@inkbox/sdk 0.2.16 → 0.3.0

package/dist/tunnels/client/_dispatch.js

@@ -0,0 +1,314 @@
+/**
+ * inkbox-tunnels/client/_dispatch.ts
+ *
+ * The Dispatch interface — both the in-process h1 parser and the h2
+ * transcoder hand parsed requests to a Dispatch impl. The interface is
+ * transport-neutral; the same impl serves an h1 inbound and an h2 inbound.
+ *
+ * UpstreamUrlDispatch forwards requests to a customer-supplied URL via
+ * undici (one Pool per dispatcher). CallableDispatch invokes an
+ * in-process Fetch-style handler. ``dispatchWebSocket`` on either impl
+ * routes WS upgrades (h1 ``Upgrade: websocket`` or h2 Extended CONNECT)
+ * without going through the HTTP response sink.
+ */
+import { Readable } from "node:stream";
+import { Pool } from "undici";
+import { HOP_BY_HOP_REQUEST } from "./_protocol.js";
+import { validateEnvelopePath } from "./_validation.js";
+import { joinForwardPath } from "./_url_forward.js";
+import { buildUpstreamTlsConnectOpts } from "./_upstream_tls.js";
+function logDispatch(line) {
+    // Single structured info line per dispatch outcome. Matches the
+    // pattern used elsewhere in `_runtime.ts` (console-based until the
+    // SDK gets a pluggable logger).
+    // eslint-disable-next-line no-console
+    console.info(line);
+}
+/**
+ * Forward requests to a customer-supplied URL via undici.
+ *
+ * One ``undici.Pool`` per dispatcher. The pool's connect options carry
+ * the upstream-TLS options when the URL is https://. We always speak
+ * h1 to the upstream — we transcode at this boundary.
+ */
+export class UpstreamUrlDispatch {
+    pool;
+    forwardTo;
+    publicHost;
+    maxOutboundBodyBytes;
+    maxInboundBodyBytes;
+    verifyTls;
+    caBundle;
+    constructor(opts) {
+        this.forwardTo = new URL(opts.forwardTo);
+        this.publicHost = opts.publicHost;
+        this.maxOutboundBodyBytes = opts.maxOutboundBodyBytes;
+        this.maxInboundBodyBytes = opts.maxInboundBodyBytes;
+        this.verifyTls = opts.verifyTls ?? true;
+        this.caBundle = opts.caBundle ?? null;
+        const origin = `${this.forwardTo.protocol}//${this.forwardTo.host}`;
+        const connect = this.forwardTo.protocol === "https:"
+            ? buildUpstreamTlsConnectOpts({
+                verify: opts.verifyTls,
+                caBundle: opts.caBundle,
+            })
+            : {};
+        this.pool = new Pool(origin, {
+            connections: 16,
+            pipelining: 1,
+            connect,
+        });
+    }
+    async aclose() {
+        try {
+            await this.pool.close();
+        }
+        catch {
+            /* swallow */
+        }
+    }
+    async dispatch(request, response) {
+        // Path validation — same rule as edge URL forwarding.
+        const reason = validateEnvelopePath(request.path);
+        if (reason !== null) {
+            await sendSimple(response, 400, "invalid path");
+            return;
+        }
+        const targetPath = joinForwardPath(this.forwardTo.toString(), request.path);
+        // joinForwardPath returns a full URL; we need just the path+query for undici.
+        const targetUrl = new URL(targetPath);
+        const targetPathOnly = targetUrl.pathname + targetUrl.search;
+        const targetHost = this.forwardTo.host;
+        const outHeaders = [];
+        outHeaders.push(["host", targetHost]);
+        outHeaders.push(["x-forwarded-host", this.publicHost]);
+        outHeaders.push(["x-forwarded-proto", "https"]);
+        if (request.forwardedForIp != null) {
+            outHeaders.push(["x-forwarded-for", request.forwardedForIp]);
+            outHeaders.push(["forwarded", `for=${request.forwardedForIp}`]);
+        }
+        const seen = new Set([
+            "host",
+            "x-forwarded-host",
+            "x-forwarded-proto",
+            "x-forwarded-for",
+            "forwarded",
+        ]);
+        for (const [k, v] of request.headers) {
+            const kl = k.toLowerCase();
+            if (kl.startsWith(":"))
+                continue;
+            if (HOP_BY_HOP_REQUEST.has(kl))
+                continue;
+            if (seen.has(kl))
+                continue;
+            outHeaders.push([k, v]);
+        }
+        const transport = request.transport ?? "h1";
+        try {
+            const headersObj = {};
+            for (const [k, v] of outHeaders) {
+                const existing = headersObj[k];
+                if (existing === undefined) {
+                    headersObj[k] = v;
+                }
+                else if (Array.isArray(existing)) {
+                    existing.push(v);
+                }
+                else {
+                    headersObj[k] = [existing, v];
+                }
+            }
+            const resp = await this.pool.request({
+                method: request.method,
+                path: targetPathOnly,
+                headers: headersObj,
+                body: Readable.from(asAsyncBytes(request.body)),
+                bodyTimeout: 60_000,
+            });
+            const respHeaders = [];
+            for (const [k, v] of Object.entries(resp.headers)) {
+                if (Array.isArray(v)) {
+                    for (const item of v)
+                        respHeaders.push([k, item]);
+                }
+                else if (typeof v === "string") {
+                    respHeaders.push([k, v]);
+                }
+            }
+            await response.sendHead({
+                status: resp.statusCode,
+                headers: respHeaders,
+            });
+            let bytesOut = 0;
+            try {
+                for await (const chunk of resp.body) {
+                    const buf = Buffer.isBuffer(chunk)
+                        ? chunk
+                        : Buffer.from(chunk);
+                    bytesOut += buf.length;
+                    if (bytesOut > this.maxOutboundBodyBytes) {
+                        await response.reset("response-too-large");
+                        logDispatch(`dispatch=url-${transport} status=${resp.statusCode} ` +
+                            `method=${request.method} path=${request.path} ` +
+                            `bytes_out=${bytesOut} outcome=reset reason=response-too-large`);
+                        return;
+                    }
+                    await response.sendBody(buf);
+                }
+                await response.endBody();
+                logDispatch(`dispatch=url-${transport} status=${resp.statusCode} ` +
+                    `method=${request.method} path=${request.path} ` +
+                    `bytes_out=${bytesOut} outcome=ok`);
+            }
+            catch {
+                await response.reset("upstream-error");
+                logDispatch(`dispatch=url-${transport} status=${resp.statusCode} ` +
+                    `method=${request.method} path=${request.path} ` +
+                    `outcome=upstream-error`);
+            }
+        }
+        catch {
+            logDispatch(`dispatch=url-${transport} status=502 method=${request.method} ` +
+                `path=${request.path} outcome=upstream-error`);
+            try {
+                await sendSimple(response, 502, "upstream error");
+            }
+            catch {
+                /* swallow */
+            }
+        }
+    }
+    async dispatchWebSocket(request, ws) {
+        const reason = validateEnvelopePath(request.path);
+        if (reason !== null) {
+            try {
+                await ws.reject({ status: 400 });
+            }
+            catch {
+                /* swallow */
+            }
+            return;
+        }
+        const { bridgeWsUpgradeToUrl } = await import("./_ws_url_bridge.js");
+        await bridgeWsUpgradeToUrl({
+            forwardTo: this.forwardTo,
+            publicHost: this.publicHost,
+            verifyTls: this.verifyTls,
+            caBundle: this.caBundle,
+            request,
+            ws,
+        });
+    }
+}
+async function* asAsyncBytes(body) {
+    for await (const chunk of body) {
+        if (chunk.length > 0)
+            yield chunk;
+    }
+}
+async function sendSimple(response, status, body) {
+    const buf = Buffer.from(body);
+    await response.sendHead({
+        status,
+        headers: [
+            ["content-type", "text/plain"],
+            ["content-length", String(buf.length)],
+        ],
+    });
+    if (buf.length > 0)
+        await response.sendBody(buf);
+    await response.endBody();
+}
+/**
+ * Dispatch impl that invokes an in-process `InkboxHandler` (Fetch-style).
+ * Used by passthrough mode when the user supplied a `handler` instead
+ * of a `forwardTo` URL. When `wsHandler` is also supplied, WebSocket
+ * upgrades route through `dispatchWebSocket`.
+ */
+export class CallableDispatch {
+    opts;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    async aclose() {
+        /* nothing to clean up — handler doesn't own runtime resources */
+    }
+    async dispatch(request, response) {
+        if (request.isWebSocket) {
+            // Transports that recognize ``dispatchWebSocket`` route WS
+            // upgrades there directly. If we get here it means either the
+            // transport is older or no ws handler is configured; refuse.
+            const status = this.opts.wsHandler === undefined ? 501 : 501;
+            await sendSimple(response, status, "websocket dispatch routed to http path");
+            return;
+        }
+        const reason = validateEnvelopePath(request.path);
+        if (reason !== null) {
+            await sendSimple(response, 400, "invalid path");
+            return;
+        }
+        const { invokeHandlerStreaming } = await import("./_callable_streaming.js");
+        const transport = request.transport ?? "h1";
+        try {
+            await invokeHandlerStreaming({
+                handler: this.opts.handler,
+                request,
+                response,
+                publicHost: this.opts.publicHost,
+                maxOutboundBodyBytes: this.opts.maxOutboundBodyBytes,
+            });
+            logDispatch(`dispatch=callable-${transport} method=${request.method} ` +
+                `path=${request.path} outcome=ok`);
+        }
+        catch (err) {
+            logDispatch(`dispatch=callable-${transport} method=${request.method} ` +
+                `path=${request.path} outcome=handler-error`);
+            throw err;
+        }
+    }
+    async dispatchWebSocket(request, ws) {
+        const wsHandler = this.opts.wsHandler;
+        if (wsHandler === undefined) {
+            // Caller checked ``in`` and routed here, but no ws handler is
+            // configured — refuse cleanly.
+            try {
+                await ws.reject({ status: 501 });
+            }
+            catch {
+                /* swallow */
+            }
+            return;
+        }
+        const reason = validateEnvelopePath(request.path);
+        if (reason !== null) {
+            await ws.reject({ status: 400 });
+            return;
+        }
+        const headersMap = new Map();
+        const offered = [];
+        for (const [k, v] of request.headers) {
+            const kl = k.toLowerCase();
+            headersMap.set(kl, v);
+            if (kl === "sec-websocket-protocol") {
+                for (const piece of v.split(",")) {
+                    const trimmed = piece.trim();
+                    if (trimmed)
+                        offered.push(trimmed);
+                }
+            }
+        }
+        const url = `wss://${this.opts.publicHost}${request.path}`;
+        const { bridgeWsHandlerOverSink } = await import("./_ws_passthrough.js");
+        await bridgeWsHandlerOverSink({
+            handler: wsHandler,
+            sink: ws,
+            meta: {
+                url,
+                headers: headersMap,
+                offeredSubprotocols: offered,
+            },
+        });
+    }
+}
+//# sourceMappingURL=_dispatch.js.map

package/dist/tunnels/client/_dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_dispatch.js","sourceRoot":"","sources":["../../../src/tunnels/client/_dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAEjE,SAAS,WAAW,CAAC,IAAY;IAC/B,gEAAgE;IAChE,mEAAmE;IACnE,gCAAgC;IAChC,sCAAsC;IACtC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAsED;;;;;;GAMG;AACH,MAAM,OAAO,mBAAmB;IACb,IAAI,CAAO;IACX,SAAS,CAAM;IACf,UAAU,CAAS;IACnB,oBAAoB,CAAS;IAC7B,mBAAmB,CAAS;IAC5B,SAAS,CAAU;IACnB,QAAQ,CAAyB;IAElD,YAAY,IAA6B;QACvC,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,oBAAoB,CAAC;QACtD,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,CAAC;QACpD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;QACtC,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACpE,MAAM,OAAO,GACX,IAAI,CAAC,SAAS,CAAC,QAAQ,KAAK,QAAQ;YAClC,CAAC,CAAC,2BAA2B,CAAC;gBAC1B,MAAM,EAAE,IAAI,CAAC,SAAS;gBACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC;YACJ,CAAC,CAAC,EAAE,CAAC;QACT,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE;YAC3B,WAAW,EAAE,EAAE;YACf,UAAU,EAAE,CAAC;YACb,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,aAAa;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,OAAwB,EACxB,QAA8B;QAE9B,sDAAsD;QACtD,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,UAAU,CAAC,QAAQ,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5E,8EAA8E;QAC9E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,cAAc,GAAG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC;QAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAEvC,MAAM,UAAU,GAA4B,EAAE,CAAC;QAC/C,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;QACtC,UAAU,CAAC,IAAI,CAAC,CAAC,kBAAkB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QACvD,UAAU,CAAC,IAAI,CAAC,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC,CAAC;QAChD,IAAI,OAAO,CAAC,cAAc,IAAI,IAAI,EAAE,CAAC;YACnC,UAAU,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;YAC7D,UAAU,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,OAAO,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC;YACnB,MAAM;YACN,kBAAkB;YAClB,mBAAmB;YACnB,iBAAiB;YACjB,WAAW;SACZ,CAAC,CAAC;QACH,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;YAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YACjC,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,SAAS;YACzC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,SAAS;YAC3B,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,UAAU,GAAsC,EAAE,CAAC;YACzD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC;gBAChC,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;gBAC/B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC3B,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBACpB,CAAC;qBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACnC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACnB,CAAC;qBAAM,CAAC;oBACN,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;gBACnC,MAAM,EAAE,OAAO,CAAC,MAOH;gBACb,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,UAAU;gBACnB,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC/C,WAAW,EAAE,MAAM;aACpB,CAAC,CAAC;YAEH,MAAM,WAAW,GAA4B,EAAE,CAAC;YAChD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrB,KAAK,MAAM,IAAI,IAAI,CAAC;wBAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;gBACpD,CAAC;qBAAM,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;oBACjC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;YACD,MAAM,QAAQ,CAAC,QAAQ,CAAC;gBACtB,MAAM,EAAE,IAAI,CAAC,UAAU;gBACvB,OAAO,EAAE,WAAW;aACrB,CAAC,CAAC;YACH,IAAI,QAAQ,GAAG,CAAC,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBACpC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;wBAChC,CAAC,CAAC,KAAK;wBACP,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAmB,CAAC,CAAC;oBACrC,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC;oBACvB,IAAI,QAAQ,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;wBACzC,MAAM,QAAQ,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;wBAC3C,WAAW,CACT,gBAAgB,SAAS,WAAW,IAAI,CAAC,UAAU,GAAG;4BACpD,UAAU,OAAO,CAAC,MAAM,SAAS,OAAO,CAAC,IAAI,GAAG;4BAChD,aAAa,QAAQ,0CAA0C,CAClE,CAAC;wBACF,OAAO;oBACT,CAAC;oBACD,MAAM,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC/B,CAAC;gBACD,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACzB,WAAW,CACT,gBAAgB,SAAS,WAAW,IAAI,CAAC,UAAU,GAAG;oBACpD,UAAU,OAAO,CAAC,MAAM,SAAS,OAAO,CAAC,IAAI,GAAG;oBAChD,aAAa,QAAQ,aAAa,CACrC,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;gBACvC,WAAW,CACT,gBAAgB,SAAS,WAAW,IAAI,CAAC,UAAU,GAAG;oBACpD,UAAU,OAAO,CAAC,MAAM,SAAS,OAAO,CAAC,IAAI,GAAG;oBAChD,wBAAwB,CAC3B,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,CACT,gBAAgB,SAAS,sBAAsB,OAAO,CAAC,MAAM,GAAG;gBAC9D,QAAQ,OAAO,CAAC,IAAI,yBAAyB,CAChD,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,UAAU,CAAC,QAAQ,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,aAAa;YACf,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,OAAwB,EACxB,EAAgD;QAEhD,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACP,aAAa;YACf,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACrE,MAAM,oBAAoB,CAAC;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO;YACP,EAAE;SACH,CAAC,CAAC;IACL,CAAC;CACF;AAED,KAAK,SAAS,CAAC,CAAC,YAAY,CAC1B,IAA2B;IAE3B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,KAAK,CAAC;IACpC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,QAA8B,EAC9B,MAAc,EACd,IAAY;IAEZ,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,QAAQ,CAAC,QAAQ,CAAC;QACtB,MAAM;QACN,OAAO,EAAE;YACP,CAAC,cAAc,EAAE,YAAY,CAAC;YAC9B,CAAC,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;SACvC;KACF,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;AAC3B,CAAC;AAYD;;;;;GAKG;AACH,MAAM,OAAO,gBAAgB;IACE;IAA7B,YAA6B,IAA0B;QAA1B,SAAI,GAAJ,IAAI,CAAsB;IAAG,CAAC;IAE3D,KAAK,CAAC,MAAM;QACV,iEAAiE;IACnE,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,OAAwB,EACxB,QAA8B;QAE9B,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,2DAA2D;YAC3D,8DAA8D;YAC9D,6DAA6D;YAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAC7D,MAAM,UAAU,CACd,QAAQ,EACR,MAAM,EACN,wCAAwC,CACzC,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,UAAU,CAAC,QAAQ,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QACD,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAC7C,0BAA0B,CAC3B,CAAC;QACF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,sBAAsB,CAAC;gBAC3B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;gBAC1B,OAAO;gBACP,QAAQ;gBACR,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;gBAChC,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,oBAAoB;aACrD,CAAC,CAAC;YACH,WAAW,CACT,qBAAqB,SAAS,WAAW,OAAO,CAAC,MAAM,GAAG;gBACxD,QAAQ,OAAO,CAAC,IAAI,aAAa,CACpC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CACT,qBAAqB,SAAS,WAAW,OAAO,CAAC,MAAM,GAAG;gBACxD,QAAQ,OAAO,CAAC,IAAI,wBAAwB,CAC/C,CAAC;YACF,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,OAAwB,EACxB,EAAgD;QAEhD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QACtC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,8DAA8D;YAC9D,+BAA+B;YAC/B,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACP,aAAa;YACf,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC7C,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;YAC3B,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YACtB,IAAI,EAAE,KAAK,wBAAwB,EAAE,CAAC;gBACpC,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;oBAC7B,IAAI,OAAO;wBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC3D,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACzE,MAAM,uBAAuB,CAAC;YAC5B,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE,EAAE;YACR,IAAI,EAAE;gBACJ,GAAG;gBACH,OAAO,EAAE,UAAU;gBACnB,mBAAmB,EAAE,OAAO;aAC7B;SACF,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/tunnels/client/_envelope.d.ts

@@ -0,0 +1,55 @@
+/**
+ * inkbox-tunnels/client/_envelope.ts
+ *
+ * Pure synchronous envelope parser. Mirrors Python `_envelope.py` line
+ * for line. No I/O. The `inkbox-body-uri` materialization step lives in
+ * `_runtime.ts` so this module stays trivially unit-testable.
+ */
+import { TunnelRouteKind } from "./_protocol.js";
+export type RouteKind = TunnelRouteKind;
+export interface Envelope {
+    requestId: string;
+    method: string;
+    path: string;
+    routeKind: RouteKind;
+    wsId: string | null;
+    forwardedHeaders: Array<[string, string]>;
+    body: Buffer;
+    bodyUri: string | null;
+    forwardedForIp: string | null;
+    tcpId: string | null;
+    sniHost: string | null;
+    extraMeta: Record<string, string>;
+}
+/**
+ * `Envelope` exposed read-only on `InkboxRequestContext`. Same shape;
+ * separate type so callers see immutability at the type level.
+ */
+export type ReadonlyEnvelope = Readonly<{
+    requestId: string;
+    method: string;
+    path: string;
+    routeKind: RouteKind;
+    wsId: string | null;
+    forwardedHeaders: ReadonlyArray<readonly [string, string]>;
+    body: Buffer;
+    bodyUri: string | null;
+    forwardedForIp: string | null;
+    tcpId: string | null;
+    sniHost: string | null;
+    extraMeta: Readonly<Record<string, string>>;
+}>;
+/**
+ * Parse a `/_system/intake` response into an {@link Envelope}.
+ *
+ * Returns `null` if the headers are missing the required
+ * `inkbox-request-id` field.
+ *
+ * The returned envelope's `body` may be empty when the server has
+ * offloaded the body to an out-of-band fetch URL — in that case
+ * `bodyUri` is set and the runtime materializes it before dispatch.
+ */
+export declare function parseEnvelope(headers: Array<[string, string]>, body: Buffer): Envelope | null;
+/** Drop hop-by-hop headers from an upstream response before forwarding. */
+export declare function filterResponseHeaders(headers: Array<[string, string]>): Array<[string, string]>;
+//# sourceMappingURL=_envelope.d.ts.map

package/dist/tunnels/client/_envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_envelope.d.ts","sourceRoot":"","sources":["../../../src/tunnels/client/_envelope.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAKL,eAAe,EAChB,MAAM,gBAAgB,CAAC;AAExB,MAAM,MAAM,SAAS,GAAG,eAAe,CAAC;AAExC,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,SAAS,CAAC;IACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,gBAAgB,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,SAAS,CAAC;IACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,gBAAgB,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC7C,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAChC,IAAI,EAAE,MAAM,GACX,QAAQ,GAAG,IAAI,CA2EjB;AAED,2EAA2E;AAC3E,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC/B,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAEzB"}

package/dist/tunnels/client/_envelope.js

@@ -0,0 +1,97 @@
+/**
+ * inkbox-tunnels/client/_envelope.ts
+ *
+ * Pure synchronous envelope parser. Mirrors Python `_envelope.py` line
+ * for line. No I/O. The `inkbox-body-uri` materialization step lives in
+ * `_runtime.ts` so this module stays trivially unit-testable.
+ */
+import { HOP_BY_HOP_RESPONSE, INKBOX_FORWARDED_HEADER_PREFIX, INKBOX_NAMESPACE_PREFIX, TunnelMetaHeader, TunnelRouteKind, } from "./_protocol.js";
+/**
+ * Parse a `/_system/intake` response into an {@link Envelope}.
+ *
+ * Returns `null` if the headers are missing the required
+ * `inkbox-request-id` field.
+ *
+ * The returned envelope's `body` may be empty when the server has
+ * offloaded the body to an out-of-band fetch URL — in that case
+ * `bodyUri` is set and the runtime materializes it before dispatch.
+ */
+export function parseEnvelope(headers, body) {
+    let requestId = "";
+    let method = "GET";
+    let path = "/";
+    let routeKind = TunnelRouteKind.WEBHOOK;
+    let wsId = null;
+    let tcpId = null;
+    let sniHost = null;
+    let bodyUri = null;
+    let forwardedForIp = null;
+    const forwarded = [];
+    const extra = {};
+    for (const [k, v] of headers) {
+        const kl = k.toLowerCase();
+        switch (kl) {
+            case TunnelMetaHeader.REQUEST_ID:
+                requestId = v;
+                break;
+            case TunnelMetaHeader.METHOD:
+                method = v;
+                break;
+            case TunnelMetaHeader.PATH:
+                path = v;
+                break;
+            case TunnelMetaHeader.ROUTE_KIND:
+                if (v === TunnelRouteKind.WEBHOOK ||
+                    v === TunnelRouteKind.WS_UPGRADE ||
+                    v === TunnelRouteKind.TCP_STREAM) {
+                    routeKind = v;
+                }
+                break;
+            case TunnelMetaHeader.WS_ID:
+                wsId = v;
+                break;
+            case TunnelMetaHeader.TCP_ID:
+                tcpId = v;
+                break;
+            case TunnelMetaHeader.SNI_HOST:
+                sniHost = v;
+                break;
+            case TunnelMetaHeader.BODY_URI:
+                bodyUri = v;
+                break;
+            case TunnelMetaHeader.FORWARDED_FOR:
+                forwardedForIp = v;
+                extra[kl] = v;
+                break;
+            default:
+                if (kl.startsWith(INKBOX_FORWARDED_HEADER_PREFIX)) {
+                    forwarded.push([kl.slice(INKBOX_FORWARDED_HEADER_PREFIX.length), v]);
+                }
+                else if (kl.startsWith(INKBOX_NAMESPACE_PREFIX)) {
+                    extra[kl] = v;
+                }
+                break;
+        }
+    }
+    if (!requestId)
+        return null;
+    return {
+        requestId,
+        method,
+        path,
+        routeKind,
+        wsId,
+        forwardedHeaders: forwarded,
+        body,
+        bodyUri,
+        forwardedForIp,
+        tcpId,
+        sniHost,
+        extraMeta: extra,
+    };
+}
+/** Drop hop-by-hop headers from an upstream response before forwarding. */
+export function filterResponseHeaders(headers) {
+    return headers.filter(([k]) => !HOP_BY_HOP_RESPONSE.has(k.toLowerCase()));
+}
+//# sourceMappingURL=_envelope.js.map

package/dist/tunnels/client/_envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_envelope.js","sourceRoot":"","sources":["../../../src/tunnels/client/_envelope.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,mBAAmB,EACnB,8BAA8B,EAC9B,uBAAuB,EACvB,gBAAgB,EAChB,eAAe,GAChB,MAAM,gBAAgB,CAAC;AAsCxB;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAgC,EAChC,IAAY;IAEZ,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,IAAI,GAAG,GAAG,CAAC;IACf,IAAI,SAAS,GAAc,eAAe,CAAC,OAAO,CAAC;IACnD,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,cAAc,GAAkB,IAAI,CAAC;IACzC,MAAM,SAAS,GAA4B,EAAE,CAAC;IAC9C,MAAM,KAAK,GAA2B,EAAE,CAAC;IAEzC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3B,QAAQ,EAAE,EAAE,CAAC;YACX,KAAK,gBAAgB,CAAC,UAAU;gBAC9B,SAAS,GAAG,CAAC,CAAC;gBACd,MAAM;YACR,KAAK,gBAAgB,CAAC,MAAM;gBAC1B,MAAM,GAAG,CAAC,CAAC;gBACX,MAAM;YACR,KAAK,gBAAgB,CAAC,IAAI;gBACxB,IAAI,GAAG,CAAC,CAAC;gBACT,MAAM;YACR,KAAK,gBAAgB,CAAC,UAAU;gBAC9B,IACE,CAAC,KAAK,eAAe,CAAC,OAAO;oBAC7B,CAAC,KAAK,eAAe,CAAC,UAAU;oBAChC,CAAC,KAAK,eAAe,CAAC,UAAU,EAChC,CAAC;oBACD,SAAS,GAAG,CAAC,CAAC;gBAChB,CAAC;gBACD,MAAM;YACR,KAAK,gBAAgB,CAAC,KAAK;gBACzB,IAAI,GAAG,CAAC,CAAC;gBACT,MAAM;YACR,KAAK,gBAAgB,CAAC,MAAM;gBAC1B,KAAK,GAAG,CAAC,CAAC;gBACV,MAAM;YACR,KAAK,gBAAgB,CAAC,QAAQ;gBAC5B,OAAO,GAAG,CAAC,CAAC;gBACZ,MAAM;YACR,KAAK,gBAAgB,CAAC,QAAQ;gBAC5B,OAAO,GAAG,CAAC,CAAC;gBACZ,MAAM;YACR,KAAK,gBAAgB,CAAC,aAAa;gBACjC,cAAc,GAAG,CAAC,CAAC;gBACnB,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;gBACd,MAAM;YACR;gBACE,IAAI,EAAE,CAAC,UAAU,CAAC,8BAA8B,CAAC,EAAE,CAAC;oBAClD,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,8BAA8B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACvE,CAAC;qBAAM,IAAI,EAAE,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;oBAClD,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;gBAChB,CAAC;gBACD,MAAM;QACV,CAAC;IACH,CAAC;IAED,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO;QACL,SAAS;QACT,MAAM;QACN,IAAI;QACJ,SAAS;QACT,IAAI;QACJ,gBAAgB,EAAE,SAAS;QAC3B,IAAI;QACJ,OAAO;QACP,cAAc;QACd,KAAK;QACL,OAAO;QACP,SAAS,EAAE,KAAK;KACjB,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,qBAAqB,CACnC,OAAgC;IAEhC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC5E,CAAC"}

package/dist/tunnels/client/_h1_server.d.ts

@@ -0,0 +1,37 @@
+/**
+ * inkbox-tunnels/client/_h1_server.ts
+ *
+ * In-process HTTP/1.1 server-side parser. Drives `node:http`'s server
+ * over an in-memory Duplex (the "WireDuplex" pattern — the underlying
+ * Socket surface is mocked just enough that node:http accepts it) to
+ * turn plaintext bytes from the third party into `DispatchRequest`
+ * objects, hands them to a `Dispatch` impl, and serializes responses
+ * back to plaintext bytes.
+ *
+ * Implements the Plaintext adapter contract used by the runtime in
+ * passthrough mode after the TLS terminator.
+ */
+import type { Dispatch } from "./_dispatch.js";
+export interface InProcH1ParserPlaintextOpts {
+    dispatch: Dispatch;
+    maxInboundBodyBytes: number;
+    forwardedForIp: string | null;
+    sniHost: string | null;
+}
+/**
+ * h1 parser exposed as a Plaintext adapter. One instance per third-
+ * party TLS session.
+ */
+export declare class InProcH1ParserPlaintext {
+    private readonly wire;
+    private readonly server;
+    private readonly maxInboundBodyBytes;
+    private closed;
+    constructor(opts: InProcH1ParserPlaintextOpts);
+    feed(plaintext: Buffer): Promise<void>;
+    pumpOutbound(send: (chunk: Buffer) => Promise<void>): Promise<void>;
+    aclose(): Promise<void>;
+    private handleUpgrade;
+    private handleRequest;
+}
+//# sourceMappingURL=_h1_server.d.ts.map

package/dist/tunnels/client/_h1_server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_h1_server.d.ts","sourceRoot":"","sources":["../../../src/tunnels/client/_h1_server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EACV,QAAQ,EAIT,MAAM,gBAAgB,CAAC;AA4FxB,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,QAAQ,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED;;;GAGG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAe;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;IAC7C,OAAO,CAAC,MAAM,CAAS;gBAEX,IAAI,EAAE,2BAA2B;IAiBvC,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKtC,YAAY,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAYnE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;YAWf,aAAa;YA2Ib,aAAa;CA2G5B"}