kinetex 1.3.0 → 1.5.0

package/dist/esm/proxy.js

@@ -0,0 +1,430 @@
+/**
+ * §14  HTTP(S) CONNECT PROXY TUNNELING
+ *
+ * Establishes a TCP tunnel to a target host through an HTTP/HTTPS proxy using
+ * the `CONNECT` method (RFC 9110 §9.3.6), then optionally wraps that socket in
+ * TLS to the target.
+ *
+ * The tunnel is how an HTTP proxy must be used for HTTPS: the client sends
+ * only the CONNECT request line to the proxy, and from there the proxy is a
+ * blind byte relay. The target's certificate is therefore validated end to
+ * end against the target's own name — the proxy never terminates TLS, so it
+ * cannot impersonate the target without the CA store rejecting it.
+ *
+ * This module is Node-only by construction: it imports `node:net` and
+ * `node:tls`. Other runtimes route through their own `fetch` and must use a
+ * proxy-capable dispatcher instead.
+ *
+ * @module
+ */
+import { KinetexError } from "./types.js";
+/**
+ * True when `host` is an IPv4/IPv6 literal rather than a DNS name.
+ *
+ * A textual shape check rather than `node:net.isIP`, because this is a
+ * synchronous guard and the module only reaches for `node:net` through a
+ * dynamic import. Being imprecise here is harmless: the worst case is that a
+ * name the resolver dislikes is sent as SNI, and the TLS stack rejects it.
+ */
+function isIpLiteral(host) {
+    const h = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+    return h.includes(":") || /^\d+(\.\d+)*$/.test(h);
+}
+const DEFAULT_CONNECT_TIMEOUT_MS = 30_000;
+/** Maximum CONNECT response head we will buffer before giving up. */
+const MAX_HEAD_BYTES = 64 * 1024;
+/**
+ * True when the proxy URL names a SOCKS proxy, which needs a different
+ * mechanism entirely (`createSocks5Tunnel` in `kinetex/socks5`).
+ */
+function isSocksProxy(url) {
+    return /^socks5h?:/i.test(url);
+}
+/**
+ * Build the `Proxy-Authorization` header value for Basic proxy auth.
+ *
+ * Uses the same encoding as the client's HTTP Basic auth. Returns `undefined`
+ * when no username was supplied — an empty username is still a deliberate
+ * (if unusual) credential, so it is encoded rather than skipped.
+ */
+function proxyAuthHeader(proxy) {
+    if (proxy.username === undefined)
+        return undefined;
+    const raw = `${proxy.username}:${proxy.password ?? ""}`;
+    const bytes = new TextEncoder().encode(raw);
+    let binary = "";
+    for (const b of bytes)
+        binary += String.fromCharCode(b);
+    const b64 = typeof globalThis.btoa === "function"
+        ? globalThis.btoa(binary)
+        : // Node without btoa (or a non-Latin1 username) — encode explicitly.
+            Buffer.from(bytes).toString("base64");
+    return `Basic ${b64}`;
+}
+/**
+ * Parse a `CONNECT` response head.
+ *
+ * @returns The numeric status code, or `null` when the head is incomplete.
+ */
+function parseConnectStatus(head) {
+    const statusLine = head.split("\r\n", 1)[0] ?? "";
+    const match = /^HTTP\/1\.[01] (\d{3})(?: (.*))?$/.exec(statusLine);
+    if (!match)
+        return null;
+    return { status: Number(match[1]), reason: match[2] ?? "" };
+}
+/**
+ * Open a socket to a target host through an HTTP(S) proxy via `CONNECT`.
+ *
+ * Returns a socket connected to the **target** — already TLS-wrapped when the
+ * target is `https:`. The caller owns it and decides whether to pool it.
+ *
+ * @param proxy - Proxy URL and optional Basic credentials.
+ * @param target - Fully-resolved target URL.
+ * @param options - CA, timeout, and abort configuration.
+ * @returns A socket tunneled to the target.
+ * @throws {KinetexError} `EVALIDATION` for a SOCKS proxy or a malformed proxy
+ *   URL, `EPROXYAUTH` when the proxy demands credentials, `EPROXY` for any
+ *   other non-2xx CONNECT response, `ETIMEOUT` if the proxy never answers,
+ *   `EABORT` if `signal` fires, and `ENETWORK` for socket/TLS failures.
+ */
+export async function connectThroughProxy(proxy, target, options = {}) {
+    // Built conditionally: `exactOptionalPropertyTypes` forbids passing an
+    // explicit `undefined` for an optional property.
+    const errMeta = options.request !== undefined ? { request: options.request } : {};
+    if (isSocksProxy(proxy.url)) {
+        throw new KinetexError(`proxy url "${proxy.url}" is a SOCKS proxy, which needs a different mechanism. ` +
+            "Use createSocks5Tunnel() from kinetex/socks5 and supply your own fetch over the tunnel.", "EVALIDATION", errMeta);
+    }
+    let proxyUrl;
+    try {
+        proxyUrl = new URL(proxy.url);
+    }
+    catch (err) {
+        throw new KinetexError(`proxy url "${proxy.url}" is not a valid URL`, "EVALIDATION", {
+            ...errMeta,
+            cause: err,
+        });
+    }
+    if (proxyUrl.protocol !== "http:" && proxyUrl.protocol !== "https:") {
+        throw new KinetexError(`proxy url scheme "${proxyUrl.protocol}" is not supported; use http:, https:, socks5: or socks5h:`, "EVALIDATION", errMeta);
+    }
+    const net = await import("node:net");
+    const tls = await import("node:tls");
+    const proxyPort = proxyUrl.port
+        ? Number(proxyUrl.port)
+        : proxyUrl.protocol === "https:"
+            ? 443
+            : 80;
+    const targetPort = target.port ? Number(target.port) : target.protocol === "https:" ? 443 : 80;
+    const authority = `${target.hostname}:${targetPort}`;
+    const timeoutMs = options.connectTimeoutMs ?? DEFAULT_CONNECT_TIMEOUT_MS;
+    // ── 1. TCP (or TLS-to-proxy) connection to the proxy itself ───────────────
+    const baseSocket = proxyUrl.protocol === "https:"
+        ? await openTlsSocket(tls, {
+            host: proxyUrl.hostname,
+            port: proxyPort,
+            servername: proxyUrl.hostname,
+            ...(options.ca !== undefined ? { ca: options.ca } : {}),
+        }, timeoutMs, options.signal, errMeta, `proxy ${proxyUrl.host}`)
+        : await openTcpSocket(net, { host: proxyUrl.hostname, port: proxyPort }, timeoutMs, options.signal, errMeta, `proxy ${proxyUrl.host}`);
+    // ── 2. CONNECT handshake ─────────────────────────────────────────────────
+    const auth = proxyAuthHeader(proxy);
+    const connectLines = [
+        `CONNECT ${authority} HTTP/1.1`,
+        `Host: ${authority}`,
+        // RFC 9110 §9.3.6: proxies that support persistent tunnels are expected to
+        // treat a tunnel as still-open even without this, but sending it is what
+        // every real client does and some proxies misbehave without it.
+        "Proxy-Connection: Keep-Alive",
+        ...(auth !== undefined ? [`Proxy-Authorization: ${auth}`] : []),
+        "",
+        "",
+    ];
+    baseSocket.write(connectLines.join("\r\n"));
+    let head = "";
+    // TCP does not preserve write boundaries. A proxy that splits the 200 head
+    // across two writes and puts the target's first bytes in the second
+    // delivers the head terminator and the start of the tunnelled stream in a
+    // single read, so the tail is kept and put back rather than discarded --
+    // dropping it silently truncates the message the caller is about to read.
+    //
+    // The head is therefore read in PAUSED mode -- `on("readable")` plus
+    // `read()` -- and never with `on("data")`. `on("data")` switches the stream
+    // to flowing mode, and removing the last `data` listener does NOT switch it
+    // back, so a flowing socket with nothing attached silently DISCARDS the
+    // bytes after the head terminator. `unshift()` alone does not recover them
+    // either: a later `on("data")` sets `state.flowing = true` before calling
+    // `resume()`, and `resume()` only restarts the flow when flowing was
+    // previously false, so the socket stalls with the tail still buffered and
+    // the caller waits forever. Reading paused leaves the flow state unset, so
+    // whichever consumer comes next -- `on("data")`, `pipe()`, or
+    // `tls.connect({ socket })` -- starts the flow and sees the tail.
+    const headResult = await new Promise((resolve) => {
+        // Pull every buffered chunk into `head`; a null read means the buffer is
+        // drained and `readable` will fire again when more arrives.
+        const drain = () => {
+            for (;;) {
+                const chunk = baseSocket.read();
+                if (chunk === null)
+                    return;
+                head += chunk.toString("latin1");
+            }
+        };
+        const onReadable = () => {
+            drain();
+            const end = head.indexOf("\r\n\r\n");
+            if (end === -1) {
+                if (head.length > MAX_HEAD_BYTES) {
+                    cleanup();
+                    resolve({
+                        ok: false,
+                        err: new KinetexError("Proxy sent an oversized CONNECT response", "EPROXY", errMeta),
+                    });
+                }
+                return;
+            }
+            cleanup();
+            const parsed = parseConnectStatus(head.slice(0, end));
+            if (!parsed) {
+                resolve({
+                    ok: false,
+                    err: new KinetexError(`Proxy returned a malformed CONNECT response: ${JSON.stringify(head.slice(0, end).split("\r\n", 1)[0] ?? "")}`, "EPROXY", errMeta),
+                });
+                return;
+            }
+            // RFC 9110 section 9.3.6: any 2xx switches the proxy to tunnel mode.
+            // Only 200 was accepted, so a proxy answering 201 or 204 was reported
+            // as a refusal.
+            if (parsed.status >= 200 && parsed.status < 300) {
+                // Put the tunnel bytes back in front of the buffered stream before
+                // handing the socket on. latin1 round-trips the bytes exactly, which
+                // is how `head` was built.
+                const tail = head.slice(end + 4);
+                if (tail.length > 0)
+                    baseSocket.unshift(Buffer.from(tail, "latin1"));
+                resolve({ ok: true });
+                return;
+            }
+            if (parsed.status === 407) {
+                // Deliberately does not echo credentials back to the caller.
+                resolve({
+                    ok: false,
+                    err: new KinetexError("Proxy requires authentication (407). Set `username`/`password` on the proxy config, " +
+                        "or embed them in the proxy URL.", "EPROXY", errMeta),
+                });
+                return;
+            }
+            resolve({
+                ok: false,
+                err: new KinetexError(`Proxy refused CONNECT to ${authority}: ${parsed.status} ${parsed.reason}`.trim(), "EPROXY", errMeta),
+            });
+        };
+        const onError = (e) => {
+            cleanup();
+            resolve({
+                ok: false,
+                err: new KinetexError(`Proxy connection failed: ${e.message}`, "ENETWORK", {
+                    ...errMeta,
+                    cause: e,
+                }),
+            });
+        };
+        // A proxy that closes the connection mid-handshake delivers a clean FIN,
+        // not a reset — so no `error` event fires and the socket simply ends.
+        // Without this the request would sit here until the connect timeout
+        // expired: 30s by default, for a proxy that is already gone.
+        const onClosedEarly = () => {
+            cleanup();
+            resolve({
+                ok: false,
+                err: new KinetexError(`Proxy closed the connection before answering CONNECT for ${authority}`, "EPROXY", errMeta),
+            });
+        };
+        const onTimeout = () => {
+            cleanup();
+            baseSocket.destroy();
+            resolve({
+                ok: false,
+                err: new KinetexError(`Proxy did not respond to CONNECT for ${authority} within ${timeoutMs}ms`, "ETIMEOUT", errMeta),
+            });
+        };
+        const onAbort = () => {
+            cleanup();
+            baseSocket.destroy();
+            resolve({
+                ok: false,
+                err: new KinetexError("Proxy connection aborted", "EABORT", errMeta),
+            });
+        };
+        const timer = setTimeout(onTimeout, timeoutMs);
+        if (typeof timer.unref === "function") {
+            timer.unref();
+        }
+        function cleanup() {
+            clearTimeout(timer);
+            baseSocket.off("readable", onReadable);
+            baseSocket.off("error", onError);
+            baseSocket.off("end", onClosedEarly);
+            baseSocket.off("close", onClosedEarly);
+            baseSocket.off("timeout", onTimeout);
+            options.signal?.removeEventListener("abort", onAbort);
+        }
+        baseSocket.on("readable", onReadable);
+        baseSocket.once("error", onError);
+        baseSocket.once("end", onClosedEarly);
+        baseSocket.once("close", onClosedEarly);
+        baseSocket.setTimeout(timeoutMs, onTimeout);
+        options.signal?.addEventListener("abort", onAbort, { once: true });
+        // Data may already be buffered (the request write above and the reply
+        // can cross), and `readable` does not fire for bytes that arrived before
+        // the listener was attached.
+        drain();
+    });
+    if (!headResult.ok) {
+        baseSocket.destroy();
+        throw headResult.err;
+    }
+    // ── 3. TLS to the target through the tunnel ───────────────────────────────
+    if (target.protocol !== "https:") {
+        // Clear the handshake listeners' timeout; the socket now belongs to the
+        // caller and its own timeout policy.
+        baseSocket.setTimeout(0);
+        return baseSocket;
+    }
+    return await new Promise((resolve, reject) => {
+        // The CONNECT handshake is over and its timeout/abort listeners are torn
+        // down, but the TLS handshake to the target has not happened yet. A peer
+        // that accepts the tunnel and then says nothing -- a black-holed target,
+        // or a proxy that relays to nothing -- would otherwise wait forever, so
+        // the same timeout and abort cover this step too.
+        const onTunnelTimeout = () => {
+            done();
+            baseSocket.destroy();
+            reject(new KinetexError(`TLS handshake through proxy to ${target.hostname} did not complete within ${timeoutMs}ms`, "ETIMEOUT", errMeta));
+        };
+        const onTunnelAbort = () => {
+            done();
+            baseSocket.destroy();
+            reject(new KinetexError("Proxy connection aborted", "EABORT", errMeta));
+        };
+        const tunnelTimer = setTimeout(onTunnelTimeout, timeoutMs);
+        if (typeof tunnelTimer.unref === "function") {
+            tunnelTimer.unref();
+        }
+        options.signal?.addEventListener("abort", onTunnelAbort, { once: true });
+        function done() {
+            clearTimeout(tunnelTimer);
+            options.signal?.removeEventListener("abort", onTunnelAbort);
+        }
+        // RFC 6066 §3 forbids IP literals in SNI, and Node 26 rejects the
+        // handshake outright when one is sent; Node 22 and 24 ignored it. Omit
+        // `servername` for IP targets so certificate verification falls back to
+        // the `host`/`authorized` check, which still covers the certificate.
+        const sni = options.servername ?? target.hostname;
+        const secure = tls.connect({
+            socket: baseSocket,
+            ...(sni !== undefined && !isIpLiteral(sni) ? { servername: sni } : {}),
+            ...(options.ca !== undefined ? { ca: options.ca } : {}),
+        }, 
+        // `rejectUnauthorized` is left at its default (true), so a peer that
+        // fails verification emits `error` rather than reaching this callback.
+        // Verification therefore cannot be bypassed here, and the callback
+        // only ever runs for a verified handshake.
+        () => {
+            done();
+            baseSocket.setTimeout(0);
+            resolve(secure);
+        });
+        secure.once("error", (e) => {
+            done();
+            baseSocket.destroy();
+            reject(new KinetexError(`TLS handshake through proxy failed for ${target.hostname}: ${e.message}`, "ENETWORK", { ...errMeta, cause: e }));
+        });
+    });
+}
+/** Open a plain TCP socket, rejecting on error/timeout/abort. */
+async function openTcpSocket(net, opts, timeoutMs, signal, errMeta, what) {
+    return await new Promise((resolve, reject) => {
+        const socket = net.connect({ host: opts.host, port: opts.port });
+        const onError = (e) => {
+            cleanup();
+            reject(new KinetexError(`Cannot reach ${what}: ${e.message}`, "ENETWORK", {
+                ...errMeta,
+                cause: e,
+            }));
+        };
+        const timer = setTimeout(() => {
+            cleanup();
+            socket.destroy();
+            reject(new KinetexError(`Connecting to ${what} timed out`, "ETIMEOUT", errMeta));
+        }, timeoutMs);
+        if (typeof timer.unref === "function") {
+            timer.unref();
+        }
+        const onAbort = () => {
+            cleanup();
+            socket.destroy();
+            reject(new KinetexError("Proxy connection aborted", "EABORT", errMeta));
+        };
+        function cleanup() {
+            clearTimeout(timer);
+            socket.off("error", onError);
+            signal?.removeEventListener("abort", onAbort);
+        }
+        socket.once("error", onError);
+        socket.once("connect", () => {
+            cleanup();
+            resolve(socket);
+        });
+        if (signal?.aborted)
+            onAbort();
+        else
+            signal?.addEventListener("abort", onAbort, { once: true });
+    });
+}
+/** Open a TLS socket to an HTTPS proxy itself. */
+async function openTlsSocket(tls, opts, timeoutMs, signal, errMeta, what) {
+    return await new Promise((resolve, reject) => {
+        const socket = tls.connect({
+            host: opts.host,
+            port: opts.port,
+            ...(isIpLiteral(opts.servername) ? {} : { servername: opts.servername }),
+            ...(opts.ca !== undefined ? { ca: opts.ca } : {}),
+        }, () => {
+            cleanup();
+            resolve(socket);
+        });
+        const onError = (e) => {
+            cleanup();
+            reject(new KinetexError(`Cannot reach ${what}: ${e.message}`, "ENETWORK", {
+                ...errMeta,
+                cause: e,
+            }));
+        };
+        const timer = setTimeout(() => {
+            cleanup();
+            socket.destroy();
+            reject(new KinetexError(`Connecting to ${what} timed out`, "ETIMEOUT", errMeta));
+        }, timeoutMs);
+        if (typeof timer.unref === "function") {
+            timer.unref();
+        }
+        const onAbort = () => {
+            cleanup();
+            socket.destroy();
+            reject(new KinetexError("Proxy connection aborted", "EABORT", errMeta));
+        };
+        function cleanup() {
+            clearTimeout(timer);
+            socket.off("error", onError);
+            signal?.removeEventListener("abort", onAbort);
+        }
+        socket.once("error", onError);
+        if (signal?.aborted)
+            onAbort();
+        else
+            signal?.addEventListener("abort", onAbort, { once: true });
+    });
+}
+//# sourceMappingURL=proxy.js.map

package/dist/esm/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../../src/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAG1C;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChF,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAgBD,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAE1C,qEAAqE;AACrE,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC;AAEjC;;;GAGG;AACH,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,KAAkB;IACzC,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACnD,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;IACxD,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,GAAG,GACP,OAAO,UAAU,CAAC,IAAI,KAAK,UAAU;QACnC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;QACzB,CAAC,CAAC,oEAAoE;YACpE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5C,OAAO,SAAS,GAAG,EAAE,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,MAAM,KAAK,GAAG,mCAAmC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACnE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAkB,EAClB,MAAW,EACX,UAA+B,EAAE;IAEjC,uEAAuE;IACvE,iDAAiD;IACjD,MAAM,OAAO,GACX,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAEpE,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,YAAY,CACpB,cAAc,KAAK,CAAC,GAAG,yDAAyD;YAC9E,yFAAyF,EAC3F,aAAa,EACb,OAAO,CACR,CAAC;IACJ,CAAC;IAED,IAAI,QAAa,CAAC;IAClB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CAAC,cAAc,KAAK,CAAC,GAAG,sBAAsB,EAAE,aAAa,EAAE;YACnF,GAAG,OAAO;YACV,KAAK,EAAE,GAAG;SACX,CAAC,CAAC;IACL,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACpE,MAAM,IAAI,YAAY,CACpB,qBAAqB,QAAQ,CAAC,QAAQ,4DAA4D,EAClG,aAAa,EACb,OAAO,CACR,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IAErC,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI;QAC7B,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QACvB,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,QAAQ;YAC9B,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,MAAM,SAAS,GAAG,GAAG,MAAM,CAAC,QAAQ,IAAI,UAAU,EAAE,CAAC;IACrD,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;IAEzE,6EAA6E;IAC7E,MAAM,UAAU,GACd,QAAQ,CAAC,QAAQ,KAAK,QAAQ;QAC5B,CAAC,CAAC,MAAM,aAAa,CACjB,GAAG,EACH;YACE,IAAI,EAAE,QAAQ,CAAC,QAAQ;YACvB,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,QAAQ,CAAC,QAAQ;YAC7B,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,EACD,SAAS,EACT,OAAO,CAAC,MAAM,EACd,OAAO,EACP,SAAS,QAAQ,CAAC,IAAI,EAAE,CACzB;QACH,CAAC,CAAC,MAAM,aAAa,CACjB,GAAG,EACH,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,EAC5C,SAAS,EACT,OAAO,CAAC,MAAM,EACd,OAAO,EACP,SAAS,QAAQ,CAAC,IAAI,EAAE,CACzB,CAAC;IAER,4EAA4E;IAC5E,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,YAAY,GAAG;QACnB,WAAW,SAAS,WAAW;QAC/B,SAAS,SAAS,EAAE;QACpB,2EAA2E;QAC3E,yEAAyE;QACzE,gEAAgE;QAChE,8BAA8B;QAC9B,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,EAAE;QACF,EAAE;KACH,CAAC;IACF,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAE5C,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,2EAA2E;IAC3E,oEAAoE;IACpE,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,EAAE;IACF,qEAAqE;IACrE,4EAA4E;IAC5E,4EAA4E;IAC5E,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,qEAAqE;IACrE,0EAA0E;IAC1E,2EAA2E;IAC3E,8DAA8D;IAC9D,kEAAkE;IAClE,MAAM,UAAU,GAAG,MAAM,IAAI,OAAO,CAClC,CAAC,OAAO,EAAE,EAAE;QACV,yEAAyE;QACzE,4DAA4D;QAC5D,MAAM,KAAK,GAAG,GAAS,EAAE;YACvB,SAAS,CAAC;gBACR,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAmB,CAAC;gBACjD,IAAI,KAAK,KAAK,IAAI;oBAAE,OAAO;gBAC3B,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACnC,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,UAAU,GAAG,GAAS,EAAE;YAC5B,KAAK,EAAE,CAAC;YACR,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACrC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,IAAI,IAAI,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;oBACjC,OAAO,EAAE,CAAC;oBACV,OAAO,CAAC;wBACN,EAAE,EAAE,KAAK;wBACT,GAAG,EAAE,IAAI,YAAY,CAAC,0CAA0C,EAAE,QAAQ,EAAE,OAAO,CAAC;qBACrF,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO;YACT,CAAC;YAED,OAAO,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YACtD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC;oBACN,EAAE,EAAE,KAAK;oBACT,GAAG,EAAE,IAAI,YAAY,CACnB,gDAAgD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAC9G,QAAQ,EACR,OAAO,CACR;iBACF,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,qEAAqE;YACrE,sEAAsE;YACtE,gBAAgB;YAChB,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAChD,mEAAmE;gBACnE,qEAAqE;gBACrE,2BAA2B;gBAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;gBACjC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;oBAAE,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;gBACrE,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBACtB,OAAO;YACT,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC1B,6DAA6D;gBAC7D,OAAO,CAAC;oBACN,EAAE,EAAE,KAAK;oBACT,GAAG,EAAE,IAAI,YAAY,CACnB,sFAAsF;wBACpF,iCAAiC,EACnC,QAAQ,EACR,OAAO,CACR;iBACF,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,OAAO,CAAC;gBACN,EAAE,EAAE,KAAK;gBACT,GAAG,EAAE,IAAI,YAAY,CACnB,4BAA4B,SAAS,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EACjF,QAAQ,EACR,OAAO,CACR;aACF,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,CAAC,CAAQ,EAAQ,EAAE;YACjC,OAAO,EAAE,CAAC;YACV,OAAO,CAAC;gBACN,EAAE,EAAE,KAAK;gBACT,GAAG,EAAE,IAAI,YAAY,CAAC,4BAA4B,CAAC,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE;oBACzE,GAAG,OAAO;oBACV,KAAK,EAAE,CAAC;iBACT,CAAC;aACH,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,yEAAyE;QACzE,sEAAsE;QACtE,oEAAoE;QACpE,6DAA6D;QAC7D,MAAM,aAAa,GAAG,GAAS,EAAE;YAC/B,OAAO,EAAE,CAAC;YACV,OAAO,CAAC;gBACN,EAAE,EAAE,KAAK;gBACT,GAAG,EAAE,IAAI,YAAY,CACnB,4DAA4D,SAAS,EAAE,EACvE,QAAQ,EACR,OAAO,CACR;aACF,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,MAAM,SAAS,GAAG,GAAS,EAAE;YAC3B,OAAO,EAAE,CAAC;YACV,UAAU,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,CAAC;gBACN,EAAE,EAAE,KAAK;gBACT,GAAG,EAAE,IAAI,YAAY,CACnB,wCAAwC,SAAS,WAAW,SAAS,IAAI,EACzE,UAAU,EACV,OAAO,CACR;aACF,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,OAAO,EAAE,CAAC;YACV,UAAU,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,CAAC;gBACN,EAAE,EAAE,KAAK;gBACT,GAAG,EAAE,IAAI,YAAY,CAAC,0BAA0B,EAAE,QAAQ,EAAE,OAAO,CAAC;aACrE,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC/C,IAAI,OAAQ,KAA2C,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YAC5E,KAA0C,CAAC,KAAK,EAAE,CAAC;QACtD,CAAC;QAED,SAAS,OAAO;YACd,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YACvC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACjC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;YACrC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YACvC,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YACrC,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxD,CAAC;QAED,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACtC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACtC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACxC,UAAU,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC5C,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,sEAAsE;QACtE,yEAAyE;QACzE,6BAA6B;QAC7B,KAAK,EAAE,CAAC;IACV,CAAC,CACF,CAAC;IAEF,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,UAAU,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,UAAU,CAAC,GAAG,CAAC;IACvB,CAAC;IAED,6EAA6E;IAC7E,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,wEAAwE;QACxE,qCAAqC;QACrC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACzB,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO,MAAM,IAAI,OAAO,CAA+B,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACzE,yEAAyE;QACzE,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,kDAAkD;QAClD,MAAM,eAAe,GAAG,GAAS,EAAE;YACjC,IAAI,EAAE,CAAC;YACP,UAAU,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,CACJ,IAAI,YAAY,CACd,kCAAkC,MAAM,CAAC,QAAQ,4BAA4B,SAAS,IAAI,EAC1F,UAAU,EACV,OAAO,CACR,CACF,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,aAAa,GAAG,GAAS,EAAE;YAC/B,IAAI,EAAE,CAAC;YACP,UAAU,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,YAAY,CAAC,0BAA0B,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1E,CAAC,CAAC;QAEF,MAAM,WAAW,GAAG,UAAU,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,OAAQ,WAAiD,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YAClF,WAAgD,CAAC,KAAK,EAAE,CAAC;QAC5D,CAAC;QACD,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAEzE,SAAS,IAAI;YACX,YAAY,CAAC,WAAW,CAAC,CAAC;YAC1B,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC9D,CAAC;QAED,kEAAkE;QAClE,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC;QAClD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CACxB;YACE,MAAM,EAAE,UAAU;YAClB,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD;QACD,qEAAqE;QACrE,uEAAuE;QACvE,mEAAmE;QACnE,2CAA2C;QAC3C,GAAG,EAAE;YACH,IAAI,EAAE,CAAC;YACP,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACzB,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CACF,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAQ,EAAE,EAAE;YAChC,IAAI,EAAE,CAAC;YACP,UAAU,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,CACJ,IAAI,YAAY,CACd,0CAA0C,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,EACzE,UAAU,EACV,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CACzB,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iEAAiE;AACjE,KAAK,UAAU,aAAa,CAC1B,GAA8B,EAC9B,IAAoC,EACpC,SAAiB,EACjB,MAAsC,EACtC,OAAe,EACf,IAAY;IAEZ,OAAO,MAAM,IAAI,OAAO,CAA4B,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,CAAC,CAAQ,EAAQ,EAAE;YACjC,OAAO,EAAE,CAAC;YACV,MAAM,CACJ,IAAI,YAAY,CAAC,gBAAgB,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE;gBACjE,GAAG,OAAO;gBACV,KAAK,EAAE,CAAC;aACT,CAAC,CACH,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,YAAY,CAAC,iBAAiB,IAAI,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QACnF,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,IAAI,OAAQ,KAA2C,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YAC5E,KAA0C,CAAC,KAAK,EAAE,CAAC;QACtD,CAAC;QACD,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,YAAY,CAAC,0BAA0B,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1E,CAAC,CAAC;QACF,SAAS,OAAO;YACd,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7B,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;YAC1B,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,IAAI,MAAM,EAAE,OAAO;YAAE,OAAO,EAAE,CAAC;;YAC1B,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,kDAAkD;AAClD,KAAK,UAAU,aAAa,CAC1B,GAA8B,EAC9B,IAAgF,EAChF,SAAiB,EACjB,MAAsC,EACtC,OAAe,EACf,IAAY;IAEZ,OAAO,MAAM,IAAI,OAAO,CAA+B,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACzE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CACxB;YACE,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;YACxE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,EACD,GAAG,EAAE;YACH,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CACF,CAAC;QACF,MAAM,OAAO,GAAG,CAAC,CAAQ,EAAQ,EAAE;YACjC,OAAO,EAAE,CAAC;YACV,MAAM,CACJ,IAAI,YAAY,CAAC,gBAAgB,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE;gBACjE,GAAG,OAAO;gBACV,KAAK,EAAE,CAAC;aACT,CAAC,CACH,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,YAAY,CAAC,iBAAiB,IAAI,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QACnF,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,IAAI,OAAQ,KAA2C,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YAC5E,KAA0C,CAAC,KAAK,EAAE,CAAC;QACtD,CAAC;QACD,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,YAAY,CAAC,0BAA0B,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1E,CAAC,CAAC;QACF,SAAS,OAAO;YACd,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7B,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9B,IAAI,MAAM,EAAE,OAAO;YAAE,OAAO,EAAE,CAAC;;YAC1B,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC"}