@openclaw/crabline 0.1.11 → 0.1.13

package/dist/src/servers/webhook-target.d.ts

@@ -1,4 +1,4 @@
-import { type ClientRequest } from "node:http";
+import { type ClientRequest, type IncomingHttpHeaders } from "node:http";
 export type WebhookAddress = {
     address: string;
     family: 4 | 6;
@@ -9,6 +9,10 @@ export type ValidatedWebhookTarget = {
 } | {
     error: WebhookTargetError;
 };
+export type WebhookResponse = {
+    headers: IncomingHttpHeaders;
+    status: number;
+};
 export declare const MAX_CONCURRENT_WEBHOOK_DNS_LOOKUPS = 8;
 type WebhookDnsLookupResult = ReadonlyArray<{
     address: string;
@@ -19,16 +23,18 @@ export declare class WebhookDnsLookupPool {
     #private;
     private readonly maxConcurrent;
     private readonly lookupHostname;
-    constructor(maxConcurrent: number, lookupHostname?: WebhookDnsLookup);
+    private readonly abortedLookupRecoveryMs;
+    constructor(maxConcurrent: number, lookupHostname?: WebhookDnsLookup, abortedLookupRecoveryMs?: number);
     resolve(hostname: string, signal?: AbortSignal): Promise<WebhookDnsLookupResult>;
 }
 export declare function validateWebhookTarget(params: {
     allowLoopbackHttp: boolean;
+    dnsLookupPool?: Pick<WebhookDnsLookupPool, "resolve"> | undefined;
     restrictPrivateAddresses: boolean;
     signal?: AbortSignal | undefined;
     url: URL;
 }): Promise<ValidatedWebhookTarget>;
-export declare function postWebhookRequest(params: {
+type PostWebhookRequestParams = {
     activeRequests?: Set<ClientRequest> | undefined;
     address?: WebhookAddress | undefined;
     body: string;
@@ -36,5 +42,7 @@ export declare function postWebhookRequest(params: {
     signal?: AbortSignal | undefined;
     timeoutMs: number;
     url: URL;
-}): Promise<number>;
+};
+export declare function postWebhookRequestWithResponse(params: PostWebhookRequestParams): Promise<WebhookResponse>;
+export declare function postWebhookRequest(params: PostWebhookRequestParams): Promise<number>;
 export {};

package/dist/src/servers/webhook-target.js

@@ -1,5 +1,5 @@
 import { lookup } from "node:dns/promises";
-import { request as requestHttp } from "node:http";
+import { request as requestHttp, } from "node:http";
 import { request as requestHttps } from "node:https";
 import { BlockList, isIP } from "node:net";
 import { isLoopbackHost } from "./http.js";
@@ -9,21 +9,43 @@ const BLOCKED_IPV6_ADDRESSES = createBlockedIpv6Addresses();
 const GLOBAL_IPV4_EXCEPTIONS = createGlobalIpv4Exceptions();
 const GLOBAL_IPV6_EXCEPTIONS = createGlobalIpv6Exceptions();
 const ALLOCATED_GLOBAL_IPV6_RANGES = createAllocatedGlobalIpv6Ranges();
+const RFC6052_PREFIX_LENGTHS = [32, 40, 48, 56, 64, 96];
+const IPV4ONLY_ADDRESSES = new Set(["192.0.0.170", "192.0.0.171"]);
+const SENDER_CONTROLLED_WEBHOOK_HEADERS = new Set([
+    "connection",
+    "content-length",
+    "expect",
+    "host",
+    "keep-alive",
+    "proxy-connection",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+]);
 export class WebhookDnsLookupPool {
     maxConcurrent;
     lookupHostname;
+    abortedLookupRecoveryMs;
     #pending = [];
+    #recoverable = new Set();
     #active = 0;
-    constructor(maxConcurrent, lookupHostname = async (hostname) => await lookup(hostname, { all: true, verbatim: true })) {
+    #detached = 0;
+    constructor(maxConcurrent, lookupHostname = async (hostname) => await lookup(hostname, { all: true, verbatim: true }), abortedLookupRecoveryMs = 5_000) {
         this.maxConcurrent = maxConcurrent;
         this.lookupHostname = lookupHostname;
+        this.abortedLookupRecoveryMs = abortedLookupRecoveryMs;
         if (!Number.isSafeInteger(maxConcurrent) || maxConcurrent < 1) {
             throw new Error("Webhook DNS lookup concurrency must be a positive safe integer.");
         }
+        if (!Number.isSafeInteger(abortedLookupRecoveryMs) || abortedLookupRecoveryMs < 1) {
+            throw new Error("Webhook DNS lookup recovery must be a positive safe integer.");
+        }
     }
     resolve(hostname, signal) {
         return new Promise((resolve, reject) => {
             const pending = {
+                detached: false,
                 hostname,
                 onAbort: () => {
                     if (pending.settled) {
@@ -36,14 +58,20 @@ export class WebhookDnsLookupPool {
                             this.#pending.splice(index, 1);
                         }
                     }
+                    else {
+                        this.#scheduleRecovery(pending);
+                    }
                     signal?.removeEventListener("abort", pending.onAbort);
                     reject(abortSignalError(signal));
                     this.#pump();
                 },
                 reject,
+                recoveryReady: false,
+                recoveryTimer: undefined,
                 resolve,
                 settled: false,
                 signal,
+                slotHeld: false,
                 started: false,
             };
             if (signal?.aborted) {
@@ -65,8 +93,16 @@ export class WebhookDnsLookupPool {
                 continue;
             }
             pending.started = true;
+            pending.slotHeld = true;
             this.#active += 1;
-            void this.lookupHostname(pending.hostname)
+            let lookupPromise;
+            try {
+                lookupPromise = this.lookupHostname(pending.hostname);
+            }
+            catch (error) {
+                lookupPromise = Promise.reject(error);
+            }
+            void lookupPromise
                 .then((addresses) => {
                 if (!pending.settled) {
                     pending.settled = true;
@@ -79,12 +115,61 @@ export class WebhookDnsLookupPool {
                 }
             })
                 .finally(() => {
+                if (pending.recoveryTimer) {
+                    clearTimeout(pending.recoveryTimer);
+                    pending.recoveryTimer = undefined;
+                }
+                this.#recoverable.delete(pending);
                 pending.signal?.removeEventListener("abort", pending.onAbort);
-                this.#active -= 1;
-                this.#pump();
+                if (pending.detached) {
+                    pending.detached = false;
+                    this.#detached -= 1;
+                    this.#recoverSlots();
+                    this.#pump();
+                }
+                else {
+                    this.#releaseSlot(pending);
+                }
             });
         }
     }
+    #scheduleRecovery(pending) {
+        if (pending.recoveryTimer || pending.detached || !pending.slotHeld) {
+            return;
+        }
+        pending.recoveryTimer = setTimeout(() => {
+            pending.recoveryTimer = undefined;
+            if (!pending.slotHeld) {
+                return;
+            }
+            pending.recoveryReady = true;
+            this.#recoverable.add(pending);
+            this.#recoverSlots();
+        }, this.abortedLookupRecoveryMs);
+        pending.recoveryTimer.unref();
+    }
+    #recoverSlots() {
+        for (const pending of this.#recoverable) {
+            if (this.#detached >= this.maxConcurrent) {
+                return;
+            }
+            this.#recoverable.delete(pending);
+            if (!pending.recoveryReady || !pending.slotHeld) {
+                continue;
+            }
+            pending.detached = true;
+            this.#detached += 1;
+            this.#releaseSlot(pending);
+        }
+    }
+    #releaseSlot(pending) {
+        if (!pending.slotHeld) {
+            return;
+        }
+        pending.slotHeld = false;
+        this.#active -= 1;
+        this.#pump();
+    }
 }
 const webhookDnsLookupPool = new WebhookDnsLookupPool(MAX_CONCURRENT_WEBHOOK_DNS_LOOKUPS);
 function abortSignalError(signal) {
@@ -227,17 +312,83 @@ function parseIpv6Hextets(address) {
     const hextets = [...leading, ...Array.from({ length: omitted }, () => 0), ...trailing];
     return hextets.length === 8 ? hextets : undefined;
 }
-function embeddedNat64Ipv4(address) {
+function ipv6Bytes(address) {
+    if (isIP(address) !== 6) {
+        return undefined;
+    }
     const hextets = parseIpv6Hextets(address);
-    if (!hextets ||
-        hextets[0] !== 0x64 ||
-        hextets[1] !== 0xff9b ||
-        hextets.slice(2, 6).some((value) => value !== 0)) {
+    if (!hextets) {
         return undefined;
     }
-    return [hextets[6] >> 8, hextets[6] & 0xff, hextets[7] >> 8, hextets[7] & 0xff].join(".");
+    return hextets.flatMap((value) => [value >> 8, value & 0xff]);
+}
+function extractRfc6052Ipv4(bytes, prefixLength) {
+    if (prefixLength === 96) {
+        return bytes.slice(12, 16).join(".");
+    }
+    const prefixBytes = prefixLength / 8;
+    const leadingIpv4Bytes = 8 - prefixBytes;
+    return [...bytes.slice(prefixBytes, 8), ...bytes.slice(9, 9 + (4 - leadingIpv4Bytes))].join(".");
 }
-function isBlockedWebhookAddress(address) {
+function prefixMatches(bytes, prefix) {
+    const prefixBytes = prefix.length / 8;
+    return prefix.bytes.slice(0, prefixBytes).every((value, index) => bytes[index] === value);
+}
+function nat64PrefixKey(prefix) {
+    return `${prefix.length}:${prefix.bytes.slice(0, prefix.length / 8).join(".")}`;
+}
+function discoverNat64Prefixes(addresses) {
+    const candidates = new Map();
+    let ipv6Answers = 0;
+    for (const entry of addresses) {
+        if (entry.family !== 6) {
+            continue;
+        }
+        ipv6Answers++;
+        const bytes = ipv6Bytes(normalizeHostname(entry.address));
+        if (!bytes) {
+            continue;
+        }
+        for (const length of RFC6052_PREFIX_LENGTHS) {
+            if (length !== 96 && bytes[8] !== 0) {
+                continue;
+            }
+            if (!IPV4ONLY_ADDRESSES.has(extractRfc6052Ipv4(bytes, length))) {
+                continue;
+            }
+            const prefix = { bytes, length };
+            const key = nat64PrefixKey(prefix);
+            const candidate = candidates.get(key) ?? { addresses: new Set(), prefix };
+            candidate.addresses.add(extractRfc6052Ipv4(bytes, length));
+            candidates.set(key, candidate);
+        }
+    }
+    if (ipv6Answers === 0) {
+        return [];
+    }
+    const prefixes = [...candidates.values()]
+        .filter((candidate) => [...IPV4ONLY_ADDRESSES].every((address) => candidate.addresses.has(address)))
+        .map((candidate) => candidate.prefix);
+    return prefixes.length > 0 ? prefixes : undefined;
+}
+const WELL_KNOWN_NAT64_PREFIX = {
+    bytes: ipv6Bytes("64:ff9b::"),
+    length: 96,
+};
+function embeddedNat64Ipv4Addresses(address, nat64Prefixes) {
+    const bytes = ipv6Bytes(address);
+    if (!bytes) {
+        return [];
+    }
+    const addresses = [];
+    for (const prefix of [WELL_KNOWN_NAT64_PREFIX, ...nat64Prefixes]) {
+        if (prefixMatches(bytes, prefix)) {
+            addresses.push(extractRfc6052Ipv4(bytes, prefix.length));
+        }
+    }
+    return addresses;
+}
+function isBlockedWebhookAddress(address, nat64Prefixes = []) {
     const normalized = normalizeHostname(address);
     const family = isIP(normalized);
     if (family === 4) {
@@ -245,8 +396,7 @@ function isBlockedWebhookAddress(address) {
             BLOCKED_IPV4_ADDRESSES.check(normalized, "ipv4"));
     }
     if (family === 6) {
-        const embeddedIpv4 = embeddedNat64Ipv4(normalized);
-        if (embeddedIpv4 && isBlockedWebhookAddress(embeddedIpv4)) {
+        if (embeddedNat64Ipv4Addresses(normalized, nat64Prefixes).some((embeddedIpv4) => isBlockedWebhookAddress(embeddedIpv4))) {
             return true;
         }
         if (GLOBAL_IPV6_EXCEPTIONS.check(normalized, "ipv6")) {
@@ -257,13 +407,13 @@ function isBlockedWebhookAddress(address) {
     }
     return false;
 }
-async function resolveWebhookAddresses(hostname, signal) {
+async function resolveWebhookAddresses(hostname, signal, dnsLookupPool = webhookDnsLookupPool) {
     const normalized = normalizeHostname(hostname);
     const family = isIP(normalized);
     if (family === 4 || family === 6) {
         return [{ address: normalized, family }];
     }
-    return (await webhookDnsLookupPool.resolve(normalized, signal)).flatMap((entry) => entry.family === 4 || entry.family === 6
+    return (await dnsLookupPool.resolve(normalized, signal)).flatMap((entry) => entry.family === 4 || entry.family === 6
         ? [{ address: entry.address, family: entry.family }]
         : []);
 }
@@ -274,15 +424,12 @@ export async function validateWebhookTarget(params) {
     if (params.url.protocol !== "https:" && !allowThisLoopbackHttp) {
         return { error: "https-required" };
     }
-    if (allowThisLoopbackHttp) {
-        return { addresses: undefined };
-    }
-    if (!params.restrictPrivateAddresses) {
+    if (!params.restrictPrivateAddresses && !allowThisLoopbackHttp) {
         return { addresses: undefined };
     }
     let addresses;
     try {
-        addresses = await resolveWebhookAddresses(params.url.hostname, params.signal);
+        addresses = await resolveWebhookAddresses(params.url.hostname, params.signal, params.dnsLookupPool);
     }
     catch (error) {
         if (params.signal?.aborted) {
@@ -293,12 +440,50 @@ export async function validateWebhookTarget(params) {
     if (addresses.length === 0) {
         return { error: "unresolvable" };
     }
+    if (allowThisLoopbackHttp) {
+        return addresses.every((entry) => isLoopbackHost(entry.address))
+            ? { addresses }
+            : { error: "private-address" };
+    }
     if (addresses.some((entry) => isBlockedWebhookAddress(entry.address))) {
         return { error: "private-address" };
     }
+    if (addresses.some((entry) => entry.family === 6)) {
+        let nat64Prefixes;
+        try {
+            nat64Prefixes = discoverNat64Prefixes(await (params.dnsLookupPool ?? webhookDnsLookupPool).resolve("ipv4only.arpa", params.signal));
+        }
+        catch (error) {
+            if (params.signal?.aborted) {
+                throw error;
+            }
+            return { error: "private-address" };
+        }
+        if (!nat64Prefixes) {
+            return { error: "private-address" };
+        }
+        if (addresses.some((entry) => isBlockedWebhookAddress(entry.address, nat64Prefixes))) {
+            return { error: "private-address" };
+        }
+    }
     return { addresses };
 }
-export async function postWebhookRequest(params) {
+function webhookRequestHeaders(body, headerEntries) {
+    const headers = {
+        "content-length": String(Buffer.byteLength(body)),
+        "content-type": "application/json",
+    };
+    for (const [name, value] of headerEntries ?? []) {
+        const normalizedName = name.toLowerCase();
+        if (SENDER_CONTROLLED_WEBHOOK_HEADERS.has(normalizedName)) {
+            throw new Error(`Webhook header "${name}" is controlled by the sender.`);
+        }
+        headers[normalizedName] = value;
+    }
+    return headers;
+}
+async function sendWebhookRequest(params, resolveOnHeaders) {
+    const headers = webhookRequestHeaders(params.body, params.headerEntries);
     return await new Promise((resolve, reject) => {
         const address = params.address;
         let settled = false;
@@ -317,11 +502,7 @@ export async function postWebhookRequest(params) {
         const request = send(params.url, {
             agent: false,
             ...(address ? { family: address.family } : {}),
-            headers: {
-                "content-length": String(Buffer.byteLength(params.body)),
-                "content-type": "application/json",
-                ...Object.fromEntries(params.headerEntries ?? []),
-            },
+            headers,
             ...(address
                 ? {
                     lookup: (_hostname, _options, callback) => callback(null, address.address, address.family),
@@ -331,9 +512,20 @@ export async function postWebhookRequest(params) {
             signal: params.signal,
         }, (incoming) => {
             response = incoming;
+            const result = {
+                headers: incoming.headers,
+                status: incoming.statusCode ?? 0,
+            };
+            if (resolveOnHeaders) {
+                finish(() => {
+                    incoming.destroy();
+                    resolve(result);
+                });
+                return;
+            }
             incoming.resume();
             incoming.once("error", (error) => finish(() => reject(error)));
-            incoming.once("end", () => finish(() => resolve(incoming.statusCode ?? 0)));
+            incoming.once("end", () => finish(() => resolve(result)));
         });
         params.activeRequests?.add(request);
         deadline = setTimeout(() => {
@@ -346,4 +538,10 @@ export async function postWebhookRequest(params) {
         request.end(params.body);
     });
 }
+export async function postWebhookRequestWithResponse(params) {
+    return await sendWebhookRequest(params, true);
+}
+export async function postWebhookRequest(params) {
+    return (await sendWebhookRequest(params, false)).status;
+}
 //# sourceMappingURL=webhook-target.js.map

package/dist/src/servers/webhook-target.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-target.js","sourceRoot":"","sources":["../../../src/servers/webhook-target.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,OAAO,IAAI,WAAW,EAA4C,MAAM,WAAW,CAAC;AAC7F,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAa3C,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC;AAEpD,MAAM,sBAAsB,GAAG,0BAA0B,EAAE,CAAC;AAC5D,MAAM,sBAAsB,GAAG,0BAA0B,EAAE,CAAC;AAC5D,MAAM,sBAAsB,GAAG,0BAA0B,EAAE,CAAC;AAC5D,MAAM,sBAAsB,GAAG,0BAA0B,EAAE,CAAC;AAC5D,MAAM,4BAA4B,GAAG,+BAA+B,EAAE,CAAC;AAevE,MAAM,OAAO,oBAAoB;IAKZ,aAAa;IACb,cAAc;IALxB,QAAQ,GAA8B,EAAE,CAAC;IAClD,OAAO,GAAG,CAAC,CAAC;IAEZ,YACmB,aAAqB,EACrB,cAAc,GAAqB,KAAK,EAAE,QAAQ,EAAE,EAAE,CACrE,MAAM,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;6BAFtC,aAAa;8BACb,cAAc;QAG/B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IAED,OAAO,CAAC,QAAgB,EAAE,MAAoB;QAC5C,OAAO,IAAI,OAAO,CAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7D,MAAM,OAAO,GAA4B;gBACvC,QAAQ;gBACR,OAAO,EAAE,GAAG,EAAE;oBACZ,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;wBACpB,OAAO;oBACT,CAAC;oBACD,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;oBACvB,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;wBACrB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;wBAC7C,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;4BACf,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;wBACjC,CAAC;oBACH,CAAC;oBACD,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;oBACtD,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;oBACjC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACf,CAAC;gBACD,MAAM;gBACN,OAAO;gBACP,OAAO,EAAE,KAAK;gBACd,MAAM;gBACN,OAAO,EAAE,KAAK;aACf,CAAC;YACF,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpB,OAAO,CAAC,OAAO,EAAE,CAAC;gBAClB,OAAO;YACT,CAAC;YACD,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACnE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACtC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YACD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpB,SAAS;YACX,CAAC;YACD,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;YACvB,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;YAClB,KAAK,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC;iBACvC,IAAI,CACH,CAAC,SAAS,EAAE,EAAE;gBACZ,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;oBACrB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;oBACvB,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;gBACjB,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;oBACrB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;oBACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACxB,CAAC;YACH,CAAC,CACF;iBACA,OAAO,CAAC,GAAG,EAAE;gBACZ,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;gBAC9D,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;gBAClB,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,CAAC,CAAC,CAAC;QACP,CAAC;IACH,CAAC;CACF;AAED,MAAM,oBAAoB,GAAG,IAAI,oBAAoB,CAAC,kCAAkC,CAAC,CAAC;AAE1F,SAAS,gBAAgB,CAAC,MAA+B;IACvD,OAAO,MAAM,EAAE,MAAM,YAAY,KAAK;QACpC,CAAC,CAAC,MAAM,CAAC,MAAM;QACf,CAAC,CAAC,IAAI,YAAY,CAAC,4BAA4B,EAAE,YAAY,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,0BAA0B;IACjC,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI;QAC9B,CAAC,SAAS,EAAE,CAAC,CAAC;QACd,CAAC,UAAU,EAAE,CAAC,CAAC;QACf,CAAC,YAAY,EAAE,EAAE,CAAC;QAClB,CAAC,WAAW,EAAE,CAAC,CAAC;QAChB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,YAAY,EAAE,EAAE,CAAC;QAClB,CAAC,WAAW,EAAE,EAAE,CAAC;QACjB,CAAC,WAAW,EAAE,EAAE,CAAC;QACjB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,YAAY,EAAE,EAAE,CAAC;QAClB,CAAC,cAAc,EAAE,EAAE,CAAC;QACpB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,WAAW,EAAE,CAAC,CAAC;QAChB,CAAC,WAAW,EAAE,CAAC,CAAC;KACR,EAAE,CAAC;QACX,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,0BAA0B;IACjC,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI;QAC9B,CAAC,IAAI,EAAE,EAAE,CAAC;QACV,CAAC,YAAY,EAAE,EAAE,CAAC;QAClB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,OAAO,EAAE,EAAE,CAAC;QACb,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,QAAQ,EAAE,EAAE,CAAC;QACd,CAAC,YAAY,EAAE,EAAE,CAAC;QAClB,CAAC,QAAQ,EAAE,EAAE,CAAC;QACd,CAAC,QAAQ,EAAE,EAAE,CAAC;QACd,CAAC,QAAQ,EAAE,EAAE,CAAC;QACd,CAAC,QAAQ,EAAE,CAAC,CAAC;QACb,CAAC,QAAQ,EAAE,EAAE,CAAC;QACd,CAAC,QAAQ,EAAE,CAAC,CAAC;KACL,EAAE,CAAC;QACX,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,0BAA0B;IACjC,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;IAClC,gEAAgE;IAChE,KAAK,MAAM,OAAO,IAAI,CAAC,WAAW,EAAE,YAAY,CAAU,EAAE,CAAC;QAC3D,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,0BAA0B;IACjC,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;IAClC,6DAA6D;IAC7D,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI;QAC9B,CAAC,WAAW,EAAE,GAAG,CAAC;QAClB,CAAC,WAAW,EAAE,GAAG,CAAC;QAClB,CAAC,WAAW,EAAE,GAAG,CAAC;QAClB,CAAC,UAAU,EAAE,EAAE,CAAC;QAChB,CAAC,cAAc,EAAE,EAAE,CAAC;QACpB,CAAC,WAAW,EAAE,EAAE,CAAC;QACjB,CAAC,WAAW,EAAE,EAAE,CAAC;KACT,EAAE,CAAC;QACX,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,+BAA+B;IACtC,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;IAClC,qEAAqE;IACrE,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI;QAC9B,CAAC,YAAY,EAAE,EAAE,CAAC;QAClB,CAAC,YAAY,EAAE,EAAE,CAAC;QAClB,CAAC,YAAY,EAAE,EAAE,CAAC;QAClB,CAAC,YAAY,EAAE,EAAE,CAAC;QAClB,CAAC,YAAY,EAAE,EAAE,CAAC;QAClB,CAAC,YAAY,EAAE,EAAE,CAAC;QAClB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,QAAQ,EAAE,EAAE,CAAC;QACd,CAAC,QAAQ,EAAE,EAAE,CAAC;QACd,CAAC,QAAQ,EAAE,EAAE,CAAC;QACd,CAAC,QAAQ,EAAE,EAAE,CAAC;QACd,CAAC,QAAQ,EAAE,EAAE,CAAC;QACd,CAAC,QAAQ,EAAE,EAAE,CAAC;QACd,CAAC,QAAQ,EAAE,EAAE,CAAC;QACd,CAAC,QAAQ,EAAE,EAAE,CAAC;QACd,CAAC,QAAQ,EAAE,EAAE,CAAC;QACd,CAAC,QAAQ,EAAE,EAAE,CAAC;QACd,CAAC,QAAQ,EAAE,EAAE,CAAC;KACN,EAAE,CAAC;QACX,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IACD,SAAS,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IACzC,OAAO,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,YAAY,GAAG,CAAC,OAAe,EAAY,EAAE,CACjD,OAAO;QACL,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;YACnC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YACtC,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5C,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;QAC1E,CAAC,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC;IACvF,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1C,IACE,CAAC,OAAO;QACR,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;QACnB,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM;QACrB,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,EAChD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,CAAC,OAAO,CAAC,CAAC,CAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,CAAE,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC,CAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAe;IAC9C,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAChC,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,OAAO,CACL,CAAC,sBAAsB,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC;YACjD,sBAAsB,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CACjD,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,YAAY,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,YAAY,IAAI,uBAAuB,CAAC,YAAY,CAAC,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,sBAAsB,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;YACrD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,CACL,sBAAsB,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC;YAChD,CAAC,4BAA4B,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CACxD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,QAAgB,EAChB,MAAoB;IAEpB,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAChC,IAAI,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,CAAC,MAAM,oBAAoB,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAChF,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QACtC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QACpD,CAAC,CAAC,EAAE,CACP,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAK3C;IACC,MAAM,qBAAqB,GACzB,MAAM,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO;QAC/B,MAAM,CAAC,iBAAiB;QACxB,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC/D,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;IACrC,CAAC;IACD,IAAI,qBAAqB,EAAE,CAAC;QAC1B,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,wBAAwB,EAAE,CAAC;QACrC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,SAA2B,CAAC;IAChC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC3B,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACtE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACtC,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAQxC;IACC,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,QAAqC,CAAC;QAC1C,IAAI,QAAwB,CAAC;QAC7B,MAAM,MAAM,GAAG,CAAC,QAAoB,EAAE,EAAE;YACtC,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,QAAQ,CAAC,CAAC;YACvB,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YACvC,QAAQ,EAAE,CAAC;QACb,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;QAC3E,MAAM,OAAO,GAAG,IAAI,CAClB,MAAM,CAAC,GAAG,EACV;YACE,KAAK,EAAE,KAAK;YACZ,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,OAAO,EAAE;gBACP,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACxD,cAAc,EAAE,kBAAkB;gBAClC,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;aAClD;YACD,GAAG,CAAC,OAAO;gBACT,CAAC,CAAC;oBACE,MAAM,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CACxC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC;iBAClD;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,EACD,CAAC,QAAQ,EAAE,EAAE;YACX,QAAQ,GAAG,QAAQ,CAAC;YACpB,QAAQ,CAAC,MAAM,EAAE,CAAC;YAClB,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC/D,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9E,CAAC,CACF,CAAC;QACF,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACpC,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE;YACzB,MAAM,KAAK,GAAG,IAAI,YAAY,CAC5B,oCAAoC,MAAM,CAAC,SAAS,IAAI,EACxD,cAAc,CACf,CAAC;YACF,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACzB,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACrB,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { lookup } from \"node:dns/promises\";\nimport { request as requestHttp, type ClientRequest, type IncomingMessage } from \"node:http\";\nimport { request as requestHttps } from \"node:https\";\nimport { BlockList, isIP } from \"node:net\";\nimport { isLoopbackHost } from \"./http.js\";\n\nexport type WebhookAddress = {\n  address: string;\n  family: 4 | 6;\n};\n\nexport type WebhookTargetError = \"https-required\" | \"private-address\" | \"unresolvable\";\n\nexport type ValidatedWebhookTarget =\n  | { addresses: WebhookAddress[] | undefined }\n  | { error: WebhookTargetError };\n\nexport const MAX_CONCURRENT_WEBHOOK_DNS_LOOKUPS = 8;\n\nconst BLOCKED_IPV4_ADDRESSES = createBlockedIpv4Addresses();\nconst BLOCKED_IPV6_ADDRESSES = createBlockedIpv6Addresses();\nconst GLOBAL_IPV4_EXCEPTIONS = createGlobalIpv4Exceptions();\nconst GLOBAL_IPV6_EXCEPTIONS = createGlobalIpv6Exceptions();\nconst ALLOCATED_GLOBAL_IPV6_RANGES = createAllocatedGlobalIpv6Ranges();\n\ntype WebhookDnsLookupResult = ReadonlyArray<{ address: string; family: number }>;\ntype WebhookDnsLookup = (hostname: string) => Promise<WebhookDnsLookupResult>;\n\ntype PendingWebhookDnsLookup = {\n  hostname: string;\n  onAbort: () => void;\n  reject(error: unknown): void;\n  resolve(addresses: WebhookDnsLookupResult): void;\n  settled: boolean;\n  signal: AbortSignal | undefined;\n  started: boolean;\n};\n\nexport class WebhookDnsLookupPool {\n  readonly #pending: PendingWebhookDnsLookup[] = [];\n  #active = 0;\n\n  constructor(\n    private readonly maxConcurrent: number,\n    private readonly lookupHostname: WebhookDnsLookup = async (hostname) =>\n      await lookup(hostname, { all: true, verbatim: true }),\n  ) {\n    if (!Number.isSafeInteger(maxConcurrent) || maxConcurrent < 1) {\n      throw new Error(\"Webhook DNS lookup concurrency must be a positive safe integer.\");\n    }\n  }\n\n  resolve(hostname: string, signal?: AbortSignal): Promise<WebhookDnsLookupResult> {\n    return new Promise<WebhookDnsLookupResult>((resolve, reject) => {\n      const pending: PendingWebhookDnsLookup = {\n        hostname,\n        onAbort: () => {\n          if (pending.settled) {\n            return;\n          }\n          pending.settled = true;\n          if (!pending.started) {\n            const index = this.#pending.indexOf(pending);\n            if (index >= 0) {\n              this.#pending.splice(index, 1);\n            }\n          }\n          signal?.removeEventListener(\"abort\", pending.onAbort);\n          reject(abortSignalError(signal));\n          this.#pump();\n        },\n        reject,\n        resolve,\n        settled: false,\n        signal,\n        started: false,\n      };\n      if (signal?.aborted) {\n        pending.onAbort();\n        return;\n      }\n      signal?.addEventListener(\"abort\", pending.onAbort, { once: true });\n      this.#pending.push(pending);\n      this.#pump();\n    });\n  }\n\n  #pump(): void {\n    while (this.#active < this.maxConcurrent) {\n      const pending = this.#pending.shift();\n      if (!pending) {\n        return;\n      }\n      if (pending.settled) {\n        continue;\n      }\n      pending.started = true;\n      this.#active += 1;\n      void this.lookupHostname(pending.hostname)\n        .then(\n          (addresses) => {\n            if (!pending.settled) {\n              pending.settled = true;\n              pending.resolve(addresses);\n            }\n          },\n          (error: unknown) => {\n            if (!pending.settled) {\n              pending.settled = true;\n              pending.reject(error);\n            }\n          },\n        )\n        .finally(() => {\n          pending.signal?.removeEventListener(\"abort\", pending.onAbort);\n          this.#active -= 1;\n          this.#pump();\n        });\n    }\n  }\n}\n\nconst webhookDnsLookupPool = new WebhookDnsLookupPool(MAX_CONCURRENT_WEBHOOK_DNS_LOOKUPS);\n\nfunction abortSignalError(signal: AbortSignal | undefined): Error {\n  return signal?.reason instanceof Error\n    ? signal.reason\n    : new DOMException(\"Webhook DNS lookup aborted\", \"AbortError\");\n}\n\nfunction createBlockedIpv4Addresses(): BlockList {\n  const blockList = new BlockList();\n  for (const [address, prefix] of [\n    [\"0.0.0.0\", 8],\n    [\"10.0.0.0\", 8],\n    [\"100.64.0.0\", 10],\n    [\"127.0.0.0\", 8],\n    [\"169.254.0.0\", 16],\n    [\"172.16.0.0\", 12],\n    [\"192.0.0.0\", 24],\n    [\"192.0.2.0\", 24],\n    [\"192.88.99.0\", 24],\n    [\"192.168.0.0\", 16],\n    [\"198.18.0.0\", 15],\n    [\"198.51.100.0\", 24],\n    [\"203.0.113.0\", 24],\n    [\"224.0.0.0\", 4],\n    [\"240.0.0.0\", 4],\n  ] as const) {\n    blockList.addSubnet(address, prefix, \"ipv4\");\n  }\n  return blockList;\n}\n\nfunction createBlockedIpv6Addresses(): BlockList {\n  const blockList = new BlockList();\n  for (const [address, prefix] of [\n    [\"::\", 96],\n    [\"::ffff:0:0\", 96],\n    [\"64:ff9b:1::\", 48],\n    [\"100::\", 64],\n    [\"100:0:0:1::\", 64],\n    [\"2001::\", 23],\n    [\"2001:db8::\", 32],\n    [\"2002::\", 16],\n    [\"3fff::\", 20],\n    [\"5f00::\", 16],\n    [\"fc00::\", 7],\n    [\"fe80::\", 10],\n    [\"ff00::\", 8],\n  ] as const) {\n    blockList.addSubnet(address, prefix, \"ipv6\");\n  }\n  return blockList;\n}\n\nfunction createGlobalIpv4Exceptions(): BlockList {\n  const blockList = new BlockList();\n  // These are globally reachable assignments inside 192.0.0.0/24.\n  for (const address of [\"192.0.0.9\", \"192.0.0.10\"] as const) {\n    blockList.addAddress(address, \"ipv4\");\n  }\n  return blockList;\n}\n\nfunction createGlobalIpv6Exceptions(): BlockList {\n  const blockList = new BlockList();\n  // These are globally reachable assignments inside 2001::/23.\n  for (const [address, prefix] of [\n    [\"2001:1::1\", 128],\n    [\"2001:1::2\", 128],\n    [\"2001:1::3\", 128],\n    [\"2001:3::\", 32],\n    [\"2001:4:112::\", 48],\n    [\"2001:20::\", 28],\n    [\"2001:30::\", 28],\n  ] as const) {\n    blockList.addSubnet(address, prefix, \"ipv6\");\n  }\n  return blockList;\n}\n\nfunction createAllocatedGlobalIpv6Ranges(): BlockList {\n  const blockList = new BlockList();\n  // IANA reserves unlisted portions of 2000::/3 for future allocation.\n  for (const [address, prefix] of [\n    [\"2001:200::\", 23],\n    [\"2001:400::\", 23],\n    [\"2001:600::\", 23],\n    [\"2001:800::\", 22],\n    [\"2001:c00::\", 23],\n    [\"2001:e00::\", 23],\n    [\"2001:1200::\", 23],\n    [\"2001:1400::\", 22],\n    [\"2001:1800::\", 23],\n    [\"2001:1a00::\", 23],\n    [\"2001:1c00::\", 22],\n    [\"2001:2000::\", 19],\n    [\"2001:4000::\", 23],\n    [\"2001:4200::\", 23],\n    [\"2001:4400::\", 23],\n    [\"2001:4600::\", 23],\n    [\"2001:4800::\", 23],\n    [\"2001:4a00::\", 23],\n    [\"2001:4c00::\", 23],\n    [\"2001:5000::\", 20],\n    [\"2001:8000::\", 19],\n    [\"2001:a000::\", 20],\n    [\"2001:b000::\", 20],\n    [\"2003::\", 18],\n    [\"2400::\", 12],\n    [\"2410::\", 12],\n    [\"2600::\", 12],\n    [\"2610::\", 23],\n    [\"2620::\", 23],\n    [\"2630::\", 12],\n    [\"2800::\", 12],\n    [\"2a00::\", 12],\n    [\"2a10::\", 12],\n    [\"2c00::\", 12],\n  ] as const) {\n    blockList.addSubnet(address, prefix, \"ipv6\");\n  }\n  blockList.addSubnet(\"64:ff9b::\", 96, \"ipv6\");\n  return blockList;\n}\n\nfunction normalizeHostname(hostname: string): string {\n  return hostname.replace(/^\\[(.*)\\]$/u, \"$1\").replace(/%25/gu, \"%\");\n}\n\nfunction parseIpv6Hextets(address: string): number[] | undefined {\n  const sections = address.split(\"::\");\n  if (sections.length > 2) {\n    return undefined;\n  }\n  const parseSection = (section: string): number[] =>\n    section\n      ? section.split(\":\").flatMap((value) => {\n          if (!value.includes(\".\")) {\n            return [Number.parseInt(value, 16)];\n          }\n          const octets = value.split(\".\").map(Number);\n          return [(octets[0]! << 8) | octets[1]!, (octets[2]! << 8) | octets[3]!];\n        })\n      : [];\n  const leading = parseSection(sections[0]!);\n  const trailing = parseSection(sections[1] ?? \"\");\n  const omitted = sections.length === 2 ? 8 - leading.length - trailing.length : 0;\n  const hextets = [...leading, ...Array.from({ length: omitted }, () => 0), ...trailing];\n  return hextets.length === 8 ? hextets : undefined;\n}\n\nfunction embeddedNat64Ipv4(address: string): string | undefined {\n  const hextets = parseIpv6Hextets(address);\n  if (\n    !hextets ||\n    hextets[0] !== 0x64 ||\n    hextets[1] !== 0xff9b ||\n    hextets.slice(2, 6).some((value) => value !== 0)\n  ) {\n    return undefined;\n  }\n  return [hextets[6]! >> 8, hextets[6]! & 0xff, hextets[7]! >> 8, hextets[7]! & 0xff].join(\".\");\n}\n\nfunction isBlockedWebhookAddress(address: string): boolean {\n  const normalized = normalizeHostname(address);\n  const family = isIP(normalized);\n  if (family === 4) {\n    return (\n      !GLOBAL_IPV4_EXCEPTIONS.check(normalized, \"ipv4\") &&\n      BLOCKED_IPV4_ADDRESSES.check(normalized, \"ipv4\")\n    );\n  }\n  if (family === 6) {\n    const embeddedIpv4 = embeddedNat64Ipv4(normalized);\n    if (embeddedIpv4 && isBlockedWebhookAddress(embeddedIpv4)) {\n      return true;\n    }\n    if (GLOBAL_IPV6_EXCEPTIONS.check(normalized, \"ipv6\")) {\n      return false;\n    }\n    return (\n      BLOCKED_IPV6_ADDRESSES.check(normalized, \"ipv6\") ||\n      !ALLOCATED_GLOBAL_IPV6_RANGES.check(normalized, \"ipv6\")\n    );\n  }\n  return false;\n}\n\nasync function resolveWebhookAddresses(\n  hostname: string,\n  signal?: AbortSignal,\n): Promise<WebhookAddress[]> {\n  const normalized = normalizeHostname(hostname);\n  const family = isIP(normalized);\n  if (family === 4 || family === 6) {\n    return [{ address: normalized, family }];\n  }\n  return (await webhookDnsLookupPool.resolve(normalized, signal)).flatMap((entry) =>\n    entry.family === 4 || entry.family === 6\n      ? [{ address: entry.address, family: entry.family }]\n      : [],\n  );\n}\n\nexport async function validateWebhookTarget(params: {\n  allowLoopbackHttp: boolean;\n  restrictPrivateAddresses: boolean;\n  signal?: AbortSignal | undefined;\n  url: URL;\n}): Promise<ValidatedWebhookTarget> {\n  const allowThisLoopbackHttp =\n    params.url.protocol === \"http:\" &&\n    params.allowLoopbackHttp &&\n    isLoopbackHost(params.url.hostname);\n  if (params.url.protocol !== \"https:\" && !allowThisLoopbackHttp) {\n    return { error: \"https-required\" };\n  }\n  if (allowThisLoopbackHttp) {\n    return { addresses: undefined };\n  }\n  if (!params.restrictPrivateAddresses) {\n    return { addresses: undefined };\n  }\n\n  let addresses: WebhookAddress[];\n  try {\n    addresses = await resolveWebhookAddresses(params.url.hostname, params.signal);\n  } catch (error) {\n    if (params.signal?.aborted) {\n      throw error;\n    }\n    return { error: \"unresolvable\" };\n  }\n  if (addresses.length === 0) {\n    return { error: \"unresolvable\" };\n  }\n  if (addresses.some((entry) => isBlockedWebhookAddress(entry.address))) {\n    return { error: \"private-address\" };\n  }\n  return { addresses };\n}\n\nexport async function postWebhookRequest(params: {\n  activeRequests?: Set<ClientRequest> | undefined;\n  address?: WebhookAddress | undefined;\n  body: string;\n  headerEntries?: ReadonlyArray<readonly [string, string]> | undefined;\n  signal?: AbortSignal | undefined;\n  timeoutMs: number;\n  url: URL;\n}): Promise<number> {\n  return await new Promise<number>((resolve, reject) => {\n    const address = params.address;\n    let settled = false;\n    let response: IncomingMessage | undefined;\n    let deadline: NodeJS.Timeout;\n    const finish = (callback: () => void) => {\n      if (settled) {\n        return;\n      }\n      settled = true;\n      clearTimeout(deadline);\n      params.activeRequests?.delete(request);\n      callback();\n    };\n    const send = params.url.protocol === \"https:\" ? requestHttps : requestHttp;\n    const request = send(\n      params.url,\n      {\n        agent: false,\n        ...(address ? { family: address.family } : {}),\n        headers: {\n          \"content-length\": String(Buffer.byteLength(params.body)),\n          \"content-type\": \"application/json\",\n          ...Object.fromEntries(params.headerEntries ?? []),\n        },\n        ...(address\n          ? {\n              lookup: (_hostname, _options, callback) =>\n                callback(null, address.address, address.family),\n            }\n          : {}),\n        method: \"POST\",\n        signal: params.signal,\n      },\n      (incoming) => {\n        response = incoming;\n        incoming.resume();\n        incoming.once(\"error\", (error) => finish(() => reject(error)));\n        incoming.once(\"end\", () => finish(() => resolve(incoming.statusCode ?? 0)));\n      },\n    );\n    params.activeRequests?.add(request);\n    deadline = setTimeout(() => {\n      const error = new DOMException(\n        `Webhook delivery timed out after ${params.timeoutMs}ms`,\n        \"TimeoutError\",\n      );\n      response?.destroy(error);\n      request.destroy(error);\n    }, params.timeoutMs);\n    deadline.unref();\n    request.once(\"error\", (error) => finish(() => reject(error)));\n    request.end(params.body);\n  });\n}\n"]}
+{"version":3,"file":"webhook-target.js","sourceRoot":"","sources":["../../../src/servers/webhook-target.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EACL,OAAO,IAAI,WAAW,GAIvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAkB3C,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC;AAEpD,MAAM,sBAAsB,GAAG,0BAA0B,EAAE,CAAC;AAC5D,MAAM,sBAAsB,GAAG,0BAA0B,EAAE,CAAC;AAC5D,MAAM,sBAAsB,GAAG,0BAA0B,EAAE,CAAC;AAC5D,MAAM,sBAAsB,GAAG,0BAA0B,EAAE,CAAC;AAC5D,MAAM,4BAA4B,GAAG,+BAA+B,EAAE,CAAC;AACvE,MAAM,sBAAsB,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAU,CAAC;AACjE,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC;AACnE,MAAM,iCAAiC,GAAG,IAAI,GAAG,CAAC;IAChD,YAAY;IACZ,gBAAgB;IAChB,QAAQ;IACR,MAAM;IACN,YAAY;IACZ,kBAAkB;IAClB,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;CACV,CAAC,CAAC;AAwBH,MAAM,OAAO,oBAAoB;IAOZ,aAAa;IACb,cAAc;IAEd,uBAAuB;IATjC,QAAQ,GAA8B,EAAE,CAAC;IACzC,YAAY,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC3D,OAAO,GAAG,CAAC,CAAC;IACZ,SAAS,GAAG,CAAC,CAAC;IAEd,YACmB,aAAqB,EACrB,cAAc,GAAqB,KAAK,EAAE,QAAQ,EAAE,EAAE,CACrE,MAAM,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EACtC,uBAAuB,GAAG,KAAK;6BAH/B,aAAa;8BACb,cAAc;uCAEd,uBAAuB;QAExC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,uBAAuB,CAAC,IAAI,uBAAuB,GAAG,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED,OAAO,CAAC,QAAgB,EAAE,MAAoB;QAC5C,OAAO,IAAI,OAAO,CAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7D,MAAM,OAAO,GAA4B;gBACvC,QAAQ,EAAE,KAAK;gBACf,QAAQ;gBACR,OAAO,EAAE,GAAG,EAAE;oBACZ,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;wBACpB,OAAO;oBACT,CAAC;oBACD,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;oBACvB,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;wBACrB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;wBAC7C,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;4BACf,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;wBACjC,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;oBAClC,CAAC;oBACD,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;oBACtD,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;oBACjC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACf,CAAC;gBACD,MAAM;gBACN,aAAa,EAAE,KAAK;gBACpB,aAAa,EAAE,SAAS;gBACxB,OAAO;gBACP,OAAO,EAAE,KAAK;gBACd,MAAM;gBACN,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,KAAK;aACf,CAAC;YACF,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpB,OAAO,CAAC,OAAO,EAAE,CAAC;gBAClB,OAAO;YACT,CAAC;YACD,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACnE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACtC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YACD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpB,SAAS;YACX,CAAC;YACD,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;YACvB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;YACxB,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;YAClB,IAAI,aAA8C,CAAC;YACnD,IAAI,CAAC;gBACH,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACxD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACxC,CAAC;YACD,KAAK,aAAa;iBACf,IAAI,CACH,CAAC,SAAS,EAAE,EAAE;gBACZ,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;oBACrB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;oBACvB,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;gBACjB,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;oBACrB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;oBACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACxB,CAAC;YACH,CAAC,CACF;iBACA,OAAO,CAAC,GAAG,EAAE;gBACZ,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;oBAC1B,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;oBACpC,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;gBACpC,CAAC;gBACD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAClC,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;gBAC9D,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;oBACrB,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC;oBACzB,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC;oBACpB,IAAI,CAAC,aAAa,EAAE,CAAC;oBACrB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACf,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC,CAAC,CAAC;QACP,CAAC;IACH,CAAC;IAED,iBAAiB,CAAC,OAAgC;QAChD,IAAI,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACnE,OAAO;QACT,CAAC;QACD,OAAO,CAAC,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;YACtC,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;YAClC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtB,OAAO;YACT,CAAC;YACD,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;YAC7B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC/B,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,CAAC,EAAE,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACjC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;IAChC,CAAC;IAED,aAAa;QACX,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACxC,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;gBACzC,OAAO;YACT,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAChD,SAAS;YACX,CAAC;YACD,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;YACxB,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC;YACpB,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,YAAY,CAAC,OAAgC;QAC3C,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;CACF;AAED,MAAM,oBAAoB,GAAG,IAAI,oBAAoB,CAAC,kCAAkC,CAAC,CAAC;AAE1F,SAAS,gBAAgB,CAAC,MAA+B;IACvD,OAAO,MAAM,EAAE,MAAM,YAAY,KAAK;QACpC,CAAC,CAAC,MAAM,CAAC,MAAM;QACf,CAAC,CAAC,IAAI,YAAY,CAAC,4BAA4B,EAAE,YAAY,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,0BAA0B;IACjC,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI;QAC9B,CAAC,SAAS,EAAE,CAAC,CAAC;QACd,CAAC,UAAU,EAAE,CAAC,CAAC;QACf,CAAC,YAAY,EAAE,EAAE,CAAC;QAClB,CAAC,WAAW,EAAE,CAAC,CAAC;QAChB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,YAAY,EAAE,EAAE,CAAC;QAClB,CAAC,WAAW,EAAE,EAAE,CAAC;QACjB,CAAC,WAAW,EAAE,EAAE,CAAC;QACjB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,YAAY,EAAE,EAAE,CAAC;QAClB,CAAC,cAAc,EAAE,EAAE,CAAC;QACpB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,WAAW,EAAE,CAAC,CAAC;QAChB,CAAC,WAAW,EAAE,CAAC,CAAC;KACR,EAAE,CAAC;QACX,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,0BAA0B;IACjC,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI;QAC9B,CAAC,IAAI,EAAE,EAAE,CAAC;QACV,CAAC,YAAY,EAAE,EAAE,CAAC;QAClB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,OAAO,EAAE,EAAE,CAAC;QACb,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,QAAQ,EAAE,EAAE,CAAC;QACd,CAAC,YAAY,EAAE,EAAE,CAAC;QAClB,CAAC,QAAQ,EAAE,EAAE,CAAC;QACd,CAAC,QAAQ,EAAE,EAAE,CAAC;QACd,CAAC,QAAQ,EAAE,EAAE,CAAC;QACd,CAAC,QAAQ,EAAE,CAAC,CAAC;QACb,CAAC,QAAQ,EAAE,EAAE,CAAC;QACd,CAAC,QAAQ,EAAE,CAAC,CAAC;KACL,EAAE,CAAC;QACX,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,0BAA0B;IACjC,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;IAClC,gEAAgE;IAChE,KAAK,MAAM,OAAO,IAAI,CAAC,WAAW,EAAE,YAAY,CAAU,EAAE,CAAC;QAC3D,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,0BAA0B;IACjC,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;IAClC,6DAA6D;IAC7D,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI;QAC9B,CAAC,WAAW,EAAE,GAAG,CAAC;QAClB,CAAC,WAAW,EAAE,GAAG,CAAC;QAClB,CAAC,WAAW,EAAE,GAAG,CAAC;QAClB,CAAC,UAAU,EAAE,EAAE,CAAC;QAChB,CAAC,cAAc,EAAE,EAAE,CAAC;QACpB,CAAC,WAAW,EAAE,EAAE,CAAC;QACjB,CAAC,WAAW,EAAE,EAAE,CAAC;KACT,EAAE,CAAC;QACX,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,+BAA+B;IACtC,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;IAClC,qEAAqE;IACrE,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI;QAC9B,CAAC,YAAY,EAAE,EAAE,CAAC;QAClB,CAAC,YAAY,EAAE,EAAE,CAAC;QAClB,CAAC,YAAY,EAAE,EAAE,CAAC;QAClB,CAAC,YAAY,EAAE,EAAE,CAAC;QAClB,CAAC,YAAY,EAAE,EAAE,CAAC;QAClB,CAAC,YAAY,EAAE,EAAE,CAAC;QAClB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,QAAQ,EAAE,EAAE,CAAC;QACd,CAAC,QAAQ,EAAE,EAAE,CAAC;QACd,CAAC,QAAQ,EAAE,EAAE,CAAC;QACd,CAAC,QAAQ,EAAE,EAAE,CAAC;QACd,CAAC,QAAQ,EAAE,EAAE,CAAC;QACd,CAAC,QAAQ,EAAE,EAAE,CAAC;QACd,CAAC,QAAQ,EAAE,EAAE,CAAC;QACd,CAAC,QAAQ,EAAE,EAAE,CAAC;QACd,CAAC,QAAQ,EAAE,EAAE,CAAC;QACd,CAAC,QAAQ,EAAE,EAAE,CAAC;QACd,CAAC,QAAQ,EAAE,EAAE,CAAC;KACN,EAAE,CAAC;QACX,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IACD,SAAS,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IACzC,OAAO,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,YAAY,GAAG,CAAC,OAAe,EAAY,EAAE,CACjD,OAAO;QACL,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;YACnC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YACtC,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5C,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;QAC1E,CAAC,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC;IACvF,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAwB,EAAE,YAA+B;IACnF,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,WAAW,GAAG,YAAY,GAAG,CAAC,CAAC;IACrC,MAAM,gBAAgB,GAAG,CAAC,GAAG,WAAW,CAAC;IACzC,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnG,CAAC;AAED,SAAS,aAAa,CAAC,KAAwB,EAAE,MAAmB;IAClE,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,cAAc,CAAC,MAAmB;IACzC,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAClF,CAAC;AAED,SAAS,qBAAqB,CAAC,SAAiC;IAC9D,MAAM,UAAU,GAAG,IAAI,GAAG,EAA2D,CAAC;IACtF,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,SAAS;QACX,CAAC;QACD,WAAW,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,SAAS,CAAC,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,SAAS;QACX,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,sBAAsB,EAAE,CAAC;YAC5C,IAAI,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpC,SAAS;YACX,CAAC;YACD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC/D,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC;YAC1E,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;YAC3D,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IACD,IAAI,WAAW,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;SACtC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CACpB,CAAC,GAAG,kBAAkB,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAC7E;SACA,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED,MAAM,uBAAuB,GAAgB;IAC3C,KAAK,EAAE,SAAS,CAAC,WAAW,CAAE;IAC9B,MAAM,EAAE,EAAE;CACX,CAAC;AAEF,SAAS,0BAA0B,CACjC,OAAe,EACf,aAAqC;IAErC,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,CAAC,uBAAuB,EAAE,GAAG,aAAa,CAAC,EAAE,CAAC;QACjE,IAAI,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YACjC,SAAS,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,uBAAuB,CAC9B,OAAe,EACf,aAAa,GAA2B,EAAE;IAE1C,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAChC,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,OAAO,CACL,CAAC,sBAAsB,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC;YACjD,sBAAsB,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CACjD,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,IACE,0BAA0B,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAC1E,uBAAuB,CAAC,YAAY,CAAC,CACtC,EACD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,sBAAsB,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;YACrD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,CACL,sBAAsB,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC;YAChD,CAAC,4BAA4B,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CACxD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,QAAgB,EAChB,MAAoB,EACpB,aAAa,GAA0C,oBAAoB;IAE3E,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAChC,IAAI,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACzE,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QACtC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QACpD,CAAC,CAAC,EAAE,CACP,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAM3C;IACC,MAAM,qBAAqB,GACzB,MAAM,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO;QAC/B,MAAM,CAAC,iBAAiB;QACxB,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC/D,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;IACrC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,wBAAwB,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC/D,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,SAA2B,CAAC;IAChC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,uBAAuB,CACvC,MAAM,CAAC,GAAG,CAAC,QAAQ,EACnB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,aAAa,CACrB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC3B,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,qBAAqB,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC9D,CAAC,CAAC,EAAE,SAAS,EAAE;YACf,CAAC,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACtE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACtC,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAClD,IAAI,aAAwC,CAAC;QAC7C,IAAI,CAAC;YACH,aAAa,GAAG,qBAAqB,CACnC,MAAM,CAAC,MAAM,CAAC,aAAa,IAAI,oBAAoB,CAAC,CAAC,OAAO,CAC1D,eAAe,EACf,MAAM,CAAC,MAAM,CACd,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBAC3B,MAAM,KAAK,CAAC;YACd,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;QACtC,CAAC;QACD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;QACtC,CAAC;QACD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC;YACrF,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,CAAC;AACvB,CAAC;AAYD,SAAS,qBAAqB,CAC5B,IAAY,EACZ,aAAwD;IAExD,MAAM,OAAO,GAA2B;QACtC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACjD,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,aAAa,IAAI,EAAE,EAAE,CAAC;QAChD,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,iCAAiC,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,gCAAgC,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,CAAC,cAAc,CAAC,GAAG,KAAK,CAAC;IAClC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,MAAgC,EAChC,gBAAyB;IAEzB,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IACzE,OAAO,MAAM,IAAI,OAAO,CAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,QAAqC,CAAC;QAC1C,IAAI,QAAwB,CAAC;QAC7B,MAAM,MAAM,GAAG,CAAC,QAAoB,EAAE,EAAE;YACtC,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,QAAQ,CAAC,CAAC;YACvB,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YACvC,QAAQ,EAAE,CAAC;QACb,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;QAC3E,MAAM,OAAO,GAAG,IAAI,CAClB,MAAM,CAAC,GAAG,EACV;YACE,KAAK,EAAE,KAAK;YACZ,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,OAAO;YACP,GAAG,CAAC,OAAO;gBACT,CAAC,CAAC;oBACE,MAAM,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CACxC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC;iBAClD;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,EACD,CAAC,QAAQ,EAAE,EAAE;YACX,QAAQ,GAAG,QAAQ,CAAC;YACpB,MAAM,MAAM,GAAG;gBACb,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,MAAM,EAAE,QAAQ,CAAC,UAAU,IAAI,CAAC;aACjC,CAAC;YACF,IAAI,gBAAgB,EAAE,CAAC;gBACrB,MAAM,CAAC,GAAG,EAAE;oBACV,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACnB,OAAO,CAAC,MAAM,CAAC,CAAC;gBAClB,CAAC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,MAAM,EAAE,CAAC;YAClB,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC/D,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5D,CAAC,CACF,CAAC;QACF,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACpC,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE;YACzB,MAAM,KAAK,GAAG,IAAI,YAAY,CAC5B,oCAAoC,MAAM,CAAC,SAAS,IAAI,EACxD,cAAc,CACf,CAAC;YACF,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACzB,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACrB,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,MAAgC;IAEhC,OAAO,MAAM,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAgC;IACvE,OAAO,CAAC,MAAM,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;AAC1D,CAAC","sourcesContent":["import { lookup } from \"node:dns/promises\";\nimport {\n  request as requestHttp,\n  type ClientRequest,\n  type IncomingHttpHeaders,\n  type IncomingMessage,\n} from \"node:http\";\nimport { request as requestHttps } from \"node:https\";\nimport { BlockList, isIP } from \"node:net\";\nimport { isLoopbackHost } from \"./http.js\";\n\nexport type WebhookAddress = {\n  address: string;\n  family: 4 | 6;\n};\n\nexport type WebhookTargetError = \"https-required\" | \"private-address\" | \"unresolvable\";\n\nexport type ValidatedWebhookTarget =\n  | { addresses: WebhookAddress[] | undefined }\n  | { error: WebhookTargetError };\n\nexport type WebhookResponse = {\n  headers: IncomingHttpHeaders;\n  status: number;\n};\n\nexport const MAX_CONCURRENT_WEBHOOK_DNS_LOOKUPS = 8;\n\nconst BLOCKED_IPV4_ADDRESSES = createBlockedIpv4Addresses();\nconst BLOCKED_IPV6_ADDRESSES = createBlockedIpv6Addresses();\nconst GLOBAL_IPV4_EXCEPTIONS = createGlobalIpv4Exceptions();\nconst GLOBAL_IPV6_EXCEPTIONS = createGlobalIpv6Exceptions();\nconst ALLOCATED_GLOBAL_IPV6_RANGES = createAllocatedGlobalIpv6Ranges();\nconst RFC6052_PREFIX_LENGTHS = [32, 40, 48, 56, 64, 96] as const;\nconst IPV4ONLY_ADDRESSES = new Set([\"192.0.0.170\", \"192.0.0.171\"]);\nconst SENDER_CONTROLLED_WEBHOOK_HEADERS = new Set([\n  \"connection\",\n  \"content-length\",\n  \"expect\",\n  \"host\",\n  \"keep-alive\",\n  \"proxy-connection\",\n  \"te\",\n  \"trailer\",\n  \"transfer-encoding\",\n  \"upgrade\",\n]);\n\ntype WebhookDnsLookupResult = ReadonlyArray<{ address: string; family: number }>;\ntype WebhookDnsLookup = (hostname: string) => Promise<WebhookDnsLookupResult>;\ntype Nat64PrefixLength = (typeof RFC6052_PREFIX_LENGTHS)[number];\ntype Nat64Prefix = {\n  bytes: readonly number[];\n  length: Nat64PrefixLength;\n};\n\ntype PendingWebhookDnsLookup = {\n  detached: boolean;\n  hostname: string;\n  onAbort: () => void;\n  recoveryReady: boolean;\n  recoveryTimer: NodeJS.Timeout | undefined;\n  reject(error: unknown): void;\n  resolve(addresses: WebhookDnsLookupResult): void;\n  settled: boolean;\n  signal: AbortSignal | undefined;\n  slotHeld: boolean;\n  started: boolean;\n};\n\nexport class WebhookDnsLookupPool {\n  readonly #pending: PendingWebhookDnsLookup[] = [];\n  readonly #recoverable = new Set<PendingWebhookDnsLookup>();\n  #active = 0;\n  #detached = 0;\n\n  constructor(\n    private readonly maxConcurrent: number,\n    private readonly lookupHostname: WebhookDnsLookup = async (hostname) =>\n      await lookup(hostname, { all: true, verbatim: true }),\n    private readonly abortedLookupRecoveryMs = 5_000,\n  ) {\n    if (!Number.isSafeInteger(maxConcurrent) || maxConcurrent < 1) {\n      throw new Error(\"Webhook DNS lookup concurrency must be a positive safe integer.\");\n    }\n    if (!Number.isSafeInteger(abortedLookupRecoveryMs) || abortedLookupRecoveryMs < 1) {\n      throw new Error(\"Webhook DNS lookup recovery must be a positive safe integer.\");\n    }\n  }\n\n  resolve(hostname: string, signal?: AbortSignal): Promise<WebhookDnsLookupResult> {\n    return new Promise<WebhookDnsLookupResult>((resolve, reject) => {\n      const pending: PendingWebhookDnsLookup = {\n        detached: false,\n        hostname,\n        onAbort: () => {\n          if (pending.settled) {\n            return;\n          }\n          pending.settled = true;\n          if (!pending.started) {\n            const index = this.#pending.indexOf(pending);\n            if (index >= 0) {\n              this.#pending.splice(index, 1);\n            }\n          } else {\n            this.#scheduleRecovery(pending);\n          }\n          signal?.removeEventListener(\"abort\", pending.onAbort);\n          reject(abortSignalError(signal));\n          this.#pump();\n        },\n        reject,\n        recoveryReady: false,\n        recoveryTimer: undefined,\n        resolve,\n        settled: false,\n        signal,\n        slotHeld: false,\n        started: false,\n      };\n      if (signal?.aborted) {\n        pending.onAbort();\n        return;\n      }\n      signal?.addEventListener(\"abort\", pending.onAbort, { once: true });\n      this.#pending.push(pending);\n      this.#pump();\n    });\n  }\n\n  #pump(): void {\n    while (this.#active < this.maxConcurrent) {\n      const pending = this.#pending.shift();\n      if (!pending) {\n        return;\n      }\n      if (pending.settled) {\n        continue;\n      }\n      pending.started = true;\n      pending.slotHeld = true;\n      this.#active += 1;\n      let lookupPromise: Promise<WebhookDnsLookupResult>;\n      try {\n        lookupPromise = this.lookupHostname(pending.hostname);\n      } catch (error) {\n        lookupPromise = Promise.reject(error);\n      }\n      void lookupPromise\n        .then(\n          (addresses) => {\n            if (!pending.settled) {\n              pending.settled = true;\n              pending.resolve(addresses);\n            }\n          },\n          (error: unknown) => {\n            if (!pending.settled) {\n              pending.settled = true;\n              pending.reject(error);\n            }\n          },\n        )\n        .finally(() => {\n          if (pending.recoveryTimer) {\n            clearTimeout(pending.recoveryTimer);\n            pending.recoveryTimer = undefined;\n          }\n          this.#recoverable.delete(pending);\n          pending.signal?.removeEventListener(\"abort\", pending.onAbort);\n          if (pending.detached) {\n            pending.detached = false;\n            this.#detached -= 1;\n            this.#recoverSlots();\n            this.#pump();\n          } else {\n            this.#releaseSlot(pending);\n          }\n        });\n    }\n  }\n\n  #scheduleRecovery(pending: PendingWebhookDnsLookup): void {\n    if (pending.recoveryTimer || pending.detached || !pending.slotHeld) {\n      return;\n    }\n    pending.recoveryTimer = setTimeout(() => {\n      pending.recoveryTimer = undefined;\n      if (!pending.slotHeld) {\n        return;\n      }\n      pending.recoveryReady = true;\n      this.#recoverable.add(pending);\n      this.#recoverSlots();\n    }, this.abortedLookupRecoveryMs);\n    pending.recoveryTimer.unref();\n  }\n\n  #recoverSlots(): void {\n    for (const pending of this.#recoverable) {\n      if (this.#detached >= this.maxConcurrent) {\n        return;\n      }\n      this.#recoverable.delete(pending);\n      if (!pending.recoveryReady || !pending.slotHeld) {\n        continue;\n      }\n      pending.detached = true;\n      this.#detached += 1;\n      this.#releaseSlot(pending);\n    }\n  }\n\n  #releaseSlot(pending: PendingWebhookDnsLookup): void {\n    if (!pending.slotHeld) {\n      return;\n    }\n    pending.slotHeld = false;\n    this.#active -= 1;\n    this.#pump();\n  }\n}\n\nconst webhookDnsLookupPool = new WebhookDnsLookupPool(MAX_CONCURRENT_WEBHOOK_DNS_LOOKUPS);\n\nfunction abortSignalError(signal: AbortSignal | undefined): Error {\n  return signal?.reason instanceof Error\n    ? signal.reason\n    : new DOMException(\"Webhook DNS lookup aborted\", \"AbortError\");\n}\n\nfunction createBlockedIpv4Addresses(): BlockList {\n  const blockList = new BlockList();\n  for (const [address, prefix] of [\n    [\"0.0.0.0\", 8],\n    [\"10.0.0.0\", 8],\n    [\"100.64.0.0\", 10],\n    [\"127.0.0.0\", 8],\n    [\"169.254.0.0\", 16],\n    [\"172.16.0.0\", 12],\n    [\"192.0.0.0\", 24],\n    [\"192.0.2.0\", 24],\n    [\"192.88.99.0\", 24],\n    [\"192.168.0.0\", 16],\n    [\"198.18.0.0\", 15],\n    [\"198.51.100.0\", 24],\n    [\"203.0.113.0\", 24],\n    [\"224.0.0.0\", 4],\n    [\"240.0.0.0\", 4],\n  ] as const) {\n    blockList.addSubnet(address, prefix, \"ipv4\");\n  }\n  return blockList;\n}\n\nfunction createBlockedIpv6Addresses(): BlockList {\n  const blockList = new BlockList();\n  for (const [address, prefix] of [\n    [\"::\", 96],\n    [\"::ffff:0:0\", 96],\n    [\"64:ff9b:1::\", 48],\n    [\"100::\", 64],\n    [\"100:0:0:1::\", 64],\n    [\"2001::\", 23],\n    [\"2001:db8::\", 32],\n    [\"2002::\", 16],\n    [\"3fff::\", 20],\n    [\"5f00::\", 16],\n    [\"fc00::\", 7],\n    [\"fe80::\", 10],\n    [\"ff00::\", 8],\n  ] as const) {\n    blockList.addSubnet(address, prefix, \"ipv6\");\n  }\n  return blockList;\n}\n\nfunction createGlobalIpv4Exceptions(): BlockList {\n  const blockList = new BlockList();\n  // These are globally reachable assignments inside 192.0.0.0/24.\n  for (const address of [\"192.0.0.9\", \"192.0.0.10\"] as const) {\n    blockList.addAddress(address, \"ipv4\");\n  }\n  return blockList;\n}\n\nfunction createGlobalIpv6Exceptions(): BlockList {\n  const blockList = new BlockList();\n  // These are globally reachable assignments inside 2001::/23.\n  for (const [address, prefix] of [\n    [\"2001:1::1\", 128],\n    [\"2001:1::2\", 128],\n    [\"2001:1::3\", 128],\n    [\"2001:3::\", 32],\n    [\"2001:4:112::\", 48],\n    [\"2001:20::\", 28],\n    [\"2001:30::\", 28],\n  ] as const) {\n    blockList.addSubnet(address, prefix, \"ipv6\");\n  }\n  return blockList;\n}\n\nfunction createAllocatedGlobalIpv6Ranges(): BlockList {\n  const blockList = new BlockList();\n  // IANA reserves unlisted portions of 2000::/3 for future allocation.\n  for (const [address, prefix] of [\n    [\"2001:200::\", 23],\n    [\"2001:400::\", 23],\n    [\"2001:600::\", 23],\n    [\"2001:800::\", 22],\n    [\"2001:c00::\", 23],\n    [\"2001:e00::\", 23],\n    [\"2001:1200::\", 23],\n    [\"2001:1400::\", 22],\n    [\"2001:1800::\", 23],\n    [\"2001:1a00::\", 23],\n    [\"2001:1c00::\", 22],\n    [\"2001:2000::\", 19],\n    [\"2001:4000::\", 23],\n    [\"2001:4200::\", 23],\n    [\"2001:4400::\", 23],\n    [\"2001:4600::\", 23],\n    [\"2001:4800::\", 23],\n    [\"2001:4a00::\", 23],\n    [\"2001:4c00::\", 23],\n    [\"2001:5000::\", 20],\n    [\"2001:8000::\", 19],\n    [\"2001:a000::\", 20],\n    [\"2001:b000::\", 20],\n    [\"2003::\", 18],\n    [\"2400::\", 12],\n    [\"2410::\", 12],\n    [\"2600::\", 12],\n    [\"2610::\", 23],\n    [\"2620::\", 23],\n    [\"2630::\", 12],\n    [\"2800::\", 12],\n    [\"2a00::\", 12],\n    [\"2a10::\", 12],\n    [\"2c00::\", 12],\n  ] as const) {\n    blockList.addSubnet(address, prefix, \"ipv6\");\n  }\n  blockList.addSubnet(\"64:ff9b::\", 96, \"ipv6\");\n  return blockList;\n}\n\nfunction normalizeHostname(hostname: string): string {\n  return hostname.replace(/^\\[(.*)\\]$/u, \"$1\").replace(/%25/gu, \"%\");\n}\n\nfunction parseIpv6Hextets(address: string): number[] | undefined {\n  const sections = address.split(\"::\");\n  if (sections.length > 2) {\n    return undefined;\n  }\n  const parseSection = (section: string): number[] =>\n    section\n      ? section.split(\":\").flatMap((value) => {\n          if (!value.includes(\".\")) {\n            return [Number.parseInt(value, 16)];\n          }\n          const octets = value.split(\".\").map(Number);\n          return [(octets[0]! << 8) | octets[1]!, (octets[2]! << 8) | octets[3]!];\n        })\n      : [];\n  const leading = parseSection(sections[0]!);\n  const trailing = parseSection(sections[1] ?? \"\");\n  const omitted = sections.length === 2 ? 8 - leading.length - trailing.length : 0;\n  const hextets = [...leading, ...Array.from({ length: omitted }, () => 0), ...trailing];\n  return hextets.length === 8 ? hextets : undefined;\n}\n\nfunction ipv6Bytes(address: string): number[] | undefined {\n  if (isIP(address) !== 6) {\n    return undefined;\n  }\n  const hextets = parseIpv6Hextets(address);\n  if (!hextets) {\n    return undefined;\n  }\n  return hextets.flatMap((value) => [value >> 8, value & 0xff]);\n}\n\nfunction extractRfc6052Ipv4(bytes: readonly number[], prefixLength: Nat64PrefixLength): string {\n  if (prefixLength === 96) {\n    return bytes.slice(12, 16).join(\".\");\n  }\n  const prefixBytes = prefixLength / 8;\n  const leadingIpv4Bytes = 8 - prefixBytes;\n  return [...bytes.slice(prefixBytes, 8), ...bytes.slice(9, 9 + (4 - leadingIpv4Bytes))].join(\".\");\n}\n\nfunction prefixMatches(bytes: readonly number[], prefix: Nat64Prefix): boolean {\n  const prefixBytes = prefix.length / 8;\n  return prefix.bytes.slice(0, prefixBytes).every((value, index) => bytes[index] === value);\n}\n\nfunction nat64PrefixKey(prefix: Nat64Prefix): string {\n  return `${prefix.length}:${prefix.bytes.slice(0, prefix.length / 8).join(\".\")}`;\n}\n\nfunction discoverNat64Prefixes(addresses: WebhookDnsLookupResult): Nat64Prefix[] | undefined {\n  const candidates = new Map<string, { addresses: Set<string>; prefix: Nat64Prefix }>();\n  let ipv6Answers = 0;\n  for (const entry of addresses) {\n    if (entry.family !== 6) {\n      continue;\n    }\n    ipv6Answers++;\n    const bytes = ipv6Bytes(normalizeHostname(entry.address));\n    if (!bytes) {\n      continue;\n    }\n    for (const length of RFC6052_PREFIX_LENGTHS) {\n      if (length !== 96 && bytes[8] !== 0) {\n        continue;\n      }\n      if (!IPV4ONLY_ADDRESSES.has(extractRfc6052Ipv4(bytes, length))) {\n        continue;\n      }\n      const prefix = { bytes, length };\n      const key = nat64PrefixKey(prefix);\n      const candidate = candidates.get(key) ?? { addresses: new Set(), prefix };\n      candidate.addresses.add(extractRfc6052Ipv4(bytes, length));\n      candidates.set(key, candidate);\n    }\n  }\n  if (ipv6Answers === 0) {\n    return [];\n  }\n  const prefixes = [...candidates.values()]\n    .filter((candidate) =>\n      [...IPV4ONLY_ADDRESSES].every((address) => candidate.addresses.has(address)),\n    )\n    .map((candidate) => candidate.prefix);\n  return prefixes.length > 0 ? prefixes : undefined;\n}\n\nconst WELL_KNOWN_NAT64_PREFIX: Nat64Prefix = {\n  bytes: ipv6Bytes(\"64:ff9b::\")!,\n  length: 96,\n};\n\nfunction embeddedNat64Ipv4Addresses(\n  address: string,\n  nat64Prefixes: readonly Nat64Prefix[],\n): string[] {\n  const bytes = ipv6Bytes(address);\n  if (!bytes) {\n    return [];\n  }\n  const addresses: string[] = [];\n  for (const prefix of [WELL_KNOWN_NAT64_PREFIX, ...nat64Prefixes]) {\n    if (prefixMatches(bytes, prefix)) {\n      addresses.push(extractRfc6052Ipv4(bytes, prefix.length));\n    }\n  }\n  return addresses;\n}\n\nfunction isBlockedWebhookAddress(\n  address: string,\n  nat64Prefixes: readonly Nat64Prefix[] = [],\n): boolean {\n  const normalized = normalizeHostname(address);\n  const family = isIP(normalized);\n  if (family === 4) {\n    return (\n      !GLOBAL_IPV4_EXCEPTIONS.check(normalized, \"ipv4\") &&\n      BLOCKED_IPV4_ADDRESSES.check(normalized, \"ipv4\")\n    );\n  }\n  if (family === 6) {\n    if (\n      embeddedNat64Ipv4Addresses(normalized, nat64Prefixes).some((embeddedIpv4) =>\n        isBlockedWebhookAddress(embeddedIpv4),\n      )\n    ) {\n      return true;\n    }\n    if (GLOBAL_IPV6_EXCEPTIONS.check(normalized, \"ipv6\")) {\n      return false;\n    }\n    return (\n      BLOCKED_IPV6_ADDRESSES.check(normalized, \"ipv6\") ||\n      !ALLOCATED_GLOBAL_IPV6_RANGES.check(normalized, \"ipv6\")\n    );\n  }\n  return false;\n}\n\nasync function resolveWebhookAddresses(\n  hostname: string,\n  signal?: AbortSignal,\n  dnsLookupPool: Pick<WebhookDnsLookupPool, \"resolve\"> = webhookDnsLookupPool,\n): Promise<WebhookAddress[]> {\n  const normalized = normalizeHostname(hostname);\n  const family = isIP(normalized);\n  if (family === 4 || family === 6) {\n    return [{ address: normalized, family }];\n  }\n  return (await dnsLookupPool.resolve(normalized, signal)).flatMap((entry) =>\n    entry.family === 4 || entry.family === 6\n      ? [{ address: entry.address, family: entry.family }]\n      : [],\n  );\n}\n\nexport async function validateWebhookTarget(params: {\n  allowLoopbackHttp: boolean;\n  dnsLookupPool?: Pick<WebhookDnsLookupPool, \"resolve\"> | undefined;\n  restrictPrivateAddresses: boolean;\n  signal?: AbortSignal | undefined;\n  url: URL;\n}): Promise<ValidatedWebhookTarget> {\n  const allowThisLoopbackHttp =\n    params.url.protocol === \"http:\" &&\n    params.allowLoopbackHttp &&\n    isLoopbackHost(params.url.hostname);\n  if (params.url.protocol !== \"https:\" && !allowThisLoopbackHttp) {\n    return { error: \"https-required\" };\n  }\n  if (!params.restrictPrivateAddresses && !allowThisLoopbackHttp) {\n    return { addresses: undefined };\n  }\n\n  let addresses: WebhookAddress[];\n  try {\n    addresses = await resolveWebhookAddresses(\n      params.url.hostname,\n      params.signal,\n      params.dnsLookupPool,\n    );\n  } catch (error) {\n    if (params.signal?.aborted) {\n      throw error;\n    }\n    return { error: \"unresolvable\" };\n  }\n  if (addresses.length === 0) {\n    return { error: \"unresolvable\" };\n  }\n  if (allowThisLoopbackHttp) {\n    return addresses.every((entry) => isLoopbackHost(entry.address))\n      ? { addresses }\n      : { error: \"private-address\" };\n  }\n  if (addresses.some((entry) => isBlockedWebhookAddress(entry.address))) {\n    return { error: \"private-address\" };\n  }\n  if (addresses.some((entry) => entry.family === 6)) {\n    let nat64Prefixes: Nat64Prefix[] | undefined;\n    try {\n      nat64Prefixes = discoverNat64Prefixes(\n        await (params.dnsLookupPool ?? webhookDnsLookupPool).resolve(\n          \"ipv4only.arpa\",\n          params.signal,\n        ),\n      );\n    } catch (error) {\n      if (params.signal?.aborted) {\n        throw error;\n      }\n      return { error: \"private-address\" };\n    }\n    if (!nat64Prefixes) {\n      return { error: \"private-address\" };\n    }\n    if (addresses.some((entry) => isBlockedWebhookAddress(entry.address, nat64Prefixes))) {\n      return { error: \"private-address\" };\n    }\n  }\n  return { addresses };\n}\n\ntype PostWebhookRequestParams = {\n  activeRequests?: Set<ClientRequest> | undefined;\n  address?: WebhookAddress | undefined;\n  body: string;\n  headerEntries?: ReadonlyArray<readonly [string, string]> | undefined;\n  signal?: AbortSignal | undefined;\n  timeoutMs: number;\n  url: URL;\n};\n\nfunction webhookRequestHeaders(\n  body: string,\n  headerEntries: PostWebhookRequestParams[\"headerEntries\"],\n): Record<string, string> {\n  const headers: Record<string, string> = {\n    \"content-length\": String(Buffer.byteLength(body)),\n    \"content-type\": \"application/json\",\n  };\n  for (const [name, value] of headerEntries ?? []) {\n    const normalizedName = name.toLowerCase();\n    if (SENDER_CONTROLLED_WEBHOOK_HEADERS.has(normalizedName)) {\n      throw new Error(`Webhook header \"${name}\" is controlled by the sender.`);\n    }\n    headers[normalizedName] = value;\n  }\n  return headers;\n}\n\nasync function sendWebhookRequest(\n  params: PostWebhookRequestParams,\n  resolveOnHeaders: boolean,\n): Promise<WebhookResponse> {\n  const headers = webhookRequestHeaders(params.body, params.headerEntries);\n  return await new Promise<WebhookResponse>((resolve, reject) => {\n    const address = params.address;\n    let settled = false;\n    let response: IncomingMessage | undefined;\n    let deadline: NodeJS.Timeout;\n    const finish = (callback: () => void) => {\n      if (settled) {\n        return;\n      }\n      settled = true;\n      clearTimeout(deadline);\n      params.activeRequests?.delete(request);\n      callback();\n    };\n    const send = params.url.protocol === \"https:\" ? requestHttps : requestHttp;\n    const request = send(\n      params.url,\n      {\n        agent: false,\n        ...(address ? { family: address.family } : {}),\n        headers,\n        ...(address\n          ? {\n              lookup: (_hostname, _options, callback) =>\n                callback(null, address.address, address.family),\n            }\n          : {}),\n        method: \"POST\",\n        signal: params.signal,\n      },\n      (incoming) => {\n        response = incoming;\n        const result = {\n          headers: incoming.headers,\n          status: incoming.statusCode ?? 0,\n        };\n        if (resolveOnHeaders) {\n          finish(() => {\n            incoming.destroy();\n            resolve(result);\n          });\n          return;\n        }\n        incoming.resume();\n        incoming.once(\"error\", (error) => finish(() => reject(error)));\n        incoming.once(\"end\", () => finish(() => resolve(result)));\n      },\n    );\n    params.activeRequests?.add(request);\n    deadline = setTimeout(() => {\n      const error = new DOMException(\n        `Webhook delivery timed out after ${params.timeoutMs}ms`,\n        \"TimeoutError\",\n      );\n      response?.destroy(error);\n      request.destroy(error);\n    }, params.timeoutMs);\n    deadline.unref();\n    request.once(\"error\", (error) => finish(() => reject(error)));\n    request.end(params.body);\n  });\n}\n\nexport async function postWebhookRequestWithResponse(\n  params: PostWebhookRequestParams,\n): Promise<WebhookResponse> {\n  return await sendWebhookRequest(params, true);\n}\n\nexport async function postWebhookRequest(params: PostWebhookRequestParams): Promise<number> {\n  return (await sendWebhookRequest(params, false)).status;\n}\n"]}