@withbuddi/buddi 0.1.0-pre.37 → 0.1.0-pre.38

package/packages/gateway/dist/web/access/cloudflare-setup.js

@@ -0,0 +1,438 @@
+import { CloudflareApiError, CONNECTOR_TOKEN } from './cloudflare-api.js';
+import { plausibleEmail, validateCloudflareInput } from './cloudflare.js';
+/** Where the record of what buddi made lives (a web setting). Ids only, never a token. */
+export const CLOUDFLARE_SETUP_KEY = 'access.cloudflare.setup';
+/** The owner secret holding the API token. */
+export const CLOUDFLARE_TOKEN_SECRET = 'CLOUDFLARE_API_TOKEN';
+export const tunnelNameFor = (host) => `buddi-${host}`;
+export const policyNameFor = (host) => `buddi — ${host}`;
+export const appNameFor = (host) => `buddi (${host})`;
+/** The DNS record's comment: buddi's tag on it. */
+/** After the Done line: a new Access application takes a minute or two to reach Cloudflare's sign-in page. */
+export const SETUP_PROPAGATION = 'Cloudflare needs a minute or two before the first sign-in works; if its page says it can’t find the application, reload.';
+export const DNS_COMMENT = 'Made by buddi for Sign in from elsewhere. Remove it from buddi.';
+const ownsRecord = (r) => (r.comment ?? '').startsWith('Made by buddi');
+/** How often the tunnel's health is asked, and for how long. */
+export const HEALTH_POLL_MS = 5_000;
+export const HEALTH_WAIT_MS = 30 * 60_000;
+/** In this process, the one setup or removal going, or null. */
+let operation = null;
+/** Claim the one operation slot, synchronously; null when another holds it. */
+export function claimSetupOperation(kind) {
+    if (operation)
+        return null;
+    const mine = { kind };
+    operation = mine;
+    return { kind, release: () => { if (operation === mine)
+            operation = null; } };
+}
+/** What holds the slot, or null. */
+export const setupOperation = () => operation?.kind ?? null;
+/** The sentence for a second caller, by what is going. */
+export function setupBusySentence(kind) {
+    return kind === 'remove'
+        ? 'buddi is removing what it made in Cloudflare. Wait for it to finish, then try again.'
+        : 'A Cloudflare setup is already running. Wait for it, or stop it, then try again.';
+}
+/** A hostname, lower case, or null. */
+export function normalizeHost(raw) {
+    const value = raw.trim().toLowerCase().replace(/^https?:\/\//, '').replace(/\/.*$/, '').replace(/\.$/, '');
+    if (value.length > 253 || !value.includes('.'))
+        return null;
+    return value.split('.').every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label)) ? value : null;
+}
+/** The input checked: what is wrong with it, or null. */
+export function checkSetupInput(input) {
+    if (normalizeHost(input.host) === null)
+        return 'The hostname must be a name like buddi.example.com, on a domain in your Cloudflare account.';
+    if (!plausibleEmail(input.email.trim()))
+        return 'That is not an email address.';
+    if (input.zone !== undefined && input.zone.trim() !== '' && normalizeHost(input.zone) === null)
+        return 'The zone must be a domain like example.com.';
+    return null;
+}
+/** The line to run, for this platform. */
+export function installFor(token, platform) {
+    // The line goes into an owner's sudo: never anything but a token in it.
+    if (!CONNECTOR_TOKEN.test(token))
+        throw new CloudflareApiError('Cloudflare answered without the tunnel’s connector token.', 200, []);
+    if (platform === 'win32') {
+        return { command: `cloudflared.exe service install ${token}`, note: 'Run it in a terminal opened as administrator, after installing cloudflared from Cloudflare’s downloads page.' };
+    }
+    if (platform === 'darwin') {
+        return {
+            command: `sudo cloudflared service install ${token}`,
+            note: 'No cloudflared yet? brew install cloudflared first. If sudo can’t find it, use its full path: /opt/homebrew/bin/cloudflared (on an Intel Mac, /usr/local/bin/cloudflared).',
+        };
+    }
+    return {
+        command: `sudo cloudflared service install ${token}`,
+        note: 'No cloudflared yet? Install it from Cloudflare’s .deb or its package repository first.',
+    };
+}
+export function uninstallFor(platform) {
+    return platform === 'win32' ? 'cloudflared.exe service uninstall' : 'sudo cloudflared service uninstall';
+}
+const LABELS = {
+    token: 'Checking the token',
+    tunnel: 'Creating the tunnel',
+    route: 'Routing the hostname',
+    dns: 'Adding the DNS record',
+    access: 'Creating the Access application',
+    save: 'Filling in buddi’s settings',
+    connector: 'Install the connector',
+    healthy: 'Waiting for the tunnel to connect',
+    test: 'Testing the setup',
+};
+const ORDER = ['token', 'tunnel', 'route', 'dns', 'access', 'save', 'connector', 'healthy', 'test'];
+export function freshProgress(host = '', email = '') {
+    return {
+        state: 'idle', host, email,
+        steps: ORDER.map((id) => ({ id, state: 'next', text: LABELS[id] })),
+        install: null, error: null, url: null, removed: [], uninstall: null, adoptable: false,
+    };
+}
+function sentence(error) {
+    if (error instanceof CloudflareApiError || error instanceof SetupError)
+        return error.message;
+    // Anything else is a defect, and its message may hold anything: say little.
+    return 'Something went wrong talking to Cloudflare. Try again; nothing buddi made is lost.';
+}
+class SetupError extends Error {
+}
+const realSleep = (ms, signal) => new Promise((resolve) => {
+    const timer = setTimeout(resolve, ms);
+    signal?.addEventListener('abort', () => { clearTimeout(timer); resolve(); }, { once: true });
+});
+/**
+ * Run the setup. Never throws: the progress it ends on says how it went.
+ * `onProgress` gets a copy at every change.
+ */
+export async function runCloudflareSetup(input, deps, onProgress = () => { }) {
+    const lease = deps.lease ?? claimSetupOperation('setup');
+    if (!lease) {
+        const p = freshProgress(input.host.trim(), input.email.trim());
+        p.state = 'failed';
+        p.error = setupBusySentence(setupOperation());
+        onProgress(structuredClone(p));
+        return p;
+    }
+    try {
+        return await setupRun(input, deps, onProgress);
+    }
+    finally {
+        if (!deps.lease)
+            lease.release();
+    }
+}
+async function setupRun(input, deps, onProgress) {
+    const host = normalizeHost(input.host) ?? input.host.trim();
+    const email = input.email.trim();
+    const p = freshProgress(host, email);
+    p.state = 'running';
+    const emit = () => onProgress(structuredClone(p));
+    const step = (id) => p.steps.find((s) => s.id === id);
+    const begin = (id) => { const s = step(id); s.state = 'now'; s.text = LABELS[id]; emit(); };
+    const finish = (id, text) => { const s = step(id); s.state = 'done'; s.text = text; emit(); };
+    const sleep = deps.sleep ?? realSleep;
+    const now = deps.now ?? (() => new Date());
+    let current = 'token';
+    const at = (id) => { current = id; begin(id); };
+    const invalid = checkSetupInput(input);
+    if (invalid) {
+        const s = step('token');
+        s.state = 'failed';
+        s.why = invalid;
+        p.state = 'failed';
+        p.error = invalid;
+        emit();
+        return p;
+    }
+    try {
+        const { api } = deps;
+        // 1. The token, and the zone and account it reaches.
+        at('token');
+        // A record for another hostname is never overwritten: its ids are the
+        // only way Remove finds what buddi made there.
+        const earlier = await deps.readRecord();
+        if (earlier && earlier.host !== host && (earlier.tunnelId || earlier.dnsRecordId || earlier.policyId || earlier.appId)) {
+            throw new SetupError(`buddi already set up ${earlier.host}. Remove what it made first, or set up the same hostname again.`);
+        }
+        await api.verifyToken();
+        const zones = await api.zones();
+        const wanted = input.zone?.trim() ? normalizeHost(input.zone) : null;
+        const candidates = zones.filter((z) => host === z.name || host.endsWith(`.${z.name}`));
+        const zone = wanted
+            ? candidates.find((z) => z.name === wanted)
+            : candidates.sort((a, b) => b.name.length - a.name.length)[0];
+        if (!zone) {
+            if (wanted && zones.some((z) => z.name === wanted))
+                throw new SetupError(`${host} is not a name on ${wanted}.`);
+            if (zones.length === 0)
+                throw new SetupError(`The token can’t see any domain. Give it ${'Zone · DNS · Edit'} on the zone of ${host}, then try again.`);
+            throw new SetupError(`None of the domains this token can edit holds ${host}. It can edit ${zones.slice(0, 5).map((z) => z.name).join(', ')}${zones.length > 5 ? ', …' : ''}.`);
+        }
+        const accountId = zone.account.id;
+        let teamDomain;
+        try {
+            teamDomain = await api.teamDomain(accountId);
+        }
+        catch (error) {
+            if (error instanceof CloudflareApiError && error.status === 404) {
+                throw new SetupError('Zero Trust isn’t set up on this Cloudflare account yet. Open Zero Trust in Cloudflare’s dashboard once and pick a team name, then try again.');
+            }
+            throw error;
+        }
+        if (!/^[a-z0-9-]+\.cloudflareaccess\.com$/.test(teamDomain)) {
+            throw new SetupError('Zero Trust isn’t set up on this Cloudflare account yet. Open Zero Trust in Cloudflare’s dashboard once and pick a team name, then try again.');
+        }
+        const record = { host, email, zone: { id: zone.id, name: zone.name }, accountId, teamDomain, at: now().toISOString() };
+        const previous = await deps.readRecord();
+        if (previous && previous.host === host) {
+            Object.assign(record, { tunnelId: previous.tunnelId, dnsRecordId: previous.dnsRecordId, policyId: previous.policyId, appId: previous.appId, aud: previous.aud });
+        }
+        await deps.saveRecord(record);
+        const adopt = input.adopt === true;
+        /** Stop at an object buddi didn't make, offering "Use it anyway". */
+        const notOurs = (what) => {
+            p.adoptable = true;
+            throw new SetupError(`${what} buddi didn’t make it. Use it anyway to let buddi take it over, or delete it in Cloudflare first.`);
+        };
+        finish('token', `Token checked · ${zone.name} · team ${teamDomain}`);
+        // 2. The tunnel.
+        at('tunnel');
+        const name = tunnelNameFor(host);
+        let tunnel = await api.findTunnel(accountId, name);
+        if (tunnel && tunnel.id !== record.tunnelId && !adopt)
+            notOurs(`There is already a tunnel named ${name} in this Cloudflare account, and`);
+        const reusedTunnel = tunnel !== null;
+        tunnel ??= await api.createTunnel(accountId, name);
+        record.tunnelId = tunnel.id;
+        await deps.saveRecord(record);
+        finish('tunnel', `Tunnel ${name} ${reusedTunnel ? 'found' : 'created'}`);
+        // 3. Its ingress: the hostname to the ingress listener, nothing else.
+        at('route');
+        const service = `http://127.0.0.1:${deps.ingressPort}`;
+        await api.putTunnelConfig(accountId, tunnel.id, host, service);
+        finish('route', `${host} → ${service}`);
+        // 4. DNS: a proxied CNAME to the tunnel.
+        at('dns');
+        const target = `${tunnel.id}.cfargotunnel.com`;
+        const records = (await api.dnsRecords(zone.id, host)).filter((r) => r.name.toLowerCase() === host);
+        let dnsWords = `DNS record ${host} added`;
+        const pointing = records.find((r) => r.type === 'CNAME' && r.content.toLowerCase() === target);
+        if (pointing) {
+            if (pointing.id !== record.dnsRecordId && !adopt)
+                notOurs(`${host} already has a DNS record to this tunnel, and`);
+            record.dnsRecordId = pointing.id;
+            dnsWords = `DNS record ${host} found`;
+        }
+        else {
+            const others = records.filter((r) => r.id !== record.dnsRecordId);
+            const foreign = others.find((r) => !ownsRecord(r));
+            if (foreign) {
+                throw new SetupError(`${host} already has a DNS record (${foreign.type} to ${foreign.content}). Pick another hostname, or delete that record in Cloudflare first.`);
+            }
+            if (others.length > 0 && !adopt)
+                notOurs(`${host} already has a DNS record tagged as buddi’s, but`);
+            // buddi's own record for an older tunnel goes; the new one replaces it.
+            for (const old of records)
+                await api.deleteDnsRecord(zone.id, old.id);
+            record.dnsRecordId = (await api.createCname(zone.id, host, target, DNS_COMMENT)).id;
+        }
+        await deps.saveRecord(record);
+        finish('dns', dnsWords);
+        // 5. The Allow policy and the Access application.
+        at('access');
+        const policyName = policyNameFor(host);
+        const allPolicies = await api.policies(accountId);
+        const namedPolicy = allPolicies.find((x) => x.name === policyName);
+        const ourPolicy = allPolicies.find((x) => x.id === record.policyId);
+        if (namedPolicy && !ourPolicy && !adopt)
+            notOurs(`There is already an Access policy named “${policyName}”, and`);
+        const existingPolicy = ourPolicy ?? namedPolicy;
+        const policy = existingPolicy
+            ? await api.updatePolicy(accountId, existingPolicy.id, policyName, email)
+            : await api.createPolicy(accountId, policyName, email);
+        record.policyId = policy.id;
+        await deps.saveRecord(record);
+        const appName = appNameFor(host);
+        const apps = await api.apps(accountId);
+        const sameHost = apps.filter((a) => (a.domain ?? '').toLowerCase().replace(/\/.*$/, '') === host);
+        const foreignApp = sameHost.find((a) => a.name !== appName && a.id !== record.appId);
+        if (foreignApp) {
+            throw new SetupError(`There is already an Access application for ${host} (“${foreignApp.name}”). buddi won’t change it: delete it in Cloudflare, or use “I’ll do it myself” with its AUD tag.`);
+        }
+        const existingApp = sameHost.find((a) => a.id === record.appId) ?? sameHost.find((a) => a.name === appName);
+        if (existingApp && existingApp.id !== record.appId && !adopt)
+            notOurs(`There is already an Access application named “${appName}” for ${host}, and`);
+        const app = existingApp
+            ? await api.updateApp(accountId, existingApp.id, { name: appName, domain: host, policyId: policy.id })
+            : await api.createApp(accountId, { name: appName, domain: host, policyId: policy.id });
+        record.appId = app.id;
+        if (!app.aud) {
+            await deps.saveRecord(record);
+            throw new SetupError('Cloudflare made the Access application but gave no AUD tag. Try again.');
+        }
+        record.aud = app.aud;
+        await deps.saveRecord(record);
+        finish('access', `Access application · allows ${email} · 24 h sessions`);
+        // 6. buddi's own setting: on, for this team, application and email.
+        at('save');
+        const checked = validateCloudflareInput({ enabled: true, teamDomain, aud: app.aud, email, publicOrigin: `https://${host}` });
+        if (!checked.ok)
+            throw new SetupError(checked.error);
+        await deps.saveSetting(checked.value);
+        finish('save', 'buddi’s settings filled in');
+        // 7. The one command buddi does not run.
+        at('connector');
+        p.install = installFor(await api.tunnelToken(accountId, tunnel.id), deps.platform);
+        p.state = 'waiting';
+        emit();
+        // 8. Wait for cloudflared to connect.
+        const deadline = now().getTime() + (deps.waitMs ?? HEALTH_WAIT_MS);
+        let healthy = false;
+        let first = true;
+        while (!deps.signal?.aborted) {
+            const status = (await api.tunnel(accountId, tunnel.id)).status ?? '';
+            if (status === 'healthy' || status === 'degraded') {
+                healthy = true;
+                break;
+            }
+            if (first) {
+                first = false;
+                step('healthy').state = 'now';
+                emit();
+            }
+            if (now().getTime() >= deadline)
+                break;
+            await sleep(deps.pollMs ?? HEALTH_POLL_MS, deps.signal);
+        }
+        if (!healthy) {
+            if (deps.signal?.aborted) {
+                p.state = 'stopped';
+                p.error = 'Stopped waiting. Everything buddi made stays; run the command, then Set it up again to finish.';
+                emit();
+                return p;
+            }
+            current = 'healthy';
+            throw new SetupError('The tunnel hasn’t connected yet. Run the command above on this computer, then try again.');
+        }
+        finish('connector', 'Connector installed');
+        finish('healthy', 'Tunnel connected');
+        // 9. Test my setup.
+        at('test');
+        const tested = await deps.test(teamDomain);
+        if (!tested.ok)
+            throw new SetupError(tested.error ?? 'Cloudflare’s signing keys could not be fetched.');
+        finish('test', `${teamDomain} answered with ${tested.keys} signing key${tested.keys === 1 ? '' : 's'}`);
+        p.state = 'done';
+        p.url = `https://${host}`;
+        emit();
+        return p;
+    }
+    catch (error) {
+        const s = step(current);
+        s.state = 'failed';
+        s.why = sentence(error);
+        p.state = 'failed';
+        p.error = s.why;
+        emit();
+        return p;
+    }
+}
+/**
+ * Remove what buddi made: the Access application and policy, the DNS record
+ * and the tunnel whose ids the setup record holds, and nothing found by name.
+ * Each id leaves the record as its object goes, so Remove again retries only
+ * what is left. Turns signing in through Cloudflare off when the setting is
+ * the one setup filled in, and forgets the record. Never throws.
+ */
+export async function removeCloudflareSetup(deps, onProgress = () => { }) {
+    const lease = deps.lease ?? claimSetupOperation('remove');
+    if (!lease) {
+        const p = freshProgress();
+        p.state = 'failed';
+        p.error = setupBusySentence(setupOperation());
+        onProgress(structuredClone(p));
+        return p;
+    }
+    try {
+        return await removeRun(deps, onProgress);
+    }
+    finally {
+        if (!deps.lease)
+            lease.release();
+    }
+}
+async function removeRun(deps, onProgress) {
+    const record = await deps.readRecord();
+    const host = record?.host ?? (deps.host ? normalizeHost(deps.host) : null) ?? '';
+    const p = freshProgress(host, record?.email ?? '');
+    p.state = 'removing';
+    p.steps = [];
+    const emit = () => onProgress(structuredClone(p));
+    emit();
+    if (!record) {
+        p.state = 'removed';
+        p.error = host
+            ? `buddi has no record of making anything in Cloudflare for ${host}, so it removes nothing. Delete what is there in Cloudflare by hand.`
+            : 'buddi has made nothing in Cloudflare to remove.';
+        emit();
+        return p;
+    }
+    const { api } = deps;
+    const failures = [];
+    const gone = (error) => error instanceof CloudflareApiError && error.status === 404;
+    const attempt = async (what, key, run) => {
+        const id = record[key];
+        if (!id)
+            return;
+        try {
+            await run(id);
+            p.removed.push(what);
+            emit();
+        }
+        catch (error) {
+            // Already deleted in Cloudflare: nothing left to remove.
+            if (!gone(error)) {
+                failures.push(`${what}: ${sentence(error)}`);
+                return;
+            }
+        }
+        record[key] = undefined;
+        await deps.saveRecord(record).catch(() => undefined);
+    };
+    const account = record.accountId;
+    const zone = record.zone.id;
+    await attempt('the Access application', 'appId', (id) => api.deleteApp(account, id));
+    await attempt('its policy', 'policyId', (id) => api.deletePolicy(account, id));
+    await attempt('the DNS record', 'dnsRecordId', (id) => api.deleteDnsRecord(zone, id));
+    await attempt('the tunnel', 'tunnelId', (id) => api.deleteTunnel(account, id));
+    // buddi's setting goes off when it is the one setup filled in.
+    try {
+        const setting = await deps.readSetting();
+        if (setting.enabled && (!record.aud || setting.aud === record.aud) && setting.publicOrigin === `https://${host}`) {
+            await deps.saveSetting({ ...setting, enabled: false, aud: '', teamDomain: '', publicOrigin: '' });
+        }
+    }
+    catch {
+        failures.push('buddi’s own setting could not be turned off; turn it off by hand.');
+    }
+    if (failures.length === 0)
+        await deps.saveRecord(null).catch(() => undefined);
+    p.state = 'removed';
+    p.uninstall = uninstallFor(deps.platform);
+    p.error = failures.length ? `Some of it is still there. ${failures.join(' ')} Try Remove again.` : null;
+    emit();
+    return p;
+}
+/** "a, b and c". */
+export function removedInWords(items) {
+    if (items.length === 0)
+        return 'nothing';
+    if (items.length === 1)
+        return items[0];
+    return `${items.slice(0, -1).join(', ')} and ${items[items.length - 1]}`;
+}
+//# sourceMappingURL=cloudflare-setup.js.map

package/packages/gateway/dist/web/access/cloudflare-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-setup.js","sourceRoot":"","sources":["../../../src/web/access/cloudflare-setup.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,uBAAuB,EAAgC,MAAM,iBAAiB,CAAC;AAExG,0FAA0F;AAC1F,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAC;AAC9D,8CAA8C;AAC9C,MAAM,CAAC,MAAM,uBAAuB,GAAG,sBAAsB,CAAC;AAE9D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC;AACvE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC;AACzE,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,UAAU,IAAI,GAAG,CAAC;AACtE,mDAAmD;AACnD,8GAA8G;AAC9G,MAAM,CAAC,MAAM,iBAAiB,GAAG,0HAA0H,CAAC;AAC5J,MAAM,CAAC,MAAM,WAAW,GAAG,iEAAiE,CAAC;AAC7F,MAAM,UAAU,GAAG,CAAC,CAAc,EAAW,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;AAE9F,gEAAgE;AAChE,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC;AACpC,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,CAAC;AAwF1C,gEAAgE;AAChE,IAAI,SAAS,GAAoC,IAAI,CAAC;AAEtD,+EAA+E;AAC/E,MAAM,UAAU,mBAAmB,CAAC,IAAoB;IACtD,IAAI,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC;IACtB,SAAS,GAAG,IAAI,CAAC;IACjB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,SAAS,KAAK,IAAI;YAAE,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AAChF,CAAC;AAED,oCAAoC;AACpC,MAAM,CAAC,MAAM,cAAc,GAAG,GAA0B,EAAE,CAAC,SAAS,EAAE,IAAI,IAAI,IAAI,CAAC;AAEnF,0DAA0D;AAC1D,MAAM,UAAU,iBAAiB,CAAC,IAA2B;IAC3D,OAAO,IAAI,KAAK,QAAQ;QACtB,CAAC,CAAC,sFAAsF;QACxF,CAAC,CAAC,iFAAiF,CAAC;AACxF,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3G,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,wCAAwC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAChH,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,IAAI,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,6FAA6F,CAAC;IAC7I,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,+BAA+B,CAAC;IAChF,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,6CAA6C,CAAC;IACrJ,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,QAAyB;IACjE,wEAAwE;IACxE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,kBAAkB,CAAC,2DAA2D,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACrI,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,mCAAmC,KAAK,EAAE,EAAE,IAAI,EAAE,8GAA8G,EAAE,CAAC;IACvL,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO;YACL,OAAO,EAAE,oCAAoC,KAAK,EAAE;YACpD,IAAI,EAAE,4KAA4K;SACnL,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,oCAAoC,KAAK,EAAE;QACpD,IAAI,EAAE,wFAAwF;KAC/F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAyB;IACpD,OAAO,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,oCAAoC,CAAC;AAC3G,CAAC;AAED,MAAM,MAAM,GAAgC;IAC1C,KAAK,EAAE,oBAAoB;IAC3B,MAAM,EAAE,qBAAqB;IAC7B,KAAK,EAAE,sBAAsB;IAC7B,GAAG,EAAE,uBAAuB;IAC5B,MAAM,EAAE,iCAAiC;IACzC,IAAI,EAAE,6BAA6B;IACnC,SAAS,EAAE,uBAAuB;IAClC,OAAO,EAAE,mCAAmC;IAC5C,IAAI,EAAE,mBAAmB;CAC1B,CAAC;AACF,MAAM,KAAK,GAAkB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AAEnH,MAAM,UAAU,aAAa,CAAC,IAAI,GAAG,EAAE,EAAE,KAAK,GAAG,EAAE;IACjD,OAAO;QACL,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK;QAC1B,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACnE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;KACtF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,YAAY,kBAAkB,IAAI,KAAK,YAAY,UAAU;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IAC7F,4EAA4E;IAC5E,OAAO,oFAAoF,CAAC;AAC9F,CAAC;AAED,MAAM,UAAW,SAAQ,KAAK;CAAG;AAEjC,MAAM,SAAS,GAAG,CAAC,EAAU,EAAE,MAAoB,EAAiB,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;IAC7F,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACtC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/F,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAiB,EAAE,IAAe,EAAE,aAAyC,GAAG,EAAE,GAAE,CAAC;IAC5H,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/D,CAAC,CAAC,KAAK,GAAG,QAAQ,CAAC;QACnB,CAAC,CAAC,KAAK,GAAG,iBAAiB,CAAC,cAAc,EAAE,CAAC,CAAC;QAC9C,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IACjD,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACnC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,KAAiB,EAAE,IAAe,EAAE,UAAsC;IAChG,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACjC,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC;IACpB,MAAM,IAAI,GAAG,GAAS,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,CAAC,EAAe,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAE,CAAC;IACpE,MAAM,KAAK,GAAG,CAAC,EAAe,EAAQ,EAAE,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/G,MAAM,MAAM,GAAG,CAAC,EAAe,EAAE,IAAY,EAAQ,EAAE,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACzH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3C,IAAI,OAAO,GAAgB,OAAO,CAAC;IACnC,MAAM,EAAE,GAAG,CAAC,EAAe,EAAQ,EAAE,GAAG,OAAO,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnE,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC,CAAC,KAAK,GAAG,QAAQ,CAAC;QACnB,CAAC,CAAC,GAAG,GAAG,OAAO,CAAC;QAChB,CAAC,CAAC,KAAK,GAAG,QAAQ,CAAC;QACnB,CAAC,CAAC,KAAK,GAAG,OAAO,CAAC;QAClB,IAAI,EAAE,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACrB,qDAAqD;QACrD,EAAE,CAAC,OAAO,CAAC,CAAC;QACZ,sEAAsE;QACtE,+CAA+C;QAC/C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACvH,MAAM,IAAI,UAAU,CAAC,wBAAwB,OAAO,CAAC,IAAI,iEAAiE,CAAC,CAAC;QAC9H,CAAC;QACD,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrE,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACvF,MAAM,IAAI,GAAG,MAAM;YACjB,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;YAC3C,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;gBAAE,MAAM,IAAI,UAAU,CAAC,GAAG,IAAI,qBAAqB,MAAM,GAAG,CAAC,CAAC;YAChH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,UAAU,CAAC,2CAA2C,mBAAmB,mBAAmB,IAAI,mBAAmB,CAAC,CAAC;YACvJ,MAAM,IAAI,UAAU,CAAC,iDAAiD,IAAI,iBAAiB,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACjL,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,IAAI,UAAkB,CAAC;QACvB,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kBAAkB,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAChE,MAAM,IAAI,UAAU,CAAC,8IAA8I,CAAC,CAAC;YACvK,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,qCAAqC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,UAAU,CAAC,8IAA8I,CAAC,CAAC;QACvK,CAAC;QACD,MAAM,MAAM,GAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACpI,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACzC,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QACnK,CAAC;QACD,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC;QACnC,qEAAqE;QACrE,MAAM,OAAO,GAAG,CAAC,IAAY,EAAS,EAAE;YACtC,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC;YACnB,MAAM,IAAI,UAAU,CAAC,GAAG,IAAI,mGAAmG,CAAC,CAAC;QACnI,CAAC,CAAC;QACF,MAAM,CAAC,OAAO,EAAE,mBAAmB,IAAI,CAAC,IAAI,WAAW,UAAU,EAAE,CAAC,CAAC;QAErE,iBAAiB;QACjB,EAAE,CAAC,QAAQ,CAAC,CAAC;QACb,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACnD,IAAI,MAAM,IAAI,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,QAAQ,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,mCAAmC,IAAI,kCAAkC,CAAC,CAAC;QAC1I,MAAM,YAAY,GAAG,MAAM,KAAK,IAAI,CAAC;QACrC,MAAM,KAAK,MAAM,GAAG,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACnD,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,CAAC,QAAQ,EAAE,UAAU,IAAI,IAAI,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAEzE,sEAAsE;QACtE,EAAE,CAAC,OAAO,CAAC,CAAC;QACZ,MAAM,OAAO,GAAG,oBAAoB,IAAI,CAAC,WAAW,EAAE,CAAC;QACvD,MAAM,GAAG,CAAC,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/D,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,MAAM,OAAO,EAAE,CAAC,CAAC;QAExC,yCAAyC;QACzC,EAAE,CAAC,KAAK,CAAC,CAAC;QACV,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,mBAAmB,CAAC;QAC/C,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,CAAC;QACnG,IAAI,QAAQ,GAAG,cAAc,IAAI,QAAQ,CAAC;QAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;QAC/F,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,QAAQ,CAAC,EAAE,KAAK,MAAM,CAAC,WAAW,IAAI,CAAC,KAAK;gBAAE,OAAO,CAAC,GAAG,IAAI,+CAA+C,CAAC,CAAC;YAClH,MAAM,CAAC,WAAW,GAAG,QAAQ,CAAC,EAAE,CAAC;YACjC,QAAQ,GAAG,cAAc,IAAI,QAAQ,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,WAAW,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,IAAI,UAAU,CAAC,GAAG,IAAI,8BAA8B,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,OAAO,sEAAsE,CAAC,CAAC;YACtK,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK;gBAAE,OAAO,CAAC,GAAG,IAAI,kDAAkD,CAAC,CAAC;YACpG,wEAAwE;YACxE,KAAK,MAAM,GAAG,IAAI,OAAO;gBAAE,MAAM,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACtE,MAAM,CAAC,WAAW,GAAG,CAAC,MAAM,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,CAAC;QACD,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAExB,kDAAkD;QAClD,EAAE,CAAC,QAAQ,CAAC,CAAC;QACb,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;QACnE,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpE,IAAI,WAAW,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,4CAA4C,UAAU,QAAQ,CAAC,CAAC;QACjH,MAAM,cAAc,GAAG,SAAS,IAAI,WAAW,CAAC;QAChD,MAAM,MAAM,GAAG,cAAc;YAC3B,CAAC,CAAC,MAAM,GAAG,CAAC,YAAY,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC;YACzE,CAAC,CAAC,MAAM,GAAG,CAAC,YAAY,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;QACzD,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC;QAClG,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC;QACrF,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,IAAI,UAAU,CAAC,8CAA8C,IAAI,MAAM,UAAU,CAAC,IAAI,kGAAkG,CAAC,CAAC;QAClM,CAAC;QACD,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;QAC5G,IAAI,WAAW,IAAI,WAAW,CAAC,EAAE,KAAK,MAAM,CAAC,KAAK,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,iDAAiD,OAAO,SAAS,IAAI,OAAO,CAAC,CAAC;QACpJ,MAAM,GAAG,GAAgB,WAAW;YAClC,CAAC,CAAC,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;YACtG,CAAC,CAAC,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACzF,MAAM,CAAC,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAC9B,MAAM,IAAI,UAAU,CAAC,wEAAwE,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QACrB,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,CAAC,QAAQ,EAAE,+BAA+B,KAAK,kBAAkB,CAAC,CAAC;QAEzE,oEAAoE;QACpE,EAAE,CAAC,MAAM,CAAC,CAAC;QACX,MAAM,OAAO,GAAG,uBAAuB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC;QAC7H,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,MAAM,IAAI,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;QAE7C,yCAAyC;QACzC,EAAE,CAAC,WAAW,CAAC,CAAC;QAChB,CAAC,CAAC,OAAO,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnF,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC;QACpB,IAAI,EAAE,CAAC;QAEP,sCAAsC;QACtC,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC;QACnE,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,KAAK,GAAG,IAAI,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;YACrE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;gBAAC,OAAO,GAAG,IAAI,CAAC;gBAAC,MAAM;YAAC,CAAC;YAC7E,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,GAAG,KAAK,CAAC;gBACd,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC;gBAC9B,IAAI,EAAE,CAAC;YACT,CAAC;YACD,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,QAAQ;gBAAE,MAAM;YACvC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBACzB,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC;gBACpB,CAAC,CAAC,KAAK,GAAG,gGAAgG,CAAC;gBAC3G,IAAI,EAAE,CAAC;gBACP,OAAO,CAAC,CAAC;YACX,CAAC;YACD,OAAO,GAAG,SAAS,CAAC;YACpB,MAAM,IAAI,UAAU,CAAC,0FAA0F,CAAC,CAAC;QACnH,CAAC;QACD,MAAM,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC;QAC3C,MAAM,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;QAEtC,oBAAoB;QACpB,EAAE,CAAC,MAAM,CAAC,CAAC;QACX,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,IAAI,iDAAiD,CAAC,CAAC;QACxG,MAAM,CAAC,MAAM,EAAE,GAAG,UAAU,kBAAkB,MAAM,CAAC,IAAI,eAAe,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACxG,CAAC,CAAC,KAAK,GAAG,MAAM,CAAC;QACjB,CAAC,CAAC,GAAG,GAAG,WAAW,IAAI,EAAE,CAAC;QAC1B,IAAI,EAAE,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC,CAAC,KAAK,GAAG,QAAQ,CAAC;QACnB,CAAC,CAAC,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC,CAAC,KAAK,GAAG,QAAQ,CAAC;QACnB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC;QAChB,IAAI,EAAE,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAiJ,EACjJ,aAAyC,GAAG,EAAE,GAAE,CAAC;IAEjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,CAAC,GAAG,aAAa,EAAE,CAAC;QAC1B,CAAC,CAAC,KAAK,GAAG,QAAQ,CAAC;QACnB,CAAC,CAAC,KAAK,GAAG,iBAAiB,CAAC,cAAc,EAAE,CAAC,CAAC;QAC9C,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC3C,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACnC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,IAAuI,EACvI,UAAsC;IAEtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACjF,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,KAAK,GAAG,UAAU,CAAC;IACrB,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;IACb,MAAM,IAAI,GAAG,GAAS,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,IAAI,EAAE,CAAC;IACP,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC;QACpB,CAAC,CAAC,KAAK,GAAG,IAAI;YACZ,CAAC,CAAC,4DAA4D,IAAI,sEAAsE;YACxI,CAAC,CAAC,iDAAiD,CAAC;QACtD,IAAI,EAAE,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACrB,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,CAAC,KAAc,EAAW,EAAE,CAAC,KAAK,YAAY,kBAAkB,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC;IACtG,MAAM,OAAO,GAAG,KAAK,EAAE,IAAY,EAAE,GAAsD,EAAE,GAAkC,EAAiB,EAAE;QAChJ,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,EAAE;YAAE,OAAO;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,EAAE,CAAC,CAAC;YACd,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yDAAyD;YACzD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;QAC7E,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC;IACjC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;IAC5B,MAAM,OAAO,CAAC,wBAAwB,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACrF,MAAM,OAAO,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/E,MAAM,OAAO,CAAC,gBAAgB,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IACtF,MAAM,OAAO,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAE/E,+DAA+D;IAC/D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzC,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,YAAY,KAAK,WAAW,IAAI,EAAE,EAAE,CAAC;YACjH,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9E,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC;IACpB,CAAC,CAAC,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC,CAAC,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,8BAA8B,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC;IACxG,IAAI,EAAE,CAAC;IACP,OAAO,CAAC,CAAC;AACX,CAAC;AAED,oBAAoB;AACpB,MAAM,UAAU,cAAc,CAAC,KAAe;IAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAE,CAAC;IACzC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;AAC3E,CAAC"}

package/packages/gateway/dist/web/access/cloudflare-token.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The Cloudflare API token "Set it up for me" uses, kept as an owner secret
+ * (docs/owner-secrets.md): a row named `CLOUDFLARE_API_TOKEN`, its value in
+ * the vault, bound pre-approved to the gateway's own `access.cloudflare`
+ * destination because the owner pasted it into this very panel (or the CLI's
+ * hidden prompt). Saving it primes the scrubber, so the value is masked in
+ * every log line and tool result from then on.
+ *
+ * Read once per setup or Remove run, through `useOwnerSecret` with the value
+ * delivered straight into the caller (the use is recorded like any other),
+ * and held only for that run.
+ */
+import { type Vault } from '@buddi/core';
+import type { Pool } from 'pg';
+export declare const ACCESS_CLOUDFLARE_KIND = "access.cloudflare";
+/** The gateway's destination for the token. Delivered only into the gateway itself. */
+export declare function registerCloudflareTokenDestination(): void;
+export interface CloudflareTokenStore {
+    /** Is one stored? */
+    has(): Promise<boolean>;
+    put(value: string): Promise<void>;
+    /** The value, for one run; null when none is stored or it cannot be read. */
+    use(): Promise<string | null>;
+    remove(): Promise<void>;
+}
+export declare function ownerSecretTokenStore(pool: Pool, vault: Vault | undefined): CloudflareTokenStore;
+/** A store in memory: tests. */
+export declare function memoryTokenStore(initial?: string | null): CloudflareTokenStore & {
+    value: string | null;
+};
+//# sourceMappingURL=cloudflare-token.d.ts.map

package/packages/gateway/dist/web/access/cloudflare-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-token.d.ts","sourceRoot":"","sources":["../../../src/web/access/cloudflare-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EASL,KAAK,KAAK,EACX,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAG/B,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAG1D,uFAAuF;AACvF,wBAAgB,kCAAkC,IAAI,IAAI,CAWzD;AAED,MAAM,WAAW,oBAAoB;IACnC,qBAAqB;IACrB,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACxB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,6EAA6E;IAC7E,GAAG,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC9B,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,SAAS,GAAG,oBAAoB,CAgChG;AAED,gCAAgC;AAChC,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,MAAM,GAAG,IAAW,GAAG,oBAAoB,GAAG;IAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAS/G"}

package/packages/gateway/dist/web/access/cloudflare-token.js

@@ -0,0 +1,74 @@
+/**
+ * The Cloudflare API token "Set it up for me" uses, kept as an owner secret
+ * (docs/owner-secrets.md): a row named `CLOUDFLARE_API_TOKEN`, its value in
+ * the vault, bound pre-approved to the gateway's own `access.cloudflare`
+ * destination because the owner pasted it into this very panel (or the CLI's
+ * hidden prompt). Saving it primes the scrubber, so the value is masked in
+ * every log line and tool result from then on.
+ *
+ * Read once per setup or Remove run, through `useOwnerSecret` with the value
+ * delivered straight into the caller (the use is recorded like any other),
+ * and held only for that run.
+ */
+import { deleteOwnerSecret, findSecret, primeSecretScrubber, putOwnerSecret, registerSecretDestination, secretDestination, useOwnerSecret, } from '@buddi/core';
+import { CLOUDFLARE_TOKEN_SECRET } from './cloudflare-setup.js';
+export const ACCESS_CLOUDFLARE_KIND = 'access.cloudflare';
+const TARGET = 'setup';
+/** The gateway's destination for the token. Delivered only into the gateway itself. */
+export function registerCloudflareTokenDestination() {
+    if (secretDestination(ACCESS_CLOUDFLARE_KIND))
+        return;
+    registerSecretDestination('access', {
+        kind: ACCESS_CLOUDFLARE_KIND,
+        maxRule: 'pre-approved',
+        checkTarget: (target) => target === TARGET,
+        describe: () => 'Cloudflare setup (Settings → Sign in from elsewhere)',
+        deliver() {
+            throw new Error('access.cloudflare delivers through the gateway itself, never through a destination');
+        },
+    });
+}
+export function ownerSecretTokenStore(pool, vault) {
+    registerCloudflareTokenDestination();
+    return {
+        has: async () => (await findSecret(pool, CLOUDFLARE_TOKEN_SECRET)) !== null,
+        async put(value) {
+            if (!vault)
+                throw new Error('This installation has no vault, so the token cannot be kept.');
+            await putOwnerSecret(pool, vault, {
+                name: CLOUDFLARE_TOKEN_SECRET,
+                value: value.trim(),
+                bindings: [{ kind: ACCESS_CLOUDFLARE_KIND, target: TARGET, rule: 'pre-approved' }],
+            });
+            await primeSecretScrubber();
+        },
+        async use() {
+            let value = null;
+            const result = await useOwnerSecret({
+                pool,
+                vault,
+                plugin: 'access',
+                buddi: { version: '0.0', plugin: 'access' },
+                now: () => new Date(),
+                deliverInto: (delivered) => { value = delivered; },
+            }, { name: CLOUDFLARE_TOKEN_SECRET, kind: ACCESS_CLOUDFLARE_KIND, target: TARGET });
+            return 'done' in result ? value : null;
+        },
+        async remove() {
+            if (vault)
+                await deleteOwnerSecret(pool, vault, CLOUDFLARE_TOKEN_SECRET);
+        },
+    };
+}
+/** A store in memory: tests. */
+export function memoryTokenStore(initial = null) {
+    const store = {
+        value: initial,
+        has: async () => store.value !== null,
+        put: async (value) => { store.value = value.trim(); },
+        use: async () => store.value,
+        remove: async () => { store.value = null; },
+    };
+    return store;
+}
+//# sourceMappingURL=cloudflare-token.js.map

package/packages/gateway/dist/web/access/cloudflare-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-token.js","sourceRoot":"","sources":["../../../src/web/access/cloudflare-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EACL,iBAAiB,EACjB,UAAU,EACV,mBAAmB,EACnB,cAAc,EACd,yBAAyB,EACzB,iBAAiB,EACjB,cAAc,GAGf,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAC1D,MAAM,MAAM,GAAG,OAAO,CAAC;AAEvB,uFAAuF;AACvF,MAAM,UAAU,kCAAkC;IAChD,IAAI,iBAAiB,CAAC,sBAAsB,CAAC;QAAE,OAAO;IACtD,yBAAyB,CAAC,QAAQ,EAAE;QAClC,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,cAAc;QACvB,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,MAAM;QAC1C,QAAQ,EAAE,GAAG,EAAE,CAAC,sDAAsD;QACtE,OAAO;YACL,MAAM,IAAI,KAAK,CAAC,oFAAoF,CAAC,CAAC;QACxG,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAWD,MAAM,UAAU,qBAAqB,CAAC,IAAU,EAAE,KAAwB;IACxE,kCAAkC,EAAE,CAAC;IACrC,OAAO;QACL,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC,KAAK,IAAI;QAC3E,KAAK,CAAC,GAAG,CAAC,KAAK;YACb,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;YAC5F,MAAM,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE;gBAChC,IAAI,EAAE,uBAAuB;gBAC7B,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE;gBACnB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;aACnF,CAAC,CAAC;YACH,MAAM,mBAAmB,EAAE,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,GAAG;YACP,IAAI,KAAK,GAAkB,IAAI,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC;gBACE,IAAI;gBACJ,KAAK;gBACL,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAA0B;gBACnE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;gBACrB,WAAW,EAAE,CAAC,SAAS,EAAE,EAAE,GAAG,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC;aACnD,EACD,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,EAAE,CAChF,CAAC;YACF,OAAO,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,MAAM;YACV,IAAI,KAAK;gBAAE,MAAM,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,uBAAuB,CAAC,CAAC;QAC3E,CAAC;KACF,CAAC;AACJ,CAAC;AAED,gCAAgC;AAChC,MAAM,UAAU,gBAAgB,CAAC,UAAyB,IAAI;IAC5D,MAAM,KAAK,GAAG;QACZ,KAAK,EAAE,OAAO;QACd,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI;QACrC,GAAG,EAAE,KAAK,EAAE,KAAa,EAAE,EAAE,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7D,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK;QAC5B,MAAM,EAAE,KAAK,IAAI,EAAE,GAAG,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC;KAC5C,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC"}