@we8/cloudflare 0.1.2 → 0.2.0

package/dist/doctor.js

@@ -10,7 +10,115 @@
  * printing the reason without the answer just moves the search to a browser.
  */
 import { inspectEmailConfig } from './email.js';
-import { D1_ID_PLACEHOLDER, isRealDatabaseId } from './wrangler-config.js';
+import { SKILL_RELATIVE_PATH } from './skill.js';
+import { ACCESS_AUD_VAR, ACCESS_OWNER_DEFAULT_VAR, ACCESS_OWNER_EMAILS_VAR, ACCESS_TEAM_DOMAIN_VAR, AUTH_MIGRATIONS_DIR, D1_ID_PLACEHOLDER, isPlaceholder, isRealDatabaseId, } from './wrangler-config.js';
+/**
+ * A worker entry with its comments removed.
+ *
+ * Everything below reads code out of a file the scaffolder also fills with
+ * prose, and that prose names providers: the generated perimeter entry
+ * explains how to swap in `registerAdminAuth(embeddedAdminAuth)`, and the
+ * generated Access entry shows the settings being passed inline. Matching
+ * against the raw text reads those sentences as code and reports the wrong
+ * mode, which is exactly the kind of confident wrong answer a doctor must not
+ * give.
+ *
+ * String-aware, so a `//` inside a URL literal is not mistaken for a comment.
+ * A regular-expression literal containing an unmatched quote would confuse it;
+ * a worker entry is three imports and two calls, and does not have one.
+ */
+export function stripSourceComments(source) {
+    let out = '';
+    let quote = null;
+    let i = 0;
+    while (i < source.length) {
+        const ch = source[i];
+        const next = source[i + 1];
+        if (quote !== null) {
+            if (ch === '\\') {
+                out += ch + (next ?? '');
+                i += 2;
+                continue;
+            }
+            if (ch === quote)
+                quote = null;
+            out += ch;
+            i += 1;
+            continue;
+        }
+        if (ch === '"' || ch === "'" || ch === '`') {
+            quote = ch;
+            out += ch;
+            i += 1;
+            continue;
+        }
+        if (ch === '/' && next === '/') {
+            while (i < source.length && source[i] !== '\n')
+                i += 1;
+            continue;
+        }
+        if (ch === '/' && next === '*') {
+            i += 2;
+            while (i < source.length && !(source[i] === '*' && source[i + 1] === '/'))
+                i += 1;
+            i += 2;
+            continue;
+        }
+        out += ch;
+        i += 1;
+    }
+    return out;
+}
+/**
+ * Reads the composed admin auth mode out of a worker entry.
+ *
+ * A static read of one file, deliberately: running the worker to ask it would
+ * need a deployment, and the doctor is what a stranger runs BEFORE they have
+ * one. It looks for the registration call and for the shipped providers by
+ * name, so a project that registers something of its own reads as `external`
+ * rather than as unconfigured.
+ */
+export function readAdminAuthMode(entry) {
+    if (entry === null)
+        return 'unknown';
+    const registration = /registerAdminAuth\s*\(\s*([A-Za-z0-9_$.]+)/.exec(stripSourceComments(entry));
+    if (!registration)
+        return 'none';
+    switch (registration[1]) {
+        case 'embeddedAdminAuth':
+            return 'embedded';
+        case 'cloudflareAccessAdminAuth':
+            return 'access';
+        case 'perimeterAdminAuth':
+            return 'perimeter';
+        default:
+            return 'external';
+    }
+}
+/**
+ * Whether a perimeter-mode entry says out loud that it means it.
+ *
+ * The acknowledgement is an argument in the registration call rather than a
+ * var or a flag, because the dangerous choice is a line of code and the
+ * admission belongs in the same line: a reviewer reading `registerAdminAuth`
+ * sees both at once, and nobody acknowledges a mode they never read.
+ */
+export function readPerimeterAcknowledged(entry) {
+    if (entry === null)
+        return false;
+    return /perimeterAdminAuth\s*\(\s*\{[^}]*\backnowledged\b\s*:\s*true/.test(stripSourceComments(entry));
+}
+/**
+ * Whether an access-mode entry passes its settings inline instead of leaving
+ * them to the vars. The doctor can check a var; it cannot check a value that
+ * only exists as an expression, so it says where the answer lives and stops
+ * there rather than reporting a var as missing when it is not needed.
+ */
+export function readsAccessConfigInline(entry) {
+    if (entry === null)
+        return false;
+    return /cloudflareAccessAdminAuth\s*\(\s*\{/.test(stripSourceComments(entry));
+}
 function asRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value)
         ? value
@@ -50,9 +158,16 @@ export function readMigrationsDir(config) {
 }
 const MIGRATION_PATTERN = /^(\d{4})_[a-z0-9_]+\.sql$/;
 /**
- * Migrations apply in filename order, so the order has to be a real sequence.
- * A gap or a duplicate number is a merge that went wrong, and wrangler will
- * happily apply it anyway.
+ * Migrations apply in filename order, so the order has to be a real sequence:
+ * numbered, ascending, and each number used once. A duplicate is a merge that
+ * went wrong, and wrangler will happily apply it anyway.
+ *
+ * A gap is allowed, and there is one in the core sequence on purpose. 0007
+ * created the auth tables in 0.1 and those tables now belong to `@we8/auth`;
+ * the number is retired rather than reused, because the name of an applied
+ * migration is recorded in the database forever and must never come to mean
+ * something else. Renumbering the migrations after it would re-run them
+ * against every 0.1 database in existence.
  */
 export function checkMigrationSequence(files) {
     const sql = files.filter((name) => name.endsWith('.sql')).sort();
@@ -63,16 +178,18 @@ export function checkMigrationSequence(files) {
         return { ok: false, detail: `not numbered NNNN_name.sql: ${badly.join(', ')}` };
     }
     const numbers = sql.map((name) => Number(MIGRATION_PATTERN.exec(name)[1]));
-    for (let i = 0; i < numbers.length; i += 1) {
-        const expected = i + 1;
-        if (numbers[i] !== expected) {
+    for (let i = 1; i < numbers.length; i += 1) {
+        if (numbers[i] <= numbers[i - 1]) {
             return {
                 ok: false,
-                detail: `sequence breaks at ${sql[i]}: expected ${String(expected).padStart(4, '0')}`,
+                detail: `${sql[i]} repeats or goes back on ${sql[i - 1]}`,
             };
         }
     }
-    return { ok: true, detail: `${String(sql.length)} migrations, 0001 to ${sql[sql.length - 1]}` };
+    return {
+        ok: true,
+        detail: `${String(sql.length)} migrations, ${sql[0]} to ${sql[sql.length - 1]}`,
+    };
 }
 /**
  * The one guardrail that matters more than the rest: `seed/local.sql` carries
@@ -106,7 +223,7 @@ export function runDoctorChecks(facts) {
     const flags = asArray(config.compatibility_flags).filter((f) => typeof f === 'string');
     checks.push(flags.includes('nodejs_compat')
         ? check('nodejs_compat', 'nodejs_compat flag', 'pass', 'enabled')
-        : check('nodejs_compat', 'nodejs_compat flag', 'fail', 'the CMS and better-auth need the Node built-ins', 'Add "compatibility_flags": ["nodejs_compat"] to wrangler.jsonc'));
+        : check('nodejs_compat', 'nodejs_compat flag', 'fail', 'the CMS and the embedded auth provider need the Node built-ins', 'Add "compatibility_flags": ["nodejs_compat"] to wrangler.jsonc'));
     // ---- bindings ----------------------------------------------------------
     const d1 = findD1Binding(facts.config);
     const databaseName = typeof d1?.database_name === 'string' ? d1.database_name : 'we8-cms';
@@ -147,8 +264,102 @@ export function runDoctorChecks(facts) {
     checks.push(typeof vars['CMS_VERSION'] === 'string' && vars['CMS_VERSION'].length > 0
         ? check('cms_version', 'CMS_VERSION', 'pass', vars['CMS_VERSION'])
         : check('cms_version', 'CMS_VERSION', 'warn', 'not set, so /v1/health reports nothing useful', 'Add "CMS_VERSION": "0.1.0" to vars in wrangler.jsonc'));
-    // ---- the secret everything depends on ----------------------------------
-    if (remote) {
+    // ---- who signs in ------------------------------------------------------
+    //
+    // The CMS core has no auth of its own. Whichever provider the worker entry
+    // registers decides how the admin API is reached, and registering nothing
+    // means it cannot be reached at all, which is the secure default and worth
+    // saying out loud rather than leaving to be discovered by a 403.
+    const authMode = readAdminAuthMode(facts.workerEntry);
+    const embedded = authMode === 'embedded';
+    if (authMode === 'unknown') {
+        checks.push(check('admin_auth', 'admin auth', 'warn', 'could not read the worker entry, so the auth mode is unverified', 'Check that "main" in wrangler.jsonc points at the worker entry file'));
+    }
+    else if (authMode === 'none') {
+        checks.push(check('admin_auth', 'admin auth', 'warn', 'no provider is registered: every /v1/admin request is refused, and the admin portal cannot be used', 'npm install @we8/auth   then, in the worker entry: registerAdminAuth(embeddedAdminAuth)   or register cloudflareAccessAdminAuth() or perimeterAdminAuth({ acknowledged: true }) from @we8/cloudflare'));
+    }
+    else if (embedded && !facts.authPackageInstalled) {
+        checks.push(check('admin_auth', 'admin auth', 'fail', 'the worker registers the embedded provider but @we8/auth is not installed', 'npm install @we8/auth'));
+    }
+    else if (embedded) {
+        checks.push(check('admin_auth', 'admin auth', 'pass', 'embedded: @we8/auth over this site\'s D1'));
+    }
+    else if (authMode === 'access') {
+        checks.push(check('admin_auth', 'admin auth', 'pass', 'access: Cloudflare Access signs people in, and this worker validates the assertion'));
+    }
+    else if (authMode === 'perimeter') {
+        // Perimeter mode is the one check that gets louder rather than quieter as
+        // a project approaches a deployment. Locally it is a warning: running an
+        // admin with no login on localhost is a normal afternoon. Deployed without
+        // an acknowledgement it is a failure, because the difference between "my
+        // perimeter handles it" and "the admin API is open to the internet" is a
+        // sentence nobody has written down yet.
+        const acknowledged = readPerimeterAcknowledged(facts.workerEntry);
+        if (acknowledged) {
+            checks.push(check('admin_auth', 'admin auth', 'warn', 'perimeter: EVERY request that reaches this worker is the owner, acknowledged in the worker entry. Whatever sits in front of it is the only thing keeping the admin API closed', 'Check that the perimeter covers every route to this Worker, the workers.dev subdomain included'));
+        }
+        else {
+            const detail = 'perimeter: EVERY request that reaches this worker is the owner, and the worker entry does not acknowledge it';
+            const fix = 'In the worker entry: registerAdminAuth(perimeterAdminAuth({ acknowledged: true }))   once that is what you mean';
+            checks.push(check('admin_auth', 'admin auth', remote ? 'fail' : 'warn', detail, fix));
+        }
+    }
+    else {
+        checks.push(check('admin_auth', 'admin auth', 'pass', 'external: the worker registers a provider of its own'));
+    }
+    // ---- what Cloudflare Access mode needs to know ------------------------
+    //
+    // The team domain and the AUD tag are what the assertion is verified
+    // against, and neither is a secret, so both live in vars where this can read
+    // them. A project that passes them inline instead is checked for having done
+    // so and left alone: a value that only exists as an expression is not one a
+    // static read can confirm.
+    if (authMode === 'access') {
+        const inline = readsAccessConfigInline(facts.workerEntry);
+        const teamDomain = typeof vars[ACCESS_TEAM_DOMAIN_VAR] === 'string' ? vars[ACCESS_TEAM_DOMAIN_VAR] : '';
+        const audience = typeof vars[ACCESS_AUD_VAR] === 'string' ? vars[ACCESS_AUD_VAR] : '';
+        const missing = [];
+        if (!teamDomain || isPlaceholder(teamDomain))
+            missing.push(ACCESS_TEAM_DOMAIN_VAR);
+        if (!audience || isPlaceholder(audience))
+            missing.push(ACCESS_AUD_VAR);
+        if (inline) {
+            checks.push(check('access_config', 'Cloudflare Access', 'pass', 'the worker entry passes the team domain and audience itself'));
+        }
+        else if (missing.length > 0) {
+            checks.push(check('access_config', 'Cloudflare Access', 'fail', `${missing.join(' and ')} ${missing.length === 1 ? 'is' : 'are'} not filled in, so every admin request is refused`, `Zero Trust dashboard, Access, Applications, this app: copy the team domain and the Application Audience tag into vars in wrangler.jsonc`));
+        }
+        else {
+            checks.push(check('access_config', 'Cloudflare Access', 'pass', `${teamDomain}, aud ${audience.slice(0, 8)}...`));
+        }
+        const ownerEmails = typeof vars[ACCESS_OWNER_EMAILS_VAR] === 'string' ? vars[ACCESS_OWNER_EMAILS_VAR] : '';
+        const ownerDefault = typeof vars[ACCESS_OWNER_DEFAULT_VAR] === 'string' &&
+            vars[ACCESS_OWNER_DEFAULT_VAR].trim().toLowerCase() === 'true';
+        const namedOwners = ownerEmails
+            .split(',')
+            .map((entry) => entry.trim())
+            .filter((entry) => entry.length > 0 && !isPlaceholder(entry));
+        if (inline) {
+            checks.push(check('access_owners', 'Access owners', 'pass', 'the worker entry names the owners itself'));
+        }
+        else if (ownerDefault) {
+            checks.push(check('access_owners', 'Access owners', 'pass', `${ACCESS_OWNER_DEFAULT_VAR} is true: every identity Access admits owns this site`));
+        }
+        else if (namedOwners.length > 0) {
+            checks.push(check('access_owners', 'Access owners', 'pass', `${String(namedOwners.length)} owner ${namedOwners.length === 1 ? 'address' : 'addresses'}; everyone else Access admits is a member`));
+        }
+        else {
+            // Not a warning: a site whose every administrator is a member has no
+            // administrator. Settings, API keys, and the form inbox are all closed.
+            checks.push(check('access_owners', 'Access owners', 'fail', 'no owner is named, so everybody Access admits would be a member and nobody could reach settings, keys, or the inbox', `Set vars.${ACCESS_OWNER_EMAILS_VAR} to the owner addresses, or vars.${ACCESS_OWNER_DEFAULT_VAR} to "true" if every identity Access admits should own this site`));
+        }
+    }
+    // ---- the secret the embedded provider depends on -----------------------
+    //
+    // Only the embedded provider signs sessions, so this is its check and not
+    // the CMS's. A site behind someone else's identity provider has no session
+    // of its own to sign and must not be told to invent a secret for one.
+    if (embedded && remote) {
         if (facts.remoteSecrets === null) {
             checks.push(check('better_auth_secret', 'BETTER_AUTH_SECRET', 'warn', 'could not read the deployed secrets, so this is unverified', 'wrangler secret list   to check, or set it with: wrangler secret put BETTER_AUTH_SECRET'));
         }
@@ -159,13 +370,13 @@ export function runDoctorChecks(facts) {
             checks.push(check('better_auth_secret', 'BETTER_AUTH_SECRET', 'fail', 'not set: the admin API refuses every request without it', 'openssl rand -hex 32   then: wrangler secret put BETTER_AUTH_SECRET'));
         }
     }
-    else if (facts.devVars === null) {
+    else if (embedded && facts.devVars === null) {
         checks.push(check('better_auth_secret', 'BETTER_AUTH_SECRET', 'fail', 'no .dev.vars file, so local sign-in cannot work', 'cp .dev.vars.example .dev.vars   then put a value from: openssl rand -hex 32'));
     }
-    else if (facts.devVars.includes('BETTER_AUTH_SECRET')) {
+    else if (embedded && facts.devVars?.includes('BETTER_AUTH_SECRET')) {
         checks.push(check('better_auth_secret', 'BETTER_AUTH_SECRET', 'pass', 'set in .dev.vars'));
     }
-    else {
+    else if (embedded) {
         checks.push(check('better_auth_secret', 'BETTER_AUTH_SECRET', 'fail', '.dev.vars exists but does not set it', 'openssl rand -hex 32   then add BETTER_AUTH_SECRET=<value> to .dev.vars'));
     }
     // ---- migrations --------------------------------------------------------
@@ -182,6 +393,21 @@ export function runDoctorChecks(facts) {
             ? check('migrations', 'migrations', 'pass', `${migrationsDir}: ${sequence.detail}`)
             : check('migrations', 'migrations', 'fail', `${migrationsDir}: ${sequence.detail}`, 'Restore the migrations shipped with @we8/cms'));
     }
+    // A site's schema comes from every package it composes. @we8/auth owns the
+    // four auth tables and ships its own sequence, applied into the same
+    // database by the same command, so an installed provider with no migrations
+    // to apply is a broken install rather than a configuration choice.
+    if (facts.authPackageInstalled) {
+        if (facts.authMigrations === null) {
+            checks.push(check('auth_migrations', '@we8/auth migrations', 'fail', `${AUTH_MIGRATIONS_DIR} does not exist`, 'npm install   (the migrations ship inside the @we8/auth package)'));
+        }
+        else {
+            const sequence = checkMigrationSequence(facts.authMigrations);
+            checks.push(sequence.ok
+                ? check('auth_migrations', '@we8/auth migrations', 'pass', `${AUTH_MIGRATIONS_DIR}: ${sequence.detail}`)
+                : check('auth_migrations', '@we8/auth migrations', 'fail', `${AUTH_MIGRATIONS_DIR}: ${sequence.detail}`, 'Restore the migrations shipped with @we8/auth'));
+        }
+    }
     // ---- email -------------------------------------------------------------
     const emailMode = typeof vars['EMAIL_MODE'] === 'string' ? vars['EMAIL_MODE'] : undefined;
     const sendEmailNames = asArray(config.send_email)
@@ -211,6 +437,15 @@ export function runDoctorChecks(facts) {
     else {
         checks.push(check('seed_guardrail', 'seed guardrail', 'pass', 'the development seed is local-only'));
     }
+    // ---- the agent skill ---------------------------------------------------
+    //
+    // A warning and never a failure: a project without it works exactly as well,
+    // and nobody should be blocked from deploying because an agent would have
+    // had to read the README instead. It is here because the fix is one command
+    // and the alternative is an agent inventing how this project works.
+    checks.push(facts.skillPresent
+        ? check('skill', 'agent skill', 'pass', SKILL_RELATIVE_PATH)
+        : check('skill', 'agent skill', 'warn', `no ${SKILL_RELATIVE_PATH}, so an agentic tool opening this project has to guess how it works`, 'we8-cloudflare skill'));
     return { target: facts.target, ok: !checks.some((c) => c.status === 'fail'), checks };
 }
 const LABEL = { pass: 'PASS', fail: 'FAIL', warn: 'WARN' };

package/dist/doctor.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAiE3E,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,MAAe;IAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAA+B,CAAC;IAC7D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,aAAa,CAAC,MAAe;IAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAA+B,CAAC;IAC7D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,OAAO;YAAE,OAAO,MAAM,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,iBAAiB,CAAC,MAAe;IAC/C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,OAAO,OAAO,EAAE,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;AACnF,CAAC;AAED,MAAM,iBAAiB,GAAG,2BAA2B,CAAC;AAEtD;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAe;IACpD,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAE/E,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IAClF,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,sBAAsB,GAAG,CAAC,CAAC,CAAW,cAAc,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;aAChG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,wBAAwB,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAW,EAAE,EAAE,CAAC;AAC5G,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAuB;IACvD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,KAAK,CACZ,EAAU,EACV,KAAa,EACb,MAAmB,EACnB,MAAc,EACd,GAAY;IAEZ,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAChG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAkB;IAChD,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC;IAEzC,2EAA2E;IAC3E,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACxD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,QAAQ,EACR,gBAAgB,EAChB,MAAM,EACN,KAAK,CAAC,WAAW,IAAI,6BAA6B,EAClD,sEAAsE,CACvE,CACF,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAwB,CAAC;IAC7D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAE3E,2EAA2E;IAC3E,MAAM,CAAC,IAAI,CACT,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QACvD,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,6BAA6B,EAAE,4BAA4B,CAAC,CAC7G,CAAC;IAEF,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACpG,MAAM,CAAC,IAAI,CACT,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC;QAC7B,CAAC,CAAC,KAAK,CAAC,eAAe,EAAE,oBAAoB,EAAE,MAAM,EAAE,SAAS,CAAC;QACjE,CAAC,CAAC,KAAK,CACH,eAAe,EACf,oBAAoB,EACpB,MAAM,EACN,iDAAiD,EACjD,gEAAgE,CACjE,CACN,CAAC;IAEF,2EAA2E;IAC3E,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,YAAY,GAAG,OAAO,EAAE,EAAE,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,CAAC,IAAI,CACT,KAAK,CACH,IAAI,EACJ,eAAe,EACf,MAAM,EACN,mCAAmC,EACnC,sBAAsB,YAAY,2CAA2C,CAC9E,CACF,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9F,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC;QAClF,MAAM,IAAI,GAAG,OAAO,KAAK,iBAAiB,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,gBAAgB,OAAO,EAAE,CAAC;QACjG,MAAM,CAAC,IAAI;QACT,qEAAqE;QACrE,yEAAyE;QACzE,wEAAwE;QACxE,uBAAuB;QACvB,MAAM;YACJ,CAAC,CAAC,KAAK,CACH,IAAI,EACJ,eAAe,EACf,MAAM,EACN,kBAAkB,IAAI,EAAE,EACxB,sBAAsB,YAAY,mEAAmE,CACtG;YACH,CAAC,CAAC,KAAK,CACH,IAAI,EACJ,eAAe,EACf,MAAM,EACN,kBAAkB,IAAI,8CAA8C,EACpE,sBAAsB,YAAY,mEAAmE,CACtG,CACN,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IACnG,CAAC;IAED,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,CAAC,IAAI,CACT,EAAE,IAAI,OAAO,EAAE,CAAC,WAAW,KAAK,QAAQ,IAAI,EAAE,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QACnE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC;QACzD,CAAC,CAAC,KAAK,CACH,IAAI,EACJ,kBAAkB,EAClB,MAAM,EACN,uDAAuD,EACvD,kFAAkF,CACnF,CACN,CAAC;IAEF,2EAA2E;IAC3E,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CACT,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,iEAAiE,CAAC,CACpH,CAAC;IACJ,CAAC;SAAM,IAAI,MAAM,IAAI,sCAAsC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1E,MAAM,CAAC,IAAI,CACT,KAAK,CACH,UAAU,EACV,UAAU,EACV,MAAM,EACN,oCAAoC,OAAO,wDAAwD,EACnG,0DAA0D,CAC3D,CACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,CAAC,IAAI,CACT,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC;QACvE,CAAC,CAAC,KAAK,CAAC,aAAa,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAClE,CAAC,CAAC,KAAK,CACH,aAAa,EACb,aAAa,EACb,MAAM,EACN,+CAA+C,EAC/C,sDAAsD,CACvD,CACN,CAAC;IAEF,2EAA2E;IAC3E,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CACT,KAAK,CACH,oBAAoB,EACpB,oBAAoB,EACpB,MAAM,EACN,4DAA4D,EAC5D,yFAAyF,CAC1F,CACF,CAAC;QACJ,CAAC;aAAM,IAAI,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC9D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,EAAE,4BAA4B,CAAC,CAAC,CAAC;QACvG,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CACT,KAAK,CACH,oBAAoB,EACpB,oBAAoB,EACpB,MAAM,EACN,yDAAyD,EACzD,qEAAqE,CACtE,CACF,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,CACT,KAAK,CACH,oBAAoB,EACpB,oBAAoB,EACpB,MAAM,EACN,iDAAiD,EACjD,8EAA8E,CAC/E,CACF,CAAC;IACJ,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC7F,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CACT,KAAK,CACH,oBAAoB,EACpB,oBAAoB,EACpB,MAAM,EACN,sCAAsC,EACtC,yEAAyE,CAC1E,CACF,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,MAAM,aAAa,GAAG,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CACT,KAAK,CACH,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,sCAAsC,EACtC,4EAA4E,CAC7E,CACF,CAAC;IACJ,CAAC;SAAM,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CACT,KAAK,CACH,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,GAAG,aAAa,iBAAiB,EACjC,iEAAiE,CAClE,CACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,sBAAsB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC1D,MAAM,CAAC,IAAI,CACT,QAAQ,CAAC,EAAE;YACT,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,aAAa,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;YACnF,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,aAAa,KAAK,QAAQ,CAAC,MAAM,EAAE,EAAE,8CAA8C,CAAC,CACtI,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;SAC9C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;SACzC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,kBAAkB,CAAC;QACtC,UAAU,EAAE,SAAS;QACrB,UAAU,EAAE,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;QACnF,yEAAyE;QACzE,4EAA4E;QAC5E,KAAK,EAAE,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;KACzG,CAAC,CAAC;IAEH,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QACvD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,OAAO,EACP,OAAO,EACP,MAAM,EACN,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,mCAAmC,CACzG,CACF,CAAC;IACJ,CAAC;SAAM,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,6BAA6B,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACnG,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CACT,KAAK,CACH,OAAO,EACP,OAAO,EACP,MAAM,EACN,kBAAkB,SAAS,SAAS,YAAY,CAAC,MAAM,EAAE,EACzD,qHAAqH,CACtH,CACF,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,MAAM,UAAU,GAAG,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,UAAU,IAAI,iBAAiB,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,CAAC,IAAI,CACT,KAAK,CACH,gBAAgB,EAChB,gBAAgB,EAChB,MAAM,EACN,mGAAmG,EACnG,6CAA6C,CAC9C,CACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,EAAE,oCAAoC,CAAC,CAAC,CAAC;IACvG,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;AACxF,CAAC;AAED,MAAM,KAAK,GAAgC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAExF,0EAA0E;AAC1E,MAAM,UAAU,kBAAkB,CAAC,MAAoB;IACrD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACrE,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACvC,KAAK,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IACzE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAEzE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CACR,MAAM,CAAC,EAAE;QACP,CAAC,CAAC,UAAU,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,MAAM,CAAC,QAAQ,CAAC,YAAY;QAChF,CAAC,CAAC,cAAc,MAAM,CAAC,QAAQ,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CACvF,CAAC;IAEF,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC"}
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAuE9B;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEV,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAW,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAE3B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,GAAG,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;gBACzB,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,EAAE,KAAK,KAAK;gBAAE,KAAK,GAAG,IAAI,CAAC;YAC/B,GAAG,IAAI,EAAE,CAAC;YACV,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC3C,KAAK,GAAG,EAAE,CAAC;YACX,GAAG,IAAI,EAAE,CAAC;YACV,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,IAAI,CAAC,CAAC;YACvD,SAAS;QACX,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC/B,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;YAClF,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QAED,GAAG,IAAI,EAAE,CAAC;QACV,CAAC,IAAI,CAAC,CAAC;IACT,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAoB;IACpD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACrC,MAAM,YAAY,GAAG,4CAA4C,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;IACnG,IAAI,CAAC,YAAY;QAAE,OAAO,MAAM,CAAC;IACjC,QAAQ,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QACxB,KAAK,mBAAmB;YACtB,OAAO,UAAU,CAAC;QACpB,KAAK,2BAA2B;YAC9B,OAAO,QAAQ,CAAC;QAClB,KAAK,oBAAoB;YACvB,OAAO,WAAW,CAAC;QACrB;YACE,OAAO,UAAU,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAoB;IAC5D,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,OAAO,8DAA8D,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;AACzG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAoB;IAC1D,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,OAAO,qCAAqC,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;AAChF,CAAC;AAwBD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,MAAe;IAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAA+B,CAAC;IAC7D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,aAAa,CAAC,MAAe;IAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAA+B,CAAC;IAC7D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,OAAO;YAAE,OAAO,MAAM,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,iBAAiB,CAAC,MAAe;IAC/C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,OAAO,OAAO,EAAE,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;AACnF,CAAC;AAED,MAAM,iBAAiB,GAAG,2BAA2B,CAAC;AAEtD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAe;IACpD,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAE/E,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IAClF,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,IAAK,OAAO,CAAC,CAAC,CAAY,IAAK,OAAO,CAAC,CAAC,GAAG,CAAC,CAAY,EAAE,CAAC;YACzD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAW,4BAA4B,GAAG,CAAC,CAAC,GAAG,CAAC,CAAW,EAAE;aAC9E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAW,OAAO,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAW,EAAE;KACpG,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAuB;IACvD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,KAAK,CACZ,EAAU,EACV,KAAa,EACb,MAAmB,EACnB,MAAc,EACd,GAAY;IAEZ,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAChG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAkB;IAChD,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC;IAEzC,2EAA2E;IAC3E,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACxD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,QAAQ,EACR,gBAAgB,EAChB,MAAM,EACN,KAAK,CAAC,WAAW,IAAI,6BAA6B,EAClD,sEAAsE,CACvE,CACF,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAwB,CAAC;IAC7D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAE3E,2EAA2E;IAC3E,MAAM,CAAC,IAAI,CACT,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QACvD,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,6BAA6B,EAAE,4BAA4B,CAAC,CAC7G,CAAC;IAEF,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACpG,MAAM,CAAC,IAAI,CACT,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC;QAC7B,CAAC,CAAC,KAAK,CAAC,eAAe,EAAE,oBAAoB,EAAE,MAAM,EAAE,SAAS,CAAC;QACjE,CAAC,CAAC,KAAK,CACH,eAAe,EACf,oBAAoB,EACpB,MAAM,EACN,gEAAgE,EAChE,gEAAgE,CACjE,CACN,CAAC;IAEF,2EAA2E;IAC3E,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,YAAY,GAAG,OAAO,EAAE,EAAE,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,CAAC,IAAI,CACT,KAAK,CACH,IAAI,EACJ,eAAe,EACf,MAAM,EACN,mCAAmC,EACnC,sBAAsB,YAAY,2CAA2C,CAC9E,CACF,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9F,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC;QAClF,MAAM,IAAI,GAAG,OAAO,KAAK,iBAAiB,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,gBAAgB,OAAO,EAAE,CAAC;QACjG,MAAM,CAAC,IAAI;QACT,qEAAqE;QACrE,yEAAyE;QACzE,wEAAwE;QACxE,uBAAuB;QACvB,MAAM;YACJ,CAAC,CAAC,KAAK,CACH,IAAI,EACJ,eAAe,EACf,MAAM,EACN,kBAAkB,IAAI,EAAE,EACxB,sBAAsB,YAAY,mEAAmE,CACtG;YACH,CAAC,CAAC,KAAK,CACH,IAAI,EACJ,eAAe,EACf,MAAM,EACN,kBAAkB,IAAI,8CAA8C,EACpE,sBAAsB,YAAY,mEAAmE,CACtG,CACN,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IACnG,CAAC;IAED,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,CAAC,IAAI,CACT,EAAE,IAAI,OAAO,EAAE,CAAC,WAAW,KAAK,QAAQ,IAAI,EAAE,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QACnE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC;QACzD,CAAC,CAAC,KAAK,CACH,IAAI,EACJ,kBAAkB,EAClB,MAAM,EACN,uDAAuD,EACvD,kFAAkF,CACnF,CACN,CAAC;IAEF,2EAA2E;IAC3E,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CACT,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,iEAAiE,CAAC,CACpH,CAAC;IACJ,CAAC;SAAM,IAAI,MAAM,IAAI,sCAAsC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1E,MAAM,CAAC,IAAI,CACT,KAAK,CACH,UAAU,EACV,UAAU,EACV,MAAM,EACN,oCAAoC,OAAO,wDAAwD,EACnG,0DAA0D,CAC3D,CACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,CAAC,IAAI,CACT,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC;QACvE,CAAC,CAAC,KAAK,CAAC,aAAa,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAClE,CAAC,CAAC,KAAK,CACH,aAAa,EACb,aAAa,EACb,MAAM,EACN,+CAA+C,EAC/C,sDAAsD,CACvD,CACN,CAAC;IAEF,2EAA2E;IAC3E,EAAE;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,QAAQ,KAAK,UAAU,CAAC;IAEzC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CACT,KAAK,CACH,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,iEAAiE,EACjE,qEAAqE,CACtE,CACF,CAAC;IACJ,CAAC;SAAM,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CACT,KAAK,CACH,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,oGAAoG,EACpG,sMAAsM,CACvM,CACF,CAAC;IACJ,CAAC;SAAM,IAAI,QAAQ,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACnD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,2EAA2E,EAC3E,uBAAuB,CACxB,CACF,CAAC;IACJ,CAAC;SAAM,IAAI,QAAQ,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,0CAA0C,CAAC,CAAC,CAAC;IACrG,CAAC;SAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CACT,KAAK,CACH,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,oFAAoF,CACrF,CACF,CAAC;IACJ,CAAC;SAAM,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QACpC,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,yEAAyE;QACzE,yEAAyE;QACzE,wCAAwC;QACxC,MAAM,YAAY,GAAG,yBAAyB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAClE,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CACT,KAAK,CACH,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,+KAA+K,EAC/K,gGAAgG,CACjG,CACF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GACV,8GAA8G,CAAC;YACjH,MAAM,GAAG,GACP,iHAAiH,CAAC;YACpH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CACT,KAAK,CAAC,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,sDAAsD,CAAC,CAClG,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,EAAE;IACF,qEAAqE;IACrE,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,2BAA2B;IAC3B,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,sBAAsB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxG,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,CAAC,UAAU,IAAI,aAAa,CAAC,UAAU,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACnF,IAAI,CAAC,QAAQ,IAAI,aAAa,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAEvE,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CACT,KAAK,CACH,eAAe,EACf,mBAAmB,EACnB,MAAM,EACN,6DAA6D,CAC9D,CACF,CAAC;QACJ,CAAC;aAAM,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CACT,KAAK,CACH,eAAe,EACf,mBAAmB,EACnB,MAAM,EACN,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,mDAAmD,EAClH,yIAAyI,CAC1I,CACF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CACT,KAAK,CAAC,eAAe,EAAE,mBAAmB,EAAE,MAAM,EAAE,GAAG,UAAU,SAAS,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CACrG,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,uBAAuB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3G,MAAM,YAAY,GAChB,OAAO,IAAI,CAAC,wBAAwB,CAAC,KAAK,QAAQ;YAClD,IAAI,CAAC,wBAAwB,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;QACjE,MAAM,WAAW,GAAG,WAAW;aAC5B,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;aAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;QAEhE,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CACT,KAAK,CAAC,eAAe,EAAE,eAAe,EAAE,MAAM,EAAE,0CAA0C,CAAC,CAC5F,CAAC;QACJ,CAAC;aAAM,IAAI,YAAY,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CACT,KAAK,CACH,eAAe,EACf,eAAe,EACf,MAAM,EACN,GAAG,wBAAwB,uDAAuD,CACnF,CACF,CAAC;QACJ,CAAC;aAAM,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CACT,KAAK,CACH,eAAe,EACf,eAAe,EACf,MAAM,EACN,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,2CAA2C,CACrI,CACF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,qEAAqE;YACrE,wEAAwE;YACxE,MAAM,CAAC,IAAI,CACT,KAAK,CACH,eAAe,EACf,eAAe,EACf,MAAM,EACN,qHAAqH,EACrH,YAAY,uBAAuB,oCAAoC,wBAAwB,iEAAiE,CACjK,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,EAAE;IACF,0EAA0E;IAC1E,2EAA2E;IAC3E,sEAAsE;IACtE,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CACT,KAAK,CACH,oBAAoB,EACpB,oBAAoB,EACpB,MAAM,EACN,4DAA4D,EAC5D,yFAAyF,CAC1F,CACF,CAAC;QACJ,CAAC;aAAM,IAAI,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC9D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,EAAE,4BAA4B,CAAC,CAAC,CAAC;QACvG,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CACT,KAAK,CACH,oBAAoB,EACpB,oBAAoB,EACpB,MAAM,EACN,yDAAyD,EACzD,qEAAqE,CACtE,CACF,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,QAAQ,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CACT,KAAK,CACH,oBAAoB,EACpB,oBAAoB,EACpB,MAAM,EACN,iDAAiD,EACjD,8EAA8E,CAC/E,CACF,CAAC;IACJ,CAAC;SAAM,IAAI,QAAQ,IAAI,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACrE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC7F,CAAC;SAAM,IAAI,QAAQ,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CACT,KAAK,CACH,oBAAoB,EACpB,oBAAoB,EACpB,MAAM,EACN,sCAAsC,EACtC,yEAAyE,CAC1E,CACF,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,MAAM,aAAa,GAAG,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CACT,KAAK,CACH,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,sCAAsC,EACtC,4EAA4E,CAC7E,CACF,CAAC;IACJ,CAAC;SAAM,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CACT,KAAK,CACH,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,GAAG,aAAa,iBAAiB,EACjC,iEAAiE,CAClE,CACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,sBAAsB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC1D,MAAM,CAAC,IAAI,CACT,QAAQ,CAAC,EAAE;YACT,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,aAAa,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;YACnF,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,aAAa,KAAK,QAAQ,CAAC,MAAM,EAAE,EAAE,8CAA8C,CAAC,CACtI,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,qEAAqE;IACrE,4EAA4E;IAC5E,mEAAmE;IACnE,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CACT,KAAK,CACH,iBAAiB,EACjB,sBAAsB,EACtB,MAAM,EACN,GAAG,mBAAmB,iBAAiB,EACvC,kEAAkE,CACnE,CACF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,sBAAsB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YAC9D,MAAM,CAAC,IAAI,CACT,QAAQ,CAAC,EAAE;gBACT,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,EAAE,GAAG,mBAAmB,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACxG,CAAC,CAAC,KAAK,CACH,iBAAiB,EACjB,sBAAsB,EACtB,MAAM,EACN,GAAG,mBAAmB,KAAK,QAAQ,CAAC,MAAM,EAAE,EAC5C,+CAA+C,CAChD,CACN,CAAC;QACJ,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;SAC9C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;SACzC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,kBAAkB,CAAC;QACtC,UAAU,EAAE,SAAS;QACrB,UAAU,EAAE,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;QACnF,yEAAyE;QACzE,4EAA4E;QAC5E,KAAK,EAAE,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;KACzG,CAAC,CAAC;IAEH,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QACvD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,OAAO,EACP,OAAO,EACP,MAAM,EACN,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,mCAAmC,CACzG,CACF,CAAC;IACJ,CAAC;SAAM,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,6BAA6B,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACnG,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CACT,KAAK,CACH,OAAO,EACP,OAAO,EACP,MAAM,EACN,kBAAkB,SAAS,SAAS,YAAY,CAAC,MAAM,EAAE,EACzD,qHAAqH,CACtH,CACF,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,MAAM,UAAU,GAAG,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,UAAU,IAAI,iBAAiB,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,CAAC,IAAI,CACT,KAAK,CACH,gBAAgB,EAChB,gBAAgB,EAChB,MAAM,EACN,mGAAmG,EACnG,6CAA6C,CAC9C,CACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,EAAE,oCAAoC,CAAC,CAAC,CAAC;IACvG,CAAC;IAED,2EAA2E;IAC3E,EAAE;IACF,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,oEAAoE;IACpE,MAAM,CAAC,IAAI,CACT,KAAK,CAAC,YAAY;QAChB,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,mBAAmB,CAAC;QAC5D,CAAC,CAAC,KAAK,CACH,OAAO,EACP,aAAa,EACb,MAAM,EACN,MAAM,mBAAmB,qEAAqE,EAC9F,sBAAsB,CACvB,CACN,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;AACxF,CAAC;AAED,MAAM,KAAK,GAAgC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAExF,0EAA0E;AAC1E,MAAM,UAAU,kBAAkB,CAAC,MAAoB;IACrD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACrE,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACvC,KAAK,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IACzE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAEzE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CACR,MAAM,CAAC,EAAE;QACP,CAAC,CAAC,UAAU,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,MAAM,CAAC,QAAQ,CAAC,YAAY;QAChF,CAAC,CAAC,cAAc,MAAM,CAAC,QAAQ,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CACvF,CAAC;IAEF,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC"}

package/dist/index.d.ts

@@ -1,20 +1,32 @@
 /**
- * `@we8/cloudflare`: the Cloudflare pack. Three things, and only three.
+ * `@we8/cloudflare`: the Cloudflare pack. Four things, and only four.
  *
  * 1. A real `EmailSender` over Cloudflare Email Service, registered through
  *    the CMS seam and off until a site configures it.
- * 2. The wrangler config generator, which is what `create-we8` writes a
- *    project's `wrangler.jsonc` with.
- * 3. First-boot help: the doctor's checks and the facts they read, behind the
- *    `we8-cloudflare` CLI.
+ * 2. Two admin auth providers for sites that do not want a user table: the
+ *    Cloudflare Access provider, which validates the assertion Access forwards,
+ *    and perimeter mode, which checks nothing because something in front of
+ *    the worker already did.
+ * 3. The wrangler config generator and the project-skill generator, which are
+ *    what `create-we8` writes a project's `wrangler.jsonc` and its
+ *    `.claude/skills/we8/SKILL.md` with.
+ * 4. First-boot help: the doctor's checks and the facts they read, plus the
+ *    skill, the migrations, and the seed, behind the `we8-cloudflare` CLI.
  *
  * The package has no runtime dependencies. It declares `@we8/cms` as a peer
- * rather than importing it, so the two build in either order.
+ * rather than importing it, so the two build in either order; the seam types
+ * both providers satisfy are restated in admin-auth.ts for the same reason.
  */
+export { ACCESS_JWT_COOKIE, ACCESS_JWT_HEADER, ACCESS_PROVIDER_NAME, accessCertsUrl, accessIssuer, accessRole, cloudflareAccessAdminAuth, clearAccessReports, normalizeTeamDomain, readAssertion, resolveAccessSettings, type AccessSettings, type CloudflareAccessConfig, type CloudflareAccessEnv, } from './access.js';
+export { PERIMETER_PROVIDER_NAME, PERIMETER_USER_ID, perimeterAdminAuth, type PerimeterOptions, } from './perimeter.js';
+export { ACCESS_JWT_ALGORITHM, CLOCK_SKEW_SECONDS, JWKS_REFETCH_FLOOR_MS, JWKS_TTL_MS, base64UrlToBytes, clearJwksCache, verifyAccessJwt, type AccessClaims, type JwtResult, } from './jwt.js';
+export type { AdminAuthProvider, AdminIdentity, FirstRunState, UserRole, } from './admin-auth.js';
 export { CLOUDFLARE_EMAIL_MODE, CloudflareEmailSender, MAX_RECIPIENTS, cloudflareEmailSender, inspectEmailConfig, type CloudflareEmailEnv, type EmailMessage, type EmailSendResult, type EmailSender, type SendEmailBinding, } from './email.js';
-export { COMPATIBILITY_DATE, D1_ID_PLACEHOLDER, DEFAULT_MIGRATIONS_DIR, RETENTION_CRON, generateWranglerConfig, isRealDatabaseId, isValidResourceName, type EmailMode, type WranglerConfigAnswers, } from './wrangler-config.js';
-export { checkMigrationSequence, findD1Binding, findR2Binding, formatDoctorReport, readMigrationsDir, runDoctorChecks, seedTargetsRemote, type CheckStatus, type DoctorCheck, type DoctorFacts, type DoctorReport, type DoctorTarget, } from './doctor.js';
-export { CONFIG_FILENAMES, SEED_RELATIVE_PATH, findConfigPath, findSeedFile, gatherFacts, parseDevVarNames, } from './project.js';
+export { ACCESS_AUD_PLACEHOLDER, ACCESS_AUD_VAR, ACCESS_OWNER_DEFAULT_VAR, ACCESS_OWNER_EMAILS_VAR, ACCESS_OWNER_PLACEHOLDER, ACCESS_TEAM_DOMAIN_PLACEHOLDER, ACCESS_TEAM_DOMAIN_VAR, AUTH_MIGRATIONS_DIR, COMPATIBILITY_DATE, D1_ID_PLACEHOLDER, DEFAULT_MIGRATIONS_DIR, RETENTION_CRON, generateMigrationsConfig, generateWranglerConfig, isPlaceholder, isRealDatabaseId, isValidResourceName, type AdminAuthChoice, type EmailMode, type WranglerConfigAnswers, } from './wrangler-config.js';
+export { checkMigrationSequence, findD1Binding, findR2Binding, formatDoctorReport, readAdminAuthMode, readMigrationsDir, readPerimeterAcknowledged, readsAccessConfigInline, runDoctorChecks, seedTargetsRemote, stripSourceComments, type AdminAuthMode, type CheckStatus, type DoctorCheck, type DoctorFacts, type DoctorReport, type DoctorTarget, } from './doctor.js';
+export { AUTH_PACKAGE_RELATIVE_PATH, CONFIG_FILENAMES, SEED_RELATIVE_PATH, findConfigPath, findSeedFile, gatherFacts, parseDevVarNames, readWorkerEntry, } from './project.js';
+export { SKILL_RELATIVE_PATH, generateSkill, type SkillAuthMode, type SkillOptions, } from './skill.js';
+export { hasSiteWorkspace, runSkillCommand, skillExitCode, type SkillCommandResult, type SkillCommandStatus, } from './skill-command.js';
 export { parseJsonc, stripJsonComments } from './jsonc.js';
 export { USAGE, parseCliArgs, type CommandName, type ParsedCommand } from './cli-args.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,gBAAgB,GACtB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,sBAAsB,EACtB,cAAc,EACd,sBAAsB,EACtB,gBAAgB,EAChB,mBAAmB,EACnB,KAAK,SAAS,EACd,KAAK,qBAAqB,GAC3B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,sBAAsB,EACtB,aAAa,EACb,aAAa,EACb,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,YAAY,GAClB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,WAAW,EACX,gBAAgB,GACjB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE3D,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,cAAc,EACd,YAAY,EACZ,UAAU,EACV,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EACb,qBAAqB,EACrB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,GACzB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,gBAAgB,GACtB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,UAAU,CAAC;AAElB,YAAY,EACV,iBAAiB,EACjB,aAAa,EACb,aAAa,EACb,QAAQ,GACT,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,gBAAgB,GACtB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,EAC9B,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,sBAAsB,EACtB,cAAc,EACd,wBAAwB,EACxB,sBAAsB,EACtB,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,qBAAqB,GAC3B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,sBAAsB,EACtB,aAAa,EACb,aAAa,EACb,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACvB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,YAAY,GAClB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,eAAe,GAChB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE3D,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -1,20 +1,31 @@
 /**
- * `@we8/cloudflare`: the Cloudflare pack. Three things, and only three.
+ * `@we8/cloudflare`: the Cloudflare pack. Four things, and only four.
  *
  * 1. A real `EmailSender` over Cloudflare Email Service, registered through
  *    the CMS seam and off until a site configures it.
- * 2. The wrangler config generator, which is what `create-we8` writes a
- *    project's `wrangler.jsonc` with.
- * 3. First-boot help: the doctor's checks and the facts they read, behind the
- *    `we8-cloudflare` CLI.
+ * 2. Two admin auth providers for sites that do not want a user table: the
+ *    Cloudflare Access provider, which validates the assertion Access forwards,
+ *    and perimeter mode, which checks nothing because something in front of
+ *    the worker already did.
+ * 3. The wrangler config generator and the project-skill generator, which are
+ *    what `create-we8` writes a project's `wrangler.jsonc` and its
+ *    `.claude/skills/we8/SKILL.md` with.
+ * 4. First-boot help: the doctor's checks and the facts they read, plus the
+ *    skill, the migrations, and the seed, behind the `we8-cloudflare` CLI.
  *
  * The package has no runtime dependencies. It declares `@we8/cms` as a peer
- * rather than importing it, so the two build in either order.
+ * rather than importing it, so the two build in either order; the seam types
+ * both providers satisfy are restated in admin-auth.ts for the same reason.
  */
+export { ACCESS_JWT_COOKIE, ACCESS_JWT_HEADER, ACCESS_PROVIDER_NAME, accessCertsUrl, accessIssuer, accessRole, cloudflareAccessAdminAuth, clearAccessReports, normalizeTeamDomain, readAssertion, resolveAccessSettings, } from './access.js';
+export { PERIMETER_PROVIDER_NAME, PERIMETER_USER_ID, perimeterAdminAuth, } from './perimeter.js';
+export { ACCESS_JWT_ALGORITHM, CLOCK_SKEW_SECONDS, JWKS_REFETCH_FLOOR_MS, JWKS_TTL_MS, base64UrlToBytes, clearJwksCache, verifyAccessJwt, } from './jwt.js';
 export { CLOUDFLARE_EMAIL_MODE, CloudflareEmailSender, MAX_RECIPIENTS, cloudflareEmailSender, inspectEmailConfig, } from './email.js';
-export { COMPATIBILITY_DATE, D1_ID_PLACEHOLDER, DEFAULT_MIGRATIONS_DIR, RETENTION_CRON, generateWranglerConfig, isRealDatabaseId, isValidResourceName, } from './wrangler-config.js';
-export { checkMigrationSequence, findD1Binding, findR2Binding, formatDoctorReport, readMigrationsDir, runDoctorChecks, seedTargetsRemote, } from './doctor.js';
-export { CONFIG_FILENAMES, SEED_RELATIVE_PATH, findConfigPath, findSeedFile, gatherFacts, parseDevVarNames, } from './project.js';
+export { ACCESS_AUD_PLACEHOLDER, ACCESS_AUD_VAR, ACCESS_OWNER_DEFAULT_VAR, ACCESS_OWNER_EMAILS_VAR, ACCESS_OWNER_PLACEHOLDER, ACCESS_TEAM_DOMAIN_PLACEHOLDER, ACCESS_TEAM_DOMAIN_VAR, AUTH_MIGRATIONS_DIR, COMPATIBILITY_DATE, D1_ID_PLACEHOLDER, DEFAULT_MIGRATIONS_DIR, RETENTION_CRON, generateMigrationsConfig, generateWranglerConfig, isPlaceholder, isRealDatabaseId, isValidResourceName, } from './wrangler-config.js';
+export { checkMigrationSequence, findD1Binding, findR2Binding, formatDoctorReport, readAdminAuthMode, readMigrationsDir, readPerimeterAcknowledged, readsAccessConfigInline, runDoctorChecks, seedTargetsRemote, stripSourceComments, } from './doctor.js';
+export { AUTH_PACKAGE_RELATIVE_PATH, CONFIG_FILENAMES, SEED_RELATIVE_PATH, findConfigPath, findSeedFile, gatherFacts, parseDevVarNames, readWorkerEntry, } from './project.js';
+export { SKILL_RELATIVE_PATH, generateSkill, } from './skill.js';
+export { hasSiteWorkspace, runSkillCommand, skillExitCode, } from './skill-command.js';
 export { parseJsonc, stripJsonComments } from './jsonc.js';
 export { USAGE, parseCliArgs } from './cli-args.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACd,qBAAqB,EACrB,kBAAkB,GAMnB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,sBAAsB,EACtB,cAAc,EACd,sBAAsB,EACtB,gBAAgB,EAChB,mBAAmB,GAGpB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,sBAAsB,EACtB,aAAa,EACb,aAAa,EACb,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,GAMlB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,WAAW,EACX,gBAAgB,GACjB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE3D,OAAO,EAAE,KAAK,EAAE,YAAY,EAAwC,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,cAAc,EACd,YAAY,EACZ,UAAU,EACV,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EACb,qBAAqB,GAItB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,kBAAkB,GAEnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,eAAe,GAGhB,MAAM,UAAU,CAAC;AASlB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACd,qBAAqB,EACrB,kBAAkB,GAMnB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,EAC9B,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,sBAAsB,EACtB,cAAc,EACd,wBAAwB,EACxB,sBAAsB,EACtB,aAAa,EACb,gBAAgB,EAChB,mBAAmB,GAIpB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,sBAAsB,EACtB,aAAa,EACb,aAAa,EACb,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACvB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,GAOpB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,eAAe,GAChB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,mBAAmB,EACnB,aAAa,GAGd,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,aAAa,GAGd,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE3D,OAAO,EAAE,KAAK,EAAE,YAAY,EAAwC,MAAM,eAAe,CAAC"}

package/dist/jwt.d.ts

@@ -0,0 +1,103 @@
+/**
+ * RS256 verification for a Cloudflare Access assertion, on WebCrypto.
+ *
+ * Access signs its assertion with the team's own key and publishes the public
+ * half as a JWKS at `https://<team>.cloudflareaccess.com/cdn-cgi/access/certs`.
+ * Verifying it is four checks: the signature against that key, the issuer, the
+ * audience, and the clock. All four have to pass, and a token that fails any of
+ * them is refused rather than downgraded.
+ *
+ * Written against WebCrypto rather than pulled from a JWT library on purpose.
+ * `@we8/cloudflare` has no runtime dependencies, this runs on Workers where
+ * `crypto.subtle` is the platform, and the whole verification is small enough
+ * to read in one sitting, which is the property that matters most in the file
+ * that decides who administers a site.
+ *
+ * Everything here fails CLOSED. An unreadable token, an unknown key, an
+ * unreachable JWKS endpoint, and an algorithm this file does not implement all
+ * produce a refusal, never an admission.
+ */
+/**
+ * An imported public key, named off the platform rather than off a global.
+ *
+ * `SigningKey` is a global on Workers and lives under `webcrypto` in Node's own
+ * types, and this file is typechecked in one and runs in the other. Deriving
+ * the type from `importKey` itself means it resolves to whichever of the two is
+ * in scope, here and in the declaration this package publishes.
+ */
+export type SigningKey = Awaited<ReturnType<typeof crypto.subtle.importKey>>;
+/** The claims this pack reads off an Access assertion. */
+export interface AccessClaims {
+    iss?: unknown;
+    aud?: unknown;
+    exp?: unknown;
+    nbf?: unknown;
+    iat?: unknown;
+    sub?: unknown;
+    email?: unknown;
+    common_name?: unknown;
+}
+/** A verification either yields claims or says, for the log, why it did not. */
+export type JwtResult = {
+    ok: true;
+    claims: AccessClaims;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * The one signature algorithm accepted.
+ *
+ * Pinned rather than read from the token's own header, because "which
+ * algorithm" being a field the attacker controls is the classic JWT forgery:
+ * `alg: none` and an HS256 token signed with the public key are both defeated
+ * by refusing to look at anything but RS256.
+ */
+export declare const ACCESS_JWT_ALGORITHM = "RS256";
+/**
+ * How long a fetched key set is used before it is fetched again. Access
+ * rotates keys, and an hour is short enough to pick a rotation up quickly and
+ * long enough that the endpoint is not in the path of every admin request.
+ */
+export declare const JWKS_TTL_MS: number;
+/**
+ * The shortest gap between two fetches provoked by an unknown key id. Without
+ * it, a stream of forged tokens carrying invented `kid` values would turn into
+ * a stream of requests to Cloudflare.
+ */
+export declare const JWKS_REFETCH_FLOOR_MS: number;
+/** A few seconds of tolerance, because two machines never agree exactly. */
+export declare const CLOCK_SKEW_SECONDS = 60;
+/** Drops every cached key set. Tests use it; nothing in the request path does. */
+export declare function clearJwksCache(): void;
+/** base64url to bytes, or null when the input is not base64url at all. */
+export declare function base64UrlToBytes(value: string): Uint8Array | null;
+/**
+ * The signing key for one key id, fetching the team's key set when the cached
+ * one cannot answer.
+ *
+ * A cached key stays usable while the set is fresh. Past that, or for a key id
+ * the set does not carry (which is what a rotation looks like), the endpoint is
+ * read again; a fetch that fails falls back to whatever was cached, because a
+ * transient outage at Cloudflare should not lock an operator out of their own
+ * admin, and refuses outright when there is nothing to fall back to.
+ */
+export declare function accessSigningKey(certsUrl: string, kid: string, now: number, fetchImpl?: typeof fetch): Promise<SigningKey | null>;
+/** True when `aud` (a string or an array, per the spec) contains `audience`. */
+export declare function audienceMatches(aud: unknown, audience: string): boolean;
+/**
+ * Verifies an Access assertion end to end.
+ *
+ * Order matters only for what a log line says; every check is required, and the
+ * first failure is the reported one.
+ */
+export declare function verifyAccessJwt(options: {
+    token: string;
+    certsUrl: string;
+    issuer: string;
+    audience: string;
+    /** Seconds since the epoch. Defaults to now; a test passes its own clock. */
+    now?: number;
+    fetchImpl?: typeof fetch;
+}): Promise<JwtResult>;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;GAOG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;AAE7E,0DAA0D;AAC1D,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,gFAAgF;AAChF,MAAM,MAAM,SAAS,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3F;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,UAAU,CAAC;AAE5C;;;;GAIG;AACH,eAAO,MAAM,WAAW,QAAiB,CAAC;AAE1C;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,QAAY,CAAC;AAE/C,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAkBrC,kFAAkF;AAClF,wBAAgB,cAAc,IAAI,IAAI,CAErC;AAOD,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAcjE;AAwHD;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAc5B;AAED,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAIvE;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B,GAAG,OAAO,CAAC,SAAS,CAAC,CA2DrB"}