alchemy 2.0.0-beta.55 → 2.0.0-beta.57

package/lib/Cloudflare/Devices/CustomProfile.d.ts

@@ -0,0 +1,239 @@
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+import type { DeviceDefaultProfile } from "./DefaultProfile.ts";
+declare const DeviceCustomProfileTypeId: "Cloudflare.Devices.CustomProfile";
+type DeviceCustomProfileTypeId = typeof DeviceCustomProfileTypeId;
+/**
+ * Configuration for a WARP custom device profile.
+ *
+ * A custom profile applies its settings to the subset of devices matched
+ * by the `match` wirefilter expression, evaluated in ascending
+ * `precedence` order. Devices not matched by any custom profile fall back
+ * to the account's default profile.
+ */
+export interface DeviceCustomProfileProps {
+    /**
+     * Name of the device settings profile. If omitted, a unique name is
+     * generated from the app, stage, and logical ID.
+     * @default ${app}-${stage}-${id}
+     */
+    name?: string;
+    /**
+     * The wirefilter expression to match devices, e.g.
+     * `identity.email == "user@example.com"` or `os.name == "windows"`.
+     * Mutable — patched in place.
+     */
+    match: string;
+    /**
+     * The precedence of the profile. Lower values indicate higher
+     * precedence; profiles are evaluated in ascending order. Must be
+     * unique within the account.
+     */
+    precedence: number;
+    /**
+     * Whether the profile is applied to matching devices.
+     * @default true
+     */
+    enabled?: boolean;
+    /**
+     * A human-readable description of the profile.
+     */
+    description?: string;
+    /**
+     * Routes that WARP will tunnel for matched devices. Mutually exclusive
+     * with {@link exclude}. Pushed to the per-profile include list endpoint.
+     */
+    include?: DeviceDefaultProfile.SplitTunnelEntry[];
+    /**
+     * Routes that WARP will bypass for matched devices. Mutually exclusive
+     * with {@link include}. Pushed to the per-profile exclude list endpoint.
+     */
+    exclude?: DeviceDefaultProfile.SplitTunnelEntry[];
+    /**
+     * Local-fallback DNS suffixes for matched devices. For each suffix,
+     * WARP resolves matching names via the given DNS servers.
+     */
+    fallbackDomains?: DeviceDefaultProfile.FallbackDomain[];
+    /**
+     * Seconds to wait before activating the captive-portal bypass. A value
+     * of `0` disables the bypass.
+     */
+    captivePortal?: number;
+    /**
+     * Seconds to wait before WARP reconnects after the user disables it.
+     * `0` keeps WARP disabled until the user re-enables it.
+     */
+    autoConnect?: number;
+    /**
+     * Whether the user is allowed to remove the device from the team.
+     */
+    allowedToLeave?: boolean;
+    /**
+     * Whether the user is allowed to switch WARP between Gateway-with-WARP
+     * and other modes.
+     */
+    allowModeSwitch?: boolean;
+    /**
+     * Whether WARP should surface available client updates to the user.
+     */
+    allowUpdates?: boolean;
+    /**
+     * When `true`, fallback domains without an explicit `dnsServer` are NOT
+     * resolved via the system resolver — WARP refuses to resolve them.
+     */
+    disableAutoFallback?: boolean;
+    /**
+     * When `true`, Microsoft 365 service IP ranges are added to the
+     * split-tunnel exclude list automatically.
+     */
+    excludeOfficeIps?: boolean;
+    /**
+     * When `true`, the user cannot turn the WARP switch off.
+     */
+    switchLocked?: boolean;
+    /**
+     * Selects WARP's tunneling behavior: `"warp"` for the full WireGuard
+     * tunnel, `"proxy"` for a local SOCKS proxy on the chosen `port`.
+     */
+    serviceModeV2?: DeviceDefaultProfile.ServiceModeV2;
+    /**
+     * Minutes of LAN access permitted after a WARP reconnect. `0` means
+     * unrestricted until the next WARP cycle.
+     */
+    lanAllowMinutes?: number;
+    /**
+     * Prefix length of the LAN subnet that {@link lanAllowMinutes} applies
+     * to (e.g. `24` for a `/24`).
+     */
+    lanAllowSubnetSize?: number;
+    /**
+     * When `true`, the OS registers WARP's local interface IP with the
+     * on-premises DNS server.
+     */
+    registerInterfaceIpWithDns?: boolean;
+    /**
+     * When `true`, WARP signals SCCM that the device is inside a VPN
+     * boundary. Windows only.
+     */
+    sccmVpnBoundarySupport?: boolean;
+    /**
+     * URL launched when the user clicks "Send Feedback" in the client.
+     */
+    supportUrl?: string;
+    /**
+     * Which underlying tunnel protocol WARP should use (e.g. `"wireguard"`,
+     * `"masque"`).
+     */
+    tunnelProtocol?: string;
+}
+export type DeviceCustomProfileAttributes = {
+    /** API UUID of the profile. */
+    policyId: string;
+    /** Account that owns the profile. */
+    accountId: string;
+    /** Observed profile name. */
+    name: string;
+    /** Observed wirefilter match expression. */
+    match: string | undefined;
+    /** Observed precedence. */
+    precedence: number | undefined;
+    /** Whether the profile is applied to matching devices. */
+    enabled: boolean | undefined;
+    /** Observed description. */
+    description: string | undefined;
+    /** Always `false` — custom profiles are never the default profile. */
+    default: boolean;
+    /** Observed per-profile split-tunnel include list. */
+    include: DeviceDefaultProfile.SplitTunnelEntry[];
+    /** Observed per-profile split-tunnel exclude list. */
+    exclude: DeviceDefaultProfile.SplitTunnelEntry[];
+    /** Observed per-profile fallback domains. */
+    fallbackDomains: DeviceDefaultProfile.FallbackDomain[];
+    /** Observed captive-portal timeout (seconds). */
+    captivePortal: number | undefined;
+    /** Observed auto-connect timeout (seconds). */
+    autoConnect: number | undefined;
+    /** Whether devices are allowed to leave the organization. */
+    allowedToLeave: boolean | undefined;
+    /** Whether the user may switch WARP modes. */
+    allowModeSwitch: boolean | undefined;
+    /** Whether update notifications are shown. */
+    allowUpdates: boolean | undefined;
+    /** Whether auto-fallback to system DNS is disabled. */
+    disableAutoFallback: boolean | undefined;
+    /** Whether Microsoft IPs are auto-excluded. */
+    excludeOfficeIps: boolean | undefined;
+    /** Whether the WARP switch is locked on. */
+    switchLocked: boolean | undefined;
+    /** Tunneling mode configuration. */
+    serviceModeV2: DeviceDefaultProfile.ServiceModeV2 | undefined;
+    /** Whether the WARP IP is registered with the on-prem DNS server. */
+    registerInterfaceIpWithDns: boolean | undefined;
+    /** Whether SCCM VPN-boundary support is enabled. */
+    sccmVpnBoundarySupport: boolean | undefined;
+    /** Send-Feedback URL. */
+    supportUrl: string | undefined;
+    /** Tunnel protocol selection. */
+    tunnelProtocol: string | undefined;
+};
+export type DeviceCustomProfile = Resource<DeviceCustomProfileTypeId, DeviceCustomProfileProps, DeviceCustomProfileAttributes, never, Providers>;
+/**
+ * A Cloudflare WARP **custom device profile** — a settings profile applied
+ * to the subset of devices matched by a wirefilter `match` expression at a
+ * given `precedence`.
+ *
+ * All properties are mutable in place: the profile itself is patched, and
+ * the per-profile split-tunnel include/exclude and fallback-domain lists
+ * are replaced via their dedicated endpoints. Deleting the resource
+ * deletes the profile; matched devices fall back to the account's default
+ * profile.
+ * @resource
+ * @product Devices
+ * @category Cloudflare One (Zero Trust)
+ * @section Creating a profile
+ * @example Profile for a user group
+ * ```typescript
+ * const profile = yield* Cloudflare.DeviceCustomProfile("Contractors", {
+ *   match: 'identity.groups.name == "contractors"',
+ *   precedence: 100,
+ *   description: "Locked-down profile for contractors",
+ *   switchLocked: true,
+ * });
+ * ```
+ *
+ * @section Split tunneling
+ * @example Exclude internal ranges from the tunnel
+ * ```typescript
+ * yield* Cloudflare.DeviceCustomProfile("Engineering", {
+ *   match: 'identity.groups.name == "engineering"',
+ *   precedence: 50,
+ *   exclude: [
+ *     { address: "10.0.0.0/8", description: "RFC1918" },
+ *   ],
+ * });
+ * ```
+ *
+ * @section Fallback domains
+ * @example Resolve a private suffix via an on-prem DNS server
+ * ```typescript
+ * yield* Cloudflare.DeviceCustomProfile("CorpDns", {
+ *   match: 'identity.email matches ".*@corp.example.com"',
+ *   precedence: 10,
+ *   fallbackDomains: [
+ *     { suffix: "corp.example.com", dnsServer: ["10.0.0.53"] },
+ *   ],
+ * });
+ * ```
+ *
+ * @see https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/
+ */
+export declare const DeviceCustomProfile: import("../../Resource.ts").ResourceClass<DeviceCustomProfile>;
+/**
+ * Returns true if the given value is a DeviceCustomProfile resource.
+ */
+export declare const isDeviceCustomProfile: (value: unknown) => value is DeviceCustomProfile;
+export declare const DeviceCustomProfileProvider: () => import("effect/Layer").Layer<Provider.Provider<DeviceCustomProfile>, never, CloudflareEnvironment | import("@distilled.cloud/cloudflare").Credentials | import("effect/unstable/http/HttpClient").HttpClient | import("../../Stack.ts").Stack | import("../../Stage.ts").Stage>;
+export {};
+//# sourceMappingURL=CustomProfile.d.ts.map

package/lib/Cloudflare/Devices/CustomProfile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CustomProfile.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/Devices/CustomProfile.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEhE,QAAA,MAAM,yBAAyB,EAAG,kCAA2C,CAAC;AAC9E,KAAK,yBAAyB,GAAG,OAAO,yBAAyB,CAAC;AAElE;;;;;;;GAOG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,OAAO,CAAC,EAAE,oBAAoB,CAAC,gBAAgB,EAAE,CAAC;IAClD;;;OAGG;IACH,OAAO,CAAC,EAAE,oBAAoB,CAAC,gBAAgB,EAAE,CAAC;IAClD;;;OAGG;IACH,eAAe,CAAC,EAAE,oBAAoB,CAAC,cAAc,EAAE,CAAC;IACxD;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;OAEG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;OAEG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;OAGG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC,aAAa,CAAC;IACnD;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC;;;OAGG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,6BAA6B,GAAG;IAC1C,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,2BAA2B;IAC3B,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,0DAA0D;IAC1D,OAAO,EAAE,OAAO,GAAG,SAAS,CAAC;IAC7B,4BAA4B;IAC5B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,sEAAsE;IACtE,OAAO,EAAE,OAAO,CAAC;IACjB,sDAAsD;IACtD,OAAO,EAAE,oBAAoB,CAAC,gBAAgB,EAAE,CAAC;IACjD,sDAAsD;IACtD,OAAO,EAAE,oBAAoB,CAAC,gBAAgB,EAAE,CAAC;IACjD,6CAA6C;IAC7C,eAAe,EAAE,oBAAoB,CAAC,cAAc,EAAE,CAAC;IACvD,iDAAiD;IACjD,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,+CAA+C;IAC/C,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,6DAA6D;IAC7D,cAAc,EAAE,OAAO,GAAG,SAAS,CAAC;IACpC,8CAA8C;IAC9C,eAAe,EAAE,OAAO,GAAG,SAAS,CAAC;IACrC,8CAA8C;IAC9C,YAAY,EAAE,OAAO,GAAG,SAAS,CAAC;IAClC,uDAAuD;IACvD,mBAAmB,EAAE,OAAO,GAAG,SAAS,CAAC;IACzC,+CAA+C;IAC/C,gBAAgB,EAAE,OAAO,GAAG,SAAS,CAAC;IACtC,4CAA4C;IAC5C,YAAY,EAAE,OAAO,GAAG,SAAS,CAAC;IAClC,oCAAoC;IACpC,aAAa,EAAE,oBAAoB,CAAC,aAAa,GAAG,SAAS,CAAC;IAC9D,qEAAqE;IACrE,0BAA0B,EAAE,OAAO,GAAG,SAAS,CAAC;IAChD,oDAAoD;IACpD,sBAAsB,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5C,yBAAyB;IACzB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,iCAAiC;IACjC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CACxC,yBAAyB,EACzB,wBAAwB,EACxB,6BAA6B,EAC7B,KAAK,EACL,SAAS,CACV,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,eAAO,MAAM,mBAAmB,gEAE/B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,qBAAqB,UACzB,OAAO,KACb,KAAK,IAAI,mBAE8B,CAAC;AAE3C,eAAO,MAAM,2BAA2B,uRAyQpC,CAAC"}

package/lib/Cloudflare/Devices/CustomProfile.js

@@ -0,0 +1,356 @@
+import * as zeroTrust from "@distilled.cloud/cloudflare/zero-trust";
+import * as Effect from "effect/Effect";
+import * as Predicate from "effect/Predicate";
+import * as Stream from "effect/Stream";
+import { Unowned } from "../../AdoptPolicy.js";
+import { createPhysicalName } from "../../PhysicalName.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.js";
+const DeviceCustomProfileTypeId = "Cloudflare.Devices.CustomProfile";
+/**
+ * A Cloudflare WARP **custom device profile** — a settings profile applied
+ * to the subset of devices matched by a wirefilter `match` expression at a
+ * given `precedence`.
+ *
+ * All properties are mutable in place: the profile itself is patched, and
+ * the per-profile split-tunnel include/exclude and fallback-domain lists
+ * are replaced via their dedicated endpoints. Deleting the resource
+ * deletes the profile; matched devices fall back to the account's default
+ * profile.
+ * @resource
+ * @product Devices
+ * @category Cloudflare One (Zero Trust)
+ * @section Creating a profile
+ * @example Profile for a user group
+ * ```typescript
+ * const profile = yield* Cloudflare.DeviceCustomProfile("Contractors", {
+ *   match: 'identity.groups.name == "contractors"',
+ *   precedence: 100,
+ *   description: "Locked-down profile for contractors",
+ *   switchLocked: true,
+ * });
+ * ```
+ *
+ * @section Split tunneling
+ * @example Exclude internal ranges from the tunnel
+ * ```typescript
+ * yield* Cloudflare.DeviceCustomProfile("Engineering", {
+ *   match: 'identity.groups.name == "engineering"',
+ *   precedence: 50,
+ *   exclude: [
+ *     { address: "10.0.0.0/8", description: "RFC1918" },
+ *   ],
+ * });
+ * ```
+ *
+ * @section Fallback domains
+ * @example Resolve a private suffix via an on-prem DNS server
+ * ```typescript
+ * yield* Cloudflare.DeviceCustomProfile("CorpDns", {
+ *   match: 'identity.email matches ".*@corp.example.com"',
+ *   precedence: 10,
+ *   fallbackDomains: [
+ *     { suffix: "corp.example.com", dnsServer: ["10.0.0.53"] },
+ *   ],
+ * });
+ * ```
+ *
+ * @see https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/
+ */
+export const DeviceCustomProfile = Resource(DeviceCustomProfileTypeId);
+/**
+ * Returns true if the given value is a DeviceCustomProfile resource.
+ */
+export const isDeviceCustomProfile = (value) => Predicate.hasProperty(value, "Type") &&
+    value.Type === DeviceCustomProfileTypeId;
+export const DeviceCustomProfileProvider = () => Provider.succeed(DeviceCustomProfile, {
+    stables: ["policyId", "accountId", "default"],
+    read: Effect.fn(function* ({ id, output, olds }) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        const acct = output?.accountId ?? accountId;
+        // Owned path: refresh by our persisted policy id.
+        if (output?.policyId) {
+            const observed = yield* observeProfile(acct, output.policyId);
+            return observed ? yield* buildAttrs(acct, observed) : undefined;
+        }
+        // Cold lookup: recover from lost state by exact name. Profile names
+        // carry no ownership markers, so brand the match `Unowned` and let
+        // the engine gate takeover behind the adopt policy.
+        const name = yield* createProfileName(id, olds?.name);
+        const match = yield* findByName(acct, name);
+        if (match?.policyId) {
+            const observed = yield* observeProfile(acct, match.policyId);
+            if (observed)
+                return Unowned(yield* buildAttrs(acct, observed));
+        }
+        return undefined;
+    }),
+    reconcile: Effect.fn(function* ({ id, news, output }) {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        const name = yield* createProfileName(id, news.name);
+        // 1. Observe — the policy id cached on `output` is a hint, not a
+        //    guarantee: a missing profile falls through to create.
+        let observed = output?.policyId
+            ? yield* observeProfile(accountId, output.policyId)
+            : undefined;
+        // 2. Ensure — create when missing. Names are not unique on
+        //    Cloudflare's side, so there is no AlreadyExists race; a
+        //    precedence collision is a real validation error and propagates.
+        if (!observed) {
+            const created = yield* zeroTrust.createDevicePolicyCustom({
+                accountId,
+                name,
+                match: news.match,
+                precedence: news.precedence,
+                enabled: news.enabled,
+                description: news.description,
+                include: news.include?.map(encodeSplit),
+                exclude: news.exclude?.map(encodeSplit),
+                captivePortal: news.captivePortal,
+                autoConnect: news.autoConnect,
+                allowedToLeave: news.allowedToLeave,
+                allowModeSwitch: news.allowModeSwitch,
+                allowUpdates: news.allowUpdates,
+                disableAutoFallback: news.disableAutoFallback,
+                excludeOfficeIps: news.excludeOfficeIps,
+                switchLocked: news.switchLocked,
+                serviceModeV2: news.serviceModeV2,
+                lanAllowMinutes: news.lanAllowMinutes,
+                lanAllowSubnetSize: news.lanAllowSubnetSize,
+                registerInterfaceIpWithDns: news.registerInterfaceIpWithDns,
+                sccmVpnBoundarySupport: news.sccmVpnBoundarySupport,
+                supportUrl: news.supportUrl,
+                tunnelProtocol: news.tunnelProtocol,
+            });
+            const policyId = created?.policyId;
+            if (!policyId) {
+                return yield* Effect.fail(new Error("Cloudflare did not return a policy id for the created custom device profile"));
+            }
+            observed = yield* observeProfile(accountId, policyId);
+            if (!observed) {
+                return yield* Effect.fail(new Error(`custom device profile ${policyId} disappeared right after create`));
+            }
+        }
+        const policyId = observed.policyId;
+        // 3. Sync (a) — patch the profile body with only the changed fields.
+        const patch = {
+            accountId,
+            policyId,
+        };
+        let dirty = false;
+        const setIf = (key, desired, observedValue) => {
+            if (desired === undefined)
+                return;
+            if (!sameJSON(desired, observedValue)) {
+                patch[key] = desired;
+                dirty = true;
+            }
+        };
+        setIf("name", name, observed.name ?? undefined);
+        setIf("match", news.match, denull(observed.match));
+        setIf("precedence", news.precedence, denull(observed.precedence));
+        setIf("enabled", news.enabled, denull(observed.enabled));
+        setIf("description", news.description, denull(observed.description));
+        setIf("captivePortal", news.captivePortal, denull(observed.captivePortal));
+        setIf("autoConnect", news.autoConnect, denull(observed.autoConnect));
+        setIf("allowedToLeave", news.allowedToLeave, denull(observed.allowedToLeave));
+        setIf("allowModeSwitch", news.allowModeSwitch, denull(observed.allowModeSwitch));
+        setIf("allowUpdates", news.allowUpdates, denull(observed.allowUpdates));
+        setIf("disableAutoFallback", news.disableAutoFallback, denull(observed.disableAutoFallback));
+        setIf("excludeOfficeIps", news.excludeOfficeIps, denull(observed.excludeOfficeIps));
+        setIf("switchLocked", news.switchLocked, denull(observed.switchLocked));
+        setIf("registerInterfaceIpWithDns", news.registerInterfaceIpWithDns, denull(observed.registerInterfaceIpWithDns));
+        setIf("sccmVpnBoundarySupport", news.sccmVpnBoundarySupport, denull(observed.sccmVpnBoundarySupport));
+        setIf("supportUrl", news.supportUrl, denull(observed.supportUrl));
+        setIf("tunnelProtocol", news.tunnelProtocol, denull(observed.tunnelProtocol));
+        if (news.serviceModeV2 !== undefined &&
+            !sameJSON(news.serviceModeV2, normalizeServiceMode(observed.serviceModeV2))) {
+            patch.serviceModeV2 = news.serviceModeV2;
+            dirty = true;
+        }
+        // lanAllow* are accepted by PATCH but not reliably echoed on GET,
+        // so push them whenever the user sets them — the API is idempotent.
+        if (news.lanAllowMinutes !== undefined) {
+            patch.lanAllowMinutes = news.lanAllowMinutes;
+            dirty = true;
+        }
+        if (news.lanAllowSubnetSize !== undefined) {
+            patch.lanAllowSubnetSize = news.lanAllowSubnetSize;
+            dirty = true;
+        }
+        if (dirty) {
+            yield* zeroTrust.patchDevicePolicyCustom(patch);
+        }
+        // 3. Sync (b) — replace the per-profile lists when they differ from
+        //    the observed cloud state.
+        const lists = yield* observeLists(accountId, policyId);
+        if (news.include !== undefined &&
+            !sameJSON(news.include, lists.include)) {
+            yield* zeroTrust.putDevicePolicyCustomInclude({
+                accountId,
+                policyId,
+                body: news.include.map(encodeSplit),
+            });
+        }
+        if (news.exclude !== undefined &&
+            !sameJSON(news.exclude, lists.exclude)) {
+            yield* zeroTrust.putDevicePolicyCustomExclude({
+                accountId,
+                policyId,
+                body: news.exclude.map(encodeSplit),
+            });
+        }
+        if (news.fallbackDomains !== undefined &&
+            !sameJSON(news.fallbackDomains, lists.fallbackDomains)) {
+            yield* zeroTrust.putDevicePolicyCustomFallbackDomain({
+                accountId,
+                policyId,
+                domains: news.fallbackDomains.map(encodeFallback),
+            });
+        }
+        // 4. Return — re-read so attrs reflect post-sync truth.
+        const final = yield* observeProfile(accountId, policyId);
+        if (!final) {
+            return yield* Effect.fail(new Error(`custom device profile ${policyId} disappeared during reconcile`));
+        }
+        return yield* buildAttrs(accountId, final);
+    }),
+    delete: Effect.fn(function* ({ output }) {
+        yield* zeroTrust
+            .deleteDevicePolicyCustom({
+            accountId: output.accountId,
+            policyId: output.policyId,
+        })
+            .pipe(Effect.catchTag("DevicePolicyNotFound", () => Effect.void));
+    }),
+    // Account collection: enumerate every custom device profile in the
+    // ambient account, then hydrate each into the exact `read` Attributes
+    // shape (same `observeProfile` + `buildAttrs` path read uses, so the
+    // per-profile split-tunnel/fallback lists are fetched too). Bounded
+    // concurrency keeps the fan-out polite; a profile that vanishes
+    // mid-enumeration is dropped via the typed `DevicePolicyNotFound` map.
+    list: Effect.fn(function* () {
+        const { accountId } = yield* yield* CloudflareEnvironment;
+        const items = yield* zeroTrust.listDevicePolicyCustoms
+            .pages({ accountId })
+            .pipe(Stream.runCollect, Effect.map((chunk) => Array.from(chunk).flatMap((page) => page.result ?? [])));
+        const rows = yield* Effect.forEach(items.filter((p) => p.policyId != null), (p) => Effect.gen(function* () {
+            const observed = yield* observeProfile(accountId, p.policyId);
+            return observed
+                ? yield* buildAttrs(accountId, observed)
+                : undefined;
+        }), { concurrency: 10 });
+        return rows.filter((row) => row !== undefined);
+    }),
+});
+/**
+ * Read a custom profile by id, mapping "gone" (`DevicePolicyNotFound`,
+ * Cloudflare error code 2052) to `undefined`.
+ */
+const observeProfile = (accountId, policyId) => zeroTrust.getDevicePolicyCustom({ accountId, policyId }).pipe(Effect.map((p) => p ?? undefined), Effect.catchTag("DevicePolicyNotFound", () => Effect.succeed(undefined)));
+/**
+ * Read the three per-profile list endpoints.
+ */
+const observeLists = Effect.fn(function* (accountId, policyId) {
+    const [include, exclude, fallback] = yield* Effect.all([
+        zeroTrust.getDevicePolicyCustomInclude({ accountId, policyId }),
+        zeroTrust.getDevicePolicyCustomExclude({ accountId, policyId }),
+        zeroTrust.getDevicePolicyCustomFallbackDomain({ accountId, policyId }),
+    ], { concurrency: "unbounded" });
+    return {
+        include: (include.result ?? []).map(normalizeSplit),
+        exclude: (exclude.result ?? []).map(normalizeSplit),
+        fallbackDomains: (fallback.result ?? []).map(normalizeFallback),
+    };
+});
+/**
+ * Find a profile by exact name via the list endpoint (oldest-id-first for
+ * determinism when names collide).
+ */
+const findByName = (accountId, name) => zeroTrust.listDevicePolicyCustoms({ accountId }).pipe(Effect.map((list) => list.result
+    .filter((p) => p.name === name && p.policyId != null)
+    .sort((a, b) => (a.policyId ?? "").localeCompare(b.policyId ?? ""))
+    .at(0)));
+const createProfileName = (id, name) => Effect.gen(function* () {
+    return name ?? (yield* createPhysicalName({ id, lowercase: true }));
+});
+const buildAttrs = Effect.fn(function* (accountId, profile) {
+    const policyId = profile.policyId;
+    const lists = yield* observeLists(accountId, policyId);
+    const attrs = {
+        policyId,
+        accountId,
+        name: profile.name ?? "",
+        match: denull(profile.match),
+        precedence: denull(profile.precedence),
+        enabled: denull(profile.enabled),
+        description: denull(profile.description),
+        default: profile.default ?? false,
+        include: lists.include,
+        exclude: lists.exclude,
+        fallbackDomains: lists.fallbackDomains,
+        captivePortal: denull(profile.captivePortal),
+        autoConnect: denull(profile.autoConnect),
+        allowedToLeave: denull(profile.allowedToLeave),
+        allowModeSwitch: denull(profile.allowModeSwitch),
+        allowUpdates: denull(profile.allowUpdates),
+        disableAutoFallback: denull(profile.disableAutoFallback),
+        excludeOfficeIps: denull(profile.excludeOfficeIps),
+        switchLocked: denull(profile.switchLocked),
+        serviceModeV2: normalizeServiceMode(profile.serviceModeV2),
+        registerInterfaceIpWithDns: denull(profile.registerInterfaceIpWithDns),
+        sccmVpnBoundarySupport: denull(profile.sccmVpnBoundarySupport),
+        supportUrl: denull(profile.supportUrl),
+        tunnelProtocol: denull(profile.tunnelProtocol),
+    };
+    return attrs;
+});
+/**
+ * Strip Cloudflare's `null` echoes to `undefined` so structural equality
+ * (`JSON.stringify`) works.
+ */
+const denull = (v) => v == null ? undefined : v;
+const normalizeServiceMode = (sm) => sm && sm.mode != null
+    ? {
+        mode: (sm.mode === "proxy" ? "proxy" : "warp"),
+        port: denull(sm.port),
+    }
+    : undefined;
+const normalizeSplit = (entry) => ({
+    address: "address" in entry ? entry.address : "",
+    host: "host" in entry ? entry.host : undefined,
+    description: denull(entry.description),
+});
+const normalizeFallback = (entry) => ({
+    suffix: entry.suffix,
+    description: denull(entry.description),
+    dnsServer: denull(entry.dnsServer),
+});
+/**
+ * Encode a SplitTunnelEntry for the API's union shape (`address` OR `host`).
+ * Prefers `host` when set since the address would otherwise be empty.
+ */
+const encodeSplit = (e) => {
+    if (e.host && !e.address) {
+        return e.description !== undefined
+            ? { host: e.host, description: e.description }
+            : { host: e.host };
+    }
+    return e.description !== undefined
+        ? { address: e.address, description: e.description }
+        : { address: e.address };
+};
+const encodeFallback = (d) => {
+    const out = {
+        suffix: d.suffix,
+    };
+    if (d.description !== undefined)
+        out.description = d.description;
+    if (d.dnsServer !== undefined)
+        out.dnsServer = d.dnsServer;
+    return out;
+};
+/** Structural deep-equality via canonical JSON. */
+const sameJSON = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+//# sourceMappingURL=CustomProfile.js.map

package/lib/Cloudflare/Devices/CustomProfile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CustomProfile.js","sourceRoot":"","sources":["../../../src/Cloudflare/Devices/CustomProfile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,wCAAwC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,SAAS,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAIpE,MAAM,yBAAyB,GAAG,kCAA2C,CAAC;AA0L9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CACzC,yBAAyB,CAC1B,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,KAAc,EACgB,EAAE,CAChC,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC;IACpC,KAAK,CAAC,IAAI,KAAK,yBAAyB,CAAC;AAE3C,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,EAAE,CAC9C,QAAQ,CAAC,OAAO,CAAC,mBAAmB,EAAE;IACpC,OAAO,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,SAAS,CAAC;IAE7C,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QAC7C,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,EAAE,SAAS,IAAI,SAAS,CAAC;QAE5C,kDAAkD;QAClD,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC9D,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClE,CAAC;QAED,oEAAoE;QACpE,mEAAmE;QACnE,oDAAoD;QACpD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK,EAAE,QAAQ,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC7D,IAAI,QAAQ;gBAAE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAClD,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAErD,iEAAiE;QACjE,2DAA2D;QAC3D,IAAI,QAAQ,GAAG,MAAM,EAAE,QAAQ;YAC7B,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC;YACnD,CAAC,CAAC,SAAS,CAAC;QAEd,2DAA2D;QAC3D,6DAA6D;QAC7D,qEAAqE;QACrE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC;gBACxD,SAAS;gBACT,IAAI;gBACJ,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC;gBACvC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC;gBACvC,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,eAAe,EAAE,IAAI,CAAC,eAAe;gBACrC,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,eAAe,EAAE,IAAI,CAAC,eAAe;gBACrC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;gBAC3C,0BAA0B,EAAE,IAAI,CAAC,0BAA0B;gBAC3D,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;gBACnD,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,cAAc,EAAE,IAAI,CAAC,cAAc;aACpC,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAC;YACnC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,6EAA6E,CAC9E,CACF,CAAC;YACJ,CAAC;YACD,QAAQ,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACtD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,yBAAyB,QAAQ,iCAAiC,CACnE,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAS,CAAC;QAEpC,qEAAqE;QACrE,MAAM,KAAK,GAA6C;YACtD,SAAS;YACT,QAAQ;SACT,CAAC;QACF,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,MAAM,KAAK,GAAG,CAMZ,GAAM,EACN,OAAoD,EACpD,aAAsB,EACtB,EAAE;YACF,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO;YAClC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC;gBACtC,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;gBACrB,KAAK,GAAG,IAAI,CAAC;YACf,CAAC;QACH,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC;QAChD,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACnD,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QAClE,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACzD,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QACrE,KAAK,CACH,eAAe,EACf,IAAI,CAAC,aAAa,EAClB,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAC/B,CAAC;QACF,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QACrE,KAAK,CACH,gBAAgB,EAChB,IAAI,CAAC,cAAc,EACnB,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAChC,CAAC;QACF,KAAK,CACH,iBAAiB,EACjB,IAAI,CAAC,eAAe,EACpB,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CACjC,CAAC;QACF,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QACxE,KAAK,CACH,qBAAqB,EACrB,IAAI,CAAC,mBAAmB,EACxB,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CACrC,CAAC;QACF,KAAK,CACH,kBAAkB,EAClB,IAAI,CAAC,gBAAgB,EACrB,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAClC,CAAC;QACF,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QACxE,KAAK,CACH,4BAA4B,EAC5B,IAAI,CAAC,0BAA0B,EAC/B,MAAM,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAC5C,CAAC;QACF,KAAK,CACH,wBAAwB,EACxB,IAAI,CAAC,sBAAsB,EAC3B,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CACxC,CAAC;QACF,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QAClE,KAAK,CACH,gBAAgB,EAChB,IAAI,CAAC,cAAc,EACnB,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAChC,CAAC;QACF,IACE,IAAI,CAAC,aAAa,KAAK,SAAS;YAChC,CAAC,QAAQ,CACP,IAAI,CAAC,aAAa,EAClB,oBAAoB,CAAC,QAAQ,CAAC,aAAa,CAAC,CAC7C,EACD,CAAC;YACD,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;YACzC,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QACD,kEAAkE;QAClE,oEAAoE;QACpE,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACvC,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;YAC7C,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QACD,IAAI,IAAI,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAC1C,KAAK,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC;YACnD,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAClD,CAAC;QAED,oEAAoE;QACpE,+BAA+B;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACvD,IACE,IAAI,CAAC,OAAO,KAAK,SAAS;YAC1B,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EACtC,CAAC;YACD,KAAK,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC;gBAC5C,SAAS;gBACT,QAAQ;gBACR,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;aACpC,CAAC,CAAC;QACL,CAAC;QACD,IACE,IAAI,CAAC,OAAO,KAAK,SAAS;YAC1B,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EACtC,CAAC;YACD,KAAK,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC;gBAC5C,SAAS;gBACT,QAAQ;gBACR,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;aACpC,CAAC,CAAC;QACL,CAAC;QACD,IACE,IAAI,CAAC,eAAe,KAAK,SAAS;YAClC,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,eAAe,CAAC,EACtD,CAAC;YACD,KAAK,CAAC,CAAC,SAAS,CAAC,mCAAmC,CAAC;gBACnD,SAAS;gBACT,QAAQ;gBACR,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC;aAClD,CAAC,CAAC;QACL,CAAC;QAED,wDAAwD;QACxD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,yBAAyB,QAAQ,+BAA+B,CACjE,CACF,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC;IAEF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACrC,KAAK,CAAC,CAAC,SAAS;aACb,wBAAwB,CAAC;YACxB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC;aACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC;IAEF,mEAAmE;IACnE,sEAAsE;IACtE,qEAAqE;IACrE,oEAAoE;IACpE,gEAAgE;IAChE,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;QACvB,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,uBAAuB;aACnD,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC;aACpB,IAAI,CACH,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CACvD,CACF,CAAC;QACJ,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAChC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,EACvC,CAAC,CAAC,EAAE,EAAE,CACJ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,SAAS,EAAE,CAAC,CAAC,QAAS,CAAC,CAAC;YAC/D,OAAO,QAAQ;gBACb,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC;gBACxC,CAAC,CAAC,SAAS,CAAC;QAChB,CAAC,CAAC,EACJ,EAAE,WAAW,EAAE,EAAE,EAAE,CACpB,CAAC;QACF,OAAO,IAAI,CAAC,MAAM,CAChB,CAAC,GAAG,EAAwC,EAAE,CAAC,GAAG,KAAK,SAAS,CACjE,CAAC;IACJ,CAAC,CAAC;CACH,CAAC,CAAC;AAIL;;;GAGG;AACH,MAAM,cAAc,GAAG,CAAC,SAAiB,EAAE,QAAgB,EAAE,EAAE,CAC7D,SAAS,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAC3D,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAA+B,EAAE,CAAC,CAAC,IAAI,SAAS,CAAC,EAC9D,MAAM,CAAC,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CACzE,CAAC;AAEJ;;GAEG;AACH,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,SAAiB,EAAE,QAAgB;IAC3E,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACpD;QACE,SAAS,CAAC,4BAA4B,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAC/D,SAAS,CAAC,4BAA4B,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAC/D,SAAS,CAAC,mCAAmC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;KACvE,EACD,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CAAC;IACF,OAAO;QACL,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC;QACnD,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC;QACnD,eAAe,EAAE,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC;KAChE,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,GAAG,CAAC,SAAiB,EAAE,IAAY,EAAE,EAAE,CACrD,SAAS,CAAC,uBAAuB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CACnD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAClB,IAAI,CAAC,MAAM;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC;KACpD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;KAClE,EAAE,CAAC,CAAC,CAAC,CACT,CACF,CAAC;AAEJ,MAAM,iBAAiB,GAAG,CAAC,EAAU,EAAE,IAAwB,EAAE,EAAE,CACjE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACtE,CAAC,CAAC,CAAC;AAEL,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EACpC,SAAiB,EACjB,OAAwB;IAExB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAS,CAAC;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACvD,MAAM,KAAK,GAAkC;QAC3C,QAAQ;QACR,SAAS;QACT,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE;QACxB,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QAC5B,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;QACtC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QAChC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QACxC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,KAAK;QACjC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC;QAC5C,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QACxC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC;QAC9C,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC;QAChD,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;QAC1C,mBAAmB,EAAE,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC;QACxD,gBAAgB,EAAE,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAClD,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;QAC1C,aAAa,EAAE,oBAAoB,CAAC,OAAO,CAAC,aAAa,CAAC;QAC1D,0BAA0B,EAAE,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC;QACtE,sBAAsB,EAAE,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC;QAC9D,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;QACtC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC;KAC/C,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,MAAM,GAAG,CAAI,CAAuB,EAAiB,EAAE,CAC3D,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAE5B,MAAM,oBAAoB,GAAG,CAC3B,EAAqE,EACrB,EAAE,CAClD,EAAE,IAAI,EAAE,CAAC,IAAI,IAAI,IAAI;IACnB,CAAC,CAAC;QACE,IAAI,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAqB;QAClE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC;KACtB;IACH,CAAC,CAAC,SAAS,CAAC;AAEhB,MAAM,cAAc,GAAG,CACrB,KAEiD,EACV,EAAE,CAAC,CAAC;IAC3C,OAAO,EAAE,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;IAChD,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;IAC9C,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC;CACvC,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CAAC,KAI1B,EAAuC,EAAE,CAAC,CAAC;IAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;IACpB,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC;IACtC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;CACnC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,WAAW,GAAG,CAClB,CAAwC,EAGC,EAAE;IAC3C,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACzB,OAAO,CAAC,CAAC,WAAW,KAAK,SAAS;YAChC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE;YAC9C,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IACD,OAAO,CAAC,CAAC,WAAW,KAAK,SAAS;QAChC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE;QACpD,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;AAC7B,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CACrB,CAAsC,EAC0B,EAAE;IAClE,MAAM,GAAG,GAAmE;QAC1E,MAAM,EAAE,CAAC,CAAC,MAAM;KACjB,CAAC;IACF,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS;QAAE,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;IACjE,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;QAAE,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;IAC3D,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,mDAAmD;AACnD,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAE,CAAU,EAAW,EAAE,CACnD,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC"}