alchemy 2.0.0-beta.55 → 2.0.0-beta.56

package/lib/Cloudflare/Firewall/AccessRule.d.ts

@@ -0,0 +1,151 @@
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+declare const FirewallAccessRuleTypeId: "Cloudflare.Firewall.AccessRule";
+type FirewallAccessRuleTypeId = typeof FirewallAccessRuleTypeId;
+/**
+ * The action an IP Access rule applies to a matched request.
+ *
+ * Note: `block` for `country`/`asn` targets requires an Enterprise plan;
+ * `challenge` and `managed_challenge` work on all plans.
+ */
+export type FirewallAccessRuleMode = "block" | "challenge" | "whitelist" | "js_challenge" | "managed_challenge";
+/**
+ * What a rule's configuration matches on: a single IPv4 (`ip`), a single
+ * IPv6 (`ip6`), a CIDR range (`ip_range`), an AS number (`asn`), or a
+ * two-letter ISO-3166-1 alpha-2 country code (`country`).
+ */
+export type FirewallAccessRuleTarget = "ip" | "ip6" | "ip_range" | "asn" | "country";
+/**
+ * The match configuration of an IP Access rule. Immutable — the Cloudflare
+ * API only allows `mode`/`notes` to be patched, so changing the
+ * configuration replaces the rule.
+ */
+export interface FirewallAccessRuleConfiguration {
+    /**
+     * What the rule matches on.
+     */
+    target: FirewallAccessRuleTarget;
+    /**
+     * The value to match — e.g. `198.51.100.4` (`ip`), `2001:db8::/64`
+     * (`ip_range`), `AS13335` (`asn`), or `US` (`country`).
+     */
+    value: string;
+}
+export interface FirewallAccessRuleProps {
+    /**
+     * Zone the rule applies to. When omitted, the rule is created at the
+     * account level and applies to every zone in the account.
+     *
+     * Stable — moving a rule between scopes triggers a replacement.
+     */
+    zoneId?: string;
+    /**
+     * The rule's match configuration (target + value).
+     *
+     * Immutable — the API has no way to change a rule's configuration
+     * (only `mode`/`notes` are patchable), so changing it triggers a
+     * replacement.
+     */
+    configuration: FirewallAccessRuleConfiguration;
+    /**
+     * The action to apply to a matched request. Mutable — patched in place.
+     */
+    mode: FirewallAccessRuleMode;
+    /**
+     * An informative summary of the rule, typically used as a reminder or
+     * explanation. Mutable — patched in place.
+     */
+    notes?: string;
+}
+export interface FirewallAccessRuleAttributes {
+    /** Cloudflare-assigned identifier of the IP Access rule. */
+    ruleId: string;
+    /** Zone the rule belongs to, or `undefined` for account-scoped rules. */
+    zoneId: string | undefined;
+    /** Account the rule was created under. */
+    accountId: string;
+    /** The rule's match configuration. */
+    configuration: FirewallAccessRuleConfiguration;
+    /** The action applied to matched requests. */
+    mode: FirewallAccessRuleMode;
+    /** The actions available for this rule. */
+    allowedModes: FirewallAccessRuleMode[];
+    /** The rule's informative summary, if set. */
+    notes: string | undefined;
+    /** ISO8601 creation timestamp. */
+    createdOn: string | undefined;
+    /** ISO8601 last-modified timestamp. */
+    modifiedOn: string | undefined;
+}
+export type FirewallAccessRule = Resource<FirewallAccessRuleTypeId, FirewallAccessRuleProps, FirewallAccessRuleAttributes, never, Providers>;
+/**
+ * A Cloudflare IP Access rule — block, challenge, or whitelist requests by
+ * IP, CIDR range, ASN, or country, either on a single zone or across the
+ * whole account.
+ *
+ * A rule's identity is its `configuration` (target + value) within a scope:
+ * Cloudflare rejects a second rule for the same configuration with a
+ * duplicate error, and the configuration cannot be changed after creation —
+ * only `mode` and `notes` are mutable. Changing `configuration` or moving
+ * the rule between zone and account scope triggers a replacement.
+ *
+ * Safety: IP Access rules carry no ownership markers. When there is no
+ * prior state, `read` scans the scope for an existing rule with the same
+ * configuration and reports it as `Unowned`, so the engine refuses to take
+ * it over unless `--adopt` (or `adopt(true)`) is set.
+ *
+ * @section Blocking an IP
+ * @example Block a single IPv4 address on a zone
+ * ```typescript
+ * yield* Cloudflare.FirewallAccessRule("BlockBadActor", {
+ *   zoneId: zone.zoneId,
+ *   configuration: { target: "ip", value: "198.51.100.4" },
+ *   mode: "block",
+ *   notes: "repeated credential stuffing",
+ * });
+ * ```
+ *
+ * @example Block a CIDR range account-wide
+ * ```typescript
+ * // No zoneId — the rule applies to every zone in the account.
+ * yield* Cloudflare.FirewallAccessRule("BlockScannerRange", {
+ *   configuration: { target: "ip_range", value: "203.0.113.0/24" },
+ *   mode: "block",
+ * });
+ * ```
+ *
+ * @section Challenging traffic
+ * @example Managed challenge for a country
+ * ```typescript
+ * // `block` for country targets is Enterprise-only; challenges work on
+ * // all plans.
+ * yield* Cloudflare.FirewallAccessRule("ChallengeCountry", {
+ *   zoneId: zone.zoneId,
+ *   configuration: { target: "country", value: "KP" },
+ *   mode: "managed_challenge",
+ * });
+ * ```
+ *
+ * @section Whitelisting
+ * @example Always allow an office IP
+ * ```typescript
+ * yield* Cloudflare.FirewallAccessRule("AllowOffice", {
+ *   zoneId: zone.zoneId,
+ *   configuration: { target: "ip", value: "192.0.2.10" },
+ *   mode: "whitelist",
+ *   notes: "office egress IP",
+ * });
+ * ```
+ *
+ * @see https://developers.cloudflare.com/waf/tools/ip-access-rules/
+ */
+export declare const FirewallAccessRule: import("../../Resource.ts").ResourceClass<FirewallAccessRule>;
+/**
+ * Returns true if the given value is a FirewallAccessRule resource.
+ */
+export declare const isFirewallAccessRule: (value: unknown) => value is FirewallAccessRule;
+export declare const FirewallAccessRuleProvider: () => import("effect/Layer").Layer<Provider.Provider<FirewallAccessRule>, never, CloudflareEnvironment | import("@distilled.cloud/cloudflare").Credentials | import("effect/unstable/http/HttpClient").HttpClient>;
+export {};
+//# sourceMappingURL=AccessRule.d.ts.map

package/lib/Cloudflare/Firewall/AccessRule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessRule.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/Firewall/AccessRule.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAGjD,QAAA,MAAM,wBAAwB,EAAG,gCAAyC,CAAC;AAC3E,KAAK,wBAAwB,GAAG,OAAO,wBAAwB,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAC9B,OAAO,GACP,WAAW,GACX,WAAW,GACX,cAAc,GACd,mBAAmB,CAAC;AAExB;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAChC,IAAI,GACJ,KAAK,GACL,UAAU,GACV,KAAK,GACL,SAAS,CAAC;AAEd;;;;GAIG;AACH,MAAM,WAAW,+BAA+B;IAC9C;;OAEG;IACH,MAAM,EAAE,wBAAwB,CAAC;IACjC;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,aAAa,EAAE,+BAA+B,CAAC;IAC/C;;OAEG;IACH,IAAI,EAAE,sBAAsB,CAAC;IAC7B;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,4BAA4B;IAC3C,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,aAAa,EAAE,+BAA+B,CAAC;IAC/C,8CAA8C;IAC9C,IAAI,EAAE,sBAAsB,CAAC;IAC7B,2CAA2C;IAC3C,YAAY,EAAE,sBAAsB,EAAE,CAAC;IACvC,8CAA8C;IAC9C,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,kCAAkC;IAClC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,uCAAuC;IACvC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CACvC,wBAAwB,EACxB,uBAAuB,EACvB,4BAA4B,EAC5B,KAAK,EACL,SAAS,CACV,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AACH,eAAO,MAAM,kBAAkB,+DAE9B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,UACxB,OAAO,KACb,KAAK,IAAI,kBAE6B,CAAC;AAE1C,eAAO,MAAM,0BAA0B,oNAuKnC,CAAC"}

package/lib/Cloudflare/Firewall/AccessRule.js

@@ -0,0 +1,247 @@
+import * as firewall from "@distilled.cloud/cloudflare/firewall";
+import * as Effect from "effect/Effect";
+import * as Predicate from "effect/Predicate";
+import * as Stream from "effect/Stream";
+import { Unowned } from "../../AdoptPolicy.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.js";
+import { listAllZones } from "../Zone/lookup.js";
+const FirewallAccessRuleTypeId = "Cloudflare.Firewall.AccessRule";
+/**
+ * A Cloudflare IP Access rule — block, challenge, or whitelist requests by
+ * IP, CIDR range, ASN, or country, either on a single zone or across the
+ * whole account.
+ *
+ * A rule's identity is its `configuration` (target + value) within a scope:
+ * Cloudflare rejects a second rule for the same configuration with a
+ * duplicate error, and the configuration cannot be changed after creation —
+ * only `mode` and `notes` are mutable. Changing `configuration` or moving
+ * the rule between zone and account scope triggers a replacement.
+ *
+ * Safety: IP Access rules carry no ownership markers. When there is no
+ * prior state, `read` scans the scope for an existing rule with the same
+ * configuration and reports it as `Unowned`, so the engine refuses to take
+ * it over unless `--adopt` (or `adopt(true)`) is set.
+ *
+ * @section Blocking an IP
+ * @example Block a single IPv4 address on a zone
+ * ```typescript
+ * yield* Cloudflare.FirewallAccessRule("BlockBadActor", {
+ *   zoneId: zone.zoneId,
+ *   configuration: { target: "ip", value: "198.51.100.4" },
+ *   mode: "block",
+ *   notes: "repeated credential stuffing",
+ * });
+ * ```
+ *
+ * @example Block a CIDR range account-wide
+ * ```typescript
+ * // No zoneId — the rule applies to every zone in the account.
+ * yield* Cloudflare.FirewallAccessRule("BlockScannerRange", {
+ *   configuration: { target: "ip_range", value: "203.0.113.0/24" },
+ *   mode: "block",
+ * });
+ * ```
+ *
+ * @section Challenging traffic
+ * @example Managed challenge for a country
+ * ```typescript
+ * // `block` for country targets is Enterprise-only; challenges work on
+ * // all plans.
+ * yield* Cloudflare.FirewallAccessRule("ChallengeCountry", {
+ *   zoneId: zone.zoneId,
+ *   configuration: { target: "country", value: "KP" },
+ *   mode: "managed_challenge",
+ * });
+ * ```
+ *
+ * @section Whitelisting
+ * @example Always allow an office IP
+ * ```typescript
+ * yield* Cloudflare.FirewallAccessRule("AllowOffice", {
+ *   zoneId: zone.zoneId,
+ *   configuration: { target: "ip", value: "192.0.2.10" },
+ *   mode: "whitelist",
+ *   notes: "office egress IP",
+ * });
+ * ```
+ *
+ * @see https://developers.cloudflare.com/waf/tools/ip-access-rules/
+ */
+export const FirewallAccessRule = Resource(FirewallAccessRuleTypeId);
+/**
+ * Returns true if the given value is a FirewallAccessRule resource.
+ */
+export const isFirewallAccessRule = (value) => Predicate.hasProperty(value, "Type") &&
+    value.Type === FirewallAccessRuleTypeId;
+export const FirewallAccessRuleProvider = () => Provider.succeed(FirewallAccessRule, {
+    stables: ["ruleId", "zoneId", "accountId", "allowedModes", "createdOn"],
+    diff: Effect.fn(function* ({ olds = {}, news }) {
+        const o = olds;
+        const n = news;
+        // No prior props to compare against — let the engine decide.
+        if (o.configuration === undefined)
+            return undefined;
+        // The API can only patch mode/notes — configuration is immutable.
+        if (o.configuration.target !== n.configuration.target ||
+            o.configuration.value !== n.configuration.value) {
+            return { action: "replace" };
+        }
+        // Scope change (zone <-> account, or a different zone) replaces.
+        if ((o.zoneId === undefined) !== (n.zoneId === undefined)) {
+            return { action: "replace" };
+        }
+        // zoneId is Input<string>; compare only once both are concrete.
+        if (typeof o.zoneId === "string" &&
+            typeof n.zoneId === "string" &&
+            o.zoneId !== n.zoneId) {
+            return { action: "replace" };
+        }
+        return undefined;
+    }),
+    read: Effect.fn(function* ({ output, olds }) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        const zoneId = output?.zoneId ?? olds?.zoneId;
+        const acct = output?.accountId ?? accountId;
+        // Owned path: refresh by our persisted rule id.
+        if (output?.ruleId) {
+            const observed = yield* getRule(zoneId, acct, output.ruleId);
+            if (observed)
+                return toAttributes(observed, zoneId, acct);
+        }
+        // Adoption path: a rule with this configuration may already exist in
+        // the scope. Access rules carry no ownership markers, so we cannot
+        // prove we created it — brand it `Unowned` so the engine refuses to
+        // take over unless `adopt` is set.
+        const configuration = output?.configuration ?? olds?.configuration;
+        if (configuration) {
+            const observed = yield* findByConfiguration(zoneId, acct, configuration);
+            if (observed)
+                return Unowned(toAttributes(observed, zoneId, acct));
+        }
+        return undefined;
+    }),
+    reconcile: Effect.fn(function* ({ news, output }) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        // Inputs have been resolved to concrete strings by Plan.
+        const zoneId = news.zoneId;
+        // 1. Observe — the rule id cached on `output` is a hint, not a
+        //    guarantee: a missing rule falls through to the configuration
+        //    scan and then to create.
+        let observed = output?.ruleId
+            ? yield* getRule(zoneId, accountId, output.ruleId)
+            : undefined;
+        // 2. Fall back to scanning the scope for a configuration match.
+        //    Ownership has already been verified upstream — `read` reports
+        //    existing rules as `Unowned` and the engine gates takeover
+        //    behind the adopt policy before reconcile ever runs.
+        if (!observed) {
+            observed = yield* findByConfiguration(zoneId, accountId, news.configuration);
+        }
+        // 3. Ensure — create when missing. A concurrent create surfaces as
+        //    `DuplicateAccessRule` (Cloudflare code 10009): converge by
+        //    re-scanning for the rule that won the race.
+        if (!observed) {
+            observed = yield* createRule(zoneId, accountId, news).pipe(Effect.catchTag("DuplicateAccessRule", (error) => findByConfiguration(zoneId, accountId, news.configuration).pipe(Effect.flatMap((existing) => existing ? Effect.succeed(existing) : Effect.fail(error)))));
+        }
+        // 4. Sync — diff observed mode/notes against desired; skip the
+        //    patch call entirely on a no-op.
+        const dirty = observed.mode !== news.mode ||
+            (news.notes !== undefined && (observed.notes ?? "") !== news.notes);
+        if (dirty) {
+            observed = yield* patchRule(zoneId, accountId, observed.id, news);
+        }
+        return toAttributes(observed, zoneId, accountId);
+    }),
+    // IP Access rules are hybrid-scoped: account-level rules (zoneId
+    // undefined) plus per-zone rules. Enumerate both — the account
+    // collection, then fan out across every zone — and tag each item with
+    // its scope so the result matches the exact `read` Attributes shape.
+    list: Effect.fn(function* () {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        const accountRules = yield* firewall.listAccessRulesForAccount
+            .pages({ accountId })
+            .pipe(Stream.runCollect, Effect.map((chunk) => Array.from(chunk).flatMap((page) => (page.result ?? []).map((rule) => toAttributes(rule, undefined, accountId)))), 
+        // No permission to read account-level rules — skip them.
+        Effect.catchTag("Forbidden", () => Effect.succeed([])));
+        const zones = yield* listAllZones(accountId);
+        const zoneRuleGroups = yield* Effect.forEach(zones, (zone) => firewall.listAccessRulesForZone.pages({ zoneId: zone.id }).pipe(Stream.runCollect, Effect.map((chunk) => Array.from(chunk).flatMap((page) => (page.result ?? []).map((rule) => toAttributes(rule, zone.id, accountId)))), 
+        // Plan-gated / partial zones reject the route; skip them.
+        Effect.catchTag("Forbidden", () => Effect.succeed([]))), { concurrency: 10 });
+        return [...accountRules, ...zoneRuleGroups.flat()];
+    }),
+    delete: Effect.fn(function* ({ output }) {
+        // Cloudflare answers DELETE for an already-gone rule with HTTP 200
+        // and `result: null` (not an error envelope), which the typed
+        // response decode rejects — observe first and treat missing as done.
+        const observed = yield* getRule(output.zoneId, output.accountId, output.ruleId);
+        if (!observed)
+            return;
+        yield* deleteRule(output.zoneId, output.accountId, output.ruleId).pipe(Effect.catchTag("AccessRuleNotFound", () => Effect.void));
+    }),
+});
+/**
+ * Read a rule by id, mapping "gone" (`AccessRuleNotFound`, Cloudflare error
+ * code 10001 `firewallaccessrules.api.not_found`) to `undefined`.
+ */
+const getRule = (zoneId, accountId, ruleId) => (zoneId !== undefined
+    ? firewall.getAccessRuleForZone({ zoneId, ruleId })
+    : firewall.getAccessRuleForAccount({ accountId, ruleId })).pipe(Effect.map((rule) => rule), Effect.catchTag("AccessRuleNotFound", () => Effect.succeed(undefined)));
+/**
+ * Find a rule by exact configuration (target + value) within the scope.
+ * The configuration is a rule's identity — Cloudflare rejects duplicates —
+ * so at most one rule can match.
+ */
+const findByConfiguration = (zoneId, accountId, configuration) => (zoneId !== undefined
+    ? firewall.listAccessRulesForZone.items({ zoneId })
+    : firewall.listAccessRulesForAccount.items({ accountId })).pipe(Stream.runCollect, Effect.map((chunk) => Array.from(chunk).find((rule) => rule.configuration.target === configuration.target &&
+    rule.configuration.value === configuration.value)));
+const createRule = (zoneId, accountId, news) => zoneId !== undefined
+    ? firewall.createAccessRuleForZone({
+        zoneId,
+        configuration: news.configuration,
+        mode: news.mode,
+        notes: news.notes,
+    })
+    : firewall.createAccessRuleForAccount({
+        accountId,
+        configuration: news.configuration,
+        mode: news.mode,
+        notes: news.notes,
+    });
+const patchRule = (zoneId, accountId, ruleId, news) => zoneId !== undefined
+    ? firewall.patchAccessRuleForZone({
+        zoneId,
+        ruleId,
+        configuration: news.configuration,
+        mode: news.mode,
+        notes: news.notes,
+    })
+    : firewall.patchAccessRuleForAccount({
+        accountId,
+        ruleId,
+        configuration: news.configuration,
+        mode: news.mode,
+        notes: news.notes,
+    });
+const deleteRule = (zoneId, accountId, ruleId) => zoneId !== undefined
+    ? firewall.deleteAccessRuleForZone({ zoneId, ruleId })
+    : firewall.deleteAccessRuleForAccount({ accountId, ruleId });
+const toAttributes = (rule, zoneId, accountId) => ({
+    ruleId: rule.id,
+    zoneId,
+    accountId,
+    configuration: {
+        // Distilled types each union variant's target/value as optional —
+        // Cloudflare always echoes both for a persisted rule.
+        target: (rule.configuration.target ?? "ip"),
+        value: rule.configuration.value ?? "",
+    },
+    mode: rule.mode,
+    allowedModes: [...rule.allowedModes],
+    notes: rule.notes ?? undefined,
+    createdOn: rule.createdOn ?? undefined,
+    modifiedOn: rule.modifiedOn ?? undefined,
+});
+//# sourceMappingURL=AccessRule.js.map

package/lib/Cloudflare/Firewall/AccessRule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessRule.js","sourceRoot":"","sources":["../../../src/Cloudflare/Firewall/AccessRule.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,sCAAsC,CAAC;AACjE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,SAAS,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,wBAAwB,GAAG,gCAAyC,CAAC;AAqG3E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CACxC,wBAAwB,CACzB,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,KAAc,EACe,EAAE,CAC/B,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC;IACpC,KAAK,CAAC,IAAI,KAAK,wBAAwB,CAAC;AAE1C,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,EAAE,CAC7C,QAAQ,CAAC,OAAO,CAAC,kBAAkB,EAAE;IACnC,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,CAAC;IAEvE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE;QAC5C,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,6DAA6D;QAC7D,IAAI,CAAC,CAAC,aAAa,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACpD,kEAAkE;QAClE,IACE,CAAC,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,aAAa,CAAC,MAAM;YACjD,CAAC,CAAC,aAAa,CAAC,KAAK,KAAK,CAAC,CAAC,aAAa,CAAC,KAAK,EAC/C,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;QACxC,CAAC;QACD,iEAAiE;QACjE,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;YAC1D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;QACxC,CAAC;QACD,gEAAgE;QAChE,IACE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;YAC5B,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;YAC5B,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EACrB,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;QACxC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QACzC,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAK,IAAI,EAAE,MAA6B,CAAC;QACtE,MAAM,IAAI,GAAG,MAAM,EAAE,SAAS,IAAI,SAAS,CAAC;QAE5C,gDAAgD;QAChD,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;YACnB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7D,IAAI,QAAQ;gBAAE,OAAO,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5D,CAAC;QAED,qEAAqE;QACrE,mEAAmE;QACnE,oEAAoE;QACpE,mCAAmC;QACnC,MAAM,aAAa,GAAG,MAAM,EAAE,aAAa,IAAI,IAAI,EAAE,aAAa,CAAC;QACnE,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,mBAAmB,CACzC,MAAM,EACN,IAAI,EACJ,aAAa,CACd,CAAC;YACF,IAAI,QAAQ;gBAAE,OAAO,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAC9C,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,yDAAyD;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,MAA4B,CAAC;QAEjD,+DAA+D;QAC/D,kEAAkE;QAClE,8BAA8B;QAC9B,IAAI,QAAQ,GAAG,MAAM,EAAE,MAAM;YAC3B,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;YAClD,CAAC,CAAC,SAAS,CAAC;QAEd,gEAAgE;QAChE,mEAAmE;QACnE,+DAA+D;QAC/D,yDAAyD;QACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,KAAK,CAAC,CAAC,mBAAmB,CACnC,MAAM,EACN,SAAS,EACT,IAAI,CAAC,aAAa,CACnB,CAAC;QACJ,CAAC;QAED,mEAAmE;QACnE,gEAAgE;QAChE,iDAAiD;QACjD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,IAAI,CACxD,MAAM,CAAC,QAAQ,CAAC,qBAAqB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC/C,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAC7D,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1B,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CACzD,CACF,CACF,CACF,CAAC;QACJ,CAAC;QAED,+DAA+D;QAC/D,qCAAqC;QACrC,MAAM,KAAK,GACT,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;YAC3B,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,KAAK,EAAE,CAAC;YACV,QAAQ,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC,CAAC;IAEF,iEAAiE;IACjE,+DAA+D;IAC/D,sEAAsE;IACtE,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;QACvB,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAE1D,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,yBAAyB;aAC3D,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC;aACpB,IAAI,CACH,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACjC,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAC/B,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CACzC,CACF,CACF;QACD,yDAAyD;QACzD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CACvD,CAAC;QAEJ,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAC1C,KAAK,EACL,CAAC,IAAI,EAAE,EAAE,CACP,QAAQ,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAC7D,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACjC,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAC/B,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CACvC,CACF,CACF;QACD,0DAA0D;QAC1D,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CACvD,EACH,EAAE,WAAW,EAAE,EAAE,EAAE,CACpB,CAAC;QAEF,OAAO,CAAC,GAAG,YAAY,EAAE,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC;IAEF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACrC,mEAAmE;QACnE,8DAA8D;QAC9D,qEAAqE;QACrE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAC7B,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,MAAM,CACd,CAAC;QACF,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,KAAK,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CACpE,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CACzD,CAAC;IACJ,CAAC,CAAC;CACH,CAAC,CAAC;AAQL;;;GAGG;AACH,MAAM,OAAO,GAAG,CACd,MAA0B,EAC1B,SAAiB,EACjB,MAAc,EACd,EAAE,CACF,CAAC,MAAM,KAAK,SAAS;IACnB,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACnD,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAC1D,CAAC,IAAI,CACJ,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAA4B,EAAE,CAAC,IAAI,CAAC,EACpD,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CACvE,CAAC;AAEJ;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,CAC1B,MAA0B,EAC1B,SAAiB,EACjB,aAA8C,EAC9C,EAAE,CACF,CAAC,MAAM,KAAK,SAAS;IACnB,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACnD,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,CAC1D,CAAC,IAAI,CACJ,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CACpB,CAAC,IAAI,EAAwB,EAAE,CAC7B,IAAI,CAAC,aAAa,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM;IAClD,IAAI,CAAC,aAAa,CAAC,KAAK,KAAK,aAAa,CAAC,KAAK,CACnD,CACF,CACF,CAAC;AAEJ,MAAM,UAAU,GAAG,CACjB,MAA0B,EAC1B,SAAiB,EACjB,IAA6B,EAC7B,EAAE,CACF,MAAM,KAAK,SAAS;IAClB,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC;QAC/B,MAAM;QACN,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC;IACJ,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC;QAClC,SAAS;QACT,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;AAET,MAAM,SAAS,GAAG,CAChB,MAA0B,EAC1B,SAAiB,EACjB,MAAc,EACd,IAA6B,EAC7B,EAAE,CACF,MAAM,KAAK,SAAS;IAClB,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QAC9B,MAAM;QACN,MAAM;QACN,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC;IACJ,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QACjC,SAAS;QACT,MAAM;QACN,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;AAET,MAAM,UAAU,GAAG,CACjB,MAA0B,EAC1B,SAAiB,EACjB,MAAc,EACd,EAAE,CACF,MAAM,KAAK,SAAS;IAClB,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACtD,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;AAEjE,MAAM,YAAY,GAAG,CACnB,IAAkB,EAClB,MAA0B,EAC1B,SAAiB,EACa,EAAE,CAAC,CAAC;IAClC,MAAM,EAAE,IAAI,CAAC,EAAE;IACf,MAAM;IACN,SAAS;IACT,aAAa,EAAE;QACb,kEAAkE;QAClE,sDAAsD;QACtD,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,IAAI,IAAI,CAA6B;QACvE,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,IAAI,EAAE;KACtC;IACD,IAAI,EAAE,IAAI,CAAC,IAA8B;IACzC,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAA6B;IAChE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;IAC9B,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,SAAS;IACtC,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,SAAS;CACzC,CAAC,CAAC"}

package/lib/Cloudflare/Firewall/Lockdown.d.ts

@@ -0,0 +1,152 @@
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+declare const LockdownTypeId: "Cloudflare.Firewall.Lockdown";
+type LockdownTypeId = typeof LockdownTypeId;
+/**
+ * A single allow-list entry of a Zone Lockdown rule: a single IP address
+ * (`ip`) or a CIDR range (`ip_range`) that is allowed to access the
+ * locked-down URLs.
+ */
+export interface LockdownConfiguration {
+    /**
+     * Whether `value` is a single IP address (`ip`) or a CIDR range
+     * (`ip_range`).
+     */
+    target: "ip" | "ip_range";
+    /**
+     * The IP address (e.g. `198.51.100.4`) or CIDR range
+     * (e.g. `203.0.113.0/24`) to allow.
+     */
+    value: string;
+}
+export interface LockdownProps {
+    /**
+     * Zone the lockdown rule applies to.
+     *
+     * Stable — moving a rule between zones triggers a replacement.
+     */
+    zoneId: string;
+    /**
+     * The URLs to lock down. Each entry is escaped before use, so only simple
+     * wildcard patterns are supported (e.g. `shop.example.com/admin*`).
+     *
+     * Mutable — updated in place via PUT.
+     */
+    urls: string[];
+    /**
+     * The IP addresses and CIDR ranges that are allowed to access the URLs.
+     * Everyone else is blocked.
+     *
+     * Mutable — updated in place via PUT.
+     */
+    configurations: LockdownConfiguration[];
+    /**
+     * An informative summary of the rule. Sanitized server-side (HTML tags
+     * are removed).
+     *
+     * Mutable — updated in place via PUT.
+     */
+    description?: string;
+    /**
+     * When true, the rule is disabled without being deleted.
+     *
+     * Mutable — updated in place via PUT.
+     *
+     * @default false
+     */
+    paused?: boolean;
+    /**
+     * Processing order — a lower number indicates higher priority. Rules
+     * without a priority are processed before rules with one.
+     *
+     * Mutable — updated in place via PUT.
+     */
+    priority?: number;
+}
+export interface LockdownAttributes {
+    /** Cloudflare-assigned identifier of the Zone Lockdown rule. */
+    lockdownId: string;
+    /** Zone the rule belongs to. */
+    zoneId: string;
+    /** The locked-down URL patterns. */
+    urls: string[];
+    /** The allowed IP addresses and CIDR ranges. */
+    configurations: LockdownConfiguration[];
+    /** The rule's informative summary, if set. */
+    description: string | undefined;
+    /** Whether the rule is currently paused. */
+    paused: boolean;
+    /** The rule's processing priority, if set. */
+    priority: number | undefined;
+    /** ISO8601 creation timestamp. */
+    createdOn: string;
+    /** ISO8601 last-modified timestamp. */
+    modifiedOn: string;
+}
+export type Lockdown = Resource<LockdownTypeId, LockdownProps, LockdownAttributes, never, Providers>;
+/**
+ * A Cloudflare Zone Lockdown rule — restrict one or more URL patterns on a
+ * zone so that only an allow-list of IP addresses and CIDR ranges can access
+ * them. Every other visitor receives an "Access Denied" page.
+ *
+ * Everything about a lockdown rule is mutable in place: `urls`,
+ * `configurations`, `description`, `paused`, and `priority` are all updated
+ * via PUT without replacing the rule. Only moving the rule to a different
+ * zone triggers a replacement.
+ *
+ * Zone Lockdown is available on Pro plans and above, with per-plan rule
+ * quotas (Pro: 3, Business: 10, Enterprise: 200). Cloudflare rejects a
+ * second rule covering the same URLs with a duplicate error, so a rule's
+ * URL set acts as its identity within a zone.
+ *
+ * Safety: lockdown rules carry no ownership markers. When there is no prior
+ * state, `read` scans the zone for an existing rule with the same URL set
+ * and reports it as `Unowned`, so the engine refuses to take it over unless
+ * `--adopt` (or `adopt(true)`) is set.
+ *
+ * @section Locking down a URL
+ * @example Allow a single office IP to reach an admin panel
+ * ```typescript
+ * yield* Cloudflare.Lockdown("AdminLockdown", {
+ *   zoneId: zone.zoneId,
+ *   urls: ["shop.example.com/admin*"],
+ *   configurations: [{ target: "ip", value: "198.51.100.4" }],
+ *   description: "only the office can reach /admin",
+ * });
+ * ```
+ *
+ * @example Allow a CIDR range across multiple URLs
+ * ```typescript
+ * yield* Cloudflare.Lockdown("StaffOnly", {
+ *   zoneId: zone.zoneId,
+ *   urls: ["example.com/internal*", "example.com/staging*"],
+ *   configurations: [
+ *     { target: "ip_range", value: "203.0.113.0/24" },
+ *     { target: "ip", value: "198.51.100.4" },
+ *   ],
+ * });
+ * ```
+ *
+ * @section Pausing a rule
+ * @example Temporarily disable a lockdown without deleting it
+ * ```typescript
+ * yield* Cloudflare.Lockdown("AdminLockdown", {
+ *   zoneId: zone.zoneId,
+ *   urls: ["shop.example.com/admin*"],
+ *   configurations: [{ target: "ip", value: "198.51.100.4" }],
+ *   paused: true,
+ * });
+ * ```
+ *
+ * @see https://developers.cloudflare.com/waf/tools/zone-lockdown/
+ */
+export declare const Lockdown: import("../../Resource.ts").ResourceClass<Lockdown>;
+/**
+ * Returns true if the given value is a Lockdown resource.
+ */
+export declare const isLockdown: (value: unknown) => value is Lockdown;
+export declare const LockdownProvider: () => import("effect/Layer").Layer<Provider.Provider<Lockdown>, never, CloudflareEnvironment | import("@distilled.cloud/cloudflare").Credentials | import("effect/unstable/http/HttpClient").HttpClient>;
+export {};
+//# sourceMappingURL=Lockdown.d.ts.map

package/lib/Cloudflare/Firewall/Lockdown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Lockdown.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/Firewall/Lockdown.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAGjD,QAAA,MAAM,cAAc,EAAG,8BAAuC,CAAC;AAC/D,KAAK,cAAc,GAAG,OAAO,cAAc,CAAC;AAE5C;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,MAAM,EAAE,IAAI,GAAG,UAAU,CAAC;IAC1B;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;;;;OAKG;IACH,cAAc,EAAE,qBAAqB,EAAE,CAAC;IACxC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAC;IACnB,gCAAgC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,gDAAgD;IAChD,cAAc,EAAE,qBAAqB,EAAE,CAAC;IACxC,8CAA8C;IAC9C,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,4CAA4C;IAC5C,MAAM,EAAE,OAAO,CAAC;IAChB,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,QAAQ,GAAG,QAAQ,CAC7B,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,KAAK,EACL,SAAS,CACV,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,eAAO,MAAM,QAAQ,qDAAqC,CAAC;AAE3D;;GAEG;AACH,eAAO,MAAM,UAAU,UAAW,OAAO,KAAG,KAAK,IAAI,QACkB,CAAC;AAExE,eAAO,MAAM,gBAAgB,0MAkJzB,CAAC"}