alchemy 0.93.4 → 0.93.7

package/lib/cloudflare/access-identity-provider.js

@@ -0,0 +1,229 @@
+import { Resource, ResourceKind } from "../resource.js";
+import { Secret } from "../secret.js";
+import { logger } from "../util/logger.js";
+import { isCloudflareApiError } from "./api-error.js";
+import { extractCloudflareResult, } from "./api-response.js";
+import { createCloudflareApi, } from "./api.js";
+/**
+ * Type guard for {@link AccessIdentityProvider}.
+ */
+export function isAccessIdentityProvider(resource) {
+    return resource?.[ResourceKind] === "cloudflare::AccessIdentityProvider";
+}
+/**
+ * Creates a Cloudflare Zero Trust [Access identity provider](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/)
+ * which lets users sign in to Access-protected applications.
+ *
+ * @example
+ * // Built-in One-Time PIN (no IdP setup required).
+ * const otp = await AccessIdentityProvider("otp", {
+ *   type: "onetimepin",
+ *   name: "Email OTP",
+ * });
+ *
+ * @example
+ * // Google OAuth. clientId is a public OAuth identifier (not a secret).
+ * const google = await AccessIdentityProvider("google", {
+ *   type: "google",
+ *   name: "Google",
+ *   clientId: process.env.GOOGLE_CLIENT_ID!,
+ *   clientSecret: alchemy.secret.env.GOOGLE_CLIENT_SECRET,
+ * });
+ *
+ * @example
+ * // Generic OIDC provider.
+ * const oidc = await AccessIdentityProvider("idp", {
+ *   type: "oidc",
+ *   name: "Corporate IdP",
+ *   authUrl: "https://idp.example.com/oauth2/authorize",
+ *   tokenUrl: "https://idp.example.com/oauth2/token",
+ *   certsUrl: "https://idp.example.com/oauth2/certs",
+ *   clientId: "my-app",
+ *   clientSecret: alchemy.secret.env.IDP_CLIENT_SECRET,
+ *   scopes: ["openid", "email", "profile"],
+ *   pkceEnabled: true,
+ * });
+ */
+export const AccessIdentityProvider = Resource("cloudflare::AccessIdentityProvider", async function (id, props) {
+    const api = await createCloudflareApi(props);
+    const name = props.name ?? this.scope.createPhysicalName(id);
+    const basePath = `/accounts/${api.accountId}/access/identity_providers`;
+    if (this.phase === "delete") {
+        if (this.output?.id && props.delete !== false) {
+            await deleteAccessIdentityProvider(api, this.output.id);
+        }
+        return this.destroy();
+    }
+    // type is immutable — recreate if it changed.
+    if (this.phase === "update" &&
+        this.output &&
+        this.output.type !== props.type) {
+        this.replace(true);
+    }
+    // Cloudflare requires `config` to always be present, even for variants
+    // that don't take any (e.g. `onetimepin`). Omitting it returns
+    // [12130] "unexpected end of JSON input".
+    const body = {
+        name,
+        type: props.type,
+        config: extractIdpConfig(props),
+    };
+    let result;
+    if (this.phase === "update" && this.output?.id) {
+        result = await extractCloudflareResult(`update access identity provider "${name}"`, api.put(`${basePath}/${this.output.id}`, body));
+    }
+    else {
+        const adopt = props.adopt ?? this.scope.adopt;
+        try {
+            result =
+                await extractCloudflareResult(`create access identity provider "${name}"`, api.post(basePath, body));
+        }
+        catch (err) {
+            if (adopt && isAccessDuplicateNameError(err)) {
+                const existing = await findAccessIdentityProviderByName(api, name);
+                if (!existing) {
+                    throw new Error(`Identity provider "${name}" already exists but could not be found for adoption.`, { cause: err });
+                }
+                logger.log(`Adopting existing access identity provider "${name}" (${existing.id})`);
+                result =
+                    await extractCloudflareResult(`adopt access identity provider "${name}"`, api.put(`${basePath}/${existing.id}`, body));
+            }
+            else {
+                throw err;
+            }
+        }
+    }
+    const rest = { ...props };
+    delete rest.adopt;
+    delete rest.delete;
+    // Output convention (CLAUDE.md): secrets are always wrapped. Strict
+    // variants carry `clientSecret` at the top level; the `Other` variant
+    // tucks it inside `config`.
+    if (typeof rest.clientSecret === "string") {
+        rest.clientSecret = Secret.wrap(rest.clientSecret);
+    }
+    const config = rest.config;
+    if (config && typeof config.clientSecret === "string") {
+        rest.config = {
+            ...config,
+            clientSecret: Secret.wrap(config.clientSecret),
+        };
+    }
+    return {
+        ...rest,
+        id: result.id,
+        name: result.name,
+    };
+});
+/**
+ * Top-level prop keys that are *not* part of the IdP-specific configuration
+ * (the wire `config` blob) — Alchemy/Cloudflare metadata, the type
+ * discriminator, and the explicit `config` escape hatch on the `Other`
+ * variant.
+ */
+const IDP_METADATA_KEYS = new Set([
+    "name",
+    "type",
+    "adopt",
+    "delete",
+    "baseUrl",
+    "profile",
+    "apiKey",
+    "apiToken",
+    "accountId",
+    "email",
+    "config",
+]);
+/**
+ * Build the wire-format `config` blob from props. Strict variants store
+ * config fields flat at the top level; the `Other` variant uses an explicit
+ * nested `config` object as an escape hatch.
+ */
+function extractIdpConfig(props) {
+    if ("config" in props && props.config) {
+        return camelToSnakeWithSecrets(props.config);
+    }
+    const flat = {};
+    for (const [key, value] of Object.entries(props)) {
+        if (!IDP_METADATA_KEYS.has(key) && value !== undefined) {
+            flat[key] = value;
+        }
+    }
+    return camelToSnakeWithSecrets(flat);
+}
+/**
+ * Convert a camelCase config object to snake_case for the wire, unwrapping
+ * any {@link Secret} values along the way. Recurses into arrays of objects
+ * (e.g. SAML `headerAttributes`).
+ */
+function camelToSnakeWithSecrets(input) {
+    const out = {};
+    for (const [key, value] of Object.entries(input)) {
+        if (value === undefined)
+            continue;
+        const snakeKey = key.replace(/[A-Z]/g, (c) => `_${c.toLowerCase()}`);
+        out[snakeKey] = transformValue(value);
+    }
+    return out;
+}
+function transformValue(value) {
+    if (value instanceof Secret)
+        return value.unencrypted;
+    if (Array.isArray(value)) {
+        return value.map((item) => item && typeof item === "object" && !Array.isArray(item)
+            ? camelToSnakeWithSecrets(item)
+            : transformValue(item));
+    }
+    return value;
+}
+/**
+ * Cloudflare returns 409/400 with an "already exists" message for duplicate
+ * IdP names.
+ */
+function isAccessDuplicateNameError(err) {
+    if (isCloudflareApiError(err, { status: 409 }) ||
+        isCloudflareApiError(err, { status: 400 })) {
+        const data = err.errorData;
+        return (Array.isArray(data) &&
+            data.some((e) => "message" in e && /already exists/i.test(String(e.message))));
+    }
+    return false;
+}
+/**
+ * Look up an existing IdP by name across paginated results.
+ */
+async function findAccessIdentityProviderByName(api, name) {
+    let page = 1;
+    const perPage = 50;
+    while (true) {
+        const response = await api.get(`/accounts/${api.accountId}/access/identity_providers?page=${page}&per_page=${perPage}`);
+        if (!response.ok)
+            return null;
+        const data = (await response.json());
+        const match = data.result.find((p) => p.name === name);
+        if (match)
+            return match;
+        const info = data.result_info;
+        if (!info || info.page * info.per_page >= info.total_count)
+            return null;
+        page++;
+    }
+}
+/**
+ * Delete an IdP. Cloudflare returns 400 if any Application references it.
+ */
+async function deleteAccessIdentityProvider(api, idpId) {
+    const response = await api.delete(`/accounts/${api.accountId}/access/identity_providers/${idpId}`);
+    if (!response.ok && response.status !== 404) {
+        let body = "";
+        try {
+            body = await response.text();
+        }
+        catch { }
+        if (/in use|reference|associated/i.test(body)) {
+            throw new Error(`Cannot delete identity provider ${idpId}: it is referenced by one or more Access applications. Remove those references first.\n${body}`);
+        }
+        logger.error(`Error deleting access identity provider ${idpId}: ${response.status} ${response.statusText}\n${body}`);
+    }
+}
+//# sourceMappingURL=access-identity-provider.js.map

package/lib/cloudflare/access-identity-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-identity-provider.js","sourceRoot":"","sources":["../../src/cloudflare/access-identity-provider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mBAAmB,GAGpB,MAAM,UAAU,CAAC;AA0RlB;;GAEG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAa;IAEb,OAAO,QAAQ,EAAE,CAAC,YAAY,CAAC,KAAK,oCAAoC,CAAC;AAC3E,CAAC;AASD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,QAAQ,CAC5C,oCAAoC,EACpC,KAAK,WAEH,EAAU,EACV,KAAkC;IAElC,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,aAAa,GAAG,CAAC,SAAS,4BAA4B,CAAC;IAExE,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC9C,MAAM,4BAA4B,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,8CAA8C;IAC9C,IACE,IAAI,CAAC,KAAK,KAAK,QAAQ;QACvB,IAAI,CAAC,MAAM;QACX,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAC/B,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,uEAAuE;IACvE,+DAA+D;IAC/D,0CAA0C;IAC1C,MAAM,IAAI,GAA4B;QACpC,IAAI;QACJ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC;KAChC,CAAC;IAEF,IAAI,MAAwC,CAAC;IAC7C,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;QAC/C,MAAM,GAAG,MAAM,uBAAuB,CACpC,oCAAoC,IAAI,GAAG,EAC3C,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,CAC/C,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM;gBACJ,MAAM,uBAAuB,CAC3B,oCAAoC,IAAI,GAAG,EAC3C,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CACzB,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,KAAK,IAAI,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7C,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,KAAK,CACb,sBAAsB,IAAI,uDAAuD,EACjF,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;gBACJ,CAAC;gBACD,MAAM,CAAC,GAAG,CACR,+CAA+C,IAAI,MAAM,QAAQ,CAAC,EAAE,GAAG,CACxE,CAAC;gBACF,MAAM;oBACJ,MAAM,uBAAuB,CAC3B,mCAAmC,IAAI,GAAG,EAC1C,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,IAAI,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,CAC5C,CAAC;YACN,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAA4B,EAAE,GAAG,KAAK,EAAE,CAAC;IACnD,OAAO,IAAI,CAAC,KAAK,CAAC;IAClB,OAAO,IAAI,CAAC,MAAM,CAAC;IAEnB,oEAAoE;IACpE,sEAAsE;IACtE,4BAA4B;IAC5B,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC1C,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAA6C,CAAC;IAClE,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QACtD,IAAI,CAAC,MAAM,GAAG;YACZ,GAAG,MAAM;YACT,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;SAC/C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,IAAI;QACP,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,IAAI,EAAE,MAAM,CAAC,IAAI;KACQ,CAAC;AAC9B,CAAC,CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAS;IACxC,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,SAAS;IACT,SAAS;IACT,QAAQ;IACR,UAAU;IACV,WAAW;IACX,OAAO;IACP,QAAQ;CACT,CAAC,CAAC;AAEH;;;;GAIG;AACH,SAAS,gBAAgB,CACvB,KAAkC;IAElC,IAAI,QAAQ,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACtC,OAAO,uBAAuB,CAAC,KAAK,CAAC,MAAiC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CACvC,KAA2C,CAC5C,EAAE,CAAC;QACF,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACvD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAC9B,KAA8B;IAE9B,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACrE,GAAG,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,KAAK,YAAY,MAAM;QAAE,OAAO,KAAK,CAAC,WAAW,CAAC;IACtD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACxB,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACtD,CAAC,CAAC,uBAAuB,CAAC,IAA+B,CAAC;YAC1D,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CACzB,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,0BAA0B,CAAC,GAAY;IAC9C,IACE,oBAAoB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC1C,oBAAoB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAC1C,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC;QAC3B,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACnB,IAAI,CAAC,IAAI,CACP,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CACnE,CACF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,gCAAgC,CAC7C,GAAkB,EAClB,IAAY;IAEZ,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,OAAO,GAAG,EAAE,CAAC;IACnB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,GAAG,CAC5B,aAAa,GAAG,CAAC,SAAS,mCAAmC,IAAI,aAAa,OAAO,EAAE,CACxF,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,IAAI,GACR,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAgE,CAAC;QACzF,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QACvD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC;QAC9B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QACxE,IAAI,EAAE,CAAC;IACT,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,4BAA4B,CACzC,GAAkB,EAClB,KAAa;IAEb,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAC/B,aAAa,GAAG,CAAC,SAAS,8BAA8B,KAAK,EAAE,CAChE,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5C,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,IAAI,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,mCAAmC,KAAK,0FAA0F,IAAI,EAAE,CACzI,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,KAAK,CACV,2CAA2C,KAAK,KAAK,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI,EAAE,CACvG,CAAC;IACJ,CAAC;AACH,CAAC"}

package/lib/cloudflare/access-policy.d.ts

@@ -0,0 +1,168 @@
+import type { Context } from "../context.ts";
+import { type AccessRule } from "./access-rule.ts";
+import { type CloudflareApiOptions } from "./api.ts";
+/**
+ * Access decision a policy applies when its rules match.
+ * - `allow`: grant access when an authenticated user matches `include`.
+ * - `deny`: deny access when matched.
+ * - `non_identity`: allow without identity (e.g. service tokens, IP allowlists).
+ * - `bypass`: skip Access entirely (no auth required).
+ */
+export type AccessPolicyDecision = "allow" | "deny" | "non_identity" | "bypass";
+/**
+ * An approval group authorising an access request when
+ * `approvalRequired: true`.
+ */
+export interface AccessPolicyApprovalGroup {
+    /** Number of approvals required from this group. */
+    approvalsNeeded: number;
+    /** Email addresses of approvers. */
+    emailAddresses?: string[];
+    /** UUID of an Access email list. */
+    emailListUuid?: string;
+}
+/**
+ * Optional MFA enforcement on top of the IdP's authentication.
+ */
+export interface AccessPolicyMfaConfig {
+    allowedAuthenticators?: string[];
+    mfaDisabled?: boolean;
+    /** Cloudflare duration string, e.g. `"30m"`. */
+    sessionDuration?: string;
+}
+/**
+ * Connection-protocol-specific options (currently only RDP clipboard
+ * formats are supported by Cloudflare).
+ */
+export interface AccessPolicyConnectionRules {
+    rdp?: {
+        allowedClipboardFormats?: ("text" | "image" | "files")[];
+    };
+}
+/**
+ * Properties for creating or updating an {@link AccessPolicy}.
+ */
+export interface AccessPolicyProps extends CloudflareApiOptions {
+    /**
+     * Display name of the policy.
+     *
+     * @default ${app}-${stage}-${id}
+     */
+    name?: string;
+    /**
+     * Decision the policy applies. **Immutable** — changing the decision will
+     * trigger replacement of the underlying Cloudflare resource.
+     */
+    decision: AccessPolicyDecision;
+    /**
+     * Rules a request must match to be considered (OR logic). Must be
+     * non-empty — Cloudflare rejects policies with no include rules.
+     */
+    include: AccessRule[];
+    /**
+     * Rules that, when matched, exclude the request from this policy.
+     */
+    exclude?: AccessRule[];
+    /**
+     * Rules that must additionally match (AND logic).
+     */
+    require?: AccessRule[];
+    /**
+     * Require explicit approval before granting access.
+     */
+    approvalRequired?: boolean;
+    /**
+     * Approver groups consulted when `approvalRequired: true`.
+     */
+    approvalGroups?: AccessPolicyApprovalGroup[];
+    /**
+     * Prompt the user for a purpose justification on each access.
+     */
+    purposeJustificationRequired?: boolean;
+    /**
+     * Prompt text shown when `purposeJustificationRequired` is true.
+     */
+    purposeJustificationPrompt?: string;
+    /**
+     * Force isolated browser rendering for this policy.
+     */
+    isolationRequired?: boolean;
+    /**
+     * Optional MFA enforcement.
+     */
+    mfaConfig?: AccessPolicyMfaConfig;
+    /**
+     * Override the default Access session duration (Cloudflare duration string).
+     */
+    sessionDuration?: string;
+    /**
+     * Per-protocol connection rules (e.g. RDP clipboard restrictions).
+     */
+    connectionRules?: AccessPolicyConnectionRules;
+    /**
+     * Adopt an existing policy with the same name instead of failing.
+     *
+     * @default false
+     */
+    adopt?: boolean;
+    /**
+     * Whether to delete the policy when removed from Alchemy.
+     *
+     * @default true
+     */
+    delete?: boolean;
+}
+/**
+ * Output for an {@link AccessPolicy}.
+ */
+export type AccessPolicy = Omit<AccessPolicyProps, "adopt" | "delete"> & {
+    /** Cloudflare-assigned policy UUID. */
+    id: string;
+    /** Display name. */
+    name: string;
+    /** Number of applications currently referencing this policy. */
+    appCount: number;
+    /** ISO 8601 creation timestamp. */
+    createdAt: string;
+    /** ISO 8601 last-update timestamp. */
+    updatedAt: string;
+};
+/**
+ * Type guard for {@link AccessPolicy}.
+ */
+export declare function isAccessPolicy(resource: any): resource is AccessPolicy;
+/**
+ * Creates a reusable Cloudflare Zero Trust [Access policy](https://developers.cloudflare.com/cloudflare-one/policies/access/)
+ * that can be attached to one or more {@link AccessApplication} resources.
+ *
+ * @example
+ * // Allow employees from a specific email domain.
+ * const employees = await AccessPolicy("employees", {
+ *   name: "Employees",
+ *   decision: "allow",
+ *   include: [{ email_domain: { domain: "acme.com" } }],
+ * });
+ *
+ * @example
+ * // Bypass Access for an office IP range.
+ * const officeBypass = await AccessPolicy("office-bypass", {
+ *   name: "Office Bypass",
+ *   decision: "bypass",
+ *   include: [{ ip: { ip: "203.0.113.0/24" } }],
+ * });
+ *
+ * @example
+ * // Reference an AccessGroup and require approval.
+ * const sensitive = await AccessPolicy("sensitive", {
+ *   name: "Sensitive admin access",
+ *   decision: "allow",
+ *   include: [{ group: { id: adminGroup } }],
+ *   approvalRequired: true,
+ *   approvalGroups: [
+ *     { approvalsNeeded: 2, emailAddresses: ["security@acme.com"] },
+ *   ],
+ *   isolationRequired: true,
+ * });
+ */
+export declare const AccessPolicy: (((this: any, id: string, props?: {}) => never) & (new (_: never) => never)) | ((this: Context<AccessPolicy>, id: string, props: AccessPolicyProps) => Promise<AccessPolicy>);
+//# sourceMappingURL=access-policy.d.ts.map

package/lib/cloudflare/access-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-policy.d.ts","sourceRoot":"","sources":["../../src/cloudflare/access-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAG7C,OAAO,EAAuB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAMxE,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,UAAU,CAAC;AAElB;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,MAAM,GAAG,cAAc,GAAG,QAAQ,CAAC;AAEhF;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,oDAAoD;IACpD,eAAe,EAAE,MAAM,CAAC;IACxB,oCAAoC;IACpC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,oCAAoC;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gDAAgD;IAChD,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC1C,GAAG,CAAC,EAAE;QACJ,uBAAuB,CAAC,EAAE,CAAC,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,EAAE,CAAC;KAC1D,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,iBAAkB,SAAQ,oBAAoB;IAC7D;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,QAAQ,EAAE,oBAAoB,CAAC;IAE/B;;;OAGG;IACH,OAAO,EAAE,UAAU,EAAE,CAAC;IAEtB;;OAEG;IACH,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC;IAEvB;;OAEG;IACH,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC;IAEvB;;OAEG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B;;OAEG;IACH,cAAc,CAAC,EAAE,yBAAyB,EAAE,CAAC;IAE7C;;OAEG;IACH,4BAA4B,CAAC,EAAE,OAAO,CAAC;IAEvC;;OAEG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;IAEpC;;OAEG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B;;OAEG;IACH,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAElC;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,eAAe,CAAC,EAAE,2BAA2B,CAAC;IAE9C;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,EAAE,OAAO,GAAG,QAAQ,CAAC,GAAG;IACvE,uCAAuC;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,GAAG,GAAG,QAAQ,IAAI,YAAY,CAEtE;AAeD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,YAAY,yFAGf,OAAO,CAAC,YAAY,CAAC,MACvB,MAAM,SACH,iBAAiB,KACvB,OAAO,CAAC,YAAY,CAAC,CAwHzB,CAAC"}

package/lib/cloudflare/access-policy.js

@@ -0,0 +1,176 @@
+import { Resource, ResourceKind } from "../resource.js";
+import { logger } from "../util/logger.js";
+import { serializeAccessRule } from "./access-rule.js";
+import { isCloudflareApiError } from "./api-error.js";
+import { extractCloudflareResult, } from "./api-response.js";
+import { createCloudflareApi, } from "./api.js";
+/**
+ * Type guard for {@link AccessPolicy}.
+ */
+export function isAccessPolicy(resource) {
+    return resource?.[ResourceKind] === "cloudflare::AccessPolicy";
+}
+/**
+ * Creates a reusable Cloudflare Zero Trust [Access policy](https://developers.cloudflare.com/cloudflare-one/policies/access/)
+ * that can be attached to one or more {@link AccessApplication} resources.
+ *
+ * @example
+ * // Allow employees from a specific email domain.
+ * const employees = await AccessPolicy("employees", {
+ *   name: "Employees",
+ *   decision: "allow",
+ *   include: [{ email_domain: { domain: "acme.com" } }],
+ * });
+ *
+ * @example
+ * // Bypass Access for an office IP range.
+ * const officeBypass = await AccessPolicy("office-bypass", {
+ *   name: "Office Bypass",
+ *   decision: "bypass",
+ *   include: [{ ip: { ip: "203.0.113.0/24" } }],
+ * });
+ *
+ * @example
+ * // Reference an AccessGroup and require approval.
+ * const sensitive = await AccessPolicy("sensitive", {
+ *   name: "Sensitive admin access",
+ *   decision: "allow",
+ *   include: [{ group: { id: adminGroup } }],
+ *   approvalRequired: true,
+ *   approvalGroups: [
+ *     { approvalsNeeded: 2, emailAddresses: ["security@acme.com"] },
+ *   ],
+ *   isolationRequired: true,
+ * });
+ */
+export const AccessPolicy = Resource("cloudflare::AccessPolicy", async function (id, props) {
+    const api = await createCloudflareApi(props);
+    const name = props.name ?? this.scope.createPhysicalName(id);
+    const basePath = `/accounts/${api.accountId}/access/policies`;
+    if (this.phase === "delete") {
+        if (this.output?.id && props.delete !== false) {
+            await deleteAccessPolicy(api, this.output.id);
+        }
+        return this.destroy();
+    }
+    if (!props.include || props.include.length === 0) {
+        throw new Error(`AccessPolicy "${name}" requires at least one rule in 'include'.`);
+    }
+    // decision is immutable — recreate if it changed.
+    if (this.phase === "update" &&
+        this.output &&
+        this.output.decision !== props.decision) {
+        this.replace(true);
+    }
+    const body = {
+        name,
+        decision: props.decision,
+        reusable: true,
+        include: props.include.map(serializeAccessRule),
+        exclude: (props.exclude ?? []).map(serializeAccessRule),
+        require: (props.require ?? []).map(serializeAccessRule),
+    };
+    if (props.approvalRequired !== undefined)
+        body.approval_required = props.approvalRequired;
+    if (props.approvalGroups)
+        body.approval_groups = props.approvalGroups.map((g) => ({
+            approvals_needed: g.approvalsNeeded,
+            email_addresses: g.emailAddresses,
+            email_list_uuid: g.emailListUuid,
+        }));
+    if (props.purposeJustificationRequired !== undefined)
+        body.purpose_justification_required = props.purposeJustificationRequired;
+    if (props.purposeJustificationPrompt !== undefined)
+        body.purpose_justification_prompt = props.purposeJustificationPrompt;
+    if (props.isolationRequired !== undefined)
+        body.isolation_required = props.isolationRequired;
+    if (props.sessionDuration !== undefined)
+        body.session_duration = props.sessionDuration;
+    if (props.mfaConfig)
+        body.mfa_config = {
+            allowed_authenticators: props.mfaConfig.allowedAuthenticators,
+            mfa_disabled: props.mfaConfig.mfaDisabled,
+            session_duration: props.mfaConfig.sessionDuration,
+        };
+    if (props.connectionRules?.rdp)
+        body.connection_rules = {
+            rdp: {
+                allowed_clipboard_formats: props.connectionRules.rdp.allowedClipboardFormats,
+            },
+        };
+    let policy;
+    if (this.phase === "update" && this.output?.id) {
+        policy = await extractCloudflareResult(`update access policy "${name}"`, api.put(`${basePath}/${this.output.id}`, body));
+    }
+    else {
+        const adopt = props.adopt ?? this.scope.adopt;
+        try {
+            policy = await extractCloudflareResult(`create access policy "${name}"`, api.post(basePath, body));
+        }
+        catch (err) {
+            if (adopt && isAccessDuplicateNameError(err)) {
+                const existing = await findAccessPolicyByName(api, name);
+                if (!existing) {
+                    throw new Error(`Access policy "${name}" already exists but could not be found for adoption.`, { cause: err });
+                }
+                logger.log(`Adopting existing access policy "${name}" (${existing.id})`);
+                policy = await extractCloudflareResult(`adopt access policy "${name}"`, api.put(`${basePath}/${existing.id}`, body));
+            }
+            else {
+                throw err;
+            }
+        }
+    }
+    return {
+        id: policy.id,
+        name: policy.name,
+        decision: policy.decision,
+        include: props.include,
+        exclude: props.exclude,
+        require: props.require,
+        approvalRequired: props.approvalRequired,
+        approvalGroups: props.approvalGroups,
+        purposeJustificationRequired: props.purposeJustificationRequired,
+        purposeJustificationPrompt: props.purposeJustificationPrompt,
+        isolationRequired: props.isolationRequired,
+        mfaConfig: props.mfaConfig,
+        sessionDuration: props.sessionDuration,
+        connectionRules: props.connectionRules,
+        appCount: policy.app_count ?? 0,
+        createdAt: policy.created_at,
+        updatedAt: policy.updated_at,
+    };
+});
+function isAccessDuplicateNameError(err) {
+    if (isCloudflareApiError(err, { status: 409 }) ||
+        isCloudflareApiError(err, { status: 400 })) {
+        const data = err.errorData;
+        return (Array.isArray(data) &&
+            data.some((e) => "message" in e && /already exists/i.test(String(e.message))));
+    }
+    return false;
+}
+async function findAccessPolicyByName(api, name) {
+    let page = 1;
+    const perPage = 50;
+    while (true) {
+        const response = await api.get(`/accounts/${api.accountId}/access/policies?page=${page}&per_page=${perPage}`);
+        if (!response.ok)
+            return null;
+        const data = (await response.json());
+        const match = data.result.find((p) => p.name === name);
+        if (match)
+            return match;
+        const info = data.result_info;
+        if (!info || info.page * info.per_page >= info.total_count)
+            return null;
+        page++;
+    }
+}
+async function deleteAccessPolicy(api, policyId) {
+    const response = await api.delete(`/accounts/${api.accountId}/access/policies/${policyId}`);
+    if (!response.ok && response.status !== 404) {
+        logger.error(`Error deleting access policy ${policyId}: ${response.status} ${response.statusText}`);
+    }
+}
+//# sourceMappingURL=access-policy.js.map

package/lib/cloudflare/access-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-policy.js","sourceRoot":"","sources":["../../src/cloudflare/access-policy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAmB,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mBAAmB,GAGpB,MAAM,UAAU,CAAC;AAoJlB;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,QAAa;IAC1C,OAAO,QAAQ,EAAE,CAAC,YAAY,CAAC,KAAK,0BAA0B,CAAC;AACjE,CAAC;AAeD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAClC,0BAA0B,EAC1B,KAAK,WAEH,EAAU,EACV,KAAwB;IAExB,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,aAAa,GAAG,CAAC,SAAS,kBAAkB,CAAC;IAE9D,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC9C,MAAM,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,iBAAiB,IAAI,4CAA4C,CAClE,CAAC;IACJ,CAAC;IAED,kDAAkD;IAClD,IACE,IAAI,CAAC,KAAK,KAAK,QAAQ;QACvB,IAAI,CAAC,MAAM;QACX,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EACvC,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,IAAI,GAA4B;QACpC,IAAI;QACJ,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC/C,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC;QACvD,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC;KACxD,CAAC;IACF,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS;QACtC,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC,gBAAgB,CAAC;IAClD,IAAI,KAAK,CAAC,cAAc;QACtB,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtD,gBAAgB,EAAE,CAAC,CAAC,eAAe;YACnC,eAAe,EAAE,CAAC,CAAC,cAAc;YACjC,eAAe,EAAE,CAAC,CAAC,aAAa;SACjC,CAAC,CAAC,CAAC;IACN,IAAI,KAAK,CAAC,4BAA4B,KAAK,SAAS;QAClD,IAAI,CAAC,8BAA8B,GAAG,KAAK,CAAC,4BAA4B,CAAC;IAC3E,IAAI,KAAK,CAAC,0BAA0B,KAAK,SAAS;QAChD,IAAI,CAAC,4BAA4B,GAAG,KAAK,CAAC,0BAA0B,CAAC;IACvE,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS;QACvC,IAAI,CAAC,kBAAkB,GAAG,KAAK,CAAC,iBAAiB,CAAC;IACpD,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS;QACrC,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC,eAAe,CAAC;IAChD,IAAI,KAAK,CAAC,SAAS;QACjB,IAAI,CAAC,UAAU,GAAG;YAChB,sBAAsB,EAAE,KAAK,CAAC,SAAS,CAAC,qBAAqB;YAC7D,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW;YACzC,gBAAgB,EAAE,KAAK,CAAC,SAAS,CAAC,eAAe;SAClD,CAAC;IACJ,IAAI,KAAK,CAAC,eAAe,EAAE,GAAG;QAC5B,IAAI,CAAC,gBAAgB,GAAG;YACtB,GAAG,EAAE;gBACH,yBAAyB,EACvB,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,uBAAuB;aACpD;SACF,CAAC;IAEJ,IAAI,MAA8B,CAAC;IACnC,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;QAC/C,MAAM,GAAG,MAAM,uBAAuB,CACpC,yBAAyB,IAAI,GAAG,EAChC,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,CAC/C,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,uBAAuB,CACpC,yBAAyB,IAAI,GAAG,EAChC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CACzB,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,KAAK,IAAI,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7C,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,KAAK,CACb,kBAAkB,IAAI,uDAAuD,EAC7E,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;gBACJ,CAAC;gBACD,MAAM,CAAC,GAAG,CACR,oCAAoC,IAAI,MAAM,QAAQ,CAAC,EAAE,GAAG,CAC7D,CAAC;gBACF,MAAM,GAAG,MAAM,uBAAuB,CACpC,wBAAwB,IAAI,GAAG,EAC/B,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,IAAI,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,CAC5C,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,4BAA4B,EAAE,KAAK,CAAC,4BAA4B;QAChE,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,QAAQ,EAAE,MAAM,CAAC,SAAS,IAAI,CAAC;QAC/B,SAAS,EAAE,MAAM,CAAC,UAAU;QAC5B,SAAS,EAAE,MAAM,CAAC,UAAU;KAC7B,CAAC;AACJ,CAAC,CACF,CAAC;AAEF,SAAS,0BAA0B,CAAC,GAAY;IAC9C,IACE,oBAAoB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC1C,oBAAoB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAC1C,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC;QAC3B,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACnB,IAAI,CAAC,IAAI,CACP,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CACnE,CACF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,GAAkB,EAClB,IAAY;IAEZ,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,OAAO,GAAG,EAAE,CAAC;IACnB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,GAAG,CAC5B,aAAa,GAAG,CAAC,SAAS,yBAAyB,IAAI,aAAa,OAAO,EAAE,CAC9E,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,IAAI,GACR,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAsD,CAAC;QAC/E,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QACvD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC;QAC9B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QACxE,IAAI,EAAE,CAAC;IACT,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,GAAkB,EAClB,QAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAC/B,aAAa,GAAG,CAAC,SAAS,oBAAoB,QAAQ,EAAE,CACzD,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5C,MAAM,CAAC,KAAK,CACV,gCAAgC,QAAQ,KAAK,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CACtF,CAAC;IACJ,CAAC;AACH,CAAC"}