@oneuptime/common 12.0.33 → 12.0.34

package/build/dist/Server/Utils/Monitor/SeriesContextEnricher.js

@@ -0,0 +1,237 @@
+import ColumnLength from "../../../Types/Database/ColumnLength";
+import SeriesDebugHints from "../../../Types/Monitor/SeriesContext/SeriesDebugHints";
+import SeriesLabelDisplay from "../../../Types/Monitor/SeriesContext/SeriesLabelDisplay";
+/*
+ * Make a per-series alert or incident say WHICH pod, container, node or
+ * mount it is about.
+ *
+ * A grouped metric monitor raises one alert per breaching series and
+ * stores that series' identity in `seriesLabels`. Until now the identity
+ * stopped there: the title came from the criteria template, which is one
+ * fixed string shared by every series, so a cluster with fifty saturated
+ * pods produced fifty alerts whose titles were character-for-character
+ * identical. The identity was reachable - in a table, at the bottom of
+ * the alert detail page - but the alert list, the Slack message, the
+ * email and the phone notification all showed the same undifferentiated
+ * line.
+ *
+ * This enricher runs at creation time, after the criteria template has
+ * been rendered, and appends the series identity to the title and a
+ * resource + first-commands block to the description.
+ *
+ * Two properties matter and are covered by tests:
+ *
+ *   - It never fights the user's own template. A title that already
+ *     names the series (because the user wrote `{{resource.k8s.pod.name}}`
+ *     into it, or because the new `{{seriesResourceSuffix}}` variable
+ *     expanded there) is left exactly as the user wrote it. The check is
+ *     on the VALUES, not on the placeholders, so it works the same
+ *     whether the identity arrived from a template variable or was typed
+ *     literally.
+ *
+ *   - It is a no-op for whole-monitor alerts. A monitor with no group-by
+ *     has no series identity, and nothing is appended.
+ */
+/*
+ * Hoisted rather than written inline at its single use site: two lint
+ * rules disagree about parenthesising a regex literal in an expression
+ * and `--fix` oscillates between them (ESLintCircularFixesWarning). A
+ * named constant sidesteps the argument and reads better anyway.
+ */
+const WordCharacterPattern = /[A-Za-z0-9]/;
+class SeriesContextEnricher {
+    /**
+     * What counts as "part of the same word" when deciding whether a
+     * value found in the text is really a mention of it.
+     *
+     * Deliberately narrower than `\w`: `-`, `.`, `/` and `_` all appear
+     * inside the values themselves (pod names, mountpoints, Ceph daemon
+     * ids), so treating them as word characters would make a value that
+     * IS present look like part of a longer token.
+     */
+    static isWordCharacter(character) {
+        if (character === "") {
+            return false;
+        }
+        return WordCharacterPattern.test(character);
+    }
+    /**
+     * Whether `text` already names this label's value.
+     *
+     * Two ways to be already-named, and both matter:
+     *
+     *   - This module's own rendering (`"Pod: web-1"`) is matched exactly.
+     *     That is what makes the enricher idempotent, whatever the value
+     *     looks like.
+     *
+     *   - A distinctive value appearing anywhere on a token boundary. That
+     *     is the user's own template - `{{resource.k8s.pod.name}}` has
+     *     already expanded by the time this runs, so the check has to be
+     *     on the VALUE, not on the placeholder. The boundary requirement
+     *     stops a pod called `web` from counting as mentioned because the
+     *     title happens to contain the word "website".
+     */
+    static isValueMentioned(input) {
+        const { text, label } = input;
+        if (text.includes(`${label.name}: ${label.value}`)) {
+            return true;
+        }
+        if (label.value.length < SeriesContextEnricher.MinimumMatchableValueLength) {
+            return false;
+        }
+        let searchFrom = 0;
+        for (;;) {
+            const index = text.indexOf(label.value, searchFrom);
+            if (index === -1) {
+                return false;
+            }
+            const before = index > 0 ? text.charAt(index - 1) : "";
+            const after = text.charAt(index + label.value.length);
+            if (!SeriesContextEnricher.isWordCharacter(before) &&
+                !SeriesContextEnricher.isWordCharacter(after)) {
+                return true;
+            }
+            searchFrom = index + 1;
+        }
+    }
+    /*
+     * The identity labels not already present in `text`.
+     *
+     * Deliberately per-label rather than all-or-nothing: a title that
+     * mentions the pod by name but not the namespace still gets the
+     * namespace appended, because dropping the rest whenever a user's
+     * template happened to mention one identifier would lose exactly the
+     * context this exists to add.
+     */
+    static getUnmentionedLabels(input) {
+        const labels = SeriesLabelDisplay.getDisplayLabels(input.seriesLabels);
+        if (labels.length === 0) {
+            return [];
+        }
+        const text = input.text || "";
+        return labels.filter((label) => {
+            return !SeriesContextEnricher.isValueMentioned({ text, label });
+        });
+    }
+    /*
+     * `title` with the series identity appended, or `title` unchanged when
+     * there is no identity to add or the title already carries it.
+     */
+    static enrichTitle(input) {
+        const title = input.title || "";
+        const unmentioned = SeriesContextEnricher.getUnmentionedLabels({
+            text: title,
+            seriesLabels: input.seriesLabels,
+        });
+        if (unmentioned.length === 0) {
+            return title;
+        }
+        /*
+         * Rebuild a label map from just the unmentioned labels so the
+         * shared formatter still applies its own ordering and title cap
+         * rather than this module reimplementing either.
+         */
+        const remaining = {};
+        for (const label of unmentioned) {
+            remaining[label.key] = label.value;
+        }
+        const suffix = SeriesLabelDisplay.buildTitleSuffix(remaining);
+        if (!suffix) {
+            return title;
+        }
+        /*
+         * `Alert.title` and `Incident.title` are LongText, i.e. 500
+         * characters. Overflowing the column does not produce a shortened
+         * title - it fails the INSERT, and the alert does not exist at all.
+         * That would turn a labelling improvement into dropped pages, so the
+         * appended identity is bounded here as well as per-value inside
+         * SeriesLabelDisplay.
+         *
+         * A base title that is ALREADY at or over the limit is returned
+         * untouched: it was going to fail with or without this enricher, and
+         * silently truncating what the user wrote is not this module's call
+         * to make.
+         */
+        if (title.length >= SeriesContextEnricher.MaxTitleLength) {
+            return title;
+        }
+        const room = SeriesContextEnricher.MaxTitleLength - title.length;
+        if (suffix.length <= room) {
+            return `${title}${suffix}`;
+        }
+        return `${title}${suffix.slice(0, room)}`;
+    }
+    /*
+     * `description` with an "Affected resource" block and the read-only
+     * commands worth running first appended.
+     *
+     * The description is what reaches Slack, email and the mobile push, so
+     * this is where the full identity goes - the title only has room for
+     * the top few labels.
+     */
+    static enrichDescription(input) {
+        const description = input.description || "";
+        const labels = SeriesLabelDisplay.getDisplayLabels(input.seriesLabels);
+        if (labels.length === 0) {
+            return description;
+        }
+        const sections = [];
+        /*
+         * Only skip the resource block when the description already names
+         * EVERY label. A description mentioning the pod but not the node is
+         * still missing the thing the engineer needs.
+         */
+        const unmentioned = SeriesContextEnricher.getUnmentionedLabels({
+            text: description,
+            seriesLabels: input.seriesLabels,
+        });
+        const block = SeriesLabelDisplay.buildMarkdownBlock(input.seriesLabels);
+        /*
+         * The exact-block check is the idempotency guarantee. Per-label
+         * matching alone cannot provide it: a one-character label value
+         * (a Ceph pool id, a Proxmox vmid) is deliberately not matched as a
+         * bare substring, so a second pass would append the block again.
+         */
+        if (unmentioned.length > 0 && block && !description.includes(block)) {
+            sections.push(block);
+        }
+        const commandsBlock = SeriesDebugHints.buildMarkdownBlock({
+            monitorType: input.monitorType,
+            seriesLabels: input.seriesLabels,
+        });
+        /*
+         * The commands embed the label values, so a description that
+         * already carries them would otherwise get a near-duplicate block
+         * appended on top of a user's own runbook snippet.
+         */
+        if (commandsBlock && !description.includes(commandsBlock)) {
+            sections.push(commandsBlock);
+        }
+        if (sections.length === 0) {
+            return description;
+        }
+        if (!description.trim()) {
+            return sections.join("\n\n");
+        }
+        return `${description}\n\n${sections.join("\n\n")}`;
+    }
+}
+/**
+ * The `title` column's own limit, taken from the schema rather than
+ * restated as a number - `Alert.title` and `Incident.title` are both
+ * `ColumnType.LongText`.
+ */
+SeriesContextEnricher.MaxTitleLength = ColumnLength.LongText;
+/**
+ * Shortest label value that may be matched as a bare substring.
+ *
+ * Ceph pool ids and Proxmox vmids are one or two characters, and
+ * "does the title contain 3?" is answered `true` by any title with a
+ * threshold in it ("Restarts > 3"). Below this length only this
+ * module's own `Name: value` rendering counts as a mention, which
+ * keeps idempotency without letting a coincidence swallow the
+ * identity.
+ */
+SeriesContextEnricher.MinimumMatchableValueLength = 4;
+export default SeriesContextEnricher;
+//# sourceMappingURL=SeriesContextEnricher.js.map

package/build/dist/Server/Utils/Monitor/SeriesContextEnricher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SeriesContextEnricher.js","sourceRoot":"","sources":["../../../../../Server/Utils/Monitor/SeriesContextEnricher.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,MAAM,sCAAsC,CAAC;AAGhE,OAAO,gBAAgB,MAAM,uDAAuD,CAAC;AACrF,OAAO,kBAEN,MAAM,yDAAyD,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH;;;;;GAKG;AACH,MAAM,oBAAoB,GAAW,aAAa,CAAC;AAEnD,MAAqB,qBAAqB;IAoBxC;;;;;;;;OAQG;IACK,MAAM,CAAC,eAAe,CAAC,SAAiB;QAC9C,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,MAAM,CAAC,gBAAgB,CAAC,KAG/B;QACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;QAE9B,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IACE,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,qBAAqB,CAAC,2BAA2B,EACtE,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,UAAU,GAAW,CAAC,CAAC;QAE3B,SAAS,CAAC;YACR,MAAM,KAAK,GAAW,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;YAE5D,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,MAAM,GAAW,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,MAAM,KAAK,GAAW,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAE9D,IACE,CAAC,qBAAqB,CAAC,eAAe,CAAC,MAAM,CAAC;gBAC9C,CAAC,qBAAqB,CAAC,eAAe,CAAC,KAAK,CAAC,EAC7C,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,MAAM,CAAC,oBAAoB,CAAC,KAGnC;QACC,MAAM,MAAM,GACV,kBAAkB,CAAC,gBAAgB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAE1D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,IAAI,GAAW,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;QAEtC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAyB,EAAE,EAAE;YACjD,OAAO,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,WAAW,CAAC,KAGzB;QACC,MAAM,KAAK,GAAW,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;QAExC,MAAM,WAAW,GACf,qBAAqB,CAAC,oBAAoB,CAAC;YACzC,IAAI,EAAE,KAAK;YACX,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QAEL,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAC;QACf,CAAC;QAED;;;;WAIG;QACH,MAAM,SAAS,GAAe,EAAE,CAAC;QAEjC,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;YAChC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;QACrC,CAAC;QAED,MAAM,MAAM,GAAW,kBAAkB,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAEtE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC;QACf,CAAC;QAED;;;;;;;;;;;;WAYG;QACH,IAAI,KAAK,CAAC,MAAM,IAAI,qBAAqB,CAAC,cAAc,EAAE,CAAC;YACzD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,IAAI,GAAW,qBAAqB,CAAC,cAAc,GAAG,KAAK,CAAC,MAAM,CAAC;QAEzE,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1B,OAAO,GAAG,KAAK,GAAG,MAAM,EAAE,CAAC;QAC7B,CAAC;QAED,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;IAC5C,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,iBAAiB,CAAC,KAI/B;QACC,MAAM,WAAW,GAAW,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC;QAEpD,MAAM,MAAM,GACV,kBAAkB,CAAC,gBAAgB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAE1D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,MAAM,QAAQ,GAAkB,EAAE,CAAC;QAEnC;;;;WAIG;QACH,MAAM,WAAW,GACf,qBAAqB,CAAC,oBAAoB,CAAC;YACzC,IAAI,EAAE,WAAW;YACjB,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QAEL,MAAM,KAAK,GAAW,kBAAkB,CAAC,kBAAkB,CACzD,KAAK,CAAC,YAAY,CACnB,CAAC;QAEF;;;;;WAKG;QACH,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACpE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QAED,MAAM,aAAa,GAAW,gBAAgB,CAAC,kBAAkB,CAAC;YAChE,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QAEH;;;;WAIG;QACH,IAAI,aAAa,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAC1D,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC/B,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;YACxB,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,GAAG,WAAW,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IACtD,CAAC;;AA7PD;;;;GAIG;AACqB,oCAAc,GAAW,YAAY,CAAC,QAAQ,CAAC;AAEvE;;;;;;;;;GASG;AACqB,iDAA2B,GAAW,CAAC,CAAC;eAlB7C,qBAAqB"}

package/build/dist/Server/Utils/SSRFProtection.js

@@ -21,9 +21,11 @@ import net from "net";
  * legitimate reason to reach one of them and none at all to reach the other:
  *
  *   FORBIDDEN — loopback, unspecified, link-local (the 169.254.169.254 cloud
- *     metadata endpoint lives here), multicast, reserved, broadcast, and the
- *     hostnames that name them. Refused in every deployment. The only way past
- *     is an exact entry in the instance's PRIVATE_NETWORK_WEBHOOK_ALLOWLIST.
+ *     metadata endpoint lives here), cloud-platform control endpoints,
+ *     IPv4-translation infrastructure, multicast, reserved, broadcast, and
+ *     the hostnames that name them. Refused in every deployment. The only way
+ *     past is an exact entry in the instance's
+ *     PRIVATE_NETWORK_WEBHOOK_ALLOWLIST.
  *
  *   PRIVATE — RFC-1918, CGNAT, IPv6 unique-local and site-local. Refused by
  *     default, which is the only correct answer for multi-tenant SaaS, but a
@@ -105,6 +107,21 @@ export default class SSRFProtection {
         });
     }
     static async validateWebhookTargetIsSafe(rawUrl, options) {
+        await SSRFProtection.validateWebhookTarget(rawUrl, options, false);
+    }
+    /*
+     * Validate and return the exact addresses approved by that same DNS pass.
+     * A caller must pin these into its socket lookup; resolving the hostname a
+     * second time after validation reopens the DNS-rebinding window.
+     */
+    static async validateAndResolveWebhookTarget(rawUrl, options) {
+        const result = await SSRFProtection.validateWebhookTarget(rawUrl, options, true);
+        if (!result) {
+            throw new BadDataException("Request URL could not be resolved safely.");
+        }
+        return result;
+    }
+    static async validateWebhookTarget(rawUrl, options, returnValidatedTarget) {
         var _a;
         const label = (options === null || options === void 0 ? void 0 : options.targetLabel) || DEFAULT_TARGET_LABEL;
         const privateNetworkHint = (_a = options === null || options === void 0 ? void 0 : options.privateNetworkHint) !== null && _a !== void 0 ? _a : DEFAULT_PRIVATE_NETWORK_HINT;
@@ -167,6 +184,15 @@ export default class SSRFProtection {
          * comparison for the privilege.
          */
         const whatwgHostname = SSRFProtection.getBareHostname(rawUrl);
+        let canonicalUrl = null;
+        if (returnValidatedTarget) {
+            try {
+                canonicalUrl = new globalThis.URL(rawUrl.toString());
+            }
+            catch (_c) {
+                throw new BadDataException(`${label} is not a valid URL`);
+            }
+        }
         const hostnames = whatwgHostname && whatwgHostname !== hostname
             ? [hostname, whatwgHostname]
             : [hostname];
@@ -178,7 +204,11 @@ export default class SSRFProtection {
          * it was before the exception existed.
          */
         const isOptedIn = (options === null || options === void 0 ? void 0 : options.allowPrivateNetworkTargets) === true;
-        const isPrivateTierAllowed = isOptedIn && PrivateNetworkWebhookConfig.isPrivateNetworkAllowed();
+        const shouldUseWebhookPolicy = (options === null || options === void 0 ? void 0 : options.privateNetworkAccessIsAllowed) === undefined;
+        const isPrivateTierAllowed = isOptedIn &&
+            (shouldUseWebhookPolicy
+                ? PrivateNetworkWebhookConfig.isPrivateNetworkAllowed()
+                : (options === null || options === void 0 ? void 0 : options.privateNetworkAccessIsAllowed) === true);
         /*
          * A host the operator named outright needs no further inspection — not the
          * tier check, and not DNS. That is the whole point of naming
@@ -186,7 +216,7 @@ export default class SSRFProtection {
          * and the operator has said to trust it anyway.
          */
         const isHostAllowlisted = (host) => {
-            if (!isOptedIn) {
+            if (!isOptedIn || !shouldUseWebhookPolicy) {
                 return false;
             }
             return SSRFProtection.isIpLiteral(host)
@@ -205,20 +235,38 @@ export default class SSRFProtection {
                 throw new BadDataException(`${label} points to a private network address and is not allowed.${privateNetworkHint}`);
             }
         }
+        const resolvedAddressesByHostname = new Map();
         for (const host of hostnames) {
-            if (SSRFProtection.isIpLiteral(host) || isHostAllowlisted(host)) {
+            const isConnectionHostname = returnValidatedTarget && host === whatwgHostname;
+            if (SSRFProtection.isIpLiteral(host) ||
+                (isHostAllowlisted(host) && !isConnectionHostname)) {
                 continue;
             }
             let resolved = [];
             try {
                 resolved = await dns.promises.lookup(host, { all: true });
             }
-            catch (_c) {
+            catch (_d) {
                 throw new BadDataException(`${label} hostname could not be resolved via DNS.`);
             }
-            for (const entry of resolved) {
+            if (resolved.length === 0 && isConnectionHostname) {
+                throw new BadDataException(`${label} hostname could not be resolved via DNS.`);
+            }
+            const normalizedAddresses = resolved.map((entry) => {
                 const address = entry.address.toLowerCase();
+                return {
+                    address: address,
+                    family: entry.family || net.isIP(address),
+                };
+            });
+            resolvedAddressesByHostname.set(host, normalizedAddresses);
+            if (isHostAllowlisted(host)) {
+                continue;
+            }
+            for (const entry of normalizedAddresses) {
+                const address = entry.address;
                 if (isOptedIn &&
+                    shouldUseWebhookPolicy &&
                     PrivateNetworkWebhookConfig.isAddressAllowed(address)) {
                     continue;
                 }
@@ -231,6 +279,24 @@ export default class SSRFProtection {
                 }
             }
         }
+        if (!returnValidatedTarget) {
+            return null;
+        }
+        if (!canonicalUrl || !whatwgHostname) {
+            throw new BadDataException(`${label} is not a valid URL`);
+        }
+        if (SSRFProtection.isIpLiteral(whatwgHostname)) {
+            const address = SSRFProtection.stripZoneId(whatwgHostname);
+            return {
+                url: canonicalUrl,
+                addresses: [{ address: address, family: net.isIP(address) }],
+            };
+        }
+        const addresses = resolvedAddressesByHostname.get(whatwgHostname);
+        if (!addresses || addresses.length === 0) {
+            throw new BadDataException(`${label} hostname could not be resolved via DNS.`);
+        }
+        return { url: canonicalUrl, addresses: addresses };
     }
     /*
      * Everything up to and including the LAST "@" is userinfo, never the host.
@@ -363,7 +429,9 @@ export default class SSRFProtection {
      * IPv4-compatible (::/96), NAT64 (64:ff9b::/96), 6to4 (2002::/16), and
      * Teredo (2001:0000::/32) - are handed to the IPv4 classifier, so an
      * embedded 10.0.0.1 is PRIVATE and an embedded 169.254.169.254 is FORBIDDEN
-     * exactly as the bare forms are.
+     * exactly as the bare forms are. Cloud-provider service addresses and
+     * translation prefixes that should never be monitor targets are FORBIDDEN
+     * outright, before the general unique-local/public verdicts are considered.
      */
     static classifyIpv6(address) {
         const groups = SSRFProtection.expandIpv6(address);
@@ -394,6 +462,16 @@ export default class SSRFProtection {
         if (isZeroThrough(7) && groups[7] === 1) {
             return WebhookAddressTier.Forbidden;
         }
+        /*
+         * ::ffff:0:0:0/96 — legacy SIIT IPv4-translatable prefix (RFC 2765).
+         * Unlike ::ffff:0:0/96 below, the embedded bits do not describe a target
+         * that can be safely classified as public. The translation endpoint is
+         * infrastructure and must not become reachable through the private-network
+         * opt-in.
+         */
+        if (isZeroThrough(4) && groups[4] === 0xffff && groups[5] === 0) {
+            return WebhookAddressTier.Forbidden;
+        }
         // ::ffff:0:0/96 — IPv4-mapped.
         if (isZeroThrough(5) && groups[5] === 0xffff) {
             return SSRFProtection.classifyIpv4(embeddedIpv4(6));
@@ -407,6 +485,10 @@ export default class SSRFProtection {
             groups[5] === 0) {
             return SSRFProtection.classifyIpv4(embeddedIpv4(6));
         }
+        // 64:ff9b:1::/48 — local-use IPv4/IPv6 translation prefix (RFC 8215).
+        if (groups[0] === 0x0064 && groups[1] === 0xff9b && groups[2] === 1) {
+            return WebhookAddressTier.Forbidden;
+        }
         // ::/96 — IPv4-compatible (deprecated, still routable by some stacks).
         if (isZeroThrough(6)) {
             return SSRFProtection.classifyIpv4(embeddedIpv4(6));
@@ -424,6 +506,19 @@ export default class SSRFProtection {
             return SSRFProtection.strictestTier(SSRFProtection.classifyIpv4(embeddedIpv4(2)), SSRFProtection.classifyIpv4(embeddedIpv4(6, true)));
         }
         const first = groups[0];
+        // fd00:ec2::/32 — AWS IPv6 link-local service range.
+        if (first === 0xfd00 && groups[1] === 0x0ec2) {
+            return WebhookAddressTier.Forbidden;
+        }
+        // fd20:ce::254 — Google Cloud's IPv6 metadata server.
+        if (first === 0xfd20 &&
+            groups[1] === 0x00ce &&
+            groups.slice(2, 7).every((group) => {
+                return group === 0;
+            }) &&
+            groups[7] === 0x0254) {
+            return WebhookAddressTier.Forbidden;
+        }
         // fe80::/10 — link-local.
         if ((first & 0xffc0) === 0xfe80) {
             return WebhookAddressTier.Forbidden;
@@ -440,6 +535,10 @@ export default class SSRFProtection {
         if ((first & 0xffc0) === 0xfec0) {
             return WebhookAddressTier.Private;
         }
+        // 2001:db8::/32 — documentation-only, never a globally reachable target.
+        if (first === 0x2001 && groups[1] === 0x0db8) {
+            return WebhookAddressTier.Private;
+        }
         return WebhookAddressTier.Public;
     }
     static strictestTier(left, right) {
@@ -469,6 +568,23 @@ export default class SSRFProtection {
             return WebhookAddressTier.Forbidden;
         }
         const [first, second] = octets;
+        /*
+         * Cloud-platform service addresses that are outside ordinary link-local
+         * space. Alibaba's endpoint sits inside CGNAT and Azure's WireServer uses
+         * a globally-routable-looking address, so both must be checked before the
+         * general PRIVATE/Public ranges below.
+         */
+        if ((first === 100 &&
+            second === 100 &&
+            octets[2] === 100 &&
+            octets[3] === 200) ||
+            (first === 168 &&
+                second === 63 &&
+                octets[2] === 129 &&
+                octets[3] === 16) ||
+            (first === 192 && second === 0 && octets[2] === 0 && octets[3] === 192)) {
+            return WebhookAddressTier.Forbidden;
+        }
         if (first === 0) {
             return WebhookAddressTier.Forbidden; // 0.0.0.0/8 — "this host".
         }
@@ -495,6 +611,17 @@ export default class SSRFProtection {
         if (first === 100 && (second & 0xc0) === 64) {
             return WebhookAddressTier.Private; // CGNAT 100.64/10
         }
+        if (first === 192 && second === 0 && octets[2] === 0) {
+            return WebhookAddressTier.Private; // IETF protocol assignments 192.0.0/24
+        }
+        if (first === 198 && (second & 0xfe) === 18) {
+            return WebhookAddressTier.Private; // benchmarking 198.18/15
+        }
+        if ((first === 192 && second === 0 && octets[2] === 2) ||
+            (first === 198 && second === 51 && octets[2] === 100) ||
+            (first === 203 && second === 0 && octets[2] === 113)) {
+            return WebhookAddressTier.Private; // RFC 5737 documentation ranges
+        }
         return WebhookAddressTier.Public;
     }
     /*

package/build/dist/Server/Utils/SSRFProtection.js.map

@@ -1 +1 @@
-{"version":3,"file":"SSRFProtection.js","sourceRoot":"","sources":["../../../../Server/Utils/SSRFProtection.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,qBAAqB,CAAC;AACtC,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,2BAA2B,MAAM,+BAA+B,CAAC;AACxE,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,GAAG,MAAM,KAAK,CAAC;AAEtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,MAAM,CAAN,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC5B,uCAAiB,CAAA;IACjB,yCAAmB,CAAA;IACnB,6CAAuB,CAAA;AACzB,CAAC,EAJW,kBAAkB,KAAlB,kBAAkB,QAI7B;AAsCD,MAAM,oBAAoB,GAAW,aAAa,CAAC;AAEnD,MAAM,4BAA4B,GAChC,uHAAuH,CAAC;AAE1H,MAAM,CAAC,OAAO,OAAO,cAAc;IACjC;;;;;;OAMG;IACI,MAAM,CAAC,eAAe,CAAC,MAAoB;QAChD;;;;;;;;WAQG;QACH,IAAI,MAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QACjD,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,cAAc,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IACnE,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,oBAAoB,CAChC,MAAoB,EACpB,cAA6B;QAE7B,IAAI,MAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QACjD,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QAED,wEAAwE;QACxE,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC/C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,QAAQ,GAAW,cAAc,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAEhE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,MAAc,EAAE,EAAE;YAC5C,MAAM,OAAO,GAAW,MAAM,CAAC,WAAW,EAAE,CAAC;YAC7C,OAAO,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAC7C,MAAoB,EACpB,OAAwC;;QAExC,MAAM,KAAK,GAAW,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,WAAW,KAAI,oBAAoB,CAAC;QACnE,MAAM,kBAAkB,GACtB,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,kBAAkB,mCAAI,4BAA4B,CAAC;QAE9D;;;;;;;;;WASG;QACH,MAAM,WAAW,GAA4B,MAAM;aAChD,QAAQ,EAAE;aACV,IAAI,EAAE;aACN,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAErC,IACE,WAAW;YACX,WAAW,CAAC,CAAC,CAAC;YACd,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,EACzD,CAAC;YACD,MAAM,IAAI,gBAAgB,CAAC,GAAG,KAAK,mCAAmC,CAAC,CAAC;QAC1E,CAAC;QAED,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7C,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,IAAI,gBAAgB,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,aAAa,GAAW,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC;QACvE,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,UAAU,EAAE,CAAC;YAChE,MAAM,IAAI,gBAAgB,CAAC,GAAG,KAAK,mCAAmC,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,OAAO,GAAW,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAE/D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,gBAAgB,CAAC,GAAG,KAAK,uBAAuB,CAAC,CAAC;QAC9D,CAAC;QAED;;;;;;;WAOG;QACH,MAAM,QAAQ,GAAW,cAAc,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAE7D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,gBAAgB,CAAC,GAAG,KAAK,uBAAuB,CAAC,CAAC;QAC9D,CAAC;QAED;;;;;;;;;;;WAWG;QACH,MAAM,cAAc,GAAW,cAAc,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAEtE,MAAM,SAAS,GACb,cAAc,IAAI,cAAc,KAAK,QAAQ;YAC3C,CAAC,CAAC,CAAC,QAAQ,EAAE,cAAc,CAAC;YAC5B,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAEjB;;;;;;WAMG;QACH,MAAM,SAAS,GAAY,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,0BAA0B,MAAK,IAAI,CAAC;QACxE,MAAM,oBAAoB,GACxB,SAAS,IAAI,2BAA2B,CAAC,uBAAuB,EAAE,CAAC;QAErE;;;;;WAKG;QACH,MAAM,iBAAiB,GAA8B,CACnD,IAAY,EACH,EAAE;YACX,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC;gBACrC,CAAC,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,IAAI,CAAC;gBACpD,CAAC,CAAC,2BAA2B,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC1D,CAAC,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GACR,cAAc,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;YAE/C,IAAI,IAAI,KAAK,kBAAkB,CAAC,SAAS,EAAE,CAAC;gBAC1C,MAAM,IAAI,gBAAgB,CACxB,GAAG,KAAK,2EAA2E,CACpF,CAAC;YACJ,CAAC;YAED,IAAI,IAAI,KAAK,kBAAkB,CAAC,OAAO,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBACjE,MAAM,IAAI,gBAAgB,CACxB,GAAG,KAAK,2DAA2D,kBAAkB,EAAE,CACxF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChE,SAAS;YACX,CAAC;YAED,IAAI,QAAQ,GAA+B,EAAE,CAAC;YAC9C,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,CAAC;YAAC,WAAM,CAAC;gBACP,MAAM,IAAI,gBAAgB,CACxB,GAAG,KAAK,0CAA0C,CACnD,CAAC;YACJ,CAAC;YAED,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAW,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;gBAEpD,IACE,SAAS;oBACT,2BAA2B,CAAC,gBAAgB,CAAC,OAAO,CAAC,EACrD,CAAC;oBACD,SAAS;gBACX,CAAC;gBAED,MAAM,IAAI,GACR,cAAc,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;gBAElD,IAAI,IAAI,KAAK,kBAAkB,CAAC,SAAS,EAAE,CAAC;oBAC1C,MAAM,IAAI,gBAAgB,CACxB,GAAG,KAAK,6EAA6E,CACtF,CAAC;gBACJ,CAAC;gBAED,IAAI,IAAI,KAAK,kBAAkB,CAAC,OAAO,IAAI,CAAC,oBAAoB,EAAE,CAAC;oBACjE,MAAM,IAAI,gBAAgB,CACxB,GAAG,KAAK,6DAA6D,kBAAkB,EAAE,CAC1F,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,MAAM,CAAC,aAAa,CAAC,SAAiB;QAC5C,MAAM,OAAO,GAAW,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACnD,OAAO,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IACvE,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,WAAW,CAAC,YAAoB;QAC7C,MAAM,IAAI,GAAW,cAAc,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;QAEvE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,mBAAmB,GAAW,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACtD,IAAI,mBAAmB,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,UAAU,GAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QAE3D,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACnB,yEAAyE;YACzE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;YACrB,uCAAuC;YACvC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAClC,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,WAAW,CAAC,QAAgB;QACzC,OAAO,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;IAEO,MAAM,CAAC,WAAW,CAAC,OAAe;QACxC,MAAM,SAAS,GAAW,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/C,OAAO,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACtE,CAAC;IAED;;;;;;;;;OASG;IACK,MAAM,CAAC,UAAU,CAAC,OAAe;QACvC,IAAI,EAAE,GAAW,cAAc,CAAC,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QAEnE,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,iEAAiE;QACjE,MAAM,cAAc,GAAW,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACnD,MAAM,IAAI,GAAW,EAAE,CAAC,SAAS,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAAkB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAY,EAAE,EAAE;gBACjE,OAAO,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC;YACH,MAAM,IAAI,GAAW,CACnB,CAAE,MAAM,CAAC,CAAC,CAAY,IAAI,CAAC,CAAC;gBAC3B,MAAM,CAAC,CAAC,CAAY,CACtB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACf,MAAM,GAAG,GAAW,CAClB,CAAE,MAAM,CAAC,CAAC,CAAY,IAAI,CAAC,CAAC;gBAC3B,MAAM,CAAC,CAAC,CAAY,CACtB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACf,EAAE,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,cAAc,CAAC,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC;QAC3D,CAAC;QAED,MAAM,MAAM,GAAkB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GACR,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1E,MAAM,IAAI,GACR,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE;YAChE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;YACtB,CAAC,CAAC,EAAE,CAAC;QAET,IAAI,MAAqB,CAAC;QAC1B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAW,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACvD,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAkB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAa,EAAE,EAAE;YACzD,OAAO,QAAQ,CAAC,KAAK,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,IACE,MAAM,CAAC,IAAI,CAAC,CAAC,KAAa,EAAE,EAAE;YAC5B,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,MAAM,CAAC;QAC5D,CAAC,CAAC,EACF,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;OASG;IACK,MAAM,CAAC,YAAY,CAAC,OAAe;QACzC,MAAM,MAAM,GAAyB,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAExE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,2DAA2D;YAC3D,OAAO,kBAAkB,CAAC,MAAM,CAAC;QACnC,CAAC;QAED,MAAM,aAAa,GAAsC,CACvD,YAAoB,EACX,EAAE;YACX,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,KAAa,EAAE,EAAE;gBAC3D,OAAO,KAAK,KAAK,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,MAAM,YAAY,GAAyD,CACzE,cAAsB,EACtB,SAAkB,KAAK,EACf,EAAE;YACV,IAAI,IAAI,GAAW,MAAM,CAAC,cAAc,CAAW,CAAC;YACpD,IAAI,GAAG,GAAW,MAAM,CAAC,cAAc,GAAG,CAAC,CAAW,CAAC;YAEvD,mEAAmE;YACnE,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,IAAI,MAAM,CAAC;gBACf,GAAG,IAAI,MAAM,CAAC;YAChB,CAAC;YAED,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;QACjE,CAAC,CAAC;QAEF,8DAA8D;QAC9D,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,OAAO,kBAAkB,CAAC,SAAS,CAAC;QACtC,CAAC;QAED,kBAAkB;QAClB,IAAI,aAAa,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,OAAO,kBAAkB,CAAC,SAAS,CAAC;QACtC,CAAC;QAED,+BAA+B;QAC/B,IAAI,aAAa,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YAC7C,OAAO,cAAc,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QAED,0CAA0C;QAC1C,IACE,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM;YACpB,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM;YACpB,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YACf,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YACf,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YACf,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EACf,CAAC;YACD,OAAO,cAAc,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QAED,uEAAuE;QACvE,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,OAAO,cAAc,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QAED,0DAA0D;QAC1D,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YACzB,OAAO,cAAc,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QAED;;;;WAIG;QACH,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,OAAO,cAAc,CAAC,aAAa,CACjC,cAAc,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAC5C,cAAc,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CACnD,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAW,MAAM,CAAC,CAAC,CAAW,CAAC;QAE1C,0BAA0B;QAC1B,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;YAChC,OAAO,kBAAkB,CAAC,SAAS,CAAC;QACtC,CAAC;QAED,wBAAwB;QACxB,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;YAChC,OAAO,kBAAkB,CAAC,SAAS,CAAC;QACtC,CAAC;QAED,yEAAyE;QACzE,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;YAChC,OAAO,kBAAkB,CAAC,OAAO,CAAC;QACpC,CAAC;QAED,iFAAiF;QACjF,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;YAChC,OAAO,kBAAkB,CAAC,OAAO,CAAC;QACpC,CAAC;QAED,OAAO,kBAAkB,CAAC,MAAM,CAAC;IACnC,CAAC;IAEO,MAAM,CAAC,aAAa,CAC1B,IAAwB,EACxB,KAAyB;QAEzB,IACE,IAAI,KAAK,kBAAkB,CAAC,SAAS;YACrC,KAAK,KAAK,kBAAkB,CAAC,SAAS,EACtC,CAAC;YACD,OAAO,kBAAkB,CAAC,SAAS,CAAC;QACtC,CAAC;QAED,IACE,IAAI,KAAK,kBAAkB,CAAC,OAAO;YACnC,KAAK,KAAK,kBAAkB,CAAC,OAAO,EACpC,CAAC;YACD,OAAO,kBAAkB,CAAC,OAAO,CAAC;QACpC,CAAC;QAED,OAAO,kBAAkB,CAAC,MAAM,CAAC;IACnC,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,OAAe;QACzC,MAAM,MAAM,GAAkB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAY,EAAE,EAAE;YACpE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,IACE,MAAM,CAAC,MAAM,KAAK,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,CAAC,KAAa,EAAE,EAAE;gBAC5B,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG,CAAC;YACzD,CAAC,CAAC,EACF,CAAC;YACD;;;;eAIG;YACH,OAAO,kBAAkB,CAAC,SAAS,CAAC;QACtC,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,MAA0C,CAAC;QAEnE,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAChB,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC,2BAA2B;QAClE,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YAClB,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC,WAAW;QAClD,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACpC,0DAA0D;YAC1D,OAAO,kBAAkB,CAAC,SAAS,CAAC;QACtC,CAAC;QACD,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;YACjB,2CAA2C;YAC3C,OAAO,kBAAkB,CAAC,SAAS,CAAC;QACtC,CAAC;QACD,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACjB,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC,WAAW;QAChD,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAC5C,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC,qBAAqB;QAC1D,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACpC,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC,WAAW;QAChD,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAC5C,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC,kBAAkB;QACvD,CAAC;QAED,OAAO,kBAAkB,CAAC,MAAM,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,uBAAuB,CAAC,QAAgB;QACrD,IACE,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,YAAY;YACzB,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC/B,QAAQ,KAAK,0BAA0B,EACvC,CAAC;YACD,OAAO,kBAAkB,CAAC,SAAS,CAAC;QACtC,CAAC;QAED,MAAM,OAAO,GAAW,cAAc,CAAC,WAAW,CAChD,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CACjC,CAAC;QAEF,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,OAAO,cAAc,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,OAAO,cAAc,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC;QAED,OAAO,kBAAkB,CAAC,MAAM,CAAC;IACnC,CAAC;CACF"}
+{"version":3,"file":"SSRFProtection.js","sourceRoot":"","sources":["../../../../Server/Utils/SSRFProtection.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,qBAAqB,CAAC;AACtC,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,2BAA2B,MAAM,+BAA+B,CAAC;AACxE,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,GAAG,MAAM,KAAK,CAAC;AAEtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,MAAM,CAAN,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC5B,uCAAiB,CAAA;IACjB,yCAAmB,CAAA;IACnB,6CAAuB,CAAA;AACzB,CAAC,EAJW,kBAAkB,KAAlB,kBAAkB,QAI7B;AAgED,MAAM,oBAAoB,GAAW,aAAa,CAAC;AAEnD,MAAM,4BAA4B,GAChC,uHAAuH,CAAC;AAE1H,MAAM,CAAC,OAAO,OAAO,cAAc;IACjC;;;;;;OAMG;IACI,MAAM,CAAC,eAAe,CAAC,MAAoB;QAChD;;;;;;;;WAQG;QACH,IAAI,MAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QACjD,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,cAAc,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IACnE,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,oBAAoB,CAChC,MAAoB,EACpB,cAA6B;QAE7B,IAAI,MAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QACjD,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QAED,wEAAwE;QACxE,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC/C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,QAAQ,GAAW,cAAc,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAEhE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,MAAc,EAAE,EAAE;YAC5C,MAAM,OAAO,GAAW,MAAM,CAAC,WAAW,EAAE,CAAC;YAC7C,OAAO,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAC7C,MAAoB,EACpB,OAAwC;QAExC,MAAM,cAAc,CAAC,qBAAqB,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACrE,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,KAAK,CAAC,+BAA+B,CACjD,MAAoB,EACpB,OAAwC;QAExC,MAAM,MAAM,GACV,MAAM,cAAc,CAAC,qBAAqB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAEpE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,gBAAgB,CAAC,2CAA2C,CAAC,CAAC;QAC1E,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,qBAAqB,CACxC,MAAoB,EACpB,OAAmD,EACnD,qBAA8B;;QAE9B,MAAM,KAAK,GAAW,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,WAAW,KAAI,oBAAoB,CAAC;QACnE,MAAM,kBAAkB,GACtB,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,kBAAkB,mCAAI,4BAA4B,CAAC;QAE9D;;;;;;;;;WASG;QACH,MAAM,WAAW,GAA4B,MAAM;aAChD,QAAQ,EAAE;aACV,IAAI,EAAE;aACN,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAErC,IACE,WAAW;YACX,WAAW,CAAC,CAAC,CAAC;YACd,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,EACzD,CAAC;YACD,MAAM,IAAI,gBAAgB,CAAC,GAAG,KAAK,mCAAmC,CAAC,CAAC;QAC1E,CAAC;QAED,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7C,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,IAAI,gBAAgB,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,aAAa,GAAW,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC;QACvE,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,UAAU,EAAE,CAAC;YAChE,MAAM,IAAI,gBAAgB,CAAC,GAAG,KAAK,mCAAmC,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,OAAO,GAAW,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAE/D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,gBAAgB,CAAC,GAAG,KAAK,uBAAuB,CAAC,CAAC;QAC9D,CAAC;QAED;;;;;;;WAOG;QACH,MAAM,QAAQ,GAAW,cAAc,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAE7D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,gBAAgB,CAAC,GAAG,KAAK,uBAAuB,CAAC,CAAC;QAC9D,CAAC;QAED;;;;;;;;;;;WAWG;QACH,MAAM,cAAc,GAAW,cAAc,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAEtE,IAAI,YAAY,GAA0B,IAAI,CAAC;QAC/C,IAAI,qBAAqB,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,YAAY,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YACvD,CAAC;YAAC,WAAM,CAAC;gBACP,MAAM,IAAI,gBAAgB,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GACb,cAAc,IAAI,cAAc,KAAK,QAAQ;YAC3C,CAAC,CAAC,CAAC,QAAQ,EAAE,cAAc,CAAC;YAC5B,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAEjB;;;;;;WAMG;QACH,MAAM,SAAS,GAAY,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,0BAA0B,MAAK,IAAI,CAAC;QACxE,MAAM,sBAAsB,GAC1B,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,6BAA6B,MAAK,SAAS,CAAC;QACvD,MAAM,oBAAoB,GACxB,SAAS;YACT,CAAC,sBAAsB;gBACrB,CAAC,CAAC,2BAA2B,CAAC,uBAAuB,EAAE;gBACvD,CAAC,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,6BAA6B,MAAK,IAAI,CAAC,CAAC;QAEvD;;;;;WAKG;QACH,MAAM,iBAAiB,GAA8B,CACnD,IAAY,EACH,EAAE;YACX,IAAI,CAAC,SAAS,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAC1C,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC;gBACrC,CAAC,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,IAAI,CAAC;gBACpD,CAAC,CAAC,2BAA2B,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC1D,CAAC,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GACR,cAAc,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;YAE/C,IAAI,IAAI,KAAK,kBAAkB,CAAC,SAAS,EAAE,CAAC;gBAC1C,MAAM,IAAI,gBAAgB,CACxB,GAAG,KAAK,2EAA2E,CACpF,CAAC;YACJ,CAAC;YAED,IAAI,IAAI,KAAK,kBAAkB,CAAC,OAAO,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBACjE,MAAM,IAAI,gBAAgB,CACxB,GAAG,KAAK,2DAA2D,kBAAkB,EAAE,CACxF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,2BAA2B,GAG7B,IAAI,GAAG,EAAgD,CAAC;QAE5D,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,MAAM,oBAAoB,GACxB,qBAAqB,IAAI,IAAI,KAAK,cAAc,CAAC;YAEnD,IACE,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC;gBAChC,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAClD,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IAAI,QAAQ,GAA+C,EAAE,CAAC;YAC9D,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,CAAC;YAAC,WAAM,CAAC;gBACP,MAAM,IAAI,gBAAgB,CACxB,GAAG,KAAK,0CAA0C,CACnD,CAAC;YACJ,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,oBAAoB,EAAE,CAAC;gBAClD,MAAM,IAAI,gBAAgB,CACxB,GAAG,KAAK,0CAA0C,CACnD,CAAC;YACJ,CAAC;YAED,MAAM,mBAAmB,GACvB,QAAQ,CAAC,GAAG,CACV,CAAC,KAGA,EAAiC,EAAE;gBAClC,MAAM,OAAO,GAAW,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;gBACpD,OAAO;oBACL,OAAO,EAAE,OAAO;oBAChB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;iBAC1C,CAAC;YACJ,CAAC,CACF,CAAC;YAEJ,2BAA2B,CAAC,GAAG,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;YAE3D,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,SAAS;YACX,CAAC;YAED,KAAK,MAAM,KAAK,IAAI,mBAAmB,EAAE,CAAC;gBACxC,MAAM,OAAO,GAAW,KAAK,CAAC,OAAO,CAAC;gBAEtC,IACE,SAAS;oBACT,sBAAsB;oBACtB,2BAA2B,CAAC,gBAAgB,CAAC,OAAO,CAAC,EACrD,CAAC;oBACD,SAAS;gBACX,CAAC;gBAED,MAAM,IAAI,GACR,cAAc,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;gBAElD,IAAI,IAAI,KAAK,kBAAkB,CAAC,SAAS,EAAE,CAAC;oBAC1C,MAAM,IAAI,gBAAgB,CACxB,GAAG,KAAK,6EAA6E,CACtF,CAAC;gBACJ,CAAC;gBAED,IAAI,IAAI,KAAK,kBAAkB,CAAC,OAAO,IAAI,CAAC,oBAAoB,EAAE,CAAC;oBACjE,MAAM,IAAI,gBAAgB,CACxB,GAAG,KAAK,6DAA6D,kBAAkB,EAAE,CAC1F,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,YAAY,IAAI,CAAC,cAAc,EAAE,CAAC;YACrC,MAAM,IAAI,gBAAgB,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,cAAc,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,CAAC;YAC/C,MAAM,OAAO,GAAW,cAAc,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;YACnE,OAAO;gBACL,GAAG,EAAE,YAAY;gBACjB,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;aAC7D,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GACb,2BAA2B,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAElD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,gBAAgB,CACxB,GAAG,KAAK,0CAA0C,CACnD,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IACrD,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,MAAM,CAAC,aAAa,CAAC,SAAiB;QAC5C,MAAM,OAAO,GAAW,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACnD,OAAO,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IACvE,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,WAAW,CAAC,YAAoB;QAC7C,MAAM,IAAI,GAAW,cAAc,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;QAEvE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,mBAAmB,GAAW,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACtD,IAAI,mBAAmB,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,UAAU,GAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QAE3D,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACnB,yEAAyE;YACzE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;YACrB,uCAAuC;YACvC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAClC,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,WAAW,CAAC,QAAgB;QACzC,OAAO,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;IAEO,MAAM,CAAC,WAAW,CAAC,OAAe;QACxC,MAAM,SAAS,GAAW,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/C,OAAO,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACtE,CAAC;IAED;;;;;;;;;OASG;IACK,MAAM,CAAC,UAAU,CAAC,OAAe;QACvC,IAAI,EAAE,GAAW,cAAc,CAAC,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QAEnE,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,iEAAiE;QACjE,MAAM,cAAc,GAAW,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACnD,MAAM,IAAI,GAAW,EAAE,CAAC,SAAS,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAAkB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAY,EAAE,EAAE;gBACjE,OAAO,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC;YACH,MAAM,IAAI,GAAW,CACnB,CAAE,MAAM,CAAC,CAAC,CAAY,IAAI,CAAC,CAAC;gBAC3B,MAAM,CAAC,CAAC,CAAY,CACtB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACf,MAAM,GAAG,GAAW,CAClB,CAAE,MAAM,CAAC,CAAC,CAAY,IAAI,CAAC,CAAC;gBAC3B,MAAM,CAAC,CAAC,CAAY,CACtB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACf,EAAE,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,cAAc,CAAC,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC;QAC3D,CAAC;QAED,MAAM,MAAM,GAAkB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GACR,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1E,MAAM,IAAI,GACR,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE;YAChE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;YACtB,CAAC,CAAC,EAAE,CAAC;QAET,IAAI,MAAqB,CAAC;QAC1B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAW,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACvD,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAkB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAa,EAAE,EAAE;YACzD,OAAO,QAAQ,CAAC,KAAK,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,IACE,MAAM,CAAC,IAAI,CAAC,CAAC,KAAa,EAAE,EAAE;YAC5B,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,MAAM,CAAC;QAC5D,CAAC,CAAC,EACF,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;OAWG;IACK,MAAM,CAAC,YAAY,CAAC,OAAe;QACzC,MAAM,MAAM,GAAyB,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAExE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,2DAA2D;YAC3D,OAAO,kBAAkB,CAAC,MAAM,CAAC;QACnC,CAAC;QAED,MAAM,aAAa,GAAsC,CACvD,YAAoB,EACX,EAAE;YACX,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,KAAa,EAAE,EAAE;gBAC3D,OAAO,KAAK,KAAK,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,MAAM,YAAY,GAAyD,CACzE,cAAsB,EACtB,SAAkB,KAAK,EACf,EAAE;YACV,IAAI,IAAI,GAAW,MAAM,CAAC,cAAc,CAAW,CAAC;YACpD,IAAI,GAAG,GAAW,MAAM,CAAC,cAAc,GAAG,CAAC,CAAW,CAAC;YAEvD,mEAAmE;YACnE,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,IAAI,MAAM,CAAC;gBACf,GAAG,IAAI,MAAM,CAAC;YAChB,CAAC;YAED,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;QACjE,CAAC,CAAC;QAEF,8DAA8D;QAC9D,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,OAAO,kBAAkB,CAAC,SAAS,CAAC;QACtC,CAAC;QAED,kBAAkB;QAClB,IAAI,aAAa,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,OAAO,kBAAkB,CAAC,SAAS,CAAC;QACtC,CAAC;QAED;;;;;;WAMG;QACH,IAAI,aAAa,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,OAAO,kBAAkB,CAAC,SAAS,CAAC;QACtC,CAAC;QAED,+BAA+B;QAC/B,IAAI,aAAa,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YAC7C,OAAO,cAAc,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QAED,0CAA0C;QAC1C,IACE,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM;YACpB,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM;YACpB,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YACf,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YACf,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YACf,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EACf,CAAC;YACD,OAAO,cAAc,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QAED,sEAAsE;QACtE,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACpE,OAAO,kBAAkB,CAAC,SAAS,CAAC;QACtC,CAAC;QAED,uEAAuE;QACvE,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,OAAO,cAAc,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QAED,0DAA0D;QAC1D,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YACzB,OAAO,cAAc,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QAED;;;;WAIG;QACH,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,OAAO,cAAc,CAAC,aAAa,CACjC,cAAc,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAC5C,cAAc,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CACnD,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAW,MAAM,CAAC,CAAC,CAAW,CAAC;QAE1C,qDAAqD;QACrD,IAAI,KAAK,KAAK,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YAC7C,OAAO,kBAAkB,CAAC,SAAS,CAAC;QACtC,CAAC;QAED,sDAAsD;QACtD,IACE,KAAK,KAAK,MAAM;YAChB,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM;YACpB,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAa,EAAE,EAAE;gBACzC,OAAO,KAAK,KAAK,CAAC,CAAC;YACrB,CAAC,CAAC;YACF,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EACpB,CAAC;YACD,OAAO,kBAAkB,CAAC,SAAS,CAAC;QACtC,CAAC;QAED,0BAA0B;QAC1B,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;YAChC,OAAO,kBAAkB,CAAC,SAAS,CAAC;QACtC,CAAC;QAED,wBAAwB;QACxB,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;YAChC,OAAO,kBAAkB,CAAC,SAAS,CAAC;QACtC,CAAC;QAED,yEAAyE;QACzE,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;YAChC,OAAO,kBAAkB,CAAC,OAAO,CAAC;QACpC,CAAC;QAED,iFAAiF;QACjF,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;YAChC,OAAO,kBAAkB,CAAC,OAAO,CAAC;QACpC,CAAC;QAED,yEAAyE;QACzE,IAAI,KAAK,KAAK,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YAC7C,OAAO,kBAAkB,CAAC,OAAO,CAAC;QACpC,CAAC;QAED,OAAO,kBAAkB,CAAC,MAAM,CAAC;IACnC,CAAC;IAEO,MAAM,CAAC,aAAa,CAC1B,IAAwB,EACxB,KAAyB;QAEzB,IACE,IAAI,KAAK,kBAAkB,CAAC,SAAS;YACrC,KAAK,KAAK,kBAAkB,CAAC,SAAS,EACtC,CAAC;YACD,OAAO,kBAAkB,CAAC,SAAS,CAAC;QACtC,CAAC;QAED,IACE,IAAI,KAAK,kBAAkB,CAAC,OAAO;YACnC,KAAK,KAAK,kBAAkB,CAAC,OAAO,EACpC,CAAC;YACD,OAAO,kBAAkB,CAAC,OAAO,CAAC;QACpC,CAAC;QAED,OAAO,kBAAkB,CAAC,MAAM,CAAC;IACnC,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,OAAe;QACzC,MAAM,MAAM,GAAkB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAY,EAAE,EAAE;YACpE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,IACE,MAAM,CAAC,MAAM,KAAK,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,CAAC,KAAa,EAAE,EAAE;gBAC5B,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG,CAAC;YACzD,CAAC,CAAC,EACF,CAAC;YACD;;;;eAIG;YACH,OAAO,kBAAkB,CAAC,SAAS,CAAC;QACtC,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,MAA0C,CAAC;QAEnE;;;;;WAKG;QACH,IACE,CAAC,KAAK,KAAK,GAAG;YACZ,MAAM,KAAK,GAAG;YACd,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;YACjB,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;YACpB,CAAC,KAAK,KAAK,GAAG;gBACZ,MAAM,KAAK,EAAE;gBACb,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;gBACjB,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;YACnB,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,EACvE,CAAC;YACD,OAAO,kBAAkB,CAAC,SAAS,CAAC;QACtC,CAAC;QAED,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAChB,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC,2BAA2B;QAClE,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YAClB,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC,WAAW;QAClD,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACpC,0DAA0D;YAC1D,OAAO,kBAAkB,CAAC,SAAS,CAAC;QACtC,CAAC;QACD,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;YACjB,2CAA2C;YAC3C,OAAO,kBAAkB,CAAC,SAAS,CAAC;QACtC,CAAC;QACD,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACjB,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC,WAAW;QAChD,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAC5C,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC,qBAAqB;QAC1D,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACpC,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC,WAAW;QAChD,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAC5C,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC,kBAAkB;QACvD,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC,uCAAuC;QAC5E,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAC5C,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC,yBAAyB;QAC9D,CAAC;QACD,IACE,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAClD,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;YACrD,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,EACpD,CAAC;YACD,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC,gCAAgC;QACrE,CAAC;QAED,OAAO,kBAAkB,CAAC,MAAM,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,uBAAuB,CAAC,QAAgB;QACrD,IACE,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,YAAY;YACzB,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC/B,QAAQ,KAAK,0BAA0B,EACvC,CAAC;YACD,OAAO,kBAAkB,CAAC,SAAS,CAAC;QACtC,CAAC;QAED,MAAM,OAAO,GAAW,cAAc,CAAC,WAAW,CAChD,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CACjC,CAAC;QAEF,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,OAAO,cAAc,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,OAAO,cAAc,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC;QAED,OAAO,kBAAkB,CAAC,MAAM,CAAC;IACnC,CAAC;CACF"}