@evalops/maestro 0.10.22 → 0.10.24

package/dist/app-server/network-governance-api.js

@@ -0,0 +1,476 @@
+import { randomUUID } from "node:crypto";
+import { request as requestHttp } from "node:http";
+import { request as requestHttps } from "node:https";
+import { Readable } from "node:stream";
+import { loadPolicy } from "../safety/policy.js";
+import { checkNetworkRestrictionsDetailed } from "../safety/validators/network-policy-validator.js";
+const DEFAULT_MAX_RESPONSE_BYTES = 1024 * 1024;
+const DEFAULT_MAX_AUDIT_RECORDS = 100;
+const DEFAULT_PINNED_ADDRESS_TIMEOUT_MS = 30_000;
+const DEFAULT_PAGE_LIMIT = 50;
+const MAX_PAGE_LIMIT = 100;
+const IDEMPOTENT_HTTP_METHODS = new Set([
+    "GET",
+    "HEAD",
+    "OPTIONS",
+    "TRACE",
+    "PUT",
+    "DELETE",
+]);
+export class MaestroAppServerNetworkGovernanceError extends Error {
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "MaestroAppServerNetworkGovernanceError";
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function normalizeLimit(value) {
+    if (typeof value !== "number" || !Number.isFinite(value)) {
+        return DEFAULT_PAGE_LIMIT;
+    }
+    return Math.min(MAX_PAGE_LIMIT, Math.max(1, Math.trunc(value)));
+}
+function normalizePositiveInteger(value, fallback) {
+    if (typeof value !== "number" || !Number.isFinite(value)) {
+        return fallback;
+    }
+    return Math.max(1, Math.trunc(value));
+}
+function readOptionalString(value, field) {
+    if (value === undefined || value === null) {
+        return undefined;
+    }
+    if (typeof value !== "string") {
+        throw new MaestroAppServerNetworkGovernanceError(-32602, `Invalid ${field}`);
+    }
+    return value;
+}
+function requireUrl(params) {
+    const rawUrl = readOptionalString(params.url, "url");
+    if (!rawUrl) {
+        throw new MaestroAppServerNetworkGovernanceError(-32602, "Missing url");
+    }
+    let parsed;
+    try {
+        parsed = new URL(rawUrl);
+    }
+    catch {
+        throw new MaestroAppServerNetworkGovernanceError(-32602, "Invalid url");
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        throw new MaestroAppServerNetworkGovernanceError(-32602, "Only http and https URLs are supported");
+    }
+    return parsed;
+}
+function normalizeMethod(value) {
+    const method = readOptionalString(value, "method") ?? "GET";
+    const normalized = method.trim().toUpperCase();
+    if (!/^[A-Z]+$/.test(normalized)) {
+        throw new MaestroAppServerNetworkGovernanceError(-32602, "Invalid method");
+    }
+    return normalized;
+}
+function isIdempotentMethod(method) {
+    return IDEMPOTENT_HTTP_METHODS.has((method ?? "GET").trim().toUpperCase());
+}
+function normalizeHeaders(value) {
+    if (value === undefined || value === null) {
+        return undefined;
+    }
+    if (!isRecord(value)) {
+        throw new MaestroAppServerNetworkGovernanceError(-32602, "Invalid headers");
+    }
+    const headers = {};
+    for (const [key, headerValue] of Object.entries(value)) {
+        if (typeof headerValue !== "string") {
+            throw new MaestroAppServerNetworkGovernanceError(-32602, "Invalid headers");
+        }
+        headers[key] = headerValue;
+    }
+    return headers;
+}
+function normalizeBody(value) {
+    if (value === undefined || value === null) {
+        return undefined;
+    }
+    if (typeof value !== "string") {
+        throw new MaestroAppServerNetworkGovernanceError(-32602, "Invalid bodyBase64");
+    }
+    if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)) {
+        throw new MaestroAppServerNetworkGovernanceError(-32602, "bodyBase64 must be valid base64");
+    }
+    const decoded = Buffer.from(value, "base64");
+    if (decoded.toString("base64") !== value) {
+        throw new MaestroAppServerNetworkGovernanceError(-32602, "bodyBase64 must be canonical base64");
+    }
+    return decoded;
+}
+function responseHeadersToRecord(headers) {
+    const record = {};
+    for (const [key, value] of headers.entries()) {
+        const normalizedKey = key.toLowerCase();
+        const existing = record[normalizedKey];
+        record[normalizedKey] =
+            existing === undefined ? value : `${existing}\n${value}`;
+    }
+    return record;
+}
+function nowIso() {
+    return new Date().toISOString();
+}
+function redactAuditUrl(url) {
+    const redacted = new URL(url.toString());
+    redacted.username = "";
+    redacted.password = "";
+    return redacted.toString();
+}
+function urlWithoutCredentials(url) {
+    const credentialless = new URL(url.toString());
+    credentialless.username = "";
+    credentialless.password = "";
+    return credentialless;
+}
+function decodeUrlCredential(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+}
+function applyUrlCredentials(url, headers) {
+    if ((!url.username && !url.password) || headers.has("authorization")) {
+        return;
+    }
+    const credentials = `${decodeUrlCredential(url.username)}:${decodeUrlCredential(url.password)}`;
+    headers.set("authorization", `Basic ${Buffer.from(credentials, "utf8").toString("base64")}`);
+}
+function createAuditRecord(input) {
+    return {
+        id: randomUUID(),
+        method: input.method,
+        url: redactAuditUrl(input.url),
+        host: input.url.hostname.toLowerCase().replace(/^\[|\]$/g, ""),
+        allowed: input.allowed,
+        status: input.status,
+        ...(input.reason ? { reason: input.reason } : {}),
+        ...(input.statusCode !== undefined ? { statusCode: input.statusCode } : {}),
+        startedAt: input.startedAt,
+        completedAt: nowIso(),
+    };
+}
+function cloneAuditRecord(record) {
+    return { ...record };
+}
+function headersToRecord(headers) {
+    const record = {};
+    for (const [key, value] of headers.entries()) {
+        record[key] = value;
+    }
+    return record;
+}
+function responseHeadersFromNode(headers) {
+    const responseHeaders = new Headers();
+    for (const [key, value] of Object.entries(headers)) {
+        if (Array.isArray(value)) {
+            for (const entry of value) {
+                responseHeaders.append(key, entry);
+            }
+        }
+        else if (value !== undefined) {
+            responseHeaders.set(key, value);
+        }
+    }
+    return responseHeaders;
+}
+export async function fetchWithPinnedAddress(input, init, binding = {}, pinnedAddressTimeoutMs = DEFAULT_PINNED_ADDRESS_TIMEOUT_MS) {
+    const resolvedAddresses = binding.resolvedAddresses && binding.resolvedAddresses.length > 0
+        ? binding.resolvedAddresses
+        : binding.resolvedAddress
+            ? [binding.resolvedAddress]
+            : [];
+    if (resolvedAddresses.length === 0) {
+        const url = new URL(input);
+        if (!url.username && !url.password) {
+            return globalThis.fetch(input, init);
+        }
+        const requestHeaders = new Headers(init?.headers);
+        applyUrlCredentials(url, requestHeaders);
+        return globalThis.fetch(urlWithoutCredentials(url).toString(), {
+            ...init,
+            headers: requestHeaders,
+        });
+    }
+    const addressesToTry = isIdempotentMethod(init?.method)
+        ? resolvedAddresses
+        : resolvedAddresses.slice(0, 1);
+    let lastError;
+    for (const resolvedAddress of addressesToTry) {
+        try {
+            return await fetchWithSinglePinnedAddress(input, init, {
+                ...binding,
+                resolvedAddress,
+            }, pinnedAddressTimeoutMs);
+        }
+        catch (error) {
+            lastError = error;
+        }
+    }
+    throw lastError instanceof Error
+        ? lastError
+        : new Error("Network request failed");
+}
+async function fetchWithSinglePinnedAddress(input, init, binding, pinnedAddressTimeoutMs) {
+    const url = new URL(input);
+    const requestHeaders = new Headers(init?.headers);
+    applyUrlCredentials(url, requestHeaders);
+    requestHeaders.set("host", url.host);
+    const transport = url.protocol === "https:" ? requestHttps : requestHttp;
+    const method = init?.method ?? "GET";
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        let timeout;
+        let abortListener;
+        const signal = init?.signal;
+        const timeoutMessage = `Pinned network request to ${binding.resolvedAddress} timed out after ${pinnedAddressTimeoutMs}ms`;
+        const cleanup = () => {
+            if (timeout) {
+                clearTimeout(timeout);
+                timeout = undefined;
+            }
+            if (signal && abortListener) {
+                signal.removeEventListener("abort", abortListener);
+                abortListener = undefined;
+            }
+        };
+        const finishResolve = (response) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            cleanup();
+            resolve(response);
+        };
+        const finishReject = (error) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            cleanup();
+            reject(error);
+        };
+        const request = transport({
+            hostname: binding.resolvedAddress,
+            method,
+            path: `${url.pathname}${url.search}`,
+            port: url.port ? Number(url.port) : undefined,
+            headers: headersToRecord(requestHeaders),
+            ...(url.protocol === "https:"
+                ? { servername: binding.originalHost ?? url.hostname }
+                : {}),
+        }, (response) => {
+            finishResolve(new Response(Readable.toWeb(response), {
+                status: response.statusCode ?? 500,
+                statusText: response.statusMessage,
+                headers: responseHeadersFromNode(response.headers),
+            }));
+        });
+        request.on("error", finishReject);
+        request.setTimeout(pinnedAddressTimeoutMs, () => {
+            request.destroy(new Error(timeoutMessage));
+        });
+        timeout = setTimeout(() => {
+            request.destroy(new Error(timeoutMessage));
+        }, pinnedAddressTimeoutMs);
+        timeout.unref?.();
+        if (signal) {
+            if (signal.aborted) {
+                const error = new Error("Request aborted");
+                request.destroy(error);
+                finishReject(error);
+                return;
+            }
+            abortListener = () => {
+                const error = new Error("Request aborted");
+                request.destroy(error);
+                finishReject(error);
+            };
+            signal.addEventListener("abort", abortListener, { once: true });
+        }
+        const body = init?.body;
+        if (body !== undefined && body !== null) {
+            if (typeof body === "string" ||
+                body instanceof Uint8Array ||
+                body instanceof ArrayBuffer) {
+                request.write(body instanceof ArrayBuffer ? Buffer.from(body) : body);
+            }
+            else {
+                const error = new Error("Unsupported request body");
+                request.destroy(error);
+                finishReject(error);
+                return;
+            }
+        }
+        request.end();
+    });
+}
+async function readResponseBytes(response, maxResponseBytes) {
+    if (!response.body) {
+        return Buffer.from(await response.arrayBuffer());
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let totalBytes = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done) {
+                break;
+            }
+            if (!value) {
+                continue;
+            }
+            totalBytes += value.byteLength;
+            if (totalBytes > maxResponseBytes) {
+                await reader.cancel().catch(() => undefined);
+                throw new Error(`Response body exceeds ${maxResponseBytes} byte network proxy limit`);
+            }
+            chunks.push(Buffer.from(value));
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    return Buffer.concat(chunks, totalBytes);
+}
+async function evaluateNetworkPolicy(url) {
+    let policy;
+    try {
+        policy = loadPolicy();
+    }
+    catch (error) {
+        return {
+            allowed: false,
+            reason: `Failed to load managed policy: ${error instanceof Error ? error.message : "unknown error"}`,
+        };
+    }
+    if (!policy?.network) {
+        return { allowed: true };
+    }
+    const check = await checkNetworkRestrictionsDetailed(url.toString(), policy.network);
+    return {
+        allowed: check.allowed,
+        ...(check.reason ? { reason: check.reason } : {}),
+        ...(check.normalizedHost ? { originalHost: check.normalizedHost } : {}),
+        ...(check.resolvedIPs[0] ? { resolvedAddress: check.resolvedIPs[0] } : {}),
+        ...(check.resolvedIPs.length > 0
+            ? { resolvedAddresses: [...check.resolvedIPs] }
+            : {}),
+    };
+}
+export function createMaestroAppServerNetworkGovernance(options = {}) {
+    const pinnedAddressTimeoutMs = normalizePositiveInteger(options.pinnedAddressTimeoutMs, DEFAULT_PINNED_ADDRESS_TIMEOUT_MS);
+    const fetchImpl = options.fetchImpl ??
+        ((input, init, binding) => fetchWithPinnedAddress(input, init, binding, pinnedAddressTimeoutMs));
+    const maxResponseBytes = normalizePositiveInteger(options.maxResponseBytes, DEFAULT_MAX_RESPONSE_BYTES);
+    const maxAuditRecords = normalizePositiveInteger(options.maxAuditRecords, DEFAULT_MAX_AUDIT_RECORDS);
+    const audit = [];
+    function recordAudit(record) {
+        audit.push(record);
+        if (audit.length > maxAuditRecords) {
+            audit.splice(0, audit.length - maxAuditRecords);
+        }
+    }
+    return {
+        async fetch(params = {}) {
+            if (!isRecord(params)) {
+                throw new MaestroAppServerNetworkGovernanceError(-32602, "Invalid params");
+            }
+            const url = requireUrl(params);
+            const method = normalizeMethod(params.method);
+            const headers = normalizeHeaders(params.headers);
+            const body = normalizeBody(params.bodyBase64);
+            const startedAt = nowIso();
+            const policyCheck = await evaluateNetworkPolicy(url);
+            if (!policyCheck.allowed) {
+                const auditRecord = createAuditRecord({
+                    method,
+                    url,
+                    allowed: false,
+                    status: "blocked",
+                    reason: policyCheck.reason,
+                    startedAt,
+                });
+                recordAudit(auditRecord);
+                return {
+                    allowed: false,
+                    status: "blocked",
+                    ...(policyCheck.reason ? { reason: policyCheck.reason } : {}),
+                    audit: cloneAuditRecord(auditRecord),
+                };
+            }
+            try {
+                const response = await fetchImpl(url.toString(), {
+                    method,
+                    redirect: "manual",
+                    ...(headers ? { headers } : {}),
+                    ...(body ? { body } : {}),
+                }, {
+                    originalHost: policyCheck.originalHost,
+                    resolvedAddress: policyCheck.resolvedAddress,
+                    resolvedAddresses: policyCheck.resolvedAddresses,
+                });
+                const bytes = await readResponseBytes(response, maxResponseBytes);
+                const auditRecord = createAuditRecord({
+                    method,
+                    url,
+                    allowed: true,
+                    status: "allowed",
+                    statusCode: response.status,
+                    startedAt,
+                });
+                recordAudit(auditRecord);
+                return {
+                    allowed: true,
+                    status: "allowed",
+                    statusCode: response.status,
+                    headers: responseHeadersToRecord(response.headers),
+                    bodyBase64: bytes.toString("base64"),
+                    audit: cloneAuditRecord(auditRecord),
+                };
+            }
+            catch (error) {
+                const reason = error instanceof Error ? error.message : "Network request failed";
+                const auditRecord = createAuditRecord({
+                    method,
+                    url,
+                    allowed: true,
+                    status: "failed",
+                    reason,
+                    startedAt,
+                });
+                recordAudit(auditRecord);
+                return {
+                    allowed: true,
+                    status: "failed",
+                    reason,
+                    audit: cloneAuditRecord(auditRecord),
+                };
+            }
+        },
+        async listAudit(params = {}) {
+            if (!isRecord(params)) {
+                throw new MaestroAppServerNetworkGovernanceError(-32602, "Invalid params");
+            }
+            const limit = normalizeLimit(params.limit);
+            return {
+                audit: audit.slice(-limit).map(cloneAuditRecord),
+                nextCursor: null,
+            };
+        },
+    };
+}
+//# sourceMappingURL=network-governance-api.js.map

package/dist/app-server/network-governance-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-governance-api.js","sourceRoot":"","sources":["../../src/app-server/network-governance-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAOvC,OAAO,EAAyB,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAC;AAcpG,MAAM,0BAA0B,GAAG,IAAI,GAAG,IAAI,CAAC;AAC/C,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,MAAM,iCAAiC,GAAG,MAAM,CAAC;AACjD,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACvC,KAAK;IACL,MAAM;IACN,SAAS;IACT,OAAO;IACP,KAAK;IACL,QAAQ;CACR,CAAC,CAAC;AAEH,MAAM,OAAO,sCAAuC,SAAQ,KAAK;IAChE,YACU,IAAY,EACrB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,SAAI,GAAJ,IAAI,CAAQ;QAIrB,IAAI,CAAC,IAAI,GAAG,wCAAwC,CAAC;IACtD,CAAC;CACD;AAgBD,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO,kBAAkB,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc,EAAE,QAAgB;IACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc,EAAE,KAAa;IACxD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,sCAAsC,CAC/C,CAAC,KAAK,EACN,WAAW,KAAK,EAAE,CAClB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,MAAqB;IACxC,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,sCAAsC,CAAC,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,sCAAsC,CAAC,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjE,MAAM,IAAI,sCAAsC,CAC/C,CAAC,KAAK,EACN,wCAAwC,CACxC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACtC,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,KAAK,CAAC;IAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,sCAAsC,CAAC,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CAAC,MAA0B;IACrD,OAAO,uBAAuB,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACvC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,sCAAsC,CAAC,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,IAAI,sCAAsC,CAC/C,CAAC,KAAK,EACN,iBAAiB,CACjB,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC;IAC5B,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACpC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,sCAAsC,CAC/C,CAAC,KAAK,EACN,oBAAoB,CACpB,CAAC;IACH,CAAC;IACD,IACC,CAAC,kEAAkE,CAAC,IAAI,CACvE,KAAK,CACL,EACA,CAAC;QACF,MAAM,IAAI,sCAAsC,CAC/C,CAAC,KAAK,EACN,iCAAiC,CACjC,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC;QAC1C,MAAM,IAAI,sCAAsC,CAC/C,CAAC,KAAK,EACN,qCAAqC,CACrC,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAgB;IAChD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,MAAM,aAAa,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;QACvC,MAAM,CAAC,aAAa,CAAC;YACpB,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,KAAK,KAAK,EAAE,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,MAAM;IACd,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,cAAc,CAAC,GAAQ;IAC/B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzC,QAAQ,CAAC,QAAQ,GAAG,EAAE,CAAC;IACvB,QAAQ,CAAC,QAAQ,GAAG,EAAE,CAAC;IACvB,OAAO,QAAQ,CAAC,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAQ;IACtC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC/C,cAAc,CAAC,QAAQ,GAAG,EAAE,CAAC;IAC7B,cAAc,CAAC,QAAQ,GAAG,EAAE,CAAC;IAC7B,OAAO,cAAc,CAAC;AACvB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACzC,IAAI,CAAC;QACJ,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAQ,EAAE,OAAgB;IACtD,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;QACtE,OAAO;IACR,CAAC;IACD,MAAM,WAAW,GAAG,GAAG,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,mBAAmB,CAC9E,GAAG,CAAC,QAAQ,CACZ,EAAE,CAAC;IACJ,OAAO,CAAC,GAAG,CACV,eAAe,EACf,SAAS,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAC9D,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAQ1B;IACA,OAAO;QACN,EAAE,EAAE,UAAU,EAAE;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC;QAC9B,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;QAC9D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,MAAM,EAAE;KACrB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACxB,MAA0C;IAE1C,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,eAAe,CAAC,OAAgB;IACxC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB,CAC/B,OAAsD;IAEtD,MAAM,eAAe,GAAG,IAAI,OAAO,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;gBAC3B,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACF,CAAC;aAAM,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;IACF,CAAC;IACD,OAAO,eAAe,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC3C,KAAa,EACb,IAA6B,EAC7B,UAA+B,EAAE,EACjC,sBAAsB,GAAG,iCAAiC;IAE1D,MAAM,iBAAiB,GACtB,OAAO,CAAC,iBAAiB,IAAI,OAAO,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC;QAChE,CAAC,CAAC,OAAO,CAAC,iBAAiB;QAC3B,CAAC,CAAC,OAAO,CAAC,eAAe;YACxB,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;YAC3B,CAAC,CAAC,EAAE,CAAC;IACR,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YACpC,OAAO,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,cAAc,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAClD,mBAAmB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACzC,OAAO,UAAU,CAAC,KAAK,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;YAC9D,GAAG,IAAI;YACP,OAAO,EAAE,cAAc;SACvB,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC;QACtD,CAAC,CAAC,iBAAiB;QACnB,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjC,IAAI,SAAkB,CAAC;IACvB,KAAK,MAAM,eAAe,IAAI,cAAc,EAAE,CAAC;QAC9C,IAAI,CAAC;YACJ,OAAO,MAAM,4BAA4B,CACxC,KAAK,EACL,IAAI,EACJ;gBACC,GAAG,OAAO;gBACV,eAAe;aACf,EACD,sBAAsB,CACtB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,SAAS,GAAG,KAAK,CAAC;QACnB,CAAC;IACF,CAAC;IACD,MAAM,SAAS,YAAY,KAAK;QAC/B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,4BAA4B,CAC1C,KAAa,EACb,IAA6B,EAC7B,OACoB,EACpB,sBAA8B;IAE9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,cAAc,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAClD,mBAAmB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACzC,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;IACzE,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC;IAErC,OAAO,IAAI,OAAO,CAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAChD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,OAAkD,CAAC;QACvD,IAAI,aAAuC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC;QAC5B,MAAM,cAAc,GAAG,6BAA6B,OAAO,CAAC,eAAe,oBAAoB,sBAAsB,IAAI,CAAC;QAC1H,MAAM,OAAO,GAAG,GAAG,EAAE;YACpB,IAAI,OAAO,EAAE,CAAC;gBACb,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,OAAO,GAAG,SAAS,CAAC;YACrB,CAAC;YACD,IAAI,MAAM,IAAI,aAAa,EAAE,CAAC;gBAC7B,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;gBACnD,aAAa,GAAG,SAAS,CAAC;YAC3B,CAAC;QACF,CAAC,CAAC;QACF,MAAM,aAAa,GAAG,CAAC,QAAkB,EAAE,EAAE;YAC5C,IAAI,OAAO,EAAE,CAAC;gBACb,OAAO;YACR,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnB,CAAC,CAAC;QACF,MAAM,YAAY,GAAG,CAAC,KAAY,EAAE,EAAE;YACrC,IAAI,OAAO,EAAE,CAAC;gBACb,OAAO;YACR,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,KAAK,CAAC,CAAC;QACf,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,SAAS,CACxB;YACC,QAAQ,EAAE,OAAO,CAAC,eAAe;YACjC,MAAM;YACN,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;YACpC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YAC7C,OAAO,EAAE,eAAe,CAAC,cAAc,CAAC;YACxC,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ;gBAC5B,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,YAAY,IAAI,GAAG,CAAC,QAAQ,EAAE;gBACtD,CAAC,CAAC,EAAE,CAAC;SACN,EACD,CAAC,QAAQ,EAAE,EAAE;YACZ,aAAa,CACZ,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAA+B,EAAE;gBACpE,MAAM,EAAE,QAAQ,CAAC,UAAU,IAAI,GAAG;gBAClC,UAAU,EAAE,QAAQ,CAAC,aAAa;gBAClC,OAAO,EAAE,uBAAuB,CAAC,QAAQ,CAAC,OAAO,CAAC;aAClD,CAAC,CACF,CAAC;QACH,CAAC,CACD,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAClC,OAAO,CAAC,UAAU,CAAC,sBAAsB,EAAE,GAAG,EAAE;YAC/C,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YACzB,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;QAC5C,CAAC,EAAE,sBAAsB,CAAC,CAAC;QAC3B,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAClB,IAAI,MAAM,EAAE,CAAC;YACZ,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBAC3C,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACvB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO;YACR,CAAC;YACD,aAAa,GAAG,GAAG,EAAE;gBACpB,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBAC3C,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACvB,YAAY,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC,CAAC;YACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC;QACxB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACzC,IACC,OAAO,IAAI,KAAK,QAAQ;gBACxB,IAAI,YAAY,UAAU;gBAC1B,IAAI,YAAY,WAAW,EAC1B,CAAC;gBACF,OAAO,CAAC,KAAK,CAAC,IAAI,YAAY,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACvE,CAAC;iBAAM,CAAC;gBACP,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;gBACpD,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACvB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO;YACR,CAAC;QACF,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC/B,QAAkB,EAClB,gBAAwB;IAExB,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,CAAC;QACJ,SAAS,CAAC;YACT,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI,EAAE,CAAC;gBACV,MAAM;YACP,CAAC;YACD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACZ,SAAS;YACV,CAAC;YACD,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC;YAC/B,IAAI,UAAU,GAAG,gBAAgB,EAAE,CAAC;gBACnC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC7C,MAAM,IAAI,KAAK,CACd,yBAAyB,gBAAgB,2BAA2B,CACpE,CAAC;YACH,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACjC,CAAC;IACF,CAAC;YAAS,CAAC;QACV,MAAM,CAAC,WAAW,EAAE,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,GAAQ;IAO5C,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACJ,MAAM,GAAG,UAAU,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,kCAAkC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;SACpG,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,gCAAgC,CACnD,GAAG,CAAC,QAAQ,EAAE,EACd,MAAM,CAAC,OAAO,CACd,CAAC;IACF,OAAO;QACN,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;YAC/B,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,EAAE;YAC/C,CAAC,CAAC,EAAE,CAAC;KACN,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uCAAuC,CACtD,UAAoD,EAAE;IAEtD,MAAM,sBAAsB,GAAG,wBAAwB,CACtD,OAAO,CAAC,sBAAsB,EAC9B,iCAAiC,CACjC,CAAC;IACF,MAAM,SAAS,GACd,OAAO,CAAC,SAAS;QACjB,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CACzB,sBAAsB,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACxE,MAAM,gBAAgB,GAAG,wBAAwB,CAChD,OAAO,CAAC,gBAAgB,EACxB,0BAA0B,CAC1B,CAAC;IACF,MAAM,eAAe,GAAG,wBAAwB,CAC/C,OAAO,CAAC,eAAe,EACvB,yBAAyB,CACzB,CAAC;IACF,MAAM,KAAK,GAAyC,EAAE,CAAC;IAEvD,SAAS,WAAW,CAAC,MAA0C;QAC9D,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,IAAI,KAAK,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;YACpC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC;QACjD,CAAC;IACF,CAAC;IAED,OAAO;QACN,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE;YACtB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,sCAAsC,CAC/C,CAAC,KAAK,EACN,gBAAgB,CAChB,CAAC;YACH,CAAC;YACD,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YAC/B,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC9C,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC;YAE3B,MAAM,WAAW,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC;YACrD,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;gBAC1B,MAAM,WAAW,GAAG,iBAAiB,CAAC;oBACrC,MAAM;oBACN,GAAG;oBACH,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,WAAW,CAAC,MAAM;oBAC1B,SAAS;iBACT,CAAC,CAAC;gBACH,WAAW,CAAC,WAAW,CAAC,CAAC;gBACzB,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,SAAS;oBACjB,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7D,KAAK,EAAE,gBAAgB,CAAC,WAAW,CAAC;iBACpC,CAAC;YACH,CAAC;YAED,IAAI,CAAC;gBACJ,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC/B,GAAG,CAAC,QAAQ,EAAE,EACd;oBACC,MAAM;oBACN,QAAQ,EAAE,QAAQ;oBAClB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACzB,EACD;oBACC,YAAY,EAAE,WAAW,CAAC,YAAY;oBACtC,eAAe,EAAE,WAAW,CAAC,eAAe;oBAC5C,iBAAiB,EAAE,WAAW,CAAC,iBAAiB;iBAChD,CACD,CAAC;gBACF,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;gBAClE,MAAM,WAAW,GAAG,iBAAiB,CAAC;oBACrC,MAAM;oBACN,GAAG;oBACH,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,SAAS;oBACjB,UAAU,EAAE,QAAQ,CAAC,MAAM;oBAC3B,SAAS;iBACT,CAAC,CAAC;gBACH,WAAW,CAAC,WAAW,CAAC,CAAC;gBACzB,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,SAAS;oBACjB,UAAU,EAAE,QAAQ,CAAC,MAAM;oBAC3B,OAAO,EAAE,uBAAuB,CAAC,QAAQ,CAAC,OAAO,CAAC;oBAClD,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBACpC,KAAK,EAAE,gBAAgB,CAAC,WAAW,CAAC;iBACpC,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,MAAM,GACX,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC;gBACnE,MAAM,WAAW,GAAG,iBAAiB,CAAC;oBACrC,MAAM;oBACN,GAAG;oBACH,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,QAAQ;oBAChB,MAAM;oBACN,SAAS;iBACT,CAAC,CAAC;gBACH,WAAW,CAAC,WAAW,CAAC,CAAC;gBACzB,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,QAAQ;oBAChB,MAAM;oBACN,KAAK,EAAE,gBAAgB,CAAC,WAAW,CAAC;iBACpC,CAAC;YACH,CAAC;QACF,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE;YAC1B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,sCAAsC,CAC/C,CAAC,KAAK,EACN,gBAAgB,CAChB,CAAC;YACH,CAAC;YACD,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3C,OAAO;gBACN,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;gBAChD,UAAU,EAAE,IAAI;aAChB,CAAC;QACH,CAAC;KACD,CAAC;AACH,CAAC","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { request as requestHttp } from \"node:http\";\nimport { request as requestHttps } from \"node:https\";\nimport { Readable } from \"node:stream\";\nimport type {\n\tMaestroAppServerNetworkAuditListResult,\n\tMaestroAppServerNetworkAuditRecord,\n\tMaestroAppServerNetworkFetchResult,\n\tMaestroAppServerNetworkGovernanceStatus,\n} from \"@evalops/contracts\";\nimport { type EnterprisePolicy, loadPolicy } from \"../safety/policy.js\";\nimport { checkNetworkRestrictionsDetailed } from \"../safety/validators/network-policy-validator.js\";\n\ntype UnknownRecord = Record<string, unknown>;\ninterface NetworkFetchBinding {\n\toriginalHost?: string;\n\tresolvedAddress?: string;\n\tresolvedAddresses?: string[];\n}\ntype FetchLike = (\n\tinput: string,\n\tinit?: RequestInit,\n\tbinding?: NetworkFetchBinding,\n) => Promise<Response>;\n\nconst DEFAULT_MAX_RESPONSE_BYTES = 1024 * 1024;\nconst DEFAULT_MAX_AUDIT_RECORDS = 100;\nconst DEFAULT_PINNED_ADDRESS_TIMEOUT_MS = 30_000;\nconst DEFAULT_PAGE_LIMIT = 50;\nconst MAX_PAGE_LIMIT = 100;\nconst IDEMPOTENT_HTTP_METHODS = new Set([\n\t\"GET\",\n\t\"HEAD\",\n\t\"OPTIONS\",\n\t\"TRACE\",\n\t\"PUT\",\n\t\"DELETE\",\n]);\n\nexport class MaestroAppServerNetworkGovernanceError extends Error {\n\tconstructor(\n\t\treadonly code: number,\n\t\tmessage: string,\n\t) {\n\t\tsuper(message);\n\t\tthis.name = \"MaestroAppServerNetworkGovernanceError\";\n\t}\n}\n\nexport interface MaestroAppServerNetworkGovernanceOptions {\n\tfetchImpl?: FetchLike;\n\tmaxResponseBytes?: number;\n\tmaxAuditRecords?: number;\n\tpinnedAddressTimeoutMs?: number;\n}\n\nexport interface MaestroAppServerNetworkGovernance {\n\tfetch(params?: UnknownRecord): Promise<MaestroAppServerNetworkFetchResult>;\n\tlistAudit(\n\t\tparams?: UnknownRecord,\n\t): Promise<MaestroAppServerNetworkAuditListResult>;\n}\n\nfunction isRecord(value: unknown): value is UnknownRecord {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction normalizeLimit(value: unknown): number {\n\tif (typeof value !== \"number\" || !Number.isFinite(value)) {\n\t\treturn DEFAULT_PAGE_LIMIT;\n\t}\n\treturn Math.min(MAX_PAGE_LIMIT, Math.max(1, Math.trunc(value)));\n}\n\nfunction normalizePositiveInteger(value: unknown, fallback: number): number {\n\tif (typeof value !== \"number\" || !Number.isFinite(value)) {\n\t\treturn fallback;\n\t}\n\treturn Math.max(1, Math.trunc(value));\n}\n\nfunction readOptionalString(value: unknown, field: string): string | undefined {\n\tif (value === undefined || value === null) {\n\t\treturn undefined;\n\t}\n\tif (typeof value !== \"string\") {\n\t\tthrow new MaestroAppServerNetworkGovernanceError(\n\t\t\t-32602,\n\t\t\t`Invalid ${field}`,\n\t\t);\n\t}\n\treturn value;\n}\n\nfunction requireUrl(params: UnknownRecord): URL {\n\tconst rawUrl = readOptionalString(params.url, \"url\");\n\tif (!rawUrl) {\n\t\tthrow new MaestroAppServerNetworkGovernanceError(-32602, \"Missing url\");\n\t}\n\tlet parsed: URL;\n\ttry {\n\t\tparsed = new URL(rawUrl);\n\t} catch {\n\t\tthrow new MaestroAppServerNetworkGovernanceError(-32602, \"Invalid url\");\n\t}\n\tif (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n\t\tthrow new MaestroAppServerNetworkGovernanceError(\n\t\t\t-32602,\n\t\t\t\"Only http and https URLs are supported\",\n\t\t);\n\t}\n\treturn parsed;\n}\n\nfunction normalizeMethod(value: unknown): string {\n\tconst method = readOptionalString(value, \"method\") ?? \"GET\";\n\tconst normalized = method.trim().toUpperCase();\n\tif (!/^[A-Z]+$/.test(normalized)) {\n\t\tthrow new MaestroAppServerNetworkGovernanceError(-32602, \"Invalid method\");\n\t}\n\treturn normalized;\n}\n\nfunction isIdempotentMethod(method: string | undefined): boolean {\n\treturn IDEMPOTENT_HTTP_METHODS.has((method ?? \"GET\").trim().toUpperCase());\n}\n\nfunction normalizeHeaders(value: unknown): Record<string, string> | undefined {\n\tif (value === undefined || value === null) {\n\t\treturn undefined;\n\t}\n\tif (!isRecord(value)) {\n\t\tthrow new MaestroAppServerNetworkGovernanceError(-32602, \"Invalid headers\");\n\t}\n\tconst headers: Record<string, string> = {};\n\tfor (const [key, headerValue] of Object.entries(value)) {\n\t\tif (typeof headerValue !== \"string\") {\n\t\t\tthrow new MaestroAppServerNetworkGovernanceError(\n\t\t\t\t-32602,\n\t\t\t\t\"Invalid headers\",\n\t\t\t);\n\t\t}\n\t\theaders[key] = headerValue;\n\t}\n\treturn headers;\n}\n\nfunction normalizeBody(value: unknown): Uint8Array | undefined {\n\tif (value === undefined || value === null) {\n\t\treturn undefined;\n\t}\n\tif (typeof value !== \"string\") {\n\t\tthrow new MaestroAppServerNetworkGovernanceError(\n\t\t\t-32602,\n\t\t\t\"Invalid bodyBase64\",\n\t\t);\n\t}\n\tif (\n\t\t!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(\n\t\t\tvalue,\n\t\t)\n\t) {\n\t\tthrow new MaestroAppServerNetworkGovernanceError(\n\t\t\t-32602,\n\t\t\t\"bodyBase64 must be valid base64\",\n\t\t);\n\t}\n\tconst decoded = Buffer.from(value, \"base64\");\n\tif (decoded.toString(\"base64\") !== value) {\n\t\tthrow new MaestroAppServerNetworkGovernanceError(\n\t\t\t-32602,\n\t\t\t\"bodyBase64 must be canonical base64\",\n\t\t);\n\t}\n\treturn decoded;\n}\n\nfunction responseHeadersToRecord(headers: Headers): Record<string, string> {\n\tconst record: Record<string, string> = {};\n\tfor (const [key, value] of headers.entries()) {\n\t\tconst normalizedKey = key.toLowerCase();\n\t\tconst existing = record[normalizedKey];\n\t\trecord[normalizedKey] =\n\t\t\texisting === undefined ? value : `${existing}\\n${value}`;\n\t}\n\treturn record;\n}\n\nfunction nowIso(): string {\n\treturn new Date().toISOString();\n}\n\nfunction redactAuditUrl(url: URL): string {\n\tconst redacted = new URL(url.toString());\n\tredacted.username = \"\";\n\tredacted.password = \"\";\n\treturn redacted.toString();\n}\n\nfunction urlWithoutCredentials(url: URL): URL {\n\tconst credentialless = new URL(url.toString());\n\tcredentialless.username = \"\";\n\tcredentialless.password = \"\";\n\treturn credentialless;\n}\n\nfunction decodeUrlCredential(value: string): string {\n\ttry {\n\t\treturn decodeURIComponent(value);\n\t} catch {\n\t\treturn value;\n\t}\n}\n\nfunction applyUrlCredentials(url: URL, headers: Headers): void {\n\tif ((!url.username && !url.password) || headers.has(\"authorization\")) {\n\t\treturn;\n\t}\n\tconst credentials = `${decodeUrlCredential(url.username)}:${decodeUrlCredential(\n\t\turl.password,\n\t)}`;\n\theaders.set(\n\t\t\"authorization\",\n\t\t`Basic ${Buffer.from(credentials, \"utf8\").toString(\"base64\")}`,\n\t);\n}\n\nfunction createAuditRecord(input: {\n\tmethod: string;\n\turl: URL;\n\tallowed: boolean;\n\tstatus: MaestroAppServerNetworkGovernanceStatus;\n\tstartedAt: string;\n\treason?: string;\n\tstatusCode?: number;\n}): MaestroAppServerNetworkAuditRecord {\n\treturn {\n\t\tid: randomUUID(),\n\t\tmethod: input.method,\n\t\turl: redactAuditUrl(input.url),\n\t\thost: input.url.hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\"),\n\t\tallowed: input.allowed,\n\t\tstatus: input.status,\n\t\t...(input.reason ? { reason: input.reason } : {}),\n\t\t...(input.statusCode !== undefined ? { statusCode: input.statusCode } : {}),\n\t\tstartedAt: input.startedAt,\n\t\tcompletedAt: nowIso(),\n\t};\n}\n\nfunction cloneAuditRecord(\n\trecord: MaestroAppServerNetworkAuditRecord,\n): MaestroAppServerNetworkAuditRecord {\n\treturn { ...record };\n}\n\nfunction headersToRecord(headers: Headers): Record<string, string> {\n\tconst record: Record<string, string> = {};\n\tfor (const [key, value] of headers.entries()) {\n\t\trecord[key] = value;\n\t}\n\treturn record;\n}\n\nfunction responseHeadersFromNode(\n\theaders: Record<string, string | string[] | undefined>,\n): Headers {\n\tconst responseHeaders = new Headers();\n\tfor (const [key, value] of Object.entries(headers)) {\n\t\tif (Array.isArray(value)) {\n\t\t\tfor (const entry of value) {\n\t\t\t\tresponseHeaders.append(key, entry);\n\t\t\t}\n\t\t} else if (value !== undefined) {\n\t\t\tresponseHeaders.set(key, value);\n\t\t}\n\t}\n\treturn responseHeaders;\n}\n\nexport async function fetchWithPinnedAddress(\n\tinput: string,\n\tinit: RequestInit | undefined,\n\tbinding: NetworkFetchBinding = {},\n\tpinnedAddressTimeoutMs = DEFAULT_PINNED_ADDRESS_TIMEOUT_MS,\n): Promise<Response> {\n\tconst resolvedAddresses =\n\t\tbinding.resolvedAddresses && binding.resolvedAddresses.length > 0\n\t\t\t? binding.resolvedAddresses\n\t\t\t: binding.resolvedAddress\n\t\t\t\t? [binding.resolvedAddress]\n\t\t\t\t: [];\n\tif (resolvedAddresses.length === 0) {\n\t\tconst url = new URL(input);\n\t\tif (!url.username && !url.password) {\n\t\t\treturn globalThis.fetch(input, init);\n\t\t}\n\t\tconst requestHeaders = new Headers(init?.headers);\n\t\tapplyUrlCredentials(url, requestHeaders);\n\t\treturn globalThis.fetch(urlWithoutCredentials(url).toString(), {\n\t\t\t...init,\n\t\t\theaders: requestHeaders,\n\t\t});\n\t}\n\tconst addressesToTry = isIdempotentMethod(init?.method)\n\t\t? resolvedAddresses\n\t\t: resolvedAddresses.slice(0, 1);\n\tlet lastError: unknown;\n\tfor (const resolvedAddress of addressesToTry) {\n\t\ttry {\n\t\t\treturn await fetchWithSinglePinnedAddress(\n\t\t\t\tinput,\n\t\t\t\tinit,\n\t\t\t\t{\n\t\t\t\t\t...binding,\n\t\t\t\t\tresolvedAddress,\n\t\t\t\t},\n\t\t\t\tpinnedAddressTimeoutMs,\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tlastError = error;\n\t\t}\n\t}\n\tthrow lastError instanceof Error\n\t\t? lastError\n\t\t: new Error(\"Network request failed\");\n}\n\nasync function fetchWithSinglePinnedAddress(\n\tinput: string,\n\tinit: RequestInit | undefined,\n\tbinding: Required<Pick<NetworkFetchBinding, \"resolvedAddress\">> &\n\t\tNetworkFetchBinding,\n\tpinnedAddressTimeoutMs: number,\n): Promise<Response> {\n\tconst url = new URL(input);\n\tconst requestHeaders = new Headers(init?.headers);\n\tapplyUrlCredentials(url, requestHeaders);\n\trequestHeaders.set(\"host\", url.host);\n\tconst transport = url.protocol === \"https:\" ? requestHttps : requestHttp;\n\tconst method = init?.method ?? \"GET\";\n\n\treturn new Promise<Response>((resolve, reject) => {\n\t\tlet settled = false;\n\t\tlet timeout: ReturnType<typeof setTimeout> | undefined;\n\t\tlet abortListener: (() => void) | undefined;\n\t\tconst signal = init?.signal;\n\t\tconst timeoutMessage = `Pinned network request to ${binding.resolvedAddress} timed out after ${pinnedAddressTimeoutMs}ms`;\n\t\tconst cleanup = () => {\n\t\t\tif (timeout) {\n\t\t\t\tclearTimeout(timeout);\n\t\t\t\ttimeout = undefined;\n\t\t\t}\n\t\t\tif (signal && abortListener) {\n\t\t\t\tsignal.removeEventListener(\"abort\", abortListener);\n\t\t\t\tabortListener = undefined;\n\t\t\t}\n\t\t};\n\t\tconst finishResolve = (response: Response) => {\n\t\t\tif (settled) {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tsettled = true;\n\t\t\tcleanup();\n\t\t\tresolve(response);\n\t\t};\n\t\tconst finishReject = (error: Error) => {\n\t\t\tif (settled) {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tsettled = true;\n\t\t\tcleanup();\n\t\t\treject(error);\n\t\t};\n\t\tconst request = transport(\n\t\t\t{\n\t\t\t\thostname: binding.resolvedAddress,\n\t\t\t\tmethod,\n\t\t\t\tpath: `${url.pathname}${url.search}`,\n\t\t\t\tport: url.port ? Number(url.port) : undefined,\n\t\t\t\theaders: headersToRecord(requestHeaders),\n\t\t\t\t...(url.protocol === \"https:\"\n\t\t\t\t\t? { servername: binding.originalHost ?? url.hostname }\n\t\t\t\t\t: {}),\n\t\t\t},\n\t\t\t(response) => {\n\t\t\t\tfinishResolve(\n\t\t\t\t\tnew Response(Readable.toWeb(response) as ReadableStream<Uint8Array>, {\n\t\t\t\t\t\tstatus: response.statusCode ?? 500,\n\t\t\t\t\t\tstatusText: response.statusMessage,\n\t\t\t\t\t\theaders: responseHeadersFromNode(response.headers),\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t},\n\t\t);\n\t\trequest.on(\"error\", finishReject);\n\t\trequest.setTimeout(pinnedAddressTimeoutMs, () => {\n\t\t\trequest.destroy(new Error(timeoutMessage));\n\t\t});\n\t\ttimeout = setTimeout(() => {\n\t\t\trequest.destroy(new Error(timeoutMessage));\n\t\t}, pinnedAddressTimeoutMs);\n\t\ttimeout.unref?.();\n\t\tif (signal) {\n\t\t\tif (signal.aborted) {\n\t\t\t\tconst error = new Error(\"Request aborted\");\n\t\t\t\trequest.destroy(error);\n\t\t\t\tfinishReject(error);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tabortListener = () => {\n\t\t\t\tconst error = new Error(\"Request aborted\");\n\t\t\t\trequest.destroy(error);\n\t\t\t\tfinishReject(error);\n\t\t\t};\n\t\t\tsignal.addEventListener(\"abort\", abortListener, { once: true });\n\t\t}\n\t\tconst body = init?.body;\n\t\tif (body !== undefined && body !== null) {\n\t\t\tif (\n\t\t\t\ttypeof body === \"string\" ||\n\t\t\t\tbody instanceof Uint8Array ||\n\t\t\t\tbody instanceof ArrayBuffer\n\t\t\t) {\n\t\t\t\trequest.write(body instanceof ArrayBuffer ? Buffer.from(body) : body);\n\t\t\t} else {\n\t\t\t\tconst error = new Error(\"Unsupported request body\");\n\t\t\t\trequest.destroy(error);\n\t\t\t\tfinishReject(error);\n\t\t\t\treturn;\n\t\t\t}\n\t\t}\n\t\trequest.end();\n\t});\n}\n\nasync function readResponseBytes(\n\tresponse: Response,\n\tmaxResponseBytes: number,\n): Promise<Buffer> {\n\tif (!response.body) {\n\t\treturn Buffer.from(await response.arrayBuffer());\n\t}\n\n\tconst reader = response.body.getReader();\n\tconst chunks: Buffer[] = [];\n\tlet totalBytes = 0;\n\ttry {\n\t\tfor (;;) {\n\t\t\tconst { done, value } = await reader.read();\n\t\t\tif (done) {\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tif (!value) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\ttotalBytes += value.byteLength;\n\t\t\tif (totalBytes > maxResponseBytes) {\n\t\t\t\tawait reader.cancel().catch(() => undefined);\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`Response body exceeds ${maxResponseBytes} byte network proxy limit`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tchunks.push(Buffer.from(value));\n\t\t}\n\t} finally {\n\t\treader.releaseLock();\n\t}\n\treturn Buffer.concat(chunks, totalBytes);\n}\n\nasync function evaluateNetworkPolicy(url: URL): Promise<{\n\tallowed: boolean;\n\treason?: string;\n\toriginalHost?: string;\n\tresolvedAddress?: string;\n\tresolvedAddresses?: string[];\n}> {\n\tlet policy: EnterprisePolicy | null;\n\ttry {\n\t\tpolicy = loadPolicy();\n\t} catch (error) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Failed to load managed policy: ${error instanceof Error ? error.message : \"unknown error\"}`,\n\t\t};\n\t}\n\tif (!policy?.network) {\n\t\treturn { allowed: true };\n\t}\n\tconst check = await checkNetworkRestrictionsDetailed(\n\t\turl.toString(),\n\t\tpolicy.network,\n\t);\n\treturn {\n\t\tallowed: check.allowed,\n\t\t...(check.reason ? { reason: check.reason } : {}),\n\t\t...(check.normalizedHost ? { originalHost: check.normalizedHost } : {}),\n\t\t...(check.resolvedIPs[0] ? { resolvedAddress: check.resolvedIPs[0] } : {}),\n\t\t...(check.resolvedIPs.length > 0\n\t\t\t? { resolvedAddresses: [...check.resolvedIPs] }\n\t\t\t: {}),\n\t};\n}\n\nexport function createMaestroAppServerNetworkGovernance(\n\toptions: MaestroAppServerNetworkGovernanceOptions = {},\n): MaestroAppServerNetworkGovernance {\n\tconst pinnedAddressTimeoutMs = normalizePositiveInteger(\n\t\toptions.pinnedAddressTimeoutMs,\n\t\tDEFAULT_PINNED_ADDRESS_TIMEOUT_MS,\n\t);\n\tconst fetchImpl =\n\t\toptions.fetchImpl ??\n\t\t((input, init, binding) =>\n\t\t\tfetchWithPinnedAddress(input, init, binding, pinnedAddressTimeoutMs));\n\tconst maxResponseBytes = normalizePositiveInteger(\n\t\toptions.maxResponseBytes,\n\t\tDEFAULT_MAX_RESPONSE_BYTES,\n\t);\n\tconst maxAuditRecords = normalizePositiveInteger(\n\t\toptions.maxAuditRecords,\n\t\tDEFAULT_MAX_AUDIT_RECORDS,\n\t);\n\tconst audit: MaestroAppServerNetworkAuditRecord[] = [];\n\n\tfunction recordAudit(record: MaestroAppServerNetworkAuditRecord): void {\n\t\taudit.push(record);\n\t\tif (audit.length > maxAuditRecords) {\n\t\t\taudit.splice(0, audit.length - maxAuditRecords);\n\t\t}\n\t}\n\n\treturn {\n\t\tasync fetch(params = {}) {\n\t\t\tif (!isRecord(params)) {\n\t\t\t\tthrow new MaestroAppServerNetworkGovernanceError(\n\t\t\t\t\t-32602,\n\t\t\t\t\t\"Invalid params\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst url = requireUrl(params);\n\t\t\tconst method = normalizeMethod(params.method);\n\t\t\tconst headers = normalizeHeaders(params.headers);\n\t\t\tconst body = normalizeBody(params.bodyBase64);\n\t\t\tconst startedAt = nowIso();\n\n\t\t\tconst policyCheck = await evaluateNetworkPolicy(url);\n\t\t\tif (!policyCheck.allowed) {\n\t\t\t\tconst auditRecord = createAuditRecord({\n\t\t\t\t\tmethod,\n\t\t\t\t\turl,\n\t\t\t\t\tallowed: false,\n\t\t\t\t\tstatus: \"blocked\",\n\t\t\t\t\treason: policyCheck.reason,\n\t\t\t\t\tstartedAt,\n\t\t\t\t});\n\t\t\t\trecordAudit(auditRecord);\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\tstatus: \"blocked\",\n\t\t\t\t\t...(policyCheck.reason ? { reason: policyCheck.reason } : {}),\n\t\t\t\t\taudit: cloneAuditRecord(auditRecord),\n\t\t\t\t};\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst response = await fetchImpl(\n\t\t\t\t\turl.toString(),\n\t\t\t\t\t{\n\t\t\t\t\t\tmethod,\n\t\t\t\t\t\tredirect: \"manual\",\n\t\t\t\t\t\t...(headers ? { headers } : {}),\n\t\t\t\t\t\t...(body ? { body } : {}),\n\t\t\t\t\t},\n\t\t\t\t\t{\n\t\t\t\t\t\toriginalHost: policyCheck.originalHost,\n\t\t\t\t\t\tresolvedAddress: policyCheck.resolvedAddress,\n\t\t\t\t\t\tresolvedAddresses: policyCheck.resolvedAddresses,\n\t\t\t\t\t},\n\t\t\t\t);\n\t\t\t\tconst bytes = await readResponseBytes(response, maxResponseBytes);\n\t\t\t\tconst auditRecord = createAuditRecord({\n\t\t\t\t\tmethod,\n\t\t\t\t\turl,\n\t\t\t\t\tallowed: true,\n\t\t\t\t\tstatus: \"allowed\",\n\t\t\t\t\tstatusCode: response.status,\n\t\t\t\t\tstartedAt,\n\t\t\t\t});\n\t\t\t\trecordAudit(auditRecord);\n\t\t\t\treturn {\n\t\t\t\t\tallowed: true,\n\t\t\t\t\tstatus: \"allowed\",\n\t\t\t\t\tstatusCode: response.status,\n\t\t\t\t\theaders: responseHeadersToRecord(response.headers),\n\t\t\t\t\tbodyBase64: bytes.toString(\"base64\"),\n\t\t\t\t\taudit: cloneAuditRecord(auditRecord),\n\t\t\t\t};\n\t\t\t} catch (error) {\n\t\t\t\tconst reason =\n\t\t\t\t\terror instanceof Error ? error.message : \"Network request failed\";\n\t\t\t\tconst auditRecord = createAuditRecord({\n\t\t\t\t\tmethod,\n\t\t\t\t\turl,\n\t\t\t\t\tallowed: true,\n\t\t\t\t\tstatus: \"failed\",\n\t\t\t\t\treason,\n\t\t\t\t\tstartedAt,\n\t\t\t\t});\n\t\t\t\trecordAudit(auditRecord);\n\t\t\t\treturn {\n\t\t\t\t\tallowed: true,\n\t\t\t\t\tstatus: \"failed\",\n\t\t\t\t\treason,\n\t\t\t\t\taudit: cloneAuditRecord(auditRecord),\n\t\t\t\t};\n\t\t\t}\n\t\t},\n\n\t\tasync listAudit(params = {}) {\n\t\t\tif (!isRecord(params)) {\n\t\t\t\tthrow new MaestroAppServerNetworkGovernanceError(\n\t\t\t\t\t-32602,\n\t\t\t\t\t\"Invalid params\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst limit = normalizeLimit(params.limit);\n\t\t\treturn {\n\t\t\t\taudit: audit.slice(-limit).map(cloneAuditRecord),\n\t\t\t\tnextCursor: null,\n\t\t\t};\n\t\t},\n\t};\n}\n"]}

package/dist/app-server/plugin-bundle-api.d.ts

@@ -0,0 +1,17 @@
+import type { MaestroAppServerPluginBundleListResult, MaestroAppServerPluginBundleMutationResult } from "@evalops/contracts";
+type UnknownRecord = Record<string, unknown>;
+export declare class MaestroAppServerPluginBundleError extends Error {
+    readonly code: number;
+    constructor(code: number, message: string);
+}
+export interface MaestroAppServerPluginBundleApi {
+    listBundles(params?: UnknownRecord): Promise<MaestroAppServerPluginBundleListResult>;
+    installBundle(params?: UnknownRecord): Promise<MaestroAppServerPluginBundleMutationResult>;
+    removeBundle(params?: UnknownRecord): Promise<MaestroAppServerPluginBundleMutationResult>;
+}
+export interface MaestroAppServerPluginBundleApiOptions {
+    projectRoot?: string;
+}
+export declare function createMaestroAppServerPluginBundleApi(options?: MaestroAppServerPluginBundleApiOptions): MaestroAppServerPluginBundleApi;
+export {};
+//# sourceMappingURL=plugin-bundle-api.d.ts.map

package/dist/app-server/plugin-bundle-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-bundle-api.d.ts","sourceRoot":"","sources":["../../src/app-server/plugin-bundle-api.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACX,sCAAsC,EACtC,0CAA0C,EAE1C,MAAM,oBAAoB,CAAC;AAgB5B,KAAK,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE7C,qBAAa,iCAAkC,SAAQ,KAAK;IAE1D,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM;CAKhB;AAED,MAAM,WAAW,+BAA+B;IAC/C,WAAW,CACV,MAAM,CAAC,EAAE,aAAa,GACpB,OAAO,CAAC,sCAAsC,CAAC,CAAC;IACnD,aAAa,CACZ,MAAM,CAAC,EAAE,aAAa,GACpB,OAAO,CAAC,0CAA0C,CAAC,CAAC;IACvD,YAAY,CACX,MAAM,CAAC,EAAE,aAAa,GACpB,OAAO,CAAC,0CAA0C,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,sCAAsC;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AA6KD,wBAAgB,qCAAqC,CACpD,OAAO,GAAE,sCAA2C,GAClD,+BAA+B,CAuGjC"}