alchemy 2.0.0-beta.55 → 2.0.0-beta.56

package/lib/Cloudflare/Gateway/List.js

@@ -0,0 +1,206 @@
+import * as zeroTrust from "@distilled.cloud/cloudflare/zero-trust";
+import * as Effect from "effect/Effect";
+import * as Predicate from "effect/Predicate";
+import * as Stream from "effect/Stream";
+import { Unowned } from "../../AdoptPolicy.js";
+import { isResolved } from "../../Diff.js";
+import { createPhysicalName } from "../../PhysicalName.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { arrayEqualsUnordered } from "../../Util/equal.js";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.js";
+const GatewayListTypeId = "Cloudflare.Gateway.List";
+/**
+ * A Cloudflare Zero Trust Gateway list — a named set of domains, IPs,
+ * URLs, emails, serial numbers, or device IDs referenced from Gateway
+ * rule wirefilter expressions by UUID (`$<listId>`).
+ *
+ * The list's `type` is immutable (changing it replaces the list); name,
+ * description, and items all converge in place. Items are managed as a
+ * full set — the provider PUTs the complete desired item set and removes
+ * anything not declared.
+ *
+ * @section Creating a List
+ * @example Domain list
+ * ```typescript
+ * const blocked = yield* Cloudflare.GatewayList("BlockedDomains", {
+ *   type: "DOMAIN",
+ *   description: "domains blocked org-wide",
+ *   items: [
+ *     { value: "badsite.example.com" },
+ *     { value: "malware.example.net", description: "known C2" },
+ *   ],
+ * });
+ * ```
+ *
+ * @example IP list
+ * ```typescript
+ * const egress = yield* Cloudflare.GatewayList("OfficeEgress", {
+ *   type: "IP",
+ *   items: [{ value: "203.0.113.0/24" }],
+ * });
+ * ```
+ *
+ * @section Referencing from a Gateway Rule
+ * @example Block DNS lookups for every domain in the list
+ * ```typescript
+ * yield* Cloudflare.GatewayRule("BlockListedDomains", {
+ *   action: "block",
+ *   filters: ["dns"],
+ *   traffic: `any(dns.domains[*] in $${blocked.listId})`,
+ * });
+ * ```
+ *
+ * @see https://developers.cloudflare.com/cloudflare-one/policies/gateway/lists/
+ */
+export const GatewayList = Resource(GatewayListTypeId);
+/**
+ * Returns true if the given value is a GatewayList resource.
+ */
+export const isGatewayList = (value) => Predicate.hasProperty(value, "Type") && value.Type === GatewayListTypeId;
+export const GatewayListProvider = () => Provider.succeed(GatewayList, {
+    stables: ["listId", "accountId", "type", "createdAt"],
+    list: Effect.fn(function* () {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        const lists = yield* zeroTrust.listGatewayLists.items({ accountId }).pipe(Stream.runCollect, Effect.map((chunk) => Array.from(chunk)));
+        return lists.map((list) => toAttributes(list, accountId));
+    }),
+    diff: Effect.fn(function* ({ olds = {}, news, output }) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        if (!isResolved(news))
+            return undefined;
+        if ((output?.accountId ?? accountId) !== accountId) {
+            return { action: "replace" };
+        }
+        // The list type is immutable on Cloudflare's side.
+        const oldType = output?.type ?? olds.type;
+        if (oldType !== undefined && oldType !== news.type) {
+            return { action: "replace" };
+        }
+        return undefined;
+    }),
+    read: Effect.fn(function* ({ id, output, olds }) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        const acct = output?.accountId ?? accountId;
+        // Owned path — refresh by the cached list id.
+        if (output?.listId) {
+            const observed = yield* getList(acct, output.listId);
+            if (observed)
+                return toAttributes(observed, acct);
+        }
+        // Cold read — locate by deterministic name. Gateway lists carry no
+        // ownership markers, so report the match as Unowned to gate adoption.
+        const name = yield* resolveName(id, olds?.name ?? output?.name);
+        const match = yield* findByName(acct, name);
+        if (match?.id) {
+            const observed = yield* getList(acct, match.id);
+            if (observed)
+                return Unowned(toAttributes(observed, acct));
+        }
+        return undefined;
+    }),
+    reconcile: Effect.fn(function* ({ id, news, output }) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        const name = yield* resolveName(id, news.name);
+        const desiredItems = news.items ?? [];
+        // 1. Observe — the cached id is a hint, not a guarantee; fall back
+        //    to a name scan so out-of-band deletes / lost state converge.
+        let observed = output?.listId
+            ? yield* getList(accountId, output.listId)
+            : undefined;
+        if (!observed) {
+            const match = yield* findByName(accountId, name);
+            if (match?.id)
+                observed = yield* getList(accountId, match.id);
+        }
+        // 2. Ensure — create with the full desired body when missing. Names
+        //    are not unique on Cloudflare's side, so there is no
+        //    AlreadyExists race to tolerate.
+        if (!observed) {
+            const created = yield* zeroTrust.createGatewayList({
+                accountId,
+                name,
+                type: news.type,
+                description: news.description,
+                items: desiredItems,
+            });
+            if (!created.id) {
+                return yield* Effect.fail(new Error("Cloudflare did not return an id for the Gateway list"));
+            }
+            // Create echoes items without count — re-read for a full shape.
+            const fresh = yield* getList(accountId, created.id);
+            return toAttributes(fresh ?? { ...created, count: desiredItems.length }, accountId);
+        }
+        // 3. Sync — diff observed name/description/items against desired;
+        //    the update API is a PUT of the full mutable state, so skip the
+        //    call entirely on a no-op. Items compare as an unordered set of
+        //    values (the API may reorder).
+        const observedItems = (observed.items ?? []).map((i) => ({
+            value: i.value ?? "",
+            ...(i.description != null ? { description: i.description } : {}),
+        }));
+        const dirty = observed.name !== name ||
+            (news.description !== undefined &&
+                (observed.description ?? "") !== news.description) ||
+            !sameItems(observedItems, desiredItems);
+        if (dirty) {
+            yield* zeroTrust.updateGatewayList({
+                accountId,
+                listId: observed.id,
+                name,
+                description: news.description ?? observed.description ?? undefined,
+                items: desiredItems,
+            });
+            // PUT echoes count but not items — re-read for the full shape.
+            const fresh = yield* getList(accountId, observed.id);
+            if (fresh)
+                return toAttributes(fresh, accountId);
+        }
+        return toAttributes(observed, accountId);
+    }),
+    delete: Effect.fn(function* ({ output }) {
+        // Lists still referenced by Gateway rules can fail deletion — rules
+        // that reference the list id as an Input get correct destroy
+        // ordering. A missing list (GatewayListNotFound, code 2218) means
+        // we're done.
+        yield* zeroTrust
+            .deleteGatewayList({
+            accountId: output.accountId,
+            listId: output.listId,
+        })
+            .pipe(Effect.catchTag("GatewayListNotFound", () => Effect.void));
+    }),
+});
+/**
+ * Read a list by id, mapping "gone" (`GatewayListNotFound`, Cloudflare
+ * error code 2218) to `undefined`.
+ */
+const getList = (accountId, listId) => zeroTrust.getGatewayList({ accountId, listId }).pipe(Effect.map((l) => l), Effect.catchTag("GatewayListNotFound", () => Effect.succeed(undefined)));
+/**
+ * Find a list by exact name. Names are not unique on Cloudflare's side;
+ * pick the oldest match for determinism.
+ */
+const findByName = (accountId, name) => zeroTrust.listGatewayLists.items({ accountId }).pipe(Stream.filter((l) => l.name === name), Stream.runCollect, Effect.map((chunk) => Array.from(chunk)
+    .sort((a, b) => (a.createdAt ?? "").localeCompare(b.createdAt ?? ""))
+    .at(0)));
+const resolveName = (id, name) => Effect.gen(function* () {
+    if (name)
+        return name;
+    return yield* createPhysicalName({ id, lowercase: true });
+});
+const sameItems = (observed, desired) => arrayEqualsUnordered(observed.map((i) => `${i.value}${i.description ?? ""}`), desired.map((i) => `${i.value}${i.description ?? ""}`));
+const toAttributes = (list, accountId) => ({
+    listId: list.id ?? "",
+    accountId,
+    name: list.name ?? "",
+    type: (list.type ?? "DOMAIN"),
+    description: list.description ?? "",
+    items: (list.items ?? []).map((i) => ({
+        value: i.value ?? "",
+        ...(i.description != null ? { description: i.description } : {}),
+    })),
+    count: list.count ?? (list.items ?? []).length,
+    createdAt: list.createdAt ?? undefined,
+    updatedAt: list.updatedAt ?? undefined,
+});
+//# sourceMappingURL=List.js.map

package/lib/Cloudflare/Gateway/List.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"List.js","sourceRoot":"","sources":["../../../src/Cloudflare/Gateway/List.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,wCAAwC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,SAAS,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAGpE,MAAM,iBAAiB,GAAG,yBAAkC,CAAC;AA4F7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAc,iBAAiB,CAAC,CAAC;AAEpE;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAc,EAAwB,EAAE,CACpE,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,CAAC;AAE3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,EAAE,CACtC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE;IAC5B,OAAO,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,CAAC;IAErD,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;QACvB,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CACvE,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CACzC,CAAC;QACF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC;IAEF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACpD,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACxC,IAAI,CAAC,MAAM,EAAE,SAAS,IAAI,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;YACnD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;QACxC,CAAC;QACD,mDAAmD;QACnD,MAAM,OAAO,GAAG,MAAM,EAAE,IAAI,IAAK,IAAyB,CAAC,IAAI,CAAC;QAChE,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YACnD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;QACxC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QAC7C,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,EAAE,SAAS,IAAI,SAAS,CAAC;QAE5C,8CAA8C;QAC9C,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;YACnB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACrD,IAAI,QAAQ;gBAAE,OAAO,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpD,CAAC;QAED,mEAAmE;QACnE,sEAAsE;QACtE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,MAAM,EAAE,IAAI,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK,EAAE,EAAE,EAAE,CAAC;YACd,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;YAChD,IAAI,QAAQ;gBAAE,OAAO,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAClD,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAEtC,mEAAmE;QACnE,kEAAkE;QAClE,IAAI,QAAQ,GAAG,MAAM,EAAE,MAAM;YAC3B,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;YAC1C,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACjD,IAAI,KAAK,EAAE,EAAE;gBAAE,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,oEAAoE;QACpE,yDAAyD;QACzD,qCAAqC;QACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC;gBACjD,SAAS;gBACT,IAAI;gBACJ,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,KAAK,EAAE,YAAY;aACpB,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAChB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAClE,CAAC;YACJ,CAAC;YACD,gEAAgE;YAChE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACpD,OAAO,YAAY,CACjB,KAAK,IAAI,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,EAAE,EACnD,SAAS,CACV,CAAC;QACJ,CAAC;QAED,kEAAkE;QAClE,oEAAoE;QACpE,oEAAoE;QACpE,mCAAmC;QACnC,MAAM,aAAa,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvD,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;YACpB,GAAG,CAAC,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC,CAAC,CAAC;QACJ,MAAM,KAAK,GACT,QAAQ,CAAC,IAAI,KAAK,IAAI;YACtB,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS;gBAC7B,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC;YACpD,CAAC,SAAS,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;QAC1C,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC;gBACjC,SAAS;gBACT,MAAM,EAAE,QAAQ,CAAC,EAAG;gBACpB,IAAI;gBACJ,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,QAAQ,CAAC,WAAW,IAAI,SAAS;gBAClE,KAAK,EAAE,YAAY;aACpB,CAAC,CAAC;YACH,+DAA+D;YAC/D,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAG,CAAC,CAAC;YACtD,IAAI,KAAK;gBAAE,OAAO,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC3C,CAAC,CAAC;IAEF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACrC,oEAAoE;QACpE,6DAA6D;QAC7D,kEAAkE;QAClE,cAAc;QACd,KAAK,CAAC,CAAC,SAAS;aACb,iBAAiB,CAAC;YACjB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC;aACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC;CACH,CAAC,CAAC;AAIL;;;GAGG;AACH,MAAM,OAAO,GAAG,CAAC,SAAiB,EAAE,MAAc,EAAE,EAAE,CACpD,SAAS,CAAC,cAAc,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAClD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAA4B,EAAE,CAAC,CAAC,CAAC,EAC9C,MAAM,CAAC,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CACxE,CAAC;AAEJ;;;GAGG;AACH,MAAM,UAAU,GAAG,CAAC,SAAiB,EAAE,IAAY,EAAE,EAAE,CACrD,SAAS,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAClD,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EACrC,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;KACd,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;KACpE,EAAE,CAAC,CAAC,CAAC,CACT,CACF,CAAC;AAEJ,MAAM,WAAW,GAAG,CAAC,EAAU,EAAE,IAAwB,EAAE,EAAE,CAC3D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC,CAAC,CAAC;AAEL,MAAM,SAAS,GAAG,CAChB,QAAwC,EACxC,OAAuC,EAC9B,EAAE,CACX,oBAAoB,CAClB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,EACxD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,CACxD,CAAC;AAEJ,MAAM,YAAY,GAAG,CACnB,IAA8C,EAC9C,SAAiB,EACM,EAAE,CAAC,CAAC;IAC3B,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;IACrB,SAAS;IACT,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;IACrB,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAoB;IAChD,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE;IACnC,KAAK,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpC,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;QACpB,GAAG,CAAC,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC,CAAC;IACH,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM;IAC9C,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,SAAS;IACtC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,SAAS;CACvC,CAAC,CAAC"}

package/lib/Cloudflare/Gateway/Location.d.ts

@@ -0,0 +1,142 @@
+import * as zeroTrust from "@distilled.cloud/cloudflare/zero-trust";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+declare const GatewayLocationTypeId: "Cloudflare.Gateway.Location";
+type GatewayLocationTypeId = typeof GatewayLocationTypeId;
+/**
+ * A source network range (CIDR) requests at a Gateway location may
+ * originate from.
+ */
+export interface GatewayLocationNetwork {
+    /**
+     * IPv4 CIDR, e.g. `203.0.113.0/24`.
+     */
+    network: string;
+}
+/**
+ * Destination endpoint configuration for a Gateway location. Re-exports
+ * distilled's request shape so every server-recognised knob (DoH networks
+ * and token requirement, DoT, IPv4/IPv6 toggles) is available without
+ * re-declaring the structure.
+ */
+export type GatewayLocationEndpoints = NonNullable<zeroTrust.UpdateGatewayLocationRequest["endpoints"]>;
+export interface GatewayLocationProps {
+    /**
+     * Display name for the location. Used as a stable identifier so the
+     * provider can locate it by name during adoption / state recovery. If
+     * omitted, a unique name is generated from the app, stage, and logical ID.
+     *
+     * @default ${app}-${stage}-${id}
+     */
+    name?: string;
+    /**
+     * Whether this location is the default for the account. Cloudflare
+     * rejects demoting the current default directly — promote another
+     * location instead. Mutable.
+     *
+     * @default false
+     */
+    clientDefault?: boolean;
+    /**
+     * Whether the location must resolve EDNS (EDNS Client Subnet) queries.
+     * Mutable.
+     *
+     * @default false
+     */
+    ecsSupport?: boolean;
+    /**
+     * Identifier of the pair of DNS destination IPv4 addresses assigned to
+     * this location. When absent, Cloudflare's shared IPv4 pair is used.
+     * Mutable.
+     */
+    dnsDestinationIpsId?: string;
+    /**
+     * Destination endpoint configuration (DoH / DoT / IPv4 / IPv6 toggles
+     * and source networks). Mutable.
+     */
+    endpoints?: GatewayLocationEndpoints;
+    /**
+     * Source network ranges (IPv4 CIDRs) requests at this location originate
+     * from. Only takes effect when non-empty and the IPv4 endpoint is
+     * enabled. Mutable.
+     *
+     * @default []
+     */
+    networks?: GatewayLocationNetwork[];
+}
+export interface GatewayLocationAttributes {
+    /** UUID of the location, assigned by Cloudflare. */
+    locationId: string;
+    /** Cloudflare account that owns the location. */
+    accountId: string;
+    /** Display name of the location. */
+    name: string;
+    /** Whether this location is the account default. */
+    clientDefault: boolean;
+    /** Whether the location resolves EDNS queries. */
+    ecsSupport: boolean;
+    /**
+     * Server-generated DNS-over-HTTPS subdomain that receives this
+     * location's DNS requests (`https://<dohSubdomain>.cloudflare-gateway.com/dns-query`).
+     */
+    dohSubdomain: string | undefined;
+    /** Auto-generated IPv6 destination IP assigned to this location. */
+    ip: string | undefined;
+    /** Primary DNS destination IPv4 address (read-only, server-assigned). */
+    ipv4Destination: string | undefined;
+    /** Identifier of the DNS destination IPv4 pair, if a dedicated pair is assigned. */
+    dnsDestinationIpsId: string | undefined;
+    /** Source network ranges configured for this location. */
+    networks: GatewayLocationNetwork[];
+    /** ISO8601 creation timestamp. */
+    createdAt: string | undefined;
+    /** ISO8601 last-update timestamp. */
+    updatedAt: string | undefined;
+}
+export type GatewayLocation = Resource<GatewayLocationTypeId, GatewayLocationProps, GatewayLocationAttributes, never, Providers>;
+/**
+ * A Cloudflare Zero Trust Gateway DNS location — a configured source of
+ * DNS traffic (an office, a home network, a device fleet) with its own
+ * DNS-over-HTTPS endpoint and optional dedicated destination IPs.
+ *
+ * Cloudflare assigns each location a stable `dohSubdomain`; point your
+ * network's DoH resolver at
+ * `https://<dohSubdomain>.cloudflare-gateway.com/dns-query` and Gateway
+ * DNS policies apply to its traffic. All declared properties converge in
+ * place — nothing on a location forces a replacement.
+ *
+ * @section Creating a Location
+ * @example DoH-only location
+ * ```typescript
+ * const office = yield* Cloudflare.GatewayLocation("Office", {
+ *   ecsSupport: false,
+ * });
+ * // Point your resolver at the assigned DoH endpoint:
+ * const doh = office.dohSubdomain;
+ * ```
+ *
+ * @example Location with IPv4 source networks
+ * ```typescript
+ * const office = yield* Cloudflare.GatewayLocation("Office", {
+ *   networks: [{ network: "203.0.113.0/24" }],
+ *   endpoints: {
+ *     doh: { enabled: true },
+ *     dot: { enabled: false },
+ *     ipv4: { enabled: true },
+ *     ipv6: { enabled: false },
+ *   },
+ * });
+ * ```
+ *
+ * @see https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/agentless/dns/locations/
+ */
+export declare const GatewayLocation: import("../../Resource.ts").ResourceClass<GatewayLocation>;
+/**
+ * Returns true if the given value is a GatewayLocation resource.
+ */
+export declare const isGatewayLocation: (value: unknown) => value is GatewayLocation;
+export declare const GatewayLocationProvider: () => import("effect/Layer").Layer<Provider.Provider<GatewayLocation>, never, CloudflareEnvironment | import("@distilled.cloud/cloudflare").Credentials | import("effect/unstable/http/HttpClient").HttpClient | import("../../Stack.ts").Stack | import("../../Stage.ts").Stage>;
+export {};
+//# sourceMappingURL=Location.d.ts.map

package/lib/Cloudflare/Gateway/Location.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Location.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/Gateway/Location.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,wCAAwC,CAAC;AAQpE,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,QAAA,MAAM,qBAAqB,EAAG,6BAAsC,CAAC;AACrE,KAAK,qBAAqB,GAAG,OAAO,qBAAqB,CAAC;AAE1D;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,MAAM,wBAAwB,GAAG,WAAW,CAChD,SAAS,CAAC,4BAA4B,CAAC,WAAW,CAAC,CACpD,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACnC;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,SAAS,CAAC,EAAE,wBAAwB,CAAC;IACrC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,sBAAsB,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,yBAAyB;IACxC,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,aAAa,EAAE,OAAO,CAAC;IACvB,kDAAkD;IAClD,UAAU,EAAE,OAAO,CAAC;IACpB;;;OAGG;IACH,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,oEAAoE;IACpE,EAAE,EAAE,MAAM,GAAG,SAAS,CAAC;IACvB,yEAAyE;IACzE,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,oFAAoF;IACpF,mBAAmB,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,0DAA0D;IAC1D,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACnC,kCAAkC;IAClC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,qCAAqC;IACrC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAED,MAAM,MAAM,eAAe,GAAG,QAAQ,CACpC,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,KAAK,EACL,SAAS,CACV,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,eAAO,MAAM,eAAe,4DAAmD,CAAC;AAEhF;;GAEG;AACH,eAAO,MAAM,iBAAiB,UAAW,OAAO,KAAG,KAAK,IAAI,eACkB,CAAC;AAoB/E,eAAO,MAAM,uBAAuB,mRAwJhC,CAAC"}

package/lib/Cloudflare/Gateway/Location.js

@@ -0,0 +1,249 @@
+import * as zeroTrust from "@distilled.cloud/cloudflare/zero-trust";
+import * as Effect from "effect/Effect";
+import * as Predicate from "effect/Predicate";
+import * as Schedule from "effect/Schedule";
+import * as Stream from "effect/Stream";
+import { Unowned } from "../../AdoptPolicy.js";
+import { createPhysicalName } from "../../PhysicalName.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { arrayEqualsUnordered } from "../../Util/equal.js";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.js";
+const GatewayLocationTypeId = "Cloudflare.Gateway.Location";
+/**
+ * A Cloudflare Zero Trust Gateway DNS location — a configured source of
+ * DNS traffic (an office, a home network, a device fleet) with its own
+ * DNS-over-HTTPS endpoint and optional dedicated destination IPs.
+ *
+ * Cloudflare assigns each location a stable `dohSubdomain`; point your
+ * network's DoH resolver at
+ * `https://<dohSubdomain>.cloudflare-gateway.com/dns-query` and Gateway
+ * DNS policies apply to its traffic. All declared properties converge in
+ * place — nothing on a location forces a replacement.
+ *
+ * @section Creating a Location
+ * @example DoH-only location
+ * ```typescript
+ * const office = yield* Cloudflare.GatewayLocation("Office", {
+ *   ecsSupport: false,
+ * });
+ * // Point your resolver at the assigned DoH endpoint:
+ * const doh = office.dohSubdomain;
+ * ```
+ *
+ * @example Location with IPv4 source networks
+ * ```typescript
+ * const office = yield* Cloudflare.GatewayLocation("Office", {
+ *   networks: [{ network: "203.0.113.0/24" }],
+ *   endpoints: {
+ *     doh: { enabled: true },
+ *     dot: { enabled: false },
+ *     ipv4: { enabled: true },
+ *     ipv6: { enabled: false },
+ *   },
+ * });
+ * ```
+ *
+ * @see https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/agentless/dns/locations/
+ */
+export const GatewayLocation = Resource(GatewayLocationTypeId);
+/**
+ * Returns true if the given value is a GatewayLocation resource.
+ */
+export const isGatewayLocation = (value) => Predicate.hasProperty(value, "Type") && value.Type === GatewayLocationTypeId;
+/**
+ * Right after a location create/update, Cloudflare's edge intermittently
+ * answers the write with a 401 `Unauthorized` carrying "This account does
+ * not have access to this feature." even though the account is fully
+ * entitled — the same transient edge/token-propagation blip the read path
+ * rides out as a 403 `Forbidden`. It clears within a few hundred ms, so we
+ * retry the mutation while we see exactly that message. A genuine
+ * entitlement loss carries the same tag, but the bounded retry surfaces it
+ * quickly instead of looping. Matching the message keeps real auth failures
+ * (a bad/expired token) non-retryable.
+ */
+const isTransientFeatureAccessBlip = (e) => e._tag === "Unauthorized" &&
+    (e.message ?? "").includes("does not have access to this feature");
+export const GatewayLocationProvider = () => Provider.succeed(GatewayLocation, {
+    stables: ["locationId", "accountId", "dohSubdomain", "ip", "createdAt"],
+    // Account-scoped collection: enumerate every Gateway location in the
+    // ambient account, exhaustively paginating, and hydrate each into the
+    // exact `read` Attributes shape. The list response already carries the
+    // full per-location state, so no follow-up get is needed.
+    list: Effect.fn(function* () {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        return yield* zeroTrust.listGatewayLocations.pages({ accountId }).pipe(Stream.runCollect, Effect.map((chunk) => Array.from(chunk).flatMap((page) => (page.result ?? [])
+            .map((l) => toAttributes(l, accountId))
+            // The account's default location can't be deleted while it is
+            // the client default (`CannotDeleteDefaultGatewayLocation`);
+            // never enumerate it for account-wide teardown.
+            .filter((l) => !l.clientDefault))));
+    }),
+    diff: Effect.fn(function* ({ output }) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        if ((output?.accountId ?? accountId) !== accountId) {
+            return { action: "replace" };
+        }
+        // Everything declared on a location converges via PUT.
+        return undefined;
+    }),
+    read: Effect.fn(function* ({ id, output, olds }) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        const acct = output?.accountId ?? accountId;
+        // Owned path — refresh by the cached location id.
+        if (output?.locationId) {
+            const observed = yield* getLocation(acct, output.locationId);
+            if (observed)
+                return toAttributes(observed, acct);
+        }
+        // Cold read — locate by deterministic name. Locations carry no
+        // ownership markers, so report the match as Unowned to gate adoption.
+        const name = yield* resolveName(id, olds?.name ?? output?.name);
+        const match = yield* findByName(acct, name);
+        if (match)
+            return Unowned(toAttributes(match, acct));
+        return undefined;
+    }),
+    reconcile: Effect.fn(function* ({ id, news, output }) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        const name = yield* resolveName(id, news.name);
+        // 1. Observe — the cached id is a hint; fall back to a name scan so
+        //    out-of-band deletes / lost state converge.
+        let observed = output?.locationId
+            ? yield* getLocation(accountId, output.locationId)
+            : undefined;
+        if (!observed) {
+            observed = yield* findByName(accountId, name);
+        }
+        // 2. Ensure — create with the full desired body when missing. Names
+        //    are not unique on Cloudflare's side, so there is no
+        //    AlreadyExists race to tolerate.
+        if (!observed) {
+            const created = yield* zeroTrust
+                .createGatewayLocation({
+                accountId,
+                name,
+                clientDefault: news.clientDefault,
+                ecsSupport: news.ecsSupport,
+                dnsDestinationIpsId: news.dnsDestinationIpsId,
+                endpoints: news.endpoints,
+                networks: news.networks,
+            })
+                // See `isTransientFeatureAccessBlip` — ride out the transient
+                // 401 "does not have access to this feature" edge blip.
+                .pipe(Effect.retry({
+                while: isTransientFeatureAccessBlip,
+                schedule: Schedule.exponential("500 millis"),
+                times: 8,
+            }));
+            return toAttributes(created, accountId);
+        }
+        // 3. Sync — diff observed cloud state against desired; the update
+        //    API is a PUT of the full mutable state, so send everything but
+        //    skip the call entirely on a no-op. Networks compare as an
+        //    unordered set; endpoints stringify-compare only when declared.
+        const desired = {
+            name,
+            clientDefault: news.clientDefault ?? observed.clientDefault ?? false,
+            ecsSupport: news.ecsSupport ?? observed.ecsSupport ?? false,
+            dnsDestinationIpsId: news.dnsDestinationIpsId,
+            endpoints: news.endpoints,
+            networks: news.networks,
+        };
+        const dirty = observed.name !== desired.name ||
+            (observed.clientDefault ?? false) !== desired.clientDefault ||
+            (observed.ecsSupport ?? false) !== desired.ecsSupport ||
+            (news.dnsDestinationIpsId !== undefined &&
+                observed.dnsDestinationIpsId !== news.dnsDestinationIpsId) ||
+            (news.networks !== undefined &&
+                !sameNetworks(observed.networks ?? [], news.networks)) ||
+            (news.endpoints !== undefined &&
+                !sameEndpoints(observed.endpoints, news.endpoints));
+        if (dirty) {
+            const updated = yield* zeroTrust
+                .updateGatewayLocation({
+                accountId,
+                locationId: observed.id,
+                name: desired.name,
+                clientDefault: desired.clientDefault,
+                ecsSupport: desired.ecsSupport,
+                dnsDestinationIpsId: desired.dnsDestinationIpsId,
+                endpoints: desired.endpoints,
+                networks: desired.networks,
+            })
+                // See `isTransientFeatureAccessBlip` — ride out the transient
+                // 401 "does not have access to this feature" edge blip.
+                .pipe(Effect.retry({
+                while: isTransientFeatureAccessBlip,
+                schedule: Schedule.exponential("500 millis"),
+                times: 8,
+            }));
+            return toAttributes(updated, accountId);
+        }
+        return toAttributes(observed, accountId);
+    }),
+    delete: Effect.fn(function* ({ output }) {
+        // Deleting the default location while it is the client default is a
+        // non-retryable 4xx (CannotDeleteDefaultGatewayLocation, code 1217)
+        // and propagates. A missing location (GatewayLocationNotFound, code
+        // 1103) means we're done.
+        yield* zeroTrust
+            .deleteGatewayLocation({
+            accountId: output.accountId,
+            locationId: output.locationId,
+        })
+            .pipe(Effect.catchTag("GatewayLocationNotFound", () => Effect.void));
+    }),
+});
+/**
+ * Read a location by id, mapping "gone" (`GatewayLocationNotFound`,
+ * Cloudflare error code 1103) to `undefined`.
+ */
+const getLocation = (accountId, locationId) => zeroTrust.getGatewayLocation({ accountId, locationId }).pipe(Effect.map((l) => l), Effect.catchTag("GatewayLocationNotFound", () => Effect.succeed(undefined)));
+/**
+ * Find a location by exact name. Names are not unique on Cloudflare's
+ * side; pick the oldest match for determinism.
+ */
+const findByName = (accountId, name) => zeroTrust.listGatewayLocations.items({ accountId }).pipe(Stream.filter((l) => l.name === name), Stream.runCollect, Effect.map((chunk) => Array.from(chunk)
+    .sort((a, b) => (a.createdAt ?? "").localeCompare(b.createdAt ?? ""))
+    .at(0)));
+const resolveName = (id, name) => Effect.gen(function* () {
+    if (name)
+        return name;
+    return yield* createPhysicalName({ id, lowercase: true });
+});
+const sameNetworks = (observed, desired) => arrayEqualsUnordered(observed.map((n) => n.network), desired.map((n) => n.network));
+/**
+ * Endpoints are a deeply nested object whose server echo includes extra
+ * `null`/default fields. Compare only the fields the caller declared.
+ */
+const sameEndpoints = (observed, desired) => {
+    if (!observed)
+        return false;
+    const sameNetworkList = (o, d) => d === undefined ||
+        arrayEqualsUnordered((o ?? []).map((n) => n.network), (d ?? []).map((n) => n.network));
+    const sameToggle = (o, d) => d === undefined || (o ?? false) === d;
+    return (sameToggle(observed.doh.enabled, desired.doh.enabled) &&
+        sameToggle(observed.doh.requireToken, desired.doh.requireToken) &&
+        sameNetworkList(observed.doh.networks, desired.doh.networks) &&
+        sameToggle(observed.dot.enabled, desired.dot.enabled) &&
+        sameNetworkList(observed.dot.networks, desired.dot.networks) &&
+        sameToggle(observed.ipv4.enabled, desired.ipv4.enabled) &&
+        sameToggle(observed.ipv6.enabled, desired.ipv6.enabled) &&
+        sameNetworkList(observed.ipv6.networks, desired.ipv6.networks));
+};
+const toAttributes = (location, accountId) => ({
+    locationId: location.id ?? "",
+    accountId,
+    name: location.name ?? "",
+    clientDefault: location.clientDefault ?? false,
+    ecsSupport: location.ecsSupport ?? false,
+    dohSubdomain: location.dohSubdomain ?? undefined,
+    ip: location.ip ?? undefined,
+    ipv4Destination: location.ipv4Destination ?? undefined,
+    dnsDestinationIpsId: location.dnsDestinationIpsId ?? undefined,
+    networks: (location.networks ?? []).map((n) => ({ network: n.network })),
+    createdAt: location.createdAt ?? undefined,
+    updatedAt: location.updatedAt ?? undefined,
+});
+//# sourceMappingURL=Location.js.map

package/lib/Cloudflare/Gateway/Location.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Location.js","sourceRoot":"","sources":["../../../src/Cloudflare/Gateway/Location.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,wCAAwC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,SAAS,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAGpE,MAAM,qBAAqB,GAAG,6BAAsC,CAAC;AA2GrE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAkB,qBAAqB,CAAC,CAAC;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAc,EAA4B,EAAE,CAC5E,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,MAAM,4BAA4B,GAAG,CAAC,CAGrC,EAAW,EAAE,CACZ,CAAC,CAAC,IAAI,KAAK,cAAc;IACzB,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,sCAAsC,CAAC,CAAC;AAErE,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,EAAE,CAC1C,QAAQ,CAAC,OAAO,CAAC,eAAe,EAAE;IAChC,OAAO,EAAE,CAAC,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,CAAC;IAEvE,qEAAqE;IACrE,sEAAsE;IACtE,uEAAuE;IACvE,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;QACvB,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,OAAO,KAAK,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CACpE,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACjC,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;aAChB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YACvC,8DAA8D;YAC9D,6DAA6D;YAC7D,gDAAgD;aAC/C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CACnC,CACF,CACF,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACnC,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,IAAI,CAAC,MAAM,EAAE,SAAS,IAAI,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;YACnD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;QACxC,CAAC;QACD,uDAAuD;QACvD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QAC7C,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,EAAE,SAAS,IAAI,SAAS,CAAC;QAE5C,kDAAkD;QAClD,IAAI,MAAM,EAAE,UAAU,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YAC7D,IAAI,QAAQ;gBAAE,OAAO,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpD,CAAC;QAED,+DAA+D;QAC/D,sEAAsE;QACtE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,MAAM,EAAE,IAAI,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK;YAAE,OAAO,OAAO,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACrD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAClD,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAE/C,oEAAoE;QACpE,gDAAgD;QAChD,IAAI,QAAQ,GAAG,MAAM,EAAE,UAAU;YAC/B,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC;YAClD,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAChD,CAAC;QAED,oEAAoE;QACpE,yDAAyD;QACzD,qCAAqC;QACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,SAAS;iBAC7B,qBAAqB,CAAC;gBACrB,SAAS;gBACT,IAAI;gBACJ,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC;gBACF,8DAA8D;gBAC9D,wDAAwD;iBACvD,IAAI,CACH,MAAM,CAAC,KAAK,CAAC;gBACX,KAAK,EAAE,4BAA4B;gBACnC,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,YAAY,CAAC;gBAC5C,KAAK,EAAE,CAAC;aACT,CAAC,CACH,CAAC;YACJ,OAAO,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC1C,CAAC;QAED,kEAAkE;QAClE,oEAAoE;QACpE,+DAA+D;QAC/D,oEAAoE;QACpE,MAAM,OAAO,GAAG;YACd,IAAI;YACJ,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,IAAI,KAAK;YACpE,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU,IAAI,KAAK;YAC3D,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;QACF,MAAM,KAAK,GACT,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI;YAC9B,CAAC,QAAQ,CAAC,aAAa,IAAI,KAAK,CAAC,KAAK,OAAO,CAAC,aAAa;YAC3D,CAAC,QAAQ,CAAC,UAAU,IAAI,KAAK,CAAC,KAAK,OAAO,CAAC,UAAU;YACrD,CAAC,IAAI,CAAC,mBAAmB,KAAK,SAAS;gBACrC,QAAQ,CAAC,mBAAmB,KAAK,IAAI,CAAC,mBAAmB,CAAC;YAC5D,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS;gBAC1B,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YACxD,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS;gBAC3B,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QACxD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,SAAS;iBAC7B,qBAAqB,CAAC;gBACrB,SAAS;gBACT,UAAU,EAAE,QAAQ,CAAC,EAAG;gBACxB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;gBAChD,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC;gBACF,8DAA8D;gBAC9D,wDAAwD;iBACvD,IAAI,CACH,MAAM,CAAC,KAAK,CAAC;gBACX,KAAK,EAAE,4BAA4B;gBACnC,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,YAAY,CAAC;gBAC5C,KAAK,EAAE,CAAC;aACT,CAAC,CACH,CAAC;YACJ,OAAO,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC1C,CAAC;QAED,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC3C,CAAC,CAAC;IAEF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACrC,oEAAoE;QACpE,oEAAoE;QACpE,oEAAoE;QACpE,0BAA0B;QAC1B,KAAK,CAAC,CAAC,SAAS;aACb,qBAAqB,CAAC;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC;aACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC;CACH,CAAC,CAAC;AAIL;;;GAGG;AACH,MAAM,WAAW,GAAG,CAAC,SAAiB,EAAE,UAAkB,EAAE,EAAE,CAC5D,SAAS,CAAC,kBAAkB,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAC1D,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAgC,EAAE,CAAC,CAAC,CAAC,EAClD,MAAM,CAAC,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAC5E,CAAC;AAEJ;;;GAGG;AACH,MAAM,UAAU,GAAG,CAAC,SAAiB,EAAE,IAAY,EAAE,EAAE,CACrD,SAAS,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CACtD,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EACrC,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,GAAG,CACR,CAAC,KAAK,EAAgC,EAAE,CACtC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;KACd,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;KACpE,EAAE,CAAC,CAAC,CAAiC,CAC3C,CACF,CAAC;AAEJ,MAAM,WAAW,GAAG,CAAC,EAAU,EAAE,IAAwB,EAAE,EAAE,CAC3D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC,CAAC,CAAC;AAEL,MAAM,YAAY,GAAG,CACnB,QAA+C,EAC/C,OAA8C,EACrC,EAAE,CACX,oBAAoB,CAClB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAC9B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAC9B,CAAC;AAEJ;;;GAGG;AACH,MAAM,aAAa,GAAG,CACpB,QAAuC,EACvC,OAAiC,EACxB,EAAE;IACX,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,eAAe,GAAG,CACtB,CAAwD,EACxD,CAAwD,EACxD,EAAE,CACF,CAAC,KAAK,SAAS;QACf,oBAAoB,CAClB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAC/B,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAChC,CAAC;IACJ,MAAM,UAAU,GAAG,CAAC,CAA6B,EAAE,CAAsB,EAAE,EAAE,CAC3E,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,CACL,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QACrD,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAC/D,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC5D,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QACrD,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC5D,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QACvD,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QACvD,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC/D,CAAC;AACJ,CAAC,CAAC;AAMF,MAAM,YAAY,GAAG,CACnB,QAGkB,EAClB,SAAiB,EACU,EAAE,CAAC,CAAC;IAC/B,UAAU,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE;IAC7B,SAAS;IACT,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,EAAE;IACzB,aAAa,EAAE,QAAQ,CAAC,aAAa,IAAI,KAAK;IAC9C,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,KAAK;IACxC,YAAY,EAAE,QAAQ,CAAC,YAAY,IAAI,SAAS;IAChD,EAAE,EAAE,QAAQ,CAAC,EAAE,IAAI,SAAS;IAC5B,eAAe,EAAE,QAAQ,CAAC,eAAe,IAAI,SAAS;IACtD,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,IAAI,SAAS;IAC9D,QAAQ,EAAE,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACxE,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,SAAS;IAC1C,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,SAAS;CAC3C,CAAC,CAAC"}