@memberjunction/server 6.2.0-edge.2 → 6.2.0-edge.4

package/dist/postgresqlPoolSettings.js

@@ -0,0 +1,134 @@
+import { BaseSingleton } from '@memberjunction/global';
+/** Statement timeout for the CodeGen/DDL pool, matching the SQL Server CodeGen pool. */
+export const CODEGEN_STATEMENT_TIMEOUT_MS = 600000;
+/** Pool size for the CodeGen/DDL pool. */
+const CODEGEN_MAX_CONNECTIONS = 10;
+/** Largest pool size for the read-only pool, which serves only caller-supplied SQL. */
+const READ_ONLY_MAX_CONNECTIONS = 10;
+/** Reads the PostgreSQL endpoint from `PG_*` environment variables, then `DB_*` ones. */
+export function ResolvePostgreSQLEndpoint(env = process.env) {
+    return {
+        Host: env.PG_HOST || env.DB_HOST || 'localhost',
+        Port: parseInt(env.PG_PORT || env.DB_PORT || '5432', 10),
+        Database: env.PG_DATABASE || env.DB_DATABASE || '',
+        User: env.PG_USERNAME || env.DB_USERNAME || 'postgres',
+        Password: env.PG_PASSWORD || env.DB_PASSWORD || ''
+    };
+}
+/** The idle-in-transaction limit for a given statement timeout; 0 means none. */
+export function IdleInTransactionTimeoutFor(statementTimeoutMs) {
+    return statementTimeoutMs > 0 ? statementTimeoutMs * 2 : 0;
+}
+/** Builds the provider connection config for one of MJAPI's PostgreSQL pools. */
+export function BuildPostgreSQLConnectionConfig(endpoint, settings, purpose) {
+    const pool = settings.connectionPool;
+    if (purpose === 'codegen') {
+        return {
+            ...endpoint,
+            MaxConnections: CODEGEN_MAX_CONNECTIONS,
+            StatementTimeoutMs: CODEGEN_STATEMENT_TIMEOUT_MS,
+            IdleInTransactionSessionTimeoutMs: 0
+        };
+    }
+    const statementTimeoutMs = Math.max(0, settings.requestTimeout);
+    const apiMax = pool?.max ?? 50;
+    const apiMin = pool?.min ?? 5;
+    const readOnly = purpose === 'read-only';
+    return {
+        ...endpoint,
+        MaxConnections: readOnly ? Math.min(READ_ONLY_MAX_CONNECTIONS, apiMax) : apiMax,
+        MinConnections: readOnly ? 0 : apiMin,
+        IdleTimeoutMillis: pool?.idleTimeoutMillis ?? 30000,
+        ConnectionTimeoutMillis: pool?.acquireTimeoutMillis ?? 30000,
+        StatementTimeoutMs: statementTimeoutMs,
+        IdleInTransactionSessionTimeoutMs: IdleInTransactionTimeoutFor(statementTimeoutMs)
+    };
+}
+/**
+ * Maps a provider connection config onto `pg.Pool` options, for the pools MJAPI creates directly
+ * rather than through the provider. Timeouts that are unset or 0 are left out.
+ */
+export function ToPGPoolConfig(config) {
+    const pool = {
+        host: config.Host,
+        port: config.Port,
+        database: config.Database,
+        user: config.User,
+        password: config.Password,
+        max: config.MaxConnections
+    };
+    if (config.MinConnections !== undefined)
+        pool.min = config.MinConnections;
+    if (config.IdleTimeoutMillis !== undefined)
+        pool.idleTimeoutMillis = config.IdleTimeoutMillis;
+    if (config.ConnectionTimeoutMillis !== undefined)
+        pool.connectionTimeoutMillis = config.ConnectionTimeoutMillis;
+    if (config.StatementTimeoutMs)
+        pool.statement_timeout = config.StatementTimeoutMs;
+    if (config.IdleInTransactionSessionTimeoutMs)
+        pool.idle_in_transaction_session_timeout = config.IdleInTransactionSessionTimeoutMs;
+    return pool;
+}
+/**
+ * The read-only login for PostgreSQL: the `dbReadOnlyUsername` / `dbReadOnlyPassword` settings
+ * SQL Server uses (which default from `DB_READ_ONLY_USERNAME` / `DB_READ_ONLY_PASSWORD`), then
+ * `PG_READ_ONLY_USERNAME` / `PG_READ_ONLY_PASSWORD`. `null` when neither pair is complete.
+ */
+export function ResolvePostgreSQLReadOnlyCredentials(configured, env = process.env) {
+    if (configured.dbReadOnlyUsername && configured.dbReadOnlyPassword) {
+        return { User: configured.dbReadOnlyUsername, Password: configured.dbReadOnlyPassword };
+    }
+    if (env.PG_READ_ONLY_USERNAME && env.PG_READ_ONLY_PASSWORD) {
+        return { User: env.PG_READ_ONLY_USERNAME, Password: env.PG_READ_ONLY_PASSWORD };
+    }
+    return null;
+}
+/**
+ * Holds MJAPI's PostgreSQL read-only pool, opened once at startup with the read-only login.
+ * Per-request read-only providers share it, so they connect as the read-only user rather than
+ * through the read-write pool.
+ */
+export class PostgreSQLReadOnlyPool extends BaseSingleton {
+    /** Use {@link PostgreSQLReadOnlyPool.Instance}. */
+    constructor() {
+        super();
+        this._pool = null;
+    }
+    static get Instance() {
+        return PostgreSQLReadOnlyPool.getInstance();
+    }
+    /** The read-only pool, or `null` when no read-only login is configured. */
+    get Pool() {
+        return this._pool;
+    }
+    set Pool(pool) {
+        this._pool = pool;
+    }
+}
+/**
+ * What the PostgreSQL read-only login can do beyond reading entity base views, as warnings to log at
+ * startup. Ad-hoc SQL and `TestQuerySQL` run as this login, and SQL can reach data through functions
+ * that no check of its table references sees (`query_to_xml`, file readers), so the login's own
+ * grants are the only complete limit. It should hold `SELECT` on the entity base views and nothing
+ * else: not on the base tables, and not membership of `pg_read_server_files`. Empty when the login
+ * is that narrow.
+ *
+ * @param client - A connection opened as the read-only login.
+ * @param coreSchema - The MJ core schema, whose base tables the login should not read.
+ */
+export async function DescribeReadOnlyLoginOverreach(client, coreSchema) {
+    const result = await client.query(`SELECT pg_has_role(current_user, 'pg_read_server_files', 'MEMBER') AS "ReadsServerFiles",
+                (SELECT count(*)::int FROM pg_catalog.pg_tables t
+                  WHERE t.schemaname = $1
+                    AND has_table_privilege(current_user, quote_ident(t.schemaname) || '.' || quote_ident(t.tablename), 'SELECT')) AS "ReadableBaseTables"`, [coreSchema]);
+    const row = result.rows[0];
+    const warnings = [];
+    if (row?.ReadableBaseTables > 0) {
+        warnings.push(`The PostgreSQL read-only login can read ${row.ReadableBaseTables} base table(s) in schema "${coreSchema}". Ad-hoc SQL and TestQuerySQL run as this login; grant it SELECT on the entity base views only.`);
+    }
+    if (row?.ReadsServerFiles) {
+        warnings.push('The PostgreSQL read-only login is a member of pg_read_server_files, so SQL run as it can read files on the database server. Revoke that membership.');
+    }
+    return warnings;
+}
+//# sourceMappingURL=postgresqlPoolSettings.js.map

package/dist/postgresqlPoolSettings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgresqlPoolSettings.js","sourceRoot":"","sources":["../src/postgresqlPoolSettings.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAGvD,wFAAwF;AACxF,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAEnD,0CAA0C;AAC1C,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC,uFAAuF;AACvF,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAiBrC,yFAAyF;AACzF,MAAM,UAAU,yBAAyB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC1E,OAAO;QACH,IAAI,EAAE,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,IAAI,WAAW;QAC/C,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,IAAI,MAAM,EAAE,EAAE,CAAC;QACxD,QAAQ,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,IAAI,EAAE;QAClD,IAAI,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,IAAI,UAAU;QACtD,QAAQ,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,IAAI,EAAE;KACrD,CAAC;AACN,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,2BAA2B,CAAC,kBAA0B;IAClE,OAAO,kBAAkB,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,+BAA+B,CAC3C,QAA4B,EAC5B,QAA8B,EAC9B,OAA8B;IAE9B,MAAM,IAAI,GAAG,QAAQ,CAAC,cAAc,CAAC;IACrC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO;YACH,GAAG,QAAQ;YACX,cAAc,EAAE,uBAAuB;YACvC,kBAAkB,EAAE,4BAA4B;YAChD,iCAAiC,EAAE,CAAC;SACvC,CAAC;IACN,CAAC;IACD,MAAM,kBAAkB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,OAAO,KAAK,WAAW,CAAC;IACzC,OAAO;QACH,GAAG,QAAQ;QACX,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,yBAAyB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM;QAC/E,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;QACrC,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,IAAI,KAAK;QACnD,uBAAuB,EAAE,IAAI,EAAE,oBAAoB,IAAI,KAAK;QAC5D,kBAAkB,EAAE,kBAAkB;QACtC,iCAAiC,EAAE,2BAA2B,CAAC,kBAAkB,CAAC;KACrF,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAA0B;IACrD,MAAM,IAAI,GAAe;QACrB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,EAAE,MAAM,CAAC,cAAc;KAC7B,CAAC;IACF,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS;QAAE,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,cAAc,CAAC;IAC1E,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS;QAAE,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAC9F,IAAI,MAAM,CAAC,uBAAuB,KAAK,SAAS;QAAE,IAAI,CAAC,uBAAuB,GAAG,MAAM,CAAC,uBAAuB,CAAC;IAChH,IAAI,MAAM,CAAC,kBAAkB;QAAE,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,kBAAkB,CAAC;IAClF,IAAI,MAAM,CAAC,iCAAiC;QAAE,IAAI,CAAC,mCAAmC,GAAG,MAAM,CAAC,iCAAiC,CAAC;IAClI,OAAO,IAAI,CAAC;AAChB,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,oCAAoC,CAChD,UAAwE,EACxE,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,UAAU,CAAC,kBAAkB,IAAI,UAAU,CAAC,kBAAkB,EAAE,CAAC;QACjE,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,kBAAkB,EAAE,QAAQ,EAAE,UAAU,CAAC,kBAAkB,EAAE,CAAC;IAC5F,CAAC;IACD,IAAI,GAAG,CAAC,qBAAqB,IAAI,GAAG,CAAC,qBAAqB,EAAE,CAAC;QACzD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,qBAAqB,EAAE,QAAQ,EAAE,GAAG,CAAC,qBAAqB,EAAE,CAAC;IACpF,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,sBAAuB,SAAQ,aAAqC;IAG7E,mDAAmD;IACnD;QACI,KAAK,EAAE,CAAC;QAJJ,UAAK,GAAgB,IAAI,CAAC;IAKlC,CAAC;IAEM,MAAM,KAAK,QAAQ;QACtB,OAAO,sBAAsB,CAAC,WAAW,EAA0B,CAAC;IACxE,CAAC;IAED,2EAA2E;IAC3E,IAAW,IAAI;QACX,OAAO,IAAI,CAAC,KAAK,CAAC;IACtB,CAAC;IAED,IAAW,IAAI,CAAC,IAAiB;QAC7B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACtB,CAAC;CACJ;AAaD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,MAAgC,EAAE,UAAkB;IACrG,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC7B;;;2JAGmJ,EACnJ,CAAC,UAAU,CAAC,CACf,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,GAAG,EAAE,kBAAkB,GAAG,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC,2CAA2C,GAAG,CAAC,kBAAkB,6BAA6B,UAAU,kGAAkG,CAAC,CAAC;IAC9N,CAAC;IACD,IAAI,GAAG,EAAE,gBAAgB,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,qJAAqJ,CAAC,CAAC;IACzK,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC"}

package/dist/realtimeProxy/RealtimeProxyServer.d.ts

@@ -1,6 +1,7 @@
 import type { IncomingMessage } from 'node:http';
 import type { Duplex } from 'node:stream';
 import { BaseSingleton, type IShutdownable } from '@memberjunction/global';
+import { type RealtimeRelayLimits } from './RealtimeRelayTunnel.js';
 /**
  * MJAPI's realtime websocket **proxy** — the transport half of the self-hosted realtime provider story.
  *
@@ -15,6 +16,11 @@ import { BaseSingleton, type IShutdownable } from '@memberjunction/global';
  * wire vocabulary) and knows nothing about any specific provider — it is a pure authenticated byte tunnel,
  * reusable by any future self-hosted realtime provider that mints a ticket.
  *
+ * It also serves the realtime **relay** at `{REALTIME_RELAY_PATH}/<ticket>/…` (any suffix: a provider's
+ * browser SDK appends its own path): one ticket per realtime session, a frame policy from the provider driver
+ * between the legs (see {@link RealtimeRelayTunnel}), one live upstream per session (a resume replaces the
+ * older connection). The Origin allowlist applies to both paths.
+ *
  * A {@link BaseSingleton} + {@link IShutdownable}: it tracks live tunnels and closes them on graceful
  * shutdown (drained by MJServer's `ShutdownRegistry` before `httpServer.close()`).
  */
@@ -22,18 +28,46 @@ export declare class RealtimeProxyServer extends BaseSingleton<RealtimeProxyServ
     readonly ShutdownName = "RealtimeProxyServer";
     /** `noServer` so THIS server never binds its own upgrade listener — MJServer routes upgrades to it by path. */
     private readonly wss;
+    /** The relay's upgrade server: the same routing, plus the client frame cap, enforced while a frame is read. */
+    private readonly relayWss;
     /** Live browser↔upstream tunnels, tracked for shutdown teardown. */
     private readonly tunnels;
+    /** Live relay connections, tracked for shutdown teardown. */
+    private readonly relays;
+    /** The granted connection each relay session uses now: one live upstream per session. */
+    private readonly liveRelays;
+    private readonly relayHost;
     private registered;
     protected constructor();
     /** Process-wide singleton accessor. */
     static get Instance(): RealtimeProxyServer;
+    /** The relay's deadlines, ping interval and pre-open buffer ({@link REALTIME_RELAY_LIMITS}); a subclass may tune them. */
+    protected get RelayLimits(): RealtimeRelayLimits;
     /**
-     * Routes an HTTP `upgrade` for {@link REALTIME_PROXY_PATH} to the proxy. Returns `true` when it OWNS
-     * (handled/rejected) the request, `false` when the path is not the proxy's — so the caller leaves the
-     * socket for the GraphQL websocket server's own upgrade listener. NEVER destroys a socket it doesn't own.
+     * Routes an HTTP `upgrade` for {@link REALTIME_PROXY_PATH} (ticket in the query) or {@link REALTIME_RELAY_PATH}
+     * (ticket in the path, any suffix). Returns `true` when it OWNS (handled/rejected) the request, `false` when
+     * the path is neither — so the caller leaves the socket for the GraphQL websocket server's own upgrade
+     * listener. NEVER destroys a socket it doesn't own.
      */
     TryHandleUpgrade(request: IncomingMessage, socket: Duplex, head: Buffer): boolean;
+    /** `/realtime-proxy?ticket=<id>`: consumes the single-use ticket and opens a byte tunnel. */
+    private handleProxyUpgrade;
+    /**
+     * `/realtime/relay/<ticket>/…`: the same Origin allowlist (403, logged with the origin), then 401 unless the relay
+     * session can still take a connection. Whether it opens fresh or resumes is decided on the connection's first frame.
+     * A query string is ignored: the ticket is read from the path only.
+     */
+    private handleRelayUpgrade;
+    /** Whether a path is the relay's: `/realtime/relay` itself or anything below it. */
+    private static isRelayPath;
+    /** The ticket id in a relay path: the segment right after `/realtime/relay/`; whatever follows is the SDK's. */
+    private static relayTicketFrom;
+    /** Starts one relay connection; the session's policy reads its first frame. */
+    private openRelay;
+    /** A relay connection was granted: it becomes the session's live one, and the older one closes. */
+    private relayGranted;
+    /** A relay connection closed: forget it, and the session's live slot when it held it. */
+    private relayClosed;
     /**
      * Evaluates the optional Origin allowlist. Comparison is exact on the normalized origin
      * (scheme://host[:port], lowercased, no trailing slash). An upgrade WITHOUT an Origin header
@@ -48,10 +82,16 @@ export declare class RealtimeProxyServer extends BaseSingleton<RealtimeProxyServ
     private openTunnel;
     /** Registers for graceful-shutdown draining exactly once (lazily, on first real use). */
     private ensureRegistered;
-    /** Closes every live tunnel and the proxy server. Idempotent; never throws. */
+    /** Closes every live tunnel and relay connection (1001), and both upgrade servers. Idempotent; never throws. */
     Shutdown(): void;
     /** Parses `request.url` (a path+query) into a URL, or `null` when absent/unparseable. */
     private static parseUrl;
+    /**
+     * Refuses an upgrade whose Origin is not on the allowlist: 403, and one log line naming the origin (printable
+     * characters only, shortened), so a browser page on an origin the allowlist lacks shows in MJAPI's log. The line
+     * never quotes the request's path or query: they carry the ticket.
+     */
+    private static refuseOrigin;
     /** Writes a minimal HTTP error response and destroys the socket (used for a rejected upgrade). */
     private static rejectUpgrade;
 }

package/dist/realtimeProxy/RealtimeProxyServer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RealtimeProxyServer.d.ts","sourceRoot":"","sources":["../../src/realtimeProxy/RealtimeProxyServer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,aAAa,EAAoB,KAAK,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAG7F;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,mBAAoB,SAAQ,aAAa,CAAC,mBAAmB,CAAE,YAAW,aAAa;IAChG,SAAgB,YAAY,yBAAyB;IAErD,+GAA+G;IAC/G,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA2C;IAE/D,oEAAoE;IACpE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;IAE1D,OAAO,CAAC,UAAU,CAAS;IAE3B,SAAS;IAIT,uCAAuC;IACvC,WAAkB,QAAQ,IAAI,mBAAmB,CAEhD;IAED;;;;OAIG;IACI,gBAAgB,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO;IAuBxF;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM,CAAC,aAAa;IAa5B,+FAA+F;IAC/F,OAAO,CAAC,UAAU;IAMlB,yFAAyF;IACzF,OAAO,CAAC,gBAAgB;IAOxB,+EAA+E;IACxE,QAAQ,IAAI,IAAI;IAYvB,yFAAyF;IACzF,OAAO,CAAC,MAAM,CAAC,QAAQ;IAWvB,kGAAkG;IAClG,OAAO,CAAC,MAAM,CAAC,aAAa;CAQ/B"}
+{"version":3,"file":"RealtimeProxyServer.d.ts","sourceRoot":"","sources":["../../src/realtimeProxy/RealtimeProxyServer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,aAAa,EAAoB,KAAK,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAQ7F,OAAO,EAKH,KAAK,mBAAmB,EAE3B,MAAM,0BAA0B,CAAC;AAQlC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,mBAAoB,SAAQ,aAAa,CAAC,mBAAmB,CAAE,YAAW,aAAa;IAChG,SAAgB,YAAY,yBAAyB;IAErD,+GAA+G;IAC/G,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA2C;IAE/D,+GAA+G;IAC/G,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA8F;IAEvH,oEAAoE;IACpE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;IAE1D,6DAA6D;IAC7D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;IAEzD,yFAAyF;IACzF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA0C;IAErE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAGxB;IAEF,OAAO,CAAC,UAAU,CAAS;IAE3B,SAAS;IAIT,uCAAuC;IACvC,WAAkB,QAAQ,IAAI,mBAAmB,CAEhD;IAED,0HAA0H;IAC1H,SAAS,KAAK,WAAW,IAAI,mBAAmB,CAE/C;IAED;;;;;OAKG;IACI,gBAAgB,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO;IAaxF,6FAA6F;IAC7F,OAAO,CAAC,kBAAkB;IAkB1B;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAgB1B,oFAAoF;IACpF,OAAO,CAAC,MAAM,CAAC,WAAW;IAI1B,gHAAgH;IAChH,OAAO,CAAC,MAAM,CAAC,eAAe;IAS9B,+EAA+E;IAC/E,OAAO,CAAC,SAAS;IAMjB,mGAAmG;IACnG,OAAO,CAAC,YAAY;IAQpB,yFAAyF;IACzF,OAAO,CAAC,WAAW;IAOnB;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM,CAAC,aAAa;IAa5B,+FAA+F;IAC/F,OAAO,CAAC,UAAU;IAMlB,yFAAyF;IACzF,OAAO,CAAC,gBAAgB;IAOxB,gHAAgH;IACzG,QAAQ,IAAI,IAAI;IAmBvB,yFAAyF;IACzF,OAAO,CAAC,MAAM,CAAC,QAAQ;IAWvB;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,YAAY;IAM3B,kGAAkG;IAClG,OAAO,CAAC,MAAM,CAAC,aAAa;CAQ/B"}

package/dist/realtimeProxy/RealtimeProxyServer.js

@@ -1,6 +1,11 @@
 import { WebSocket as WsClient, WebSocketServer } from 'ws';
 import { BaseSingleton, ShutdownRegistry } from '@memberjunction/global';
-import { RealtimeProxyRegistry, REALTIME_PROXY_PATH } from '@memberjunction/ai';
+import { RealtimeProxyRegistry, REALTIME_PROXY_PATH, REALTIME_RELAY_PATH, } from '@memberjunction/ai';
+import { RealtimeRelayTunnel, RelayTicketPrefix, REALTIME_RELAY_LIMITS, REALTIME_RELAY_MAX_CLIENT_FRAME_BYTES, } from './RealtimeRelayTunnel.js';
+/** The optional Origin allowlist both paths apply: comma-separated origins. */
+const ALLOWED_ORIGINS_ENV = 'MJ_REALTIME_PROXY_ALLOWED_ORIGINS';
+/** The longest part of a refused Origin header a log line quotes. */
+const MAX_LOGGED_ORIGIN_CHARS = 200;
 /**
  * MJAPI's realtime websocket **proxy** — the transport half of the self-hosted realtime provider story.
  *
@@ -15,6 +20,11 @@ import { RealtimeProxyRegistry, REALTIME_PROXY_PATH } from '@memberjunction/ai';
  * wire vocabulary) and knows nothing about any specific provider — it is a pure authenticated byte tunnel,
  * reusable by any future self-hosted realtime provider that mints a ticket.
  *
+ * It also serves the realtime **relay** at `{REALTIME_RELAY_PATH}/<ticket>/…` (any suffix: a provider's
+ * browser SDK appends its own path): one ticket per realtime session, a frame policy from the provider driver
+ * between the legs (see {@link RealtimeRelayTunnel}), one live upstream per session (a resume replaces the
+ * older connection). The Origin allowlist applies to both paths.
+ *
  * A {@link BaseSingleton} + {@link IShutdownable}: it tracks live tunnels and closes them on graceful
  * shutdown (drained by MJServer's `ShutdownRegistry` before `httpServer.close()`).
  */
@@ -24,40 +34,118 @@ export class RealtimeProxyServer extends BaseSingleton {
         this.ShutdownName = 'RealtimeProxyServer';
         /** `noServer` so THIS server never binds its own upgrade listener — MJServer routes upgrades to it by path. */
         this.wss = new WebSocketServer({ noServer: true });
+        /** The relay's upgrade server: the same routing, plus the client frame cap, enforced while a frame is read. */
+        this.relayWss = new WebSocketServer({ noServer: true, maxPayload: REALTIME_RELAY_MAX_CLIENT_FRAME_BYTES });
         /** Live browser↔upstream tunnels, tracked for shutdown teardown. */
         this.tunnels = new Set();
+        /** Live relay connections, tracked for shutdown teardown. */
+        this.relays = new Set();
+        /** The granted connection each relay session uses now: one live upstream per session. */
+        this.liveRelays = new Map();
+        this.relayHost = {
+            OnGranted: (tunnel) => this.relayGranted(tunnel),
+            OnClosed: (tunnel) => this.relayClosed(tunnel),
+        };
         this.registered = false;
     }
     /** Process-wide singleton accessor. */
     static get Instance() {
         return super.getInstance();
     }
+    /** The relay's deadlines, ping interval and pre-open buffer ({@link REALTIME_RELAY_LIMITS}); a subclass may tune them. */
+    get RelayLimits() {
+        return REALTIME_RELAY_LIMITS;
+    }
     /**
-     * Routes an HTTP `upgrade` for {@link REALTIME_PROXY_PATH} to the proxy. Returns `true` when it OWNS
-     * (handled/rejected) the request, `false` when the path is not the proxy's — so the caller leaves the
-     * socket for the GraphQL websocket server's own upgrade listener. NEVER destroys a socket it doesn't own.
+     * Routes an HTTP `upgrade` for {@link REALTIME_PROXY_PATH} (ticket in the query) or {@link REALTIME_RELAY_PATH}
+     * (ticket in the path, any suffix). Returns `true` when it OWNS (handled/rejected) the request, `false` when
+     * the path is neither — so the caller leaves the socket for the GraphQL websocket server's own upgrade
+     * listener. NEVER destroys a socket it doesn't own.
      */
     TryHandleUpgrade(request, socket, head) {
         const url = RealtimeProxyServer.parseUrl(request.url);
-        if (!url || url.pathname !== REALTIME_PROXY_PATH) {
-            return false; // not ours — leave it for the GraphQL WS server
+        if (url?.pathname === REALTIME_PROXY_PATH) {
+            this.handleProxyUpgrade(request, socket, head, url);
+            return true;
         }
+        if (url && RealtimeProxyServer.isRelayPath(url.pathname)) {
+            this.handleRelayUpgrade(request, socket, head, url.pathname);
+            return true;
+        }
+        return false; // not ours — leave it for the GraphQL WS server
+    }
+    /** `/realtime-proxy?ticket=<id>`: consumes the single-use ticket and opens a byte tunnel. */
+    handleProxyUpgrade(request, socket, head, url) {
         this.ensureRegistered();
         // Optional Origin allowlist (MJ_REALTIME_PROXY_ALLOWED_ORIGINS: comma-separated origins).
         // Unset ⇒ prior behavior (the single-use short-TTL ticket remains the primary guard);
         // set ⇒ a browser page on a foreign origin cannot ride a leaked ticket id.
         if (!RealtimeProxyServer.originAllowed(request.headers?.origin)) {
-            RealtimeProxyServer.rejectUpgrade(socket, 403, 'Forbidden');
-            return true;
+            RealtimeProxyServer.refuseOrigin(socket, '[RealtimeProxy]', request.headers?.origin);
+            return;
         }
         const ticketId = url.searchParams.get('ticket') ?? '';
         const entry = RealtimeProxyRegistry.Instance.Consume(ticketId);
         if (!entry) {
             RealtimeProxyServer.rejectUpgrade(socket, 401, 'Unauthorized');
-            return true;
+            return;
         }
         this.wss.handleUpgrade(request, socket, head, (browserWs) => this.openTunnel(browserWs, entry));
-        return true;
+    }
+    /**
+     * `/realtime/relay/<ticket>/…`: the same Origin allowlist (403, logged with the origin), then 401 unless the relay
+     * session can still take a connection. Whether it opens fresh or resumes is decided on the connection's first frame.
+     * A query string is ignored: the ticket is read from the path only.
+     */
+    handleRelayUpgrade(request, socket, head, pathname) {
+        this.ensureRegistered();
+        if (!RealtimeProxyServer.originAllowed(request.headers?.origin)) {
+            RealtimeProxyServer.refuseOrigin(socket, '[RealtimeRelay]', request.headers?.origin);
+            return;
+        }
+        const sessionId = RealtimeProxyServer.relayTicketFrom(pathname);
+        const session = sessionId ? RealtimeProxyRegistry.Instance.FindRelaySession(sessionId) : null;
+        if (!session) {
+            console.warn(`[RealtimeRelay] relay ${RelayTicketPrefix(sessionId)}: upgrade refused (unknown, ended or used up)`);
+            RealtimeProxyServer.rejectUpgrade(socket, 401, 'Unauthorized');
+            return;
+        }
+        this.relayWss.handleUpgrade(request, socket, head, (browserWs) => this.openRelay(browserWs, sessionId, session.Policy));
+    }
+    /** Whether a path is the relay's: `/realtime/relay` itself or anything below it. */
+    static isRelayPath(pathname) {
+        return pathname === REALTIME_RELAY_PATH || pathname.startsWith(`${REALTIME_RELAY_PATH}/`);
+    }
+    /** The ticket id in a relay path: the segment right after `/realtime/relay/`; whatever follows is the SDK's. */
+    static relayTicketFrom(pathname) {
+        const segment = pathname.slice(REALTIME_RELAY_PATH.length + 1).split('/')[0] ?? '';
+        try {
+            return decodeURIComponent(segment);
+        }
+        catch {
+            return ''; // malformed escape — no ticket
+        }
+    }
+    /** Starts one relay connection; the session's policy reads its first frame. */
+    openRelay(browserWs, sessionId, policy) {
+        const tunnel = new RealtimeRelayTunnel(browserWs, sessionId, policy, this.RelayLimits, this.relayHost);
+        this.relays.add(tunnel);
+        tunnel.Start();
+    }
+    /** A relay connection was granted: it becomes the session's live one, and the older one closes. */
+    relayGranted(tunnel) {
+        const previous = this.liveRelays.get(tunnel.SessionID);
+        this.liveRelays.set(tunnel.SessionID, tunnel);
+        if (previous && previous !== tunnel) {
+            previous.Close(1000, 'Replaced by a resumed connection');
+        }
+    }
+    /** A relay connection closed: forget it, and the session's live slot when it held it. */
+    relayClosed(tunnel) {
+        this.relays.delete(tunnel);
+        if (this.liveRelays.get(tunnel.SessionID) === tunnel) {
+            this.liveRelays.delete(tunnel.SessionID);
+        }
     }
     /**
      * Evaluates the optional Origin allowlist. Comparison is exact on the normalized origin
@@ -69,7 +157,7 @@ export class RealtimeProxyServer extends BaseSingleton {
      * @returns True when allowed (or no allowlist is configured).
      */
     static originAllowed(origin) {
-        const raw = process.env['MJ_REALTIME_PROXY_ALLOWED_ORIGINS'];
+        const raw = process.env[ALLOWED_ORIGINS_ENV];
         if (!raw || raw.trim().length === 0) {
             return true; // no allowlist configured — prior behavior
         }
@@ -93,17 +181,24 @@ export class RealtimeProxyServer extends BaseSingleton {
             this.registered = true;
         }
     }
-    /** Closes every live tunnel and the proxy server. Idempotent; never throws. */
+    /** Closes every live tunnel and relay connection (1001), and both upgrade servers. Idempotent; never throws. */
     Shutdown() {
         for (const tunnel of [...this.tunnels]) {
             tunnel.Close();
         }
         this.tunnels.clear();
-        try {
-            this.wss.close();
+        for (const relay of [...this.relays]) {
+            relay.Close(1001, 'Server shutting down');
         }
-        catch {
-            /* already closing */
+        this.relays.clear();
+        this.liveRelays.clear();
+        for (const server of [this.wss, this.relayWss]) {
+            try {
+                server.close();
+            }
+            catch {
+                /* already closing */
+            }
         }
     }
     /** Parses `request.url` (a path+query) into a URL, or `null` when absent/unparseable. */
@@ -118,6 +213,16 @@ export class RealtimeProxyServer extends BaseSingleton {
             return null;
         }
     }
+    /**
+     * Refuses an upgrade whose Origin is not on the allowlist: 403, and one log line naming the origin (printable
+     * characters only, shortened), so a browser page on an origin the allowlist lacks shows in MJAPI's log. The line
+     * never quotes the request's path or query: they carry the ticket.
+     */
+    static refuseOrigin(socket, logPrefix, origin) {
+        const shown = (origin ?? '').replace(/[^\x20-\x7E]/g, '?').slice(0, MAX_LOGGED_ORIGIN_CHARS);
+        console.warn(`${logPrefix} upgrade refused (403): origin "${shown}" is not in ${ALLOWED_ORIGINS_ENV}`);
+        RealtimeProxyServer.rejectUpgrade(socket, 403, 'Forbidden');
+    }
     /** Writes a minimal HTTP error response and destroys the socket (used for a rejected upgrade). */
     static rejectUpgrade(socket, code, reason) {
         try {

package/dist/realtimeProxy/RealtimeProxyServer.js.map

@@ -1 +1 @@
-{"version":3,"file":"RealtimeProxyServer.js","sourceRoot":"","sources":["../../src/realtimeProxy/RealtimeProxyServer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,IAAI,QAAQ,EAAE,eAAe,EAAgB,MAAM,IAAI,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAsB,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAiC,MAAM,oBAAoB,CAAC;AAE/G;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,mBAAoB,SAAQ,aAAkC;IAWvE;QACI,KAAK,EAAE,CAAC;QAXI,iBAAY,GAAG,qBAAqB,CAAC;QAErD,+GAA+G;QAC9F,QAAG,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAE/D,oEAAoE;QACnD,YAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;QAElD,eAAU,GAAG,KAAK,CAAC;IAI3B,CAAC;IAED,uCAAuC;IAChC,MAAM,KAAK,QAAQ;QACtB,OAAO,KAAK,CAAC,WAAW,EAAuB,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACI,gBAAgB,CAAC,OAAwB,EAAE,MAAc,EAAE,IAAY;QAC1E,MAAM,GAAG,GAAG,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,mBAAmB,EAAE,CAAC;YAC/C,OAAO,KAAK,CAAC,CAAC,gDAAgD;QAClE,CAAC;QACD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,0FAA0F;QAC1F,sFAAsF;QACtF,2EAA2E;QAC3E,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YAC9D,mBAAmB,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,qBAAqB,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,mBAAmB,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;QAChG,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;;;;;;OAQG;IACK,MAAM,CAAC,aAAa,CAAC,MAA0B;QACnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;QAC7D,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,CAAC,2CAA2C;QAC5D,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,IAAI,CAAC,CAAC,oEAAoE;QACrF,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC5F,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC1E,OAAO,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,+FAA+F;IACvF,UAAU,CAAC,SAAmB,EAAE,KAA+B;QACnE,MAAM,MAAM,GAAG,IAAI,mBAAmB,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5F,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,yFAAyF;IACjF,gBAAgB;QACpB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACnB,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QAC3B,CAAC;IACL,CAAC;IAED,+EAA+E;IACxE,QAAQ;QACX,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACL,qBAAqB;QACzB,CAAC;IACL,CAAC;IAED,yFAAyF;IACjF,MAAM,CAAC,QAAQ,CAAC,MAA0B;QAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,CAAC;YACD,OAAO,IAAI,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC,sCAAsC;QACrF,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IAED,kGAAkG;IAC1F,MAAM,CAAC,aAAa,CAAC,MAAc,EAAE,IAAY,EAAE,MAAc;QACrE,IAAI,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,YAAY,IAAI,IAAI,MAAM,+BAA+B,CAAC,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACL,yBAAyB;QAC7B,CAAC;QACD,MAAM,CAAC,OAAO,EAAE,CAAC;IACrB,CAAC;CACJ;AAED;;;GAGG;AACH,MAAM,mBAAmB;IACrB,4FAA4F;aACpE,6BAAwB,GAAG,MAAM,AAAT,CAAU;IAC1D;;;;;OAKG;aACqB,uBAAkB,GAAG,GAAG,AAAN,CAAO;IASjD,YACqB,OAAiB,EACjB,KAA+B,EAC/B,QAAoB;QAFpB,YAAO,GAAP,OAAO,CAAU;QACjB,UAAK,GAAL,KAAK,CAA0B;QAC/B,aAAQ,GAAR,QAAQ,CAAY;QAVjC,aAAQ,GAAoB,IAAI,CAAC;QACzC,4FAA4F;QAC3E,YAAO,GAAgD,EAAE,CAAC;QACnE,iBAAY,GAAyC,IAAI,CAAC;QAC1D,yBAAoB,GAAG,CAAC,CAAC;QACzB,WAAM,GAAG,KAAK,CAAC;IAMpB,CAAC;IAEJ,qDAAqD;IAC9C,KAAK;QACR,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7G,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAEzB,oFAAoF;QACpF,2DAA2D;QAC3D,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;YAChC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACxD,OAAO,CAAC,IAAI,CAAC,gDAAgD,mBAAmB,CAAC,wBAAwB,qBAAqB,CAAC,CAAC;gBAChI,IAAI,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC;QACL,CAAC,EAAE,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;QAChD,IAAI,CAAC,YAAuC,CAAC,KAAK,EAAE,EAAE,CAAC;QAExD,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACrB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACpB,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAChC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YAC7B,CAAC;YACD,IAAI,CAAC,YAAY,EAAE,CAAC;QACxB,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAa,EAAE,QAAiB,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzG,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACzC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAEzC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAa,EAAE,QAAiB,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QACnG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,+FAA+F;IACvF,WAAW,CAAC,IAAa,EAAE,QAAiB;QAChD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC9D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACJ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YACtC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,mBAAmB,CAAC,kBAAkB,EAAE,CAAC;gBAC/D,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,uDAAuD;gBAC7E,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBAC5B,IAAI,IAAI,CAAC,oBAAoB,KAAK,CAAC,IAAI,IAAI,CAAC,oBAAoB,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC;oBAC3E,OAAO,CAAC,IAAI,CAAC,qDAAqD,IAAI,CAAC,oBAAoB,yCAAyC,CAAC,CAAC;gBAC1I,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;IAED,2DAA2D;IACnD,YAAY;QAChB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjB,OAAO;QACX,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,sGAAsG;IAC9F,OAAO,CAAC,MAAgB,EAAE,IAAa,EAAE,QAAiB;QAC9D,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;YACtC,OAAO;QACX,CAAC;QACD,IAAI,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACL,IAAI,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;IACL,CAAC;IAED,4EAA4E;IACrE,KAAK;QACR,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAChC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAC7B,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,OAAO;QACX,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QACxB,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACD,IAAI,EAAE,KAAK,EAAE,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACL,qBAAqB;YACzB,CAAC;QACL,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,CAAC;IACpB,CAAC"}
+{"version":3,"file":"RealtimeProxyServer.js","sourceRoot":"","sources":["../../src/realtimeProxy/RealtimeProxyServer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,IAAI,QAAQ,EAAE,eAAe,EAAgB,MAAM,IAAI,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAsB,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EACH,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,GAGtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACH,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,qCAAqC,GAGxC,MAAM,0BAA0B,CAAC;AAElC,+EAA+E;AAC/E,MAAM,mBAAmB,GAAG,mCAAmC,CAAC;AAEhE,qEAAqE;AACrE,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,OAAO,mBAAoB,SAAQ,aAAkC;IAyBvE;QACI,KAAK,EAAE,CAAC;QAzBI,iBAAY,GAAG,qBAAqB,CAAC;QAErD,+GAA+G;QAC9F,QAAG,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAE/D,+GAA+G;QAC9F,aAAQ,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,qCAAqC,EAAE,CAAC,CAAC;QAEvH,oEAAoE;QACnD,YAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;QAE1D,6DAA6D;QAC5C,WAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;QAEzD,yFAAyF;QACxE,eAAU,GAAG,IAAI,GAAG,EAA+B,CAAC;QAEpD,cAAS,GAA4B;YAClD,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;YAChD,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;SACjD,CAAC;QAEM,eAAU,GAAG,KAAK,CAAC;IAI3B,CAAC;IAED,uCAAuC;IAChC,MAAM,KAAK,QAAQ;QACtB,OAAO,KAAK,CAAC,WAAW,EAAuB,CAAC;IACpD,CAAC;IAED,0HAA0H;IAC1H,IAAc,WAAW;QACrB,OAAO,qBAAqB,CAAC;IACjC,CAAC;IAED;;;;;OAKG;IACI,gBAAgB,CAAC,OAAwB,EAAE,MAAc,EAAE,IAAY;QAC1E,MAAM,GAAG,GAAG,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,GAAG,EAAE,QAAQ,KAAK,mBAAmB,EAAE,CAAC;YACxC,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACpD,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,GAAG,IAAI,mBAAmB,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7D,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,gDAAgD;IAClE,CAAC;IAED,6FAA6F;IACrF,kBAAkB,CAAC,OAAwB,EAAE,MAAc,EAAE,IAAY,EAAE,GAAQ;QACvF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,0FAA0F;QAC1F,sFAAsF;QACtF,2EAA2E;QAC3E,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YAC9D,mBAAmB,CAAC,YAAY,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACrF,OAAO;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,qBAAqB,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,mBAAmB,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;YAC/D,OAAO;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;IACpG,CAAC;IAED;;;;OAIG;IACK,kBAAkB,CAAC,OAAwB,EAAE,MAAc,EAAE,IAAY,EAAE,QAAgB;QAC/F,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YAC9D,mBAAmB,CAAC,YAAY,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACrF,OAAO;QACX,CAAC;QACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9F,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,yBAAyB,iBAAiB,CAAC,SAAS,CAAC,+CAA+C,CAAC,CAAC;YACnH,mBAAmB,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;YAC/D,OAAO;QACX,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5H,CAAC;IAED,oFAAoF;IAC5E,MAAM,CAAC,WAAW,CAAC,QAAgB;QACvC,OAAO,QAAQ,KAAK,mBAAmB,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,mBAAmB,GAAG,CAAC,CAAC;IAC9F,CAAC;IAED,gHAAgH;IACxG,MAAM,CAAC,eAAe,CAAC,QAAgB;QAC3C,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnF,IAAI,CAAC;YACD,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,EAAE,CAAC,CAAC,+BAA+B;QAC9C,CAAC;IACL,CAAC;IAED,+EAA+E;IACvE,SAAS,CAAC,SAAmB,EAAE,SAAiB,EAAE,MAA4B;QAClF,MAAM,MAAM,GAAG,IAAI,mBAAmB,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACvG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxB,MAAM,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,mGAAmG;IAC3F,YAAY,CAAC,MAA2B;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC9C,IAAI,QAAQ,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YAClC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,kCAAkC,CAAC,CAAC;QAC7D,CAAC;IACL,CAAC;IAED,yFAAyF;IACjF,WAAW,CAAC,MAA2B;QAC3C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,MAAM,EAAE,CAAC;YACnD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7C,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACK,MAAM,CAAC,aAAa,CAAC,MAA0B;QACnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAC7C,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,CAAC,2CAA2C;QAC5D,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,IAAI,CAAC,CAAC,oEAAoE;QACrF,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC5F,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC1E,OAAO,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,+FAA+F;IACvF,UAAU,CAAC,SAAmB,EAAE,KAA+B;QACnE,MAAM,MAAM,GAAG,IAAI,mBAAmB,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5F,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,yFAAyF;IACjF,gBAAgB;QACpB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACnB,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QAC3B,CAAC;IACL,CAAC;IAED,gHAAgH;IACzG,QAAQ;QACX,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACxB,KAAK,MAAM,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC;gBACD,MAAM,CAAC,KAAK,EAAE,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACL,qBAAqB;YACzB,CAAC;QACL,CAAC;IACL,CAAC;IAED,yFAAyF;IACjF,MAAM,CAAC,QAAQ,CAAC,MAA0B;QAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,CAAC;YACD,OAAO,IAAI,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC,sCAAsC;QACrF,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,YAAY,CAAC,MAAc,EAAE,SAAiB,EAAE,MAA0B;QACrF,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC;QAC7F,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,mCAAmC,KAAK,eAAe,mBAAmB,EAAE,CAAC,CAAC;QACvG,mBAAmB,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IAChE,CAAC;IAED,kGAAkG;IAC1F,MAAM,CAAC,aAAa,CAAC,MAAc,EAAE,IAAY,EAAE,MAAc;QACrE,IAAI,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,YAAY,IAAI,IAAI,MAAM,+BAA+B,CAAC,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACL,yBAAyB;QAC7B,CAAC;QACD,MAAM,CAAC,OAAO,EAAE,CAAC;IACrB,CAAC;CACJ;AAED;;;GAGG;AACH,MAAM,mBAAmB;IACrB,4FAA4F;aACpE,6BAAwB,GAAG,MAAM,AAAT,CAAU;IAC1D;;;;;OAKG;aACqB,uBAAkB,GAAG,GAAG,AAAN,CAAO;IASjD,YACqB,OAAiB,EACjB,KAA+B,EAC/B,QAAoB;QAFpB,YAAO,GAAP,OAAO,CAAU;QACjB,UAAK,GAAL,KAAK,CAA0B;QAC/B,aAAQ,GAAR,QAAQ,CAAY;QAVjC,aAAQ,GAAoB,IAAI,CAAC;QACzC,4FAA4F;QAC3E,YAAO,GAAgD,EAAE,CAAC;QACnE,iBAAY,GAAyC,IAAI,CAAC;QAC1D,yBAAoB,GAAG,CAAC,CAAC;QACzB,WAAM,GAAG,KAAK,CAAC;IAMpB,CAAC;IAEJ,qDAAqD;IAC9C,KAAK;QACR,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7G,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAEzB,oFAAoF;QACpF,2DAA2D;QAC3D,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;YAChC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACxD,OAAO,CAAC,IAAI,CAAC,gDAAgD,mBAAmB,CAAC,wBAAwB,qBAAqB,CAAC,CAAC;gBAChI,IAAI,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC;QACL,CAAC,EAAE,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;QAChD,IAAI,CAAC,YAAuC,CAAC,KAAK,EAAE,EAAE,CAAC;QAExD,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACrB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACpB,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAChC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YAC7B,CAAC;YACD,IAAI,CAAC,YAAY,EAAE,CAAC;QACxB,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAa,EAAE,QAAiB,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzG,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACzC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAEzC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAa,EAAE,QAAiB,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QACnG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,+FAA+F;IACvF,WAAW,CAAC,IAAa,EAAE,QAAiB;QAChD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC9D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACJ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YACtC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,mBAAmB,CAAC,kBAAkB,EAAE,CAAC;gBAC/D,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,uDAAuD;gBAC7E,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBAC5B,IAAI,IAAI,CAAC,oBAAoB,KAAK,CAAC,IAAI,IAAI,CAAC,oBAAoB,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC;oBAC3E,OAAO,CAAC,IAAI,CAAC,qDAAqD,IAAI,CAAC,oBAAoB,yCAAyC,CAAC,CAAC;gBAC1I,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;IAED,2DAA2D;IACnD,YAAY;QAChB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjB,OAAO;QACX,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,sGAAsG;IAC9F,OAAO,CAAC,MAAgB,EAAE,IAAa,EAAE,QAAiB;QAC9D,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;YACtC,OAAO;QACX,CAAC;QACD,IAAI,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACL,IAAI,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;IACL,CAAC;IAED,4EAA4E;IACrE,KAAK;QACR,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAChC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAC7B,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,OAAO;QACX,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QACxB,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACD,IAAI,EAAE,KAAK,EAAE,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACL,qBAAqB;YACzB,CAAC;QACL,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,CAAC;IACpB,CAAC"}