payload-mcp-toolkit 0.7.0 → 0.7.4

package/dist/__tests__/url-validator.test.js

@@ -1,326 +0,0 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import dns from 'node:dns';
-import { isPrivateIp, validateAndFetchUrl } from '../url-validator';
-// ─── isPrivateIp — pure unit tests ────────────────────────────────
-describe('isPrivateIp', ()=>{
-    describe('IPv4 — blocked ranges', ()=>{
-        it.each([
-            [
-                '10.0.0.1',
-                '10.0.0.0/8'
-            ],
-            [
-                '10.255.255.255',
-                '10.0.0.0/8 upper'
-            ],
-            [
-                '172.16.0.1',
-                '172.16.0.0/12 lower'
-            ],
-            [
-                '172.20.5.5',
-                '172.16.0.0/12 mid'
-            ],
-            [
-                '172.31.255.255',
-                '172.16.0.0/12 upper'
-            ],
-            [
-                '192.168.1.1',
-                '192.168.0.0/16'
-            ],
-            [
-                '127.0.0.1',
-                '127.0.0.0/8 loopback'
-            ],
-            [
-                '127.255.255.255',
-                '127.0.0.0/8 upper'
-            ],
-            [
-                '169.254.169.254',
-                '169.254.0.0/16 — AWS metadata'
-            ],
-            [
-                '0.0.0.0',
-                'unspecified — 0.0.0.0/8'
-            ],
-            [
-                '0.0.0.1',
-                '0.0.0.0/8 not just :0'
-            ],
-            [
-                '0.255.255.255',
-                '0.0.0.0/8 upper'
-            ],
-            [
-                '100.64.0.0',
-                '100.64.0.0/10 — CGNAT lower'
-            ],
-            [
-                '100.100.50.50',
-                '100.64.0.0/10 — CGNAT mid'
-            ],
-            [
-                '100.127.255.255',
-                '100.64.0.0/10 — CGNAT upper'
-            ]
-        ])('blocks %s (%s)', (ip)=>{
-            expect(isPrivateIp(ip)).toBe(true);
-        });
-    });
-    describe('IPv4 — public (allowed)', ()=>{
-        it.each([
-            [
-                '8.8.8.8'
-            ],
-            [
-                '1.1.1.1'
-            ],
-            [
-                '172.15.0.1'
-            ],
-            [
-                '172.32.0.1'
-            ],
-            [
-                '11.0.0.1'
-            ],
-            [
-                '192.169.1.1'
-            ],
-            [
-                '126.255.255.255'
-            ],
-            [
-                '128.0.0.1'
-            ],
-            [
-                '100.63.255.255'
-            ],
-            [
-                '100.128.0.0'
-            ],
-            [
-                '1.0.0.1'
-            ]
-        ])('allows %s', (ip)=>{
-            expect(isPrivateIp(ip)).toBe(false);
-        });
-    });
-    describe('IPv6 — blocked ranges', ()=>{
-        it.each([
-            [
-                '::1',
-                'loopback shorthand'
-            ],
-            [
-                '0:0:0:0:0:0:0:1',
-                'loopback expanded'
-            ],
-            [
-                '0000:0000:0000:0000:0000:0000:0000:0001',
-                'loopback fully expanded'
-            ],
-            [
-                'fc00::1',
-                'unique local fc'
-            ],
-            [
-                'fd12:3456:789a::1',
-                'unique local fd'
-            ],
-            [
-                'fe80::1',
-                'link-local'
-            ],
-            [
-                'FE80::1',
-                'link-local case-insensitive'
-            ],
-            [
-                'febf::1',
-                'link-local upper boundary fe80::/10'
-            ],
-            [
-                '::ffff:127.0.0.1',
-                'IPv4-mapped loopback'
-            ],
-            [
-                '::ffff:10.0.0.1',
-                'IPv4-mapped private 10/8'
-            ],
-            [
-                '::ffff:169.254.169.254',
-                'IPv4-mapped AWS metadata'
-            ],
-            [
-                '::ffff:100.64.0.1',
-                'IPv4-mapped CGNAT'
-            ],
-            [
-                '::127.0.0.1',
-                'IPv4-compat loopback'
-            ]
-        ])('blocks %s (%s)', (ip)=>{
-            expect(isPrivateIp(ip)).toBe(true);
-        });
-    });
-    describe('IPv6 — public (allowed)', ()=>{
-        it.each([
-            [
-                '2001:4860:4860::8888'
-            ],
-            [
-                '2606:4700:4700::1111'
-            ],
-            [
-                'ff00::1'
-            ],
-            [
-                '::ffff:8.8.8.8'
-            ],
-            [
-                'fec0::1'
-            ]
-        ])('allows %s', (ip)=>{
-            expect(isPrivateIp(ip)).toBe(false);
-        });
-    });
-});
-// ─── validateAndFetchUrl — integration with mocked DNS + fetch ────
-describe('validateAndFetchUrl', ()=>{
-    const originalFetch = globalThis.fetch;
-    let dnsLookupSpy;
-    beforeEach(()=>{
-        dnsLookupSpy = vi.spyOn(dns.promises, 'lookup');
-    });
-    afterEach(()=>{
-        vi.restoreAllMocks();
-        globalThis.fetch = originalFetch;
-    });
-    function mockDns(address, family = 4) {
-        dnsLookupSpy.mockResolvedValue({
-            address,
-            family
-        });
-    }
-    function mockFetch(impl) {
-        globalThis.fetch = vi.fn((url)=>Promise.resolve(impl(String(url))));
-    }
-    it('rejects non-HTTPS schemes', async ()=>{
-        await expect(validateAndFetchUrl('http://example.com/x.png')).rejects.toThrow(/HTTPS/);
-    });
-    it('rejects when DNS resolves to a private IPv4 (SSRF)', async ()=>{
-        mockDns('10.0.0.5');
-        await expect(validateAndFetchUrl('https://attacker.example/x.png')).rejects.toThrow(/SSRF blocked/);
-    });
-    it('rejects when DNS resolves to AWS metadata IP (SSRF)', async ()=>{
-        mockDns('169.254.169.254');
-        await expect(validateAndFetchUrl('https://metadata.example/x.png')).rejects.toThrow(/SSRF blocked/);
-    });
-    it('rejects when DNS resolves to ::1 (SSRF)', async ()=>{
-        mockDns('::1', 6);
-        await expect(validateAndFetchUrl('https://localhost.example/x.png')).rejects.toThrow(/SSRF blocked/);
-    });
-    it('fetches successfully when DNS resolves to a public IP', async ()=>{
-        mockDns('8.8.8.8');
-        mockFetch(()=>new Response(new Uint8Array([
-                1,
-                2,
-                3
-            ]), {
-                status: 200,
-                headers: {
-                    'content-type': 'image/png'
-                }
-            }));
-        const result = await validateAndFetchUrl('https://example.com/cat.png');
-        expect(result.contentType).toBe('image/png');
-        expect(result.filename).toBe('cat.png');
-        expect(result.buffer.length).toBe(3);
-    });
-    it('follows redirects and re-validates the redirect target', async ()=>{
-        let call = 0;
-        // First lookup: public. Second lookup (after redirect): private → must block.
-        dnsLookupSpy.mockImplementation(async ()=>{
-            call++;
-            return {
-                address: call === 1 ? '8.8.8.8' : '127.0.0.1',
-                family: 4
-            };
-        });
-        mockFetch((url)=>{
-            if (url === 'https://example.com/start') {
-                return new Response(null, {
-                    status: 302,
-                    headers: {
-                        location: 'https://internal.example/secret'
-                    }
-                });
-            }
-            throw new Error(`should not reach ${url} — redirect target must be blocked`);
-        });
-        await expect(validateAndFetchUrl('https://example.com/start')).rejects.toThrow(/SSRF blocked/);
-        expect(call).toBe(2);
-    });
-    it('caps redirect chains at maxRedirects', async ()=>{
-        mockDns('8.8.8.8');
-        mockFetch((url)=>new Response(null, {
-                status: 302,
-                headers: {
-                    location: url + '/again'
-                }
-            }));
-        await expect(validateAndFetchUrl('https://example.com/loop', {
-            maxRedirects: 2
-        })).rejects.toThrow(/Too many redirects/);
-    });
-    it('errors when a redirect response has no Location header', async ()=>{
-        mockDns('8.8.8.8');
-        mockFetch(()=>new Response(null, {
-                status: 302
-            }));
-        await expect(validateAndFetchUrl('https://example.com/x.png')).rejects.toThrow(/Location header/);
-    });
-    it('surfaces non-OK HTTP responses', async ()=>{
-        mockDns('8.8.8.8');
-        mockFetch(()=>new Response(null, {
-                status: 404,
-                statusText: 'Not Found'
-            }));
-        await expect(validateAndFetchUrl('https://example.com/x.png')).rejects.toThrow(/404/);
-    });
-    it('derives a UUID filename when the URL path has no extension', async ()=>{
-        mockDns('8.8.8.8');
-        mockFetch(()=>new Response(new Uint8Array([
-                0
-            ]), {
-                status: 200,
-                headers: {
-                    'content-type': 'image/jpeg'
-                }
-            }));
-        const result = await validateAndFetchUrl('https://example.com/no-extension');
-        expect(result.filename).toMatch(/\.jpg$/);
-        expect(result.filename).not.toBe('no-extension');
-    });
-    it('strips path traversal segments from derived filenames', async ()=>{
-        mockDns('8.8.8.8');
-        mockFetch(()=>new Response(new Uint8Array([
-                0
-            ]), {
-                status: 200,
-                headers: {
-                    'content-type': 'image/png'
-                }
-            }));
-        const result = await validateAndFetchUrl('https://example.com/foo/..%2Fevil.png');
-        // URL parser decodes %2F into /, so lastSegment ends up "..evil.png" after .. strip
-        expect(result.filename).not.toContain('..');
-        expect(result.filename).not.toContain('/');
-        expect(result.filename).not.toContain('\\');
-    });
-});
-
-//# sourceMappingURL=url-validator.test.js.map

package/dist/__tests__/url-validator.test.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/__tests__/url-validator.test.ts"],"sourcesContent":["import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'\nimport dns from 'node:dns'\nimport { isPrivateIp, validateAndFetchUrl } from '../url-validator'\n\n// ─── isPrivateIp — pure unit tests ────────────────────────────────\n\ndescribe('isPrivateIp', () => {\n  describe('IPv4 — blocked ranges', () => {\n    it.each([\n      ['10.0.0.1', '10.0.0.0/8'],\n      ['10.255.255.255', '10.0.0.0/8 upper'],\n      ['172.16.0.1', '172.16.0.0/12 lower'],\n      ['172.20.5.5', '172.16.0.0/12 mid'],\n      ['172.31.255.255', '172.16.0.0/12 upper'],\n      ['192.168.1.1', '192.168.0.0/16'],\n      ['127.0.0.1', '127.0.0.0/8 loopback'],\n      ['127.255.255.255', '127.0.0.0/8 upper'],\n      ['169.254.169.254', '169.254.0.0/16 — AWS metadata'],\n      ['0.0.0.0', 'unspecified — 0.0.0.0/8'],\n      ['0.0.0.1', '0.0.0.0/8 not just :0'],\n      ['0.255.255.255', '0.0.0.0/8 upper'],\n      ['100.64.0.0', '100.64.0.0/10 — CGNAT lower'],\n      ['100.100.50.50', '100.64.0.0/10 — CGNAT mid'],\n      ['100.127.255.255', '100.64.0.0/10 — CGNAT upper'],\n    ])('blocks %s (%s)', (ip) => {\n      expect(isPrivateIp(ip)).toBe(true)\n    })\n  })\n\n  describe('IPv4 — public (allowed)', () => {\n    it.each([\n      ['8.8.8.8'],\n      ['1.1.1.1'],\n      ['172.15.0.1'], // just outside 172.16/12\n      ['172.32.0.1'], // just outside 172.16/12\n      ['11.0.0.1'],\n      ['192.169.1.1'], // not 192.168\n      ['126.255.255.255'],\n      ['128.0.0.1'],\n      ['100.63.255.255'], // just below CGNAT\n      ['100.128.0.0'], // just above CGNAT\n      ['1.0.0.1'], // outside 0.0.0.0/8\n    ])('allows %s', (ip) => {\n      expect(isPrivateIp(ip)).toBe(false)\n    })\n  })\n\n  describe('IPv6 — blocked ranges', () => {\n    it.each([\n      ['::1', 'loopback shorthand'],\n      ['0:0:0:0:0:0:0:1', 'loopback expanded'],\n      ['0000:0000:0000:0000:0000:0000:0000:0001', 'loopback fully expanded'],\n      ['fc00::1', 'unique local fc'],\n      ['fd12:3456:789a::1', 'unique local fd'],\n      ['fe80::1', 'link-local'],\n      ['FE80::1', 'link-local case-insensitive'],\n      ['febf::1', 'link-local upper boundary fe80::/10'],\n      ['::ffff:127.0.0.1', 'IPv4-mapped loopback'],\n      ['::ffff:10.0.0.1', 'IPv4-mapped private 10/8'],\n      ['::ffff:169.254.169.254', 'IPv4-mapped AWS metadata'],\n      ['::ffff:100.64.0.1', 'IPv4-mapped CGNAT'],\n      ['::127.0.0.1', 'IPv4-compat loopback'],\n    ])('blocks %s (%s)', (ip) => {\n      expect(isPrivateIp(ip)).toBe(true)\n    })\n  })\n\n  describe('IPv6 — public (allowed)', () => {\n    it.each([\n      ['2001:4860:4860::8888'], // Google DNS\n      ['2606:4700:4700::1111'], // Cloudflare DNS\n      ['ff00::1'], // multicast — not in our private blocklist\n      ['::ffff:8.8.8.8'], // IPv4-mapped public\n      ['fec0::1'], // outside fe80::/10 (deprecated site-local, but not our match)\n    ])('allows %s', (ip) => {\n      expect(isPrivateIp(ip)).toBe(false)\n    })\n  })\n})\n\n// ─── validateAndFetchUrl — integration with mocked DNS + fetch ────\n\ndescribe('validateAndFetchUrl', () => {\n  const originalFetch = globalThis.fetch\n  let dnsLookupSpy: ReturnType<typeof vi.spyOn>\n\n  beforeEach(() => {\n    dnsLookupSpy = vi.spyOn(dns.promises, 'lookup')\n  })\n\n  afterEach(() => {\n    vi.restoreAllMocks()\n    globalThis.fetch = originalFetch\n  })\n\n  function mockDns(address: string, family: 4 | 6 = 4) {\n    dnsLookupSpy.mockResolvedValue({ address, family } as any)\n  }\n\n  function mockFetch(impl: (url: string) => Promise<Response> | Response) {\n    globalThis.fetch = vi.fn(((url: any) => Promise.resolve(impl(String(url)))) as any) as any\n  }\n\n  it('rejects non-HTTPS schemes', async () => {\n    await expect(validateAndFetchUrl('http://example.com/x.png')).rejects.toThrow(/HTTPS/)\n  })\n\n  it('rejects when DNS resolves to a private IPv4 (SSRF)', async () => {\n    mockDns('10.0.0.5')\n    await expect(validateAndFetchUrl('https://attacker.example/x.png')).rejects.toThrow(\n      /SSRF blocked/,\n    )\n  })\n\n  it('rejects when DNS resolves to AWS metadata IP (SSRF)', async () => {\n    mockDns('169.254.169.254')\n    await expect(validateAndFetchUrl('https://metadata.example/x.png')).rejects.toThrow(\n      /SSRF blocked/,\n    )\n  })\n\n  it('rejects when DNS resolves to ::1 (SSRF)', async () => {\n    mockDns('::1', 6)\n    await expect(validateAndFetchUrl('https://localhost.example/x.png')).rejects.toThrow(\n      /SSRF blocked/,\n    )\n  })\n\n  it('fetches successfully when DNS resolves to a public IP', async () => {\n    mockDns('8.8.8.8')\n    mockFetch(\n      () =>\n        new Response(new Uint8Array([1, 2, 3]), {\n          status: 200,\n          headers: { 'content-type': 'image/png' },\n        }),\n    )\n\n    const result = await validateAndFetchUrl('https://example.com/cat.png')\n    expect(result.contentType).toBe('image/png')\n    expect(result.filename).toBe('cat.png')\n    expect(result.buffer.length).toBe(3)\n  })\n\n  it('follows redirects and re-validates the redirect target', async () => {\n    let call = 0\n    // First lookup: public. Second lookup (after redirect): private → must block.\n    dnsLookupSpy.mockImplementation(async () => {\n      call++\n      return { address: call === 1 ? '8.8.8.8' : '127.0.0.1', family: 4 } as any\n    })\n\n    mockFetch((url) => {\n      if (url === 'https://example.com/start') {\n        return new Response(null, {\n          status: 302,\n          headers: { location: 'https://internal.example/secret' },\n        })\n      }\n      throw new Error(`should not reach ${url} — redirect target must be blocked`)\n    })\n\n    await expect(validateAndFetchUrl('https://example.com/start')).rejects.toThrow(\n      /SSRF blocked/,\n    )\n    expect(call).toBe(2)\n  })\n\n  it('caps redirect chains at maxRedirects', async () => {\n    mockDns('8.8.8.8')\n    mockFetch(\n      (url) =>\n        new Response(null, {\n          status: 302,\n          headers: { location: url + '/again' },\n        }),\n    )\n\n    await expect(\n      validateAndFetchUrl('https://example.com/loop', { maxRedirects: 2 }),\n    ).rejects.toThrow(/Too many redirects/)\n  })\n\n  it('errors when a redirect response has no Location header', async () => {\n    mockDns('8.8.8.8')\n    mockFetch(() => new Response(null, { status: 302 }))\n\n    await expect(validateAndFetchUrl('https://example.com/x.png')).rejects.toThrow(\n      /Location header/,\n    )\n  })\n\n  it('surfaces non-OK HTTP responses', async () => {\n    mockDns('8.8.8.8')\n    mockFetch(() => new Response(null, { status: 404, statusText: 'Not Found' }))\n\n    await expect(validateAndFetchUrl('https://example.com/x.png')).rejects.toThrow(/404/)\n  })\n\n  it('derives a UUID filename when the URL path has no extension', async () => {\n    mockDns('8.8.8.8')\n    mockFetch(\n      () =>\n        new Response(new Uint8Array([0]), {\n          status: 200,\n          headers: { 'content-type': 'image/jpeg' },\n        }),\n    )\n\n    const result = await validateAndFetchUrl('https://example.com/no-extension')\n    expect(result.filename).toMatch(/\\.jpg$/)\n    expect(result.filename).not.toBe('no-extension')\n  })\n\n  it('strips path traversal segments from derived filenames', async () => {\n    mockDns('8.8.8.8')\n    mockFetch(\n      () =>\n        new Response(new Uint8Array([0]), {\n          status: 200,\n          headers: { 'content-type': 'image/png' },\n        }),\n    )\n\n    const result = await validateAndFetchUrl('https://example.com/foo/..%2Fevil.png')\n    // URL parser decodes %2F into /, so lastSegment ends up \"..evil.png\" after .. strip\n    expect(result.filename).not.toContain('..')\n    expect(result.filename).not.toContain('/')\n    expect(result.filename).not.toContain('\\\\')\n  })\n})\n"],"names":["describe","it","expect","vi","beforeEach","afterEach","dns","isPrivateIp","validateAndFetchUrl","each","ip","toBe","originalFetch","globalThis","fetch","dnsLookupSpy","spyOn","promises","restoreAllMocks","mockDns","address","family","mockResolvedValue","mockFetch","impl","fn","url","Promise","resolve","String","rejects","toThrow","Response","Uint8Array","status","headers","result","contentType","filename","buffer","length","call","mockImplementation","location","Error","maxRedirects","statusText","toMatch","not","toContain"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,EAAE,EAAEC,MAAM,EAAEC,EAAE,EAAEC,UAAU,EAAEC,SAAS,QAAQ,SAAQ;AACxE,OAAOC,SAAS,WAAU;AAC1B,SAASC,WAAW,EAAEC,mBAAmB,QAAQ,mBAAkB;AAEnE,qEAAqE;AAErER,SAAS,eAAe;IACtBA,SAAS,yBAAyB;QAChCC,GAAGQ,IAAI,CAAC;YACN;gBAAC;gBAAY;aAAa;YAC1B;gBAAC;gBAAkB;aAAmB;YACtC;gBAAC;gBAAc;aAAsB;YACrC;gBAAC;gBAAc;aAAoB;YACnC;gBAAC;gBAAkB;aAAsB;YACzC;gBAAC;gBAAe;aAAiB;YACjC;gBAAC;gBAAa;aAAuB;YACrC;gBAAC;gBAAmB;aAAoB;YACxC;gBAAC;gBAAmB;aAAgC;YACpD;gBAAC;gBAAW;aAA0B;YACtC;gBAAC;gBAAW;aAAwB;YACpC;gBAAC;gBAAiB;aAAkB;YACpC;gBAAC;gBAAc;aAA8B;YAC7C;gBAAC;gBAAiB;aAA4B;YAC9C;gBAAC;gBAAmB;aAA8B;SACnD,EAAE,kBAAkB,CAACC;YACpBR,OAAOK,YAAYG,KAAKC,IAAI,CAAC;QAC/B;IACF;IAEAX,SAAS,2BAA2B;QAClCC,GAAGQ,IAAI,CAAC;YACN;gBAAC;aAAU;YACX;gBAAC;aAAU;YACX;gBAAC;aAAa;YACd;gBAAC;aAAa;YACd;gBAAC;aAAW;YACZ;gBAAC;aAAc;YACf;gBAAC;aAAkB;YACnB;gBAAC;aAAY;YACb;gBAAC;aAAiB;YAClB;gBAAC;aAAc;YACf;gBAAC;aAAU;SACZ,EAAE,aAAa,CAACC;YACfR,OAAOK,YAAYG,KAAKC,IAAI,CAAC;QAC/B;IACF;IAEAX,SAAS,yBAAyB;QAChCC,GAAGQ,IAAI,CAAC;YACN;gBAAC;gBAAO;aAAqB;YAC7B;gBAAC;gBAAmB;aAAoB;YACxC;gBAAC;gBAA2C;aAA0B;YACtE;gBAAC;gBAAW;aAAkB;YAC9B;gBAAC;gBAAqB;aAAkB;YACxC;gBAAC;gBAAW;aAAa;YACzB;gBAAC;gBAAW;aAA8B;YAC1C;gBAAC;gBAAW;aAAsC;YAClD;gBAAC;gBAAoB;aAAuB;YAC5C;gBAAC;gBAAmB;aAA2B;YAC/C;gBAAC;gBAA0B;aAA2B;YACtD;gBAAC;gBAAqB;aAAoB;YAC1C;gBAAC;gBAAe;aAAuB;SACxC,EAAE,kBAAkB,CAACC;YACpBR,OAAOK,YAAYG,KAAKC,IAAI,CAAC;QAC/B;IACF;IAEAX,SAAS,2BAA2B;QAClCC,GAAGQ,IAAI,CAAC;YACN;gBAAC;aAAuB;YACxB;gBAAC;aAAuB;YACxB;gBAAC;aAAU;YACX;gBAAC;aAAiB;YAClB;gBAAC;aAAU;SACZ,EAAE,aAAa,CAACC;YACfR,OAAOK,YAAYG,KAAKC,IAAI,CAAC;QAC/B;IACF;AACF;AAEA,qEAAqE;AAErEX,SAAS,uBAAuB;IAC9B,MAAMY,gBAAgBC,WAAWC,KAAK;IACtC,IAAIC;IAEJX,WAAW;QACTW,eAAeZ,GAAGa,KAAK,CAACV,IAAIW,QAAQ,EAAE;IACxC;IAEAZ,UAAU;QACRF,GAAGe,eAAe;QAClBL,WAAWC,KAAK,GAAGF;IACrB;IAEA,SAASO,QAAQC,OAAe,EAAEC,SAAgB,CAAC;QACjDN,aAAaO,iBAAiB,CAAC;YAAEF;YAASC;QAAO;IACnD;IAEA,SAASE,UAAUC,IAAmD;QACpEX,WAAWC,KAAK,GAAGX,GAAGsB,EAAE,CAAE,CAACC,MAAaC,QAAQC,OAAO,CAACJ,KAAKK,OAAOH;IACtE;IAEAzB,GAAG,6BAA6B;QAC9B,MAAMC,OAAOM,oBAAoB,6BAA6BsB,OAAO,CAACC,OAAO,CAAC;IAChF;IAEA9B,GAAG,sDAAsD;QACvDkB,QAAQ;QACR,MAAMjB,OAAOM,oBAAoB,mCAAmCsB,OAAO,CAACC,OAAO,CACjF;IAEJ;IAEA9B,GAAG,uDAAuD;QACxDkB,QAAQ;QACR,MAAMjB,OAAOM,oBAAoB,mCAAmCsB,OAAO,CAACC,OAAO,CACjF;IAEJ;IAEA9B,GAAG,2CAA2C;QAC5CkB,QAAQ,OAAO;QACf,MAAMjB,OAAOM,oBAAoB,oCAAoCsB,OAAO,CAACC,OAAO,CAClF;IAEJ;IAEA9B,GAAG,yDAAyD;QAC1DkB,QAAQ;QACRI,UACE,IACE,IAAIS,SAAS,IAAIC,WAAW;gBAAC;gBAAG;gBAAG;aAAE,GAAG;gBACtCC,QAAQ;gBACRC,SAAS;oBAAE,gBAAgB;gBAAY;YACzC;QAGJ,MAAMC,SAAS,MAAM5B,oBAAoB;QACzCN,OAAOkC,OAAOC,WAAW,EAAE1B,IAAI,CAAC;QAChCT,OAAOkC,OAAOE,QAAQ,EAAE3B,IAAI,CAAC;QAC7BT,OAAOkC,OAAOG,MAAM,CAACC,MAAM,EAAE7B,IAAI,CAAC;IACpC;IAEAV,GAAG,0DAA0D;QAC3D,IAAIwC,OAAO;QACX,8EAA8E;QAC9E1B,aAAa2B,kBAAkB,CAAC;YAC9BD;YACA,OAAO;gBAAErB,SAASqB,SAAS,IAAI,YAAY;gBAAapB,QAAQ;YAAE;QACpE;QAEAE,UAAU,CAACG;YACT,IAAIA,QAAQ,6BAA6B;gBACvC,OAAO,IAAIM,SAAS,MAAM;oBACxBE,QAAQ;oBACRC,SAAS;wBAAEQ,UAAU;oBAAkC;gBACzD;YACF;YACA,MAAM,IAAIC,MAAM,CAAC,iBAAiB,EAAElB,IAAI,kCAAkC,CAAC;QAC7E;QAEA,MAAMxB,OAAOM,oBAAoB,8BAA8BsB,OAAO,CAACC,OAAO,CAC5E;QAEF7B,OAAOuC,MAAM9B,IAAI,CAAC;IACpB;IAEAV,GAAG,wCAAwC;QACzCkB,QAAQ;QACRI,UACE,CAACG,MACC,IAAIM,SAAS,MAAM;gBACjBE,QAAQ;gBACRC,SAAS;oBAAEQ,UAAUjB,MAAM;gBAAS;YACtC;QAGJ,MAAMxB,OACJM,oBAAoB,4BAA4B;YAAEqC,cAAc;QAAE,IAClEf,OAAO,CAACC,OAAO,CAAC;IACpB;IAEA9B,GAAG,0DAA0D;QAC3DkB,QAAQ;QACRI,UAAU,IAAM,IAAIS,SAAS,MAAM;gBAAEE,QAAQ;YAAI;QAEjD,MAAMhC,OAAOM,oBAAoB,8BAA8BsB,OAAO,CAACC,OAAO,CAC5E;IAEJ;IAEA9B,GAAG,kCAAkC;QACnCkB,QAAQ;QACRI,UAAU,IAAM,IAAIS,SAAS,MAAM;gBAAEE,QAAQ;gBAAKY,YAAY;YAAY;QAE1E,MAAM5C,OAAOM,oBAAoB,8BAA8BsB,OAAO,CAACC,OAAO,CAAC;IACjF;IAEA9B,GAAG,8DAA8D;QAC/DkB,QAAQ;QACRI,UACE,IACE,IAAIS,SAAS,IAAIC,WAAW;gBAAC;aAAE,GAAG;gBAChCC,QAAQ;gBACRC,SAAS;oBAAE,gBAAgB;gBAAa;YAC1C;QAGJ,MAAMC,SAAS,MAAM5B,oBAAoB;QACzCN,OAAOkC,OAAOE,QAAQ,EAAES,OAAO,CAAC;QAChC7C,OAAOkC,OAAOE,QAAQ,EAAEU,GAAG,CAACrC,IAAI,CAAC;IACnC;IAEAV,GAAG,yDAAyD;QAC1DkB,QAAQ;QACRI,UACE,IACE,IAAIS,SAAS,IAAIC,WAAW;gBAAC;aAAE,GAAG;gBAChCC,QAAQ;gBACRC,SAAS;oBAAE,gBAAgB;gBAAY;YACzC;QAGJ,MAAMC,SAAS,MAAM5B,oBAAoB;QACzC,oFAAoF;QACpFN,OAAOkC,OAAOE,QAAQ,EAAEU,GAAG,CAACC,SAAS,CAAC;QACtC/C,OAAOkC,OAAOE,QAAQ,EAAEU,GAAG,CAACC,SAAS,CAAC;QACtC/C,OAAOkC,OAAOE,QAAQ,EAAEU,GAAG,CAACC,SAAS,CAAC;IACxC;AACF"}