAAE,SAAS;QACrF,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,IAAI,yBAAyB,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QACnD,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;IACjD,CAAC;IACD,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;IACvE,2CAA2C;IAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC;IAC3F,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAC1B,MAAM,CAAC,iBAAiB,CAAC,GAAG,UAAU,CAAC;IACvC,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CACtB,OAAsD,EACtD,QAAa,EACb,WAAmB,EACnB,QAA4B,EAC5B,EAAE;IACF,MAAM,MAAM,GAAsC,EAAE,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QAClC,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACzD,IAAI,QAAQ,KAAK,SAAS;gBAAE,SAAS;YACrC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBAC3C,IACE,MAAM,CAAC,QAAQ,KAAK,QAAQ;oBAC5B,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;oBACjC,MAAM,CAAC,QAAQ;oBACf,MAAM,CAAC,QAAQ;oBACf,MAAM,CAAC,IAAI;oBAEX,SAAS;gBACX,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACjB,MAAM,CAAC,UAAU,CAAC,GAAG,GAAG,WAAW,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YAC1E,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;;YAAM,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,KAAK,GAAG,CAAC,GAAmB,EAAE,KAAiB,EAAE,MAAmB,EAAiB,EAAE;IAC3F,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC/C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,GAAG,EAAE;YAChB,OAAO,EAAE,CAAC;YACV,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,GAAG,EAAE;YAChB,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5B,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAClC,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAClC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACxB,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACxB,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,KAAK,SAAS,CAAC,EACrC,MAAiC,EACjC,QAAa,EACb,WAAmB,EACnB,QAA4B,EAC5B,QAAgB;IAEhB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACjC,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,MAAM,GAAG,QAAQ,GAAG,CAAC;YAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC;QACV,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACzC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACnC,KAAK,IAAI,IAAI,CAAC;YACd,IAAI,KAAK,CAAC,MAAM,GAAG,QAAQ;gBAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAC7D,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CACvB,qEAAqE,CACtE,CAAC;gBACF,IAAI,KAAK,EAAE,CAAC;oBACV,IAAI,QAAa,CAAC;oBAClB,IAAI,CAAC;wBACH,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;oBACzC,CAAC;oBAAC,MAAM,CAAC;wBACP,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;oBAC/B,CAAC;oBACD,IACE,QAAQ,CAAC,QAAQ,KAAK,QAAQ;wBAC9B,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;wBACnC,QAAQ,CAAC,QAAQ;wBACjB,QAAQ,CAAC,QAAQ;wBACjB,QAAQ,CAAC,IAAI;wBAEb,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;oBAC/B,QAAQ,CAAC,QAAQ,CAAC,CAAC;oBACnB,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,WAAW,GAAG,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC1F,CAAC;gBACD,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClB,KAAK,GAAG,EAAE,CAAC;YACb,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAC5B,IAAI,OAAO;QAAE,KAAK,IAAI,OAAO,CAAC;IAC9B,IAAI,KAAK;QAAE,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CACnB,MAAW,EACX,KAAU,EACV,EAAU,EACV,MAAc,EACd,OAA0C,EAC1C,IAA6B,EAC7B,cAAsB,EACtB,WAAmB,EACnB,MAAmB,EAKlB,EAAE,CACH,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,MAAM,cAAc,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAChF,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,EAAE,SAAS;QACjB,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,IAAI,GAAG,EAAE;QAChD,OAAO,EAAE,cAAc;KACxB,CAAC,CAAC;IACH,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,GAA6C,CAAC;IAClD,IAAI,OAAsD,CAAC;IAC3D,MAAM,IAAI,GAAG,GAAG,EAAE;QAChB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,cAAc,CAAC,OAAO,EAAE,CAAC;QACzB,GAAG,EAAE,OAAO,EAAE,CAAC;QACf,OAAO,EAAE,OAAO,EAAE,CAAC;QACnB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC,CAAC;IACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACnC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;QAClC,cAAc,CAAC,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC,CAAC,CAAC;IACH,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;QAClD,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;YAChC,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,GAAG,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC;YACzC,CAAC;YACD,OAAO;QACT,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACrB,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC;YACzC,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE;YAC7B,iEAAiE;YACjE,oEAAoE;YACpE,sDAAsD;YACtD,MAAM,WAAY,SAAQ,SAAS;gBACxB,gBAAgB,CACvB,QAAsD,EACtD,QAAuD;oBAEvD,MAAM,MAAM,GAAG,GAAI,CAAC;oBACpB,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;oBACzB,OAAO,MAAM,CAAC;gBAChB,CAAC;aACF;YACD,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1D,OAAO,GAAG,WAAW,CAAC;gBACpB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,GAAG;gBACxB,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE;gBAC1C,MAAM;gBACN,OAAO;gBACP,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,WAAW;aACrB,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;gBACzB,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,GAAG,IAAI,CAAC;oBACf,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC;gBAC7C,CAAC;YACH,CAAC,CAAC,CAAC;YACH,MAAM,aAAa,GAAG,OAAO,CAAC;YAC9B,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAC/E,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,gBAAgB,EAAE,EAAE;gBAC5C,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC5C,OAAO,CAAC;oBACN,UAAU,EAAE,gBAAgB,CAAC,UAAU,IAAI,GAAG;oBAC9C,OAAO,EAAE,gBAAgB,CAAC,OAAO;oBACjC,IAAI,EAAE,gBAAgB;iBACvB,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,IAAI,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;;gBACxB,OAAO,CAAC,GAAG,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,cAAc,CAAC,GAAG,EAAE,CAAC;AACvB,CAAC,CAAC,CAAC;AAEL,MAAM,KAAK,GAAG,CACZ,MAAmB,EACmD,EAAE;IACxE,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,YAAY;QACvE,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,eAAe,IAAI,UAAU,CAAC;IACtD,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,kBAAkB,CAAC;IACnE,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC;QAC/B,QAAQ,GAAG,CAAC;QACZ,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC;QACrC,cAAc,GAAG,CAAC;QAElB,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAEhD,OAAO,MAAM,CAAC,cAAc,CAC1B,MAAM,CAAC,QAAQ,CAA0B,CAAC,MAAM,EAAE,EAAE;QAClD,IAAI,MAAc,CAAC;QACnB,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAe,CAAC;QACtC,MAAM,OAAO,GAAG,GAAG,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QACzD,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC9B,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAmB,CAAC;QAC/C,MAAM,WAAW,GAAG,GAAG,EAAE;YACvB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,OAAO,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;gBAC3C,CAAC,CAAC,oBAAqB,OAAuB,CAAC,IAAI,EAAE;gBACrD,CAAC,CAAC,kBAAkB,CAAC;QACzB,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,CAAC,MAAW,EAAE,EAAE;YAC/B,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YACjD,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO;YAC5B,IAAI,MAAM,CAAC,IAAI,IAAI,aAAa;gBAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;YAC/D,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC1B,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,GAAmB,EAAE,MAAc,EAAE,EAAE;YACrD,IAAI,CAAC,GAAG,CAAC,WAAW;gBAClB,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC;YACjF,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,GAAoB,EAAE,GAAmB,EAA8B,EAAE,CACvF,MAAM,CAAC,UAAU,CAAC;YAChB,GAAG,EAAE,KAAK,IAAI,EAAE;gBACd,IAAI,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC;oBAAE,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC9E,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;gBAChD,MAAM,QAAQ,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACxF,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,UAAU,CAAC;oBACjF,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC1B,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;gBAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACnC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;oBAAE,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC1E,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;oBAC9D,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC1B,IAAI,MAAM,IAAI,cAAc;oBAAE,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACtD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;gBAC7C,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,QAAQ;oBAAE,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACjE,MAAM,EAAE,CAAC;gBACT,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;gBACzC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAC5B,IAAI,QAAQ,GAAG,KAAK,CAAC;gBACrB,MAAM,MAAM,GAAG,GAAG,EAAE;oBAClB,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,aAAa;wBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;gBAC1D,CAAC,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;gBAC5B,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC1B,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;gBAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;gBACd,IAAI,SAAS,GAAG,KAAK,CAAC;gBACtB,IAAI,SAAoD,CAAC;gBACzD,MAAM,cAAc,GAAG,GAAG,EAAE;oBAC1B,IAAI,SAAS;wBAAE,YAAY,CAAC,SAAS,CAAC,CAAC;oBACvC,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;wBAC1B,UAAU,CAAC,KAAK,EAAE,CAAC;wBACnB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;wBACjC,GAAG,CAAC,OAAO,EAAE,CAAC;oBAChB,CAAC,EAAE,MAAM,CAAC,aAAa,IAAI,WAAW,CAAC,CAAC;gBAC1C,CAAC,CAAC;gBACF,cAAc,EAAE,CAAC;gBACjB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;oBAC/B,cAAc,EAAE,CAAC;oBACjB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;oBAC1B,IAAI,KAAK,GAAG,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;wBACnC,SAAS,GAAG,IAAI,CAAC;wBACjB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;wBACxC,GAAG,CAAC,OAAO,EAAE,CAAC;oBAChB,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACjB,IAAI,SAAS;wBAAE,YAAY,CAAC,SAAS,CAAC,CAAC;oBACvC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACb,CAAC,CAAC,CAAC;gBACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;gBAChD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACf,IAAI,CAAC;oBACH,MAAM,gBAAgB,GAAG,MAAM,YAAY,CACzC,MAAM,EACN,KAAK,EACL,MAAM,CAAC,YAAY,EACnB,GAAG,CAAC,MAAM,IAAI,KAAK,EACnB,YAAY,CACV,GAAG,CAAC,OAAO,EACX,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAChF,EACD,MAAM,CACP,EACD,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAChE,MAAM,CAAC,gBAAgB,IAAI,cAAc,EACzC,MAAM,CAAC,aAAa,IAAI,WAAW,EACnC,UAAU,CAAC,MAAM,CAClB,CAAC;oBACF,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE;wBACjF,IAAI,EAAE,IAAI;qBACX,CAAC,CAAC;oBACH,MAAM,OAAO,GAAG,eAAe,CAC7B,gBAAgB,CAAC,OAAO,EACxB,QAAQ,EACR,WAAW,EAAE,EACb,QAAQ,CACT,CAAC;oBACF,MAAM,WAAW,GACf,OAAO,OAAO,CAAC,cAAc,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7E,MAAM,YAAY,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;oBAC7E,IACE,YAAY;wBACZ,OAAO,CAAC,kBAAkB,CAAC,KAAK,SAAS;wBACzC,OAAO,CAAC,kBAAkB,CAAC,KAAK,UAAU;wBAE1C,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;oBAC/B,IAAI,YAAY,EAAE,CAAC;wBACjB,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC;wBACjC,OAAO,OAAO,CAAC,kBAAkB,CAAC,CAAC;oBACrC,CAAC;oBACD,MAAM,MAAM,GAAG,YAAY;wBACzB,CAAC,CAAC,eAAe,CACb,gBAAgB,CAAC,IAAI,EACrB,QAAQ,EACR,WAAW,EAAE,EACb,QAAQ,EACR,QAAQ,CACT;wBACH,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC;oBAC1B,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;oBAChD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;oBACpC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;oBACpD,IAAI,CAAC,KAAK,CAAC,IAAI;wBAAE,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;oBAClE,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE;wBAClE,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;oBAC7C,GAAG,CAAC,GAAG,EAAE,CAAC;gBACZ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,gEAAgE;oBAChE,+DAA+D;oBAC/D,6DAA6D;oBAC7D,iDAAiD;oBACjD,UAAU,CAAC,KAAK,EAAE,CAAC;oBACnB,IAAI,CAAC,GAAG,CAAC,WAAW;wBAAE,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;;wBACpD,GAAG,CAAC,OAAO,EAAE,CAAC;gBACrB,CAAC;wBAAS,CAAC;oBACT,QAAQ,GAAG,IAAI,CAAC;oBAChB,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;oBAC/B,GAAG,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;oBACtC,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;oBACpC,IAAI,SAAS;wBAAE,YAAY,CAAC,SAAS,CAAC,CAAC;oBACvC,MAAM,EAAE,CAAC;gBACX,CAAC;YACH,CAAC;YACD,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAChC,CAAC;QACJ,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACjC,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,cAAc,GAAG,cAAc,CAAC;QACvC,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE;YACjC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACxB,IAAI,CAAC,SAAS;gBAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,SAAS,GAAG,IAAI,CAAC;YACjB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC5C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;gBAC5C,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,oBAAoB,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC1F,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC/B,IAAI,OAAO;oBAAE,OAAO,MAAM,CAAC,IAAI,CAAC;gBAChC,OAAO,GAAG,IAAI,CAAC;gBACf,KAAK,MAAM,UAAU,IAAI,WAAW;oBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;gBACzD,KAAK,MAAM,MAAM,IAAI,OAAO;oBAAE,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC/C,OAAO,MAAM,CAAC,UAAU,CAAC;oBACvB,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;oBACxE,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;iBAC/B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACzB,CAAC,CAAC,CAAC;YACH,MAAM,CACJ,MAAM,CAAC,OAAO,CAAC;gBACb,QAAQ;gBACR,eAAe,EAAE,KAAK;gBACtB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;oBACzB,SAAS,EAAE,SAAS,IAAI,CAAC,OAAO;oBAChC,cAAc,EAAE,MAAM;oBACtB,QAAQ;iBACT,CAAC,CAAC;gBACH,IAAI;aACL,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;YACtB,OAAO,GAAG,IAAI,CAAC;YACf,KAAK,MAAM,UAAU,IAAI,WAAW;gBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;YACzD,KAAK,MAAM,MAAM,IAAI,OAAO;gBAAE,MAAM,CAAC,OAAO,EAAE,CAAC;YAC/C,MAAM,EAAE,KAAK,EAAE,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,EACF,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAC5D,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC"}

package/dist/remote.d.ts

@@ -0,0 +1,62 @@
+import { Effect, Scope } from "effect";
+import type { ServerProtection } from "./options.js";
+/** Must stay in sync with the standalone relay implementation. */
+export declare const RELAY_AUTH_HEADER = "x-varlock-relay-token";
+export interface RemoteRelayConfig {
+    readonly upstreamUrl: string;
+    readonly proxyUrl: string;
+    readonly managerCaPem: string;
+    readonly placeholderHeaders: Readonly<Record<string, string>>;
+    readonly oauth: false;
+    readonly maxRequestBytes?: number;
+    readonly connectTimeoutMs?: number;
+    readonly idleTimeoutMs?: number;
+    readonly maxConnections?: number;
+}
+export interface RemoteRelayHealth {
+    readonly listening: boolean;
+    readonly activeRequests: number;
+    readonly localUrl: string;
+}
+export interface RemoteRelayHandle {
+    readonly localUrl: string;
+    /** Internal capability. Never expose this in status, RPC, logs, or TUI. */
+    readonly downstreamToken: string;
+    readonly health: Effect.Effect<RemoteRelayHealth, unknown>;
+    readonly stop: Effect.Effect<void, unknown>;
+}
+export type RemoteRelayFactory = (config: RemoteRelayConfig) => Effect.Effect<RemoteRelayHandle, unknown, Scope.Scope>;
+export interface RemoteServerSnapshot {
+    readonly type: "remote";
+    readonly url: string;
+    readonly headers?: Readonly<Record<string, string>>;
+    readonly oauth?: unknown;
+    readonly disabled?: boolean;
+    readonly codemode?: boolean;
+    readonly timeout?: unknown;
+    readonly protocol?: unknown;
+}
+export interface RemoteDiagnostic {
+    readonly code: "remote_unavailable" | "remote_invalid_url" | "remote_oauth_required" | "remote_missing_placeholder" | "remote_invalid_header" | "remote_relay_failed";
+    readonly server: string;
+    readonly message: string;
+}
+export declare function isRemoteProtection(value: ServerProtection): value is Extract<ServerProtection, {
+    readonly remote: unknown;
+}>;
+export declare function sourceEnvironmentKeys(mapping: ServerProtection): readonly string[];
+export declare function validateRemoteUrl(value: string, allowPrivateNetwork?: boolean): URL;
+/** Remove mapped and dangerous configured headers from the native loopback config. */
+export declare function safeForwardHeaders(headers: Readonly<Record<string, string>> | undefined, mapping: Extract<ServerProtection, {
+    readonly remote: unknown;
+}>): Readonly<Record<string, string>> | undefined;
+export interface RemoteRelayCoordinator {
+    readonly handles: ReadonlyMap<string, RemoteRelayHandle>;
+    readonly diagnostics: readonly RemoteDiagnostic[];
+    readonly reconcile: (servers: ReadonlyMap<string, RemoteServerSnapshot>, mappings: Readonly<Record<string, ServerProtection>>, environment: Readonly<Record<string, string>>, generation: number) => Effect.Effect<void, never, Scope.Scope>;
+    readonly health: Effect.Effect<boolean>;
+    readonly stopAll: Effect.Effect<void>;
+}
+/** Coordinates relay replacement without exposing relay tokens or secrets. */
+export declare function makeRemoteRelayCoordinator(factory: RemoteRelayFactory | undefined, allowPrivateNetwork?: boolean): RemoteRelayCoordinator;
+//# sourceMappingURL=remote.d.ts.map

package/dist/remote.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../src/remote.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,kEAAkE;AAClE,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AAEzD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9D,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;IAC3D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;CAC7C;AAED,MAAM,MAAM,kBAAkB,GAAG,CAC/B,MAAM,EAAE,iBAAiB,KACtB,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;AAE5D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EACT,oBAAoB,GACpB,oBAAoB,GACpB,uBAAuB,GACvB,4BAA4B,GAC5B,uBAAuB,GACvB,qBAAqB,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AA+BD,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,gBAAgB,GACtB,KAAK,IAAI,OAAO,CAAC,gBAAgB,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC,CAElE;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,MAAM,EAAE,CAKlF;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,mBAAmB,UAAQ,GAAG,GAAG,CAgBjF;AA4BD,sFAAsF;AACtF,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,EACrD,OAAO,EAAE,OAAO,CAAC,gBAAgB,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC,GAC/D,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAmB9C;AAuCD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACzD,QAAQ,CAAC,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAClD,QAAQ,CAAC,SAAS,EAAE,CAClB,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,EAClD,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,EACpD,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAC7C,UAAU,EAAE,MAAM,KACf,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,8EAA8E;AAC9E,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,kBAAkB,GAAG,SAAS,EACvC,mBAAmB,UAAQ,GAC1B,sBAAsB,CAqJxB"}