@bluefields/fetcher 0.2.0

package/dist/fetcher-http.d.ts

@@ -0,0 +1,81 @@
+/**
+ * HTTP fetcher adapter (chunk 8).
+ *
+ * Default v1 adapter for environments without Patchright + IPRoyal. Uses
+ * the global fetch with the SSRF-safe undici dispatcher from @bluefields/primitives.
+ * Fingerprint diversity, proxy rotation, browser-level stealth are NOT
+ * implemented here — that's `fetcher-patchright.ts` (env-gated, requires
+ * the Patchright dep + IPRoyal credentials to come online).
+ *
+ * The egressIp returned is the local outbound IP for direct fetches
+ * (we report '0.0.0.0' as a placeholder since the platform doesn't see
+ * its own egress IP without an external service call). When the
+ * Patchright adapter ships, egressIp will be the proxy's egress.
+ */
+import type { FetcherAdapter, RequestCookie } from './types.js';
+/** True for 403/429/503 — statuses whose body can't change the escalate decision (see L1). */
+export declare function isDecisiveBlockStatus(status: number): boolean;
+export interface HttpFetcherOptions {
+    /** Test seam: override the HTTP fetch. */
+    fetchImpl?: typeof fetch;
+    /**
+     * Hard cap (bytes) on the response body buffered into memory; an oversize body
+     * is rejected rather than read in full. Default `DEFAULT_MAX_BODY_BYTES` (5 MiB).
+     */
+    maxBodyBytes?: number;
+}
+/**
+ * Filter cookies that apply to `url` (domain + path match) and serialize
+ * them into a single `Cookie: a=1; b=2` header value.
+ *
+ * Domain match: cookie has no domain → applies; otherwise the request
+ * host must equal the cookie domain or be a subdomain of it (leading dot
+ * is tolerated; we trim it on compare).
+ *
+ * Path match: cookie has no path → applies; otherwise the request path
+ * must start with the cookie path.
+ *
+ * Expired cookies are dropped.
+ */
+export declare function serializeCookiesForRequest(cookies: RequestCookie[], url: string): string;
+export declare function createHttpFetcherAdapter(opts?: HttpFetcherOptions): FetcherAdapter;
+export interface ReadBodyOptions {
+    /** Absolute deadline (Date.now ms) for the whole body read. Omit for no time bound. */
+    deadlineMs?: number;
+    /** Test seam: clock. Default Date.now. */
+    nowMsFn?: () => number;
+}
+/**
+ * Read a response body to a string under a hard byte cap AND a hard time budget,
+ * instead of buffering an unbounded / slow-streaming body. A cheap Content-Length
+ * reject, then a streaming read with a running byte counter; the whole drain is
+ * raced against `deadlineMs` so a slow-trickling or hung body is bounded even
+ * when the request's abort signal does NOT cancel an in-flight read on the
+ * underlying fetch — the real-undici case the perf benchmark exposed (a 1-credit
+ * tier-0 fetch running 90s despite an 8s abort). On cap/timeout we cancel the
+ * stream and throw a plain Error — the route maps it via its existing
+ * `upstream_fetch_failed` branch, so no new customer-facing error shape. Decodes
+ * UTF-8, identical to `Response.text()` (always UTF-8-decodes per the Fetch spec).
+ *
+ * Not an SSRF concern: it runs on an already-validated, already-fetched response.
+ * Exported for testing.
+ */
+export declare function readBodyCapped(res: Response, maxBytes: number, opts?: ReadBodyOptions): Promise<string>;
+/**
+ * Retry on transient network errors with full-jittered exponential backoff
+ * (base 200ms). Successful HTTP responses (including 4xx/5xx) pass through to
+ * the caller — 4xx is permanent, 5xx is retried only once because most 5xx
+ * pages are deliberate (rate limit, maintenance).
+ *
+ * Exported for testing.
+ */
+export declare function fetchWithRetry(fetchImpl: typeof fetch, url: string, init: RequestInit, maxAttempts?: number): Promise<Response>;
+/**
+ * Full-jitter exponential backoff: a uniform random delay in [0, base) where
+ * base = BACKOFF_BASE_MS · 2^attempt. The jitter de-synchronizes retries so a
+ * fleet hammering one flaky origin doesn't retry in lockstep (thundering herd).
+ * `rand` is injectable for tests; Math.random is fine — not security-sensitive.
+ *
+ * Exported for testing.
+ */
+export declare function backoffMs(attempt: number, rand?: () => number): number;

package/dist/fetcher-http.js

@@ -0,0 +1,395 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+/**
+ * HTTP fetcher adapter (chunk 8).
+ *
+ * Default v1 adapter for environments without Patchright + IPRoyal. Uses
+ * the global fetch with the SSRF-safe undici dispatcher from @bluefields/primitives.
+ * Fingerprint diversity, proxy rotation, browser-level stealth are NOT
+ * implemented here — that's `fetcher-patchright.ts` (env-gated, requires
+ * the Patchright dep + IPRoyal credentials to come online).
+ *
+ * The egressIp returned is the local outbound IP for direct fetches
+ * (we report '0.0.0.0' as a placeholder since the platform doesn't see
+ * its own egress IP without an external service call). When the
+ * Patchright adapter ships, egressIp will be the proxy's egress.
+ */
+import { envInt, ssrfSafeFetch, validateUrlForExternalRequest } from '@bluefields/primitives';
+const DEFAULT_TIMEOUT_MS = envInt('BLUEFIELDS_HTTP_TIMEOUT_MS', 30_000);
+const DEFAULT_UA = 'BlueFields-Fetcher/1.0 (+https://bluefields.dev)';
+const FETCHER_ID = 'http-v1';
+/** Placeholder when running without a proxy — real value lands with Patchright. */
+const NO_PROXY_PLACEHOLDER_IP = '0.0.0.0';
+/**
+ * Below this raw-HTML size, a `Set-Cookie` response is likely a consent /
+ * redirect interstitial — worth one cookie'd retry on the same URL before we'd
+ * escalate to the browser tier. Conservative so normal small pages rarely retry.
+ */
+const CONSENT_RETRY_MAX_HTML = 8_192;
+/**
+ * Hard cap on the response body we buffer into memory. Without it a
+ * pathologically large page is read in full before we ever measure it; past
+ * this many bytes we stop reading and reject. The rejection is a plain Error,
+ * so the route surfaces it through its existing `upstream_fetch_failed` mapping
+ * (no new customer-facing error shape). Override per-adapter via
+ * `HttpFetcherOptions.maxBodyBytes`.
+ */
+const DEFAULT_MAX_BODY_BYTES = 5 * 1024 * 1024; // 5 MiB
+/** Base unit for exponential backoff — doubled per attempt, then full-jittered. */
+const BACKOFF_BASE_MS = 200;
+/**
+ * Statuses on which tier-0's body cannot change the escalate decision (perf round, L1).
+ * 403/429/503 are unconditionally escalation-worthy: classifyFetchResult
+ * (`fetcher-escalating.ts`) maps them to `challenge` or `blocked`, both of which
+ * satisfy `needsEscalation()`. So when the escalating layer opts in via
+ * `__earlyClassify`, the HTTP adapter can skip draining the doomed body on these
+ * statuses and let escalation start at time-to-headers. Deliberately kept in sync with
+ * the status branch of `classifyFetchResult` (403/429/503).
+ */
+const DECISIVE_BLOCK_STATUSES = new Set([403, 429, 503]);
+/** True for 403/429/503 — statuses whose body can't change the escalate decision (see L1). */
+export function isDecisiveBlockStatus(status) {
+    return DECISIVE_BLOCK_STATUSES.has(status);
+}
+/**
+ * Filter cookies that apply to `url` (domain + path match) and serialize
+ * them into a single `Cookie: a=1; b=2` header value.
+ *
+ * Domain match: cookie has no domain → applies; otherwise the request
+ * host must equal the cookie domain or be a subdomain of it (leading dot
+ * is tolerated; we trim it on compare).
+ *
+ * Path match: cookie has no path → applies; otherwise the request path
+ * must start with the cookie path.
+ *
+ * Expired cookies are dropped.
+ */
+export function serializeCookiesForRequest(cookies, url) {
+    let host;
+    let pathname;
+    let isHttps;
+    try {
+        const u = new URL(url);
+        host = u.hostname.toLowerCase();
+        pathname = u.pathname || '/';
+        isHttps = u.protocol === 'https:';
+    }
+    catch {
+        return '';
+    }
+    const nowSec = Math.floor(Date.now() / 1000);
+    const matches = [];
+    for (const c of cookies) {
+        if (c.expires && c.expires < nowSec)
+            continue;
+        if (c.secure && !isHttps)
+            continue;
+        if (c.domain) {
+            const dom = c.domain.toLowerCase().replace(/^\./, '');
+            if (host !== dom && !host.endsWith(`.${dom}`))
+                continue;
+        }
+        if (c.path && !pathname.startsWith(c.path))
+            continue;
+        matches.push(`${c.name}=${c.value}`);
+    }
+    return matches.join('; ');
+}
+export function createHttpFetcherAdapter(opts = {}) {
+    // Tests inject opts.fetchImpl; production uses ssrfSafeFetch which
+    // routes through undici's fetch (not Node's global fetch — that
+    // silently ignores the dispatcher field on RequestInit and bypasses
+    // the SSRF lookup entirely).
+    const fetchImpl = (opts.fetchImpl ?? ssrfSafeFetch);
+    const maxBodyBytes = opts.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
+    return {
+        async fetch(url, options) {
+            if (options?.actions && options.actions.length > 0) {
+                throw new Error('HTTP fetcher cannot run page actions; use the Patchright fetcher');
+            }
+            await validateUrlForExternalRequest(url);
+            const timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+            const userAgent = options?.userAgent ?? DEFAULT_UA;
+            const now = options?.nowFn ?? (() => new Date());
+            const controller = new AbortController();
+            const timeout = setTimeout(() => controller.abort(), timeoutMs);
+            const startedAt = Date.now();
+            const fetchedAt = now();
+            // Honest browser-parity content-negotiation + Fetch-Metadata headers.
+            // NOT impersonation: there is no browser-brand claim — the UA stays our
+            // honest token and we deliberately omit `sec-ch-ua`. These are standard
+            // request headers a plain fetch omits that many origins gate real content
+            // on, so adding them lifts tier-0 success and cuts escalation to the
+            // 3-/8-credit tiers. (UA kept honest, 2026-06-15; robots
+            // matching still keys on our product token. `accept-encoding` is left to
+            // undici, which sends gzip/deflate/br and auto-decompresses.)
+            const headers = {
+                'user-agent': userAgent,
+                accept: 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8',
+                'accept-language': 'en-US,en;q=0.9',
+                'sec-fetch-site': 'none',
+                'sec-fetch-mode': 'navigate',
+                'sec-fetch-user': '?1',
+                'sec-fetch-dest': 'document',
+                'upgrade-insecure-requests': '1',
+            };
+            // Caller headers override the defaults; UA from caller wins over the
+            // top-level userAgent option (rare but documented in types.ts).
+            if (options?.headers) {
+                for (const [k, v] of Object.entries(options.headers)) {
+                    headers[k.toLowerCase()] = v;
+                }
+            }
+            // Browser-style cookies → single `Cookie:` request header. Filter by
+            // domain/path so a session save from foo.com doesn't leak its cookies
+            // when re-used against bar.com.
+            if (options?.cookies && options.cookies.length > 0) {
+                const cookieHeader = serializeCookiesForRequest(options.cookies, url);
+                if (cookieHeader)
+                    headers.cookie = cookieHeader;
+            }
+            let res;
+            let html;
+            try {
+                // ssrfSafeFetch (or the injected fetchImpl) already wires the
+                // SSRF-safe dispatcher — no dispatcher field needed here.
+                // Retries: up to 3 attempts with full-jittered exponential backoff
+                // (base 200ms) for transient errors (network blips, 5xx). 4xx
+                // short-circuits — no amount of retrying fixes a 404.
+                res = await fetchWithRetry(fetchImpl, url, {
+                    method: 'GET',
+                    headers,
+                    signal: controller.signal,
+                    redirect: 'follow',
+                });
+                // Bound the body read by the SAME deadline as the fetch (startedAt +
+                // timeoutMs). The read-vs-deadline race in readBodyCapped is the real
+                // bound — the abort signal alone doesn't reliably cancel an in-flight
+                // undici body read (the perf benchmark showed 1-credit tier-0 fetches
+                // running 90-130s past their timeout). Keeping the read inside the
+                // clearTimeout window is belt-and-suspenders for the headers/connect phase.
+                if (options?.__earlyClassify &&
+                    isDecisiveBlockStatus(res.status)) {
+                    // Tier-0 early-block escalation (L1): 403/429/503 are unconditionally
+                    // escalation-worthy upstream and the body cannot change that decision (only
+                    // its challenge-vs-blocked LABEL, which escalates either way). Skip the doomed
+                    // drain so the escalating layer escalates at ~time-to-headers instead of after
+                    // the full (often slow-rolled) block body or the tier-0 fast-fail wall. Cancel
+                    // the stream so undici frees the socket. Coverage-safe: html:'' on these
+                    // statuses re-classifies to `blocked`, which still escalates identically.
+                    await res.body?.cancel().catch(() => undefined);
+                    html = '';
+                }
+                else {
+                    html = await readBodyCapped(res, maxBodyBytes, { deadlineMs: startedAt + timeoutMs });
+                }
+            }
+            finally {
+                clearTimeout(timeout);
+            }
+            // Simple consent-cookie case: a thin 2xx that sets cookies is often a
+            // consent / redirect interstitial. Re-fetch the SAME URL once with those
+            // cookies — cheaper than escalating to the browser tier just to clear a
+            // consent wall. Best-effort (any failure keeps the first response) and
+            // skipped when the caller already supplied cookies. SSRF is re-validated
+            // on the retry URL — never weakened.
+            if (!options?.cookies?.length &&
+                res.status >= 200 &&
+                res.status < 300 &&
+                html.length < CONSENT_RETRY_MAX_HTML) {
+                const setCookies = typeof res.headers.getSetCookie === 'function' ? res.headers.getSetCookie() : [];
+                const cookieHeader = setCookies
+                    .map((c) => c.split(';')[0]?.trim())
+                    .filter((c) => !!c)
+                    .join('; ');
+                if (cookieHeader) {
+                    const retryUrl = res.url || url;
+                    try {
+                        await validateUrlForExternalRequest(retryUrl);
+                        const retryStartedAt = Date.now();
+                        const retryController = new AbortController();
+                        const retryTimer = setTimeout(() => retryController.abort(), timeoutMs);
+                        try {
+                            const res2 = await fetchWithRetry(fetchImpl, retryUrl, {
+                                method: 'GET',
+                                headers: { ...headers, cookie: cookieHeader },
+                                signal: retryController.signal,
+                                redirect: 'follow',
+                            });
+                            const html2 = await readBodyCapped(res2, maxBodyBytes, {
+                                deadlineMs: retryStartedAt + timeoutMs,
+                            });
+                            // Keep the retry only if it actually returned more content.
+                            if (html2.length > html.length) {
+                                html = html2;
+                                res = res2;
+                            }
+                        }
+                        finally {
+                            clearTimeout(retryTimer);
+                        }
+                    }
+                    catch {
+                        // best-effort — keep the first response.
+                    }
+                }
+            }
+            const fetchDurationMs = Math.max(1, Date.now() - startedAt);
+            const responseHeaders = {};
+            res.headers.forEach((value, key) => {
+                responseHeaders[key.toLowerCase()] = value;
+            });
+            return {
+                html,
+                responseStatus: res.status,
+                responseHeaders,
+                fetchedAt,
+                fetchDurationMs,
+                fetcherId: FETCHER_ID,
+                proxyEgressIp: NO_PROXY_PLACEHOLDER_IP,
+                userAgent,
+                rawHtmlSizeBytes: Buffer.byteLength(html, 'utf8'),
+                // HTTP adapter can't render → no screenshot possible. If the
+                // caller needs one, they must route to a browser adapter (Patchright).
+                screenshot: null,
+                // finalUrl after redirects. fetch() follows redirects by default
+                // and exposes res.url with the final URL.
+                finalUrl: res.url || url,
+            };
+        },
+    };
+}
+/**
+ * Read a response body to a string under a hard byte cap AND a hard time budget,
+ * instead of buffering an unbounded / slow-streaming body. A cheap Content-Length
+ * reject, then a streaming read with a running byte counter; the whole drain is
+ * raced against `deadlineMs` so a slow-trickling or hung body is bounded even
+ * when the request's abort signal does NOT cancel an in-flight read on the
+ * underlying fetch — the real-undici case the perf benchmark exposed (a 1-credit
+ * tier-0 fetch running 90s despite an 8s abort). On cap/timeout we cancel the
+ * stream and throw a plain Error — the route maps it via its existing
+ * `upstream_fetch_failed` branch, so no new customer-facing error shape. Decodes
+ * UTF-8, identical to `Response.text()` (always UTF-8-decodes per the Fetch spec).
+ *
+ * Not an SSRF concern: it runs on an already-validated, already-fetched response.
+ * Exported for testing.
+ */
+export async function readBodyCapped(res, maxBytes, opts = {}) {
+    const declared = Number(res.headers.get('content-length'));
+    if (Number.isFinite(declared) && declared > maxBytes) {
+        await res.body?.cancel().catch(() => undefined);
+        throw new Error(`response body exceeds ${maxBytes}-byte cap (declared ${declared})`);
+    }
+    const body = res.body;
+    if (!body)
+        return '';
+    const reader = body.getReader();
+    const drain = async () => {
+        const chunks = [];
+        let total = 0;
+        let chunk = await reader.read();
+        while (!chunk.done) {
+            if (chunk.value) {
+                total += chunk.value.byteLength;
+                if (total > maxBytes) {
+                    throw new Error(`response body exceeds ${maxBytes}-byte cap`);
+                }
+                chunks.push(chunk.value);
+            }
+            chunk = await reader.read();
+        }
+        return Buffer.concat(chunks).toString('utf8');
+    };
+    const now = opts.nowMsFn ?? Date.now;
+    let timer;
+    try {
+        if (opts.deadlineMs === undefined) {
+            return await drain();
+        }
+        const remaining = Math.max(0, opts.deadlineMs - now());
+        // Race the whole drain against the time budget. A slow trickle (many quick
+        // reads over a long total) OR a single hung read both trip this — unlike the
+        // fetch abort signal, which the real undici body stream may ignore mid-read.
+        const timeout = new Promise((_, reject) => {
+            timer = setTimeout(() => reject(new Error(`response body read exceeded ${remaining}ms deadline`)), remaining);
+        });
+        return await Promise.race([drain(), timeout]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+        // Cancel the underlying download (stops a still-pending read on timeout);
+        // swallow any error. No-op once the body has drained.
+        await reader.cancel().catch(() => undefined);
+    }
+}
+/**
+ * Retryable network error codes — single transient blips on these
+ * shouldn't fail a customer-facing fetch.
+ */
+const RETRYABLE_CAUSE_CODES = new Set([
+    'ETIMEDOUT',
+    'ECONNRESET',
+    'ECONNREFUSED',
+    'ENOTFOUND',
+    'EAI_AGAIN',
+    'UND_ERR_SOCKET',
+    'UND_ERR_CONNECT_TIMEOUT',
+    'UND_ERR_HEADERS_TIMEOUT',
+]);
+/**
+ * Retry on transient network errors with full-jittered exponential backoff
+ * (base 200ms). Successful HTTP responses (including 4xx/5xx) pass through to
+ * the caller — 4xx is permanent, 5xx is retried only once because most 5xx
+ * pages are deliberate (rate limit, maintenance).
+ *
+ * Exported for testing.
+ */
+export async function fetchWithRetry(fetchImpl, url, init, maxAttempts = 3) {
+    let lastError;
+    for (let attempt = 0; attempt < maxAttempts; attempt++) {
+        try {
+            const res = await fetchImpl(url, init);
+            // Retry 5xx once at attempt 0 (might be a transient origin blip).
+            if (res.status >= 500 && res.status < 600 && attempt === 0) {
+                await sleep(backoffMs(attempt));
+                continue;
+            }
+            return res;
+        }
+        catch (err) {
+            lastError = err;
+            if (!isRetryable(err) || attempt === maxAttempts - 1)
+                throw err;
+            await sleep(backoffMs(attempt));
+        }
+    }
+    throw lastError;
+}
+function isRetryable(err) {
+    if (!err || typeof err !== 'object')
+        return false;
+    const cause = err.cause;
+    const code = cause?.code ?? err.code;
+    if (typeof code === 'string' && RETRYABLE_CAUSE_CODES.has(code))
+        return true;
+    // Network errors from undici sometimes surface as "fetch failed" with
+    // a cause.code we missed. Retry one more time on any TypeError; if it
+    // was a programmer bug, the second attempt fails identically.
+    return err.name === 'TypeError';
+}
+/**
+ * Full-jitter exponential backoff: a uniform random delay in [0, base) where
+ * base = BACKOFF_BASE_MS · 2^attempt. The jitter de-synchronizes retries so a
+ * fleet hammering one flaky origin doesn't retry in lockstep (thundering herd).
+ * `rand` is injectable for tests; Math.random is fine — not security-sensitive.
+ *
+ * Exported for testing.
+ */
+export function backoffMs(attempt, rand = Math.random) {
+    const base = BACKOFF_BASE_MS * 2 ** attempt;
+    return Math.floor(rand() * base);
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=fetcher-http.js.map

package/dist/fetcher-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetcher-http.js","sourceRoot":"","sources":["../src/fetcher-http.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AAK9F,MAAM,kBAAkB,GAAG,MAAM,CAAC,4BAA4B,EAAE,MAAM,CAAC,CAAC;AACxE,MAAM,UAAU,GAAG,kDAAkD,CAAC;AACtE,MAAM,UAAU,GAAG,SAAS,CAAC;AAC7B,mFAAmF;AACnF,MAAM,uBAAuB,GAAG,SAAS,CAAC;AAC1C;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,KAAK,CAAC;AACrC;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ;AACxD,mFAAmF;AACnF,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B;;;;;;;;GAQG;AACH,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAE9E,8FAA8F;AAC9F,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,OAAO,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC7C,CAAC;AAYD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAwB,EAAE,GAAW;IAC9E,IAAI,IAAY,CAAC;IACjB,IAAI,QAAgB,CAAC;IACrB,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAChC,QAAQ,GAAG,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC;QAC7B,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,GAAG,MAAM;YAAE,SAAS;QAC9C,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO;YAAE,SAAS;QACnC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACtD,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC;gBAAE,SAAS;QAC1D,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,SAAS;QACrD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAA2B,EAAE;IACpE,mEAAmE;IACnE,gEAAgE;IAChE,oEAAoE;IACpE,6BAA6B;IAC7B,MAAM,SAAS,GAAiB,CAAC,IAAI,CAAC,SAAS,IAAI,aAAa,CAAiB,CAAC;IAClF,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,sBAAsB,CAAC;IAEjE,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO;YACtB,IAAI,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnD,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,6BAA6B,CAAC,GAAG,CAAC,CAAC;YAEzC,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,kBAAkB,CAAC;YAC3D,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,UAAU,CAAC;YACnD,MAAM,GAAG,GAAG,OAAO,EAAE,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YAEjD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;YAChE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;YAExB,sEAAsE;YACtE,wEAAwE;YACxE,wEAAwE;YACxE,0EAA0E;YAC1E,qEAAqE;YACrE,yDAAyD;YACzD,yEAAyE;YACzE,8DAA8D;YAC9D,MAAM,OAAO,GAA2B;gBACtC,YAAY,EAAE,SAAS;gBACvB,MAAM,EACJ,kGAAkG;gBACpG,iBAAiB,EAAE,gBAAgB;gBACnC,gBAAgB,EAAE,MAAM;gBACxB,gBAAgB,EAAE,UAAU;gBAC5B,gBAAgB,EAAE,IAAI;gBACtB,gBAAgB,EAAE,UAAU;gBAC5B,2BAA2B,EAAE,GAAG;aACjC,CAAC;YACF,qEAAqE;YACrE,gEAAgE;YAChE,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;gBACrB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;oBACrD,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;YACD,qEAAqE;YACrE,sEAAsE;YACtE,gCAAgC;YAChC,IAAI,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnD,MAAM,YAAY,GAAG,0BAA0B,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;gBACtE,IAAI,YAAY;oBAAE,OAAO,CAAC,MAAM,GAAG,YAAY,CAAC;YAClD,CAAC;YAED,IAAI,GAAa,CAAC;YAClB,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,8DAA8D;gBAC9D,0DAA0D;gBAC1D,mEAAmE;gBACnE,8DAA8D;gBAC9D,sDAAsD;gBACtD,GAAG,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE;oBACzC,MAAM,EAAE,KAAK;oBACb,OAAO;oBACP,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,QAAQ,EAAE,QAAQ;iBACnB,CAAC,CAAC;gBACH,qEAAqE;gBACrE,sEAAsE;gBACtE,sEAAsE;gBACtE,sEAAsE;gBACtE,mEAAmE;gBACnE,4EAA4E;gBAC5E,IACG,OAA4C,EAAE,eAAe;oBAC9D,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,EACjC,CAAC;oBACD,sEAAsE;oBACtE,4EAA4E;oBAC5E,+EAA+E;oBAC/E,+EAA+E;oBAC/E,+EAA+E;oBAC/E,yEAAyE;oBACzE,0EAA0E;oBAC1E,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;oBAChD,IAAI,GAAG,EAAE,CAAC;gBACZ,CAAC;qBAAM,CAAC;oBACN,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,UAAU,EAAE,SAAS,GAAG,SAAS,EAAE,CAAC,CAAC;gBACxF,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;YAED,sEAAsE;YACtE,yEAAyE;YACzE,wEAAwE;YACxE,uEAAuE;YACvE,yEAAyE;YACzE,qCAAqC;YACrC,IACE,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM;gBACzB,GAAG,CAAC,MAAM,IAAI,GAAG;gBACjB,GAAG,CAAC,MAAM,GAAG,GAAG;gBAChB,IAAI,CAAC,MAAM,GAAG,sBAAsB,EACpC,CAAC;gBACD,MAAM,UAAU,GACd,OAAO,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnF,MAAM,YAAY,GAAG,UAAU;qBAC5B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;qBACnC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;qBAC/B,IAAI,CAAC,IAAI,CAAC,CAAC;gBACd,IAAI,YAAY,EAAE,CAAC;oBACjB,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;oBAChC,IAAI,CAAC;wBACH,MAAM,6BAA6B,CAAC,QAAQ,CAAC,CAAC;wBAC9C,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;wBAClC,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;wBAC9C,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;wBACxE,IAAI,CAAC;4BACH,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,QAAQ,EAAE;gCACrD,MAAM,EAAE,KAAK;gCACb,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE;gCAC7C,MAAM,EAAE,eAAe,CAAC,MAAM;gCAC9B,QAAQ,EAAE,QAAQ;6BACnB,CAAC,CAAC;4BACH,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,YAAY,EAAE;gCACrD,UAAU,EAAE,cAAc,GAAG,SAAS;6BACvC,CAAC,CAAC;4BACH,4DAA4D;4BAC5D,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;gCAC/B,IAAI,GAAG,KAAK,CAAC;gCACb,GAAG,GAAG,IAAI,CAAC;4BACb,CAAC;wBACH,CAAC;gCAAS,CAAC;4BACT,YAAY,CAAC,UAAU,CAAC,CAAC;wBAC3B,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,yCAAyC;oBAC3C,CAAC;gBACH,CAAC;YACH,CAAC;YAED,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;YAE5D,MAAM,eAAe,GAA2B,EAAE,CAAC;YACnD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;gBACjC,eAAe,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC;YAC7C,CAAC,CAAC,CAAC;YAEH,OAAO;gBACL,IAAI;gBACJ,cAAc,EAAE,GAAG,CAAC,MAAM;gBAC1B,eAAe;gBACf,SAAS;gBACT,eAAe;gBACf,SAAS,EAAE,UAAU;gBACrB,aAAa,EAAE,uBAAuB;gBACtC,SAAS;gBACT,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC;gBACjD,6DAA6D;gBAC7D,uEAAuE;gBACvE,UAAU,EAAE,IAAI;gBAChB,iEAAiE;gBACjE,0CAA0C;gBAC1C,QAAQ,EAAE,GAAG,CAAC,GAAG,IAAI,GAAG;aACzB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AASD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAa,EACb,QAAgB,EAChB,OAAwB,EAAE;IAE1B,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;QACrD,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,uBAAuB,QAAQ,GAAG,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAEhC,MAAM,KAAK,GAAG,KAAK,IAAqB,EAAE;QACxC,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAChC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBAChB,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;gBAChC,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;oBACrB,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,WAAW,CAAC,CAAC;gBAChE,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC;YACD,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC,CAAC;IAEF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC;IACrC,IAAI,KAAgD,CAAC;IACrD,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,MAAM,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC,CAAC;QACvD,2EAA2E;QAC3E,6EAA6E;QAC7E,6EAA6E;QAC7E,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;YAC/C,KAAK,GAAG,UAAU,CAChB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,+BAA+B,SAAS,aAAa,CAAC,CAAC,EAC9E,SAAS,CACV,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAChD,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/B,0EAA0E;QAC1E,sDAAsD;QACtD,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,WAAW;IACX,YAAY;IACZ,cAAc;IACd,WAAW;IACX,WAAW;IACX,gBAAgB;IAChB,yBAAyB;IACzB,yBAAyB;CAC1B,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,SAAuB,EACvB,GAAW,EACX,IAAiB,EACjB,WAAW,GAAG,CAAC;IAEf,IAAI,SAAkB,CAAC;IACvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACvC,kEAAkE;YAClE,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;gBAC3D,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;gBAChC,SAAS;YACX,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,GAAG,GAAG,CAAC;YAChB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,WAAW,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;YAChE,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,MAAM,SAAkB,CAAC;AAC3B,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,KAAK,GAAI,GAAqC,CAAC,KAAK,CAAC;IAC3D,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,IAAK,GAAyB,CAAC,IAAI,CAAC;IAC5D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,sEAAsE;IACtE,sEAAsE;IACtE,8DAA8D;IAC9D,OAAQ,GAAyB,CAAC,IAAI,KAAK,WAAW,CAAC;AACzD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,OAAqB,IAAI,CAAC,MAAM;IACzE,MAAM,IAAI,GAAG,eAAe,GAAG,CAAC,IAAI,OAAO,CAAC;IAC5C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}