@bluefields/primitives 0.2.0

package/dist/ssrf.js

@@ -0,0 +1,432 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * SSRF-safe URL validation and HTTP client (Reviews #6, #7, #10).
+ *
+ * Every URL that crosses a trust boundary into our platform — customer
+ * webhook URLs, customer watch URLs, MCP scrape_url arguments — must pass
+ * through `validateUrlForExternalRequest` before we make any outbound
+ * request. The validator is the first line of defense; `createSsrfSafeHttpClient`
+ * is the second, catching DNS rebinding by re-validating at connect time.
+ *
+ * This module is reused widely. Two rules to keep in mind when extending it:
+ *   1. Default-deny. Add new categories to the deny side; don't allowlist exceptions.
+ *   2. Validate, don't sanitize. We reject bad URLs; we never massage them into
+ *      "fixed" URLs and proceed.
+ */
+import { lookup as dnsLookup } from 'node:dns/promises';
+import { isIPv4, isIPv6 } from 'node:net';
+import { Agent, ProxyAgent, fetch as undiciFetch } from 'undici';
+export class SsrfValidationError extends Error {
+    reason;
+    constructor(message, reason) {
+        super(message);
+        this.name = 'SsrfValidationError';
+        this.reason = reason;
+    }
+}
+// Hostnames that are known metadata services — reject before DNS even runs.
+const METADATA_HOSTNAMES = new Set([
+    'metadata.google.internal',
+    'metadata.goog',
+    'metadata',
+]);
+// Internal-only domains the platform owns — reject before DNS.
+// Matches both the bare domain and any subdomain.
+const INTERNAL_DOMAIN_SUFFIXES = ['bluefields.dev', 'internal.bluefields.dev'];
+const HTTPS_PROTOCOL = 'https:';
+/**
+ * Validate that `url` is safe to use for an outbound HTTPS request.
+ *
+ * Throws `SsrfValidationError` on any rejection. Callers should treat the
+ * error as a 4xx validation failure (not a 5xx server error).
+ */
+export async function validateUrlForExternalRequest(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new SsrfValidationError(`URL did not parse: ${url}`, 'invalid_url');
+    }
+    if (parsed.protocol !== HTTPS_PROTOCOL) {
+        throw new SsrfValidationError(`unsupported protocol: ${parsed.protocol} (only https is allowed)`, 'unsupported_protocol');
+    }
+    // WHATWG URL returns IPv6 hostnames in bracketed form (`[::1]`); strip
+    // brackets so `isIPv6` and the IP-range predicates see the bare literal.
+    // Also lowercase defensively even though the parser already normalizes it.
+    const hostname = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    if (METADATA_HOSTNAMES.has(hostname)) {
+        throw new SsrfValidationError(`metadata endpoint blocked: ${hostname}`, 'metadata_endpoint');
+    }
+    for (const suffix of INTERNAL_DOMAIN_SUFFIXES) {
+        if (hostname === suffix || hostname.endsWith(`.${suffix}`)) {
+            throw new SsrfValidationError(`internal domain blocked: ${hostname}`, 'internal_domain');
+        }
+    }
+    // If the URL is an IP literal (brackets already stripped above), validate
+    // it directly without DNS.
+    if (isIPv4(hostname) || isIPv6(hostname)) {
+        if (isPrivateOrReservedIp(hostname)) {
+            throw new SsrfValidationError(`private/reserved IP blocked: ${hostname}`, 'private_ip');
+        }
+        return;
+    }
+    // Resolve via DNS. `all: true` surfaces every record so we can catch the
+    // multi-A-record attack where one address is public and another is private.
+    // The `as const` is required for TS to pick the LookupAllOptions overload.
+    let addresses;
+    try {
+        addresses = await dnsLookup(hostname, { all: true, verbatim: true });
+    }
+    catch (err) {
+        throw new SsrfValidationError(`DNS lookup failed for ${hostname}: ${err.message}`, 'dns_failure');
+    }
+    for (const addr of addresses) {
+        if (isPrivateOrReservedIp(addr.address)) {
+            throw new SsrfValidationError(`${hostname} resolves to private/reserved IP ${addr.address}`, 'private_ip');
+        }
+    }
+}
+/**
+ * Returns true if `ip` is in any private, reserved, loopback, link-local,
+ * multicast, broadcast, documentation, or AWS-metadata range — anything we
+ * don't want our platform's egress to reach. Exported so tests can verify
+ * each category and other callers (e.g. attestation manifest integrity
+ * checks on `proxy_egress_ip`) can reuse the same predicate.
+ */
+export function isPrivateOrReservedIp(ip) {
+    if (isIPv4(ip))
+        return isIPv4PrivateOrReserved(ip);
+    if (isIPv6(ip))
+        return isIPv6PrivateOrReserved(ip);
+    // Unrecognized format — fail closed.
+    return true;
+}
+function ipv4ToUint32(ip) {
+    const parts = ip.split('.');
+    if (parts.length !== 4)
+        return Number.NaN;
+    let n = 0;
+    for (const p of parts) {
+        if (!/^\d{1,3}$/.test(p))
+            return Number.NaN;
+        const v = Number(p);
+        if (v < 0 || v > 255)
+            return Number.NaN;
+        n = (n << 8) | v;
+    }
+    return n >>> 0;
+}
+function isIPv4PrivateOrReserved(ip) {
+    const n = ipv4ToUint32(ip);
+    if (!Number.isFinite(n))
+        return true;
+    // 0.0.0.0/8 — "this network" / unspecified
+    if (n <= 0x00ffffff)
+        return true;
+    // 10.0.0.0/8
+    if (n >= 0x0a000000 && n <= 0x0affffff)
+        return true;
+    // 100.64.0.0/10 — Carrier-grade NAT (RFC 6598)
+    if (n >= 0x64400000 && n <= 0x647fffff)
+        return true;
+    // 127.0.0.0/8 — loopback
+    if (n >= 0x7f000000 && n <= 0x7fffffff)
+        return true;
+    // 169.254.0.0/16 — link-local (includes 169.254.169.254 metadata)
+    if (n >= 0xa9fe0000 && n <= 0xa9feffff)
+        return true;
+    // 172.16.0.0/12
+    if (n >= 0xac100000 && n <= 0xac1fffff)
+        return true;
+    // 192.0.0.0/24 — IETF Protocol Assignments
+    if (n >= 0xc0000000 && n <= 0xc00000ff)
+        return true;
+    // 192.0.2.0/24 — TEST-NET-1
+    if (n >= 0xc0000200 && n <= 0xc00002ff)
+        return true;
+    // 192.168.0.0/16
+    if (n >= 0xc0a80000 && n <= 0xc0a8ffff)
+        return true;
+    // 198.18.0.0/15 — benchmarking
+    if (n >= 0xc6120000 && n <= 0xc613ffff)
+        return true;
+    // 198.51.100.0/24 — TEST-NET-2
+    if (n >= 0xc6336400 && n <= 0xc63364ff)
+        return true;
+    // 203.0.113.0/24 — TEST-NET-3
+    if (n >= 0xcb007100 && n <= 0xcb0071ff)
+        return true;
+    // 224.0.0.0/4 — multicast
+    if (n >= 0xe0000000 && n <= 0xefffffff)
+        return true;
+    // 240.0.0.0/4 — reserved (includes 255.255.255.255 broadcast)
+    if (n >= 0xf0000000)
+        return true;
+    return false;
+}
+/**
+ * Expand any valid IPv6 textual representation (including shorthand and
+ * IPv4-mapped forms) into a 16-byte buffer. Returns null on malformed input.
+ *
+ * Implemented inline rather than via a library because the policy "default
+ * deny on parse failure" is integral to the SSRF defense — a bug in a
+ * permissive parser would silently allow attacker-controlled inputs.
+ */
+function expandIPv6(ip) {
+    let cleaned = ip.toLowerCase();
+    // Strip surrounding brackets if present.
+    if (cleaned.startsWith('[') && cleaned.endsWith(']')) {
+        cleaned = cleaned.slice(1, -1);
+    }
+    // Strip zone identifier (% suffix) — link-local sometimes carries it.
+    const zoneIdx = cleaned.indexOf('%');
+    if (zoneIdx !== -1)
+        cleaned = cleaned.slice(0, zoneIdx);
+    // Detect IPv4 tail (e.g. ::ffff:192.0.2.1 or ::192.0.2.1).
+    const lastColon = cleaned.lastIndexOf(':');
+    const tail = lastColon === -1 ? '' : cleaned.slice(lastColon + 1);
+    let head = cleaned;
+    let v4Bytes = null;
+    if (tail.includes('.')) {
+        if (!isIPv4(tail))
+            return null;
+        const v4 = ipv4ToUint32(tail);
+        if (!Number.isFinite(v4))
+            return null;
+        v4Bytes = [(v4 >>> 24) & 0xff, (v4 >>> 16) & 0xff, (v4 >>> 8) & 0xff, v4 & 0xff];
+        head = cleaned.slice(0, lastColon);
+    }
+    // Split on the at-most-one "::" run.
+    const parts = head.split('::');
+    if (parts.length > 2)
+        return null;
+    const left = parts[0] ? parts[0].split(':') : [];
+    const right = parts.length === 2 && parts[1] ? parts[1].split(':') : [];
+    const wantWords = v4Bytes ? 6 : 8;
+    let words;
+    if (parts.length === 1) {
+        if (left.length !== wantWords)
+            return null;
+        words = left;
+    }
+    else {
+        const missing = wantWords - left.length - right.length;
+        if (missing < 0)
+            return null;
+        words = [...left, ...new Array(missing).fill('0'), ...right];
+    }
+    const out = new Uint8Array(16);
+    for (let i = 0; i < words.length; i++) {
+        const w = words[i];
+        if (!/^[0-9a-f]{1,4}$/.test(w))
+            return null;
+        const v = Number.parseInt(w, 16);
+        if (!Number.isInteger(v) || v < 0 || v > 0xffff)
+            return null;
+        out[i * 2] = (v >>> 8) & 0xff;
+        out[i * 2 + 1] = v & 0xff;
+    }
+    if (v4Bytes) {
+        out[12] = v4Bytes[0];
+        out[13] = v4Bytes[1];
+        out[14] = v4Bytes[2];
+        out[15] = v4Bytes[3];
+    }
+    return out;
+}
+function isIPv6PrivateOrReserved(ip) {
+    const b = expandIPv6(ip);
+    if (!b)
+        return true;
+    // :: — unspecified
+    let allZero = true;
+    for (let i = 0; i < 16; i++) {
+        if (b[i] !== 0) {
+            allZero = false;
+            break;
+        }
+    }
+    if (allZero)
+        return true;
+    // ::1 — loopback
+    let loopback = true;
+    for (let i = 0; i < 15; i++) {
+        if (b[i] !== 0) {
+            loopback = false;
+            break;
+        }
+    }
+    if (loopback && b[15] === 1)
+        return true;
+    // ::ffff:0:0/96 — IPv4-mapped. Bytes 0-9 = 0, bytes 10-11 = 0xff. Tail
+    // is an IPv4 address; defer to the IPv4 predicate so we catch e.g.
+    // ::ffff:127.0.0.1 as loopback.
+    let mappedPrefix = true;
+    for (let i = 0; i < 10; i++) {
+        if (b[i] !== 0) {
+            mappedPrefix = false;
+            break;
+        }
+    }
+    if (mappedPrefix && b[10] === 0xff && b[11] === 0xff) {
+        const v4 = `${b[12]}.${b[13]}.${b[14]}.${b[15]}`;
+        return isIPv4PrivateOrReserved(v4);
+    }
+    // 64:ff9b::/96 — IPv4/IPv6 translation (RFC 6052)
+    if (b[0] === 0x00 && b[1] === 0x64 && b[2] === 0xff && b[3] === 0x9b) {
+        let zerosOk = true;
+        for (let i = 4; i < 12; i++) {
+            if (b[i] !== 0) {
+                zerosOk = false;
+                break;
+            }
+        }
+        if (zerosOk) {
+            const v4 = `${b[12]}.${b[13]}.${b[14]}.${b[15]}`;
+            return isIPv4PrivateOrReserved(v4);
+        }
+    }
+    // 100::/64 — discard-only address block (RFC 6666)
+    if (b[0] === 0x01 && b[1] === 0x00 && b[2] === 0 && b[3] === 0) {
+        let zerosOk = true;
+        for (let i = 4; i < 8; i++) {
+            if (b[i] !== 0) {
+                zerosOk = false;
+                break;
+            }
+        }
+        if (zerosOk)
+            return true;
+    }
+    // 2001:db8::/32 — documentation
+    if (b[0] === 0x20 && b[1] === 0x01 && b[2] === 0x0d && b[3] === 0xb8)
+        return true;
+    // fc00::/7 — Unique Local Addresses (covers fd00:ec2::/64 AWS IPv6 metadata)
+    if ((b[0] & 0xfe) === 0xfc)
+        return true;
+    // fe80::/10 — link-local
+    if (b[0] === 0xfe && (b[1] & 0xc0) === 0x80)
+        return true;
+    // ff00::/8 — multicast
+    if (b[0] === 0xff)
+        return true;
+    return false;
+}
+/**
+ * Undici lookup callback that re-validates each candidate address at
+ * connect time. Exported for testability; created via
+ * `createSsrfSafeHttpClient` for production use.
+ *
+ * The signature matches Node's `dns.lookup` callback so undici can call it
+ * as its `connect.lookup`. We always do an `all: true` lookup internally so
+ * a multi-record DNS response can't slip a private IP past us by chance of
+ * record ordering — we only return a public one.
+ */
+export function ssrfSafeLookup(hostname, options, callback) {
+    // undici (and node:net.connect) may pass family as a number (0/4/6) or
+    // as the strings 'IPv4'/'IPv6'. Normalize to a number for dns.lookup.
+    let family = 0;
+    if (typeof options.family === 'number')
+        family = options.family;
+    else if (options.family === 'IPv4')
+        family = 4;
+    else if (options.family === 'IPv6')
+        family = 6;
+    dnsLookup(hostname, { all: true, family, verbatim: true }).then((addresses) => {
+        // Defend against malformed dns.lookup results that contain entries
+        // with no address (observed in some Node + Alpine combinations on
+        // hosts that have both IPv4 + IPv6 A records but one record family
+        // returns partial data). Drop those before checking private-IP-ness
+        // so we don't hand undici an `undefined` host.
+        const publicOnes = addresses.filter((a) => typeof a.address === 'string' &&
+            a.address.length > 0 &&
+            !isPrivateOrReservedIp(a.address));
+        if (publicOnes.length === 0) {
+            callback(new SsrfValidationError(`${hostname} has no public IP addresses at connect time`, 'private_ip'), '', 0);
+            return;
+        }
+        // undici 6.x calls this lookup with options.all === true,
+        // expecting callback(err, Array<{address, family}>). Node's net
+        // module uses the legacy options.all === false form,
+        // callback(err, address, family). Honor both.
+        const wantAll = options.all === true;
+        if (wantAll) {
+            // biome-ignore lint/suspicious/noExplicitAny: array-form callback overload
+            callback(null, publicOnes);
+        }
+        else {
+            const first = publicOnes[0];
+            callback(null, first.address, first.family);
+        }
+    }, (err) => callback(err, '', 0));
+}
+/**
+ * Diagnostic helper — fetch a URL through an arbitrary HTTP proxy.
+ * Used by the /debug/diagnostics/proxy-test endpoint to verify
+ * provider reachability from inside the api container without going
+ * through Patchright/Chromium. Not for production traffic; the
+ * standard fetcher path uses ssrfSafeFetch.
+ *
+ * The target `url` is SSRF-validated up front (it can't go through the
+ * connect-time `ssrfSafeLookup`, since the dispatcher connects to the proxy,
+ * not the target). The proxy itself is operator-supplied via the admin-gated
+ * diagnostic, so it isn't validated here.
+ */
+export async function proxyFetch(url, proxy, timeoutMs = 15_000) {
+    // Defense-in-depth: reject a private/metadata/internal target before we
+    // route it through the proxy (the connect-time lookup can't see it here).
+    await validateUrlForExternalRequest(url);
+    // Embed user:pass directly in the proxy URL — undici's ProxyAgent
+    // expects this style; the `token` option is for bearer-style tokens,
+    // not Basic auth.
+    const u = new URL(proxy.server);
+    u.username = encodeURIComponent(proxy.username);
+    u.password = encodeURIComponent(proxy.password);
+    const agent = new ProxyAgent({
+        uri: u.toString(),
+        connectTimeout: timeoutMs,
+        bodyTimeout: timeoutMs,
+        headersTimeout: timeoutMs,
+    });
+    // biome-ignore lint/suspicious/noExplicitAny: undici dispatcher extension
+    return undiciFetch(url, { dispatcher: agent });
+}
+/**
+ * SSRF-safe fetch helper — uses undici's fetch (not Node's global fetch)
+ * because Node's global fetch silently ignores the `dispatcher` field
+ * on RequestInit. Re-uses one dispatcher per process for efficiency.
+ *
+ * Callers that just want "fetch this URL, refuse if it resolves to a
+ * private IP" should use this instead of constructing the dispatcher
+ * themselves.
+ */
+let sharedSsrfDispatcher = null;
+export async function ssrfSafeFetch(url, init) {
+    if (!sharedSsrfDispatcher)
+        sharedSsrfDispatcher = createSsrfSafeHttpClient();
+    // biome-ignore lint/suspicious/noExplicitAny: undici extension
+    return undiciFetch(url, {
+        ...init,
+        dispatcher: sharedSsrfDispatcher,
+    });
+}
+/**
+ * Build an undici Agent that pins each connection to a public IP and
+ * times out at 10s. Use this dispatcher wherever the platform makes an
+ * outbound request on behalf of a customer (webhook delivery, fetcher
+ * Tier 0, MCP scrape_url backend).
+ *
+ * Redirects: undici re-runs the dispatcher (and thus our lookup) for each
+ * new host encountered, so a redirect to a private IP is rejected at
+ * connect time the same way the original URL would be. Callers should
+ * still pass `maxRedirections` explicitly per-request — the default is 0.
+ */
+export function createSsrfSafeHttpClient() {
+    return new Agent({
+        headersTimeout: 10_000,
+        bodyTimeout: 10_000,
+        connect: { lookup: ssrfSafeLookup },
+    });
+}
+//# sourceMappingURL=ssrf.js.map

package/dist/ssrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.js","sourceRoot":"","sources":["../src/ssrf.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,IAAI,WAAW,EAAE,MAAM,QAAQ,CAAC;AAUjE,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,MAAM,CAAsB;IACrC,YAAY,OAAe,EAAE,MAA2B;QACtD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAS;IACzC,0BAA0B;IAC1B,eAAe;IACf,UAAU;CACX,CAAC,CAAC;AAEH,+DAA+D;AAC/D,kDAAkD;AAClD,MAAM,wBAAwB,GAAG,CAAC,gBAAgB,EAAE,yBAAyB,CAAC,CAAC;AAE/E,MAAM,cAAc,GAAG,QAAQ,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,GAAW;IAC7D,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,mBAAmB,CAAC,sBAAsB,GAAG,EAAE,EAAE,aAAa,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;QACvC,MAAM,IAAI,mBAAmB,CAC3B,yBAAyB,MAAM,CAAC,QAAQ,0BAA0B,EAClE,sBAAsB,CACvB,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,yEAAyE;IACzE,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAEvE,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,mBAAmB,CAAC,8BAA8B,QAAQ,EAAE,EAAE,mBAAmB,CAAC,CAAC;IAC/F,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,wBAAwB,EAAE,CAAC;QAC9C,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,QAAQ,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,2BAA2B;IAC3B,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,IAAI,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,mBAAmB,CAAC,gCAAgC,QAAQ,EAAE,EAAE,YAAY,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO;IACT,CAAC;IAED,yEAAyE;IACzE,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,SAAqD,CAAC;IAC1D,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAW,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAC3B,yBAAyB,QAAQ,KAAM,GAAa,CAAC,OAAO,EAAE,EAC9D,aAAa,CACd,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,mBAAmB,CAC3B,GAAG,QAAQ,oCAAoC,IAAI,CAAC,OAAO,EAAE,EAC7D,YAAY,CACb,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,EAAU;IAC9C,IAAI,MAAM,CAAC,EAAE,CAAC;QAAE,OAAO,uBAAuB,CAAC,EAAE,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,EAAE,CAAC;QAAE,OAAO,uBAAuB,CAAC,EAAE,CAAC,CAAC;IACnD,qCAAqC;IACrC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC;IAC1C,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,GAAG,CAAC;QAC5C,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG;YAAE,OAAO,MAAM,CAAC,GAAG,CAAC;QACxC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAED,SAAS,uBAAuB,CAAC,EAAU;IACzC,MAAM,CAAC,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAErC,2CAA2C;IAC3C,IAAI,CAAC,IAAI,UAAU;QAAE,OAAO,IAAI,CAAC;IACjC,aAAa;IACb,IAAI,CAAC,IAAI,UAAU,IAAI,CAAC,IAAI,UAAU;QAAE,OAAO,IAAI,CAAC;IACpD,+CAA+C;IAC/C,IAAI,CAAC,IAAI,UAAU,IAAI,CAAC,IAAI,UAAU;QAAE,OAAO,IAAI,CAAC;IACpD,yBAAyB;IACzB,IAAI,CAAC,IAAI,UAAU,IAAI,CAAC,IAAI,UAAU;QAAE,OAAO,IAAI,CAAC;IACpD,kEAAkE;IAClE,IAAI,CAAC,IAAI,UAAU,IAAI,CAAC,IAAI,UAAU;QAAE,OAAO,IAAI,CAAC;IACpD,gBAAgB;IAChB,IAAI,CAAC,IAAI,UAAU,IAAI,CAAC,IAAI,UAAU;QAAE,OAAO,IAAI,CAAC;IACpD,2CAA2C;IAC3C,IAAI,CAAC,IAAI,UAAU,IAAI,CAAC,IAAI,UAAU;QAAE,OAAO,IAAI,CAAC;IACpD,4BAA4B;IAC5B,IAAI,CAAC,IAAI,UAAU,IAAI,CAAC,IAAI,UAAU;QAAE,OAAO,IAAI,CAAC;IACpD,iBAAiB;IACjB,IAAI,CAAC,IAAI,UAAU,IAAI,CAAC,IAAI,UAAU;QAAE,OAAO,IAAI,CAAC;IACpD,+BAA+B;IAC/B,IAAI,CAAC,IAAI,UAAU,IAAI,CAAC,IAAI,UAAU;QAAE,OAAO,IAAI,CAAC;IACpD,+BAA+B;IAC/B,IAAI,CAAC,IAAI,UAAU,IAAI,CAAC,IAAI,UAAU;QAAE,OAAO,IAAI,CAAC;IACpD,8BAA8B;IAC9B,IAAI,CAAC,IAAI,UAAU,IAAI,CAAC,IAAI,UAAU;QAAE,OAAO,IAAI,CAAC;IACpD,0BAA0B;IAC1B,IAAI,CAAC,IAAI,UAAU,IAAI,CAAC,IAAI,UAAU;QAAE,OAAO,IAAI,CAAC;IACpD,8DAA8D;IAC9D,IAAI,CAAC,IAAI,UAAU;QAAE,OAAO,IAAI,CAAC;IAEjC,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,EAAU;IAC5B,IAAI,OAAO,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/B,yCAAyC;IACzC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IACD,sEAAsE;IACtE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAExD,2DAA2D;IAC3D,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAClE,IAAI,IAAI,GAAG,OAAO,CAAC;IACnB,IAAI,OAAO,GAAoB,IAAI,CAAC;IACpC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,OAAO,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;QACjF,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACrC,CAAC;IAED,qCAAqC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAElC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAElC,IAAI,KAAe,CAAC;IACpB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAC3C,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACvD,IAAI,OAAO,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7B,KAAK,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,KAAK,CAAS,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACpB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5C,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM;YAAE,OAAO,IAAI,CAAC;QAC7D,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC;QAC9B,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IAC5B,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QACtB,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QACtB,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QACtB,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,uBAAuB,CAAC,EAAU;IACzC,MAAM,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;IACzB,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpB,mBAAmB;IACnB,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACf,OAAO,GAAG,KAAK,CAAC;YAChB,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC;IAEzB,iBAAiB;IACjB,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACf,QAAQ,GAAG,KAAK,CAAC;YACjB,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzC,uEAAuE;IACvE,mEAAmE;IACnE,gCAAgC;IAChC,IAAI,YAAY,GAAG,IAAI,CAAC;IACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACf,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,YAAY,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;QACrD,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACjD,OAAO,uBAAuB,CAAC,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,kDAAkD;IAClD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACrE,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACf,OAAO,GAAG,KAAK,CAAC;gBAChB,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACjD,OAAO,uBAAuB,CAAC,EAAE,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACf,OAAO,GAAG,KAAK,CAAC;gBAChB,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,OAAO;YAAE,OAAO,IAAI,CAAC;IAC3B,CAAC;IAED,gCAAgC;IAChC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAElF,6EAA6E;IAC7E,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEzC,yBAAyB;IACzB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE1D,uBAAuB;IACvB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE/B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAgB,EAChB,OAAsB,EACtB,QAAsF;IAEtF,uEAAuE;IACvE,sEAAsE;IACtE,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;QAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;SAC3D,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,MAAM,GAAG,CAAC,CAAC;SAC1C,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,MAAM,GAAG,CAAC,CAAC;IAE/C,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAW,CAAC,CAAC,IAAI,CACtE,CAAC,SAAS,EAAE,EAAE;QACZ,mEAAmE;QACnE,kEAAkE;QAClE,mEAAmE;QACnE,oEAAoE;QACpE,+CAA+C;QAC/C,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CACjC,CAAC,CAAC,EAAE,EAAE,CACJ,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;YAC7B,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YACpB,CAAC,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC,CACpC,CAAC;QACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,QAAQ,CACN,IAAI,mBAAmB,CACrB,GAAG,QAAQ,6CAA6C,EACxD,YAAY,CACb,EACD,EAAE,EACF,CAAC,CACF,CAAC;YACF,OAAO;QACT,CAAC;QACD,0DAA0D;QAC1D,gEAAgE;QAChE,qDAAqD;QACrD,8CAA8C;QAC9C,MAAM,OAAO,GAAI,OAA6B,CAAC,GAAG,KAAK,IAAI,CAAC;QAC5D,IAAI,OAAO,EAAE,CAAC;YACZ,2EAA2E;YAC1E,QAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,EACD,CAAC,GAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,GAA4B,EAAE,EAAE,EAAE,CAAC,CAAC,CAChE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAW,EACX,KAA6D,EAC7D,SAAS,GAAG,MAAM;IAElB,wEAAwE;IACxE,0EAA0E;IAC1E,MAAM,6BAA6B,CAAC,GAAG,CAAC,CAAC;IACzC,kEAAkE;IAClE,qEAAqE;IACrE,kBAAkB;IAClB,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC,CAAC,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC,CAAC,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC;QAC3B,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;QACjB,cAAc,EAAE,SAAS;QACzB,WAAW,EAAE,SAAS;QACtB,cAAc,EAAE,SAAS;KAC1B,CAAC,CAAC;IACH,0EAA0E;IAC1E,OAAQ,WAA8B,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAsB,CAAC;AAC1F,CAAC;AAED;;;;;;;;GAQG;AACH,IAAI,oBAAoB,GAAiB,IAAI,CAAC;AAC9C,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAiB,EAAE,IAAkB;IACvE,IAAI,CAAC,oBAAoB;QAAE,oBAAoB,GAAG,wBAAwB,EAAE,CAAC;IAC7E,+DAA+D;IAC/D,OAAQ,WAA8B,CAAC,GAAG,EAAE;QAC1C,GAAG,IAAI;QACP,UAAU,EAAE,oBAAoB;KACjC,CAAsB,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB;IACtC,OAAO,IAAI,KAAK,CAAC;QACf,cAAc,EAAE,MAAM;QACtB,WAAW,EAAE,MAAM;QACnB,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE;KACpC,CAAC,CAAC;AACL,CAAC"}