dkimkit 0.0.0-stage → 0.7.0

package/dist/src/hosted/store.d.ts

@@ -0,0 +1,257 @@
+import type { DnsRecord, PlannedChange, ValidationResult } from '../types.js';
+export type DomainStatus = 'pending' | 'awaiting_dns' | 'verifying' | 'verified' | 'conflict' | 'failed';
+export interface Account {
+    id: string;
+    name: string;
+    apiKeyHash: string;
+    /** sendgrid | postmark | mailgun | ses */
+    emailProvider: string;
+    /** Encrypted JSON of the provider's credentials (see EmailCredentials). */
+    emailCredentialsEnc: string | null;
+    webhookUrl: string | null;
+    webhookSecret: string;
+    /** Origins allowed to embed the widget. */
+    widgetOrigins: string[];
+    /** Max domains this account may have at once; null for unlimited. Set by the operator. */
+    domainLimit: number | null;
+    /** Sign-in email for self-serve accounts; null for operator-created ones. */
+    email: string | null;
+    billingCustomerId: string | null;
+    billingSubscriptionId: string | null;
+    billingStatus: BillingStatus;
+    /** Current billing period from the payment provider, ms. */
+    billingPeriodStart: number | null;
+    billingPeriodEnd: number | null;
+    /** Active domains already reported to the payment provider this period. */
+    reportedQuantity: number;
+    /** Time (seconds) of the last billing event applied, to ignore stale, out-of-order ones. */
+    billingEventAt: number | null;
+    createdAt: number;
+}
+/** free: no card on file. active: paying. past_due: payment failing, the provider is retrying. */
+export type BillingStatus = 'free' | 'active' | 'past_due';
+/** A single-use email sign-in / sign-up link. */
+export interface LoginToken {
+    tokenHash: string;
+    email: string;
+    name: string | null;
+    expiresAt: number;
+    usedAt: number | null;
+    createdAt: number;
+}
+export interface DashboardSession {
+    tokenHash: string;
+    accountId: string;
+    expiresAt: number;
+    createdAt: number;
+}
+export type UsageMetric = 'domain_created' | 'domain_verified' | 'active_domain_day';
+/**
+ * One billable fact. Append-only, and the id is deterministic (e.g.
+ * "active_domain_day:dom_1:2026-10-25"), so recording the same fact twice is a no-op.
+ * Domain name and tenant are snapshots, so history survives domain deletion.
+ */
+export interface UsageRecord {
+    id: string;
+    accountId: string;
+    tenantId: string | null;
+    domainId: string;
+    domain: string;
+    metric: UsageMetric;
+    quantity: number;
+    /** UTC calendar day, YYYY-MM-DD. */
+    day: string;
+    occurredAt: number;
+}
+export interface UsageTotals {
+    domainsCreated: number;
+    verifications: number;
+    /** Distinct domains that were verified on at least one day of the period. */
+    activeDomains: number;
+    /** Sum over days of verified domains: for prorated billing. */
+    activeDomainDays: number;
+}
+export interface UsageQuery {
+    /** Inclusive UTC days, YYYY-MM-DD. */
+    from: string;
+    to: string;
+    /** Omit for every account (operator reports). */
+    accountId?: string;
+    groupByTenant?: boolean;
+}
+export interface UsageRow extends UsageTotals {
+    accountId: string;
+    /** Present when grouped by tenant. */
+    tenantId?: string | null;
+}
+export interface WidgetDefaults {
+    tenantId: string;
+    metadata: Record<string, string>;
+    subdomain: string | null;
+    sendgridSubuser: string | null;
+    /** Inbound parse webhook; the hostname becomes parse.<domain>. */
+    inboundUrl: string | null;
+}
+/** A short-lived browser credential scoped to one domain (or to creating one). */
+export interface WidgetSession {
+    id: string;
+    accountId: string;
+    tokenHash: string;
+    domainId: string | null;
+    /** Used when the end user enters the domain in the widget. */
+    defaults: WidgetDefaults | null;
+    expiresAt: number;
+    createdAt: number;
+}
+export interface InboundConfig {
+    url: string;
+    hostname: string;
+    spamCheck: boolean;
+    sendRaw: boolean;
+}
+export interface DomainRow {
+    id: string;
+    accountId: string;
+    domain: string;
+    subdomain: string | null;
+    tenantId: string | null;
+    metadata: Record<string, string>;
+    status: DomainStatus;
+    /** The domain's id at the email provider. */
+    providerDomainId: string;
+    sendgridSubuser: string | null;
+    dnsProvider: string;
+    dnsCredentialsEnc: string | null;
+    inbound: InboundConfig | null;
+    overwrite: boolean;
+    records: DnsRecord[];
+    /** Names of records not yet visible in DNS at the last check. */
+    pending: string[];
+    validation: ValidationResult | null;
+    conflicts: PlannedChange[] | null;
+    lastError: string | null;
+    attempts: number;
+    nextRunAt: number | null;
+    lockedUntil: number | null;
+    verifiedAt: number | null;
+    expiresAt: number | null;
+    createdAt: number;
+    updatedAt: number;
+}
+export interface DomainEvent {
+    id: string;
+    domainId: string;
+    accountId: string;
+    type: string;
+    data: Record<string, unknown>;
+    createdAt: number;
+}
+export interface WebhookDelivery {
+    id: string;
+    accountId: string;
+    eventId: string;
+    url: string;
+    payload: string;
+    status: 'pending' | 'delivered' | 'failed';
+    attempts: number;
+    nextAttemptAt: number | null;
+    lockedUntil: number | null;
+    lastError: string | null;
+    responseStatus: number | null;
+    createdAt: number;
+}
+export interface ListDomainsQuery {
+    tenantId?: string;
+    status?: DomainStatus;
+    limit: number;
+    /** Opaque cursor from a previous page. */
+    after?: string;
+}
+export declare class DuplicateError extends Error {
+}
+/** Persistence for the hosted API. Implemented by SqliteStore and PostgresStore. */
+export interface Store {
+    createAccount(account: Account): Promise<void>;
+    getAccount(id: string): Promise<Account | undefined>;
+    getAccountByKeyHash(hash: string): Promise<Account | undefined>;
+    updateAccount(id: string, patch: Partial<Omit<Account, 'id' | 'createdAt'>>): Promise<void>;
+    /** Throws DuplicateError when the account already has this domain + subdomain. */
+    insertDomain(domain: DomainRow): Promise<void>;
+    getDomain(accountId: string, id: string): Promise<DomainRow | undefined>;
+    findDomain(accountId: string, domain: string, subdomain: string | null): Promise<DomainRow | undefined>;
+    listDomains(accountId: string, query: ListDomainsQuery): Promise<{
+        domains: DomainRow[];
+        next: string | null;
+    }>;
+    updateDomain(id: string, patch: Partial<Omit<DomainRow, 'id' | 'accountId' | 'createdAt'>>): Promise<DomainRow>;
+    deleteDomain(id: string): Promise<void>;
+    /** Atomically leases up to `limit` domains whose next run is due. */
+    claimDueDomains(now: number, limit: number, leaseMs: number): Promise<DomainRow[]>;
+    addEvent(event: DomainEvent): Promise<void>;
+    listEvents(domainId: string, limit: number): Promise<DomainEvent[]>;
+    addDelivery(delivery: WebhookDelivery): Promise<void>;
+    claimDueDeliveries(now: number, limit: number, leaseMs: number): Promise<WebhookDelivery[]>;
+    updateDelivery(id: string, patch: Partial<Omit<WebhookDelivery, 'id' | 'accountId' | 'createdAt'>>): Promise<void>;
+    createWidgetSession(session: WidgetSession): Promise<void>;
+    getWidgetSessionByHash(hash: string): Promise<WidgetSession | undefined>;
+    updateWidgetSession(id: string, patch: Partial<Pick<WidgetSession, 'domainId'>>): Promise<void>;
+    listAccounts(): Promise<Account[]>;
+    /** Current number of domains (any status) for plan limits. */
+    countDomains(accountId: string): Promise<number>;
+    /** Inserts records, silently skipping ids that already exist. */
+    recordUsage(records: UsageRecord[]): Promise<void>;
+    /** Records an active day for every currently verified domain. Idempotent per domain and day. */
+    recordActiveDomainDays(day: string, now: number): Promise<void>;
+    summarizeUsage(query: UsageQuery): Promise<UsageRow[]>;
+    getAccountByEmail(email: string): Promise<Account | undefined>;
+    getAccountByBillingCustomer(customerId: string): Promise<Account | undefined>;
+    /** Accounts with a card on file (active or past_due) and a billing customer. */
+    listBillableAccounts(): Promise<Account[]>;
+    createLoginToken(token: LoginToken): Promise<void>;
+    /** Marks the token used and returns it, or undefined if unknown, expired or already used. Atomic. */
+    consumeLoginToken(tokenHash: string, now: number): Promise<LoginToken | undefined>;
+    createDashboardSession(session: DashboardSession): Promise<void>;
+    getDashboardSession(tokenHash: string): Promise<DashboardSession | undefined>;
+    deleteDashboardSession(tokenHash: string): Promise<void>;
+    /** Records a billing webhook event id; false if it was already processed. */
+    markBillingEventProcessed(eventId: string, now: number): Promise<boolean>;
+    close(): Promise<void>;
+}
+/**
+ * How a model field is stored. Each store turns these into its own encoding
+ * (e.g. JSON is TEXT in SQLite and JSONB in Postgres; booleans are 0/1 in SQLite).
+ */
+export type ColumnKind = 'text' | 'int' | 'bool'
+/** '' in the column (so UNIQUE constraints work) ↔ null in the model. */
+ | 'emptyAsNull' | {
+    json: unknown;
+};
+export type ColumnMap<T> = Record<keyof T, readonly [column: string, kind: ColumnKind]>;
+export declare const ACCOUNT_COLUMNS: ColumnMap<Account>;
+export declare const LOGIN_TOKEN_COLUMNS: ColumnMap<LoginToken>;
+export declare const DASHBOARD_SESSION_COLUMNS: ColumnMap<DashboardSession>;
+/** Billing columns added to accounts after the first release: [column, SQLite type, Postgres type]. */
+export declare const ACCOUNT_BILLING_COLUMNS: [string, string, string][];
+export declare const USAGE_COLUMNS: ColumnMap<UsageRecord>;
+/** UTC calendar day of a timestamp, YYYY-MM-DD. */
+export declare const utcDay: (ms: number) => string;
+/**
+ * The aggregate both stores run. Grouped by account (and tenant if asked).
+ * Parameters: $1 from, $2 to, then optionally $3 account id.
+ */
+export declare function usageSql(query: UsageQuery, placeholder: (n: number) => string): string;
+/** Aggregate row → UsageRow. Counts may arrive as strings (Postgres bigint/numeric) or null. */
+export declare function toUsageRow(row: Record<string, unknown>, groupByTenant: boolean): UsageRow;
+export declare const DOMAIN_COLUMNS: ColumnMap<DomainRow>;
+export declare const EVENT_COLUMNS: ColumnMap<DomainEvent>;
+export declare const DELIVERY_COLUMNS: ColumnMap<WebhookDelivery>;
+export declare const SESSION_COLUMNS: ColumnMap<WidgetSession>;
+/** Model object → { column: encoded value }, skipping undefined fields (so it works for patches). */
+export declare function toColumns<T, V>(map: ColumnMap<T>, value: Partial<T>, encode: (kind: ColumnKind, v: unknown) => V): Record<string, V>;
+export declare function fromColumns<T>(map: ColumnMap<T>, row: Record<string, unknown> | undefined, decode: (kind: ColumnKind, v: unknown) => unknown): T | undefined;
+/** A fresh copy of a JSON column's fallback, so rows never share one mutable object. */
+export declare const jsonFallback: (kind: {
+    json: unknown;
+}) => unknown;
+/** Opens a store by URL: postgres://… or postgresql://… for Postgres, anything else is a SQLite path (or :memory:). */
+export declare function openStore(url: string): Promise<Store>;

package/dist/src/hosted/store.js

@@ -0,0 +1,181 @@
+export class DuplicateError extends Error {
+}
+const json = (fallback = null) => ({ json: fallback });
+export const ACCOUNT_COLUMNS = {
+    id: ['id', 'text'],
+    name: ['name', 'text'],
+    apiKeyHash: ['api_key_hash', 'text'],
+    emailProvider: ['email_provider', 'text'],
+    emailCredentialsEnc: ['email_credentials_enc', 'text'],
+    webhookUrl: ['webhook_url', 'text'],
+    webhookSecret: ['webhook_secret', 'text'],
+    widgetOrigins: ['widget_origins', json([])],
+    domainLimit: ['domain_limit', 'int'],
+    email: ['email', 'text'],
+    billingCustomerId: ['billing_customer_id', 'text'],
+    billingSubscriptionId: ['billing_subscription_id', 'text'],
+    billingStatus: ['billing_status', 'text'],
+    billingPeriodStart: ['billing_period_start', 'int'],
+    billingPeriodEnd: ['billing_period_end', 'int'],
+    reportedQuantity: ['reported_quantity', 'int'],
+    billingEventAt: ['billing_event_at', 'int'],
+    createdAt: ['created_at', 'int'],
+};
+export const LOGIN_TOKEN_COLUMNS = {
+    tokenHash: ['token_hash', 'text'],
+    email: ['email', 'text'],
+    name: ['name', 'text'],
+    expiresAt: ['expires_at', 'int'],
+    usedAt: ['used_at', 'int'],
+    createdAt: ['created_at', 'int'],
+};
+export const DASHBOARD_SESSION_COLUMNS = {
+    tokenHash: ['token_hash', 'text'],
+    accountId: ['account_id', 'text'],
+    expiresAt: ['expires_at', 'int'],
+    createdAt: ['created_at', 'int'],
+};
+/** Billing columns added to accounts after the first release: [column, SQLite type, Postgres type]. */
+export const ACCOUNT_BILLING_COLUMNS = [
+    ['email_provider', "TEXT NOT NULL DEFAULT 'sendgrid'", "TEXT NOT NULL DEFAULT 'sendgrid'"],
+    ['email_credentials_enc', 'TEXT', 'TEXT'],
+    ['email', 'TEXT', 'TEXT'],
+    ['billing_customer_id', 'TEXT', 'TEXT'],
+    ['billing_subscription_id', 'TEXT', 'TEXT'],
+    ['billing_status', "TEXT NOT NULL DEFAULT 'free'", "TEXT NOT NULL DEFAULT 'free'"],
+    ['billing_period_start', 'INTEGER', 'BIGINT'],
+    ['billing_period_end', 'INTEGER', 'BIGINT'],
+    ['reported_quantity', 'INTEGER NOT NULL DEFAULT 0', 'INTEGER NOT NULL DEFAULT 0'],
+    ['billing_event_at', 'INTEGER', 'BIGINT'],
+];
+export const USAGE_COLUMNS = {
+    id: ['id', 'text'],
+    accountId: ['account_id', 'text'],
+    tenantId: ['tenant_id', 'text'],
+    domainId: ['domain_id', 'text'],
+    domain: ['domain', 'text'],
+    metric: ['metric', 'text'],
+    quantity: ['quantity', 'int'],
+    day: ['day', 'text'],
+    occurredAt: ['occurred_at', 'int'],
+};
+/** UTC calendar day of a timestamp, YYYY-MM-DD. */
+export const utcDay = (ms) => new Date(ms).toISOString().slice(0, 10);
+/**
+ * The aggregate both stores run. Grouped by account (and tenant if asked).
+ * Parameters: $1 from, $2 to, then optionally $3 account id.
+ */
+export function usageSql(query, placeholder) {
+    const groups = query.groupByTenant ? 'account_id, tenant_id' : 'account_id';
+    return `SELECT ${groups},
+      SUM(CASE WHEN metric = 'domain_created' THEN quantity ELSE 0 END) AS domains_created,
+      SUM(CASE WHEN metric = 'domain_verified' THEN quantity ELSE 0 END) AS verifications,
+      COUNT(DISTINCT CASE WHEN metric = 'active_domain_day' THEN domain_id END) AS active_domains,
+      SUM(CASE WHEN metric = 'active_domain_day' THEN quantity ELSE 0 END) AS active_domain_days
+    FROM usage_records
+    WHERE day >= ${placeholder(1)} AND day <= ${placeholder(2)}${query.accountId ? ` AND account_id = ${placeholder(3)}` : ''}
+    GROUP BY ${groups}
+    ORDER BY ${groups}`;
+}
+/** Aggregate row → UsageRow. Counts may arrive as strings (Postgres bigint/numeric) or null. */
+export function toUsageRow(row, groupByTenant) {
+    const n = (v) => Number(v ?? 0);
+    return {
+        accountId: row.account_id,
+        ...(groupByTenant ? { tenantId: row.tenant_id ?? null } : {}),
+        domainsCreated: n(row.domains_created),
+        verifications: n(row.verifications),
+        activeDomains: n(row.active_domains),
+        activeDomainDays: n(row.active_domain_days),
+    };
+}
+export const DOMAIN_COLUMNS = {
+    id: ['id', 'text'],
+    accountId: ['account_id', 'text'],
+    domain: ['domain', 'text'],
+    subdomain: ['subdomain', 'emptyAsNull'],
+    tenantId: ['tenant_id', 'text'],
+    metadata: ['metadata', json({})],
+    status: ['status', 'text'],
+    // Named from when SendGrid was the only provider; kept to avoid a data migration.
+    providerDomainId: ['sendgrid_domain_id', 'text'],
+    sendgridSubuser: ['sendgrid_subuser', 'text'],
+    dnsProvider: ['dns_provider', 'text'],
+    dnsCredentialsEnc: ['dns_credentials_enc', 'text'],
+    inbound: ['inbound', json()],
+    overwrite: ['overwrite', 'bool'],
+    records: ['records', json([])],
+    pending: ['pending', json([])],
+    validation: ['validation', json()],
+    conflicts: ['conflicts', json()],
+    lastError: ['last_error', 'text'],
+    attempts: ['attempts', 'int'],
+    nextRunAt: ['next_run_at', 'int'],
+    lockedUntil: ['locked_until', 'int'],
+    verifiedAt: ['verified_at', 'int'],
+    expiresAt: ['expires_at', 'int'],
+    createdAt: ['created_at', 'int'],
+    updatedAt: ['updated_at', 'int'],
+};
+export const EVENT_COLUMNS = {
+    id: ['id', 'text'],
+    domainId: ['domain_id', 'text'],
+    accountId: ['account_id', 'text'],
+    type: ['type', 'text'],
+    data: ['data', json({})],
+    createdAt: ['created_at', 'int'],
+};
+export const DELIVERY_COLUMNS = {
+    id: ['id', 'text'],
+    accountId: ['account_id', 'text'],
+    eventId: ['event_id', 'text'],
+    url: ['url', 'text'],
+    payload: ['payload', 'text'],
+    status: ['status', 'text'],
+    attempts: ['attempts', 'int'],
+    nextAttemptAt: ['next_attempt_at', 'int'],
+    lockedUntil: ['locked_until', 'int'],
+    lastError: ['last_error', 'text'],
+    responseStatus: ['response_status', 'int'],
+    createdAt: ['created_at', 'int'],
+};
+export const SESSION_COLUMNS = {
+    id: ['id', 'text'],
+    accountId: ['account_id', 'text'],
+    tokenHash: ['token_hash', 'text'],
+    domainId: ['domain_id', 'text'],
+    defaults: ['defaults', json()],
+    expiresAt: ['expires_at', 'int'],
+    createdAt: ['created_at', 'int'],
+};
+/** Model object → { column: encoded value }, skipping undefined fields (so it works for patches). */
+export function toColumns(map, value, encode) {
+    const row = {};
+    for (const [field, v] of Object.entries(value)) {
+        const entry = map[field];
+        if (entry && v !== undefined)
+            row[entry[0]] = encode(entry[1], v);
+    }
+    return row;
+}
+export function fromColumns(map, row, decode) {
+    if (!row)
+        return undefined;
+    const out = {};
+    for (const [field, [column, kind]] of Object.entries(map)) {
+        out[field] = decode(kind, row[column]);
+    }
+    return out;
+}
+/** A fresh copy of a JSON column's fallback, so rows never share one mutable object. */
+export const jsonFallback = (kind) => structuredClone(kind.json);
+/** Opens a store by URL: postgres://… or postgresql://… for Postgres, anything else is a SQLite path (or :memory:). */
+export async function openStore(url) {
+    if (/^postgres(ql)?:\/\//.test(url)) {
+        const { PostgresStore } = await import('./postgres-store.js');
+        return PostgresStore.connect({ connectionString: url });
+    }
+    const { SqliteStore } = await import('./sqlite-store.js');
+    return new SqliteStore(url.replace(/^sqlite:/, ''));
+}
+//# sourceMappingURL=store.js.map

package/dist/src/hosted/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/hosted/store.ts"],"names":[],"mappings":"AA2LA,MAAM,OAAO,cAAe,SAAQ,KAAK;CAAG;AAuE5C,MAAM,IAAI,GAAG,CAAC,WAAoB,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;AAEhE,MAAM,CAAC,MAAM,eAAe,GAAuB;IACjD,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,CAAC,cAAc,EAAE,MAAM,CAAC;IACpC,aAAa,EAAE,CAAC,gBAAgB,EAAE,MAAM,CAAC;IACzC,mBAAmB,EAAE,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACtD,UAAU,EAAE,CAAC,aAAa,EAAE,MAAM,CAAC;IACnC,aAAa,EAAE,CAAC,gBAAgB,EAAE,MAAM,CAAC;IACzC,aAAa,EAAE,CAAC,gBAAgB,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3C,WAAW,EAAE,CAAC,cAAc,EAAE,KAAK,CAAC;IACpC,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,CAAC,qBAAqB,EAAE,MAAM,CAAC;IAClD,qBAAqB,EAAE,CAAC,yBAAyB,EAAE,MAAM,CAAC;IAC1D,aAAa,EAAE,CAAC,gBAAgB,EAAE,MAAM,CAAC;IACzC,kBAAkB,EAAE,CAAC,sBAAsB,EAAE,KAAK,CAAC;IACnD,gBAAgB,EAAE,CAAC,oBAAoB,EAAE,KAAK,CAAC;IAC/C,gBAAgB,EAAE,CAAC,mBAAmB,EAAE,KAAK,CAAC;IAC9C,cAAc,EAAE,CAAC,kBAAkB,EAAE,KAAK,CAAC;IAC3C,SAAS,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;CACjC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAA0B;IACxD,SAAS,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC;IACjC,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;IAChC,MAAM,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC;IAC1B,SAAS,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;CACjC,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAgC;IACpE,SAAS,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC;IACjC,SAAS,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC;IACjC,SAAS,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;IAChC,SAAS,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;CACjC,CAAC;AAEF,uGAAuG;AACvG,MAAM,CAAC,MAAM,uBAAuB,GAA+B;IACjE,CAAC,gBAAgB,EAAE,kCAAkC,EAAE,kCAAkC,CAAC;IAC1F,CAAC,uBAAuB,EAAE,MAAM,EAAE,MAAM,CAAC;IACzC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC;IACzB,CAAC,qBAAqB,EAAE,MAAM,EAAE,MAAM,CAAC;IACvC,CAAC,yBAAyB,EAAE,MAAM,EAAE,MAAM,CAAC;IAC3C,CAAC,gBAAgB,EAAE,8BAA8B,EAAE,8BAA8B,CAAC;IAClF,CAAC,sBAAsB,EAAE,SAAS,EAAE,QAAQ,CAAC;IAC7C,CAAC,oBAAoB,EAAE,SAAS,EAAE,QAAQ,CAAC;IAC3C,CAAC,mBAAmB,EAAE,4BAA4B,EAAE,4BAA4B,CAAC;IACjF,CAAC,kBAAkB,EAAE,SAAS,EAAE,QAAQ,CAAC;CAC1C,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAA2B;IACnD,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC;IACjC,QAAQ,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC;IAC/B,QAAQ,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC;IAC/B,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC;IAC7B,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC;CACnC,CAAC;AAEF,mDAAmD;AACnD,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAE9E;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAiB,EAAE,WAAkC;IAC5E,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,YAAY,CAAC;IAC5E,OAAO,UAAU,MAAM;;;;;;mBAMN,WAAW,CAAC,CAAC,CAAC,eAAe,WAAW,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;eAC9G,MAAM;eACN,MAAM,EAAE,CAAC;AACxB,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,UAAU,CAAC,GAA4B,EAAE,aAAsB;IAC7E,MAAM,CAAC,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,UAAoB;QACnC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAG,GAAG,CAAC,SAA2B,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC;QACtC,aAAa,EAAE,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC;QACnC,aAAa,EAAE,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC;QACpC,gBAAgB,EAAE,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAyB;IAClD,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC;IACjC,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC;IACvC,QAAQ,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC;IAC/B,QAAQ,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAChC,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,kFAAkF;IAClF,gBAAgB,EAAE,CAAC,oBAAoB,EAAE,MAAM,CAAC;IAChD,eAAe,EAAE,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAC7C,WAAW,EAAE,CAAC,cAAc,EAAE,MAAM,CAAC;IACrC,iBAAiB,EAAE,CAAC,qBAAqB,EAAE,MAAM,CAAC;IAClD,OAAO,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;IAC5B,SAAS,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC;IAChC,OAAO,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9B,OAAO,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9B,UAAU,EAAE,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;IAClC,SAAS,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IAChC,SAAS,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC;IACjC,QAAQ,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC;IAC7B,SAAS,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC;IACjC,WAAW,EAAE,CAAC,cAAc,EAAE,KAAK,CAAC;IACpC,UAAU,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC;IAClC,SAAS,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;IAChC,SAAS,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;IAChC,SAAS,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;CACjC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAA2B;IACnD,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC;IAC/B,SAAS,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC;IACjC,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACxB,SAAS,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;CACjC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAA+B;IAC1D,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC;IACjC,OAAO,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC;IAC7B,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC;IAC7B,aAAa,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC;IACzC,WAAW,EAAE,CAAC,cAAc,EAAE,KAAK,CAAC;IACpC,SAAS,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC;IACjC,cAAc,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC;IAC1C,SAAS,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;CACjC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAA6B;IACvD,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC;IACjC,SAAS,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC;IACjC,QAAQ,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC;IAC/B,QAAQ,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAC9B,SAAS,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;IAChC,SAAS,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;CACjC,CAAC;AAEF,qGAAqG;AACrG,MAAM,UAAU,SAAS,CAAO,GAAiB,EAAE,KAAiB,EAAE,MAA2C;IAC/G,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAgB,CAAC,CAAC;QACpC,IAAI,KAAK,IAAI,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,WAAW,CAAI,GAAiB,EAAE,GAAwC,EAAE,MAAiD;IAC3I,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAA8C,EAAE,CAAC;QACvG,GAAG,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,GAAQ,CAAC;AAClB,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAuB,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEpF,uHAAuH;AACvH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW;IACzC,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QAC9D,OAAO,aAAa,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAC1D,OAAO,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;AACtD,CAAC"}

package/dist/src/hosted/widget.d.ts

@@ -0,0 +1,46 @@
+import { type DnsHost } from '../dns-host.js';
+import { type DnsCredentials, type DomainService } from './service.js';
+import type { Account, DomainRow, Store, WidgetDefaults, WidgetSession } from './store.js';
+export declare const newSessionToken: () => string;
+export declare const MAX_SESSION_SEC: number;
+export interface WidgetContext {
+    session: WidgetSession;
+    account: Account;
+}
+export interface WidgetOptions {
+    now?: () => number;
+    detectHost?: (domain: string) => Promise<DnsHost>;
+}
+/**
+ * Backs the embeddable widget. Everything is scoped to one session, which the
+ * app's backend mints with its secret key; the browser only ever holds the
+ * short-lived session token.
+ */
+export declare class WidgetService {
+    private readonly domains;
+    private readonly store;
+    private readonly now;
+    private readonly detectHost;
+    private readonly hostCache;
+    constructor(domains: DomainService, store: Store, opts?: WidgetOptions);
+    createSession(account: Account, input: {
+        domainId?: string;
+        defaults?: WidgetDefaults;
+        expiresInSec?: number;
+    }): Promise<{
+        session: WidgetSession;
+        token: string;
+    }>;
+    authenticate(token: string): Promise<WidgetContext | undefined>;
+    domainOf(ctx: WidgetContext): Promise<DomainRow | null>;
+    /** Where the domain's DNS is hosted, so the widget can suggest the right setup path. */
+    hostOf(domain: string): Promise<DnsHost>;
+    /** For sessions created without a domain: the end user enters it. */
+    setDomain(ctx: WidgetContext, input: string): Promise<DomainRow>;
+    /** Switches how DNS gets written. Credentials are checked against the zone before they're saved. */
+    connect(ctx: WidgetContext, provider: string, credentials: DnsCredentials): Promise<DomainRow>;
+    verify(ctx: WidgetContext): Promise<DomainRow>;
+    /** The end user approves replacing their existing records that conflict. */
+    resolveConflicts(ctx: WidgetContext): Promise<DomainRow>;
+    private requireDomain;
+}

package/dist/src/hosted/widget.js

@@ -0,0 +1,130 @@
+import { randomBytes } from 'node:crypto';
+import { detectDnsHost } from '../dns-host.js';
+import { ApiError, apiErrorHint, ConfigError } from '../errors.js';
+import { isValidDomain, normalizeName } from '../records.js';
+import { hashApiKey, newId } from './crypto.js';
+import { ConflictError, PlanLimitError } from './service.js';
+export const newSessionToken = () => `wss_${randomBytes(24).toString('base64url')}`;
+export const MAX_SESSION_SEC = 24 * 3600;
+const DEFAULT_SESSION_SEC = 3600;
+const HOST_CACHE_MS = 10 * 60e3;
+/**
+ * Backs the embeddable widget. Everything is scoped to one session, which the
+ * app's backend mints with its secret key; the browser only ever holds the
+ * short-lived session token.
+ */
+export class WidgetService {
+    domains;
+    store;
+    now;
+    detectHost;
+    hostCache = new Map();
+    constructor(domains, store, opts = {}) {
+        this.domains = domains;
+        this.store = store;
+        this.now = opts.now ?? Date.now;
+        this.detectHost = opts.detectHost ?? ((domain) => detectDnsHost(domain));
+    }
+    async createSession(account, input) {
+        if (account.widgetOrigins.length === 0) {
+            throw new ConfigError('Set widget_origins on your account first (PATCH /v1/account), e.g. ["https://app.example.com"].');
+        }
+        if (input.domainId)
+            await this.domains.getDomain(account, input.domainId);
+        else if (!input.defaults)
+            throw new ConfigError('Pass domain_id, or tenant_id to let the user enter their own domain.');
+        const token = newSessionToken();
+        const now = this.now();
+        const session = {
+            id: newId('ws'),
+            accountId: account.id,
+            tokenHash: hashApiKey(token),
+            domainId: input.domainId ?? null,
+            defaults: input.domainId ? null : input.defaults,
+            expiresAt: now + (input.expiresInSec ?? DEFAULT_SESSION_SEC) * 1000,
+            createdAt: now,
+        };
+        await this.store.createWidgetSession(session);
+        return { session, token };
+    }
+    async authenticate(token) {
+        const session = await this.store.getWidgetSessionByHash(hashApiKey(token));
+        if (!session || session.expiresAt <= this.now())
+            return undefined;
+        const account = await this.store.getAccount(session.accountId);
+        return account ? { session, account } : undefined;
+    }
+    async domainOf(ctx) {
+        return ctx.session.domainId ? ((await this.store.getDomain(ctx.account.id, ctx.session.domainId)) ?? null) : null;
+    }
+    /** Where the domain's DNS is hosted, so the widget can suggest the right setup path. */
+    async hostOf(domain) {
+        const cached = this.hostCache.get(domain);
+        if (cached && this.now() - cached.at < HOST_CACHE_MS)
+            return cached.host;
+        const host = await this.detectHost(domain);
+        this.hostCache.set(domain, { host, at: this.now() });
+        return host;
+    }
+    /** For sessions created without a domain: the end user enters it. */
+    async setDomain(ctx, input) {
+        const defaults = ctx.session.defaults;
+        if (ctx.session.domainId || !defaults)
+            throw new ConfigError('This session already has a domain.');
+        const domain = normalizeName(input);
+        if (!isValidDomain(domain))
+            throw new ConfigError('Enter a domain like example.com.');
+        let row = await this.store.findDomain(ctx.account.id, domain, defaults.subdomain);
+        if (row && row.tenantId !== defaults.tenantId) {
+            throw new ConflictError(`${domain} is already set up by someone else. Contact support if it's yours.`, '');
+        }
+        // The app owner's plan limit is their business; end users get a neutral message.
+        row ??= await this.domains.createDomain(ctx.account, {
+            domain,
+            subdomain: defaults.subdomain,
+            tenantId: defaults.tenantId,
+            metadata: defaults.metadata,
+            sendgridSubuser: defaults.sendgridSubuser,
+            // The email provider picks the inbound hostname (e.g. parse.<domain>).
+            inbound: defaults.inboundUrl ? { url: defaults.inboundUrl, spamCheck: false, sendRaw: false } : null,
+            dnsProvider: 'manual',
+        }).catch((err) => {
+            if (err instanceof PlanLimitError) {
+                throw new ConfigError(`Adding a domain isn't available right now. Please contact ${ctx.account.name} support.`);
+            }
+            throw err;
+        });
+        await this.store.updateWidgetSession(ctx.session.id, { domainId: row.id });
+        ctx.session.domainId = row.id;
+        return row;
+    }
+    /** Switches how DNS gets written. Credentials are checked against the zone before they're saved. */
+    async connect(ctx, provider, credentials) {
+        const row = await this.requireDomain(ctx);
+        try {
+            await this.domains.testDnsAccess(row, provider, credentials);
+        }
+        catch (err) {
+            if (err instanceof ApiError && err.status < 500) {
+                const detail = err.message.replace(/^.*?\(\d+\):\s*/, '');
+                throw new ConfigError(`${err.provider} didn't accept these credentials: ${detail}. ${apiErrorHint(err) ?? ''}`.trim());
+            }
+            throw err;
+        }
+        return this.domains.updateDomain(ctx.account, row.id, { dnsProvider: provider, dnsCredentials: credentials });
+    }
+    async verify(ctx) {
+        return this.domains.verifyNow(ctx.account, (await this.requireDomain(ctx)).id);
+    }
+    /** The end user approves replacing their existing records that conflict. */
+    async resolveConflicts(ctx) {
+        return this.domains.updateDomain(ctx.account, (await this.requireDomain(ctx)).id, { overwrite: true });
+    }
+    async requireDomain(ctx) {
+        const row = await this.domainOf(ctx);
+        if (!row)
+            throw new ConfigError('Enter your domain first.');
+        return row;
+    }
+}
+//# sourceMappingURL=widget.js.map

package/dist/src/hosted/widget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"widget.js","sourceRoot":"","sources":["../../../src/hosted/widget.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAgB,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,cAAc,EAA2C,MAAM,cAAc,CAAC;AAGtG,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,EAAE,CAAC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAEpF,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AACjC,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC;AAYhC;;;;GAIG;AACH,MAAM,OAAO,aAAa;IAML;IACA;IANF,GAAG,CAAe;IAClB,UAAU,CAAuC;IACjD,SAAS,GAAG,IAAI,GAAG,EAAyC,CAAC;IAE9E,YACmB,OAAsB,EACtB,KAAY,EAC7B,OAAsB,EAAE;QAFP,YAAO,GAAP,OAAO,CAAe;QACtB,UAAK,GAAL,KAAK,CAAO;QAG7B,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,OAAgB,EAChB,KAA8E;QAE9E,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,WAAW,CAAC,iGAAiG,CAAC,CAAC;QAC3H,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;aACrE,IAAI,CAAC,KAAK,CAAC,QAAQ;YAAE,MAAM,IAAI,WAAW,CAAC,sEAAsE,CAAC,CAAC;QAExH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,OAAO,GAAkB;YAC7B,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC;YACf,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;YAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAS;YACjD,SAAS,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,mBAAmB,CAAC,GAAG,IAAI;YACnE,SAAS,EAAE,GAAG;SACf,CAAC;QACF,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,SAAS,CAAC;QAClE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/D,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAkB;QAC/B,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpH,CAAC;IAED,wFAAwF;IACxF,KAAK,CAAC,MAAM,CAAC,MAAc;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,aAAa;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC;QACzE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qEAAqE;IACrE,KAAK,CAAC,SAAS,CAAC,GAAkB,EAAE,KAAa;QAC/C,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;QACtC,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,WAAW,CAAC,oCAAoC,CAAC,CAAC;QACnG,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,kCAAkC,CAAC,CAAC;QAEtF,IAAI,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QAClF,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC9C,MAAM,IAAI,aAAa,CAAC,GAAG,MAAM,oEAAoE,EAAE,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,iFAAiF;QACjF,GAAG,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE;YACnD,MAAM;YACN,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,eAAe,EAAE,QAAQ,CAAC,eAAe;YACzC,uEAAuE;YACvE,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI;YACpG,WAAW,EAAE,QAAQ;SACtB,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACxB,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;gBAClC,MAAM,IAAI,WAAW,CAAC,6DAA6D,GAAG,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,CAAC;YAClH,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3E,GAAG,CAAC,OAAO,CAAC,QAAQ,GAAG,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,GAAG,CAAC;IACb,CAAC;IAED,oGAAoG;IACpG,KAAK,CAAC,OAAO,CAAC,GAAkB,EAAE,QAAgB,EAAE,WAA2B;QAC7E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAChD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;gBAC1D,MAAM,IAAI,WAAW,CAAC,GAAG,GAAG,CAAC,QAAQ,qCAAqC,MAAM,KAAK,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;YACzH,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;IAChH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAkB;QAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,gBAAgB,CAAC,GAAkB;QACvC,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzG,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,GAAkB;QAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,WAAW,CAAC,0BAA0B,CAAC,CAAC;QAC5D,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}