dkimkit 0.0.0-stage → 0.6.1

package/dist/src/records.js

@@ -0,0 +1,109 @@
+const RECORD_TYPES = ['CNAME', 'TXT', 'MX'];
+export function isRecordType(type) {
+    return RECORD_TYPES.includes(type);
+}
+const DOMAIN_RE = /^(?!-)[a-z0-9-]{1,63}(?<!-)(\.(?!-)[a-z0-9-]{1,63}(?<!-))+$/;
+/** A normalized hostname with at least two labels (IDNs must be punycode). */
+export function isValidDomain(name) {
+    return name.length <= 253 && DOMAIN_RE.test(name);
+}
+export function normalizeName(name) {
+    return name.trim().toLowerCase().replace(/\.+$/, '');
+}
+/** Hostnames compare case-insensitively without trailing dots; TXT values compare with quoting and chunking removed. */
+export function normalizeValue(type, value) {
+    if (type === 'TXT') {
+        return value.trim().replace(/^"(.*)"$/s, '$1').replace(/"\s*"/g, '');
+    }
+    return normalizeName(value);
+}
+export function sameValue(type, a, b) {
+    return normalizeValue(type, a) === normalizeValue(type, b);
+}
+const SPF_TERMINATOR = /^([~+?-]?all|redirect=.*)$/i;
+export function isSpf(value) {
+    return /^v=spf1(\s|$)/i.test(normalizeValue('TXT', value));
+}
+/**
+ * Adds the mechanisms of `desired` (e.g. "include:mailgun.org") to an existing
+ * SPF record, before its `all`/`redirect` term. Returns null when the existing
+ * record already has them all. A name must have exactly one SPF record, so
+ * providers' SPF records are merged in rather than added next to the old one.
+ */
+export function mergeSpf(existing, desired) {
+    const have = normalizeValue('TXT', existing).split(/\s+/).filter(Boolean);
+    const want = normalizeValue('TXT', desired)
+        .split(/\s+/)
+        .filter((t) => t && t.toLowerCase() !== 'v=spf1' && !SPF_TERMINATOR.test(t));
+    const added = want.filter((t) => !have.some((h) => h.toLowerCase() === t.toLowerCase()));
+    if (added.length === 0)
+        return null;
+    const end = have.findIndex((t) => SPF_TERMINATOR.test(t));
+    const merged = end === -1 ? [...have, ...added] : [...have.slice(0, end), ...added, ...have.slice(end)];
+    return { value: merged.join(' '), added };
+}
+/**
+ * Decides what to do with `record` given the records already at its name.
+ * Never replaces a record pointing elsewhere unless `overwrite` is set, and never
+ * deletes records of other types. `desired` is every record being planned, so
+ * a provider's own multi-value sets (e.g. two MX hosts) don't conflict with each other.
+ */
+export function decideChange(record, existing, overwrite = false, desired = []) {
+    const conflict = (reason) => ({ record, action: 'conflict', reason });
+    const siblings = desired.filter((d) => d !== record && d.name === record.name && d.type === record.type);
+    const ours = (e) => siblings.some((s) => sameValue(record.type, s.value, e.value));
+    const sameType = existing.filter((e) => e.type === record.type);
+    const others = existing.filter((e) => e.type !== record.type);
+    if (record.type === 'CNAME' && others.length > 0) {
+        const types = [...new Set(others.map((e) => e.type))].join(', ');
+        return conflict(`a CNAME cannot coexist with the existing ${types} record(s) at this name`);
+    }
+    const blockingCname = others.find((e) => e.type === 'CNAME');
+    if (blockingCname) {
+        return conflict(`an existing CNAME (${blockingCname.value}) blocks other records at this name`);
+    }
+    const match = sameType.find((e) => sameValue(record.type, e.value, record.value));
+    if (match) {
+        if (match.proxied) {
+            return { record, action: 'update', existingId: match.id, reason: 'disable proxying' };
+        }
+        if (record.type === 'MX' && record.priority !== undefined && match.priority !== record.priority) {
+            return { record, action: 'update', existingId: match.id, reason: `priority ${match.priority} → ${record.priority}` };
+        }
+        return { record, action: 'noop' };
+    }
+    if (record.type === 'TXT') {
+        // SPF: merge into the existing record rather than adding a second one.
+        if (isSpf(record.value)) {
+            const spf = sameType.filter((e) => isSpf(e.value));
+            if (spf.length > 1)
+                return conflict('the name already has more than one SPF record, which makes SPF fail; reduce it to one first');
+            if (spf.length === 1) {
+                const merged = mergeSpf(spf[0].value, record.value);
+                if (!merged)
+                    return { record: { ...record, value: normalizeValue('TXT', spf[0].value) }, action: 'noop' };
+                return {
+                    record: { ...record, value: merged.value },
+                    action: 'update',
+                    existingId: spf[0].id,
+                    reason: `add ${merged.added.join(' ')} to the existing SPF record`,
+                };
+            }
+        }
+        // Other TXT records can sit side by side.
+        return { record, action: 'create' };
+    }
+    const foreign = sameType.filter((e) => !ours(e));
+    if (foreign.length === 0)
+        return { record, action: 'create' };
+    const current = foreign.map((e) => e.value).join(', ');
+    if (overwrite && foreign.length === 1) {
+        return { record, action: 'update', existingId: foreign[0].id, reason: `replace ${current}` };
+    }
+    return conflict(`existing ${record.type} points to ${current}; use overwrite to replace it`);
+}
+export function describeRecord(record) {
+    const priority = record.priority !== undefined ? `${record.priority} ` : '';
+    return `${record.type} ${record.name} → ${priority}${record.value}`;
+}
+//# sourceMappingURL=records.js.map

package/dist/src/records.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"records.js","sourceRoot":"","sources":["../../src/records.ts"],"names":[],"mappings":"AAEA,MAAM,YAAY,GAAsB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AAE/D,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,SAAS,GAAG,6DAA6D,CAAC;AAEhF,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,wHAAwH;AACxH,MAAM,UAAU,cAAc,CAAC,IAAgB,EAAE,KAAa;IAC5D,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAgB,EAAE,CAAS,EAAE,CAAS;IAC9D,OAAO,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC;AAWD,MAAM,cAAc,GAAG,6BAA6B,CAAC;AAErD,MAAM,UAAU,KAAK,CAAC,KAAa;IACjC,OAAO,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,OAAe;IACxD,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC;SACxC,KAAK,CAAC,KAAK,CAAC;SACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACzF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACxG,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,MAAiB,EAAE,QAA0B,EAAE,SAAS,GAAG,KAAK,EAAE,UAAuB,EAAE;IACtH,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAiB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7F,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC;IACzG,MAAM,IAAI,GAAG,CAAC,CAAiB,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACnG,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC;IAE9D,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjE,OAAO,QAAQ,CAAC,4CAA4C,KAAK,yBAAyB,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;IAC7D,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,QAAQ,CAAC,sBAAsB,aAAa,CAAC,KAAK,qCAAqC,CAAC,CAAC;IAClG,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAClF,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACxF,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,KAAK,CAAC,QAAQ,MAAM,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QACvH,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACpC,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1B,uEAAuE;QACvE,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACnD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,QAAQ,CAAC,6FAA6F,CAAC,CAAC;YACnI,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrB,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBACrD,IAAI,CAAC,MAAM;oBAAE,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;gBAC3G,OAAO;oBACL,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE;oBAC1C,MAAM,EAAE,QAAQ;oBAChB,UAAU,EAAE,GAAG,CAAC,CAAC,CAAE,CAAC,EAAE;oBACtB,MAAM,EAAE,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,6BAA6B;iBACnE,CAAC;YACJ,CAAC;QACH,CAAC;QACD,0CAA0C;QAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAE9D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAE,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,OAAO,EAAE,EAAE,CAAC;IAChG,CAAC;IACD,OAAO,QAAQ,CAAC,YAAY,MAAM,CAAC,IAAI,cAAc,OAAO,+BAA+B,CAAC,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAiB;IAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;AACtE,CAAC"}

package/dist/src/server.d.ts

@@ -0,0 +1,67 @@
+import { type SetupOptions } from './orchestrator.js';
+import type { DnsProvider, EmailProvider } from './types.js';
+/** Body of /api/plan, /api/setup and /api/status. Secrets fall back to environment variables. */
+export interface SetupRequest {
+    domain: string;
+    subdomain?: string;
+    dns: string;
+    /** sendgrid | postmark | mailgun | ses (default sendgrid) */
+    emailProvider?: string;
+    onBehalfOf?: string;
+    credentials?: {
+        sendgridApiKey?: string;
+        postmarkAccountToken?: string;
+        postmarkInboundServerId?: string;
+        mailgunApiKey?: string;
+        mailgunRegion?: string;
+        /** Amazon SES uses the AWS fields below (or the AWS environment) plus this region. */
+        sesRegion?: string;
+        cloudflareApiToken?: string;
+        awsAccessKeyId?: string;
+        awsSecretAccessKey?: string;
+        awsSessionToken?: string;
+        awsProfile?: string;
+        route53HostedZoneId?: string;
+    };
+    inbound?: {
+        url: string;
+        hostname?: string;
+        spamCheck?: boolean;
+        sendRaw?: boolean;
+    };
+    overwrite?: boolean;
+    waitSeconds?: number;
+}
+export interface UiServerOptions {
+    /** Default 4545; 0 picks a free port. */
+    port?: number;
+    token?: string;
+    env?: NodeJS.ProcessEnv;
+    /** Override provider construction (custom providers, tests). */
+    providers?: (req: SetupRequest) => {
+        email: EmailProvider;
+        dns: DnsProvider;
+    } | Promise<{
+        email: EmailProvider;
+        dns: DnsProvider;
+    }>;
+    /** Merged into every setup run. */
+    setupDefaults?: Partial<SetupOptions>;
+    version?: string;
+}
+export interface UiServer {
+    /** Open this once; it exchanges the token for a cookie. */
+    url: string;
+    port: number;
+    close(): Promise<void>;
+}
+/**
+ * Local web UI. Binds to 127.0.0.1 only. A random token in the first URL is
+ * swapped for a SameSite=Strict cookie; the Host header is checked to block
+ * DNS rebinding; API calls must be JSON POSTs, which cross-origin pages can't
+ * send without a CORS preflight this server never approves.
+ */
+export declare function startUiServer(opts?: UiServerOptions): Promise<UiServer>;
+export declare function parseSetupRequest(input: unknown, { requireDns }?: {
+    requireDns?: boolean | undefined;
+}): SetupRequest;

package/dist/src/server.js

@@ -0,0 +1,301 @@
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { existsSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { createServer } from 'node:http';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { ApiError, apiErrorHint, ConfigError, DnsConflictError } from './errors.js';
+import { checkStatus, setupDomain } from './orchestrator.js';
+import { loadAwsCredentials } from './providers/dns/aws.js';
+import { createEmailProvider, EMAIL_PROVIDERS, isEmailProvider } from './providers/email/factory.js';
+import { createDnsProvider, DNS_PROVIDERS } from './providers/factory.js';
+import { isValidDomain, normalizeName } from './records.js';
+const MAX_BODY_BYTES = 64 * 1024;
+const PAGE = new URL('../../web/index.html', import.meta.url);
+/**
+ * Local web UI. Binds to 127.0.0.1 only. A random token in the first URL is
+ * swapped for a SameSite=Strict cookie; the Host header is checked to block
+ * DNS rebinding; API calls must be JSON POSTs, which cross-origin pages can't
+ * send without a CORS preflight this server never approves.
+ */
+export async function startUiServer(opts = {}) {
+    const env = opts.env ?? process.env;
+    const token = opts.token ?? randomBytes(24).toString('base64url');
+    const page = await readFile(PAGE, 'utf8');
+    let port = 0;
+    const cookieName = () => `dkimkit_${port}`;
+    const tokenMatches = (candidate) => {
+        if (!candidate)
+            return false;
+        const a = Buffer.from(candidate);
+        const b = Buffer.from(token);
+        return a.length === b.length && timingSafeEqual(a, b);
+    };
+    const hostAllowed = (host) => host === `127.0.0.1:${port}` || host === `localhost:${port}` || host === `[::1]:${port}`;
+    const cookie = (req) => req.headers.cookie
+        ?.split(';')
+        .map((c) => c.trim().split('='))
+        .find(([k]) => k === cookieName())?.[1];
+    const buildProviders = opts.providers ??
+        (async (req) => {
+            const c = req.credentials ?? {};
+            const provider = req.emailProvider ?? 'sendgrid';
+            let credentials;
+            switch (provider) {
+                case 'postmark':
+                    credentials = { accountToken: c.postmarkAccountToken || env.POSTMARK_ACCOUNT_TOKEN, inboundServerId: c.postmarkInboundServerId || env.POSTMARK_INBOUND_SERVER_ID };
+                    break;
+                case 'mailgun':
+                    credentials = { apiKey: c.mailgunApiKey || env.MAILGUN_API_KEY, region: c.mailgunRegion || env.MAILGUN_REGION || 'us' };
+                    break;
+                case 'ses': {
+                    const aws = c.awsAccessKeyId && c.awsSecretAccessKey
+                        ? { accessKeyId: c.awsAccessKeyId, secretAccessKey: c.awsSecretAccessKey, sessionToken: c.awsSessionToken }
+                        : await loadAwsCredentials({ profile: c.awsProfile, env });
+                    credentials = { ...aws, region: c.sesRegion || env.AWS_REGION || env.AWS_DEFAULT_REGION };
+                    break;
+                }
+                default:
+                    credentials = { apiKey: c.sendgridApiKey || env.SENDGRID_API_KEY };
+            }
+            return {
+                email: createEmailProvider(provider, credentials, { subuser: req.onBehalfOf || undefined }),
+                dns: createDnsProvider(req.dns, {
+                    cloudflareApiToken: c.cloudflareApiToken,
+                    aws: { accessKeyId: c.awsAccessKeyId, secretAccessKey: c.awsSecretAccessKey, sessionToken: c.awsSessionToken },
+                    awsProfile: c.awsProfile,
+                    route53HostedZoneId: c.route53HostedZoneId,
+                    env,
+                }),
+            };
+        });
+    const runOptions = (req, email) => {
+        if (req.inbound && !email.supportsInbound)
+            throw new ConfigError(`Receiving email isn't supported with ${email.label} yet.`);
+        return {
+            domain: req.domain,
+            subdomain: req.subdomain,
+            overwrite: req.overwrite,
+            inbound: req.inbound && {
+                hostname: req.inbound.hostname || email.defaultInboundHostname(req.domain),
+                url: req.inbound.url,
+                spamCheck: req.inbound.spamCheck,
+                sendRaw: req.inbound.sendRaw,
+            },
+            ...opts.setupDefaults,
+            propagation: { timeoutMs: (req.waitSeconds ?? 300) * 1000, ...opts.setupDefaults?.propagation },
+        };
+    };
+    const routes = {
+        'GET /api/config': async (_req, res) => {
+            const awsFile = env.AWS_SHARED_CREDENTIALS_FILE ?? join(homedir(), '.aws', 'credentials');
+            sendJson(res, 200, {
+                version: opts.version,
+                providers: DNS_PROVIDERS,
+                emailProviders: EMAIL_PROVIDERS,
+                env: {
+                    sendgrid: Boolean(env.SENDGRID_API_KEY),
+                    postmark: Boolean(env.POSTMARK_ACCOUNT_TOKEN),
+                    mailgun: Boolean(env.MAILGUN_API_KEY),
+                    awsRegion: env.AWS_REGION || env.AWS_DEFAULT_REGION || null,
+                    cloudflare: Boolean(env.CLOUDFLARE_API_TOKEN),
+                    aws: Boolean(env.AWS_ACCESS_KEY_ID && env.AWS_SECRET_ACCESS_KEY) || existsSync(awsFile),
+                },
+            });
+        },
+        'POST /api/plan': async (req, res) => {
+            const body = parseSetupRequest(await readJson(req));
+            const { email, dns } = await buildProviders(body);
+            let domain;
+            let changes = [];
+            try {
+                await setupDomain(email, dns, {
+                    ...runOptions(body, email),
+                    dryRun: true,
+                    onEvent: (e) => {
+                        if (e.type === 'domain')
+                            domain = e.auth;
+                        if (e.type === 'plan')
+                            changes = e.changes;
+                    },
+                });
+            }
+            catch (err) {
+                if (!(err instanceof DnsConflictError))
+                    throw err;
+            }
+            sendJson(res, 200, { domain, changes, conflicts: changes.some((c) => c.action === 'conflict') });
+        },
+        'POST /api/setup': async (req, res) => {
+            const body = parseSetupRequest(await readJson(req));
+            const { email, dns } = await buildProviders(body);
+            const controller = new AbortController();
+            res.on('close', () => {
+                if (!res.writableFinished)
+                    controller.abort();
+            });
+            res.writeHead(200, { 'content-type': 'application/x-ndjson; charset=utf-8', 'cache-control': 'no-store' });
+            const write = (line) => res.write(JSON.stringify(line) + '\n');
+            try {
+                const result = await setupDomain(email, dns, {
+                    ...runOptions(body, email),
+                    onEvent: (event) => write({ type: 'event', event }),
+                    signal: controller.signal,
+                });
+                write({ type: 'result', result });
+            }
+            catch (err) {
+                if (!controller.signal.aborted)
+                    write({ type: 'error', ...serializeError(err) });
+            }
+            finally {
+                res.end();
+            }
+        },
+        'POST /api/status': async (req, res) => {
+            const body = parseSetupRequest(await readJson(req), { requireDns: false });
+            const { email } = await buildProviders({ ...body, dns: 'manual' });
+            sendJson(res, 200, await checkStatus(email, body.domain, body.subdomain));
+        },
+    };
+    const server = createServer(async (req, res) => {
+        try {
+            if (!hostAllowed(req.headers.host))
+                return sendText(res, 403, 'Forbidden host');
+            const url = new URL(req.url ?? '/', 'http://localhost');
+            if (url.pathname === '/' && req.method === 'GET') {
+                const fromQuery = url.searchParams.get('token');
+                if (tokenMatches(fromQuery)) {
+                    res.writeHead(303, {
+                        location: '/',
+                        'set-cookie': `${cookieName()}=${token}; HttpOnly; SameSite=Strict; Path=/`,
+                    });
+                    return void res.end();
+                }
+                if (!tokenMatches(cookie(req)))
+                    return sendHtml(res, 401, LOCKED_PAGE);
+                return sendHtml(res, 200, page);
+            }
+            const route = routes[`${req.method} ${url.pathname}`];
+            if (!route)
+                return sendJson(res, 404, { error: 'Not found' });
+            if (!tokenMatches(cookie(req))) {
+                return sendJson(res, 401, { error: 'Session expired: open the link printed in the terminal again.' });
+            }
+            if (req.method === 'POST' && !req.headers['content-type']?.startsWith('application/json')) {
+                return sendJson(res, 415, { error: 'Expected application/json' });
+            }
+            await route(req, res);
+        }
+        catch (err) {
+            if (res.headersSent)
+                return void res.end();
+            const status = err instanceof ConfigError ? 400 : err instanceof ApiError ? 502 : 500;
+            sendJson(res, status, serializeError(err));
+        }
+    });
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(opts.port ?? 4545, '127.0.0.1', () => resolve());
+    });
+    port = server.address().port;
+    return {
+        url: `http://127.0.0.1:${port}/?token=${token}`,
+        port,
+        close: () => new Promise((resolve, reject) => {
+            server.closeAllConnections();
+            server.close((err) => (err ? reject(err) : resolve()));
+        }),
+    };
+}
+export function parseSetupRequest(input, { requireDns = true } = {}) {
+    if (!input || typeof input !== 'object')
+        throw new ConfigError('Expected a JSON object.');
+    const body = input;
+    const domain = typeof body.domain === 'string' ? normalizeName(body.domain) : '';
+    if (!isValidDomain(domain))
+        throw new ConfigError('Enter a valid domain, like example.com.');
+    if (requireDns && typeof body.dns !== 'string')
+        throw new ConfigError('Choose a DNS provider.');
+    const emailProvider = typeof body.emailProvider === 'string' && body.emailProvider ? body.emailProvider : 'sendgrid';
+    if (!isEmailProvider(emailProvider))
+        throw new ConfigError(`Email provider must be one of: ${EMAIL_PROVIDERS.join(', ')}.`);
+    let inbound;
+    if (body.inbound) {
+        const url = String(body.inbound.url ?? '');
+        if (!/^https:\/\/[^\s]+$/.test(url))
+            throw new ConfigError('The inbound webhook URL must start with https://.');
+        const hostname = body.inbound.hostname ? normalizeName(String(body.inbound.hostname)) : undefined;
+        if (hostname && !isValidDomain(hostname))
+            throw new ConfigError('Enter a valid inbound hostname.');
+        inbound = { url, hostname, spamCheck: Boolean(body.inbound.spamCheck), sendRaw: Boolean(body.inbound.sendRaw) };
+    }
+    const waitSeconds = body.waitSeconds === undefined ? undefined : Number(body.waitSeconds);
+    if (waitSeconds !== undefined && !(waitSeconds >= 0 && waitSeconds <= 3600)) {
+        throw new ConfigError('Wait time must be between 0 and 3600 seconds.');
+    }
+    const credentials = {};
+    for (const [k, v] of Object.entries(body.credentials ?? {})) {
+        if (typeof v === 'string' && v.trim())
+            credentials[k] = v.trim();
+    }
+    return {
+        domain,
+        subdomain: typeof body.subdomain === 'string' && body.subdomain.trim() ? body.subdomain.trim() : undefined,
+        dns: String(body.dns ?? 'manual'),
+        emailProvider,
+        onBehalfOf: typeof body.onBehalfOf === 'string' ? body.onBehalfOf.trim() : undefined,
+        credentials,
+        inbound,
+        overwrite: Boolean(body.overwrite),
+        waitSeconds,
+    };
+}
+function serializeError(err) {
+    if (err instanceof DnsConflictError)
+        return { kind: 'conflict', error: err.message, conflicts: err.conflicts };
+    if (err instanceof ApiError) {
+        return { kind: 'api', error: err.message, provider: err.provider, status: err.status, hint: apiErrorHint(err) };
+    }
+    if (err instanceof ConfigError)
+        return { kind: 'config', error: err.message };
+    return { kind: 'error', error: err instanceof Error ? err.message : String(err) };
+}
+async function readJson(req) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        size += chunk.length;
+        if (size > MAX_BODY_BYTES)
+            throw new ConfigError('Request body too large.');
+        chunks.push(chunk);
+    }
+    try {
+        return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    }
+    catch {
+        throw new ConfigError('Request body is not valid JSON.');
+    }
+}
+function sendJson(res, status, body) {
+    res.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' });
+    res.end(JSON.stringify(body));
+}
+function sendText(res, status, text) {
+    res.writeHead(status, { 'content-type': 'text/plain; charset=utf-8' });
+    res.end(text);
+}
+function sendHtml(res, status, html) {
+    res.writeHead(status, {
+        'content-type': 'text/html; charset=utf-8',
+        'cache-control': 'no-store',
+        'content-security-policy': "default-src 'self'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none'",
+        'referrer-policy': 'no-referrer',
+    });
+    res.end(html);
+}
+const LOCKED_PAGE = `<!doctype html><meta charset="utf-8"><title>DKIMkit</title>
+<body style="font:16px system-ui;max-width:32rem;margin:15vh auto;padding:0 16px;color:#333">
+<h1 style="font-size:1.25rem">Open the link from your terminal</h1>
+<p>For security, this page only opens from the one-time link printed by <code>dkimkit ui</code>.</p></body>`;
+//# sourceMappingURL=server.js.map

package/dist/src/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AAEpF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpF,OAAO,EAAE,WAAW,EAAE,WAAW,EAAqB,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,eAAe,EAAyB,MAAM,8BAA8B,CAAC;AAC5H,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAkD5D,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC;AACjC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,sBAAsB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAwB,EAAE;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1C,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC;IAE3C,MAAM,YAAY,GAAG,CAAC,SAAoC,EAAE,EAAE;QAC5D,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC;IACF,MAAM,WAAW,GAAG,CAAC,IAAwB,EAAE,EAAE,CAC/C,IAAI,KAAK,aAAa,IAAI,EAAE,IAAI,IAAI,KAAK,aAAa,IAAI,EAAE,IAAI,IAAI,KAAK,SAAS,IAAI,EAAE,CAAC;IAC3F,MAAM,MAAM,GAAG,CAAC,GAAoB,EAAE,EAAE,CACtC,GAAG,CAAC,OAAO,CAAC,MAAM;QAChB,EAAE,KAAK,CAAC,GAAG,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SAC/B,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAE5C,MAAM,cAAc,GAClB,IAAI,CAAC,SAAS;QACd,CAAC,KAAK,EAAE,GAAiB,EAAE,EAAE;YAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,aAAa,IAAI,UAAU,CAAC;YACjD,IAAI,WAA6B,CAAC;YAClC,QAAQ,QAAQ,EAAE,CAAC;gBACjB,KAAK,UAAU;oBACb,WAAW,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC,oBAAoB,IAAI,GAAG,CAAC,sBAAsB,EAAE,eAAe,EAAE,CAAC,CAAC,uBAAuB,IAAI,GAAG,CAAC,0BAA0B,EAAE,CAAC;oBACnK,MAAM;gBACR,KAAK,SAAS;oBACZ,WAAW,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,aAAa,IAAI,GAAG,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC,CAAC,aAAa,IAAI,GAAG,CAAC,cAAc,IAAI,IAAI,EAAE,CAAC;oBACxH,MAAM;gBACR,KAAK,KAAK,CAAC,CAAC,CAAC;oBACX,MAAM,GAAG,GACP,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,kBAAkB;wBACtC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,cAAc,EAAE,eAAe,EAAE,CAAC,CAAC,kBAAkB,EAAE,YAAY,EAAE,CAAC,CAAC,eAAe,EAAE;wBAC3G,CAAC,CAAC,MAAM,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;oBAC/D,WAAW,GAAG,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,SAAS,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,kBAAkB,EAAE,CAAC;oBAC1F,MAAM;gBACR,CAAC;gBACD;oBACE,WAAW,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,cAAc,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC;YACvE,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,mBAAmB,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,IAAI,SAAS,EAAE,CAAC;gBAC3F,GAAG,EAAE,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE;oBAC9B,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;oBACxC,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,cAAc,EAAE,eAAe,EAAE,CAAC,CAAC,kBAAkB,EAAE,YAAY,EAAE,CAAC,CAAC,eAAe,EAAE;oBAC9G,UAAU,EAAE,CAAC,CAAC,UAAU;oBACxB,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;oBAC1C,GAAG;iBACJ,CAAC;aACH,CAAC;QACJ,CAAC,CAAC,CAAC;IAEL,MAAM,UAAU,GAAG,CAAC,GAAiB,EAAE,KAAoB,EAAgB,EAAE;QAC3E,IAAI,GAAG,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe;YAAE,MAAM,IAAI,WAAW,CAAC,wCAAwC,KAAK,CAAC,KAAK,OAAO,CAAC,CAAC;QAC7H,OAAO;YACP,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI;gBACtB,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC1E,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG;gBACpB,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS;gBAChC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO;aAC7B;YACD,GAAG,IAAI,CAAC,aAAa;YACrB,WAAW,EAAE,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE;SAC9F,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,MAAM,GAAiF;QAC3F,iBAAiB,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;YACrC,MAAM,OAAO,GAAG,GAAG,CAAC,2BAA2B,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;YAC1F,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,SAAS,EAAE,aAAa;gBACxB,cAAc,EAAE,eAAe;gBAC/B,GAAG,EAAE;oBACH,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;oBACvC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;oBAC7C,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;oBACrC,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,kBAAkB,IAAI,IAAI;oBAC3D,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;oBAC7C,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,qBAAqB,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC;iBACxF;aACF,CAAC,CAAC;QACL,CAAC;QAED,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACnC,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YACpD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,MAAwC,CAAC;YAC7C,IAAI,OAAO,GAAoB,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE;oBAC5B,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC;oBAC1B,MAAM,EAAE,IAAI;oBACZ,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;wBACb,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;4BAAE,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC;wBACzC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;4BAAE,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;oBAC7C,CAAC;iBACF,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,CAAC,GAAG,YAAY,gBAAgB,CAAC;oBAAE,MAAM,GAAG,CAAC;YACpD,CAAC;YACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,EAAE,CAAC,CAAC;QACnG,CAAC;QAED,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACpC,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YACpD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;YAClD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnB,IAAI,CAAC,GAAG,CAAC,gBAAgB;oBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;YAChD,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,qCAAqC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3G,MAAM,KAAK,GAAG,CAAC,IAAa,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;YACxE,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE;oBAC3C,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC;oBAC1B,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;oBACnD,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBACH,KAAK,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YACpC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO;oBAAE,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnF,CAAC;oBAAS,CAAC;gBACT,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACrC,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3E,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;YACnE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QAC5E,CAAC;KACF,CAAC;IAEF,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,IAAI,CAAC;YACH,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;YAChF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAExD,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACjD,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAChD,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;wBACjB,QAAQ,EAAE,GAAG;wBACb,YAAY,EAAE,GAAG,UAAU,EAAE,IAAI,KAAK,qCAAqC;qBAC5E,CAAC,CAAC;oBACH,OAAO,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC;gBACxB,CAAC;gBACD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;gBACvE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAClC,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YACtD,IAAI,CAAC,KAAK;gBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC9D,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC/B,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,+DAA+D,EAAE,CAAC,CAAC;YACxG,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAC1F,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,MAAM,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,CAAC,WAAW;gBAAE,OAAO,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,GAAG,YAAY,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,YAAY,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACtF,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IACH,IAAI,GAAI,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,CAAC;IAE9C,OAAO;QACL,GAAG,EAAE,oBAAoB,IAAI,WAAW,KAAK,EAAE;QAC/C,IAAI;QACJ,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACpC,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAC7B,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACzD,CAAC,CAAC;KACL,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc,EAAE,EAAE,UAAU,GAAG,IAAI,EAAE,GAAG,EAAE;IAC1E,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,WAAW,CAAC,yBAAyB,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,KAA4B,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,yCAAyC,CAAC,CAAC;IAC7F,IAAI,UAAU,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,WAAW,CAAC,wBAAwB,CAAC,CAAC;IAChG,MAAM,aAAa,GAAG,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC;IACrH,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,kCAAkC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE5H,IAAI,OAAgC,CAAC;IACrC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,mDAAmD,CAAC,CAAC;QAChH,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClG,IAAI,QAAQ,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,iCAAiC,CAAC,CAAC;QACnG,OAAO,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IAClH,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC1F,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,IAAI,WAAW,IAAI,IAAI,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,WAAW,CAAC,+CAA+C,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,WAAW,GAA6C,EAAE,CAAC;IACjE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;QAC5D,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE;YAAE,WAAW,CAAC,CAA6B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/F,CAAC;IAED,OAAO;QACL,MAAM;QACN,SAAS,EAAE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;QAC1G,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,QAAQ,CAAC;QACjC,aAAa;QACb,UAAU,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;QACpF,WAAW;QACX,OAAO;QACP,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;QAClC,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,GAAG,YAAY,gBAAgB;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;IAC/G,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;IAClH,CAAC;IACD,IAAI,GAAG,YAAY,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IAC9E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AACpF,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAoB;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,IAAI,IAAK,KAAgB,CAAC,MAAM,CAAC;QACjC,IAAI,IAAI,GAAG,cAAc;YAAE,MAAM,IAAI,WAAW,CAAC,yBAAyB,CAAC,CAAC;QAC5E,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,iCAAiC,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAClE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IAC1G,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAY;IACjE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;IACvE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAY;IACjE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;QACpB,cAAc,EAAE,0BAA0B;QAC1C,eAAe,EAAE,UAAU;QAC3B,yBAAyB,EACvB,yHAAyH;QAC3H,iBAAiB,EAAE,aAAa;KACjC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,WAAW,GAAG;;;4GAGwF,CAAC"}

package/dist/src/types.d.ts

@@ -0,0 +1,75 @@
+export type RecordType = 'CNAME' | 'TXT' | 'MX';
+export interface DnsRecord {
+    type: RecordType;
+    /** Fully qualified name, lowercase, no trailing dot. */
+    name: string;
+    value: string;
+    /** MX only. */
+    priority?: number;
+    /** What the record is for (e.g. "dkim1", "inbound_mx"). Display only. */
+    purpose?: string;
+    /** Guidance for people adding it by hand (e.g. merging into an existing SPF record). */
+    note?: string;
+}
+export interface DomainAuthentication {
+    id: string;
+    domain: string;
+    valid: boolean;
+    records: DnsRecord[];
+    /** True when this run created it, false when an existing one was reused. */
+    created: boolean;
+}
+export interface RecordValidation {
+    record: string;
+    valid: boolean;
+    reason?: string;
+}
+export interface ValidationResult {
+    valid: boolean;
+    results: RecordValidation[];
+}
+export interface InboundParseOptions {
+    hostname: string;
+    url: string;
+    spamCheck?: boolean;
+    sendRaw?: boolean;
+}
+export type InboundAction = 'created' | 'updated' | 'unchanged';
+/** An email service provider (SendGrid, Postmark, Mailgun, Amazon SES) that issues DNS records for a sending domain. */
+export interface EmailProvider {
+    readonly name: string;
+    /** Human-readable name, e.g. "Amazon SES". */
+    readonly label: string;
+    /** Whether inbound email (receiving and forwarding to a webhook) is supported. */
+    readonly supportsInbound: boolean;
+    /** Where inbound mail is received when the caller doesn't choose (e.g. parse.<domain>). */
+    defaultInboundHostname(domain: string): string;
+    findDomain(domain: string, subdomain?: string): Promise<DomainAuthentication | null>;
+    /** Returns the existing authentication for the domain, or creates one. */
+    ensureDomain(domain: string, opts?: {
+        subdomain?: string;
+    }): Promise<DomainAuthentication>;
+    getDomain(id: string): Promise<DomainAuthentication>;
+    deleteDomain(id: string): Promise<void>;
+    validateDomain(id: string): Promise<ValidationResult>;
+    /** DNS records needed to route inbound mail for `hostname` to the provider. */
+    inboundRecords(hostname: string): DnsRecord[];
+    ensureInboundParse(opts: InboundParseOptions): Promise<InboundAction>;
+    deleteInboundParse(hostname: string): Promise<void>;
+}
+export type ChangeAction = 'create' | 'update' | 'noop' | 'conflict';
+export interface PlannedChange {
+    record: DnsRecord;
+    action: ChangeAction;
+    /** Provider record id to update, for `update`. */
+    existingId?: string;
+    reason?: string;
+}
+/** A DNS host that can write records. */
+export interface DnsProvider {
+    readonly name: string;
+    plan(records: DnsRecord[], opts?: {
+        overwrite?: boolean;
+    }): Promise<PlannedChange[]>;
+    apply(changes: PlannedChange[]): Promise<void>;
+}

package/dist/src/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":""}

package/dist/src/xml.d.ts

@@ -0,0 +1,6 @@
+/** Inner content of every `<tag>…</tag>`. Assumes the tag doesn't nest inside itself. */
+export declare function xmlTags(xml: string, tag: string): string[];
+/** Decoded text of the first `<tag>`, if present. */
+export declare function xmlText(xml: string, tag: string): string | undefined;
+export declare function decodeXml(s: string): string;
+export declare function encodeXml(s: string): string;

package/dist/src/xml.js

@@ -0,0 +1,23 @@
+// Just enough XML for the flat, well-known shapes of the Route53 API.
+/** Inner content of every `<tag>…</tag>`. Assumes the tag doesn't nest inside itself. */
+export function xmlTags(xml, tag) {
+    const re = new RegExp(`<${tag}(?:\\s[^>]*)?>([\\s\\S]*?)</${tag}>`, 'g');
+    return [...xml.matchAll(re)].map((m) => m[1]);
+}
+/** Decoded text of the first `<tag>`, if present. */
+export function xmlText(xml, tag) {
+    const inner = xmlTags(xml, tag)[0];
+    return inner === undefined ? undefined : decodeXml(inner.trim());
+}
+const ENTITIES = { amp: '&', lt: '<', gt: '>', quot: '"', apos: "'" };
+export function decodeXml(s) {
+    return s.replace(/&(#x[0-9a-f]+|#\d+|\w+);/gi, (m, e) => {
+        if (e[0] === '#')
+            return String.fromCodePoint(e[1] === 'x' || e[1] === 'X' ? parseInt(e.slice(2), 16) : Number(e.slice(1)));
+        return ENTITIES[e] ?? m;
+    });
+}
+export function encodeXml(s) {
+    return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&apos;');
+}
+//# sourceMappingURL=xml.js.map

package/dist/src/xml.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"xml.js","sourceRoot":"","sources":["../../src/xml.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAEtE,yFAAyF;AACzF,MAAM,UAAU,OAAO,CAAC,GAAW,EAAE,GAAW;IAC9C,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,GAAG,+BAA+B,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;AACjD,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,OAAO,CAAC,GAAW,EAAE,GAAW;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,QAAQ,GAA2B,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAE9F,MAAM,UAAU,SAAS,CAAC,CAAS;IACjC,OAAO,CAAC,CAAC,OAAO,CAAC,4BAA4B,EAAE,CAAC,CAAC,EAAE,CAAS,EAAE,EAAE;QAC9D,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5H,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,CAAS;IACjC,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC9H,CAAC"}