@provian/mcp 1.2.3 → 1.3.0

package/CHANGELOG.md

@@ -1,6 +1,10 @@
 # @provian/mcp release notes
 
-**Published version: 1.2.3.** The package manifest in this directory defines the installed version.
+**Version: 1.3.0.** The package manifest in this directory defines the installed version.
+
+Ownership and recovery are independent of a wallet key. The common-owner link across bound addresses and portfolio totals remain private to the relay; an individual recovery may publicly link an old address to its replacement. This release resolves the permanent protocol pointer before supported PVT and institution operations and refuses retired targets.
+
+The optional Recourse Pool uses reversal authorized by both the restoration authority and the owner first, then its member-funded reserve for a shortfall accepted by discretionary determination, pro rata when underfunded. Contributions are nonrefundable; an allocated restoration has a direct exit without the relay. Members separately burn 100 PVT each month and contribute 1% of earnings, or 100 PVT from holdings in a month without earnings, under the signed rule. Ordinary transfers remain permissionless. The SDK and CLI include hash-based recovery and restoration workflows; the MCP package uses the same verified current deployment for its supported tools.
 
 A Provenance Envelope (PE) is signed proof owned by its contributor. PVT is the currency on Base minted from witnessed work. Every act of work mints once at its best-supported value; bookkeeping and duplicate witnesses do not mint separately.
 
@@ -10,6 +14,6 @@ The hosted MCP endpoint is `https://api.provian.ai/mcp`. Its public tool descrip
 
 The observer delivers Commons messages directly to the configured runtime over authenticated events. Follow the owner’s reply policy. No Commons heartbeat is required. On a machine with a service manager, cron, or a shell that reads its startup files, there is nothing to schedule: the observer restarts itself, the Provian startup hook prints any notice before the agent’s next command, and every `provian` command carries it. On a Grok Bot computer, whose commands run in a shell that reads no startup file and which has no cron or systemd, the agent keeps the observer running with a scheduled `provian observe --if-not-running`, and keeps that task.
 
-Standard earnings settle on a schedule Provian sets, currently every 30 days, Genesis grants daily, and an owner may settle ready earnings sooner for a flat $1 USDC service fee. Genesis is open through December 31, 2026. Court/Disputes, Voting, Compute market and Insurance are not open. Android out-of-app AI capture and Grok Bot’s provider-side tool calls are not available.
+Standard earnings settle on a schedule Provian sets, currently every 30 days, Genesis grants daily, and an owner may settle ready earnings sooner for a flat $1 USDC service fee. Genesis is open through December 31, 2026. Court/Disputes, Voting, Compute market and other recourse programs are not open. Android out-of-app AI capture and Grok Bot’s provider-side tool calls are not available.
 
 See [README](README.md) for the supported commands, interfaces and security boundaries.

package/README.md

@@ -216,7 +216,7 @@ Court escalation is not offered on a job.
 
 The Commons institution catalog is served by `GET /v1/commons/institutions`. Its not-open-yet
 set is exactly Disputes (the Court: it opens once enough members qualify to judge cases), Voting,
-Compute market, and Insurance. Insurance is not open. Provian provides the rails, not the insurance.
+and Compute market.
 
 Every act of work mints PVT once at its best-supported value. The PE mints its base; telemetry and independence multiply on top. There is no tool to report your own work: an actor's own claim about its work is never a PE. Your work mints from what something other than you vouches for: tool-calling model responses witnessed by the observer on a registered device. Each program has exactly one witness: its described session files if it keeps them, otherwise the proxy, otherwise OTel, otherwise — on its own machine — the process lane, which mints each command the program runs once. Each response calling at least one tool, including errored calls, mints once; a response without tools does not mint. Switching sign-in, model or provider keeps that witness. Other work earns through commits via the forge webhooks, your Commons acts, and your on-chain acts signed with your own key. This holds for a hosted bot on a cloud VM too. Capture health for each device shows which lanes are live. A Grok Bot runs its turns on xAI's servers and writes no transcript on its machine; the process lane witnesses each command it runs there, read from the operating system, beside its commits, Commons acts and on-chain acts.
 

package/dist/core/egress-guard.d.ts

@@ -0,0 +1,39 @@
+/**
+ * SSRF egress guard (SDK-side enforcement).
+ *
+ * WS3 audit fix. The architecture promised that non-payment agent egress was
+ * SSRF/IP-pinning enforced, but the device-side gate that was supposed to do it
+ * had zero callers and the agent performed the fetch itself with no checks.
+ * Enforcement belongs where the fetch actually happens — here, in the SDK. (The
+ * unwired device module was deleted outright in; this is the only egress
+ * enforcement point, not a second one.)
+ *
+ * This is a self-contained port of the device SSRFValidator's synchronous
+ * classifier (src/core/credentials/proxy/SSRFValidator.ts), plus an async
+ * resolve-and-recheck step with an INJECTABLE resolver so it is portable
+ * (Node `dns` by default) and unit-testable (DNS-rebinding can be exercised by
+ * injecting a resolver that returns a private IP for a public-looking host).
+ *
+ * `guarded-fetch.ts` binds these exact addresses to the connection's lookup while
+ * retaining the original hostname for TLS/SNI and Host. Empty/failed DNS is refused.
+ */
+/** True if a hostname/IP literal is an SSRF target (private / loopback / metadata). */
+export declare function isSSRFTarget(hostname: string): boolean;
+export interface EgressGuardResult {
+    ok: boolean;
+    reason?: string;
+    code?: 'INVALID_URL' | 'HTTPS_REQUIRED' | 'CREDENTIALS_IN_URL' | 'SSRF_BLOCKED' | 'DNS_FAILED';
+    hostname?: string;
+    resolvedIps?: string[];
+}
+export type HostResolver = (hostname: string) => Promise<string[]>;
+/**
+ * Validate an egress target. Hard-rejects:
+ *  - non-HTTPS URLs and URLs carrying credentials
+ *  - SSRF targets (private/loopback/link-local IPs, IPv6 ULA, cloud metadata)
+ *  - hosts that RESOLVE to a private IP (DNS rebinding at check time)
+ */
+export declare function validateEgressTarget(url: string, opts?: {
+    resolveHost?: HostResolver;
+}): Promise<EgressGuardResult>;
+//# sourceMappingURL=egress-guard.d.ts.map

package/dist/core/egress-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress-guard.d.ts","sourceRoot":"","sources":["../../src/core/egress-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAqLH,uFAAuF;AACvF,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAStD;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,aAAa,GAAG,gBAAgB,GAAG,oBAAoB,GAAG,cAAc,GAAG,YAAY,CAAC;IAC/F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAanE;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,YAAY,CAAA;CAAE,GACpC,OAAO,CAAC,iBAAiB,CAAC,CAyC5B"}

package/dist/core/egress-guard.js

@@ -0,0 +1,303 @@
+"use strict";
+/**
+ * SSRF egress guard (SDK-side enforcement).
+ *
+ * WS3 audit fix. The architecture promised that non-payment agent egress was
+ * SSRF/IP-pinning enforced, but the device-side gate that was supposed to do it
+ * had zero callers and the agent performed the fetch itself with no checks.
+ * Enforcement belongs where the fetch actually happens — here, in the SDK. (The
+ * unwired device module was deleted outright in; this is the only egress
+ * enforcement point, not a second one.)
+ *
+ * This is a self-contained port of the device SSRFValidator's synchronous
+ * classifier (src/core/credentials/proxy/SSRFValidator.ts), plus an async
+ * resolve-and-recheck step with an INJECTABLE resolver so it is portable
+ * (Node `dns` by default) and unit-testable (DNS-rebinding can be exercised by
+ * injecting a resolver that returns a private IP for a public-looking host).
+ *
+ * `guarded-fetch.ts` binds these exact addresses to the connection's lookup while
+ * retaining the original hostname for TLS/SNI and Host. Empty/failed DNS is refused.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSSRFTarget = isSSRFTarget;
+exports.validateEgressTarget = validateEgressTarget;
+const IPV4_REGEX = /^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/;
+const IPV6_REGEX = /^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}$|^(?:[0-9a-fA-F]{1,4}:){1,7}:$|^(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}$|^(?:[0-9a-fA-F]{1,4}:){1,5}(?::[0-9a-fA-F]{1,4}){1,2}$|^(?:[0-9a-fA-F]{1,4}:){1,4}(?::[0-9a-fA-F]{1,4}){1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,3}(?::[0-9a-fA-F]{1,4}){1,4}$|^(?:[0-9a-fA-F]{1,4}:){1,2}(?::[0-9a-fA-F]{1,4}){1,5}$|^[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}$|^:(?::[0-9a-fA-F]{1,4}){1,7}$|^::$/;
+function isValidIPAddress(value) {
+    if (!value || typeof value !== 'string')
+        return false;
+    const t = value.trim();
+    return IPV4_REGEX.test(t) || IPV6_REGEX.test(t);
+}
+const BLOCKED_IPV4_RANGES = [
+    { start: '127.0.0.0', end: '127.255.255.255', name: 'loopback' },
+    { start: '10.0.0.0', end: '10.255.255.255', name: 'private-class-a' },
+    { start: '172.16.0.0', end: '172.31.255.255', name: 'private-class-b' },
+    { start: '192.168.0.0', end: '192.168.255.255', name: 'private-class-c' },
+    { start: '169.254.0.0', end: '169.254.255.255', name: 'link-local' },
+    { start: '0.0.0.0', end: '0.255.255.255', name: 'current-network' },
+    { start: '255.255.255.255', end: '255.255.255.255', name: 'broadcast' },
+    { start: '100.64.0.0', end: '100.127.255.255', name: 'shared-address-space' },
+    { start: '198.18.0.0', end: '198.19.255.255', name: 'benchmark-testing' },
+    { start: '240.0.0.0', end: '255.255.255.254', name: 'reserved-future' },
+    { start: '224.0.0.0', end: '239.255.255.255', name: 'multicast' },
+];
+const BLOCKED_HOSTNAMES = new Set([
+    'localhost', 'localhost.localdomain', '127.0.0.1', '::1', '[::1]', '0.0.0.0',
+    '169.254.169.254', 'metadata.google.internal',
+]);
+function ipv4ToInt(ip) {
+    const parts = ip.split('.');
+    if (parts.length !== 4)
+        return null;
+    let result = 0;
+    for (const part of parts) {
+        const num = parseInt(part, 10);
+        if (isNaN(num) || num < 0 || num > 255)
+            return null;
+        result = (result << 8) + num;
+    }
+    return result >>> 0;
+}
+function normalizeIpAddress(input) {
+    if (IPV4_REGEX.test(input))
+        return input;
+    if (/^\d+$/.test(input)) {
+        const num = parseInt(input, 10);
+        if (num >= 0 && num <= 0xFFFFFFFF) {
+            return [(num >>> 24) & 0xFF, (num >>> 16) & 0xFF, (num >>> 8) & 0xFF, num & 0xFF].join('.');
+        }
+        return null;
+    }
+    if (/^0x[0-9a-fA-F]+$/.test(input)) {
+        const num = parseInt(input, 16);
+        if (num >= 0 && num <= 0xFFFFFFFF) {
+            return [(num >>> 24) & 0xFF, (num >>> 16) & 0xFF, (num >>> 8) & 0xFF, num & 0xFF].join('.');
+        }
+        return null;
+    }
+    const parts = input.split('.');
+    if (parts.length >= 1 && parts.length <= 4) {
+        const octets = [];
+        for (const part of parts) {
+            let val;
+            if (part.startsWith('0x') || part.startsWith('0X'))
+                val = parseInt(part, 16);
+            else if (part.startsWith('0') && part.length > 1)
+                val = parseInt(part, 8);
+            else
+                val = parseInt(part, 10);
+            if (isNaN(val) || val < 0)
+                return null;
+            octets.push(val);
+        }
+        if (octets.length === 1 && octets[0] <= 0xFFFFFFFF) {
+            const n = octets[0];
+            return [(n >>> 24) & 0xFF, (n >>> 16) & 0xFF, (n >>> 8) & 0xFF, n & 0xFF].join('.');
+        }
+        if (octets.length === 2 && octets[0] <= 0xFF && octets[1] <= 0xFFFFFF) {
+            return [octets[0], (octets[1] >>> 16) & 0xFF, (octets[1] >>> 8) & 0xFF, octets[1] & 0xFF].join('.');
+        }
+        if (octets.length === 3 && octets[0] <= 0xFF && octets[1] <= 0xFF && octets[2] <= 0xFFFF) {
+            return [octets[0], octets[1], (octets[2] >>> 8) & 0xFF, octets[2] & 0xFF].join('.');
+        }
+        if (octets.length === 4 && octets.every(o => o <= 0xFF))
+            return octets.join('.');
+    }
+    return null;
+}
+function isBlockedIPv4(ip) {
+    if (ip.includes(':'))
+        return { blocked: false };
+    const normalized = normalizeIpAddress(ip);
+    if (normalized && normalized !== ip)
+        return isBlockedIPv4(normalized);
+    const ipInt = ipv4ToInt(ip);
+    if (ipInt === null)
+        return { blocked: false };
+    for (const range of BLOCKED_IPV4_RANGES) {
+        const s = ipv4ToInt(range.start);
+        const e = ipv4ToInt(range.end);
+        if (s !== null && e !== null && ipInt >= s && ipInt <= e) {
+            return { blocked: true, reason: `IP ${ip} is in blocked range: ${range.name}` };
+        }
+    }
+    return { blocked: false };
+}
+function looksLikePrivateHost(hostname) {
+    const lower = hostname.toLowerCase();
+    const m = lower.match(/(?:^|[.-])(\d{1,3})[.-](\d{1,3})[.-](\d{1,3})[.-](\d{1,3})(?:[.-]|$)/);
+    if (m && isBlockedIPv4(`${m[1]}.${m[2]}.${m[3]}.${m[4]}`).blocked)
+        return true;
+    if (lower.includes('localhost') || lower.includes('127.0.0.1') || lower.includes('0.0.0.0'))
+        return true;
+    if (lower.endsWith('.local') || lower.endsWith('.internal') || lower.endsWith('.corp') ||
+        lower.endsWith('.home') || lower.endsWith('.lan'))
+        return true;
+    return false;
+}
+function parseIPv6(ip) {
+    let cleanIp = ip.replace(/^\[|\]$/g, '');
+    const mapped = cleanIp.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i);
+    if (mapped)
+        return { segments: [0, 0, 0, 0, 0, 0xFFFF, 0, 0], isIPv4Mapped: true, mappedIPv4: mapped[1] };
+    if (cleanIp.includes('::')) {
+        const parts = cleanIp.split('::');
+        if (parts.length > 2)
+            return null;
+        const left = parts[0] ? parts[0].split(':') : [];
+        const right = parts[1] ? parts[1].split(':') : [];
+        const missing = 8 - left.length - right.length;
+        if (missing < 0)
+            return null;
+        cleanIp = [...left, ...Array(missing).fill('0'), ...right].join(':');
+    }
+    const segStrs = cleanIp.split(':');
+    if (segStrs.length !== 8)
+        return null;
+    const segments = [];
+    for (const seg of segStrs) {
+        const num = parseInt(seg, 16);
+        if (isNaN(num) || num < 0 || num > 0xFFFF)
+            return null;
+        segments.push(num);
+    }
+    return { segments, isIPv4Mapped: false };
+}
+function isBlockedIPv6(ip) {
+    const parsed = parseIPv6(ip);
+    if (!parsed)
+        return { blocked: false };
+    if (parsed.isIPv4Mapped && parsed.mappedIPv4) {
+        const c = isBlockedIPv4(parsed.mappedIPv4);
+        if (c.blocked)
+            return { blocked: true, reason: `IPv4-mapped IPv6: ${c.reason}` };
+    }
+    const s = parsed.segments;
+    const firstFiveZero = s[0] === 0 && s[1] === 0 && s[2] === 0 && s[3] === 0 && s[4] === 0;
+    const embedded = `${s[6] >> 8}.${s[6] & 0xFF}.${s[7] >> 8}.${s[7] & 0xFF}`;
+    if (firstFiveZero && s[5] === 0xFFFF) {
+        const c = isBlockedIPv4(embedded);
+        if (c.blocked)
+            return { blocked: true, reason: `IPv4-mapped IPv6: ${c.reason}` };
+    }
+    if (firstFiveZero && s[5] === 0 && (s[6] !== 0 || s[7] !== 0)) {
+        if (!(s[6] === 0 && s[7] === 1)) {
+            const c = isBlockedIPv4(embedded);
+            if (c.blocked)
+                return { blocked: true, reason: `IPv4-compatible IPv6: ${c.reason}` };
+        }
+    }
+    // IPv4-translated (SIIT, ::ffff:0:a.b.c.d): the same embedded address one segment further along
+    // (the form parsed as an ordinary public IPv6 address).
+    if (s[0] === 0 && s[1] === 0 && s[2] === 0 && s[3] === 0 && s[4] === 0xFFFF && s[5] === 0) {
+        const c = isBlockedIPv4(embedded);
+        if (c.blocked)
+            return { blocked: true, reason: `IPv4-translated IPv6: ${c.reason}` };
+    }
+    // NAT64 (64:ff9b::/96 well-known, 64:ff9b:1::/48 local-use) and 6to4 (2002::/16) carry an IPv4
+    // address inside the IPv6 one; a private v4 reached that way is the same private host.
+    if (s[0] === 0x0064 && s[1] === 0xFF9B && ((s[2] === 0 && s[3] === 0 && s[4] === 0 && s[5] === 0) || s[2] === 1)) {
+        const c = isBlockedIPv4(embedded);
+        if (c.blocked)
+            return { blocked: true, reason: `NAT64 IPv6: ${c.reason}` };
+    }
+    if (s[0] === 0x2002) {
+        const c = isBlockedIPv4(`${s[1] >> 8}.${s[1] & 0xFF}.${s[2] >> 8}.${s[2] & 0xFF}`);
+        if (c.blocked)
+            return { blocked: true, reason: `6to4 IPv6: ${c.reason}` };
+    }
+    if ((s[0] & 0xFF00) === 0xFF00)
+        return { blocked: true, reason: 'IPv6 multicast (ff00::/8)' };
+    if (s.every(x => x === 0))
+        return { blocked: true, reason: 'IPv6 all-interfaces' };
+    if (s[0] === 0 && s[1] === 0 && s[2] === 0 && s[3] === 0 && s[4] === 0 && s[5] === 0 && s[6] === 0 && s[7] === 1) {
+        return { blocked: true, reason: 'IPv6 loopback' };
+    }
+    if ((s[0] & 0xFFC0) === 0xFE80)
+        return { blocked: true, reason: 'IPv6 link-local (fe80::/10)' };
+    if ((s[0] & 0xFE00) === 0xFC00)
+        return { blocked: true, reason: 'IPv6 unique-local (fc00::/7)' };
+    if ((s[0] & 0xFFC0) === 0xFEC0)
+        return { blocked: true, reason: 'IPv6 site-local' };
+    return { blocked: false };
+}
+/** True if a hostname/IP literal is an SSRF target (private / loopback / metadata). */
+function isSSRFTarget(hostname) {
+    const lower = hostname.toLowerCase();
+    if (BLOCKED_HOSTNAMES.has(lower))
+        return true;
+    if (isBlockedIPv4(lower).blocked)
+        return true;
+    if (looksLikePrivateHost(lower))
+        return true;
+    const v6 = lower.replace(/^\[|\]$/g, '');
+    if (isBlockedIPv6(v6).blocked)
+        return true;
+    if (lower.includes(':') && isBlockedIPv6(lower).blocked)
+        return true;
+    return false;
+}
+/** Default Node resolver (lazy-imported so non-Node runtimes don't break at load). */
+async function defaultResolveHost(hostname) {
+    try {
+        const dns = await import('node:dns/promises');
+        const records = await dns.lookup(hostname, { all: true });
+        return records.map(r => r.address);
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Validate an egress target. Hard-rejects:
+ *  - non-HTTPS URLs and URLs carrying credentials
+ *  - SSRF targets (private/loopback/link-local IPs, IPv6 ULA, cloud metadata)
+ *  - hosts that RESOLVE to a private IP (DNS rebinding at check time)
+ */
+async function validateEgressTarget(url, opts) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return { ok: false, code: 'INVALID_URL', reason: 'Invalid destination URL' };
+    }
+    if (parsed.protocol !== 'https:') {
+        return { ok: false, code: 'HTTPS_REQUIRED', reason: `Egress must be HTTPS, got ${parsed.protocol}`, hostname: parsed.hostname };
+    }
+    if (parsed.username || parsed.password) {
+        return { ok: false, code: 'CREDENTIALS_IN_URL', reason: 'Credentials in URL are not allowed', hostname: parsed.hostname };
+    }
+    const hostname = parsed.hostname;
+    if (isSSRFTarget(hostname)) {
+        return { ok: false, code: 'SSRF_BLOCKED', reason: `Blocked SSRF target: ${hostname}`, hostname };
+    }
+    // Every approval carries the addresses the transport must use.
+    const isIpLiteral = IPV4_REGEX.test(hostname) || hostname.includes(':');
+    if (!isIpLiteral) {
+        const resolve = opts?.resolveHost ?? defaultResolveHost;
+        let ips;
+        // A resolver may explain an empty answer by throwing (e.g. which lookups it tried); the
+        // reason carries that note so a caller can say what actually happened. Still refused.
+        let note = '';
+        try {
+            ips = await resolve(hostname);
+        }
+        catch (err) {
+            ips = [];
+            note = err instanceof Error && err.message ? ` (${err.message})` : '';
+        }
+        if (ips.length === 0 || ips.some(ip => !isValidIPAddress(ip))) {
+            return { ok: false, code: 'DNS_FAILED', reason: `No valid DNS addresses for ${hostname}${note}`, hostname, resolvedIps: ips };
+        }
+        for (const ip of ips) {
+            if (isBlockedIPv4(ip).blocked || isBlockedIPv6(ip).blocked) {
+                return { ok: false, code: 'SSRF_BLOCKED', reason: `Host ${hostname} resolved to blocked IP ${ip}`, hostname, resolvedIps: ips };
+            }
+        }
+        return { ok: true, hostname, resolvedIps: ips };
+    }
+    return { ok: true, hostname, resolvedIps: [hostname.replace(/^\[|\]$/g, '')] };
+}
+//# sourceMappingURL=egress-guard.js.map

package/dist/core/egress-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress-guard.js","sourceRoot":"","sources":["../../src/core/egress-guard.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;AAsLH,oCASC;AA6BD,oDA4CC;AAtQD,MAAM,UAAU,GAAG,6FAA6F,CAAC;AACjH,MAAM,UAAU,GAAG,qaAAqa,CAAC;AAEzb,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACvB,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,mBAAmB,GAAwD;IAC/E,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,UAAU,EAAE;IAChE,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,iBAAiB,EAAE;IACrE,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,iBAAiB,EAAE;IACvE,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,EAAE;IACzE,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,YAAY,EAAE;IACpE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,iBAAiB,EAAE;IACnE,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE;IACvE,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,sBAAsB,EAAE;IAC7E,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,mBAAmB,EAAE;IACzE,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,EAAE;IACvE,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE;CAClE,CAAC;AAEF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,WAAW,EAAE,uBAAuB,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS;IAC5E,iBAAiB,EAAE,0BAA0B;CAC9C,CAAC,CAAC;AAEH,SAAS,SAAS,CAAC,EAAU;IAC3B,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,KAAK,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,GAAW,CAAC;YAChB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;iBACxE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;;gBACrE,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC9B,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC;YACnD,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACpB,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC;YACtE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC;YACzF,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,EAAU;IAC/B,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAChD,MAAM,UAAU,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAC1C,IAAI,UAAU,IAAI,UAAU,KAAK,EAAE;QAAE,OAAO,aAAa,CAAC,UAAU,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,mBAAmB,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,yBAAyB,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAClF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC9F,IAAI,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC/E,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACzG,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAClF,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,EAAU;IAC3B,IAAI,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAC/E,IAAI,MAAM;QAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1G,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC/C,IAAI,OAAO,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7B,OAAO,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,MAAM;YAAE,OAAO,IAAI,CAAC;QACvD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,aAAa,CAAC,EAAU;IAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACvC,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,CAAC,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACnF,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC1B,MAAM,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;IAC3E,IAAI,aAAa,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,aAAa,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;YAClC,IAAI,CAAC,CAAC,OAAO;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,yBAAyB,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QACvF,CAAC;IACH,CAAC;IACD,gGAAgG;IAChG,wDAAwD;IACxD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1F,MAAM,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,yBAAyB,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACvF,CAAC;IACD,+FAA+F;IAC/F,uFAAuF;IACvF,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACjH,MAAM,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAC9F,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACnF,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACjH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAChG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IACjG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACpF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,uFAAuF;AACvF,SAAgB,YAAY,CAAC,QAAgB;IAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,oBAAoB,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACzC,IAAI,aAAa,CAAC,EAAE,CAAC,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACrE,OAAO,KAAK,CAAC;AACf,CAAC;AAYD,sFAAsF;AACtF,KAAK,UAAU,kBAAkB,CAAC,QAAgB;IAChD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,oBAAoB,CACxC,GAAW,EACX,IAAqC;IAErC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC/E,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,6BAA6B,MAAM,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IAClI,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,oCAAoC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC5H,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,IAAI,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,wBAAwB,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC;IACnG,CAAC;IAED,+DAA+D;IAC/D,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACxE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,IAAI,EAAE,WAAW,IAAI,kBAAkB,CAAC;QACxD,IAAI,GAAa,CAAC;QAClB,wFAAwF;QACxF,sFAAsF;QACtF,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YAAC,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,GAAG,GAAG,EAAE,CAAC;YAAC,IAAI,GAAG,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAAC,CAAC;QACvI,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,8BAA8B,QAAQ,GAAG,IAAI,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;QAChI,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,IAAI,aAAa,CAAC,EAAE,CAAC,CAAC,OAAO,IAAI,aAAa,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,QAAQ,2BAA2B,EAAE,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;YAClI,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;IAClD,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;AACjF,CAAC"}

package/dist/core/guarded-fetch.d.ts

@@ -0,0 +1,46 @@
+import { type HostResolver } from './egress-guard';
+/** The guard refused the destination before any byte left the machine. */
+export declare class EgressRefusedError extends Error {
+    readonly code: string;
+    constructor(code: string | undefined, reason: string | undefined);
+}
+export interface GuardedFetchOptions {
+    readonly fetchFn?: typeof globalThis.fetch;
+    readonly resolveHost?: HostResolver;
+}
+/**
+ * DNS-over-HTTPS resolvers, addressed by IP so reaching them needs no DNS. Each serves the
+ * dns-json shape at the path named here, and each certificate carries its IP as a SAN.
+ */
+export declare const DOH_RESOLVERS: readonly string[];
+/** Test seam: forget cached DNS-over-HTTPS answers. */
+export declare function clearDohCache(): void;
+export declare function resolveViaDoh(hostname: string, fetchFn?: typeof globalThis.fetch): Promise<string[]>;
+/**
+ * A fake-IP gateway's answer: every name resolves into 198.18.0.0/15 (the benchmark range,
+ * RFC 2544), and the gateway maps that address back to the name when the box connects. Such an
+ * answer says nothing about where the name really points, so the guard cannot check it.
+ */
+export declare function isFakeIpAnswer(ips: readonly string[]): boolean;
+/**
+ * The resolver the guard uses for `url`, so a destination's REAL addresses are what it checks
+ * and pins (Security Invariant #6):
+ *  - the box's own DNS answer, when it is a real answer (any blocked address in it refuses);
+ *  - DNS-over-HTTPS when that answer is a fake-IP gateway's (all in 198.18.0.0/15): the real
+ *    addresses are checked and the connection is pinned to them, never to the gateway's
+ *    stand-in address;
+ *  - DNS-over-HTTPS through the forward proxy when the box has no DNS at all and a proxy
+ *    carries the request. With no proxy and no DNS: no address, refused (unknown = block).
+ */
+export declare function egressResolver(url: string, fetchFn?: typeof globalThis.fetch): HostResolver;
+/**
+ * No ambient dispatcher or later DNS lookup can change the approved destination.
+ *
+ * The pinned dispatcher is a `PinnedAgent` (`pinned-agent.ts`), which every Node's built-in fetch
+ * from 20 through 26 accepts — so the default (built-in) fetch, an injected one, and a caller's own
+ * wrapper that delegates to the built-in fetch all carry it, on every supported Node.
+ */
+export declare function guardedFetch(input: Parameters<typeof globalThis.fetch>[0], init?: Parameters<typeof globalThis.fetch>[1], options?: GuardedFetchOptions): Promise<Response>;
+/** Wrap an injected HTTP implementation as well as the native default. */
+export declare function guardedFetcher(fetchFn?: typeof globalThis.fetch, resolveHost?: HostResolver): typeof globalThis.fetch;
+//# sourceMappingURL=guarded-fetch.d.ts.map

package/dist/core/guarded-fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guarded-fetch.d.ts","sourceRoot":"","sources":["../../src/core/guarded-fetch.ts"],"names":[],"mappings":"AAKA,OAAO,EAAwB,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEzE,0EAA0E;AAC1E,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS;CAKjE;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC;CACrC;AAYD;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,MAAM,EAG1C,CAAC;AAkBF,uDAAuD;AACvD,wBAAgB,aAAa,IAAI,IAAI,CAAsB;AAE3D,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,GAChC,OAAO,CAAC,MAAM,EAAE,CAAC,CA+BnB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAM9D;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,GAAG,YAAY,CAsC3F;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAC7C,IAAI,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAC7C,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,QAAQ,CAAC,CAsCnB;AAED,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,OAAO,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,YAAY,GAAG,OAAO,UAAU,CAAC,KAAK,CAGrH"}