safehands-pharos 1.4.0 → 2.6.0

package/dist/lib/guardian/decision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision.d.ts","sourceRoot":"","sources":["../../../src/lib/guardian/decision.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,gBAAgB,GACxB,OAAO,GACP,OAAO,GACP,sBAAsB,GACtB,cAAc,CAAC;AAEnB,eAAO,MAAM,kBAAkB,EAAE,SAAS,gBAAgB,EAKhD,CAAC;AAEX,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EACtB,OAAO,GAAE,wBAA6B,GACrC,gBAAgB,CAgBlB"}

package/dist/lib/guardian/decision.js

@@ -0,0 +1,40 @@
+// ─── SafeHands Decision Contract ──────────────────────────────
+// The public, four-value decision the SafeHands returns. The internal policy
+// engine keeps richer detail (reasons, checks, sub-status) for explanations,
+// but only these four values are exposed as the public decision.
+// ────────────────────────────────────────────────────────────────────────
+export const GUARDIAN_DECISIONS = [
+    "ALLOW",
+    "BLOCK",
+    "REQUIRE_CONFIRMATION",
+    "PREPARE_ONLY",
+];
+/**
+ * Map an internal engine decision to the public four-value SafeHands contract.
+ *
+ *   ALLOW                 -> ALLOW  (or PREPARE_ONLY when execution is unavailable)
+ *   BLOCK                 -> BLOCK
+ *   WARN                  -> REQUIRE_CONFIRMATION
+ *   REQUIRE_CONFIRMATION  -> REQUIRE_CONFIRMATION
+ *   REQUIRE_TOKEN_REVIEW  -> REQUIRE_CONFIRMATION
+ *   REQUIRE_FUNDING       -> PREPARE_ONLY
+ *   (anything unknown)    -> REQUIRE_CONFIRMATION  (fail safe — never a silent ALLOW)
+ */
+export function mapEngineDecision(engineDecision, options = {}) {
+    const executionAvailable = options.executionAvailable ?? true;
+    switch (engineDecision) {
+        case "ALLOW":
+            return executionAvailable ? "ALLOW" : "PREPARE_ONLY";
+        case "BLOCK":
+            return "BLOCK";
+        case "WARN":
+        case "REQUIRE_CONFIRMATION":
+        case "REQUIRE_TOKEN_REVIEW":
+            return "REQUIRE_CONFIRMATION";
+        case "REQUIRE_FUNDING":
+            return "PREPARE_ONLY";
+        default:
+            return "REQUIRE_CONFIRMATION";
+    }
+}
+//# sourceMappingURL=decision.js.map

package/dist/lib/guardian/decision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision.js","sourceRoot":"","sources":["../../../src/lib/guardian/decision.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,6EAA6E;AAC7E,6EAA6E;AAC7E,iEAAiE;AACjE,2EAA2E;AAQ3E,MAAM,CAAC,MAAM,kBAAkB,GAAgC;IAC7D,OAAO;IACP,OAAO;IACP,sBAAsB;IACtB,cAAc;CACN,CAAC;AAWX;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAC/B,cAAsB,EACtB,UAAoC,EAAE;IAEtC,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC;IAC9D,QAAQ,cAAc,EAAE,CAAC;QACvB,KAAK,OAAO;YACV,OAAO,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;QACvD,KAAK,OAAO;YACV,OAAO,OAAO,CAAC;QACjB,KAAK,MAAM,CAAC;QACZ,KAAK,sBAAsB,CAAC;QAC5B,KAAK,sBAAsB;YACzB,OAAO,sBAAsB,CAAC;QAChC,KAAK,iBAAiB;YACpB,OAAO,cAAc,CAAC;QACxB;YACE,OAAO,sBAAsB,CAAC;IAClC,CAAC;AACH,CAAC"}

package/dist/lib/http.d.ts

@@ -1,15 +1,14 @@
-export declare class HttpError extends Error {
-    readonly status?: number | undefined;
-    readonly statusText?: string | undefined;
-    constructor(message: string, status?: number | undefined, statusText?: string | undefined);
-}
-export interface FetchWithRetryOptions extends RequestInit {
-    timeoutMs?: number;
-    retries?: number;
-    retryDelayMs?: number;
-}
-export declare function fetchWithTimeoutAndRetry(url: string | URL, options?: FetchWithRetryOptions): Promise<Response>;
-export declare function redactSensitive(value: unknown): unknown;
-export declare function isBlockedIp(ip: string): boolean;
-export declare function assertSafeFetchUrl(rawUrl: string): Promise<void>;
+export declare class HttpError extends Error {
+    readonly status?: number | undefined;
+    readonly statusText?: string | undefined;
+    constructor(message: string, status?: number | undefined, statusText?: string | undefined);
+}
+export interface FetchWithRetryOptions extends RequestInit {
+    timeoutMs?: number;
+    retries?: number;
+    retryDelayMs?: number;
+}
+export declare function fetchWithTimeoutAndRetry(url: string | URL, options?: FetchWithRetryOptions): Promise<Response>;
+export declare function isBlockedIp(ip: string): boolean;
+export declare function assertSafeFetchUrl(rawUrl: string): Promise<void>;
 //# sourceMappingURL=http.d.ts.map

package/dist/lib/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/lib/http.ts"],"names":[],"mappings":"AAKA,qBAAa,SAAU,SAAQ,KAAK;aAGhB,MAAM,CAAC,EAAE,MAAM;aACf,UAAU,CAAC,EAAE,MAAM;gBAFnC,OAAO,EAAE,MAAM,EACC,MAAM,CAAC,EAAE,MAAM,YAAA,EACf,UAAU,CAAC,EAAE,MAAM,YAAA;CAKtC;AAED,MAAM,WAAW,qBAAsB,SAAQ,WAAW;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAUD,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,MAAM,GAAG,GAAG,EACjB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,QAAQ,CAAC,CA8BnB;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAIvD;AAeD,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CA4B/C;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BtE"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/lib/http.ts"],"names":[],"mappings":"AAOA,qBAAa,SAAU,SAAQ,KAAK;aAGhB,MAAM,CAAC,EAAE,MAAM;aACf,UAAU,CAAC,EAAE,MAAM;gBAFnC,OAAO,EAAE,MAAM,EACC,MAAM,CAAC,EAAE,MAAM,YAAA,EACf,UAAU,CAAC,EAAE,MAAM,YAAA;CAKtC;AAED,MAAM,WAAW,qBAAsB,SAAQ,WAAW;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAqED,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,MAAM,GAAG,GAAG,EACjB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,QAAQ,CAAC,CAsBnB;AAyMD,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CA4C/C;AAmED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBtE"}

package/dist/lib/http.js

@@ -1,119 +1,384 @@
-// ─── Safe HTTP Helpers ─────────────────────────────────────────────────
-import dns from "node:dns/promises";
-import net from "node:net";
-export class HttpError extends Error {
-    status;
-    statusText;
-    constructor(message, status, statusText) {
-        super(message);
-        this.status = status;
-        this.statusText = statusText;
-        this.name = "HttpError";
-    }
-}
-function sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-}
-function isRetryableStatus(status) {
-    return status === 408 || status === 425 || status === 429 || status === 500 || status === 502 || status === 503 || status === 504;
-}
-export async function fetchWithTimeoutAndRetry(url, options = {}) {
-    const { timeoutMs = 10_000, retries = 2, retryDelayMs = 250, ...requestInit } = options;
-    let lastError;
-    for (let attempt = 0; attempt <= retries; attempt++) {
-        const controller = new AbortController();
-        const timeout = setTimeout(() => controller.abort(), timeoutMs);
-        try {
-            const response = await fetch(url, {
-                ...requestInit,
-                signal: requestInit.signal ?? controller.signal,
-            });
-            if (!isRetryableStatus(response.status) || attempt === retries) {
-                return response;
-            }
-            lastError = new HttpError(`HTTP ${response.status} ${response.statusText}`, response.status, response.statusText);
-        }
-        catch (err) {
-            lastError = err;
-            if (attempt === retries)
-                throw err;
-        }
-        finally {
-            clearTimeout(timeout);
-        }
-        await sleep(retryDelayMs * (attempt + 1));
-    }
-    throw lastError instanceof Error ? lastError : new Error(String(lastError));
-}
-export function redactSensitive(value) {
-    if (typeof value !== "string")
-        return value;
-    if (value.length <= 10)
-        return "[REDACTED]";
-    return `${value.slice(0, 6)}...[REDACTED]`;
-}
-function ipv4ToNumber(ip) {
-    if (net.isIP(ip) !== 4)
-        return null;
-    return ip.split(".").reduce((acc, octet) => (acc << 8) + Number(octet), 0) >>> 0;
-}
-function ipv4InCidr(ip, cidrBase, prefix) {
-    const ipNum = ipv4ToNumber(ip);
-    const baseNum = ipv4ToNumber(cidrBase);
-    if (ipNum === null || baseNum === null)
-        return false;
-    const mask = prefix === 0 ? 0 : (0xffffffff << (32 - prefix)) >>> 0;
-    return (ipNum & mask) === (baseNum & mask);
-}
-export function isBlockedIp(ip) {
-    const version = net.isIP(ip);
-    if (version === 4) {
-        return (ipv4InCidr(ip, "0.0.0.0", 8) ||
-            ipv4InCidr(ip, "10.0.0.0", 8) ||
-            ipv4InCidr(ip, "127.0.0.0", 8) ||
-            ipv4InCidr(ip, "169.254.0.0", 16) ||
-            ipv4InCidr(ip, "172.16.0.0", 12) ||
-            ipv4InCidr(ip, "192.168.0.0", 16));
-    }
-    if (version === 6) {
-        const normalized = ip.toLowerCase();
-        return (normalized === "::1" ||
-            normalized.startsWith("fc") ||
-            normalized.startsWith("fd") ||
-            normalized.startsWith("fe80:") ||
-            normalized === "::" ||
-            normalized.startsWith("::ffff:127.") ||
-            normalized.startsWith("::ffff:10.") ||
-            normalized.startsWith("::ffff:192.168."));
-    }
-    return false;
-}
-export async function assertSafeFetchUrl(rawUrl) {
-    let parsed;
-    try {
-        parsed = new URL(rawUrl);
-    }
-    catch {
-        throw new Error("Invalid URL");
-    }
-    if (!["http:", "https:"].includes(parsed.protocol)) {
-        throw new Error("Only HTTP and HTTPS URLs are allowed");
-    }
-    const allowLocal = process.env.ALLOW_LOCAL_X402_FETCH === "true";
-    if (allowLocal)
-        return;
-    const host = parsed.hostname.toLowerCase();
-    if (host === "localhost" || host.endsWith(".localhost")) {
-        throw new Error("SSRF_BLOCKED: localhost is not allowed");
-    }
-    if (net.isIP(host) && isBlockedIp(host)) {
-        throw new Error(`SSRF_BLOCKED: blocked IP range (${host})`);
-    }
-    const lookupResults = await dns.lookup(host, { all: true });
-    for (const result of lookupResults) {
-        if (isBlockedIp(result.address)) {
-            throw new Error(`SSRF_BLOCKED: hostname resolves to blocked IP range (${result.address})`);
-        }
-    }
-}
+// ─── Safe HTTP Helpers ─────────────────────────────────────────────────
+import dns from "node:dns/promises";
+import * as http from "node:http";
+import * as https from "node:https";
+import net from "node:net";
+export class HttpError extends Error {
+    status;
+    statusText;
+    constructor(message, status, statusText) {
+        super(message);
+        this.status = status;
+        this.statusText = statusText;
+        this.name = "HttpError";
+    }
+}
+const MAX_SAFE_REDIRECTS = 5;
+const DNS_LOOKUP_TIMEOUT_MS = 2_500;
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function isRetryableStatus(status) {
+    return status === 408 || status === 425 || status === 429 || status === 500 || status === 502 || status === 503 || status === 504;
+}
+function headerPairs(headers) {
+    const pairs = [];
+    headers.forEach((value, key) => pairs.push(key, value));
+    return pairs;
+}
+function normalizeHeaders(headers) {
+    return new Headers(headers);
+}
+function isRedirectStatus(status) {
+    return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+function shouldRewriteRedirectToGet(status, method) {
+    const upper = method.toUpperCase();
+    return (status === 301 || status === 302 || status === 303) && upper !== "GET" && upper !== "HEAD";
+}
+async function bodyToBuffer(body) {
+    if (body == null)
+        return undefined;
+    if (typeof body === "string")
+        return Buffer.from(body);
+    if (body instanceof URLSearchParams)
+        return Buffer.from(body.toString());
+    if (body instanceof ArrayBuffer)
+        return Buffer.from(body);
+    if (ArrayBuffer.isView(body))
+        return Buffer.from(body.buffer, body.byteOffset, body.byteLength);
+    if (typeof Blob !== "undefined" && body instanceof Blob)
+        return Buffer.from(await body.arrayBuffer());
+    throw new Error("Unsupported request body type for SafeHands safe fetch.");
+}
+function responseFromNodeMessage(res, chunks) {
+    const headers = new Headers();
+    for (const [key, raw] of Object.entries(res.headers)) {
+        if (Array.isArray(raw)) {
+            for (const value of raw)
+                headers.append(key, value);
+        }
+        else if (raw !== undefined) {
+            headers.set(key, String(raw));
+        }
+    }
+    return new Response(Buffer.concat(chunks), {
+        status: res.statusCode || 0,
+        statusText: res.statusMessage || "",
+        headers,
+    });
+}
+export async function fetchWithTimeoutAndRetry(url, options = {}) {
+    const { timeoutMs = 10_000, retries = 2, retryDelayMs = 250, ...requestInit } = options;
+    let lastError;
+    for (let attempt = 0; attempt <= retries; attempt++) {
+        try {
+            const response = await safeFetchWithTimeout(url, requestInit, timeoutMs, 0);
+            if (!isRetryableStatus(response.status) || attempt === retries) {
+                return response;
+            }
+            lastError = new HttpError(`HTTP ${response.status} ${response.statusText}`, response.status, response.statusText);
+        }
+        catch (err) {
+            lastError = err;
+            if (attempt === retries)
+                throw err;
+        }
+        await sleep(retryDelayMs * (attempt + 1));
+    }
+    throw lastError instanceof Error ? lastError : new Error(String(lastError));
+}
+function isProductionEnv() {
+    return (process.env.NODE_ENV || "").toLowerCase() === "production";
+}
+/**
+ * ALLOW_LOCAL_X402_FETCH is a LOCAL-ONLY escape hatch. It is hard-disabled in
+ * production (NODE_ENV=production) and, even when set, it relaxes ONLY loopback
+ * (localhost / 127.0.0.0/8 / ::1). Cloud-metadata (169.254.169.254), RFC1918,
+ * CGNAT, and every other blocked range stay blocked via isBlockedIp regardless.
+ */
+function localFetchBypassEnabled() {
+    return process.env.ALLOW_LOCAL_X402_FETCH === "true" && !isProductionEnv();
+}
+/**
+ * Normalize a URL hostname for IP checks. WHATWG `URL.hostname` keeps the
+ * brackets around an IPv6 literal (e.g. "[::1]"), and net.isIP("[::1]") is 0 —
+ * so without stripping them a bracketed IPv6 literal skips isBlockedIp() and
+ * falls through to DNS. Strip the surrounding brackets so the bare address is
+ * seen by net.isIP / isBlockedIp.
+ */
+function normalizeHostname(hostname) {
+    const h = hostname.toLowerCase();
+    return h.startsWith("[") && h.endsWith("]") ? h.slice(1, -1) : h;
+}
+function isLoopbackHost(host) {
+    const h = normalizeHostname(host);
+    if (h === "localhost" || h.endsWith(".localhost"))
+        return true;
+    const version = net.isIP(h);
+    if (version === 4)
+        return ipv4InCidr(h, "127.0.0.0", 8);
+    if (version === 6)
+        return h === "::1" || h.startsWith("::ffff:127.");
+    return false;
+}
+async function safeFetchWithTimeout(url, init, timeoutMs, redirectCount) {
+    const parsed = typeof url === "string" ? new URL(url) : new URL(url.href);
+    // Local demo/test escape hatch, LOOPBACK-ONLY and never in production. Any
+    // non-loopback URL — including cloud-metadata IPs — falls through to the
+    // DNS-pinned, blocklist-enforcing path below, so the flag can no longer be
+    // used to reach internal/metadata endpoints.
+    if (localFetchBypassEnabled() && isLoopbackHost(parsed.hostname)) {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), timeoutMs);
+        try {
+            return await fetch(parsed, { ...init, signal: init.signal ?? controller.signal });
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+    const response = await safePinnedFetchOnce(parsed, init, timeoutMs);
+    const redirectMode = init.redirect ?? "follow";
+    if (redirectMode === "error" && isRedirectStatus(response.status)) {
+        throw new Error(`Redirect blocked by policy (${response.status}).`);
+    }
+    if (redirectMode !== "manual" && isRedirectStatus(response.status)) {
+        const location = response.headers.get("location");
+        if (!location)
+            return response;
+        if (redirectCount >= MAX_SAFE_REDIRECTS) {
+            throw new Error("Too many redirects.");
+        }
+        const nextUrl = new URL(location, parsed.href);
+        const method = (init.method || "GET").toUpperCase();
+        const nextInit = { ...init };
+        if (shouldRewriteRedirectToGet(response.status, method)) {
+            nextInit.method = "GET";
+            delete nextInit.body;
+            const headers = normalizeHeaders(nextInit.headers);
+            headers.delete("content-length");
+            headers.delete("content-type");
+            nextInit.headers = headers;
+        }
+        return safeFetchWithTimeout(nextUrl, nextInit, timeoutMs, redirectCount + 1);
+    }
+    return response;
+}
+async function safePinnedFetchOnce(parsed, init, timeoutMs) {
+    const target = await resolveSafeFetchTarget(parsed.href);
+    const body = await bodyToBuffer(init.body);
+    const headers = normalizeHeaders(init.headers);
+    if (body && !headers.has("content-length")) {
+        headers.set("content-length", String(body.byteLength));
+    }
+    return new Promise((resolve, reject) => {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => {
+            controller.abort();
+            reject(new DOMException("The operation was aborted.", "AbortError"));
+        }, timeoutMs);
+        if (init.signal) {
+            if (init.signal.aborted) {
+                clearTimeout(timeout);
+                reject(new DOMException("The operation was aborted.", "AbortError"));
+                return;
+            }
+            init.signal.addEventListener("abort", () => controller.abort(), { once: true });
+        }
+        const client = target.url.protocol === "https:" ? https : http;
+        const req = client.request(target.url, {
+            method: init.method || "GET",
+            headers: headerPairs(headers),
+            signal: controller.signal,
+            timeout: timeoutMs,
+            lookup: (_hostname, options, callback) => {
+                // DNS rebinding protection: connect only to the exact IP address that
+                // was resolved and verified immediately before this request.
+                //
+                // Node may call custom lookup with options.all=true. In that mode the
+                // callback must receive an array of addresses, not (address, family).
+                // Returning the one pinned safe address preserves SSRF protection.
+                const pinned = {
+                    address: target.address.address,
+                    family: target.address.family,
+                };
+                if (options?.all) {
+                    callback(null, [pinned]);
+                    return;
+                }
+                callback(null, pinned.address, pinned.family);
+            },
+        }, (res) => {
+            const chunks = [];
+            res.on("data", (chunk) => chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)));
+            res.on("end", () => {
+                clearTimeout(timeout);
+                resolve(responseFromNodeMessage(res, chunks));
+            });
+        });
+        req.on("timeout", () => req.destroy(new DOMException("The operation timed out.", "TimeoutError")));
+        req.on("error", (err) => {
+            clearTimeout(timeout);
+            reject(err);
+        });
+        if (body)
+            req.write(body);
+        req.end();
+    });
+}
+function ipv4ToNumber(ip) {
+    if (net.isIP(ip) !== 4)
+        return null;
+    return ip.split(".").reduce((acc, octet) => (acc << 8) + Number(octet), 0) >>> 0;
+}
+function ipv4InCidr(ip, cidrBase, prefix) {
+    const ipNum = ipv4ToNumber(ip);
+    const baseNum = ipv4ToNumber(cidrBase);
+    if (ipNum === null || baseNum === null)
+        return false;
+    const mask = prefix === 0 ? 0 : (0xffffffff << (32 - prefix)) >>> 0;
+    return (ipNum & mask) === (baseNum & mask);
+}
+/**
+ * Extract the embedded IPv4 from an IPv4-mapped IPv6 address, handling BOTH the
+ * dotted-decimal form (`::ffff:127.0.0.1`) and its canonical hex form
+ * (`::ffff:7f00:1`, which is what WHATWG `URL` produces). Returns null when the
+ * input is not a `::ffff:`-mapped address. This lets isBlockedIp() run the
+ * authoritative IPv4 CIDR table on the real octets instead of fragile textual
+ * prefix matching (which both missed the hex form and over-blocked public space
+ * like 172.2.0.0/16 via a "::ffff:172.2" prefix).
+ */
+function mappedIpv4(ipv6) {
+    const m = ipv6.toLowerCase().match(/^::ffff:(.+)$/);
+    if (!m)
+        return null;
+    const rest = m[1];
+    if (net.isIP(rest) === 4)
+        return rest; // dotted-decimal tail
+    const groups = rest.split(":");
+    if (groups.length === 2 && groups.every((g) => /^[0-9a-f]{1,4}$/.test(g))) {
+        const hi = parseInt(groups[0], 16);
+        const lo = parseInt(groups[1], 16);
+        return `${(hi >> 8) & 0xff}.${hi & 0xff}.${(lo >> 8) & 0xff}.${lo & 0xff}`;
+    }
+    return null;
+}
+export function isBlockedIp(ip) {
+    const version = net.isIP(ip);
+    if (version === 4) {
+        return (ipv4InCidr(ip, "0.0.0.0", 8) ||
+            ipv4InCidr(ip, "10.0.0.0", 8) ||
+            ipv4InCidr(ip, "100.64.0.0", 10) ||
+            ipv4InCidr(ip, "127.0.0.0", 8) ||
+            ipv4InCidr(ip, "169.254.0.0", 16) ||
+            ipv4InCidr(ip, "172.16.0.0", 12) ||
+            ipv4InCidr(ip, "192.0.0.0", 24) ||
+            ipv4InCidr(ip, "192.0.2.0", 24) ||
+            ipv4InCidr(ip, "192.168.0.0", 16) ||
+            ipv4InCidr(ip, "198.18.0.0", 15) ||
+            ipv4InCidr(ip, "198.51.100.0", 24) ||
+            ipv4InCidr(ip, "203.0.113.0", 24) ||
+            ipv4InCidr(ip, "224.0.0.0", 4) ||
+            ipv4InCidr(ip, "240.0.0.0", 4) ||
+            ip === "255.255.255.255");
+    }
+    if (version === 6) {
+        const normalized = ip.toLowerCase();
+        // IPv4-mapped IPv6: run the authoritative IPv4 table on the embedded address.
+        // Any "::ffff:*" we cannot cleanly parse fails closed (blocked) — an
+        // unparseable mapped form must never be treated as a safe public address.
+        if (normalized.startsWith("::ffff:")) {
+            const mapped = mappedIpv4(normalized);
+            return mapped ? isBlockedIp(mapped) : true;
+        }
+        return (normalized === "::1" ||
+            normalized === "::" ||
+            normalized.startsWith("fc") || // ULA fc00::/7 (fc..)
+            normalized.startsWith("fd") || // ULA fc00::/7 (fd..)
+            normalized.startsWith("fe80:") || // link-local
+            normalized.startsWith("ff") || // multicast
+            normalized.startsWith("2001:db8:") || // documentation
+            normalized.startsWith("2002:") // 6to4
+        );
+    }
+    return false;
+}
+async function lookupWithTimeout(host) {
+    let timer;
+    try {
+        return await Promise.race([
+            dns.lookup(host, { all: true, verbatim: true }),
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error("SSRF_BLOCKED: DNS lookup timed out")), DNS_LOOKUP_TIMEOUT_MS);
+            }),
+        ]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+async function resolveSafeFetchTarget(rawUrl) {
+    const parsed = validateFetchUrlSyntax(rawUrl);
+    const host = normalizeHostname(parsed.hostname);
+    if (net.isIP(host)) {
+        if (isBlockedIp(host)) {
+            throw new Error(`SSRF_BLOCKED: blocked IP range (${host})`);
+        }
+        return { url: parsed, address: { address: host, family: net.isIP(host) } };
+    }
+    const lookupResults = await lookupWithTimeout(host);
+    if (lookupResults.length === 0) {
+        throw new Error("SSRF_BLOCKED: hostname has no DNS records");
+    }
+    for (const result of lookupResults) {
+        if (isBlockedIp(result.address)) {
+            throw new Error(`SSRF_BLOCKED: hostname resolves to blocked IP range (${result.address})`);
+        }
+    }
+    const chosen = lookupResults[0];
+    return { url: parsed, address: { address: chosen.address, family: chosen.family } };
+}
+function validateFetchUrlSyntax(rawUrl) {
+    let parsed;
+    try {
+        parsed = new URL(rawUrl);
+    }
+    catch {
+        throw new Error("Invalid URL");
+    }
+    if (!["http:", "https:"].includes(parsed.protocol)) {
+        throw new Error("Only HTTP and HTTPS URLs are allowed");
+    }
+    const host = normalizeHostname(parsed.hostname);
+    if (!host)
+        throw new Error("SSRF_BLOCKED: missing hostname");
+    if (host === "localhost" || host.endsWith(".localhost")) {
+        throw new Error("SSRF_BLOCKED: localhost is not allowed");
+    }
+    if (/^\d+$/.test(host) || host.includes("%") || host.includes("\\")) {
+        throw new Error("SSRF_BLOCKED: suspicious hostname format");
+    }
+    return parsed;
+}
+export async function assertSafeFetchUrl(rawUrl) {
+    if (localFetchBypassEnabled()) {
+        // The bypass only clears LOOPBACK. A non-loopback URL still goes through full
+        // DNS resolution + blocklist, so metadata/private IPs are never waved through.
+        let parsed;
+        try {
+            parsed = new URL(rawUrl);
+        }
+        catch {
+            throw new Error("Invalid URL");
+        }
+        if (!["http:", "https:"].includes(parsed.protocol)) {
+            throw new Error("Only HTTP and HTTPS URLs are allowed");
+        }
+        if (isLoopbackHost(parsed.hostname))
+            return;
+    }
+    await resolveSafeFetchTarget(rawUrl);
+}
 //# sourceMappingURL=http.js.map

package/dist/lib/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/lib/http.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAE1E,OAAO,GAAG,MAAM,mBAAmB,CAAC;AACpC,OAAO,GAAG,MAAM,UAAU,CAAC;AAE3B,MAAM,OAAO,SAAU,SAAQ,KAAK;IAGhB;IACA;IAHlB,YACE,OAAe,EACC,MAAe,EACf,UAAmB;QAEnC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAS;QACf,eAAU,GAAV,UAAU,CAAS;QAGnC,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAQD,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AACpI,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAiB,EACjB,UAAiC,EAAE;IAEnC,MAAM,EAAE,SAAS,GAAG,MAAM,EAAE,OAAO,GAAG,CAAC,EAAE,YAAY,GAAG,GAAG,EAAE,GAAG,WAAW,EAAE,GAAG,OAAO,CAAC;IACxF,IAAI,SAAkB,CAAC;IAEvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QAEhE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAChC,GAAG,WAAW;gBACd,MAAM,EAAE,WAAW,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM;aAChD,CAAC,CAAC;YAEH,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBAC/D,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,SAAS,GAAG,IAAI,SAAS,CAAC,QAAQ,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QACpH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,GAAG,GAAG,CAAC;YAChB,IAAI,OAAO,KAAK,OAAO;gBAAE,MAAM,GAAG,CAAC;QACrC,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;QAED,MAAM,KAAK,CAAC,YAAY,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE;QAAE,OAAO,YAAY,CAAC;IAC5C,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,eAAe,CAAC;AAC7C,CAAC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,UAAU,CAAC,EAAU,EAAE,QAAgB,EAAE,MAAc;IAC9D,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;IACpE,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAU;IACpC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7B,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO,CACL,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YAC5B,UAAU,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;YAC7B,UAAU,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;YAC9B,UAAU,CAAC,EAAE,EAAE,aAAa,EAAE,EAAE,CAAC;YACjC,UAAU,CAAC,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC;YAChC,UAAU,CAAC,EAAE,EAAE,aAAa,EAAE,EAAE,CAAC,CAClC,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,MAAM,UAAU,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,OAAO,CACL,UAAU,KAAK,KAAK;YACpB,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;YAC3B,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;YAC3B,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC;YAC9B,UAAU,KAAK,IAAI;YACnB,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC;YACpC,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC;YACnC,UAAU,CAAC,UAAU,CAAC,iBAAiB,CAAC,CACzC,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc;IACrD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,MAAM,CAAC;IACjE,IAAI,UAAU;QAAE,OAAO;IAEvB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;QACnC,IAAI,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,wDAAwD,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/lib/http.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAE1E,OAAO,GAAG,MAAM,mBAAmB,CAAC;AACpC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AACpC,OAAO,GAAG,MAAM,UAAU,CAAC;AAE3B,MAAM,OAAO,SAAU,SAAQ,KAAK;IAGhB;IACA;IAHlB,YACE,OAAe,EACC,MAAe,EACf,UAAmB;QAEnC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAS;QACf,eAAU,GAAV,UAAU,CAAS;QAGnC,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAkBD,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAC7B,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAEpC,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AACpI,CAAC;AAED,SAAS,WAAW,CAAC,OAAgB;IACnC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAgC;IACxD,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc;IACtC,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAChG,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAc,EAAE,MAAc;IAChE,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACnC,OAAO,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,MAAM,CAAC;AACrG,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAiC;IAC3D,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,IAAI,YAAY,eAAe;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzE,IAAI,IAAI,YAAY,WAAW;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAChG,IAAI,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,YAAY,IAAI;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACtG,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,uBAAuB,CAAC,GAAyB,EAAE,MAAgB;IAC1E,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,KAAK,MAAM,KAAK,IAAI,GAAG;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtD,CAAC;aAAM,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;QACzC,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;QAC3B,UAAU,EAAE,GAAG,CAAC,aAAa,IAAI,EAAE;QACnC,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAiB,EACjB,UAAiC,EAAE;IAEnC,MAAM,EAAE,SAAS,GAAG,MAAM,EAAE,OAAO,GAAG,CAAC,EAAE,YAAY,GAAG,GAAG,EAAE,GAAG,WAAW,EAAE,GAAG,OAAO,CAAC;IACxF,IAAI,SAAkB,CAAC;IAEvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;YAE5E,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBAC/D,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,SAAS,GAAG,IAAI,SAAS,CAAC,QAAQ,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QACpH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,GAAG,GAAG,CAAC;YAChB,IAAI,OAAO,KAAK,OAAO;gBAAE,MAAM,GAAG,CAAC;QACrC,CAAC;QAED,MAAM,KAAK,CAAC,YAAY,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,YAAY,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB;IAC9B,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,QAAgB;IACzC,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,OAAO,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IACxD,IAAI,OAAO,KAAK,CAAC;QAAE,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IACrE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,GAAiB,EACjB,IAAiB,EACjB,SAAiB,EACjB,aAAqB;IAErB,MAAM,MAAM,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAE1E,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,6CAA6C;IAC7C,IAAI,uBAAuB,EAAE,IAAI,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QAChE,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QACpF,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC;IAE/C,IAAI,YAAY,KAAK,OAAO,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,YAAY,KAAK,QAAQ,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC/B,IAAI,aAAa,IAAI,kBAAkB,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAgB,EAAE,GAAG,IAAI,EAAE,CAAC;QAC1C,IAAI,0BAA0B,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;YACxD,QAAQ,CAAC,MAAM,GAAG,KAAK,CAAC;YACxB,OAAO,QAAQ,CAAC,IAAI,CAAC;YACrB,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACnD,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACjC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YAC/B,QAAQ,CAAC,OAAO,GAAG,OAAO,CAAC;QAC7B,CAAC;QAED,OAAO,oBAAoB,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,GAAG,CAAC,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,MAAW,EAAE,IAAiB,EAAE,SAAiB;IAClF,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAE/C,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,IAAI,OAAO,CAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC/C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,YAAY,CAAC,4BAA4B,EAAE,YAAY,CAAC,CAAC,CAAC;QACvE,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACxB,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,MAAM,CAAC,IAAI,YAAY,CAAC,4BAA4B,EAAE,YAAY,CAAC,CAAC,CAAC;gBACrE,OAAO;YACT,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/D,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CACxB,MAAM,CAAC,GAAG,EACV;YACE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;YAC5B,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC;YAC7B,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;gBACvC,sEAAsE;gBACtE,6DAA6D;gBAC7D,EAAE;gBACF,sEAAsE;gBACtE,sEAAsE;gBACtE,mEAAmE;gBACnE,MAAM,MAAM,GAAG;oBACb,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO;oBAC/B,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;iBAC9B,CAAC;gBAEF,IAAK,OAAyC,EAAE,GAAG,EAAE,CAAC;oBACpD,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,CAAQ,CAAC,CAAC;oBAChC,OAAO;gBACT,CAAC;gBAED,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAChD,CAAC;SACF,EACD,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC7G,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,OAAO,CAAC,uBAAuB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;YAChD,CAAC,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QAEF,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,0BAA0B,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;QACnG,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACtB,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,IAAI,IAAI;YAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,UAAU,CAAC,EAAU,EAAE,QAAgB,EAAE,MAAc;IAC9D,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;IACpE,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACpD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAClB,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,sBAAsB;IAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnC,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;IAC7E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAU;IACpC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7B,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO,CACL,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YAC5B,UAAU,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;YAC7B,UAAU,CAAC,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC;YAChC,UAAU,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;YAC9B,UAAU,CAAC,EAAE,EAAE,aAAa,EAAE,EAAE,CAAC;YACjC,UAAU,CAAC,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC;YAChC,UAAU,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC;YAC/B,UAAU,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC;YAC/B,UAAU,CAAC,EAAE,EAAE,aAAa,EAAE,EAAE,CAAC;YACjC,UAAU,CAAC,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC;YAChC,UAAU,CAAC,EAAE,EAAE,cAAc,EAAE,EAAE,CAAC;YAClC,UAAU,CAAC,EAAE,EAAE,aAAa,EAAE,EAAE,CAAC;YACjC,UAAU,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;YAC9B,UAAU,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;YAC9B,EAAE,KAAK,iBAAiB,CACzB,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,MAAM,UAAU,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,8EAA8E;QAC9E,qEAAqE;QACrE,0EAA0E;QAC1E,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;YACtC,OAAO,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7C,CAAC;QACD,OAAO,CACL,UAAU,KAAK,KAAK;YACpB,UAAU,KAAK,IAAI;YACnB,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAM,sBAAsB;YACvD,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAM,sBAAsB;YACvD,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,aAAa;YAC/C,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAM,YAAY;YAC7C,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,gBAAgB;YACtD,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,CAAG,OAAO;SACzC,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAC3C,IAAI,KAAiC,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAC/C,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC/B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;YAC3G,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,MAAc;IAClD,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEhD,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnB,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,GAAG,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAU,EAAE,EAAE,CAAC;IACtF,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;QACnC,IAAI,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,wDAAwD,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IAChC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAe,EAAE,EAAE,CAAC;AAC/F,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAc;IAC5C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC7D,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc;IACrD,IAAI,uBAAuB,EAAE,EAAE,CAAC;QAC9B,8EAA8E;QAC9E,+EAA+E;QAC/E,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC;YAAE,OAAO;IAC9C,CAAC;IACD,MAAM,sBAAsB,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC"}