palaryn 0.1.0

package/dist/src/policy/opa-engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opa-engine.js","sourceRoot":"","sources":["../../../src/policy/opa-engine.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6B;AAC7B,6CAA+B;AAC/B,6BAA0B;AA0C1B,MAAa,SAAS;IAUpB,YAAY,MAAiB;QAP7B,6CAA6C;QACrC,iBAAY,GAAiB,QAAQ,CAAC;QACtC,wBAAmB,GAAW,CAAC,CAAC;QAChC,oBAAe,GAAW,CAAC,CAAC;QACnB,qBAAgB,GAAW,CAAC,CAAC;QAC7B,mBAAc,GAAW,KAAK,CAAC,CAAC,eAAe;QAG9D,IAAI,CAAC,MAAM,GAAG;YACZ,WAAW,EAAE,wBAAwB;YACrC,UAAU,EAAE,IAAI;YAChB,iBAAiB,EAAE,MAAM;YACzB,YAAY,EAAE,gBAAgB;YAC9B,GAAG,MAAM;SACV,CAAC;QAEF,gDAAgD;QAChD,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,SAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBAE/C,8DAA8D;gBAC9D,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBAC1E,MAAM,IAAI,KAAK,CAAC,qDAAqD,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;gBAC5F,CAAC;gBAED,iEAAiE;gBACjE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC/C,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACpC,4CAA4C;oBAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;wBAC1C,MAAM,IAAI,KAAK,CAAC,2EAA2E,QAAQ,GAAG,CAAC,CAAC;oBAC1G,CAAC;oBACD,iCAAiC;oBACjC,OAAO,CAAC,IAAI,CAAC,kEAAkE,QAAQ,yCAAyC,CAAC,CAAC;gBACpI,CAAC;gBAED,qDAAqD;gBACrD,IAAI,CAAC,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,KAAK,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC;oBACzH,MAAM,GAAG,CAAC;gBACZ,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,MAAM,CAAC,UAAU,yDAAyD,CAAC,CAAC;YAC/H,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAC,QAAkB;QAC/B,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3B,uCAAuC;YACvC,IAAI,IAAI,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;gBACjC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;oBAC5D,2CAA2C;oBAC3C,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;gBAClC,CAAC;qBAAM,CAAC;oBACN,iDAAiD;oBACjD,OAAO,IAAI,CAAC,cAAc,CAAC,yDAAyD,CAAC,CAAC;gBACxF,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC;QACD,qCAAqC;QACrC,OAAO,IAAI,CAAC,cAAc,CAAC,2DAA2D,CAAC,CAAC;IAC1F,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,cAAc,CAAC,QAAkB;QAC7C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACnE,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAExC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,UAAW,CAAC,CAAC;YAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAEzD,iCAAiC;YACjC,IAAI,CAAC,SAAS,EAAE,CAAC;YAEjB,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,kCAAkC;YAClC,IAAI,CAAC,SAAS,EAAE,CAAC;YAEjB,kCAAkC;YAClC,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,IAAI,CAAC,cAAc,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,aAAa,CAAC,QAAkB;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAY,EAAE,KAAK,CAAC,CAAC;YACxE,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,IAAI,CAAC,cAAc,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,kBAAkB,CAAC,MAAc,EAAE,KAA8B;QAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEpH,6BAA6B;QAC7B,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QAElE,uBAAuB;QACvB,MAAM,QAAQ,GAA2B,EAAE,CAAC;QAC5C,kEAAkE;QAClE,MAAM,KAAK,GAAkE,EAAE,CAAC;QAChF,gEAAgE;QAChE,MAAM,WAAW,GAAoD,EAAE,CAAC;QAExE,mDAAmD;QACnD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEvC,8CAA8C;QAC9C,MAAM,YAAY,GAAG,kCAAkC,CAAC;QACxD,IAAI,YAAY,CAAC;QACjB,OAAO,CAAC,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC3D,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC;QAED,uDAAuD;QACvD,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACnD,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,6CAA6C;YAC7C,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAClF,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC3E,MAAM,UAAU,GAAa,EAAE,CAAC;gBAChC,IAAI,MAAM,GAAG,EAAE,CAAC;gBAChB,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;oBAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;oBAC5D,IAAI,WAAW,EAAE,CAAC;wBAChB,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;oBAC1B,CAAC;yBAAM,CAAC;wBACN,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACxB,CAAC;gBACH,CAAC;gBACD,IAAI,MAAM,EAAE,CAAC;oBACX,WAAW,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC3C,CAAC;gBACD,SAAS;YACX,CAAC;YAED,sCAAsC;YACtC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAC9D,IAAI,CAAC,SAAS;gBAAE,SAAS;YAEzB,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI;iBAC1B,KAAK,CAAC,IAAI,CAAC;iBACX,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBAClB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;YAEnE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAC3C,CAAC;QAED,kDAAkD;QAClD,MAAM,WAAW,GAAG,EAAE,KAAK,EAAE,CAAC;QAE9B,yEAAyE;QACzE,MAAM,QAAQ,GAA2B,EAAE,GAAG,QAAQ,EAAE,CAAC;QAEzD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,kEAAkE;YAClE,kEAAkE;YAClE,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxF,qFAAqF;gBACrF,4EAA4E;gBAC5E,4DAA4D;gBAC5D,gFAAgF;gBAChF,kDAAkD;YACpD,CAAC;YACD,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC1D,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;YACpC,CAAC;QACH,CAAC;QAED,kBAAkB;QAClB,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;YAC7B,IAAI,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC;gBACxD,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,WAAW,CAAC;QAClD,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,sBAAsB,CAAC;QAEjE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,uBAAuB,QAAQ,EAAE,CAAC,CAAC;QAClD,CAAC;QAED,OAAO;YACL,QAAQ;YACR,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,QAAQ;YACnB,OAAO;SACR,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACK,kBAAkB,CAAC,UAAoB,EAAE,OAAgC;QAC/E,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEzC,mEAAmE;QACnE,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QAED,2DAA2D;QAC3D,+DAA+D;QAC/D,4EAA4E;QAC5E,MAAM,gBAAgB,GAAa,EAAE,CAAC;QACtC,MAAM,UAAU,GAAgF,EAAE,CAAC;QACnG,IAAI,WAAW,GAAgF,IAAI,CAAC;QAEpG,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;YAClE,IAAI,SAAS,EAAE,CAAC;gBACd,mCAAmC;gBACnC,IAAI,WAAW,EAAE,CAAC;oBAChB,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC/B,CAAC;gBACD,WAAW,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;YAC3F,CAAC;iBAAM,IAAI,WAAW,IAAI,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjF,yEAAyE;gBACzE,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvC,CAAC;iBAAM,CAAC;gBACN,mEAAmE;gBACnE,IAAI,WAAW,EAAE,CAAC;oBAChB,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;oBAC7B,WAAW,GAAG,IAAI,CAAC;gBACrB,CAAC;gBACD,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,IAAI,WAAW,EAAE,CAAC;YAChB,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/B,CAAC;QAED,0DAA0D;QAC1D,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;gBACjD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,2FAA2F;QAC3F,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;YACpE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;gBAAE,OAAO,KAAK,CAAC;YAE7C,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;gBACjC,iDAAiD;gBACjD,MAAM,YAAY,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;gBAC9D,MAAM,cAAc,GAAG,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CACnD,IAAI,CAAC,uBAAuB,CAAC,CAAC,EAAE,YAAY,CAAC,CAC9C,CAAC;gBACF,IAAI,cAAc,EAAE,CAAC;oBACnB,QAAQ,GAAG,IAAI,CAAC;oBAChB,MAAM;gBACR,CAAC;YACH,CAAC;YACD,IAAI,CAAC,QAAQ;gBAAE,OAAO,KAAK,CAAC;QAC9B,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACK,sBAAsB,CAAC,SAAiB,EAAE,OAAe;QAC/D,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,gBAAgB,OAAO,cAAc,CAAC,CAAC;QAChE,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACK,uBAAuB,CAAC,SAAiB,EAAE,OAAgC;QACjF,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,kCAAkC;QAClC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC3D,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YACpD,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACtD,OAAO,IAAI,KAAK,KAAK,CAAC;QACxB,CAAC;QAED,oCAAoC;QACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC5D,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACvD,OAAO,IAAI,KAAK,KAAK,CAAC;QACxB,CAAC;QAED,oCAAoC;QACpC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACtE,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YACtD,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACxD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YACxE,QAAQ,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,IAAI,KAAK,CAAC;gBAChC,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,IAAI,KAAK,CAAC;gBAChC,KAAK,GAAG,CAAC,CAAC,OAAO,IAAI,GAAG,KAAK,CAAC;gBAC9B,KAAK,GAAG,CAAC,CAAC,OAAO,IAAI,GAAG,KAAK,CAAC;YAChC,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAC3F,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC3D,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAC1C,OAAO,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,CAAC;QAED,gCAAgC;QAChC,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACvF,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YACzD,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAC1C,OAAO,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC;QAED,gCAAgC;QAChC,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACvF,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YACzD,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAC1C,OAAO,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC;QAED,gFAAgF;QAChF,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC5F,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YACtD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACjC,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;oBACrE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACzD,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAC5C,QAAQ,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtB,KAAK,IAAI,CAAC,CAAC,OAAO,GAAG,KAAK,KAAK,CAAC;gBAChC,KAAK,IAAI,CAAC,CAAC,OAAO,GAAG,KAAK,KAAK,CAAC;gBAChC,KAAK,GAAG,CAAC,CAAC,OAAO,GAAG,GAAG,KAAK,CAAC;gBAC7B,KAAK,GAAG,CAAC,CAAC,OAAO,GAAG,GAAG,KAAK,CAAC;gBAC7B,KAAK,IAAI,CAAC,CAAC,OAAO,GAAG,IAAI,KAAK,CAAC;gBAC/B,KAAK,IAAI,CAAC,CAAC,OAAO,GAAG,IAAI,KAAK,CAAC;YACjC,CAAC;QACH,CAAC;QAED,+DAA+D;QAC/D,MAAM,iBAAiB,GAAG,OAAO,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC/F,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;YACrC,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC7D,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAC1C,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC/B,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,0DAA0D;QAC1D,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACzG,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC1D,QAAQ,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1B,KAAK,WAAW,CAAC,CAAC,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC;gBACjD,KAAK,WAAW,CAAC,CAAC,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC;gBACjD,KAAK,YAAY,CAAC,CAAC,OAAO,OAAO,GAAG,KAAK,SAAS,CAAC;gBACnD,KAAK,UAAU,CAAC,CAAC,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC3D,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,IAAa,CAAC;YAClB,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrD,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;iBAAM,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;gBAC9B,IAAI,GAAG,IAAI,CAAC;YACd,CAAC;iBAAM,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBAC/B,IAAI,GAAG,KAAK,CAAC;YACf,CAAC;iBAAM,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;gBAC9B,IAAI,GAAG,IAAI,CAAC;YACd,CAAC;iBAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;gBACrD,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,iDAAiD;gBACjD,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YACnD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACtD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YACpD,OAAO,CAAC,GAAG,CAAC;QACd,CAAC;QAED,2BAA2B;QAC3B,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAChD,OAAO,CAAC,CAAC,GAAG,CAAC;QACf,CAAC;QAED,iDAAiD;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACK,YAAY,CAAC,IAAY,EAAE,OAAgC;QACjE,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED;;;OAGG;IACK,eAAe,CAAC,GAAW;QACjC,gBAAgB;QAChB,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC1C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;QAEjC,UAAU;QACV,IAAI,GAAG,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QAChC,IAAI,GAAG,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QAElC,OAAO;QACP,IAAI,GAAG,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QAEhC,SAAS;QACT,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,GAAG,CAAC;QAE1C,sCAAsC;QACtC,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,GAAG,CAAC,CAAC,oCAAoC;QAClD,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED,2CAA2C;IAC3C,UAAU,CAAC,QAAkB;QAC3B,OAAO;YACL,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;SAC9B,CAAC;IACJ,CAAC;IAED,wDAAwD;IACxD,gBAAgB,CAAC,QAAa,EAAE,QAAkB;QAChD,MAAM,MAAM,GAAG,QAAQ,EAAE,MAAM,CAAC;QAChC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,cAAc,CAAC,2BAA2B,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEzD,OAAO;YACL,QAAQ;YACR,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,YAAY;YACvC,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,uBAAuB;YACtD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAChD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;oBAC3C,CAAC,iBAAiB,QAAQ,EAAE,CAAC;YACtC,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;YAC3F,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC;IACJ,CAAC;IAED,sDAAsD;IACtD,iBAAiB,CAAC,QAA4B;QAC5C,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC;QAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACvE,OAAO,KAAuB,CAAC;QACjC,CAAC;QACD,sBAAsB;QACtB,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC;QAC5D,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC;QAC3D,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC;IACjD,CAAC;IAED,sDAAsD;IACtD,QAAQ,CAAC,GAAW,EAAE,IAAS,EAAE,SAAiB;QAChD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,MAAM,GAAG,IAAI,SAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;YAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAElC,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC;gBAC5B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,IAAI,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM;gBACrC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;iBAC1C;gBACD,OAAO,EAAE,SAAS;aACnB,EAAE,CAAC,GAAG,EAAE,EAAE;gBACT,IAAI,YAAY,GAAG,EAAE,CAAC;gBACtB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,YAAY,IAAI,KAAK,CAAC,CAAC;gBACzD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACjB,IAAI,CAAC;wBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;oBACpC,CAAC;oBAAC,MAAM,CAAC;wBACP,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;oBAChF,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACxB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxF,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChB,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,sEAAsE;IACtE,cAAc,CAAC,MAAc;QAC3B,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,MAAM;YACjD,OAAO,EAAE,cAAc;YACvB,SAAS,EAAE,cAAc;YACzB,OAAO,EAAE,CAAC,MAAM,CAAC;SAClB,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,kBAAkB,CAAC,IAAY;QACrC,MAAM,MAAM,GAA0C,EAAE,CAAC;QACzD,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACvB,2EAA2E;YAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACtC,IAAI,QAAQ,KAAK,CAAC,CAAC;gBAAE,MAAM;YAE3B,uEAAuE;YACvE,6DAA6D;YAC7D,IAAI,SAAS,GAAG,QAAQ,GAAG,CAAC,CAAC;YAC7B,+BAA+B;YAC/B,OAAO,SAAS,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,GAAG;gBAAE,SAAS,EAAE,CAAC;YAC9D,mFAAmF;YACnF,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACnC,IAAI,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAClD,IAAI,SAAS,GAAG,WAAW;gBAAE,SAAS,GAAG,WAAW,CAAC;;gBAChD,SAAS,EAAE,CAAC,CAAC,wBAAwB;YAE1C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YAExD,4DAA4D;YAC5D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzC,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC;gBACjB,SAAS;YACX,CAAC;YAED,uDAAuD;YACvD,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,IAAI,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC;YACrB,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACpC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACnB,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;oBACpD,QAAQ,GAAG,CAAC,QAAQ,CAAC;gBACvB,CAAC;qBAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACrB,IAAI,EAAE,KAAK,GAAG;wBAAE,KAAK,EAAE,CAAC;yBACnB,IAAI,EAAE,KAAK,GAAG;wBAAE,KAAK,EAAE,CAAC;gBAC/B,CAAC;gBACD,IAAI,KAAK,GAAG,CAAC;oBAAE,CAAC,EAAE,CAAC;YACrB,CAAC;YAED,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBAChB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACpD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC5B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;iBAAM,CAAC;gBACN,wBAAwB;gBACxB,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,wFAAwF;IAChF,WAAW,CAAC,GAAQ,EAAE,IAAY;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,OAAO,GAAG,GAAG,CAAC;QAClB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YAChE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,+CAA+C;IAC/C,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAClC,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,UAAU,EACnC,EAAE,KAAK,EAAE,EAAE,EAAE,EACb,IAAI,CACL,CAAC;YACF,OAAO,CAAC,CAAC,QAAQ,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,mEAAmE;IAC3D,SAAS;QACf,IAAI,CAAC,mBAAmB,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC;IAC/B,CAAC;IAED,2EAA2E;IACnE,SAAS;QACf,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC3B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,eAAe;QACb,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,YAAY;YACxB,QAAQ,EAAE,IAAI,CAAC,mBAAmB;YAClC,WAAW,EAAE,IAAI,CAAC,eAAe;SAClC,CAAC;IACJ,CAAC;IAED,oDAAoD;IACpD,YAAY;QACV,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC;QAC7B,IAAI,CAAC,mBAAmB,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED,4FAA4F;IACpF,gBAAgB,CAAC,QAAgB;QACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAEnG,sBAAsB;QACtB,IAAI,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC,CAAC,WAAW;YAC9C,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE;gBAAE,OAAO,IAAI,CAAC,CAAC,aAAa;YAC/C,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;gBAAE,OAAO,IAAI,CAAC,CAAC,gBAAgB;YACvF,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC,CAAC,iBAAiB;YACxE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC,CAAC,aAAa;YACpE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC,CAAC,YAAY;QAC/C,CAAC;QAED,sBAAsB;QACtB,IAAI,IAAI,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC,CAAC,WAAW;QAC5C,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,aAAa;QACpD,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,0BAA0B;QACjE,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,YAAY;QAEhD,oBAAoB;QACpB,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAE5D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,SAAS,KAAgB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;CAC/C;AAhxBD,8BAgxBC"}

package/dist/src/proxy/forward-proxy.d.ts

@@ -0,0 +1,30 @@
+import * as http from 'http';
+import { Gateway } from '../server/gateway';
+import { GatewayConfig } from '../types/config';
+import { ToolCall } from '../types/tool-call';
+/**
+ * Validate resolved IP is not private (SSRF protection) with DNS timeout.
+ * Returns the first valid resolved IP address for DNS pinning — the caller
+ * should connect to this IP instead of the hostname to prevent DNS rebinding.
+ */
+export declare function validateResolvedIP(hostname: string): Promise<string>;
+/** Build a synthetic ToolCall from an incoming proxy request */
+export declare function buildToolCallFromProxy(method: string, targetUrl: string, headers: Record<string, string>, body: string | undefined, workspaceId: string, actorId: string): ToolCall;
+export interface ForwardProxyServer {
+    server: http.Server;
+    listen: (port: number, callback?: () => void) => http.Server;
+    close: (callback?: (err?: Error) => void) => http.Server;
+}
+/**
+ * Create a forward HTTP proxy server that routes all requests through
+ * the Palaryn gateway pipeline (policy, DLP, budget, audit).
+ *
+ * Usage:
+ *   const proxy = createForwardProxy(gateway, config);
+ *   proxy.listen(3128);
+ *
+ * Clients configure:
+ *   HTTP_PROXY=http://workspace:apikey@localhost:3128
+ */
+export declare function createForwardProxy(gateway: Gateway, config: GatewayConfig): ForwardProxyServer;
+//# sourceMappingURL=forward-proxy.d.ts.map

package/dist/src/proxy/forward-proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forward-proxy.d.ts","sourceRoot":"","sources":["../../../src/proxy/forward-proxy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAM7B,OAAO,EAAE,OAAO,EAAoB,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAe,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AA2D9C;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA+BpE;AAaD,gEAAgE;AAChE,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,GACd,QAAQ,CA2CV;AA+QD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;IACpB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC;IAC7D,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC;CAC1D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,aAAa,GACpB,kBAAkB,CA8LpB"}

package/dist/src/proxy/forward-proxy.js

@@ -0,0 +1,580 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateResolvedIP = validateResolvedIP;
+exports.buildToolCallFromProxy = buildToolCallFromProxy;
+exports.createForwardProxy = createForwardProxy;
+const http = __importStar(require("http"));
+const https = __importStar(require("https"));
+const net = __importStar(require("net"));
+const dns = __importStar(require("dns"));
+const url_1 = require("url");
+const crypto_1 = require("crypto");
+const auth_1 = require("../middleware/auth");
+const http_executor_1 = require("../executor/http-executor");
+const logger_1 = require("../server/logger");
+/** Maximum accumulated response body for post-DLP scanning (50 MB) */
+const MAX_ACCUMULATED_BYTES = 50 * 1024 * 1024;
+/** DNS lookup timeout in ms */
+const DNS_LOOKUP_TIMEOUT_MS = 5000;
+/** Maximum request body size in bytes (10 MB) — prevents OOM DoS */
+const MAX_REQUEST_BODY_BYTES = 10 * 1024 * 1024;
+/** Global counter for total bytes being accumulated across all active proxy responses */
+let globalAccumulatedBytes = 0;
+/** Maximum total bytes accumulated across all concurrent proxy responses (500 MB) */
+const MAX_GLOBAL_ACCUMULATED_BYTES = 500 * 1024 * 1024;
+/** Headers that must never be forwarded or logged */
+const SENSITIVE_HEADERS = new Set([
+    'proxy-authorization', 'proxy-connection',
+    'x-palaryn-workspace', 'x-palaryn-actor',
+    'authorization', 'cookie', 'x-api-key',
+]);
+/** Map HTTP method to tool capability */
+function methodToCapability(method) {
+    switch (method.toUpperCase()) {
+        case 'GET':
+        case 'HEAD':
+        case 'OPTIONS':
+            return 'read';
+        case 'DELETE':
+            return 'delete';
+        default:
+            return 'write';
+    }
+}
+/** Check if a hostname matches a domain pattern (supports leading wildcard) */
+function matchesDomain(hostname, pattern) {
+    // Strip null bytes and normalize to prevent injection attacks
+    const clean = hostname.replace(/\0/g, '').toLowerCase().trim();
+    const cleanPattern = pattern.replace(/\0/g, '').toLowerCase().trim();
+    if (!clean || !cleanPattern)
+        return false;
+    if (cleanPattern === clean)
+        return true;
+    if (cleanPattern.startsWith('*.')) {
+        const suffix = cleanPattern.slice(2);
+        return clean === suffix || clean.endsWith('.' + suffix);
+    }
+    return false;
+}
+/** Check if a hostname matches any passthrough domain */
+function isPassthrough(hostname, patterns) {
+    return patterns.some(p => matchesDomain(hostname, p));
+}
+/**
+ * Validate resolved IP is not private (SSRF protection) with DNS timeout.
+ * Returns the first valid resolved IP address for DNS pinning — the caller
+ * should connect to this IP instead of the hostname to prevent DNS rebinding.
+ */
+function validateResolvedIP(hostname) {
+    if (net.isIP(hostname)) {
+        if ((0, http_executor_1.isPrivateIP)(hostname)) {
+            return Promise.reject(new Error(`SSRF blocked: IP ${hostname} is a private/reserved address`));
+        }
+        return Promise.resolve(hostname);
+    }
+    const dnsPromise = new Promise((resolve, reject) => {
+        dns.lookup(hostname, { all: true }, (err, addresses) => {
+            if (err)
+                return reject(err);
+            if (!addresses || addresses.length === 0) {
+                return reject(new Error(`DNS lookup failed: no addresses found for "${hostname}"`));
+            }
+            for (const addr of addresses) {
+                if ((0, http_executor_1.isPrivateIP)(addr.address)) {
+                    return reject(new Error(`SSRF blocked: hostname "${hostname}" resolved to private IP ${addr.address}`));
+                }
+            }
+            // Return the first resolved IP for DNS pinning
+            resolve(addresses[0].address);
+        });
+    });
+    const timeoutPromise = new Promise((_, reject) => {
+        setTimeout(() => reject(new Error(`DNS lookup timeout for "${hostname}" after ${DNS_LOOKUP_TIMEOUT_MS}ms`)), DNS_LOOKUP_TIMEOUT_MS);
+    });
+    return Promise.race([dnsPromise, timeoutPromise]);
+}
+/** Strip sensitive headers from a headers record */
+function stripSensitiveHeaders(headers) {
+    const result = {};
+    for (const [key, value] of Object.entries(headers)) {
+        if (!SENSITIVE_HEADERS.has(key.toLowerCase())) {
+            result[key] = value;
+        }
+    }
+    return result;
+}
+/** Build a synthetic ToolCall from an incoming proxy request */
+function buildToolCallFromProxy(method, targetUrl, headers, body, workspaceId, actorId) {
+    const parsedUrl = new url_1.URL(targetUrl);
+    const toolName = `http.${method.toLowerCase()}`;
+    // Remove sensitive headers before forwarding
+    const forwardHeaders = stripSensitiveHeaders(headers);
+    // Parse body if it looks like JSON
+    let parsedBody = body;
+    if (body && typeof body === 'string') {
+        try {
+            parsedBody = JSON.parse(body);
+        }
+        catch (_e) {
+            /* Not valid JSON — keep body as raw string */
+        }
+    }
+    return {
+        tool_call_id: (0, crypto_1.randomUUID)(),
+        task_id: (0, crypto_1.randomUUID)(),
+        workspace_id: workspaceId,
+        actor: {
+            type: 'agent',
+            id: actorId,
+        },
+        source: {
+            platform: 'forward_proxy',
+        },
+        tool: {
+            name: toolName,
+            capability: methodToCapability(method),
+        },
+        args: {
+            method: method.toUpperCase(),
+            url: targetUrl,
+            headers: forwardHeaders,
+            body: parsedBody,
+        },
+        context: {
+            purpose: 'Proxied HTTP request',
+            labels: ['proxy', parsedUrl.hostname],
+        },
+    };
+}
+/** Forward the request to the target and pipe the response back.
+ *  When pinnedIP is provided (from SSRF DNS validation), the TCP connection
+ *  goes to that IP while the Host header and TLS SNI use the original hostname,
+ *  preventing DNS rebinding attacks.
+ */
+function forwardRequest(method, targetUrl, headers, body, clientRes, gateway, toolCall, pre, timeoutMs, pinnedIP) {
+    const parsedUrl = new url_1.URL(targetUrl);
+    const isHttps = parsedUrl.protocol === 'https:';
+    const transport = isHttps ? https : http;
+    // Strip sensitive headers, then set host
+    const forwardHeaders = stripSensitiveHeaders(headers);
+    forwardHeaders['host'] = parsedUrl.host;
+    const requestOptions = {
+        // Use pinned IP for the actual connection to prevent DNS rebinding
+        hostname: pinnedIP || parsedUrl.hostname,
+        port: parsedUrl.port || (isHttps ? 443 : 80),
+        path: parsedUrl.pathname + parsedUrl.search,
+        method: method.toUpperCase(),
+        headers: forwardHeaders,
+        timeout: timeoutMs,
+    };
+    // When using a pinned IP with HTTPS, set servername for correct TLS SNI
+    if (pinnedIP && isHttps) {
+        requestOptions.servername = parsedUrl.hostname;
+    }
+    // Pin DNS resolution to the pre-validated IP to prevent TOCTOU rebinding
+    if (pinnedIP) {
+        const family = pinnedIP.includes(':') ? 6 : 4;
+        const agent = new (isHttps ? https : http).Agent({
+            lookup: (_hostname, _options, callback) => {
+                callback(null, pinnedIP, family);
+            },
+        });
+        requestOptions.agent = agent;
+    }
+    const proxyReq = transport.request(requestOptions, (upstreamRes) => {
+        const httpStatus = upstreamRes.statusCode || 502;
+        // Collect response headers
+        const responseHeaders = {};
+        for (const [key, value] of Object.entries(upstreamRes.headers)) {
+            if (value)
+                responseHeaders[key] = Array.isArray(value) ? value.join(', ') : value;
+        }
+        // Remove hop-by-hop headers
+        delete responseHeaders['transfer-encoding'];
+        delete responseHeaders['connection'];
+        delete responseHeaders['keep-alive'];
+        delete responseHeaders['proxy-authenticate'];
+        delete responseHeaders['proxy-authorization'];
+        delete responseHeaders['upgrade'];
+        // Write status and headers to client
+        clientRes.writeHead(httpStatus, responseHeaders);
+        // Accumulate response body for post-DLP
+        let accumulated = '';
+        let accumulatedBytes = 0;
+        let truncated = false;
+        upstreamRes.on('data', (chunk) => {
+            clientRes.write(chunk);
+            accumulatedBytes += chunk.length;
+            globalAccumulatedBytes += chunk.length;
+            if (accumulatedBytes <= MAX_ACCUMULATED_BYTES && globalAccumulatedBytes <= MAX_GLOBAL_ACCUMULATED_BYTES) {
+                accumulated += chunk.toString();
+            }
+            else if (!truncated) {
+                truncated = true;
+                const reason = globalAccumulatedBytes > MAX_GLOBAL_ACCUMULATED_BYTES
+                    ? `global accumulated bytes (${MAX_GLOBAL_ACCUMULATED_BYTES})`
+                    : `per-request limit (${MAX_ACCUMULATED_BYTES})`;
+                logger_1.logger.warn(`Response body truncated at ${reason} bytes for DLP scan`, { component: 'forward-proxy', target: targetUrl });
+            }
+        });
+        upstreamRes.on('end', () => {
+            clientRes.end();
+            globalAccumulatedBytes = Math.max(0, globalAccumulatedBytes - accumulatedBytes);
+            // Run post-execute pipeline in background (DLP scan, budget recording, audit)
+            gateway.postExecute(toolCall, {
+                http_status: httpStatus,
+                body: accumulated,
+                headers: responseHeaders,
+            }, pre).catch(err => {
+                logger_1.logger.error('postExecute failed', { component: 'forward-proxy', error: err instanceof Error ? err.message : String(err) });
+            });
+        });
+        upstreamRes.on('error', (err) => {
+            // Release accumulated bytes to prevent counter leak on error
+            globalAccumulatedBytes = Math.max(0, globalAccumulatedBytes - accumulatedBytes);
+            if (!clientRes.headersSent) {
+                clientRes.writeHead(502, { 'Content-Type': 'application/json' });
+            }
+            clientRes.end(JSON.stringify({ error: `Upstream error: ${err.message}` }));
+        });
+    });
+    proxyReq.on('error', (err) => {
+        if (!clientRes.headersSent) {
+            clientRes.writeHead(502, { 'Content-Type': 'application/json' });
+        }
+        clientRes.end(JSON.stringify({ error: `Proxy connection failed: ${err.message}` }));
+    });
+    proxyReq.on('timeout', () => {
+        proxyReq.destroy();
+        if (!clientRes.headersSent) {
+            clientRes.writeHead(504, { 'Content-Type': 'application/json' });
+        }
+        clientRes.end(JSON.stringify({ error: `Upstream request timeout after ${timeoutMs}ms` }));
+    });
+    // Handle client disconnect
+    clientRes.on('close', () => {
+        if (!proxyReq.destroyed) {
+            proxyReq.destroy();
+        }
+    });
+    if (body) {
+        proxyReq.write(body);
+    }
+    proxyReq.end();
+}
+/**
+ * Handle a CONNECT tunnel request (HTTPS).
+ * Phase 1: Domain-level policy only — no content inspection.
+ * Builds a synthetic ToolCall for policy evaluation, then either
+ * establishes a TCP tunnel or returns 403.
+ */
+async function handleConnect(req, socket, head, gateway, config, proxyConfig) {
+    const target = req.url || '';
+    const [hostname, portStr] = target.split(':');
+    const port = parseInt(portStr, 10) || 443;
+    // Auth
+    const headers = {};
+    for (const [key, value] of Object.entries(req.headers)) {
+        if (typeof value === 'string')
+            headers[key] = value;
+    }
+    const auth = (0, auth_1.parseProxyAuth)(headers, proxyConfig, config.auth);
+    if (!auth.authenticated) {
+        socket.write('HTTP/1.1 407 Proxy Authentication Required\r\n');
+        socket.write('Proxy-Authenticate: Basic realm="Palaryn Proxy"\r\n');
+        socket.write('Content-Type: application/json\r\n\r\n');
+        socket.write(JSON.stringify({ error: auth.error }));
+        socket.end();
+        return;
+    }
+    // Passthrough domains skip policy entirely
+    if (proxyConfig.passthrough_domains && isPassthrough(hostname, proxyConfig.passthrough_domains)) {
+        return establishTunnel(hostname, port, socket, head);
+    }
+    // Build a synthetic ToolCall for domain-level policy evaluation
+    const toolCall = buildToolCallFromProxy('CONNECT', `https://${hostname}:${port}`, headers, undefined, auth.workspace_id, auth.actor_id);
+    // Run pre-execute pipeline (policy, rate limit, etc.)
+    try {
+        const pre = await gateway.preExecute(toolCall);
+        if (!pre.allowed) {
+            const reason = pre.result?.error || pre.result?.policy?.reasons?.join(', ') || 'Blocked by policy';
+            socket.write('HTTP/1.1 403 Forbidden\r\n');
+            socket.write('Content-Type: application/json\r\n\r\n');
+            socket.write(JSON.stringify({ error: reason }));
+            socket.end();
+            return;
+        }
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : 'Policy evaluation failed';
+        socket.write('HTTP/1.1 500 Internal Server Error\r\n');
+        socket.write('Content-Type: application/json\r\n\r\n');
+        socket.write(JSON.stringify({ error: message }));
+        socket.end();
+        return;
+    }
+    // SSRF protection with DNS pinning
+    let connectHost = hostname;
+    if (proxyConfig.ssrf_protection !== false) {
+        try {
+            connectHost = await validateResolvedIP(hostname);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : 'SSRF blocked';
+            socket.write('HTTP/1.1 403 Forbidden\r\n');
+            socket.write('Content-Type: application/json\r\n\r\n');
+            socket.write(JSON.stringify({ error: message }));
+            socket.end();
+            return;
+        }
+    }
+    return establishTunnel(connectHost, port, socket, head);
+}
+/** Establish a raw TCP tunnel for CONNECT requests */
+function establishTunnel(hostname, port, clientSocket, head) {
+    return new Promise((resolve, reject) => {
+        const upstream = net.connect(port, hostname, () => {
+            clientSocket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
+            if (head.length > 0) {
+                upstream.write(head);
+            }
+            upstream.pipe(clientSocket);
+            clientSocket.pipe(upstream);
+            resolve();
+        });
+        upstream.on('error', (err) => {
+            clientSocket.write('HTTP/1.1 502 Bad Gateway\r\n\r\n');
+            clientSocket.end();
+            resolve(); // Don't reject — just close the tunnel
+        });
+        clientSocket.on('error', () => {
+            upstream.destroy();
+            resolve();
+        });
+        // Timeout for tunnel establishment
+        upstream.setTimeout(30000, () => {
+            upstream.destroy();
+            clientSocket.write('HTTP/1.1 504 Gateway Timeout\r\n\r\n');
+            clientSocket.end();
+            resolve();
+        });
+    });
+}
+/**
+ * Create a forward HTTP proxy server that routes all requests through
+ * the Palaryn gateway pipeline (policy, DLP, budget, audit).
+ *
+ * Usage:
+ *   const proxy = createForwardProxy(gateway, config);
+ *   proxy.listen(3128);
+ *
+ * Clients configure:
+ *   HTTP_PROXY=http://workspace:apikey@localhost:3128
+ */
+function createForwardProxy(gateway, config) {
+    const proxyConfig = config.proxy || {
+        enabled: true,
+        port: 3128,
+        require_auth: true,
+    };
+    const timeoutMs = config.executor?.http?.timeout_ms || 15000;
+    const ssrfEnabled = proxyConfig.ssrf_protection !== false; // default: true
+    const server = http.createServer(async (req, res) => {
+        try {
+            // Proxy requests have absolute URLs: GET http://example.com/path HTTP/1.1
+            const targetUrl = req.url || '';
+            // Non-proxy requests (relative URL) get a 400
+            if (!targetUrl.startsWith('http://') && !targetUrl.startsWith('https://')) {
+                res.writeHead(400, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({
+                    error: 'Not a proxy request. Use this server as an HTTP proxy (HTTP_PROXY env var).',
+                }));
+                return;
+            }
+            const method = (req.method || 'GET').toUpperCase();
+            const parsedUrl = new url_1.URL(targetUrl);
+            // Extract headers as flat record
+            const headers = {};
+            for (const [key, value] of Object.entries(req.headers)) {
+                if (typeof value === 'string')
+                    headers[key] = value;
+                else if (Array.isArray(value))
+                    headers[key] = value.join(', ');
+            }
+            // Auth
+            const auth = (0, auth_1.parseProxyAuth)(headers, proxyConfig, config.auth);
+            if (!auth.authenticated) {
+                res.writeHead(407, {
+                    'Content-Type': 'application/json',
+                    'Proxy-Authenticate': 'Basic realm="Palaryn Proxy"',
+                });
+                res.end(JSON.stringify({ error: auth.error }));
+                return;
+            }
+            // Passthrough domains skip policy eval and DLP, but still run rate limiting and audit
+            if (proxyConfig.passthrough_domains && isPassthrough(parsedUrl.hostname, proxyConfig.passthrough_domains)) {
+                const bodyChunks = [];
+                let requestBodyBytes = 0;
+                let bodyAborted = false;
+                req.on('data', (chunk) => {
+                    if (bodyAborted)
+                        return;
+                    requestBodyBytes += chunk.length;
+                    if (requestBodyBytes > MAX_REQUEST_BODY_BYTES) {
+                        bodyAborted = true;
+                        req.destroy();
+                        res.writeHead(413, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'Request body too large', error_code: 'VALIDATION_FAILED' }));
+                        return;
+                    }
+                    bodyChunks.push(chunk);
+                });
+                req.on('end', async () => {
+                    if (bodyAborted)
+                        return;
+                    const body = bodyChunks.length > 0 ? Buffer.concat(bodyChunks).toString() : undefined;
+                    const toolCall = buildToolCallFromProxy(method, targetUrl, headers, body, auth.workspace_id, auth.actor_id);
+                    // Rate limit check even for passthrough domains
+                    const rateLimiter = gateway.getRateLimiter();
+                    const rateLimitResult = rateLimiter.check(toolCall);
+                    if (!rateLimitResult.allowed) {
+                        res.writeHead(429, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({
+                            error: `Rate limit exceeded (${rateLimitResult.blocked_by}): ${rateLimitResult.current}/${rateLimitResult.limit} requests in window`,
+                            error_code: 'RATE_LIMIT_EXCEEDED',
+                        }));
+                        return;
+                    }
+                    // Audit logging for passthrough domains
+                    const auditLogger = gateway.getAuditLogger();
+                    auditLogger.logToolCallReceived(toolCall);
+                    const pre = { allowed: true, stepTimings: {}, startTime: Date.now() };
+                    forwardRequest(method, targetUrl, headers, body, res, gateway, toolCall, pre, timeoutMs);
+                });
+                return;
+            }
+            // Read request body with size limit
+            const bodyChunks = [];
+            let requestBodyBytes = 0;
+            let bodyAborted = false;
+            req.on('data', (chunk) => {
+                if (bodyAborted)
+                    return;
+                requestBodyBytes += chunk.length;
+                if (requestBodyBytes > MAX_REQUEST_BODY_BYTES) {
+                    bodyAborted = true;
+                    req.destroy();
+                    res.writeHead(413, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'Request body too large', error_code: 'VALIDATION_FAILED' }));
+                    return;
+                }
+                bodyChunks.push(chunk);
+            });
+            req.on('end', async () => {
+                if (bodyAborted)
+                    return;
+                const body = bodyChunks.length > 0 ? Buffer.concat(bodyChunks).toString() : undefined;
+                // Build synthetic ToolCall
+                const toolCall = buildToolCallFromProxy(method, targetUrl, headers, body, auth.workspace_id, auth.actor_id);
+                // SSRF protection with DNS pinning
+                let pinnedIP;
+                if (ssrfEnabled) {
+                    try {
+                        pinnedIP = await validateResolvedIP(parsedUrl.hostname);
+                    }
+                    catch (err) {
+                        const message = err instanceof Error ? err.message : 'SSRF blocked';
+                        res.writeHead(403, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: message }));
+                        return;
+                    }
+                }
+                // Run pre-execute pipeline (rate limit, anomaly, policy, DLP, budget)
+                try {
+                    const pre = await gateway.preExecute(toolCall);
+                    if (!pre.allowed) {
+                        const status = pre.result?.status === 'needs_approval' ? 202 : 403;
+                        res.writeHead(status, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify(pre.result));
+                        return;
+                    }
+                    // Forward the request to the target
+                    // Use the processed tool call args (may have been transformed by policy)
+                    const forwardBody = pre.processedToolCall
+                        ? (typeof pre.processedToolCall.args.body === 'string'
+                            ? pre.processedToolCall.args.body
+                            : pre.processedToolCall.args.body ? JSON.stringify(pre.processedToolCall.args.body) : body)
+                        : body;
+                    const forwardHeaders = pre.processedToolCall?.args.headers || headers;
+                    forwardRequest(method, targetUrl, forwardHeaders, forwardBody, res, gateway, toolCall, pre, timeoutMs, pinnedIP);
+                }
+                catch (err) {
+                    const message = err instanceof Error ? err.message : 'Internal proxy error';
+                    if (!res.headersSent) {
+                        res.writeHead(500, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: message }));
+                    }
+                }
+            });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : 'Internal proxy error';
+            if (!res.headersSent) {
+                res.writeHead(500, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: message }));
+            }
+        }
+    });
+    // Handle CONNECT method for HTTPS tunneling
+    server.on('connect', (req, socket, head) => {
+        handleConnect(req, socket, head, gateway, config, proxyConfig).catch(err => {
+            logger_1.logger.error('CONNECT handler error', { component: 'forward-proxy', error: err instanceof Error ? err.message : String(err) });
+            try {
+                socket.write('HTTP/1.1 500 Internal Server Error\r\n\r\n');
+                socket.end();
+            }
+            catch (e) {
+                /* Socket already closed — expected when client disconnects */
+            }
+        });
+    });
+    return {
+        server,
+        listen: (port, callback) => server.listen(port, callback),
+        close: (callback) => server.close(callback),
+    };
+}
+//# sourceMappingURL=forward-proxy.js.map