dkimkit 0.0.0-stage → 0.7.0

package/dist/src/providers/dns/aws.js

@@ -0,0 +1,103 @@
+import { createHash, createHmac } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+const sha256Hex = (data) => createHash('sha256').update(data, 'utf8').digest('hex');
+const hmac = (key, data) => createHmac('sha256', key).update(data, 'utf8').digest();
+/** encodeURIComponent plus the reserved characters SigV4 requires escaped. */
+function uriEncode(s) {
+    return encodeURIComponent(s).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+/**
+ * AWS Signature Version 4. Returns the headers to send (everything except
+ * `host`, which fetch sets itself to the same value that was signed).
+ */
+export function signRequest(req, credentials, region, service, now = new Date()) {
+    const url = new URL(req.url);
+    const amzDate = now.toISOString().replace(/[:-]|\.\d{3}/g, '');
+    const date = amzDate.slice(0, 8);
+    const headers = { ...req.headers, 'x-amz-date': amzDate };
+    if (credentials.sessionToken)
+        headers['x-amz-security-token'] = credentials.sessionToken;
+    const canonical = { host: url.host };
+    for (const [k, v] of Object.entries(headers))
+        canonical[k.toLowerCase()] = v.trim().replace(/\s+/g, ' ');
+    const names = Object.keys(canonical).sort();
+    const signedHeaders = names.join(';');
+    const query = [...url.searchParams]
+        .map(([k, v]) => [uriEncode(k), uriEncode(v)])
+        .sort(([ak, av], [bk, bv]) => (ak === bk ? (av < bv ? -1 : av > bv ? 1 : 0) : ak < bk ? -1 : 1))
+        .map(([k, v]) => `${k}=${v}`)
+        .join('&');
+    // url.pathname is already encoded once; non-S3 services expect it encoded again.
+    const path = url.pathname.split('/').map(uriEncode).join('/') || '/';
+    const canonicalRequest = [
+        req.method.toUpperCase(),
+        path,
+        query,
+        names.map((n) => `${n}:${canonical[n]}\n`).join(''),
+        signedHeaders,
+        sha256Hex(req.body ?? ''),
+    ].join('\n');
+    const scope = `${date}/${region}/${service}/aws4_request`;
+    const stringToSign = ['AWS4-HMAC-SHA256', amzDate, scope, sha256Hex(canonicalRequest)].join('\n');
+    const key = hmac(hmac(hmac(hmac(`AWS4${credentials.secretAccessKey}`, date), region), service), 'aws4_request');
+    const signature = createHmac('sha256', key).update(stringToSign, 'utf8').digest('hex');
+    return {
+        ...headers,
+        Authorization: `AWS4-HMAC-SHA256 Credential=${credentials.accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`,
+    };
+}
+/**
+ * Static credentials from AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, or a profile
+ * in ~/.aws/credentials (AWS_PROFILE, AWS_SHARED_CREDENTIALS_FILE honored).
+ * SSO and instance roles are not supported; export keys for those
+ * (e.g. `aws configure export-credentials --format env`).
+ */
+export async function loadAwsCredentials(opts = {}) {
+    const env = opts.env ?? process.env;
+    if (!opts.profile && env.AWS_ACCESS_KEY_ID && env.AWS_SECRET_ACCESS_KEY) {
+        return {
+            accessKeyId: env.AWS_ACCESS_KEY_ID,
+            secretAccessKey: env.AWS_SECRET_ACCESS_KEY,
+            ...(env.AWS_SESSION_TOKEN ? { sessionToken: env.AWS_SESSION_TOKEN } : {}),
+        };
+    }
+    const profile = opts.profile ?? env.AWS_PROFILE ?? 'default';
+    const file = env.AWS_SHARED_CREDENTIALS_FILE ?? join(homedir(), '.aws', 'credentials');
+    let text;
+    try {
+        text = await readFile(file, 'utf8');
+    }
+    catch {
+        throw new Error(`No AWS credentials: set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, or create ${file}.`);
+    }
+    const section = parseIni(text)[profile];
+    if (!section?.aws_access_key_id || !section.aws_secret_access_key) {
+        throw new Error(`AWS profile "${profile}" in ${file} has no aws_access_key_id/aws_secret_access_key.`);
+    }
+    return {
+        accessKeyId: section.aws_access_key_id,
+        secretAccessKey: section.aws_secret_access_key,
+        ...(section.aws_session_token ? { sessionToken: section.aws_session_token } : {}),
+    };
+}
+function parseIni(text) {
+    const sections = {};
+    let current;
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (!line || line.startsWith('#') || line.startsWith(';'))
+            continue;
+        const header = /^\[\s*(?:profile\s+)?([^\]]+?)\s*\]$/.exec(line);
+        if (header) {
+            current = sections[header[1]] ??= {};
+            continue;
+        }
+        const eq = line.indexOf('=');
+        if (current && eq > 0)
+            current[line.slice(0, eq).trim().toLowerCase()] = line.slice(eq + 1).trim();
+    }
+    return sections;
+}
+//# sourceMappingURL=aws.js.map

package/dist/src/providers/dns/aws.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws.js","sourceRoot":"","sources":["../../../../src/providers/dns/aws.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAQjC,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5F,MAAM,IAAI,GAAG,CAAC,GAAoB,EAAE,IAAY,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AAE7G,8EAA8E;AAC9E,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AAC5G,CAAC;AASD;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,GAAoB,EACpB,WAA2B,EAC3B,MAAc,EACd,OAAe,EACf,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAEjC,MAAM,OAAO,GAA2B,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IAClF,IAAI,WAAW,CAAC,YAAY;QAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,WAAW,CAAC,YAAY,CAAC;IAEzF,MAAM,SAAS,GAA2B,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;IAC7D,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACzG,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEtC,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC;SAChC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAU,CAAC;SACtD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC/F,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;SAC5B,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,iFAAiF;IACjF,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;IAErE,MAAM,gBAAgB,GAAG;QACvB,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE;QACxB,IAAI;QACJ,KAAK;QACL,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,aAAa;QACb,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;KAC1B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,KAAK,GAAG,GAAG,IAAI,IAAI,MAAM,IAAI,OAAO,eAAe,CAAC;IAC1D,MAAM,YAAY,GAAG,CAAC,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClG,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,WAAW,CAAC,eAAe,EAAE,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,EAAE,cAAc,CAAC,CAAC;IAChH,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEvF,OAAO;QACL,GAAG,OAAO;QACV,aAAa,EAAE,+BAA+B,WAAW,CAAC,WAAW,IAAI,KAAK,mBAAmB,aAAa,eAAe,SAAS,EAAE;KACzI,CAAC;AACJ,CAAC;AAQD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAA+B,EAAE;IACxE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,qBAAqB,EAAE,CAAC;QACxE,OAAO;YACL,WAAW,EAAE,GAAG,CAAC,iBAAiB;YAClC,eAAe,EAAE,GAAG,CAAC,qBAAqB;YAC1C,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1E,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,WAAW,IAAI,SAAS,CAAC;IAC7D,MAAM,IAAI,GAAG,GAAG,CAAC,2BAA2B,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;IACvF,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,kFAAkF,IAAI,GAAG,CAAC,CAAC;IAC7G,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,iBAAiB,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,gBAAgB,OAAO,QAAQ,IAAI,kDAAkD,CAAC,CAAC;IACzG,CAAC;IACD,OAAO;QACL,WAAW,EAAE,OAAO,CAAC,iBAAiB;QACtC,eAAe,EAAE,OAAO,CAAC,qBAAqB;QAC9C,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,QAAQ,GAA2C,EAAE,CAAC;IAC5D,IAAI,OAA2C,CAAC;IAChD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACpE,MAAM,MAAM,GAAG,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,KAAK,EAAE,CAAC;YACtC,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,OAAO,IAAI,EAAE,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrG,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/src/providers/dns/cloudflare.d.ts

@@ -0,0 +1,26 @@
+import { type FetchLike } from '../../http.js';
+import type { DnsProvider, DnsRecord, PlannedChange } from '../../types.js';
+export interface CloudflareOptions {
+    /** Needs Zone:Read and DNS:Edit on the target zone. */
+    apiToken: string;
+    baseUrl?: string;
+    fetch?: FetchLike;
+}
+export declare class CloudflareDns implements DnsProvider {
+    private readonly opts;
+    readonly name = "cloudflare";
+    private readonly baseUrl;
+    private readonly fetchImpl;
+    private readonly zoneIds;
+    /** Zones confirmed to exist, by name. */
+    private readonly knownZones;
+    constructor(opts: CloudflareOptions);
+    plan(records: DnsRecord[], opts?: {
+        overwrite?: boolean;
+    }): Promise<PlannedChange[]>;
+    apply(changes: PlannedChange[]): Promise<void>;
+    /** Finds the zone holding `name` by trying it and each parent domain. */
+    zoneFor(name: string): Promise<string>;
+    private lookupZone;
+    private request;
+}

package/dist/src/providers/dns/cloudflare.js

@@ -0,0 +1,97 @@
+import { ConfigError, DnsConflictError } from '../../errors.js';
+import { requestJson } from '../../http.js';
+import { decideChange, normalizeName } from '../../records.js';
+export class CloudflareDns {
+    opts;
+    name = 'cloudflare';
+    baseUrl;
+    fetchImpl;
+    zoneIds = new Map();
+    /** Zones confirmed to exist, by name. */
+    knownZones = new Map();
+    constructor(opts) {
+        this.opts = opts;
+        this.baseUrl = opts.baseUrl ?? 'https://api.cloudflare.com/client/v4';
+        this.fetchImpl = opts.fetch ?? fetch;
+    }
+    async plan(records, opts = {}) {
+        const changes = [];
+        for (const record of records) {
+            const zoneId = await this.zoneFor(record.name);
+            const existing = await this.request(`/zones/${zoneId}/dns_records?name=${encodeURIComponent(record.name)}&per_page=100`);
+            const neutral = existing.map((e) => ({
+                id: e.id,
+                type: e.type,
+                value: e.content,
+                priority: e.priority,
+                proxied: e.proxied,
+            }));
+            changes.push(decideChange(record, neutral, opts.overwrite, records));
+        }
+        return changes;
+    }
+    async apply(changes) {
+        const conflicts = changes.filter((c) => c.action === 'conflict');
+        if (conflicts.length > 0)
+            throw new DnsConflictError(conflicts);
+        for (const change of changes) {
+            if (change.action === 'noop')
+                continue;
+            const zoneId = await this.zoneFor(change.record.name);
+            const body = toCloudflareBody(change.record);
+            if (change.action === 'update') {
+                await this.request(`/zones/${zoneId}/dns_records/${change.existingId}`, { method: 'PUT', body });
+            }
+            else {
+                await this.request(`/zones/${zoneId}/dns_records`, { method: 'POST', body });
+            }
+        }
+    }
+    /** Finds the zone holding `name` by trying it and each parent domain. */
+    async zoneFor(name) {
+        const labels = normalizeName(name).split('.');
+        const candidates = labels.slice(0, -1).map((_, i) => labels.slice(i).join('.'));
+        // Records usually share a zone; reuse one already found before calling the API.
+        const known = candidates.find((c) => this.knownZones.has(c));
+        if (known)
+            return this.knownZones.get(known);
+        for (const candidate of candidates) {
+            const id = await this.lookupZone(candidate);
+            if (id) {
+                this.knownZones.set(candidate, id);
+                return id;
+            }
+        }
+        throw new ConfigError(`No Cloudflare zone found for ${name}. Check the domain is on this Cloudflare account and the token has Zone:Read access.`);
+    }
+    lookupZone(zoneName) {
+        let id = this.zoneIds.get(zoneName);
+        if (!id) {
+            id = this.request(`/zones?name=${encodeURIComponent(zoneName)}`).then((z) => z[0]?.id ?? null);
+            this.zoneIds.set(zoneName, id);
+        }
+        return id;
+    }
+    async request(path, opts = {}) {
+        const envelope = await requestJson(this.fetchImpl, 'Cloudflare', this.baseUrl + path, { ...opts, headers: { Authorization: `Bearer ${this.opts.apiToken}` } }, describeCloudflareError);
+        return envelope.result;
+    }
+}
+function toCloudflareBody(record) {
+    return {
+        type: record.type,
+        name: record.name,
+        content: record.value,
+        ttl: 1, // automatic
+        // Proxied CNAMEs resolve to Cloudflare IPs, which fails provider verification.
+        ...(record.type === 'CNAME' ? { proxied: false } : {}),
+        ...(record.type === 'MX' ? { priority: record.priority ?? 10 } : {}),
+    };
+}
+function describeCloudflareError(body) {
+    const errors = body?.errors;
+    if (!Array.isArray(errors) || errors.length === 0)
+        return undefined;
+    return errors.map((e) => `${e.message} (code ${e.code})`).join('; ');
+}
+//# sourceMappingURL=cloudflare.js.map

package/dist/src/providers/dns/cloudflare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare.js","sourceRoot":"","sources":["../../../../src/providers/dns/cloudflare.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAuC,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAyB/D,MAAM,OAAO,aAAa;IAQK;IAPpB,IAAI,GAAG,YAAY,CAAC;IACZ,OAAO,CAAS;IAChB,SAAS,CAAY;IACrB,OAAO,GAAG,IAAI,GAAG,EAAkC,CAAC;IACrE,yCAAyC;IACxB,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAExD,YAA6B,IAAuB;QAAvB,SAAI,GAAJ,IAAI,CAAmB;QAClD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,sCAAsC,CAAC;QACtE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAoB,EAAE,OAAgC,EAAE;QACjE,MAAM,OAAO,GAAoB,EAAE,CAAC;QACpC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC,UAAU,MAAM,qBAAqB,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CACpF,CAAC;YACF,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACnC,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,KAAK,EAAE,CAAC,CAAC,OAAO;gBAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,OAAO,EAAE,CAAC,CAAC,OAAO;aACnB,CAAC,CAAC,CAAC;YACJ,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAwB;QAClC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC;QACjE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAEhE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;gBAAE,SAAS;YACvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,MAAM,gBAAgB,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACnG,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,MAAM,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,OAAO,CAAC,IAAY;QACxB,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAChF,gFAAgF;QAChF,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,IAAI,KAAK;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAE,CAAC;QAC9C,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YAC5C,IAAI,EAAE,EAAE,CAAC;gBACP,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBACnC,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QACD,MAAM,IAAI,WAAW,CACnB,gCAAgC,IAAI,sFAAsF,CAC3H,CAAC;IACJ,CAAC;IAEO,UAAU,CAAC,QAAgB;QACjC,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,EAAE,GAAG,IAAI,CAAC,OAAO,CAAmB,eAAe,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC,CAAC;YACjH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,IAAY,EAAE,OAAuB,EAAE;QAC9D,MAAM,QAAQ,GAAG,MAAM,WAAW,CAChC,IAAI,CAAC,SAAS,EACd,YAAY,EACZ,IAAI,CAAC,OAAO,GAAG,IAAI,EACnB,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EACvE,uBAAuB,CACxB,CAAC;QACF,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC;CACF;AAED,SAAS,gBAAgB,CAAC,MAAiB;IACzC,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,MAAM,CAAC,KAAK;QACrB,GAAG,EAAE,CAAC,EAAE,YAAY;QACpB,+EAA+E;QAC/E,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAa;IAC5C,MAAM,MAAM,GAAI,IAAwC,EAAE,MAAM,CAAC;IACjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACpE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvE,CAAC"}

package/dist/src/providers/dns/manual.d.ts

@@ -0,0 +1,12 @@
+import type { DnsProvider, DnsRecord, PlannedChange } from '../../types.js';
+/**
+ * For DNS hosts without an API integration: hands the records to a callback
+ * (e.g. print them and wait for the user), then relies on propagation polling.
+ */
+export declare class ManualDns implements DnsProvider {
+    private readonly onRecords;
+    readonly name = "manual";
+    constructor(onRecords: (records: DnsRecord[]) => Promise<void>);
+    plan(records: DnsRecord[]): Promise<PlannedChange[]>;
+    apply(changes: PlannedChange[]): Promise<void>;
+}

package/dist/src/providers/dns/manual.js

@@ -0,0 +1,18 @@
+/**
+ * For DNS hosts without an API integration: hands the records to a callback
+ * (e.g. print them and wait for the user), then relies on propagation polling.
+ */
+export class ManualDns {
+    onRecords;
+    name = 'manual';
+    constructor(onRecords) {
+        this.onRecords = onRecords;
+    }
+    async plan(records) {
+        return records.map((record) => ({ record, action: 'create' }));
+    }
+    async apply(changes) {
+        await this.onRecords(changes.filter((c) => c.action !== 'noop').map((c) => c.record));
+    }
+}
+//# sourceMappingURL=manual.js.map

package/dist/src/providers/dns/manual.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manual.js","sourceRoot":"","sources":["../../../../src/providers/dns/manual.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,OAAO,SAAS;IAGS;IAFpB,IAAI,GAAG,QAAQ,CAAC;IAEzB,YAA6B,SAAkD;QAAlD,cAAS,GAAT,SAAS,CAAyC;IAAG,CAAC;IAEnF,KAAK,CAAC,IAAI,CAAC,OAAoB;QAC7B,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAwB;QAClC,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACxF,CAAC;CACF"}

package/dist/src/providers/dns/route53.d.ts

@@ -0,0 +1,34 @@
+import { type FetchLike } from '../../http.js';
+import type { DnsProvider, DnsRecord, PlannedChange } from '../../types.js';
+import { type AwsCredentials } from './aws.js';
+export interface Route53Options {
+    /** Static credentials, or a loader called once on first use (e.g. `() => loadAwsCredentials()`). */
+    credentials: AwsCredentials | (() => Promise<AwsCredentials>);
+    /** Use this hosted zone instead of looking one up by name. */
+    hostedZoneId?: string;
+    baseUrl?: string;
+    fetch?: FetchLike;
+}
+/**
+ * Route53 stores one record set per (name, type) holding every value, so
+ * writes rebuild the whole set (keeping values we didn't create) and UPSERT it.
+ */
+export declare class Route53Dns implements DnsProvider {
+    private readonly opts;
+    readonly name = "route53";
+    private readonly baseUrl;
+    private readonly fetchImpl;
+    private credentials?;
+    private readonly zoneIds;
+    private readonly knownZones;
+    constructor(opts: Route53Options);
+    plan(records: DnsRecord[], opts?: {
+        overwrite?: boolean;
+    }): Promise<PlannedChange[]>;
+    apply(changes: PlannedChange[]): Promise<void>;
+    /** Finds the public hosted zone holding `name` by trying it and each parent domain. */
+    zoneFor(name: string): Promise<string>;
+    private lookupZone;
+    private listSets;
+    private call;
+}

package/dist/src/providers/dns/route53.js

@@ -0,0 +1,176 @@
+import { ConfigError, DnsConflictError } from '../../errors.js';
+import { requestText } from '../../http.js';
+import { decideChange, normalizeName } from '../../records.js';
+import { decodeXml, encodeXml, xmlTags, xmlText } from '../../xml.js';
+import { signRequest } from './aws.js';
+const API_VERSION = '2013-04-01';
+const DEFAULT_TTL = 300;
+/**
+ * Route53 stores one record set per (name, type) holding every value, so
+ * writes rebuild the whole set (keeping values we didn't create) and UPSERT it.
+ */
+export class Route53Dns {
+    opts;
+    name = 'route53';
+    baseUrl;
+    fetchImpl;
+    credentials;
+    zoneIds = new Map();
+    knownZones = new Map();
+    constructor(opts) {
+        this.opts = opts;
+        this.baseUrl = opts.baseUrl ?? 'https://route53.amazonaws.com';
+        this.fetchImpl = opts.fetch ?? fetch;
+    }
+    async plan(records, opts = {}) {
+        const changes = [];
+        for (const record of records) {
+            const zoneId = await this.zoneFor(record.name);
+            const existing = (await this.listSets(zoneId, record.name)).flatMap(toExisting);
+            changes.push(decideChange(record, existing, opts.overwrite, records));
+        }
+        return changes;
+    }
+    async apply(changes) {
+        const conflicts = changes.filter((c) => c.action === 'conflict');
+        if (conflicts.length > 0)
+            throw new DnsConflictError(conflicts);
+        // zone → (name|type → changes)
+        const byZone = new Map();
+        for (const change of changes) {
+            if (change.action === 'noop')
+                continue;
+            const zoneId = await this.zoneFor(change.record.name);
+            const sets = byZone.get(zoneId) ?? new Map();
+            byZone.set(zoneId, sets);
+            const key = `${change.record.name}|${change.record.type}`;
+            sets.set(key, [...(sets.get(key) ?? []), change]);
+        }
+        for (const [zoneId, sets] of byZone) {
+            const upserts = [];
+            for (const group of sets.values()) {
+                const { name, type } = group[0].record;
+                // Re-read so values added since planning aren't dropped.
+                const current = (await this.listSets(zoneId, name)).find((s) => s.type === type);
+                let values = type === 'CNAME' ? [] : [...(current?.values ?? [])];
+                for (const change of group) {
+                    if (change.action === 'update' && change.existingId)
+                        values = values.filter((v) => v !== change.existingId);
+                    values.push(formatValue(change.record));
+                }
+                upserts.push({ name, type, ttl: current?.ttl ?? DEFAULT_TTL, values: [...new Set(values)] });
+            }
+            await this.call('POST', `/hostedzone/${zoneId}/rrset`, changeBatchXml(upserts));
+        }
+    }
+    /** Finds the public hosted zone holding `name` by trying it and each parent domain. */
+    async zoneFor(name) {
+        if (this.opts.hostedZoneId)
+            return this.opts.hostedZoneId.replace(/^\/hostedzone\//, '');
+        const labels = normalizeName(name).split('.');
+        const candidates = labels.slice(0, -1).map((_, i) => labels.slice(i).join('.'));
+        const known = candidates.find((c) => this.knownZones.has(c));
+        if (known)
+            return this.knownZones.get(known);
+        for (const candidate of candidates) {
+            const id = await this.lookupZone(candidate);
+            if (id) {
+                this.knownZones.set(candidate, id);
+                return id;
+            }
+        }
+        throw new ConfigError(`No public Route53 hosted zone found for ${name}. Check the AWS account, or pass a hosted zone id.`);
+    }
+    lookupZone(zoneName) {
+        let id = this.zoneIds.get(zoneName);
+        if (!id) {
+            id = this.call('GET', `/hostedzonesbyname?dnsname=${encodeURIComponent(zoneName)}&maxitems=10`).then((xml) => {
+                // Results start at dnsname and continue alphabetically, so match exactly.
+                const zone = xmlTags(xml, 'HostedZone').find((z) => decodeName(xmlText(z, 'Name') ?? '') === zoneName && xmlText(z, 'PrivateZone') !== 'true');
+                return zone ? xmlText(zone, 'Id').replace(/^\/hostedzone\//, '') : null;
+            });
+            this.zoneIds.set(zoneName, id);
+        }
+        return id;
+    }
+    async listSets(zoneId, name) {
+        // Listing starts at `name`; all of a name's sets are adjacent.
+        const xml = await this.call('GET', `/hostedzone/${zoneId}/rrset?name=${encodeURIComponent(name)}&maxitems=20`);
+        return xmlTags(xml, 'ResourceRecordSet')
+            .map((s) => {
+            const ttl = xmlText(s, 'TTL');
+            const alias = xmlTags(s, 'AliasTarget')[0];
+            return {
+                name: decodeName(xmlText(s, 'Name') ?? ''),
+                type: xmlText(s, 'Type') ?? '',
+                ...(ttl ? { ttl: Number(ttl) } : {}),
+                values: xmlTags(s, 'Value').map((v) => decodeXml(v.trim())),
+                ...(alias ? { alias: normalizeName(xmlText(alias, 'DNSName') ?? '') } : {}),
+            };
+        })
+            .filter((s) => s.name === name);
+    }
+    async call(method, path, body) {
+        this.credentials ??= Promise.resolve(typeof this.opts.credentials === 'function' ? this.opts.credentials() : this.opts.credentials);
+        const credentials = await this.credentials;
+        const url = `${this.baseUrl}/${API_VERSION}${path}`;
+        return requestText(this.fetchImpl, 'Route53', url, () => ({
+            method,
+            body,
+            headers: signRequest({ method, url, body, headers: body ? { 'content-type': 'application/xml' } : {} }, credentials, 'us-east-1', 'route53'),
+        }), describeRoute53Error);
+    }
+}
+function toExisting(set) {
+    if (set.alias)
+        return [{ id: `alias:${set.alias}`, type: set.type, value: set.alias }];
+    return set.values.map((raw) => {
+        if (set.type === 'MX') {
+            const [priority, host] = raw.split(/\s+/);
+            return { id: raw, type: 'MX', value: host ?? '', priority: Number(priority) };
+        }
+        return { id: raw, type: set.type, value: set.type === 'TXT' ? unquoteTxt(raw) : raw };
+    });
+}
+function formatValue(record) {
+    switch (record.type) {
+        case 'MX':
+            return `${record.priority ?? 10} ${record.value}`;
+        case 'TXT': {
+            // Route53 wants quoted strings, each at most 255 characters.
+            const escaped = record.value.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+            return (escaped.match(/[\s\S]{1,255}/g) ?? ['']).map((chunk) => `"${chunk}"`).join(' ');
+        }
+        default:
+            return record.value;
+    }
+}
+function unquoteTxt(raw) {
+    const chunks = [...raw.matchAll(/"((?:[^"\\]|\\.)*)"/g)].map((m) => m[1].replace(/\\(.)/g, '$1'));
+    return chunks.length > 0 ? chunks.join('') : raw;
+}
+/** Route53 returns names with a trailing dot and octal escapes (e.g. \052 for *). */
+function decodeName(name) {
+    return normalizeName(name.replace(/\\(\d{3})/g, (_, oct) => String.fromCharCode(parseInt(oct, 8))));
+}
+function changeBatchXml(sets) {
+    const changes = sets
+        .map((s) => `<Change><Action>UPSERT</Action><ResourceRecordSet><Name>${encodeXml(s.name)}</Name><Type>${s.type}</Type>` +
+        `<TTL>${s.ttl ?? DEFAULT_TTL}</TTL><ResourceRecords>` +
+        s.values.map((v) => `<ResourceRecord><Value>${encodeXml(v)}</Value></ResourceRecord>`).join('') +
+        `</ResourceRecords></ResourceRecordSet></Change>`)
+        .join('');
+    return (`<?xml version="1.0" encoding="UTF-8"?>` +
+        `<ChangeResourceRecordSetsRequest xmlns="https://route53.amazonaws.com/doc/${API_VERSION}/">` +
+        `<ChangeBatch><Comment>dkimkit</Comment><Changes>${changes}</Changes></ChangeBatch>` +
+        `</ChangeResourceRecordSetsRequest>`);
+}
+function describeRoute53Error(text) {
+    // InvalidChangeBatch nests per-change <Message>s; other errors have one.
+    const messages = xmlTags(text, 'Message').map((m) => decodeXml(m.trim()));
+    const code = xmlText(text, 'Code');
+    if (messages.length === 0)
+        return code;
+    return code ? `${code}: ${messages.join('; ')}` : messages.join('; ');
+}
+//# sourceMappingURL=route53.js.map

package/dist/src/providers/dns/route53.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route53.js","sourceRoot":"","sources":["../../../../src/providers/dns/route53.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAkB,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAuB,MAAM,kBAAkB,CAAC;AAEpF,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,WAAW,EAAuB,MAAM,UAAU,CAAC;AAE5D,MAAM,WAAW,GAAG,YAAY,CAAC;AACjC,MAAM,WAAW,GAAG,GAAG,CAAC;AAoBxB;;;GAGG;AACH,MAAM,OAAO,UAAU;IAQQ;IAPpB,IAAI,GAAG,SAAS,CAAC;IACT,OAAO,CAAS;IAChB,SAAS,CAAY;IAC9B,WAAW,CAA2B;IAC7B,OAAO,GAAG,IAAI,GAAG,EAAkC,CAAC;IACpD,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAExD,YAA6B,IAAoB;QAApB,SAAI,GAAJ,IAAI,CAAgB;QAC/C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,+BAA+B,CAAC;QAC/D,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAoB,EAAE,OAAgC,EAAE;QACjE,MAAM,OAAO,GAAoB,EAAE,CAAC;QACpC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAChF,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAwB;QAClC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC;QACjE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAEhE,+BAA+B;QAC/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwC,CAAC;QAC/D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;gBAAE,SAAS;YACvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,EAA2B,CAAC;YACtE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACzB,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC1D,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,CAAC;QAED,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC;YACpC,MAAM,OAAO,GAAgB,EAAE,CAAC;YAChC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC;gBACxC,yDAAyD;gBACzD,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;gBACjF,IAAI,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;gBAClE,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;oBAC3B,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU;wBAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC,CAAC;oBAC5G,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC1C,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,WAAW,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;YAC/F,CAAC;YACD,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,MAAM,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,OAAO,CAAC,IAAY;QACxB,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACzF,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAChF,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,IAAI,KAAK;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAE,CAAC;QAC9C,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YAC5C,IAAI,EAAE,EAAE,CAAC;gBACP,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBACnC,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QACD,MAAM,IAAI,WAAW,CACnB,2CAA2C,IAAI,oDAAoD,CACpG,CAAC;IACJ,CAAC;IAEO,UAAU,CAAC,QAAgB;QACjC,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,8BAA8B,kBAAkB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC3G,0EAA0E;gBAC1E,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,IAAI,CAC1C,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,EAAE,aAAa,CAAC,KAAK,MAAM,CACjG,CAAC;gBACF,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAE,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC3E,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,IAAY;QACjD,+DAA+D;QAC/D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,eAAe,MAAM,eAAe,kBAAkB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/G,OAAO,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC;aACrC,GAAG,CAAC,CAAC,CAAC,EAAa,EAAE;YACpB,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,OAAO;gBACL,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC1C,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE;gBAC9B,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5E,CAAC;QACJ,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACpC,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,MAAc,EAAE,IAAY,EAAE,IAAa;QAC5D,IAAI,CAAC,WAAW,KAAK,OAAO,CAAC,OAAO,CAClC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAC9F,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC;QAC3C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,WAAW,GAAG,IAAI,EAAE,CAAC;QACpD,OAAO,WAAW,CAChB,IAAI,CAAC,SAAS,EACd,SAAS,EACT,GAAG,EACH,GAAG,EAAE,CAAC,CAAC;YACL,MAAM;YACN,IAAI;YACJ,OAAO,EAAE,WAAW,CAClB,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EACjF,WAAW,EACX,WAAW,EACX,SAAS,CACV;SACF,CAAC,EACF,oBAAoB,CACrB,CAAC;IACJ,CAAC;CACF;AAED,SAAS,UAAU,CAAC,GAAc;IAChC,IAAI,GAAG,CAAC,KAAK;QAAE,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IACvF,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC5B,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1C,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACxF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAAiB;IACpC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,IAAI;YACP,OAAO,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACpD,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,6DAA6D;YAC7D,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACzE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1F,CAAC;QACD;YACE,OAAO,MAAM,CAAC,KAAK,CAAC;IACxB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IACnG,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACnD,CAAC;AAED,qFAAqF;AACrF,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,GAAW,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9G,CAAC;AAED,SAAS,cAAc,CAAC,IAAiB;IACvC,MAAM,OAAO,GAAG,IAAI;SACjB,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,2DAA2D,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,SAAS;QAC3G,QAAQ,CAAC,CAAC,GAAG,IAAI,WAAW,yBAAyB;QACrD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,0BAA0B,SAAS,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/F,iDAAiD,CACpD;SACA,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO,CACL,wCAAwC;QACxC,6EAA6E,WAAW,KAAK;QAC7F,mDAAmD,OAAO,0BAA0B;QACpF,oCAAoC,CACrC,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACxC,yEAAyE;IACzE,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxE,CAAC"}

package/dist/src/providers/email/factory.d.ts

@@ -0,0 +1,29 @@
+import type { FetchLike } from '../../http.js';
+import type { EmailProvider } from '../../types.js';
+export declare const EMAIL_PROVIDERS: readonly ["sendgrid", "postmark", "mailgun", "ses"];
+export type EmailProviderName = (typeof EMAIL_PROVIDERS)[number];
+export declare const EMAIL_PROVIDER_LABELS: Record<EmailProviderName, string>;
+/** Credentials for any supported email provider; each uses its own fields. */
+export interface EmailCredentials {
+    /** SendGrid, Mailgun */
+    apiKey?: string;
+    /** Postmark account token */
+    accountToken?: string;
+    /** Postmark server that receives inbound mail */
+    inboundServerId?: string;
+    /** Mailgun: us | eu. SES: AWS region. */
+    region?: string;
+    /** SES */
+    accessKeyId?: string;
+    secretAccessKey?: string;
+    sessionToken?: string;
+}
+export declare function isEmailProvider(name: string): name is EmailProviderName;
+/** Throws a ConfigError naming what's missing for the provider. */
+export declare function assertEmailCredentials(provider: string, c: EmailCredentials): void;
+/** Keeps only the fields the provider uses, so nothing extra is stored. */
+export declare function pickEmailCredentials(provider: string, c: EmailCredentials): EmailCredentials;
+export declare function createEmailProvider(provider: string, credentials: EmailCredentials, opts?: {
+    subuser?: string | null;
+    fetch?: FetchLike;
+}): EmailProvider;

package/dist/src/providers/email/factory.js

@@ -0,0 +1,67 @@
+import { ConfigError } from '../../errors.js';
+import { MailgunProvider } from './mailgun.js';
+import { PostmarkProvider } from './postmark.js';
+import { SendGridProvider } from './sendgrid.js';
+import { SesProvider } from './ses.js';
+export const EMAIL_PROVIDERS = ['sendgrid', 'postmark', 'mailgun', 'ses'];
+export const EMAIL_PROVIDER_LABELS = {
+    sendgrid: 'SendGrid',
+    postmark: 'Postmark',
+    mailgun: 'Mailgun',
+    ses: 'Amazon SES',
+};
+export function isEmailProvider(name) {
+    return EMAIL_PROVIDERS.includes(name);
+}
+/** Throws a ConfigError naming what's missing for the provider. */
+export function assertEmailCredentials(provider, c) {
+    const need = (ok, message) => {
+        if (!ok)
+            throw new ConfigError(message);
+    };
+    switch (provider) {
+        case 'sendgrid':
+            return need(c.apiKey, 'SendGrid needs an API key.');
+        case 'postmark':
+            return need(c.accountToken, 'Postmark needs an account API token.');
+        case 'mailgun':
+            need(c.apiKey, 'Mailgun needs an API key.');
+            return need(!c.region || c.region === 'us' || c.region === 'eu', 'Mailgun region must be us or eu.');
+        case 'ses':
+            need(c.accessKeyId && c.secretAccessKey, 'Amazon SES needs an AWS access key id and secret access key.');
+            return need(c.region, 'Amazon SES needs an AWS region, e.g. us-east-1.');
+        default:
+            throw new ConfigError(`Email provider must be one of: ${EMAIL_PROVIDERS.join(', ')}.`);
+    }
+}
+/** Keeps only the fields the provider uses, so nothing extra is stored. */
+export function pickEmailCredentials(provider, c) {
+    const keys = {
+        sendgrid: ['apiKey'],
+        postmark: ['accountToken', 'inboundServerId'],
+        mailgun: ['apiKey', 'region'],
+        ses: ['accessKeyId', 'secretAccessKey', 'sessionToken', 'region'],
+    };
+    return Object.fromEntries((keys[provider] ?? []).filter((k) => c[k]).map((k) => [k, c[k]]));
+}
+export function createEmailProvider(provider, credentials, opts = {}) {
+    assertEmailCredentials(provider, credentials);
+    if (opts.subuser && provider !== 'sendgrid')
+        throw new ConfigError('Subusers only apply to SendGrid.');
+    const c = credentials;
+    switch (provider) {
+        case 'sendgrid':
+            return new SendGridProvider({ apiKey: c.apiKey, onBehalfOf: opts.subuser ?? undefined, fetch: opts.fetch });
+        case 'postmark':
+            return new PostmarkProvider({ accountToken: c.accountToken, inboundServerId: c.inboundServerId, fetch: opts.fetch });
+        case 'mailgun':
+            return new MailgunProvider({ apiKey: c.apiKey, region: c.region ?? 'us', fetch: opts.fetch });
+        default:
+            return new SesProvider({
+                credentials: { accessKeyId: c.accessKeyId, secretAccessKey: c.secretAccessKey, ...(c.sessionToken ? { sessionToken: c.sessionToken } : {}) },
+                region: c.region,
+                fetch: opts.fetch,
+            });
+    }
+}
+//# sourceMappingURL=factory.js.map

package/dist/src/providers/email/factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.js","sourceRoot":"","sources":["../../../../src/providers/email/factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAG9C,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAEvC,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAU,CAAC;AAGnF,MAAM,CAAC,MAAM,qBAAqB,GAAsC;IACtE,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,SAAS;IAClB,GAAG,EAAE,YAAY;CAClB,CAAC;AAkBF,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAQ,eAAqC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,sBAAsB,CAAC,QAAgB,EAAE,CAAmB;IAC1E,MAAM,IAAI,GAAG,CAAC,EAAW,EAAE,OAAe,EAAE,EAAE;QAC5C,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC,CAAC;IACF,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;QACtD,KAAK,UAAU;YACb,OAAO,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,sCAAsC,CAAC,CAAC;QACtE,KAAK,SAAS;YACZ,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,EAAE,kCAAkC,CAAC,CAAC;QACvG,KAAK,KAAK;YACR,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,eAAe,EAAE,8DAA8D,CAAC,CAAC;YACzG,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,iDAAiD,CAAC,CAAC;QAC3E;YACE,MAAM,IAAI,WAAW,CAAC,kCAAkC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,oBAAoB,CAAC,QAAgB,EAAE,CAAmB;IACxE,MAAM,IAAI,GAA+C;QACvD,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACpB,QAAQ,EAAE,CAAC,cAAc,EAAE,iBAAiB,CAAC;QAC7C,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC7B,GAAG,EAAE,CAAC,aAAa,EAAE,iBAAiB,EAAE,cAAc,EAAE,QAAQ,CAAC;KAClE,CAAC;IACF,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,QAAgB,EAChB,WAA6B,EAC7B,OAAuD,EAAE;IAEzD,sBAAsB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC9C,IAAI,IAAI,CAAC,OAAO,IAAI,QAAQ,KAAK,UAAU;QAAE,MAAM,IAAI,WAAW,CAAC,kCAAkC,CAAC,CAAC;IACvG,MAAM,CAAC,GAAG,WAAW,CAAC;IACtB,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,IAAI,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAO,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/G,KAAK,UAAU;YACb,OAAO,IAAI,gBAAgB,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAa,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACxH,KAAK,SAAS;YACZ,OAAO,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAO,EAAE,MAAM,EAAG,CAAC,CAAC,MAAkC,IAAI,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9H;YACE,OAAO,IAAI,WAAW,CAAC;gBACrB,WAAW,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,WAAY,EAAE,eAAe,EAAE,CAAC,CAAC,eAAgB,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;gBAC9I,MAAM,EAAE,CAAC,CAAC,MAAO;gBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB,CAAC,CAAC;IACP,CAAC;AACH,CAAC"}