@sanoma-ai/connector-cloudflare 0.2.0 → 0.3.1

package/dist/records.js

@@ -0,0 +1,325 @@
+import { DriverError, errorMessage } from "@sanoma-ai/workflows";
+import { z } from "zod";
+import { caaData, canonicalRecord, keyOf, records as recordsType } from "./connector.js";
+import { inZone, NONE, refused, replanned, } from "./ops.js";
+// `cloudflare.records`' operations over `CloudflareApi`: the driver's calls Cloudflare's DNS API
+// with the SDK, the fake's answers from its zones. Both go through `recordsOps`, so they find,
+// plan, adopt and refuse alike.
+/** The permission a token needs for a set, as the dashboard names it. */
+const DNS_EDIT = "Zone → DNS → Edit";
+/** The longest comment a record of a Free zone holds, which the mark is. */
+const MARK_MAX = 100;
+const compare = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
+const heldOf = ({ id, comment, proxied, ...rest }) => {
+    const record = canonicalRecord(rest);
+    return { id, comment: comment ?? undefined, proxied: proxied === true, record, key: keyOf(record) };
+};
+/** `<zone>/<name>`, a set's id, split. */
+function idOf(id) {
+    const at = id.indexOf("/");
+    if (at <= 0 || at === id.length - 1)
+        throw refused(`records: ${id} is not <zone>/<name>`);
+    return { zone: id.slice(0, at), name: id.slice(at + 1) };
+}
+/**
+ * The mark of the set `<zone>/<name>`, `sanoma:<zone>/<name>`: the comment of every record it
+ * writes; a refusal when it is longer than a record's comment holds on a Free zone.
+ */
+function markOf(zone, name) {
+    const mark = `sanoma:${zone}/${name}`;
+    if (mark.length > MARK_MAX) {
+        throw refused(`records ${zone}/${name}: its mark ${mark} is ${mark.length} characters, and a record's comment holds ${MARK_MAX}: give the set a shorter name`, "invalid");
+    }
+    return mark;
+}
+/**
+ * A set's declared records, each in its compared form, each once; a refusal for none, one the
+ * shared shape refuses, one whose name is not in the zone, an MX record without a priority, a
+ * CAA record's content not its fields, two of one type, name and content that differ otherwise
+ * (Cloudflare holds one of them), or a CNAME beside another record of its name.
+ */
+function declaredRecords(zone, name, given) {
+    const set = `${zone}/${name}`;
+    const parsed = recordsType.schema.shape.records.safeParse(given);
+    if (!parsed.success)
+        throw refused(`records ${set}: ${z.prettifyError(parsed.error)}`, "invalid");
+    const seen = new Map();
+    for (const record of parsed.data.map((r) => canonicalRecord(r))) {
+        if (!inZone(record.name, zone)) {
+            throw refused(`records ${set}: ${record.type} ${record.name} is not in the zone ${zone}`, "invalid");
+        }
+        if (record.type === "MX" && record.priority === undefined) {
+            throw refused(`records ${set}: the MX record ${record.name} needs a priority`, "invalid");
+        }
+        if (record.type === "CAA" && !caaData(record.content)) {
+            throw refused(`records ${set}: a CAA record's content is \`<flags> <tag> "<value>"\`, not ${record.content}`, "invalid");
+        }
+        const same = JSON.stringify([record.type, record.name, record.content]);
+        const before = seen.get(same);
+        if (before && keyOf(before) !== keyOf(record)) {
+            throw refused(`records ${set}: ${record.type} ${record.name} ${JSON.stringify(record.content)} is declared twice, with another ttl or priority`, "invalid");
+        }
+        seen.set(same, record);
+    }
+    const declared = [...seen.values()];
+    const cname = declared.find((r) => r.type === "CNAME" && declared.some((o) => o !== r && o.name === r.name));
+    if (cname) {
+        throw refused(`records ${set}: the CNAME ${cname.name} is declared beside another record of its name, which a CNAME cannot stand beside`, "invalid");
+    }
+    const second = declared.find((r) => spfRecord(r) && declared.some((o) => o !== r && o.name === r.name && spfRecord(o)));
+    if (second) {
+        throw refused(`records ${set}: two SPF policies are declared at ${second.name}, which makes both invalid: merge them into one`, "invalid");
+    }
+    return declared;
+}
+/**
+ * How the zone's marked records become the declared ones: those kept as they are, those patched
+ * (a marked record of the same type and name, with other content, priority or ttl, or proxied by
+ * hand), the declared ones no marked record holds, which a write posts or adopts, and the marked
+ * ones no longer declared.
+ */
+function diff(declared, held) {
+    const left = [...held];
+    const take = (match) => {
+        const at = left.findIndex(match);
+        return at < 0 ? undefined : left.splice(at, 1)[0];
+    };
+    /** The records no marked one `matches`, the others paired with the one each takes, into `into`. */
+    const pair = (records, matches, into) => records.filter((record) => {
+        const slot = take((h) => matches(h, record));
+        if (slot)
+            into.push([slot, record]);
+        return !slot;
+    });
+    const kept = [];
+    const patched = [];
+    const at = (h, record) => h.record.type === record.type && h.record.name === record.name;
+    // Each declared record held exactly first, so a patch never takes a record another one keeps;
+    // then one of the same content (its ttl or priority changed), then any of its type and name.
+    const unheld = pair(declared, (h, record) => h.key === keyOf(record) && !h.proxied, kept);
+    const missing = pair(pair(unheld, (h, record) => at(h, record) && h.record.content === record.content, patched), at, patched);
+    return { kept: kept.map(([h]) => h), patched, missing, stale: left };
+}
+/** A declared record as a batch writes it, with the set's mark. */
+const writeOf = (mark, record) => ({
+    type: record.type,
+    name: record.name,
+    ttl: record.ttl ?? 1,
+    proxied: false,
+    comment: mark,
+    ...(record.type === "CAA" ? { data: caaData(record.content) } : { content: record.content }),
+    ...(record.priority !== undefined && { priority: record.priority }),
+});
+/** A record as a refusal names it. */
+const named = ({ record, comment }) => `${record.type} ${record.name} ${JSON.stringify(record.content)}${comment ? ` (its comment: ${comment})` : ""}`;
+/**
+ * Whether an unmarked record at a declared record's name keeps it from being written: a CNAME,
+ * which no other record may stand beside (and a declared CNAME beside any record), a second SPF
+ * policy, which makes both invalid, or an MX record to the same server at another priority.
+ */
+const clashes = (record, { record: other }) => other.type === "CNAME" ||
+    record.type === "CNAME" ||
+    (spfRecord(record) && spfRecord(other)) ||
+    (record.type === "MX" && other.type === "MX" && record.content === other.content);
+/** Whether a TXT record's text is an SPF policy: `v=spf1`, in any case. */
+const isSpf = (text) => /^v=spf1(\s|$)/i.test(text);
+/** Whether a record is an SPF policy: a TXT record whose text is one. */
+const spfRecord = (record) => record.type === "TXT" && isSpf(record.content);
+/** `call`'s answer, a 403 refused as the token's missing permission on the zone. */
+async function dns(zone, call) {
+    try {
+        return await call();
+    }
+    catch (error) {
+        if (!(error instanceof DriverError && error.status === 403))
+            throw error;
+        throw new DriverError(`cloudflare: the API token may not edit the DNS records of ${zone} (${errorMessage(error)}): give it ${DNS_EDIT} on the zone ${zone}`, { retryable: false, status: 403, vendorCode: "no_dns_permission", cause: error });
+    }
+}
+/** The refusal of records given as `null` at a write: a backstop, since apply fails such a step before it gets here. */
+const notKnown = (set) => refused(`records ${set}: its records are not known yet: apply the resource they come from first`, "not_known");
+/** The refusal of a set whose zone is not listed: the account holds no such zone, or the token cannot read it. */
+const noZone = (set, zone) => refused(`records ${set}: the account holds no zone ${zone}, or the API token cannot read it: add the zone to the account, or Zone Read and ${DNS_EDIT} on it to the token`, "no_zone");
+/**
+ * The set `id`: its mark (`sanoma:<zone>/<name>`, the comment of every record it writes), its
+ * zone's id (undefined when the account holds no such zone) and the records that carry its mark.
+ */
+async function look(cf, id) {
+    const { zone, name } = idOf(id);
+    const mark = markOf(zone, name);
+    const zoneId = await cf.zone(zone);
+    // Cloudflare's `comment.exact` ignores case: a comment that is the mark in another case is not the set's.
+    const held = zoneId === undefined
+        ? []
+        : (await dns(zone, () => cf.dnsRecords(zoneId, mark))).map(heldOf).filter((h) => h.comment === mark);
+    return { zone, name, mark, zoneId, held };
+}
+/** A set's state, from the records that carry its mark. */
+function stateOf(zone, name, zoneId, held) {
+    const sorted = held.toSorted((a, b) => compare(a.key, b.key));
+    return { zone, name, records: sorted.map((h) => h.record), zone_id: zoneId, record_ids: sorted.map((h) => h.id) };
+}
+/** What `desired` changes of the set `found` found (none found: a create). */
+function planOf(found, desired) {
+    const zone = String(desired.zone);
+    const name = String(desired.name);
+    markOf(zone, name);
+    // `null`: taken from another resource's state, known only after apply.
+    const given = desired.records;
+    const records = given === null || given === undefined
+        ? given
+        : declaredRecords(zone, name, given).toSorted((a, b) => compare(keyOf(a), keyOf(b)));
+    /** A new set's unknown fields: Cloudflare's, and its records while they are not known. */
+    const unknown = [...(records == null ? ["records"] : []), ...recordsType.fields.vendorOwned];
+    const anew = { zone, name, records: records ?? null };
+    if (!found?.zoneId || found.held.length === 0)
+        return { action: "create", planned: anew, unknown, replace: [] };
+    const state = stateOf(found.zone, found.name, found.zoneId, found.held);
+    const replace = recordsType.fields.immutable.filter((field) => desired[field] !== state[field]);
+    if (replace.length > 0)
+        return { action: "replace", planned: anew, unknown, replace };
+    // Left out: its resource is absent or unreadable, so the set keeps what it holds.
+    if (records === undefined)
+        return { action: "none", planned: state, ...NONE };
+    if (records === null) {
+        return {
+            action: "update",
+            planned: { ...state, records: null, record_ids: null },
+            unknown: ["records", "record_ids"],
+            replace: [],
+        };
+    }
+    const { patched, missing, stale } = diff(records, found.held);
+    if (patched.length + missing.length + stale.length === 0)
+        return { action: "none", planned: state, ...NONE };
+    return { action: "update", planned: { ...state, records, record_ids: null }, unknown: ["record_ids"], replace: [] };
+}
+/**
+ * `cloudflare.records`' operations over `api()`, made on each call. A read finds a set's records
+ * by its mark alone; a write is one batch, all or nothing, of posts, patches (a marked record of a
+ * declared one's type and name, or an unmarked one identical to it, adopted: its comment replaced
+ * by the mark) and deletes (marked, no longer declared), and never touches another record: one in
+ * its way (a CNAME at the name, another SPF policy, an MX to the same server at another priority,
+ * a proxied one identical to it) is refused, naming it.
+ */
+export function recordsOps(api) {
+    /** The set `id` as the zone holds it, or gone: no record carries its mark, or the zone is not the account's. */
+    const read = async ({ id }) => {
+        const { zone, name, zoneId, held } = await look(api(), id);
+        if (zoneId === undefined || held.length === 0)
+            return { id, gone: true };
+        return { id, gone: false, state: stateOf(zone, name, zoneId, held) };
+    };
+    const plan = async ({ id, desired }) => {
+        // A create plans without the account: it needs no credentials yet.
+        const found = id === undefined ? undefined : await look(api(), id);
+        if (!desired)
+            return { action: found?.held.length ? "delete" : "none", ...NONE };
+        return planOf(found, desired);
+    };
+    /**
+     * Makes the zone hold the declared records, in one batch: a create and an update alike, the
+     * latter with the account and what its plan found.
+     */
+    const put = async (desired, before) => {
+        const set = `${String(desired.zone)}/${String(desired.name)}`;
+        if (desired.records === null || desired.records === undefined)
+            throw notKnown(set);
+        const declared = declaredRecords(String(desired.zone), String(desired.name), desired.records);
+        const cf = before?.cf ?? api();
+        const { zone, name, mark, zoneId, held } = before?.found ?? (await look(cf, set));
+        if (zoneId === undefined) {
+            throw noZone(set, zone);
+        }
+        const { kept, patched, missing, stale } = diff(declared, held);
+        const batch = { posts: [], patches: [], deletes: stale.map(({ id }) => ({ id })) };
+        // The other records at each name a record is written to, looked up once per name, before
+        // anything is written: one identical to it is adopted, one in its way refused.
+        const others = new Map();
+        const othersAt = async (at) => {
+            let found = others.get(at);
+            if (!found) {
+                found = (await dns(zone, () => cf.dnsRecordsAt(zoneId, at))).map(heldOf).filter((h) => h.comment !== mark);
+                others.set(at, found);
+            }
+            return found;
+        };
+        /** The other record at its name (`at`) identical to `record` (its type, content and priority), taken to adopt; a refusal for another set's or a proxied one. */
+        const adoptable = (record, at) => {
+            const same = at.findIndex((o) => o.record.type === record.type && o.record.content === record.content && o.record.priority === record.priority);
+            if (same < 0)
+                return undefined;
+            const [adopted] = at.splice(same, 1);
+            if (adopted.comment?.startsWith("sanoma:")) {
+                throw refused(`records ${set}: ${record.type} ${record.name} is another set's: ${named(adopted)}`, "conflict");
+            }
+            if (adopted.proxied) {
+                throw refused(`records ${set}: ${named(adopted)} is proxied through Cloudflare, and a set's records are not: turn its proxy off by hand to have it adopted, or delete it`, "conflict");
+            }
+            return adopted;
+        };
+        // Each record to patch (its marked `slot`) or to post, in that order.
+        const writes = [
+            ...patched,
+            ...missing.map((r) => [undefined, r]),
+        ];
+        for (const [slot, record] of writes) {
+            // What another record already is: that one adopted instead (its comment replaced by the mark), its own deleted.
+            const at = await othersAt(record.name);
+            const adopted = adoptable(record, at);
+            if (adopted) {
+                if (slot)
+                    batch.deletes.push({ id: slot.id });
+                batch.patches.push({ id: adopted.id, ...writeOf(mark, record) });
+                continue;
+            }
+            const clash = at.find((other) => clashes(record, other));
+            if (clash) {
+                throw refused(`records ${set}: ${record.type} ${record.name} cannot be written beside ${named(clash)}, which is not this set's: delete or change it by hand, or declare it as it is, which adopts it`, "conflict");
+            }
+            if (slot)
+                batch.patches.push({ id: slot.id, ...writeOf(mark, record) });
+            else
+                batch.posts.push(writeOf(mark, record));
+        }
+        const written = batch.posts.length + batch.patches.length + batch.deletes.length === 0
+            ? { patches: [], posts: [] }
+            : await dns(zone, () => cf.writeDns(zoneId, batch));
+        const now = [...kept, ...[...written.patches, ...written.posts].map(heldOf)];
+        return { id: set, state: stateOf(zone, name, zoneId, now) };
+    };
+    return {
+        import: read,
+        read,
+        plan,
+        create: ({ desired }) => put(desired),
+        update: async ({ id, desired, expect, }) => {
+            // Before any request, as at a create.
+            if (desired.records === null)
+                throw notKnown(id);
+            const cf = api();
+            const found = await look(cf, id);
+            const fresh = planOf(found, desired);
+            // An update planned and found done (a retry after its batch was written) is done: the zone holds what was declared.
+            if (!(expect?.action === "update" && fresh.action === "none"))
+                replanned("records.update", fresh, expect);
+            // Records left out, or as declared: what the zone holds, unwritten.
+            if (fresh.action === "none")
+                return { id, state: fresh.planned };
+            return put(desired, { cf, found });
+        },
+        delete: async ({ id }) => {
+            const cf = api();
+            const { zone, zoneId, held } = await look(cf, id);
+            // A zone the token cannot read is not listed, as one the account does not hold: Cloudflare
+            // answers both alike, so a delete is refused rather than done with the records left behind.
+            if (zoneId === undefined)
+                throw noZone(id, zone);
+            if (held.length > 0) {
+                await dns(zone, () => cf.writeDns(zoneId, { posts: [], patches: [], deletes: held.map((h) => ({ id: h.id })) }));
+            }
+            return { id, gone: true };
+        },
+    };
+}
+//# sourceMappingURL=records.js.map

package/dist/records.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"records.js","sourceRoot":"","sources":["../src/records.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,WAAW,EAAE,YAAY,EAAmB,MAAM,sBAAsB,CAAC;AAClG,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACzF,OAAO,EAGL,MAAM,EACN,IAAI,EAGJ,OAAO,EACP,SAAS,GAEV,MAAM,UAAU,CAAC;AAElB,iGAAiG;AACjG,+FAA+F;AAC/F,gCAAgC;AAEhC,yEAAyE;AACzE,MAAM,QAAQ,GAAG,mBAAmB,CAAC;AACrC,4EAA4E;AAC5E,MAAM,QAAQ,GAAG,GAAG,CAAC;AAoBrB,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEvE,MAAM,MAAM,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,EAAc,EAAQ,EAAE;IACrE,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;AACtG,CAAC,CAAC;AAEF,0CAA0C;AAC1C,SAAS,IAAI,CAAC,EAAU;IACtB,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,OAAO,CAAC,YAAY,EAAE,uBAAuB,CAAC,CAAC;IAC1F,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,SAAS,MAAM,CAAC,IAAY,EAAE,IAAY;IACxC,MAAM,IAAI,GAAG,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC;IACtC,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC3B,MAAM,OAAO,CACX,WAAW,IAAI,IAAI,IAAI,cAAc,IAAI,OAAO,IAAI,CAAC,MAAM,6CAA6C,QAAQ,+BAA+B,EAC/I,SAAS,CACV,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,IAAY,EAAE,IAAY,EAAE,KAAc;IACjE,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,OAAO,CAAC,WAAW,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAClG,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC1C,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,OAAO,CAAC,WAAW,GAAG,KAAK,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,uBAAuB,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC1D,MAAM,OAAO,CAAC,WAAW,GAAG,mBAAmB,MAAM,CAAC,IAAI,mBAAmB,EAAE,SAAS,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,MAAM,OAAO,CACX,WAAW,GAAG,gEAAgE,MAAM,CAAC,OAAO,EAAE,EAC9F,SAAS,CACV,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,MAAM,OAAO,CACX,WAAW,GAAG,KAAK,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,kDAAkD,EACjI,SAAS,CACV,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7G,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,OAAO,CACX,WAAW,GAAG,eAAe,KAAK,CAAC,IAAI,mFAAmF,EAC1H,SAAS,CACV,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAC1B,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,CAC1F,CAAC;IACF,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,OAAO,CACX,WAAW,GAAG,sCAAsC,MAAM,CAAC,IAAI,iDAAiD,EAChH,SAAS,CACV,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,SAAS,IAAI,CAAC,QAAqB,EAAE,IAAY;IAC/C,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,CAAC,KAA2B,EAAE,EAAE;QAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC;IACF,mGAAmG;IACnG,MAAM,IAAI,GAAG,CAAC,OAAoB,EAAE,OAAgD,EAAE,IAAyB,EAAE,EAAE,CACjH,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7C,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC;IACf,CAAC,CAAC,CAAC;IACL,MAAM,IAAI,GAAwB,EAAE,CAAC;IACrC,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,MAAM,EAAE,GAAG,CAAC,CAAO,EAAE,MAAiB,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC;IAC1G,8FAA8F;IAC9F,6FAA6F;IAC7F,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAG,IAAI,CAClB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,EAC1F,EAAE,EACF,OAAO,CACR,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACvE,CAAC;AAED,mEAAmE;AACnE,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,MAAiB,EAAe,EAAE,CAAC,CAAC;IACjE,IAAI,EAAE,MAAM,CAAC,IAAI;IACjB,IAAI,EAAE,MAAM,CAAC,IAAI;IACjB,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IACpB,OAAO,EAAE,KAAK;IACd,OAAO,EAAE,IAAI;IACb,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC7F,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;CACpE,CAAC,CAAC;AAEH,sCAAsC;AACtC,MAAM,KAAK,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,EAAQ,EAAE,EAAE,CAC1C,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,kBAAkB,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAElH;;;;GAIG;AACH,MAAM,OAAO,GAAG,CAAC,MAAiB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAQ,EAAE,EAAE,CAC7D,KAAK,CAAC,IAAI,KAAK,OAAO;IACtB,MAAM,CAAC,IAAI,KAAK,OAAO;IACvB,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC;AAEpF,2EAA2E;AAC3E,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5D,yEAAyE;AACzE,MAAM,SAAS,GAAG,CAAC,MAAiB,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAExF,oFAAoF;AACpF,KAAK,UAAU,GAAG,CAAI,IAAY,EAAE,IAAsB;IACxD,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC;YAAE,MAAM,KAAK,CAAC;QACzE,MAAM,IAAI,WAAW,CACnB,6DAA6D,IAAI,KAAK,YAAY,CAAC,KAAK,CAAC,cAAc,QAAQ,gBAAgB,IAAI,EAAE,EACrI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,mBAAmB,EAAE,KAAK,EAAE,KAAK,EAAE,CACjF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,wHAAwH;AACxH,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAE,EAAE,CAC/B,OAAO,CAAC,WAAW,GAAG,0EAA0E,EAAE,WAAW,CAAC,CAAC;AAEjH,kHAAkH;AAClH,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,IAAY,EAAE,EAAE,CAC3C,OAAO,CACL,WAAW,GAAG,+BAA+B,IAAI,oFAAoF,QAAQ,qBAAqB,EAClK,SAAS,CACV,CAAC;AAKJ;;;GAGG;AACH,KAAK,UAAU,IAAI,CAAC,EAAiB,EAAE,EAAU;IAC/C,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,0GAA0G;IAC1G,MAAM,IAAI,GACR,MAAM,KAAK,SAAS;QAClB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;IACzG,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED,2DAA2D;AAC3D,SAAS,OAAO,CAAC,IAAY,EAAE,IAAY,EAAE,MAAc,EAAE,IAAY;IACvE,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACpH,CAAC;AAED,8EAA8E;AAC9E,SAAS,MAAM,CAAC,KAAwB,EAAE,OAAgC;IACxE,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnB,uEAAuE;IACvE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC;IAC9B,MAAM,OAAO,GACX,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QACnC,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzF,0FAA0F;IAC1F,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC7F,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI,EAAE,CAAC;IACtD,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAChH,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CACjD,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAM,KAAiC,CAAC,KAAK,CAAC,CACxE,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACtF,kFAAkF;IAClF,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC;IAC9E,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;YACtD,OAAO,EAAE,CAAC,SAAS,EAAE,YAAY,CAAC;YAClC,OAAO,EAAE,EAAE;SACZ,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC;IAC7G,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AACtH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,GAAwB;IACjD,gHAAgH;IAChH,MAAM,IAAI,GAAG,KAAK,EAAE,EAAE,EAAE,EAAkB,EAAE,EAAE;QAC5C,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;IACvE,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAsD,EAAoB,EAAE;QAC3G,mEAAmE;QACnE,MAAM,KAAK,GAAG,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC;QACjF,OAAO,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC,CAAC;IAEF;;;OAGG;IACH,MAAM,GAAG,GAAG,KAAK,EAAE,OAAgC,EAAE,MAA4C,EAAE,EAAE;QACnG,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;YAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACnF,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9F,MAAM,EAAE,GAAG,MAAM,EAAE,EAAE,IAAI,GAAG,EAAE,CAAC;QAC/B,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QAClF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAa,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;QAC7F,yFAAyF;QACzF,+EAA+E;QAC/E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;QACzC,MAAM,QAAQ,GAAG,KAAK,EAAE,EAAU,EAAE,EAAE;YACpC,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;gBAC3G,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACxB,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QACF,gKAAgK;QAChK,MAAM,SAAS,GAAG,CAAC,MAAiB,EAAE,EAAU,EAAE,EAAE;YAClD,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CACvB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAChH,CAAC;YACF,IAAI,IAAI,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC/B,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAW,CAAC;YAC/C,IAAI,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3C,MAAM,OAAO,CAAC,WAAW,GAAG,KAAK,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,sBAAsB,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;YACjH,CAAC;YACD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,OAAO,CACX,WAAW,GAAG,KAAK,KAAK,CAAC,OAAO,CAAC,0HAA0H,EAC3J,UAAU,CACX,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;QACF,sEAAsE;QACtE,MAAM,MAAM,GAAoC;YAC9C,GAAG,OAAO;YACV,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAA0B,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;SAC9D,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACpC,gHAAgH;YAChH,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACvC,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACtC,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,IAAI;oBAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC9C,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;gBACjE,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;YACzD,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,OAAO,CACX,WAAW,GAAG,KAAK,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,6BAA6B,KAAK,CAAC,KAAK,CAAC,iGAAiG,EACvL,UAAU,CACX,CAAC;YACJ,CAAC;YACD,IAAI,IAAI;gBAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;;gBACnE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,OAAO,GACX,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YACpE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAC5B,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7E,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;IAC9D,CAAC,CAAC;IAEF,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,IAAI;QACJ,IAAI;QACJ,MAAM,EAAE,CAAC,EAAE,OAAO,EAAwC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC;QAC3E,MAAM,EAAE,KAAK,EAAE,EACb,EAAE,EACF,OAAO,EACP,MAAM,GAKP,EAAE,EAAE;YACH,sCAAsC;YACtC,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI;gBAAE,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACrC,oHAAoH;YACpH,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC;gBAAE,SAAS,CAAC,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC1G,oEAAoE;YACpE,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAuB,EAAE,CAAC;YACjF,OAAO,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,EAAkB,EAAE,EAAE;YACvC,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;YACjB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAClD,2FAA2F;YAC3F,4FAA4F;YAC5F,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACjD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,CACnB,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAC1F,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAa,EAAE,CAAC;QACrC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/resources.d.ts

@@ -1,7 +1,8 @@
 /**
  * The constructors a data file declares the company's Cloudflare host and its wakeup with:
  * `export const host = cloudflare.container({ name: "acme", image: "ghcr.io/sanoma-ai/runtime:0.7.0", source: repo, ref: "main", port: 3000, secrets: { SANOMA_DATABASE_URL: secret("SANOMA_DATABASE_URL"), SANOMA_WAKEUP_TOKEN: secret("SANOMA_WAKEUP_TOKEN", { generate: true }) } })`
- * and `export const wakeup = cloudflare.alarm({ host })`.
+ * and `export const wakeup = cloudflare.alarm({ host })`, and a set of DNS records, such as a
+ * sending domain's: `export const mailDns = cloudflare.records({ zone: "example.com", name: "resend", records: mail })`.
  */
 export declare const cloudflare: {
     container: import("@sanoma-ai/workflows").Resource<import("zod").ZodObject<{
@@ -34,4 +35,27 @@ export declare const cloudflare: {
             readonly by: readonly ["url"];
         };
     }, true>;
+    records: import("@sanoma-ai/workflows").Resource<import("zod").ZodObject<{
+        zone: import("zod").ZodString;
+        name: import("zod").ZodString;
+        records: import("zod").ZodArray<import("zod").ZodObject<{
+            type: import("zod").ZodEnum<{
+                CAA: "CAA";
+                CNAME: "CNAME";
+                MX: "MX";
+                TXT: "TXT";
+            }>;
+            name: import("zod").ZodString;
+            content: import("zod").ZodString;
+            priority: import("zod").ZodOptional<import("zod").ZodNumber>;
+            ttl: import("zod").ZodOptional<import("zod").ZodNumber>;
+        }, import("zod/v4/core").$strip>>;
+        zone_id: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
+        record_ids: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodArray<import("zod").ZodString>>>;
+    }, import("zod/v4/core").$strip>, "cloudflare.records", {
+        readonly records: {
+            readonly type: readonly ["resend.domain"];
+            readonly from: "dns_records";
+        };
+    }, true>;
 };

package/dist/resources.js

@@ -1,8 +1,9 @@
-import { alarm, container } from "./connector.js";
+import { alarm, container, records } from "./connector.js";
 /**
  * The constructors a data file declares the company's Cloudflare host and its wakeup with:
  * `export const host = cloudflare.container({ name: "acme", image: "ghcr.io/sanoma-ai/runtime:0.7.0", source: repo, ref: "main", port: 3000, secrets: { SANOMA_DATABASE_URL: secret("SANOMA_DATABASE_URL"), SANOMA_WAKEUP_TOKEN: secret("SANOMA_WAKEUP_TOKEN", { generate: true }) } })`
- * and `export const wakeup = cloudflare.alarm({ host })`.
+ * and `export const wakeup = cloudflare.alarm({ host })`, and a set of DNS records, such as a
+ * sending domain's: `export const mailDns = cloudflare.records({ zone: "example.com", name: "resend", records: mail })`.
  */
-export const cloudflare = { container, alarm };
+export const cloudflare = { container, alarm, records };
 //# sourceMappingURL=resources.js.map

package/dist/resources.js.map

@@ -1 +1 @@
-{"version":3,"file":"resources.js","sourceRoot":"","sources":["../src/resources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAElD;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC"}
+{"version":3,"file":"resources.js","sourceRoot":"","sources":["../src/resources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC"}

package/features/records.feature

@@ -0,0 +1,114 @@
+Feature: Cloudflare DNS records
+  A set of DNS records in a zone, `<zone>/<name>`, each record marked with the comment
+  `sanoma:<zone>/<name>`, is created, read, planned, updated and deleted. Each scenario runs on
+  the fake and on the replies in test/fixtures/, named after the scenario (written from
+  Cloudflare's API reference until the first live run records them).
+
+  Background:
+    When cloudflare.records.create is called with
+      """
+      {
+        "desired": {
+          "zone": "sanoma.work",
+          "name": "check",
+          "records": [
+            { "type": "TXT", "name": "check-dkim._domainkey.sanoma.work", "content": "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCcheck" },
+            { "type": "MX", "name": "check-send.sanoma.work", "content": "feedback-smtp.us-east-1.amazonses.com", "priority": 10 },
+            { "type": "TXT", "name": "check-send.sanoma.work", "content": "v=spf1 include:amazonses.com ~all" }
+          ]
+        }
+      }
+      """
+
+  Scenario: Records create
+    Then it returns
+      """
+      {
+        "id": "sanoma.work/check",
+        "state": {
+          "zone": "sanoma.work",
+          "name": "check",
+          "records": [
+            { "type": "MX", "name": "check-send.sanoma.work", "content": "feedback-smtp.us-east-1.amazonses.com", "priority": 10, "ttl": 1 },
+            { "type": "TXT", "name": "check-dkim._domainkey.sanoma.work", "content": "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCcheck", "ttl": 1 },
+            { "type": "TXT", "name": "check-send.sanoma.work", "content": "v=spf1 include:amazonses.com ~all", "ttl": 1 }
+          ]
+        }
+      }
+      """
+
+  Scenario: Records read
+    When cloudflare.records.read is called with
+      | id | sanoma.work/check |
+    Then it returns
+      """
+      {
+        "gone": false,
+        "state": {
+          "zone": "sanoma.work",
+          "name": "check",
+          "records": [
+            { "type": "MX", "name": "check-send.sanoma.work", "content": "feedback-smtp.us-east-1.amazonses.com", "priority": 10, "ttl": 1 },
+            { "type": "TXT", "name": "check-dkim._domainkey.sanoma.work", "content": "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCcheck", "ttl": 1 },
+            { "type": "TXT", "name": "check-send.sanoma.work", "content": "v=spf1 include:amazonses.com ~all", "ttl": 1 }
+          ]
+        }
+      }
+      """
+
+  Scenario: Records plan none
+    When cloudflare.records.plan is called with
+      """
+      {
+        "id": "sanoma.work/check",
+        "desired": {
+          "zone": "sanoma.work",
+          "name": "check",
+          "records": [
+            { "type": "TXT", "name": "check-send.sanoma.work", "content": "v=spf1 include:amazonses.com ~all" },
+            { "type": "MX", "name": "check-send.sanoma.work", "content": "feedback-smtp.us-east-1.amazonses.com", "priority": 10, "ttl": 1 },
+            { "type": "TXT", "name": "check-dkim._domainkey.sanoma.work", "content": "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCcheck" }
+          ]
+        }
+      }
+      """
+    Then it returns
+      """
+      { "action": "none", "unknown": [], "replace": [] }
+      """
+
+  Scenario: Records update
+    When cloudflare.records.update is called with
+      """
+      {
+        "id": "sanoma.work/check",
+        "desired": {
+          "zone": "sanoma.work",
+          "name": "check",
+          "records": [
+            { "type": "MX", "name": "check-send.sanoma.work", "content": "feedback-smtp.us-east-1.amazonses.com", "priority": 10 },
+            { "type": "TXT", "name": "check-send.sanoma.work", "content": "v=spf1 include:amazonses.com -all" }
+          ]
+        }
+      }
+      """
+    Then it returns
+      """
+      {
+        "id": "sanoma.work/check",
+        "state": {
+          "records": [
+            { "type": "MX", "name": "check-send.sanoma.work", "content": "feedback-smtp.us-east-1.amazonses.com", "priority": 10, "ttl": 1 },
+            { "type": "TXT", "name": "check-send.sanoma.work", "content": "v=spf1 include:amazonses.com -all", "ttl": 1 }
+          ]
+        }
+      }
+      """
+
+  Scenario: Records delete
+    When cloudflare.records.delete is called with
+      | id | sanoma.work/check |
+    And cloudflare.records.read is called with
+      | id | sanoma.work/check |
+    Then it returns
+      | gone | true |

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "@sanoma-ai/connector-cloudflare",
-  "version": "0.2.0",
-  "description": "Cloudflare for Sanoma: a Container host that stops when quiet, and a Durable Object alarm that wakes it, from one Worker",
+  "version": "0.3.1",
+  "description": "Cloudflare for Sanoma: a Container host that stops when quiet, a Durable Object alarm that wakes it, from one Worker, and a zone's DNS records",
   "keywords": [
     "cloudflare",
     "connector",
     "containers",
+    "dns",
     "durable-objects",
     "host",
     "resources",
@@ -61,12 +62,12 @@
   },
   "devDependencies": {
     "@sanoma-ai/testing": "0.1.0",
-    "@sanoma-ai/workflows": "0.10.3",
+    "@sanoma-ai/workflows": "0.11.0",
     "msw": "^3.0.3",
     "zod": "^4.6.5"
   },
   "peerDependencies": {
-    "@sanoma-ai/workflows": "^0.10.3",
+    "@sanoma-ai/workflows": "^0.11.0",
     "zod": "^4"
   },
   "engines": {