domainkit 0.1.0 → 0.1.1

package/dist/verify-BjrR_4NF.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"verify-BjrR_4NF.mjs","names":["S","DomainName.Schema","Schema","decode","InvalidInputError","validate","encode","AuthorizationError","DomainName.parse","Error","S","ConnectionStore.Service","Connection.validate","ProviderAuthorizationStore.Service","CredentialStore.Service","S","Schema","decode","InvalidInputError","validate","encode","OAuthStateStore.Service","Secret","ProviderAuthorizationStore.Service","ConnectionStore.Service","CredentialStore.Service","Connection.AuthorizationError","ProviderAuthorization.validate","Connection.validate","InvalidInputError","DnsProvider.Error","S","Schema","decode","InvalidInputError","ProviderAuthorizationStore.Service","ConnectionStore.Service","CredentialStore.Service","ProviderAuthorization.validate","CryptoFailure","Connection.validate","DomainName.parse","InvalidInputError","DomainName.Schema","DomainName.parse","Zones.candidates","Connection.AuthorizationError","Operation","S","DnsRecord.Schema","DnsRecord.Observed","Schema","DomainName.Schema","Authorization","Receipt","InvalidInputError","UnsignedPlan","S","DnsPlan.Operation","DomainName.Schema","DnsRecord.Schema","DnsPlan.Receipt","create","DnsProvider.Service","DomainName.decode","DnsRecord.decode","authorize","validate","apply","makeReceipt","data","DnsRecord.data","DnsRecord.equals","DnsRecord.Observed","authorize","Connection.assertGrant","Connection.AuthorizationError","InvalidInputError","Provisioning.authorize","S","DnsRecord.Schema","DomainName.Schema","Error","DnsProvider.Service","Provisioning.validate","DnsRecord.equals","DomainName.parse","InvalidInputError","make","DnsResolver.Error","layer","DnsResolver.Service","toAsync","DnsResolver.toAsync","DomainName.parse","DomainName.decode","DnsData.parse","DnsOverHttps.make","DnsResolver.Service","DnsResolver.toAsync","DnsRecord.Schema","DnsProvider.Service","DnsResolver.Service","DnsRecord.equals","DnsData.parse","data","DnsRecord.data"],"sources":["../package.json","../src/auth/connection.ts","../src/auth/connection-lifecycle.ts","../src/auth/authorization.ts","../src/plan/canonical-json.ts","../src/auth/oauth.ts","../src/auth/manifest.ts","../src/auth/token.ts","../src/discovery/zones.ts","../src/discovery/selection.ts","../src/plan/types.ts","../src/plan/plan.ts","../src/plan/connection-authorization.ts","../src/plan/deletion.ts","../src/verification/dns-data.ts","../src/verification/doh.ts","../src/verification/cloudflare-doh.ts","../src/verification/verify.ts"],"sourcesContent":["","import { Effect, Schema as S } from \"effect\";\n\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport type { Value as Secret } from \"./secret.ts\";\nimport type { OAuthMethod } from \"./manifest.ts\";\nimport type * as ProviderAuthorization from \"./authorization.ts\";\n\nexport const Grant = S.TaggedUnion({\n  account: {},\n  domains: { domains: S.Array(DomainName.Schema) },\n});\nexport type Grant = typeof Grant.Type;\n\n/** An owner-scoped grant bound to one provider authorization. */\nexport const Schema = S.Struct({\n  authorizationId: S.String,\n  createdAt: S.DateFromString,\n  grant: Grant,\n  id: S.String,\n  ownerId: S.String,\n});\nexport interface Connection extends S.Schema.Type<typeof Schema> {}\n\nexport const decode = Effect.fn(\"Connection.decode\")((input: unknown) =>\n  S.decodeUnknownEffect(Schema)(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport const validate = Effect.fn(\"Connection.validate\")((input: unknown) =>\n  S.decodeUnknownEffect(S.toType(Schema))(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport const encode = S.encodeSync(Schema);\n\nexport interface OAuthContinuation {\n  readonly clientId: string;\n  readonly codeVerifier: Secret;\n  readonly expiresAt: Date;\n  readonly grant: Grant;\n  readonly method: OAuthMethod;\n  readonly ownerId: string;\n  readonly redirectUri: string;\n  readonly stateHash: string;\n  readonly subjectId: string;\n}\n\nexport interface StoredCredential {\n  readonly accessToken: Secret;\n  readonly refreshToken: Secret | null;\n  readonly tokenType: string;\n}\n\nexport class AuthorizationError extends S.TaggedError<AuthorizationError>()(\"AuthorizationError\", {\n  message: S.String,\n}) {}\n\nexport function assertGrant(\n  connection: Connection,\n  authorization: ProviderAuthorization.ProviderAuthorization,\n  request: {\n    readonly capability: ProviderAuthorization.Capability;\n    readonly domain: string;\n    readonly now?: Date;\n    readonly providerId: string;\n  },\n): DomainName.DomainName {\n  if (\n    connection.authorizationId !== authorization.id ||\n    authorization.providerId !== request.providerId\n  ) {\n    throw new AuthorizationError({ message: \"Connection does not grant this provider account\" });\n  }\n  if (authorization.expiresAt !== null) {\n    if (Number.isNaN(authorization.expiresAt.getTime())) {\n      throw new AuthorizationError({ message: \"Connection expiration is invalid\" });\n    }\n    if (authorization.expiresAt <= (request.now ?? new Date())) {\n      throw new AuthorizationError({ message: \"Connection has expired\" });\n    }\n  }\n  if (!authorization.capabilities.includes(request.capability)) {\n    throw new AuthorizationError({\n      message: `Connection lacks the ${request.capability} capability`,\n    });\n  }\n  let domain: DomainName.DomainName;\n  try {\n    domain = DomainName.parse(request.domain);\n  } catch (cause) {\n    if (cause instanceof InvalidInputError) throw cause;\n    throw new InvalidInputError({\n      message: cause instanceof Error ? cause.message : String(cause),\n    });\n  }\n  if (connection.grant._tag === \"domains\" && !connection.grant.domains.includes(domain)) {\n    throw new AuthorizationError({ message: \"Connection does not grant this domain\" });\n  }\n  return domain;\n}\n","import { Effect, Schema as S } from \"effect\";\n\nimport * as ConnectionStore from \"../stores/connection.ts\";\nimport * as CredentialStore from \"../stores/credential.ts\";\nimport * as ProviderAuthorizationStore from \"../stores/authorization.ts\";\nimport type * as Storage from \"../stores/error.ts\";\nimport * as Connection from \"./connection.ts\";\nimport type * as ProviderAuthorization from \"./authorization.ts\";\n\nexport class Error extends S.TaggedError<Error>()(\"ConnectionLifecycleError\", {\n  message: S.String,\n}) {}\n\nexport interface DetachResult {\n  readonly connection: Connection.Connection;\n  readonly remainingBindings: number;\n  readonly revokedAuthorization: boolean;\n}\n\n/** Replace the grant on an owner binding after the host has obtained explicit consent. */\nexport const updateGrant = Effect.fn(\"ConnectionLifecycle.updateGrant\")(function* (input: {\n  readonly connection: Connection.Connection;\n  readonly grant: Connection.Grant;\n}) {\n  const connectionStore = yield* ConnectionStore.Service;\n  const connection = yield* Connection.validate({ ...input.connection, grant: input.grant });\n  yield* connectionStore.put(connection);\n  return connection;\n});\n\n/**\n * Detach one owner binding. The final binding invokes provider revocation before deleting local\n * credential and authorization state. The callback keeps provider-specific revocation outside the\n * portable authorization model.\n */\nexport function detach<E, R>(input: {\n  readonly connectionId: string;\n  readonly revokeAuthorization: (\n    authorization: ProviderAuthorization.ProviderAuthorization,\n  ) => Effect.Effect<void, E, R>;\n}): Effect.Effect<DetachResult, Error | Storage.Error | E, R | Requirements> {\n  return Effect.gen(function* () {\n    const authorizationStore = yield* ProviderAuthorizationStore.Service;\n    const connectionStore = yield* ConnectionStore.Service;\n    const credentialStore = yield* CredentialStore.Service;\n    const connection = yield* connectionStore.get(input.connectionId);\n    if (connection === null) {\n      return yield* new Error({ message: \"Connection binding does not exist\" });\n    }\n    const bindings = yield* connectionStore.listByAuthorizationId(connection.authorizationId);\n    const remainingBindings = bindings.filter(({ id }) => id !== connection.id);\n    if (remainingBindings.length > 0) {\n      yield* connectionStore.delete(connection.id);\n      return {\n        connection,\n        remainingBindings: remainingBindings.length,\n        revokedAuthorization: false,\n      };\n    }\n\n    const authorization = yield* authorizationStore.get(connection.authorizationId);\n    if (authorization === null) {\n      // A prior attempt may have revoked and removed the authorization before its final binding\n      // delete failed. Both local deletes are idempotent, so finish that interrupted cleanup.\n      yield* credentialStore.delete(connection.authorizationId);\n      yield* connectionStore.delete(connection.id);\n      return { connection, remainingBindings: 0, revokedAuthorization: true };\n    }\n    yield* input.revokeAuthorization(authorization);\n    yield* credentialStore.delete(authorization.id);\n    yield* authorizationStore.delete(authorization.id);\n    yield* connectionStore.delete(connection.id);\n    return { connection, remainingBindings: 0, revokedAuthorization: true };\n  });\n}\n\nexport type Requirements =\n  | ConnectionStore.Service\n  | CredentialStore.Service\n  | ProviderAuthorizationStore.Service;\n","import { Effect, Schema as S } from \"effect\";\n\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\n\nexport const Capability = S.Literals([\"dns:read\", \"dns:write\"]);\nexport type Capability = typeof Capability.Type;\n\n/** A provider credential authorization shared by one or more owner connections. */\nexport const Schema = S.Struct({\n  accountId: S.String,\n  capabilities: S.Array(Capability),\n  createdAt: S.DateFromString,\n  expiresAt: S.NullOr(S.DateFromString),\n  id: S.String,\n  kind: S.Literals([\"oauth2\", \"token\"]),\n  providerId: S.String,\n  scopes: S.Array(S.String),\n  subjectId: S.String,\n});\nexport interface ProviderAuthorization extends S.Schema.Type<typeof Schema> {}\n\nexport const decode = Effect.fn(\"ProviderAuthorization.decode\")((input: unknown) =>\n  S.decodeUnknownEffect(Schema)(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport const validate = Effect.fn(\"ProviderAuthorization.validate\")((input: unknown) =>\n  S.decodeUnknownEffect(S.toType(Schema))(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport const encode = S.encodeSync(Schema);\n","import { Crypto, Effect, Layer, PlatformError, Schema } from \"effect\";\n\nexport class CryptoError extends Schema.TaggedError<CryptoError>()(\"CryptoError\", {\n  message: Schema.String,\n}) {}\n\nexport type Json =\n  | null\n  | boolean\n  | number\n  | string\n  | ReadonlyArray<Json>\n  | { readonly [key: string]: Json };\n\n/** Deterministic JSON serialization for already schema-encoded protocol values. */\nexport function stringify(value: Json): string {\n  if (value === null || typeof value !== \"object\") {\n    const encoded = JSON.stringify(value);\n    if (encoded === undefined) throw new TypeError(\"Value is not representable as JSON\");\n    return encoded;\n  }\n  if (isJsonArray(value)) return `[${value.map(stringify).join(\",\")}]`;\n  return `{${Object.entries(value)\n    .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))\n    .map(([key, entry]) => `${JSON.stringify(key)}:${stringify(entry)}`)\n    .join(\",\")}}`;\n}\n\nfunction isJsonArray(value: Json): value is ReadonlyArray<Json> {\n  return Array.isArray(value);\n}\n\nexport const sha256Text = Effect.fn(\"Digest.sha256Text\")(function* (value: string) {\n  const cryptoService = yield* Crypto.Crypto;\n  const digest = yield* cryptoService\n    .digest(\"SHA-256\", new TextEncoder().encode(value))\n    .pipe(Effect.mapError((cause) => new CryptoError({ message: cause.message })));\n  return [...digest].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n});\n\nexport const sha256Json = Effect.fn(\"Digest.sha256Json\")((value: Json) =>\n  Effect.try({\n    try: () => stringify(value),\n    catch: (cause) =>\n      new CryptoError({ message: cause instanceof Error ? cause.message : String(cause) }),\n  }).pipe(Effect.flatMap(sha256Text)),\n);\n\nfunction sha256EncodedProgram<S extends Schema.Constraint>(\n  schema: S,\n  value: S[\"Type\"],\n): Effect.Effect<string, CryptoError, Crypto.Crypto | S[\"EncodingServices\"]> {\n  return Schema.encodeEffect(schema)(value).pipe(\n    Effect.mapError((cause) => new CryptoError({ message: cause.message })),\n    Effect.flatMap(Schema.decodeUnknownEffect(Schema.Json)),\n    Effect.mapError((cause) => new CryptoError({ message: cause.message })),\n    Effect.flatMap(sha256Json),\n  );\n}\n\nexport const sha256Encoded = Effect.fn(\"Digest.sha256Encoded\")(sha256EncodedProgram);\n\n/** Portable Web Crypto implementation for hosts that want a ready-made Layer. */\nexport const webCryptoLayer: Layer.Layer<Crypto.Crypto> = Layer.succeed(\n  Crypto.Crypto,\n  Crypto.make({\n    randomBytes: (size) => crypto.getRandomValues(new Uint8Array(size)),\n    digest: (algorithm, data) =>\n      Effect.tryPromise({\n        try: async () => {\n          const bytes = new Uint8Array(data.byteLength);\n          bytes.set(data);\n          return new Uint8Array(await crypto.subtle.digest(algorithm, bytes.buffer));\n        },\n        catch: (cause) =>\n          PlatformError.systemError({\n            _tag: \"Unknown\",\n            module: \"WebCrypto\",\n            method: \"digest\",\n            cause,\n          }),\n      }),\n  }),\n);\n","import { Clock, Crypto, Effect } from \"effect\";\nimport * as oauth from \"oauth4webapi\";\n\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport { CryptoError, sha256Text } from \"../plan/canonical-json.ts\";\nimport * as DnsProvider from \"../provider/provider.ts\";\nimport * as ConnectionStore from \"../stores/connection.ts\";\nimport * as CredentialStore from \"../stores/credential.ts\";\nimport * as ProviderAuthorizationStore from \"../stores/authorization.ts\";\nimport type * as Storage from \"../stores/error.ts\";\nimport * as OAuthStateStore from \"../stores/oauth-state.ts\";\nimport * as Connection from \"./connection.ts\";\nimport * as ProviderAuthorization from \"./authorization.ts\";\nimport type * as ProviderAuth from \"./manifest.ts\";\nimport { Value as Secret } from \"./secret.ts\";\n\nexport type Fetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;\n\nexport interface BeginInput {\n  readonly client: ProviderAuth.OAuthClientConfiguration;\n  readonly grant: Connection.Grant;\n  readonly method: ProviderAuth.OAuthMethod;\n  readonly ownerId: string;\n  readonly redirectUri: string;\n  readonly subjectId: string;\n  readonly ttlMs?: number;\n}\n\nexport interface OAuthSubjectResolver {\n  (\n    tokens: oauth.TokenEndpointResponse,\n    accessToken: Secret,\n  ): Effect.Effect<\n    { readonly accountId: string; readonly expiresAt: Date | null },\n    InvalidInputError | DnsProvider.Error\n  >;\n}\n\nexport type OAuthError =\n  | Connection.AuthorizationError\n  | CryptoError\n  | InvalidInputError\n  | DnsProvider.Error\n  | Storage.Error;\n\nfunction beginProgram(\n  input: BeginInput,\n): Effect.Effect<\n  { readonly authorizationUrl: URL },\n  CryptoError | Storage.Error,\n  OAuthStateStore.Service | Crypto.Crypto\n> {\n  return Effect.gen(function* () {\n    const stateStore = yield* OAuthStateStore.Service;\n    const cryptoService = yield* Crypto.Crypto;\n    const now = yield* Clock.currentTimeMillis;\n    const state = base64Url(yield* cryptoBytes(cryptoService, 32));\n    const codeVerifier = base64Url(yield* cryptoBytes(cryptoService, 32));\n    const challenge = base64Url(\n      yield* cryptoService\n        .digest(\"SHA-256\", new TextEncoder().encode(codeVerifier))\n        .pipe(Effect.mapError((cause) => new CryptoError({ message: cause.message }))),\n    );\n    const stateHash = yield* sha256Text(state);\n    const authorizationUrl = new URL(input.method.authorizationServer.authorization_endpoint);\n    authorizationUrl.search = new URLSearchParams({\n      client_id: input.client.clientId,\n      code_challenge: challenge,\n      code_challenge_method: \"S256\",\n      redirect_uri: input.redirectUri,\n      response_type: \"code\",\n      scope: input.method.scopes.join(\" \"),\n      state,\n    }).toString();\n\n    yield* stateStore.put({\n      clientId: input.client.clientId,\n      codeVerifier: Secret.from(codeVerifier),\n      expiresAt: new Date(now + (input.ttlMs ?? 10 * 60_000)),\n      grant: input.grant,\n      method: input.method,\n      ownerId: input.ownerId,\n      redirectUri: input.redirectUri,\n      stateHash,\n      subjectId: input.subjectId,\n    });\n    return { authorizationUrl };\n  });\n}\n\nfunction completeProgram(input: {\n  readonly callbackUrl: URL;\n  readonly client: ProviderAuth.OAuthClientConfiguration;\n  readonly fetch?: Fetch;\n  readonly providerId: string;\n  readonly resolveSubject: OAuthSubjectResolver;\n}): Effect.Effect<\n  {\n    readonly authorization: ProviderAuthorization.ProviderAuthorization;\n    readonly connection: Connection.Connection;\n  },\n  OAuthError,\n  | OAuthStateStore.Service\n  | ProviderAuthorizationStore.Service\n  | ConnectionStore.Service\n  | CredentialStore.Service\n  | Crypto.Crypto\n> {\n  return Effect.gen(function* () {\n    const stateStore = yield* OAuthStateStore.Service;\n    const authorizationStore = yield* ProviderAuthorizationStore.Service;\n    const connectionStore = yield* ConnectionStore.Service;\n    const credentialStore = yield* CredentialStore.Service;\n    const cryptoService = yield* Crypto.Crypto;\n    const state = input.callbackUrl.searchParams.get(\"state\");\n    if (state === null) {\n      return yield* new Connection.AuthorizationError({\n        message: \"OAuth callback is missing state\",\n      });\n    }\n    const now = yield* Clock.currentTimeMillis;\n    const continuation = yield* stateStore.consume(yield* sha256Text(state), new Date(now));\n    if (continuation === null) {\n      return yield* new Connection.AuthorizationError({\n        message: \"OAuth continuation is expired, unknown, or already used\",\n      });\n    }\n    if (continuation.clientId !== input.client.clientId) {\n      return yield* new Connection.AuthorizationError({\n        message: \"OAuth client does not match the continuation\",\n      });\n    }\n\n    const as = continuation.method.authorizationServer as oauth.AuthorizationServer;\n    const client: oauth.Client = { client_id: continuation.clientId };\n    const authentication = yield* effectClientAuthentication(continuation.method, input.client);\n    const tokens = yield* providerRequest(input.providerId, async (signal) => {\n      const callbackParameters = oauth.validateAuthResponse(as, client, input.callbackUrl, state);\n      const response = await oauth.authorizationCodeGrantRequest(\n        as,\n        client,\n        authentication,\n        callbackParameters,\n        continuation.redirectUri,\n        continuation.codeVerifier.expose(),\n        requestOptions(input.fetch, signal),\n      );\n      return oauth.processAuthorizationCodeResponse(as, client, response);\n    });\n    const accessToken = Secret.from(tokens.access_token);\n    const subject = yield* input.resolveSubject(tokens, accessToken);\n    const existingAuthorization = yield* authorizationStore.findByProviderAccount(\n      input.providerId,\n      subject.accountId,\n    );\n    const authorizationId =\n      existingAuthorization?.id ??\n      (yield* cryptoService.randomUUIDv4.pipe(\n        Effect.mapError((cause) => new CryptoError({ message: cause.message })),\n      ));\n    const authorization = yield* ProviderAuthorization.validate({\n      accountId: subject.accountId,\n      capabilities: [...continuation.method.capabilities],\n      createdAt: existingAuthorization?.createdAt ?? new Date(now),\n      expiresAt: subject.expiresAt,\n      id: authorizationId,\n      kind: \"oauth2\",\n      providerId: input.providerId,\n      scopes: (tokens.scope ?? continuation.method.scopes.join(\" \")).split(\" \").filter(Boolean),\n      subjectId: continuation.subjectId,\n    });\n    const existingConnection = yield* connectionStore.find(continuation.ownerId, authorization.id);\n    const connection = yield* Connection.validate({\n      authorizationId: authorization.id,\n      createdAt: existingConnection?.createdAt ?? new Date(now),\n      grant: continuation.grant,\n      id:\n        existingConnection?.id ??\n        (yield* cryptoService.randomUUIDv4.pipe(\n          Effect.mapError((cause) => new CryptoError({ message: cause.message })),\n        )),\n      ownerId: continuation.ownerId,\n    });\n    yield* credentialStore.put(authorization.id, {\n      accessToken,\n      refreshToken: tokens.refresh_token === undefined ? null : Secret.from(tokens.refresh_token),\n      tokenType: tokens.token_type,\n    });\n    yield* authorizationStore.put(authorization);\n    yield* connectionStore.put(connection);\n    return { authorization, connection };\n  });\n}\n\nfunction refreshProgram(input: {\n  readonly client: ProviderAuth.OAuthClientConfiguration;\n  readonly authorization: ProviderAuthorization.ProviderAuthorization;\n  readonly fetch?: Fetch;\n  readonly method: ProviderAuth.OAuthMethod;\n}): Effect.Effect<void, OAuthError, CredentialStore.Service> {\n  return Effect.gen(function* () {\n    const credentialStore = yield* CredentialStore.Service;\n    const credential = yield* requireCredential(input.authorization.id, credentialStore);\n    const refreshToken = credential.refreshToken;\n    if (refreshToken === null) {\n      return yield* new Connection.AuthorizationError({\n        message: \"Connection has no refresh token\",\n      });\n    }\n    const as = input.method.authorizationServer as oauth.AuthorizationServer;\n    const client: oauth.Client = { client_id: input.client.clientId };\n    const authentication = yield* effectClientAuthentication(input.method, input.client);\n    const tokens = yield* providerRequest(input.authorization.providerId, async (signal) => {\n      const response = await oauth.refreshTokenGrantRequest(\n        as,\n        client,\n        authentication,\n        refreshToken.expose(),\n        requestOptions(input.fetch, signal),\n      );\n      return oauth.processRefreshTokenResponse(as, client, response);\n    });\n    yield* credentialStore.put(input.authorization.id, {\n      accessToken: Secret.from(tokens.access_token),\n      refreshToken:\n        tokens.refresh_token === undefined\n          ? credential.refreshToken\n          : Secret.from(tokens.refresh_token),\n      tokenType: tokens.token_type,\n    });\n  });\n}\n\nfunction revokeProgram(input: {\n  readonly client: ProviderAuth.OAuthClientConfiguration;\n  readonly authorization: ProviderAuthorization.ProviderAuthorization;\n  readonly fetch?: Fetch;\n  readonly method: ProviderAuth.OAuthMethod;\n}): Effect.Effect<void, OAuthError, CredentialStore.Service> {\n  return Effect.gen(function* () {\n    if (input.method.authorizationServer.revocation_endpoint === undefined) {\n      return yield* new Connection.AuthorizationError({\n        message: \"Provider does not advertise token revocation\",\n      });\n    }\n    const credentialStore = yield* CredentialStore.Service;\n    const credential = yield* requireCredential(input.authorization.id, credentialStore);\n    const as = input.method.authorizationServer as oauth.AuthorizationServer;\n    const authentication = yield* effectClientAuthentication(input.method, input.client);\n    yield* providerRequest(input.authorization.providerId, async (signal) => {\n      const response = await oauth.revocationRequest(\n        as,\n        { client_id: input.client.clientId },\n        authentication,\n        credential.accessToken.expose(),\n        requestOptions(input.fetch, signal),\n      );\n      await oauth.processRevocationResponse(response);\n    });\n    yield* credentialStore.delete(input.authorization.id);\n  });\n}\n\nfunction effectClientAuthentication(\n  method: ProviderAuth.OAuthMethod,\n  client: ProviderAuth.OAuthClientConfiguration,\n): Effect.Effect<oauth.ClientAuth, InvalidInputError> {\n  return Effect.try({\n    try: () => clientAuthentication(method, client),\n    catch: (cause) =>\n      cause instanceof InvalidInputError\n        ? cause\n        : new InvalidInputError({ message: \"OAuth client authentication is invalid\" }),\n  });\n}\n\nfunction clientAuthentication(\n  method: ProviderAuth.OAuthMethod,\n  client: ProviderAuth.OAuthClientConfiguration,\n): oauth.ClientAuth {\n  switch (method.clientAuth) {\n    case \"none\":\n      return oauth.None();\n    case \"client_secret_basic\":\n      if (client.clientSecret === undefined) {\n        throw new InvalidInputError({ message: \"Client secret is required\" });\n      }\n      return oauth.ClientSecretBasic(client.clientSecret.expose());\n    case \"client_secret_post\":\n      if (client.clientSecret === undefined) {\n        throw new InvalidInputError({ message: \"Client secret is required\" });\n      }\n      return oauth.ClientSecretPost(client.clientSecret.expose());\n  }\n}\n\nfunction requestOptions(\n  fetchImplementation: Fetch | undefined,\n  signal: AbortSignal,\n): oauth.TokenEndpointRequestOptions {\n  return fetchImplementation === undefined\n    ? { signal }\n    : {\n        signal,\n        [oauth.customFetch]: (url, options) =>\n          fetchImplementation(url, { ...options, body: options.body }),\n      };\n}\n\nfunction requireCredential(\n  connectionId: string,\n  store: CredentialStore.Interface,\n): Effect.Effect<Connection.StoredCredential, Connection.AuthorizationError | Storage.Error> {\n  return store.get(connectionId).pipe(\n    Effect.flatMap((credential) =>\n      credential === null\n        ? Effect.fail(\n            new Connection.AuthorizationError({\n              message: \"Connection credentials are unavailable\",\n            }),\n          )\n        : Effect.succeed(credential),\n    ),\n  );\n}\n\nfunction providerRequest<A>(providerId: string, request: (signal: AbortSignal) => Promise<A>) {\n  return Effect.tryPromise({\n    try: request,\n    catch: (cause) =>\n      cause instanceof Connection.AuthorizationError || cause instanceof InvalidInputError\n        ? cause\n        : new DnsProvider.Error({\n            cause,\n            message: safeOAuthMessage(cause),\n            operation: \"oauthRequest\",\n            providerId,\n          }),\n  });\n}\n\nfunction cryptoBytes(\n  cryptoService: Crypto.Crypto,\n  size: number,\n): Effect.Effect<Uint8Array, CryptoError> {\n  return cryptoService\n    .randomBytes(size)\n    .pipe(Effect.mapError((cause) => new CryptoError({ message: cause.message })));\n}\n\nfunction base64Url(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replaceAll(\"=\", \"\");\n}\n\nfunction safeOAuthMessage(cause: unknown): string {\n  return cause instanceof Error ? cause.name : \"OAuth provider request failed\";\n}\n\nexport const begin = Effect.fn(\"OAuth.begin\")(beginProgram);\nexport const complete = Effect.fn(\"OAuth.complete\")(completeProgram);\nexport const refresh = Effect.fn(\"OAuth.refresh\")(refreshProgram);\nexport const revoke = Effect.fn(\"OAuth.revoke\")(revokeProgram);\n","import { Effect, Schema as S } from \"effect\";\nimport type * as oauth from \"oauth4webapi\";\n\nimport type * as DnsProvider from \"../provider/provider.ts\";\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport type { Value as Secret } from \"./secret.ts\";\n\nexport const Method = S.TaggedUnion({\n  integration: {\n    capabilities: S.Array(S.Literals([\"dns:read\", \"dns:write\"])),\n    installUrl: S.String,\n    tokenEndpoint: S.String,\n  },\n  oauth2: {\n    authorizationServer: S.Struct({\n      authorization_endpoint: S.String,\n      issuer: S.String,\n      revocation_endpoint: S.optionalKey(S.String),\n      token_endpoint: S.String,\n    }),\n    capabilities: S.Array(S.Literals([\"dns:read\", \"dns:write\"])),\n    clientAuth: S.Literals([\"none\", \"client_secret_basic\", \"client_secret_post\"]),\n    scopes: S.Array(S.String),\n  },\n  token: {\n    capabilities: S.Array(S.Literals([\"dns:read\", \"dns:write\"])),\n    instructionsUrl: S.String,\n  },\n});\n\nexport const Schema = S.Struct({\n  methods: S.Array(Method),\n  providerId: S.String,\n});\nexport interface Manifest extends S.Schema.Type<typeof Schema> {}\nexport type OAuthMethod = Extract<Manifest[\"methods\"][number], { readonly _tag: \"oauth2\" }>;\n/** A provider-owned installation flow that returns a credential from a one-time code. */\nexport type IntegrationMethod = Extract<\n  Manifest[\"methods\"][number],\n  { readonly _tag: \"integration\" }\n>;\n\nexport const decode = Effect.fn(\"ProviderAuth.decode\")((input: unknown) =>\n  S.decodeUnknownEffect(Schema)(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport interface OAuthClientConfiguration {\n  readonly clientId: string;\n  readonly clientSecret?: Secret;\n}\n\nexport interface TokenValidation {\n  readonly accountId: string;\n  readonly capabilities: ReadonlyArray<\"dns:read\" | \"dns:write\">;\n  readonly expiresAt: Date | null;\n  readonly scopes: ReadonlyArray<string>;\n}\n\nexport interface OAuthSubjectResolver {\n  (\n    tokens: oauth.TokenEndpointResponse,\n    accessToken: Secret,\n  ): Effect.Effect<\n    { readonly accountId: string; readonly expiresAt: Date | null },\n    DnsProvider.Error\n  >;\n}\n\nexport interface AsyncOAuthSubjectResolver {\n  (\n    tokens: oauth.TokenEndpointResponse,\n    accessToken: Secret,\n  ): Promise<{ readonly accountId: string; readonly expiresAt: Date | null }>;\n}\n","import { Clock, Crypto, Effect } from \"effect\";\n\nimport { CryptoError, CryptoError as CryptoFailure } from \"../plan/canonical-json.ts\";\nimport type { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport type * as DnsProvider from \"../provider/provider.ts\";\nimport * as ConnectionStore from \"../stores/connection.ts\";\nimport * as CredentialStore from \"../stores/credential.ts\";\nimport * as ProviderAuthorizationStore from \"../stores/authorization.ts\";\nimport type * as Storage from \"../stores/error.ts\";\nimport * as Connection from \"./connection.ts\";\nimport * as ProviderAuthorization from \"./authorization.ts\";\nimport type * as ProviderAuth from \"./manifest.ts\";\nimport { Value as Secret } from \"./secret.ts\";\n\nexport interface Input {\n  readonly grant: Connection.Grant;\n  readonly ownerId: string;\n  readonly providerId: string;\n  readonly subjectId: string;\n  readonly token: Secret;\n  readonly validate: (\n    token: Secret,\n  ) => Effect.Effect<ProviderAuth.TokenValidation, DnsProvider.Error | InvalidInputError>;\n}\n\nexport const connect = Effect.fn(\"TokenConnection.connect\")(function* (input: Input) {\n  const authorizationStore = yield* ProviderAuthorizationStore.Service;\n  const connectionStore = yield* ConnectionStore.Service;\n  const credentialStore = yield* CredentialStore.Service;\n  const cryptoService = yield* Crypto.Crypto;\n  const validation = yield* input.validate(input.token);\n  const createdAt = new Date(yield* Clock.currentTimeMillis);\n  const existingAuthorization = yield* authorizationStore.findByProviderAccount(\n    input.providerId,\n    validation.accountId,\n  );\n  const authorization = yield* ProviderAuthorization.validate({\n    accountId: validation.accountId,\n    capabilities: [...validation.capabilities],\n    createdAt: existingAuthorization?.createdAt ?? createdAt,\n    expiresAt: validation.expiresAt,\n    id:\n      existingAuthorization?.id ??\n      (yield* cryptoService.randomUUIDv4.pipe(\n        Effect.mapError((cause) => new CryptoFailure({ message: cause.message })),\n      )),\n    kind: \"token\",\n    providerId: input.providerId,\n    scopes: [...validation.scopes],\n    subjectId: input.subjectId,\n  });\n  const existingConnection = yield* connectionStore.find(input.ownerId, authorization.id);\n  const connection = yield* Connection.validate({\n    authorizationId: authorization.id,\n    createdAt: existingConnection?.createdAt ?? createdAt,\n    grant: input.grant,\n    id:\n      existingConnection?.id ??\n      (yield* cryptoService.randomUUIDv4.pipe(\n        Effect.mapError((cause) => new CryptoFailure({ message: cause.message })),\n      )),\n    ownerId: input.ownerId,\n  });\n  yield* credentialStore.put(authorization.id, {\n    accessToken: input.token,\n    refreshToken: null,\n    tokenType: \"bearer\",\n  });\n  yield* authorizationStore.put(authorization);\n  yield* connectionStore.put(connection);\n  return { authorization, connection };\n});\n\nexport type Error = DnsProvider.Error | InvalidInputError | CryptoError | Storage.Error;\n\nexport type Requirements =\n  | ProviderAuthorizationStore.Service\n  | ConnectionStore.Service\n  | CredentialStore.Service\n  | Crypto.Crypto;\n","import { getDomain } from \"tldts\";\n\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\n\nexport function candidates(input: string): ReadonlyArray<DomainName.DomainName> {\n  const domain = DomainName.parse(input);\n  const registrable = getDomain(domain, { allowPrivateDomains: true });\n  if (registrable === null) {\n    throw new InvalidInputError({ message: \"Domain does not have a registrable DNS zone\" });\n  }\n  const labels = domain.split(\".\");\n  const registrableLabels = registrable.split(\".\").length;\n  const values: Array<DomainName.DomainName> = [];\n  for (let index = 0; index <= labels.length - registrableLabels; index += 1) {\n    values.push(DomainName.parse(labels.slice(index).join(\".\")));\n  }\n  return values;\n}\n","import { Schema } from \"effect\";\n\nimport * as ProviderAuthorization from \"../auth/authorization.ts\";\nimport * as Connection from \"../auth/connection.ts\";\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport * as Zones from \"./zones.ts\";\n\nexport interface ConnectedZone {\n  readonly authorization: ProviderAuthorization.ProviderAuthorization;\n  readonly connection: Connection.Connection;\n  readonly nameservers: ReadonlyArray<string>;\n  readonly providerId: string;\n  readonly zone: string;\n}\n\nexport const Evidence = Schema.Struct({\n  accountId: Schema.String,\n  connectionId: Schema.String,\n  decisiveNameserverMatch: Schema.Boolean,\n  matchedNameservers: Schema.Array(DomainName.Schema),\n  providerId: Schema.String,\n  zone: DomainName.Schema,\n});\nexport interface Evidence extends Schema.Schema.Type<typeof Evidence> {}\n\nexport const Selection = Schema.TaggedUnion({\n  selected: {\n    candidate: Evidence,\n    evidence: Schema.Array(Evidence),\n    reason: Schema.Literals([\"explicit\", \"unique-nameserver-match\"]),\n  },\n  manual: {\n    evidence: Schema.Array(Evidence),\n    reason: Schema.Literals([\"ambiguous\", \"unsupported\"]),\n  },\n});\nexport type Selection = typeof Selection.Type;\n\nexport function select(input: {\n  readonly authoritativeNameservers: ReadonlyArray<string>;\n  readonly connectedZones: ReadonlyArray<ConnectedZone>;\n  readonly domain: string;\n  readonly explicit?: {\n    readonly accountId: string;\n    readonly providerId: string;\n    readonly zone: string;\n  };\n  readonly now?: Date;\n}): Selection {\n  const domain = DomainName.parse(input.domain);\n  const zoneCandidates = new Set(Zones.candidates(domain));\n  const authoritative = nameserverSet(input.authoritativeNameservers);\n  const eligible = input.connectedZones.filter((connected) => {\n    if (!zoneCandidates.has(DomainName.parse(connected.zone))) return false;\n    try {\n      Connection.assertGrant(connected.connection, connected.authorization, {\n        capability: \"dns:read\",\n        domain,\n        ...(input.now === undefined ? {} : { now: input.now }),\n        providerId: connected.providerId,\n      });\n      return true;\n    } catch {\n      return false;\n    }\n  });\n  const evidence = eligible.map((connected) => evidenceFor(connected, authoritative));\n\n  if (input.explicit !== undefined) {\n    const explicitZone = DomainName.parse(input.explicit.zone);\n    const index = eligible.findIndex(\n      (connected) =>\n        connected.providerId === input.explicit?.providerId &&\n        connected.authorization.accountId === input.explicit.accountId &&\n        DomainName.parse(connected.zone) === explicitZone,\n    );\n    if (index < 0) {\n      throw new Connection.AuthorizationError({\n        message: \"Explicit provider zone is not connected or granted\",\n      });\n    }\n    const candidate = evidence[index];\n    if (candidate === undefined) throw new Error(\"Eligible provider evidence is missing\");\n    return { _tag: \"selected\", candidate, evidence, reason: \"explicit\" };\n  }\n\n  const decisive = evidence.filter(({ decisiveNameserverMatch }) => decisiveNameserverMatch);\n  const candidate = decisive[0];\n  return decisive.length === 1 && candidate !== undefined\n    ? { _tag: \"selected\", candidate, evidence, reason: \"unique-nameserver-match\" }\n    : {\n        _tag: \"manual\",\n        evidence,\n        reason: decisive.length > 1 ? \"ambiguous\" : \"unsupported\",\n      };\n}\n\nfunction evidenceFor(\n  connected: ConnectedZone,\n  authoritative: ReadonlyArray<DomainName.DomainName>,\n): Evidence {\n  const configured = new Set(nameserverSet(connected.nameservers));\n  const matchedNameservers = authoritative.filter((nameserver) => configured.has(nameserver));\n  return {\n    accountId: connected.authorization.accountId,\n    connectionId: connected.connection.id,\n    decisiveNameserverMatch:\n      authoritative.length > 0 && matchedNameservers.length === authoritative.length,\n    matchedNameservers,\n    providerId: connected.providerId,\n    zone: DomainName.parse(connected.zone),\n  };\n}\n\nfunction nameserverSet(nameservers: ReadonlyArray<string>): ReadonlyArray<DomainName.DomainName> {\n  return [...new Set(nameservers.map(DomainName.parse))].sort();\n}\n","import { Effect, Schema as S } from \"effect\";\n\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport * as DnsRecord from \"../domain/dns-record.ts\";\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\n\nexport const Operation = S.TaggedUnion({\n  create: {\n    id: S.String,\n    requirement: DnsRecord.Schema,\n  },\n  noop: {\n    id: S.String,\n    requirement: DnsRecord.Schema,\n    ttlDrift: S.Boolean,\n  },\n  conflict: {\n    existing: S.Array(DnsRecord.Observed),\n    id: S.String,\n    reason: S.String,\n    requirement: DnsRecord.Schema,\n  },\n});\nexport type Operation = typeof Operation.Type;\n\nexport const Schema = S.Struct({\n  digest: S.String,\n  operations: S.Array(Operation),\n  providerId: S.String,\n  version: S.Literal(\"domainkit.dns-plan.v1\"),\n  zone: DomainName.Schema,\n});\nexport interface DnsPlan extends S.Schema.Type<typeof Schema> {}\n\nexport const Authorization = S.Struct({\n  allowPartial: S.Boolean,\n  operationIds: S.Array(S.String),\n  planDigest: S.String,\n  version: S.Literal(\"domainkit.plan-authorization.v1\"),\n});\nexport interface PlanAuthorization extends S.Schema.Type<typeof Authorization> {}\n\nexport const Receipt = S.Struct({\n  appliedAt: S.DateFromString,\n  operations: S.Array(\n    S.Struct({\n      operationId: S.String,\n      providerRecordId: S.NullOr(S.String),\n    }),\n  ),\n  planDigest: S.String,\n  providerId: S.String,\n  status: S.Literals([\"complete\", \"partial\"]),\n  version: S.Literal(\"domainkit.apply-receipt.v1\"),\n  zone: DomainName.Schema,\n});\nexport interface ApplyReceipt extends S.Schema.Type<typeof Receipt> {}\n\nexport const decode = Effect.fn(\"DnsPlan.decode\")((input: unknown) =>\n  S.decodeUnknownEffect(Schema)(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport const encode = S.encodeSync(Schema);\nexport const decodeReceipt = Effect.fn(\"DnsPlan.decodeReceipt\")((input: unknown) =>\n  S.decodeUnknownEffect(Receipt)(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\nexport const encodeReceipt = S.encodeSync(Receipt);\n","import { Cause, Clock, Crypto, Effect, Schema as S } from \"effect\";\n\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport * as DnsRecord from \"../domain/dns-record.ts\";\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport * as DnsProvider from \"../provider/provider.ts\";\nimport { CryptoError, sha256Encoded, stringify } from \"./canonical-json.ts\";\nimport * as DnsPlan from \"./types.ts\";\n\nconst UnsignedPlan = S.Struct({\n  operations: S.Array(DnsPlan.Operation),\n  providerId: S.String,\n  version: S.Literal(\"domainkit.dns-plan.v1\"),\n  zone: DomainName.Schema,\n});\n\nconst RequirementDigest = S.Struct({ requirement: DnsRecord.Schema });\n\nexport class ConflictError extends S.TaggedError<ConflictError>()(\"PlanConflictError\", {\n  operationIds: S.Array(S.String),\n}) {}\n\nexport class AuthorizationError extends S.TaggedError<AuthorizationError>()(\"AuthorizationError\", {\n  message: S.String,\n}) {}\n\nexport class StaleError extends S.TaggedError<StaleError>()(\"StalePlanError\", {\n  approvedPlanDigest: S.String,\n  currentPlanDigest: S.String,\n}) {}\n\nexport class PartialApplyError extends S.TaggedError<PartialApplyError>()(\"PartialApplyError\", {\n  causeTag: S.Literals([\n    \"CryptoError\",\n    \"InvalidInputError\",\n    \"Interrupted\",\n    \"ProviderError\",\n    \"StalePlanError\",\n  ]),\n  failedOperationId: S.String,\n  message: S.String,\n  receipt: DnsPlan.Receipt,\n}) {}\n\nexport interface CreateInput {\n  readonly requirements: ReadonlyArray<DnsRecord.Encoded | DnsRecord.DnsRecord>;\n  readonly zone: string;\n}\n\nexport interface ApplyInput {\n  readonly authorization: DnsPlan.PlanAuthorization;\n  readonly plan: DnsPlan.DnsPlan;\n}\n\nexport type CreateError = InvalidInputError | DnsProvider.Error | CryptoError;\nexport type AuthorizeError = AuthorizationError | CryptoError;\nexport type ApplyError =\n  | InvalidInputError\n  | DnsProvider.Error\n  | CryptoError\n  | AuthorizationError\n  | ConflictError\n  | StaleError\n  | PartialApplyError;\n\n/** Builds a deterministic DNS plan through the provider in the Effect environment. */\nexport const create = Effect.fn(\"Provisioning.create\")(function* (input: CreateInput) {\n  const provider = yield* DnsProvider.Service;\n  const zone = yield* DomainName.decode(input.zone);\n  const requirements = (yield* Effect.forEach(input.requirements, DnsRecord.decode, {\n    concurrency: \"unbounded\",\n  })).sort(compareRecords);\n  const existing = [...(yield* provider.listRecords(zone))].sort(compareRecords);\n  const { operations } = yield* Effect.reduce(\n    requirements,\n    (): PlanningState => ({ operations: [], projected: existing }),\n    (state, requirement) =>\n      reconcileRequirement(requirement, state.projected).pipe(\n        Effect.map((operation) => ({\n          operations: [...state.operations, operation],\n          projected:\n            operation._tag === \"create\"\n              ? [...state.projected, operation.requirement].sort(compareRecords)\n              : state.projected,\n        })),\n      ),\n  );\n  const unsigned: S.Schema.Type<typeof UnsignedPlan> = {\n    operations,\n    providerId: provider.id,\n    version: \"domainkit.dns-plan.v1\",\n    zone,\n  };\n  return { ...unsigned, digest: yield* sha256Encoded(UnsignedPlan, unsigned) };\n});\n\ninterface PlanningState {\n  readonly operations: ReadonlyArray<DnsPlan.Operation>;\n  readonly projected: ReadonlyArray<DnsRecord.Observed>;\n}\n\n/** Authorizes all or a selected subset of create operations in a digest-bound plan. */\nexport const authorize = Effect.fn(\"Provisioning.authorize\")(function* (\n  plan: DnsPlan.DnsPlan,\n  operationIds?: ReadonlyArray<string>,\n  options: { readonly allowPartial?: boolean } = {},\n) {\n  yield* validate(plan);\n  const createIds = plan.operations\n    .filter((operation) => operation._tag === \"create\")\n    .map(({ id }) => id);\n  const selected = [...new Set(operationIds ?? createIds)].sort();\n  const unknown = selected.filter((id) => !createIds.includes(id));\n  if (unknown.length > 0) {\n    return yield* new AuthorizationError({\n      message: `Unknown operation IDs: ${unknown.join(\", \")}`,\n    });\n  }\n  if (!options.allowPartial && selected.length !== createIds.length) {\n    return yield* new AuthorizationError({\n      message: \"Partial authorization requires allowPartial\",\n    });\n  }\n  return {\n    allowPartial: options.allowPartial ?? false,\n    operationIds: selected,\n    planDigest: plan.digest,\n    version: \"domainkit.plan-authorization.v1\" as const,\n  };\n});\n\n/** Applies approved creates sequentially after full and per-operation revalidation. */\nexport const apply = Effect.fn(\"Provisioning.apply\")(function* (input: ApplyInput) {\n  const { authorization, plan } = input;\n  const provider = yield* DnsProvider.Service;\n  yield* validate(plan);\n  if (authorization.planDigest !== plan.digest) {\n    return yield* new AuthorizationError({\n      message: \"Authorization belongs to a different plan\",\n    });\n  }\n  if (provider.id !== plan.providerId) {\n    return yield* new AuthorizationError({\n      message: \"Provider does not match the approved plan\",\n    });\n  }\n  const conflicts = plan.operations.filter((operation) => operation._tag === \"conflict\");\n  if (conflicts.length > 0) {\n    return yield* new ConflictError({\n      operationIds: conflicts.map(({ id }) => id),\n    });\n  }\n\n  const creates = plan.operations.filter(DnsPlan.Operation.guards.create);\n  const approved = new Set(authorization.operationIds);\n  const unknown = authorization.operationIds.filter(\n    (id) => !creates.some((operation) => operation.id === id),\n  );\n  if (unknown.length > 0) {\n    return yield* new AuthorizationError({\n      message: `Authorization contains unknown operations: ${unknown.join(\", \")}`,\n    });\n  }\n  if (!authorization.allowPartial && creates.some(({ id }) => !approved.has(id))) {\n    return yield* new AuthorizationError({\n      message: \"Authorization does not cover every create operation\",\n    });\n  }\n\n  const currentPlan = yield* create({\n    requirements: plan.operations.map(({ requirement }) => requirement),\n    zone: plan.zone,\n  });\n  if (currentPlan.digest !== plan.digest) {\n    return yield* new StaleError({\n      approvedPlanDigest: plan.digest,\n      currentPlanDigest: currentPlan.digest,\n    });\n  }\n\n  const operations: Array<{\n    operationId: string;\n    providerRecordId: string | null;\n  }> = [];\n  for (const operation of creates) {\n    if (!approved.has(operation.id)) continue;\n    yield* Effect.gen(function* () {\n      yield* assertStillCreatable(plan, operation);\n      const result = yield* provider.createRecord(plan.zone, operation.requirement);\n      operations.push({\n        operationId: operation.id,\n        providerRecordId: result.providerRecordId,\n      });\n    }).pipe(\n      Effect.catch((failure): Effect.Effect<never, CreateError | StaleError | PartialApplyError> =>\n        operations.length === 0\n          ? Effect.fail(failure)\n          : makeReceipt(input, operations, \"partial\").pipe(\n              Effect.flatMap((receipt) =>\n                Effect.fail(\n                  new PartialApplyError({\n                    causeTag: failure._tag,\n                    failedOperationId: operation.id,\n                    message: failureMessage(failure),\n                    receipt,\n                  }),\n                ),\n              ),\n            ),\n      ),\n      Effect.catchCause((cause) => {\n        if (!Cause.hasInterruptsOnly(cause) || operations.length === 0) {\n          return Effect.failCause(cause);\n        }\n        return makeReceipt(input, operations, \"partial\").pipe(\n          Effect.flatMap((receipt) =>\n            Effect.fail(\n              new PartialApplyError({\n                causeTag: \"Interrupted\",\n                failedOperationId: operation.id,\n                message: \"DNS apply was interrupted after confirmed writes\",\n                receipt,\n              }),\n            ),\n          ),\n        );\n      }),\n    );\n  }\n  return yield* makeReceipt(input, operations, \"complete\");\n});\n\nexport function renderManualInstructions(plan: DnsPlan.DnsPlan): ReadonlyArray<string> {\n  return plan.operations.map((operation) => {\n    const record = operation.requirement;\n    const data = Object.entries(DnsRecord.data(record))\n      .map(([key, value]) => `${key}=${value}`)\n      .join(\" \");\n    return `${operation._tag.toUpperCase()} ${record._tag} ${record.name} ${data}`.trim();\n  });\n}\n\nfunction makeReceipt(\n  input: ApplyInput,\n  operations: ReadonlyArray<{\n    readonly operationId: string;\n    readonly providerRecordId: string | null;\n  }>,\n  status: \"complete\" | \"partial\",\n): Effect.Effect<DnsPlan.ApplyReceipt> {\n  return Clock.currentTimeMillis.pipe(\n    Effect.map((now) => ({\n      appliedAt: new Date(now),\n      operations,\n      planDigest: input.plan.digest,\n      providerId: input.plan.providerId,\n      status,\n      version: \"domainkit.apply-receipt.v1\" as const,\n      zone: input.plan.zone,\n    })),\n  );\n}\n\nfunction assertStillCreatable(\n  plan: DnsPlan.DnsPlan,\n  operation: Extract<DnsPlan.Operation, { readonly _tag: \"create\" }>,\n): Effect.Effect<void, CreateError | StaleError, DnsProvider.Service | Crypto.Crypto> {\n  return create({\n    requirements: [operation.requirement],\n    zone: plan.zone,\n  }).pipe(\n    Effect.flatMap((currentPlan) => {\n      const currentOperation = currentPlan.operations[0];\n      return currentOperation?._tag === \"create\" && currentOperation.id === operation.id\n        ? Effect.void\n        : Effect.fail(\n            new StaleError({\n              approvedPlanDigest: plan.digest,\n              currentPlanDigest: currentPlan.digest,\n            }),\n          );\n    }),\n  );\n}\n\nfunction reconcileRequirement(\n  requirement: DnsRecord.DnsRecord,\n  allExisting: ReadonlyArray<DnsRecord.Observed>,\n): Effect.Effect<DnsPlan.Operation, CryptoError, Crypto.Crypto> {\n  return Effect.gen(function* () {\n    const sameName = allExisting.filter((record) => record.name === requirement.name);\n    const sameSet = sameName.filter(\n      (record): record is DnsRecord.DnsRecord =>\n        record._tag !== \"Opaque\" && record._tag === requirement._tag,\n    );\n    const exact = sameSet.find((record) => DnsRecord.equals(record, requirement));\n    const id = yield* sha256Encoded(RequirementDigest, { requirement });\n    if (exact !== undefined) {\n      return {\n        _tag: \"noop\",\n        id,\n        requirement,\n        ttlDrift: exact.ttl !== requirement.ttl,\n      };\n    }\n    const cnameConflict =\n      sameName.length > 0 &&\n      (requirement._tag === \"CNAME\" || sameName.some((record) => record._tag === \"CNAME\"));\n    if (cnameConflict) {\n      return {\n        _tag: \"conflict\",\n        existing: sameName,\n        id,\n        reason: \"CNAME records cannot coexist with other records at the same name\",\n        requirement,\n      };\n    }\n    if (\n      sameSet.length > 0 &&\n      (requirement.policy === \"exclusive\" || sameSet.some(({ policy }) => policy === \"exclusive\"))\n    ) {\n      return {\n        _tag: \"conflict\",\n        existing: sameSet,\n        id,\n        reason: \"The exclusive record set already contains incompatible data\",\n        requirement,\n      };\n    }\n    return { _tag: \"create\", id, requirement };\n  });\n}\n\nexport function validate(\n  plan: DnsPlan.DnsPlan,\n): Effect.Effect<void, AuthorizeError, Crypto.Crypto> {\n  const unsigned: S.Schema.Type<typeof UnsignedPlan> = {\n    operations: plan.operations,\n    providerId: plan.providerId,\n    version: plan.version,\n    zone: plan.zone,\n  };\n  return sha256Encoded(UnsignedPlan, unsigned).pipe(\n    Effect.flatMap((digest) =>\n      digest === plan.digest\n        ? Effect.void\n        : Effect.fail(\n            new AuthorizationError({\n              message: \"Plan digest does not match its contents\",\n            }),\n          ),\n    ),\n  );\n}\n\nfunction failureMessage(failure: CreateError | StaleError): string {\n  return failure._tag === \"StalePlanError\"\n    ? \"DNS state changed while applying the approved plan\"\n    : failure.message;\n}\n\nfunction compareRecords(left: DnsRecord.Observed, right: DnsRecord.Observed): number {\n  const encode = S.encodeSync(DnsRecord.Observed);\n  const toJson = S.decodeUnknownSync(S.Json);\n  const leftJson = stringify(toJson(encode(left)));\n  const rightJson = stringify(toJson(encode(right)));\n  return leftJson < rightJson ? -1 : leftJson > rightJson ? 1 : 0;\n}\n","import { Crypto, Effect } from \"effect\";\n\nimport * as Connection from \"../auth/connection.ts\";\nimport * as ProviderAuthorization from \"../auth/authorization.ts\";\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport { CryptoError } from \"./canonical-json.ts\";\nimport * as Provisioning from \"./plan.ts\";\nimport type * as DnsPlan from \"./types.ts\";\n\nexport const authorize = Effect.fn(\"ConnectionAuthorization.authorize\")(function* (input: {\n  readonly allowPartial?: boolean;\n  readonly authorization: ProviderAuthorization.ProviderAuthorization;\n  readonly connection: Connection.Connection;\n  readonly domain: string;\n  readonly operationIds?: ReadonlyArray<string>;\n  readonly plan: DnsPlan.DnsPlan;\n}) {\n  const domain = yield* Effect.try({\n    try: () =>\n      Connection.assertGrant(input.connection, input.authorization, {\n        capability: \"dns:write\",\n        domain: input.domain,\n        providerId: input.plan.providerId,\n      }),\n    catch: (cause) =>\n      cause instanceof Connection.AuthorizationError || cause instanceof InvalidInputError\n        ? cause\n        : new Connection.AuthorizationError({ message: \"Connection grant is invalid\" }),\n  });\n  const authorization = yield* Provisioning.authorize(\n    input.plan,\n    input.operationIds,\n    input.allowPartial === undefined ? {} : { allowPartial: input.allowPartial },\n  );\n  const selected = new Set(authorization.operationIds);\n  const outsideGrant = input.plan.operations.filter(\n    (operation) =>\n      operation._tag === \"create\" &&\n      selected.has(operation.id) &&\n      operation.requirement.name !== domain &&\n      !operation.requirement.name.endsWith(`.${domain}`),\n  );\n  if (outsideGrant.length > 0) {\n    return yield* new Connection.AuthorizationError({\n      message: `Plan operations are outside the granted domain ${domain}`,\n    });\n  }\n  return authorization;\n});\n\nexport type Error = Connection.AuthorizationError | InvalidInputError | CryptoError;\nexport type Requirements = Crypto.Crypto;\n","import { Clock, Crypto, Effect, Schema as S } from \"effect\";\n\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport * as DnsRecord from \"../domain/dns-record.ts\";\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport * as DnsProvider from \"../provider/provider.ts\";\nimport { CryptoError, sha256Encoded } from \"./canonical-json.ts\";\nimport * as Provisioning from \"./plan.ts\";\nimport * as DnsPlan from \"./types.ts\";\n\nexport const Operation = S.Struct({\n  id: S.String,\n  providerRecordId: S.String,\n  record: DnsRecord.Schema,\n});\nexport interface Operation extends S.Schema.Type<typeof Operation> {}\n\nconst UnsignedPlan = S.Struct({\n  createdAt: S.DateFromString,\n  expiresAt: S.DateFromString,\n  operations: S.Array(Operation),\n  providerId: S.String,\n  sourcePlanDigest: S.String,\n  version: S.Literal(\"domainkit.deletion-plan.v1\"),\n  zone: DomainName.Schema,\n});\n\nexport const Plan = S.Struct({ ...UnsignedPlan.fields, digest: S.String });\nexport interface Plan extends S.Schema.Type<typeof Plan> {}\n\nexport const Authorization = S.Struct({\n  operationIds: S.Array(S.String),\n  planDigest: S.String,\n  version: S.Literal(\"domainkit.deletion-authorization.v1\"),\n});\nexport interface Authorization extends S.Schema.Type<typeof Authorization> {}\n\nexport const Receipt = S.Struct({\n  deletedAt: S.DateFromString,\n  operations: S.Array(S.Struct({ operationId: S.String, providerRecordId: S.String })),\n  planDigest: S.String,\n  providerId: S.String,\n  status: S.Literals([\"complete\", \"partial\"]),\n  version: S.Literal(\"domainkit.deletion-receipt.v1\"),\n  zone: DomainName.Schema,\n});\nexport interface Receipt extends S.Schema.Type<typeof Receipt> {}\n\nexport class Error extends S.TaggedError<Error>()(\"UnsafeDeletionError\", {\n  message: S.String,\n  operationId: S.optionalKey(S.String),\n}) {}\n\nexport class PartialError extends S.TaggedError<PartialError>()(\"PartialDeletionError\", {\n  failedOperationId: S.String,\n  message: S.String,\n  receipt: Receipt,\n}) {}\n\nexport interface CreateInput {\n  readonly plan: DnsPlan.DnsPlan;\n  readonly receipt: DnsPlan.ApplyReceipt;\n  readonly ttlMs?: number;\n}\n\n/** Build a fresh deletion plan only from records proven by a prior create receipt. */\nexport const create = Effect.fn(\"Deletion.create\")(function* (input: CreateInput) {\n  const provider = yield* DnsProvider.Service;\n  yield* Provisioning.validate(input.plan);\n  if (\n    input.receipt.planDigest !== input.plan.digest ||\n    input.receipt.providerId !== input.plan.providerId ||\n    input.receipt.zone !== input.plan.zone\n  ) {\n    return yield* new Error({ message: \"Create receipt does not belong to the source plan\" });\n  }\n  if (provider.id !== input.plan.providerId) {\n    return yield* new Error({ message: \"Provider does not match the source receipt\" });\n  }\n  const operations = yield* Effect.forEach(input.receipt.operations, (applied) =>\n    Effect.gen(function* () {\n      const source = input.plan.operations.find(\n        (operation) => operation._tag === \"create\" && operation.id === applied.operationId,\n      );\n      if (source === undefined || source._tag !== \"create\") {\n        return yield* new Error({\n          message: \"Receipt operation is not a created source record\",\n          operationId: applied.operationId,\n        });\n      }\n      if (applied.providerRecordId === null) {\n        return yield* new Error({\n          message: \"Provider record ID is required for safe deletion\",\n          operationId: applied.operationId,\n        });\n      }\n      yield* assertExact(\n        provider,\n        input.plan.zone,\n        applied.providerRecordId,\n        source.requirement,\n        source.id,\n      );\n      return {\n        id: source.id,\n        providerRecordId: applied.providerRecordId,\n        record: source.requirement,\n      };\n    }),\n  );\n  const now = yield* Clock.currentTimeMillis;\n  const unsigned: S.Schema.Type<typeof UnsignedPlan> = {\n    createdAt: new Date(now),\n    expiresAt: new Date(now + (input.ttlMs ?? 15 * 60_000)),\n    operations,\n    providerId: input.plan.providerId,\n    sourcePlanDigest: input.plan.digest,\n    version: \"domainkit.deletion-plan.v1\",\n    zone: input.plan.zone,\n  };\n  return { ...unsigned, digest: yield* sha256Encoded(UnsignedPlan, unsigned) };\n});\n\n/** Produce a separate digest-bound consent artifact for destructive operations. */\nexport const authorize = Effect.fn(\"Deletion.authorize\")(function* (\n  plan: Plan,\n  operationIds?: ReadonlyArray<string>,\n) {\n  yield* validate(plan);\n  const selected = [...new Set(operationIds ?? plan.operations.map(({ id }) => id))].sort();\n  const unknown = selected.filter(\n    (id) => !plan.operations.some((operation) => operation.id === id),\n  );\n  if (unknown.length > 0) {\n    return yield* new Error({ message: `Unknown deletion operation IDs: ${unknown.join(\", \")}` });\n  }\n  return {\n    operationIds: selected,\n    planDigest: plan.digest,\n    version: \"domainkit.deletion-authorization.v1\" as const,\n  };\n});\n\n/** Re-read every approved record before the first delete, then delete by provider record ID. */\nexport const apply = Effect.fn(\"Deletion.apply\")(function* (input: {\n  readonly authorization: Authorization;\n  readonly plan: Plan;\n  readonly priorReceipt?: Receipt;\n}) {\n  const provider = yield* DnsProvider.Service;\n  yield* validate(input.plan);\n  if (input.authorization.planDigest !== input.plan.digest) {\n    return yield* new Error({ message: \"Deletion authorization belongs to a different plan\" });\n  }\n  if (provider.id !== input.plan.providerId) {\n    return yield* new Error({ message: \"Provider does not match the deletion plan\" });\n  }\n  const now = yield* Clock.currentTimeMillis;\n  if (input.plan.expiresAt <= new Date(now)) {\n    return yield* new Error({ message: \"Deletion plan has expired\" });\n  }\n  const selected = input.plan.operations.filter(({ id }) =>\n    input.authorization.operationIds.includes(id),\n  );\n  if (selected.length !== input.authorization.operationIds.length) {\n    return yield* new Error({ message: \"Deletion authorization contains unknown operations\" });\n  }\n  const previouslyDeleted = yield* validatePriorReceipt(input.plan, input.priorReceipt);\n  const completedIds = new Set(previouslyDeleted.map(({ operationId }) => operationId));\n  if (\n    previouslyDeleted.some(\n      ({ operationId }) => !input.authorization.operationIds.includes(operationId),\n    )\n  ) {\n    return yield* new Error({ message: \"Prior receipt contains an unauthorized operation\" });\n  }\n  const remaining = selected.filter(({ id }) => !completedIds.has(id));\n  yield* Effect.forEach(remaining, (operation) =>\n    assertExact(\n      provider,\n      input.plan.zone,\n      operation.providerRecordId,\n      operation.record,\n      operation.id,\n    ),\n  );\n\n  const deleted: Array<{ operationId: string; providerRecordId: string }> = [...previouslyDeleted];\n  for (const operation of remaining) {\n    const failure = yield* Effect.gen(function* () {\n      yield* assertExact(\n        provider,\n        input.plan.zone,\n        operation.providerRecordId,\n        operation.record,\n        operation.id,\n      );\n      yield* provider.deleteRecord(input.plan.zone, operation.providerRecordId);\n      deleted.push({ operationId: operation.id, providerRecordId: operation.providerRecordId });\n    }).pipe(Effect.match({ onFailure: (cause) => cause, onSuccess: () => null }));\n    if (failure !== null) {\n      if (deleted.length === 0) return yield* failure;\n      return yield* new PartialError({\n        failedOperationId: operation.id,\n        message: failure.message,\n        receipt: yield* makeReceipt(input.plan, deleted, \"partial\"),\n      });\n    }\n  }\n  return yield* makeReceipt(input.plan, deleted, \"complete\");\n});\n\nexport function validate(plan: Plan): Effect.Effect<void, Error | CryptoError, Crypto.Crypto> {\n  const unsigned: S.Schema.Type<typeof UnsignedPlan> = {\n    createdAt: plan.createdAt,\n    expiresAt: plan.expiresAt,\n    operations: plan.operations,\n    providerId: plan.providerId,\n    sourcePlanDigest: plan.sourcePlanDigest,\n    version: plan.version,\n    zone: plan.zone,\n  };\n  return sha256Encoded(UnsignedPlan, unsigned).pipe(\n    Effect.flatMap((digest) =>\n      digest === plan.digest\n        ? Effect.void\n        : Effect.fail(new Error({ message: \"Deletion plan digest does not match its contents\" })),\n    ),\n  );\n}\n\nfunction validatePriorReceipt(\n  plan: Plan,\n  receipt: Receipt | undefined,\n): Effect.Effect<ReadonlyArray<{ operationId: string; providerRecordId: string }>, Error> {\n  if (receipt === undefined) return Effect.succeed([]);\n  if (\n    receipt.planDigest !== plan.digest ||\n    receipt.providerId !== plan.providerId ||\n    receipt.zone !== plan.zone ||\n    receipt.status !== \"partial\"\n  ) {\n    return Effect.fail(\n      new Error({ message: \"Prior receipt does not belong to this deletion plan\" }),\n    );\n  }\n  for (const completed of receipt.operations) {\n    const operation = plan.operations.find(({ id }) => id === completed.operationId);\n    if (operation === undefined || operation.providerRecordId !== completed.providerRecordId) {\n      return Effect.fail(\n        new Error({ message: \"Prior receipt operation does not match the deletion plan\" }),\n      );\n    }\n  }\n  return Effect.succeed([...receipt.operations]);\n}\n\nfunction assertExact(\n  provider: DnsProvider.Interface,\n  zone: DomainName.DomainName,\n  providerRecordId: string,\n  expected: DnsRecord.DnsRecord,\n  operationId: string,\n): Effect.Effect<void, Error | DnsProvider.Error> {\n  return provider.getRecord(zone, providerRecordId).pipe(\n    Effect.flatMap((observed) =>\n      observed !== null && observed._tag !== \"Opaque\" && DnsRecord.equals(observed, expected)\n        ? Effect.void\n        : Effect.fail(\n            new Error({\n              message:\n                observed === null\n                  ? \"Created record no longer exists\"\n                  : \"Created record content no longer matches its receipt\",\n              operationId,\n            }),\n          ),\n    ),\n  );\n}\n\nfunction makeReceipt(\n  plan: Plan,\n  operations: ReadonlyArray<{ readonly operationId: string; readonly providerRecordId: string }>,\n  status: \"complete\" | \"partial\",\n): Effect.Effect<Receipt> {\n  return Clock.currentTimeMillis.pipe(\n    Effect.map((now) => ({\n      deletedAt: new Date(now),\n      operations,\n      planDigest: plan.digest,\n      providerId: plan.providerId,\n      status,\n      version: \"domainkit.deletion-receipt.v1\" as const,\n      zone: plan.zone,\n    })),\n  );\n}\n\nexport type CreateError =\n  | Error\n  | InvalidInputError\n  | Provisioning.AuthorizationError\n  | DnsProvider.Error\n  | CryptoError;\nexport type ApplyError = Error | PartialError | DnsProvider.Error | CryptoError;\nexport type Requirements = DnsProvider.Service | Crypto.Crypto;\n","import { Effect, Schema, SchemaIssue, SchemaTransformation } from \"effect\";\n\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport type * as DnsRecord from \"../domain/dns-record.ts\";\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\n\nconst CanonicalAddress = Schema.String.pipe(\n  Schema.decodeTo(\n    Schema.String,\n    SchemaTransformation.transform({\n      decode: (value) => value.trim().toLowerCase(),\n      encode: (value) => value,\n    }),\n  ),\n);\n\nconst CanonicalDomain = Schema.String.pipe(\n  Schema.decodeTo(\n    Schema.String,\n    SchemaTransformation.transformOrFail({\n      decode: (value, options) =>\n        Effect.try({\n          try: () => DomainName.parse(value).toString(),\n          catch: (cause) =>\n            new SchemaIssue.InvalidValue(\n              { message: cause instanceof Error ? cause.message : String(cause) },\n              value,\n              options,\n            ),\n        }),\n      encode: (value) => Effect.succeed(value),\n    }),\n  ),\n);\n\nconst CanonicalMx = tokenizedDomain(2, 1);\nconst CanonicalSrv = tokenizedDomain(4, 3);\n\nconst CanonicalTxt = Schema.String.pipe(\n  Schema.decodeTo(\n    Schema.String,\n    SchemaTransformation.transform({\n      decode: (value) => {\n        const trimmed = value.trim();\n        const chunks = [...trimmed.matchAll(/\"((?:\\\\.|[^\"])*)\"/g)];\n        return chunks.length === 0\n          ? trimmed\n          : chunks\n              .map((match) => (match[1] ?? \"\").replace(/\\\\\"/g, '\"').replace(/\\\\\\\\/g, \"\\\\\"))\n              .join(\"\");\n      },\n      encode: (value) => value,\n    }),\n  ),\n);\n\nconst CanonicalCaa = Schema.String.pipe(\n  Schema.decodeTo(\n    Schema.String,\n    SchemaTransformation.transform({\n      decode: (value) => value.trim().replace(/\\s+\"([\\s\\S]*)\"$/, \" $1\"),\n      encode: (value) => value,\n    }),\n  ),\n);\n\nexport function parse(type: DnsRecord.Type, input: unknown): string {\n  const schema = (() => {\n    switch (type) {\n      case \"A\":\n      case \"AAAA\":\n        return CanonicalAddress;\n      case \"CNAME\":\n      case \"NS\":\n        return CanonicalDomain;\n      case \"MX\":\n        return CanonicalMx;\n      case \"SRV\":\n        return CanonicalSrv;\n      case \"TXT\":\n        return CanonicalTxt;\n      case \"CAA\":\n        return CanonicalCaa;\n    }\n  })();\n  try {\n    return Schema.decodeUnknownSync(schema)(input);\n  } catch (cause) {\n    throw new InvalidInputError({\n      message: cause instanceof Error ? cause.message : String(cause),\n    });\n  }\n}\n\nfunction tokenizedDomain(length: number, domainIndex: number) {\n  return Schema.String.pipe(\n    Schema.decodeTo(\n      Schema.String,\n      SchemaTransformation.transformOrFail({\n        decode: (value, options) =>\n          Effect.try({\n            try: () => {\n              const parts = value.trim().split(/\\s+/);\n              if (parts.length !== length)\n                throw new Error(\"DNS record data has an invalid field count\");\n              const domain = parts[domainIndex];\n              if (domain === undefined) throw new Error(\"DNS record target is missing\");\n              parts[domainIndex] = DomainName.parse(domain);\n              return parts.join(\" \");\n            },\n            catch: (cause) =>\n              new SchemaIssue.InvalidValue(\n                { message: cause instanceof Error ? cause.message : String(cause) },\n                value,\n                options,\n              ),\n          }),\n        encode: (value) => Effect.succeed(value),\n      }),\n    ),\n  );\n}\n","import * as DnsPacket from \"@leichtgewicht/dns-packet\";\nimport { Effect, Layer } from \"effect\";\n\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport * as DnsRecord from \"../domain/dns-record.ts\";\nimport * as DnsData from \"./dns-data.ts\";\nimport * as DnsResolver from \"./resolver.ts\";\n\nexport type Fetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;\n\nexport interface Options {\n  readonly endpoint: string;\n  readonly fetch?: Fetch;\n  readonly timeoutMs?: number;\n}\n\nexport function make(options: Options): DnsResolver.Interface {\n  const fetch = options.fetch ?? globalThis.fetch;\n  const timeoutMs = options.timeoutMs ?? 5_000;\n  return {\n    resolve: Effect.fn(\"DnsOverHttps.resolve\")((query) =>\n      Effect.tryPromise({\n        try: (effectSignal) =>\n          request({ effectSignal, fetch, query, timeoutMs, endpoint: options.endpoint }),\n        catch: (cause) =>\n          cause instanceof DnsResolver.Error\n            ? cause\n            : new DnsResolver.Error({\n                cause,\n                message: cause instanceof Error ? cause.message : \"DNS resolution failed\",\n                reason: \"transport\",\n              }),\n      }).pipe(Effect.flatMap((message) => decodeResolution(query, message))),\n    ),\n  };\n}\n\nexport const layer = (options: Options): Layer.Layer<DnsResolver.Service> =>\n  Layer.succeed(DnsResolver.Service, make(options));\n\nexport const toAsync = (options: Options): DnsResolver.AsyncInterface =>\n  DnsResolver.toAsync(make(options));\n\nfunction decodeResolution(\n  query: DnsResolver.Query,\n  message: Uint8Array,\n): Effect.Effect<DnsResolver.Resolution, DnsResolver.Error> {\n  return Effect.try({\n    try: () => DnsPacket.decode(message),\n    catch: (cause) =>\n      new DnsResolver.Error({\n        cause,\n        message: \"DoH returned an invalid DNS message\",\n        reason: \"response\",\n      }),\n  }).pipe(\n    Effect.flatMap((packet) => validatePacket(query, packet)),\n    Effect.flatMap(decodePacket),\n  );\n}\n\nfunction decodePacket(\n  packet: DnsPacket.Packet,\n): Effect.Effect<DnsResolver.Resolution, DnsResolver.Error> {\n  if (packet.rcode === \"NXDOMAIN\") {\n    return Effect.succeed({ _tag: \"nodata\" });\n  }\n  if (packet.rcode !== \"NOERROR\") {\n    return Effect.fail(\n      new DnsResolver.Error({\n        message: `DNS resolver returned ${packet.rcode ?? \"an unknown response code\"}`,\n        reason: \"response\",\n      }),\n    );\n  }\n  if (packet.answers === undefined || packet.answers.length === 0) {\n    return Effect.succeed({ _tag: \"nodata\" });\n  }\n  return Effect.forEach(packet.answers, decodeAnswer, { concurrency: \"unbounded\" }).pipe(\n    Effect.map((answers): DnsResolver.Resolution => {\n      const supportedAnswers = answers.filter((answer) => answer !== null);\n      return supportedAnswers.length === 0\n        ? { _tag: \"nodata\" }\n        : { _tag: \"answer\", answers: supportedAnswers };\n    }),\n  );\n}\n\nfunction validatePacket(\n  query: DnsResolver.Query,\n  packet: DnsPacket.Packet,\n): Effect.Effect<DnsPacket.Packet, DnsResolver.Error> {\n  return Effect.try({\n    try: () => {\n      if (packet.type !== \"response\") throw new Error(\"DoH returned a DNS query\");\n      if (packet.id !== 0) throw new Error(\"DoH response used an unexpected message ID\");\n      if (packet.flag_tc) throw new Error(\"DoH returned a truncated DNS response\");\n      const questions = packet.questions ?? [];\n      if (questions.length !== 1) throw new Error(\"DoH returned an unexpected question count\");\n      const question = questions[0];\n      if (question === undefined) throw new Error(\"DoH response omitted the DNS question\");\n      if (\n        question.class !== \"IN\" ||\n        question.type !== query.type ||\n        DomainName.parse(question.name) !== query.name\n      ) {\n        throw new Error(\"DoH response did not match the DNS question\");\n      }\n      return packet;\n    },\n    catch: (cause) =>\n      new DnsResolver.Error({\n        cause,\n        message: cause instanceof Error ? cause.message : \"DoH returned an invalid DNS response\",\n        reason: \"response\",\n      }),\n  });\n}\n\nfunction decodeAnswer(\n  answer: DnsPacket.Answer,\n): Effect.Effect<DnsResolver.Answer | null, DnsResolver.Error> {\n  return Effect.gen(function* () {\n    if (answer.class !== \"IN\") return null;\n    const decoded = yield* Effect.try({\n      try: () => answerData(answer),\n      catch: (cause) =>\n        new DnsResolver.Error({\n          cause,\n          message: \"DoH returned invalid DNS record data\",\n          reason: \"response\",\n        }),\n    });\n    if (decoded === undefined) return null;\n    const name = yield* DomainName.decode(answer.name);\n    const data = yield* Effect.try({\n      try: () => DnsData.parse(decoded.type, decoded.data),\n      catch: (cause) =>\n        new DnsResolver.Error({\n          cause,\n          message: \"DoH returned invalid DNS record data\",\n          reason: \"response\",\n        }),\n    });\n    if (answer.ttl === undefined) {\n      return yield* new DnsResolver.Error({\n        message: \"DoH response omitted the DNS record TTL\",\n        reason: \"response\",\n      });\n    }\n    return { data, name, ttl: answer.ttl, type: decoded.type };\n  }).pipe(\n    Effect.mapError((cause) =>\n      cause instanceof DnsResolver.Error\n        ? cause\n        : new DnsResolver.Error({ cause, message: cause.message, reason: \"response\" }),\n    ),\n  );\n}\n\nfunction answerData(\n  answer: DnsPacket.Answer,\n): { readonly data: string; readonly type: DnsRecord.Type } | undefined {\n  switch (answer.type) {\n    case \"A\":\n    case \"AAAA\":\n    case \"CNAME\":\n    case \"NS\":\n      return { data: answer.data, type: answer.type };\n    case \"CAA\":\n      return {\n        data: `${answer.data.flags ?? 0} ${answer.data.tag} ${answer.data.value}`,\n        type: answer.type,\n      };\n    case \"MX\":\n      return {\n        data: `${requiredNumber(answer.data.preference, \"MX preference\")} ${answer.data.exchange}`,\n        type: answer.type,\n      };\n    case \"SRV\":\n      return {\n        data: [\n          requiredNumber(answer.data.priority, \"SRV priority\"),\n          requiredNumber(answer.data.weight, \"SRV weight\"),\n          requiredNumber(answer.data.port, \"SRV port\"),\n          answer.data.target,\n        ].join(\" \"),\n        type: answer.type,\n      };\n    case \"TXT\":\n      return { data: decodeTxt(answer.data), type: answer.type };\n    default:\n      return undefined;\n  }\n}\n\nfunction decodeTxt(data: DnsPacket.TxtData): string {\n  const chunks = Array.isArray(data) ? data : [data];\n  const encoded = chunks.map((chunk) =>\n    typeof chunk === \"string\" ? new TextEncoder().encode(chunk) : chunk,\n  );\n  const length = encoded.reduce((total, chunk) => total + chunk.length, 0);\n  const joined = new Uint8Array(length);\n  let offset = 0;\n  for (const chunk of encoded) {\n    joined.set(chunk, offset);\n    offset += chunk.length;\n  }\n  return new TextDecoder(\"utf-8\", { fatal: true }).decode(joined);\n}\n\nfunction requiredNumber(value: number | undefined, field: string): number {\n  if (value === undefined) throw new Error(`DoH response omitted ${field}`);\n  return value;\n}\n\nasync function request(input: {\n  readonly effectSignal: AbortSignal;\n  readonly endpoint: string;\n  readonly fetch: Fetch;\n  readonly query: DnsResolver.Query;\n  readonly timeoutMs: number;\n}): Promise<Uint8Array> {\n  const controller = new AbortController();\n  let timedOut = false;\n  const abortFromEffect = () => controller.abort(input.effectSignal.reason);\n  const abortFromHost = () => controller.abort(input.query.signal?.reason);\n  input.effectSignal.addEventListener(\"abort\", abortFromEffect, { once: true });\n  input.query.signal?.addEventListener(\"abort\", abortFromHost, { once: true });\n  const timer = setTimeout(() => {\n    timedOut = true;\n    controller.abort(new Error(\"DNS resolution timed out\"));\n  }, input.timeoutMs);\n  try {\n    const query = Uint8Array.from(\n      DnsPacket.encode({\n        flags: DnsPacket.RECURSION_DESIRED,\n        id: 0,\n        questions: [{ name: input.query.name, type: input.query.type }],\n        type: \"query\",\n      }),\n    );\n    const response = await input.fetch(new URL(input.endpoint), {\n      body: query,\n      headers: {\n        accept: \"application/dns-message\",\n        \"content-type\": \"application/dns-message\",\n      },\n      method: \"POST\",\n      signal: controller.signal,\n    });\n    if (!response.ok) {\n      throw new DnsResolver.Error({\n        message: `DoH returned HTTP ${response.status}`,\n        reason: \"transport\",\n      });\n    }\n    const contentType = response.headers\n      .get(\"content-type\")\n      ?.split(\";\", 1)[0]\n      ?.trim()\n      .toLowerCase();\n    if (contentType !== \"application/dns-message\") {\n      throw new DnsResolver.Error({\n        message: `DoH returned unsupported content type ${contentType ?? \"<missing>\"}`,\n        reason: \"response\",\n      });\n    }\n    return new Uint8Array(await response.arrayBuffer());\n  } catch (cause) {\n    if (timedOut) {\n      throw new DnsResolver.Error({ message: \"DNS query timed out\", reason: \"timeout\" });\n    }\n    throw cause;\n  } finally {\n    clearTimeout(timer);\n    input.effectSignal.removeEventListener(\"abort\", abortFromEffect);\n    input.query.signal?.removeEventListener(\"abort\", abortFromHost);\n  }\n}\n","import { Layer } from \"effect\";\n\nimport * as DnsOverHttps from \"./doh.ts\";\nimport * as DnsResolver from \"./resolver.ts\";\n\nconst endpoint = \"https://cloudflare-dns.com/dns-query\";\n\nexport interface Options extends Omit<DnsOverHttps.Options, \"endpoint\"> {\n  readonly endpoint?: string;\n}\n\nexport function make(options: Options = {}): DnsResolver.Interface {\n  return DnsOverHttps.make({ ...options, endpoint: options.endpoint ?? endpoint });\n}\n\nexport const layer = (options: Options = {}): Layer.Layer<DnsResolver.Service> =>\n  Layer.succeed(DnsResolver.Service, make(options));\n\nexport const toAsync = (options: Options = {}): DnsResolver.AsyncInterface =>\n  DnsResolver.toAsync(make(options));\n","import { Effect, Schema } from \"effect\";\n\nimport type * as DomainName from \"../domain/domain-name.ts\";\nimport * as DnsRecord from \"../domain/dns-record.ts\";\nimport * as DnsProvider from \"../provider/provider.ts\";\nimport * as DnsData from \"./dns-data.ts\";\nimport * as DnsResolver from \"./resolver.ts\";\n\nexport const ProviderObservation = Schema.TaggedUnion({\n  match: {},\n  missing: {},\n  mismatch: { records: Schema.Array(DnsRecord.Schema) },\n  failure: { message: Schema.String },\n});\nexport type ProviderObservation = typeof ProviderObservation.Type;\n\nexport const PublicDnsObservation = Schema.TaggedUnion({\n  propagated: {},\n  missing: {},\n  mismatch: { answers: Schema.Array(Schema.String) },\n  timeout: {},\n  failure: { message: Schema.String },\n});\nexport type PublicDnsObservation = typeof PublicDnsObservation.Type;\n\nexport const Result = Schema.Struct({\n  provider: ProviderObservation,\n  publicDns: PublicDnsObservation,\n  status: Schema.Literals([\"verified\", \"pending\", \"mismatch\", \"unavailable\"]),\n});\nexport interface Result extends Schema.Schema.Type<typeof Result> {}\n\nexport const record = Effect.fn(\"Verification.record\")(function* (input: {\n  readonly record: DnsRecord.DnsRecord;\n  readonly zone: DomainName.DomainName;\n}) {\n  const provider = yield* DnsProvider.Service;\n  const resolver = yield* DnsResolver.Service;\n  const [providerObservation, publicDns] = yield* Effect.all(\n    [\n      observeProvider(provider, input.zone, input.record).pipe(\n        Effect.catch((failure) =>\n          Effect.succeed<ProviderObservation>({ _tag: \"failure\", message: failure.message }),\n        ),\n      ),\n      resolver.resolve({ name: input.record.name, type: input.record._tag }).pipe(\n        Effect.match({\n          onFailure: (failure): PublicDnsObservation =>\n            failure.reason === \"timeout\"\n              ? { _tag: \"timeout\" }\n              : { _tag: \"failure\", message: failure.message },\n          onSuccess: (resolution) => observePublicDns(input.record, resolution),\n        }),\n      ),\n    ] as const,\n    { concurrency: \"unbounded\" },\n  );\n  const status: Result[\"status\"] =\n    providerObservation._tag === \"match\" && publicDns._tag === \"propagated\"\n      ? \"verified\"\n      : providerObservation._tag === \"failure\" ||\n          publicDns._tag === \"failure\" ||\n          publicDns._tag === \"timeout\"\n        ? \"unavailable\"\n        : providerObservation._tag === \"mismatch\" || publicDns._tag === \"mismatch\"\n          ? \"mismatch\"\n          : \"pending\";\n  return { provider: providerObservation, publicDns, status };\n});\n\nfunction observeProvider(\n  provider: DnsProvider.Interface,\n  zone: DomainName.DomainName,\n  requirement: DnsRecord.DnsRecord,\n): Effect.Effect<ProviderObservation, DnsProvider.Error> {\n  return provider.listRecords(zone).pipe(\n    Effect.map((records): ProviderObservation => {\n      if (\n        records.some(\n          (existing) => existing._tag !== \"Opaque\" && DnsRecord.equals(existing, requirement),\n        )\n      ) {\n        return { _tag: \"match\" };\n      }\n      const sameSet = records.filter(\n        (existing): existing is DnsRecord.DnsRecord =>\n          existing._tag !== \"Opaque\" &&\n          existing.name === requirement.name &&\n          existing._tag === requirement._tag,\n      );\n      return sameSet.length === 0 ? { _tag: \"missing\" } : { _tag: \"mismatch\", records: sameSet };\n    }),\n  );\n}\n\nfunction observePublicDns(\n  requirement: DnsRecord.DnsRecord,\n  resolution: DnsResolver.Resolution,\n): PublicDnsObservation {\n  if (resolution._tag === \"nodata\") return { _tag: \"missing\" };\n  const expected = DnsData.parse(requirement._tag, recordValue(requirement));\n  return resolution.answers.some(\n    (answer) =>\n      answer.name === requirement.name &&\n      answer.type === requirement._tag &&\n      DnsData.parse(answer.type, answer.data) === expected,\n  )\n    ? { _tag: \"propagated\" }\n    : { _tag: \"mismatch\", answers: resolution.answers.map(({ data }) => data) };\n}\n\nfunction recordValue(requirement: DnsRecord.DnsRecord): string {\n  const data = DnsRecord.data(requirement);\n  switch (requirement._tag) {\n    case \"A\":\n    case \"AAAA\":\n      return String(data.address);\n    case \"CNAME\":\n    case \"NS\":\n      return String(data.target);\n    case \"TXT\":\n      return String(data.value);\n    case \"MX\":\n      return `${data.priority} ${data.exchange}`;\n    case \"CAA\":\n      return `${data.flags} ${data.tag} ${data.value}`;\n    case \"SRV\":\n      return `${data.priority} ${data.weight} ${data.port} ${data.target}`;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;ACQA,MAAa,QAAQA,OAAE,YAAY;CACjC,SAAS,CAAC;CACV,SAAS,EAAE,SAASA,OAAE,MAAMC,QAAiB,EAAE;AACjD,CAAC;;AAID,MAAaC,WAASF,OAAE,OAAO;CAC7B,iBAAiBA,OAAE;CACnB,WAAWA,OAAE;CACb,OAAO;CACP,IAAIA,OAAE;CACN,SAASA,OAAE;AACb,CAAC;AAGD,MAAaG,WAAS,OAAO,GAAG,mBAAmB,CAAC,EAAE,UACpDH,OAAE,oBAAoBE,QAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KACnC,OAAO,UAAU,UAAU,IAAIE,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AAEA,MAAaC,aAAW,OAAO,GAAG,qBAAqB,CAAC,EAAE,UACxDL,OAAE,oBAAoBA,OAAE,OAAOE,QAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAC7C,OAAO,UAAU,UAAU,IAAIE,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AAEA,MAAaE,WAASN,OAAE,WAAWE,QAAM;AAoBzC,IAAaK,uBAAb,cAAwCP,OAAE,YAAgC,CAAC,CAAC,sBAAsB,EAChG,SAASA,OAAE,OACb,CAAC,CAAC,CAAC,CAAC;AAEJ,SAAgB,YACd,YACA,eACA,SAMuB;CACvB,IACE,WAAW,oBAAoB,cAAc,MAC7C,cAAc,eAAe,QAAQ,YAErC,MAAM,IAAIO,qBAAmB,EAAE,SAAS,kDAAkD,CAAC;CAE7F,IAAI,cAAc,cAAc,MAAM;EACpC,IAAI,OAAO,MAAM,cAAc,UAAU,QAAQ,CAAC,GAChD,MAAM,IAAIA,qBAAmB,EAAE,SAAS,mCAAmC,CAAC;EAE9E,IAAI,cAAc,cAAc,QAAQ,uBAAO,IAAI,KAAK,IACtD,MAAM,IAAIA,qBAAmB,EAAE,SAAS,yBAAyB,CAAC;CAEtE;CACA,IAAI,CAAC,cAAc,aAAa,SAAS,QAAQ,UAAU,GACzD,MAAM,IAAIA,qBAAmB,EAC3B,SAAS,wBAAwB,QAAQ,WAAW,aACtD,CAAC;CAEH,IAAI;CACJ,IAAI;EACF,SAASC,QAAiB,QAAQ,MAAM;CAC1C,SAAS,OAAO;EACd,IAAI,iBAAiBJ,SAAmB,MAAM;EAC9C,MAAM,IAAIA,QAAkB,EAC1B,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAChE,CAAC;CACH;CACA,IAAI,WAAW,MAAM,SAAS,aAAa,CAAC,WAAW,MAAM,QAAQ,SAAS,MAAM,GAClF,MAAM,IAAIG,qBAAmB,EAAE,SAAS,wCAAwC,CAAC;CAEnF,OAAO;AACT;;;;;;;;AC7FA,IAAaE,UAAb,cAA2BC,OAAE,YAAmB,CAAC,CAAC,4BAA4B,EAC5E,SAASA,OAAE,OACb,CAAC,CAAC,CAAC,CAAC;;AASJ,MAAa,cAAc,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAAW,OAGhF;CACD,MAAM,kBAAkB,OAAOC;CAC/B,MAAM,aAAa,OAAOC,WAAoB;EAAE,GAAG,MAAM;EAAY,OAAO,MAAM;CAAM,CAAC;CACzF,OAAO,gBAAgB,IAAI,UAAU;CACrC,OAAO;AACT,CAAC;;;;;;AAOD,SAAgB,OAAa,OAKgD;CAC3E,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,qBAAqB,OAAOC;EAClC,MAAM,kBAAkB,OAAOF;EAC/B,MAAM,kBAAkB,OAAOG;EAC/B,MAAM,aAAa,OAAO,gBAAgB,IAAI,MAAM,YAAY;EAChE,IAAI,eAAe,MACjB,OAAO,OAAO,IAAIL,QAAM,EAAE,SAAS,oCAAoC,CAAC;EAG1E,MAAM,qBAAoB,OADF,gBAAgB,sBAAsB,WAAW,eAAe,EAAA,CACrD,QAAQ,EAAE,SAAS,OAAO,WAAW,EAAE;EAC1E,IAAI,kBAAkB,SAAS,GAAG;GAChC,OAAO,gBAAgB,OAAO,WAAW,EAAE;GAC3C,OAAO;IACL;IACA,mBAAmB,kBAAkB;IACrC,sBAAsB;GACxB;EACF;EAEA,MAAM,gBAAgB,OAAO,mBAAmB,IAAI,WAAW,eAAe;EAC9E,IAAI,kBAAkB,MAAM;GAG1B,OAAO,gBAAgB,OAAO,WAAW,eAAe;GACxD,OAAO,gBAAgB,OAAO,WAAW,EAAE;GAC3C,OAAO;IAAE;IAAY,mBAAmB;IAAG,sBAAsB;GAAK;EACxE;EACA,OAAO,MAAM,oBAAoB,aAAa;EAC9C,OAAO,gBAAgB,OAAO,cAAc,EAAE;EAC9C,OAAO,mBAAmB,OAAO,cAAc,EAAE;EACjD,OAAO,gBAAgB,OAAO,WAAW,EAAE;EAC3C,OAAO;GAAE;GAAY,mBAAmB;GAAG,sBAAsB;EAAK;CACxE,CAAC;AACH;;;;;;;;;;ACtEA,MAAa,aAAaM,OAAE,SAAS,CAAC,YAAY,WAAW,CAAC;;AAI9D,MAAaC,WAASD,OAAE,OAAO;CAC7B,WAAWA,OAAE;CACb,cAAcA,OAAE,MAAM,UAAU;CAChC,WAAWA,OAAE;CACb,WAAWA,OAAE,OAAOA,OAAE,cAAc;CACpC,IAAIA,OAAE;CACN,MAAMA,OAAE,SAAS,CAAC,UAAU,OAAO,CAAC;CACpC,YAAYA,OAAE;CACd,QAAQA,OAAE,MAAMA,OAAE,MAAM;CACxB,WAAWA,OAAE;AACf,CAAC;AAGD,MAAaE,WAAS,OAAO,GAAG,8BAA8B,CAAC,EAAE,UAC/DF,OAAE,oBAAoBC,QAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KACnC,OAAO,UAAU,UAAU,IAAIE,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AAEA,MAAaC,aAAW,OAAO,GAAG,gCAAgC,CAAC,EAAE,UACnEJ,OAAE,oBAAoBA,OAAE,OAAOC,QAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAC7C,OAAO,UAAU,UAAU,IAAIE,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AAEA,MAAaE,WAASL,OAAE,WAAWC,QAAM;;;;;;;;;;;AC/BzC,IAAa,cAAb,cAAiC,OAAO,YAAyB,CAAC,CAAC,eAAe,EAChF,SAAS,OAAO,OAClB,CAAC,CAAC,CAAC,CAAC;;AAWJ,SAAgB,UAAU,OAAqB;CAC7C,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;EAC/C,MAAM,UAAU,KAAK,UAAU,KAAK;EACpC,IAAI,YAAY,KAAA,GAAW,MAAM,IAAI,UAAU,oCAAoC;EACnF,OAAO;CACT;CACA,IAAI,YAAY,KAAK,GAAG,OAAO,IAAI,MAAM,IAAI,SAAS,CAAC,CAAC,KAAK,GAAG,EAAE;CAClE,OAAO,IAAI,OAAO,QAAQ,KAAK,CAAC,CAC7B,MAAM,CAAC,OAAO,CAAC,WAAY,OAAO,QAAQ,KAAK,OAAO,QAAQ,IAAI,CAAE,CAAC,CACrE,KAAK,CAAC,KAAK,WAAW,GAAG,KAAK,UAAU,GAAG,EAAE,GAAG,UAAU,KAAK,GAAG,CAAC,CACnE,KAAK,GAAG,EAAE;AACf;AAEA,SAAS,YAAY,OAA2C;CAC9D,OAAO,MAAM,QAAQ,KAAK;AAC5B;AAEA,MAAa,aAAa,OAAO,GAAG,mBAAmB,CAAC,CAAC,WAAW,OAAe;CAKjF,OAAO,CAAC,GAAG,QAHW,OADO,OAAO,OAAA,CAEjC,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAClD,KAAK,OAAO,UAAU,UAAU,IAAI,YAAY,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAAC,CAC9D,CAAC,CAAC,KAAK,SAAS,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;AAC9E,CAAC;AAED,MAAa,aAAa,OAAO,GAAG,mBAAmB,CAAC,EAAE,UACxD,OAAO,IAAI;CACT,WAAW,UAAU,KAAK;CAC1B,QAAQ,UACN,IAAI,YAAY,EAAE,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,CAAC;AACvF,CAAC,CAAC,CAAC,KAAK,OAAO,QAAQ,UAAU,CAAC,CACpC;AAEA,SAAS,qBACP,QACA,OAC2E;CAC3E,OAAO,OAAO,aAAa,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KACxC,OAAO,UAAU,UAAU,IAAI,YAAY,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,GACtE,OAAO,QAAQ,OAAO,oBAAoB,OAAO,IAAI,CAAC,GACtD,OAAO,UAAU,UAAU,IAAI,YAAY,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,GACtE,OAAO,QAAQ,UAAU,CAC3B;AACF;AAEA,MAAa,gBAAgB,OAAO,GAAG,sBAAsB,CAAC,CAAC,oBAAoB;;AAGnF,MAAa,iBAA6C,MAAM,QAC9D,OAAO,QACP,OAAO,KAAK;CACV,cAAc,SAAS,OAAO,gBAAgB,IAAI,WAAW,IAAI,CAAC;CAClE,SAAS,WAAW,SAClB,OAAO,WAAW;EAChB,KAAK,YAAY;GACf,MAAM,QAAQ,IAAI,WAAW,KAAK,UAAU;GAC5C,MAAM,IAAI,IAAI;GACd,OAAO,IAAI,WAAW,MAAM,OAAO,OAAO,OAAO,WAAW,MAAM,MAAM,CAAC;EAC3E;EACA,QAAQ,UACN,cAAc,YAAY;GACxB,MAAM;GACN,QAAQ;GACR,QAAQ;GACR;EACF,CAAC;CACL,CAAC;AACL,CAAC,CACH;;;;;;;;;ACtCA,SAAS,aACP,OAKA;CACA,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,aAAa,OAAOK;EAC1B,MAAM,gBAAgB,OAAO,OAAO;EACpC,MAAM,MAAM,OAAO,MAAM;EACzB,MAAM,QAAQ,UAAU,OAAO,YAAY,eAAe,EAAE,CAAC;EAC7D,MAAM,eAAe,UAAU,OAAO,YAAY,eAAe,EAAE,CAAC;EACpE,MAAM,YAAY,UAChB,OAAO,cACJ,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,YAAY,CAAC,CAAC,CACzD,KAAK,OAAO,UAAU,UAAU,IAAI,YAAY,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAAC,CACjF;EACA,MAAM,YAAY,OAAO,WAAW,KAAK;EACzC,MAAM,mBAAmB,IAAI,IAAI,MAAM,OAAO,oBAAoB,sBAAsB;EACxF,iBAAiB,SAAS,IAAI,gBAAgB;GAC5C,WAAW,MAAM,OAAO;GACxB,gBAAgB;GAChB,uBAAuB;GACvB,cAAc,MAAM;GACpB,eAAe;GACf,OAAO,MAAM,OAAO,OAAO,KAAK,GAAG;GACnC;EACF,CAAC,CAAC,CAAC,SAAS;EAEZ,OAAO,WAAW,IAAI;GACpB,UAAU,MAAM,OAAO;GACvB,cAAcC,MAAO,KAAK,YAAY;GACtC,WAAW,IAAI,KAAK,OAAO,MAAM,SAAS,IAAY;GACtD,OAAO,MAAM;GACb,QAAQ,MAAM;GACd,SAAS,MAAM;GACf,aAAa,MAAM;GACnB;GACA,WAAW,MAAM;EACnB,CAAC;EACD,OAAO,EAAE,iBAAiB;CAC5B,CAAC;AACH;AAEA,SAAS,gBAAgB,OAiBvB;CACA,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,aAAa,OAAOD;EAC1B,MAAM,qBAAqB,OAAOE;EAClC,MAAM,kBAAkB,OAAOC;EAC/B,MAAM,kBAAkB,OAAOC;EAC/B,MAAM,gBAAgB,OAAO,OAAO;EACpC,MAAM,QAAQ,MAAM,YAAY,aAAa,IAAI,OAAO;EACxD,IAAI,UAAU,MACZ,OAAO,OAAO,IAAIC,qBAA8B,EAC9C,SAAS,kCACX,CAAC;EAEH,MAAM,MAAM,OAAO,MAAM;EACzB,MAAM,eAAe,OAAO,WAAW,QAAQ,OAAO,WAAW,KAAK,GAAG,IAAI,KAAK,GAAG,CAAC;EACtF,IAAI,iBAAiB,MACnB,OAAO,OAAO,IAAIA,qBAA8B,EAC9C,SAAS,0DACX,CAAC;EAEH,IAAI,aAAa,aAAa,MAAM,OAAO,UACzC,OAAO,OAAO,IAAIA,qBAA8B,EAC9C,SAAS,+CACX,CAAC;EAGH,MAAM,KAAK,aAAa,OAAO;EAC/B,MAAM,SAAuB,EAAE,WAAW,aAAa,SAAS;EAChE,MAAM,iBAAiB,OAAO,2BAA2B,aAAa,QAAQ,MAAM,MAAM;EAC1F,MAAM,SAAS,OAAO,gBAAgB,MAAM,YAAY,OAAO,WAAW;GACxE,MAAM,qBAAqB,MAAM,qBAAqB,IAAI,QAAQ,MAAM,aAAa,KAAK;GAC1F,MAAM,WAAW,MAAM,MAAM,8BAC3B,IACA,QACA,gBACA,oBACA,aAAa,aACb,aAAa,aAAa,OAAO,GACjC,eAAe,MAAM,OAAO,MAAM,CACpC;GACA,OAAO,MAAM,iCAAiC,IAAI,QAAQ,QAAQ;EACpE,CAAC;EACD,MAAM,cAAcJ,MAAO,KAAK,OAAO,YAAY;EACnD,MAAM,UAAU,OAAO,MAAM,eAAe,QAAQ,WAAW;EAC/D,MAAM,wBAAwB,OAAO,mBAAmB,sBACtD,MAAM,YACN,QAAQ,SACV;EACA,MAAM,kBACJ,uBAAuB,OACtB,OAAO,cAAc,aAAa,KACjC,OAAO,UAAU,UAAU,IAAI,YAAY,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CACxE;EACF,MAAM,gBAAgB,OAAOK,WAA+B;GAC1D,WAAW,QAAQ;GACnB,cAAc,CAAC,GAAG,aAAa,OAAO,YAAY;GAClD,WAAW,uBAAuB,aAAa,IAAI,KAAK,GAAG;GAC3D,WAAW,QAAQ;GACnB,IAAI;GACJ,MAAM;GACN,YAAY,MAAM;GAClB,SAAS,OAAO,SAAS,aAAa,OAAO,OAAO,KAAK,GAAG,EAAA,CAAG,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO;GACxF,WAAW,aAAa;EAC1B,CAAC;EACD,MAAM,qBAAqB,OAAO,gBAAgB,KAAK,aAAa,SAAS,cAAc,EAAE;EAC7F,MAAM,aAAa,OAAOC,WAAoB;GAC5C,iBAAiB,cAAc;GAC/B,WAAW,oBAAoB,aAAa,IAAI,KAAK,GAAG;GACxD,OAAO,aAAa;GACpB,IACE,oBAAoB,OACnB,OAAO,cAAc,aAAa,KACjC,OAAO,UAAU,UAAU,IAAI,YAAY,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CACxE;GACF,SAAS,aAAa;EACxB,CAAC;EACD,OAAO,gBAAgB,IAAI,cAAc,IAAI;GAC3C;GACA,cAAc,OAAO,kBAAkB,KAAA,IAAY,OAAON,MAAO,KAAK,OAAO,aAAa;GAC1F,WAAW,OAAO;EACpB,CAAC;EACD,OAAO,mBAAmB,IAAI,aAAa;EAC3C,OAAO,gBAAgB,IAAI,UAAU;EACrC,OAAO;GAAE;GAAe;EAAW;CACrC,CAAC;AACH;AAEA,SAAS,eAAe,OAKqC;CAC3D,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,kBAAkB,OAAOG;EAC/B,MAAM,aAAa,OAAO,kBAAkB,MAAM,cAAc,IAAI,eAAe;EACnF,MAAM,eAAe,WAAW;EAChC,IAAI,iBAAiB,MACnB,OAAO,OAAO,IAAIC,qBAA8B,EAC9C,SAAS,kCACX,CAAC;EAEH,MAAM,KAAK,MAAM,OAAO;EACxB,MAAM,SAAuB,EAAE,WAAW,MAAM,OAAO,SAAS;EAChE,MAAM,iBAAiB,OAAO,2BAA2B,MAAM,QAAQ,MAAM,MAAM;EACnF,MAAM,SAAS,OAAO,gBAAgB,MAAM,cAAc,YAAY,OAAO,WAAW;GACtF,MAAM,WAAW,MAAM,MAAM,yBAC3B,IACA,QACA,gBACA,aAAa,OAAO,GACpB,eAAe,MAAM,OAAO,MAAM,CACpC;GACA,OAAO,MAAM,4BAA4B,IAAI,QAAQ,QAAQ;EAC/D,CAAC;EACD,OAAO,gBAAgB,IAAI,MAAM,cAAc,IAAI;GACjD,aAAaJ,MAAO,KAAK,OAAO,YAAY;GAC5C,cACE,OAAO,kBAAkB,KAAA,IACrB,WAAW,eACXA,MAAO,KAAK,OAAO,aAAa;GACtC,WAAW,OAAO;EACpB,CAAC;CACH,CAAC;AACH;AAEA,SAAS,cAAc,OAKsC;CAC3D,OAAO,OAAO,IAAI,aAAa;EAC7B,IAAI,MAAM,OAAO,oBAAoB,wBAAwB,KAAA,GAC3D,OAAO,OAAO,IAAII,qBAA8B,EAC9C,SAAS,+CACX,CAAC;EAEH,MAAM,kBAAkB,OAAOD;EAC/B,MAAM,aAAa,OAAO,kBAAkB,MAAM,cAAc,IAAI,eAAe;EACnF,MAAM,KAAK,MAAM,OAAO;EACxB,MAAM,iBAAiB,OAAO,2BAA2B,MAAM,QAAQ,MAAM,MAAM;EACnF,OAAO,gBAAgB,MAAM,cAAc,YAAY,OAAO,WAAW;GACvE,MAAM,WAAW,MAAM,MAAM,kBAC3B,IACA,EAAE,WAAW,MAAM,OAAO,SAAS,GACnC,gBACA,WAAW,YAAY,OAAO,GAC9B,eAAe,MAAM,OAAO,MAAM,CACpC;GACA,MAAM,MAAM,0BAA0B,QAAQ;EAChD,CAAC;EACD,OAAO,gBAAgB,OAAO,MAAM,cAAc,EAAE;CACtD,CAAC;AACH;AAEA,SAAS,2BACP,QACA,QACoD;CACpD,OAAO,OAAO,IAAI;EAChB,WAAW,qBAAqB,QAAQ,MAAM;EAC9C,QAAQ,UACN,iBAAiBI,UACb,QACA,IAAIA,QAAkB,EAAE,SAAS,yCAAyC,CAAC;CACnF,CAAC;AACH;AAEA,SAAS,qBACP,QACA,QACkB;CAClB,QAAQ,OAAO,YAAf;EACE,KAAK,QACH,OAAO,MAAM,KAAK;EACpB,KAAK;GACH,IAAI,OAAO,iBAAiB,KAAA,GAC1B,MAAM,IAAIA,QAAkB,EAAE,SAAS,4BAA4B,CAAC;GAEtE,OAAO,MAAM,kBAAkB,OAAO,aAAa,OAAO,CAAC;EAC7D,KAAK;GACH,IAAI,OAAO,iBAAiB,KAAA,GAC1B,MAAM,IAAIA,QAAkB,EAAE,SAAS,4BAA4B,CAAC;GAEtE,OAAO,MAAM,iBAAiB,OAAO,aAAa,OAAO,CAAC;CAC9D;AACF;AAEA,SAAS,eACP,qBACA,QACmC;CACnC,OAAO,wBAAwB,KAAA,IAC3B,EAAE,OAAO,IACT;EACE;GACC,MAAM,eAAe,KAAK,YACzB,oBAAoB,KAAK;GAAE,GAAG;GAAS,MAAM,QAAQ;EAAK,CAAC;CAC/D;AACN;AAEA,SAAS,kBACP,cACA,OAC2F;CAC3F,OAAO,MAAM,IAAI,YAAY,CAAC,CAAC,KAC7B,OAAO,SAAS,eACd,eAAe,OACX,OAAO,KACL,IAAIH,qBAA8B,EAChC,SAAS,yCACX,CAAC,CACH,IACA,OAAO,QAAQ,UAAU,CAC/B,CACF;AACF;AAEA,SAAS,gBAAmB,YAAoB,SAA8C;CAC5F,OAAO,OAAO,WAAW;EACvB,KAAK;EACL,QAAQ,UACN,iBAAiBA,wBAAiC,iBAAiBG,UAC/D,QACA,IAAIC,QAAkB;GACpB;GACA,SAAS,iBAAiB,KAAK;GAC/B,WAAW;GACX;EACF,CAAC;CACT,CAAC;AACH;AAEA,SAAS,YACP,eACA,MACwC;CACxC,OAAO,cACJ,YAAY,IAAI,CAAC,CACjB,KAAK,OAAO,UAAU,UAAU,IAAI,YAAY,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAAC;AACjF;AAEA,SAAS,UAAU,OAA2B;CAC5C,IAAI,SAAS;CACb,KAAK,MAAM,QAAQ,OAAO,UAAU,OAAO,aAAa,IAAI;CAC5D,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,EAAE;AAClF;AAEA,SAAS,iBAAiB,OAAwB;CAChD,OAAO,iBAAiB,QAAQ,MAAM,OAAO;AAC/C;AAEA,MAAa,QAAQ,OAAO,GAAG,aAAa,CAAC,CAAC,YAAY;AAC1D,MAAa,WAAW,OAAO,GAAG,gBAAgB,CAAC,CAAC,eAAe;AACnE,MAAa,UAAU,OAAO,GAAG,eAAe,CAAC,CAAC,cAAc;AAChE,MAAa,SAAS,OAAO,GAAG,cAAc,CAAC,CAAC,aAAa;;;;;;;;ACpW7D,MAAa,SAASC,OAAE,YAAY;CAClC,aAAa;EACX,cAAcA,OAAE,MAAMA,OAAE,SAAS,CAAC,YAAY,WAAW,CAAC,CAAC;EAC3D,YAAYA,OAAE;EACd,eAAeA,OAAE;CACnB;CACA,QAAQ;EACN,qBAAqBA,OAAE,OAAO;GAC5B,wBAAwBA,OAAE;GAC1B,QAAQA,OAAE;GACV,qBAAqBA,OAAE,YAAYA,OAAE,MAAM;GAC3C,gBAAgBA,OAAE;EACpB,CAAC;EACD,cAAcA,OAAE,MAAMA,OAAE,SAAS,CAAC,YAAY,WAAW,CAAC,CAAC;EAC3D,YAAYA,OAAE,SAAS;GAAC;GAAQ;GAAuB;EAAoB,CAAC;EAC5E,QAAQA,OAAE,MAAMA,OAAE,MAAM;CAC1B;CACA,OAAO;EACL,cAAcA,OAAE,MAAMA,OAAE,SAAS,CAAC,YAAY,WAAW,CAAC,CAAC;EAC3D,iBAAiBA,OAAE;CACrB;AACF,CAAC;AAED,MAAaC,WAASD,OAAE,OAAO;CAC7B,SAASA,OAAE,MAAM,MAAM;CACvB,YAAYA,OAAE;AAChB,CAAC;AASD,MAAaE,WAAS,OAAO,GAAG,qBAAqB,CAAC,EAAE,UACtDF,OAAE,oBAAoBC,QAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KACnC,OAAO,UAAU,UAAU,IAAIE,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;;;;ACrBA,MAAa,UAAU,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,OAAc;CACnF,MAAM,qBAAqB,OAAOC;CAClC,MAAM,kBAAkB,OAAOC;CAC/B,MAAM,kBAAkB,OAAOC;CAC/B,MAAM,gBAAgB,OAAO,OAAO;CACpC,MAAM,aAAa,OAAO,MAAM,SAAS,MAAM,KAAK;CACpD,MAAM,YAAY,IAAI,KAAK,OAAO,MAAM,iBAAiB;CACzD,MAAM,wBAAwB,OAAO,mBAAmB,sBACtD,MAAM,YACN,WAAW,SACb;CACA,MAAM,gBAAgB,OAAOC,WAA+B;EAC1D,WAAW,WAAW;EACtB,cAAc,CAAC,GAAG,WAAW,YAAY;EACzC,WAAW,uBAAuB,aAAa;EAC/C,WAAW,WAAW;EACtB,IACE,uBAAuB,OACtB,OAAO,cAAc,aAAa,KACjC,OAAO,UAAU,UAAU,IAAIC,YAAc,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC1E;EACF,MAAM;EACN,YAAY,MAAM;EAClB,QAAQ,CAAC,GAAG,WAAW,MAAM;EAC7B,WAAW,MAAM;CACnB,CAAC;CACD,MAAM,qBAAqB,OAAO,gBAAgB,KAAK,MAAM,SAAS,cAAc,EAAE;CACtF,MAAM,aAAa,OAAOC,WAAoB;EAC5C,iBAAiB,cAAc;EAC/B,WAAW,oBAAoB,aAAa;EAC5C,OAAO,MAAM;EACb,IACE,oBAAoB,OACnB,OAAO,cAAc,aAAa,KACjC,OAAO,UAAU,UAAU,IAAID,YAAc,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC1E;EACF,SAAS,MAAM;CACjB,CAAC;CACD,OAAO,gBAAgB,IAAI,cAAc,IAAI;EAC3C,aAAa,MAAM;EACnB,cAAc;EACd,WAAW;CACb,CAAC;CACD,OAAO,mBAAmB,IAAI,aAAa;CAC3C,OAAO,gBAAgB,IAAI,UAAU;CACrC,OAAO;EAAE;EAAe;CAAW;AACrC,CAAC;;;;AClED,SAAgB,WAAW,OAAqD;CAC9E,MAAM,SAASE,QAAiB,KAAK;CACrC,MAAM,cAAc,UAAU,QAAQ,EAAE,qBAAqB,KAAK,CAAC;CACnE,IAAI,gBAAgB,MAClB,MAAM,IAAIC,QAAkB,EAAE,SAAS,8CAA8C,CAAC;CAExF,MAAM,SAAS,OAAO,MAAM,GAAG;CAC/B,MAAM,oBAAoB,YAAY,MAAM,GAAG,CAAC,CAAC;CACjD,MAAM,SAAuC,CAAC;CAC9C,KAAK,IAAI,QAAQ,GAAG,SAAS,OAAO,SAAS,mBAAmB,SAAS,GACvE,OAAO,KAAKD,QAAiB,OAAO,MAAM,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;CAE7D,OAAO;AACT;;;;;;;;ACHA,MAAa,WAAW,OAAO,OAAO;CACpC,WAAW,OAAO;CAClB,cAAc,OAAO;CACrB,yBAAyB,OAAO;CAChC,oBAAoB,OAAO,MAAME,QAAiB;CAClD,YAAY,OAAO;CACnB,MAAMA;AACR,CAAC;AAGD,MAAa,YAAY,OAAO,YAAY;CAC1C,UAAU;EACR,WAAW;EACX,UAAU,OAAO,MAAM,QAAQ;EAC/B,QAAQ,OAAO,SAAS,CAAC,YAAY,yBAAyB,CAAC;CACjE;CACA,QAAQ;EACN,UAAU,OAAO,MAAM,QAAQ;EAC/B,QAAQ,OAAO,SAAS,CAAC,aAAa,aAAa,CAAC;CACtD;AACF,CAAC;AAGD,SAAgB,OAAO,OAUT;CACZ,MAAM,SAASC,QAAiB,MAAM,MAAM;CAC5C,MAAM,iBAAiB,IAAI,IAAIC,WAAiB,MAAM,CAAC;CACvD,MAAM,gBAAgB,cAAc,MAAM,wBAAwB;CAClE,MAAM,WAAW,MAAM,eAAe,QAAQ,cAAc;EAC1D,IAAI,CAAC,eAAe,IAAID,QAAiB,UAAU,IAAI,CAAC,GAAG,OAAO;EAClE,IAAI;GACF,YAAuB,UAAU,YAAY,UAAU,eAAe;IACpE,YAAY;IACZ;IACA,GAAI,MAAM,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK,MAAM,IAAI;IACpD,YAAY,UAAU;GACxB,CAAC;GACD,OAAO;EACT,QAAQ;GACN,OAAO;EACT;CACF,CAAC;CACD,MAAM,WAAW,SAAS,KAAK,cAAc,YAAY,WAAW,aAAa,CAAC;CAElF,IAAI,MAAM,aAAa,KAAA,GAAW;EAChC,MAAM,eAAeA,QAAiB,MAAM,SAAS,IAAI;EACzD,MAAM,QAAQ,SAAS,WACpB,cACC,UAAU,eAAe,MAAM,UAAU,cACzC,UAAU,cAAc,cAAc,MAAM,SAAS,aACrDA,QAAiB,UAAU,IAAI,MAAM,YACzC;EACA,IAAI,QAAQ,GACV,MAAM,IAAIE,qBAA8B,EACtC,SAAS,qDACX,CAAC;EAEH,MAAM,YAAY,SAAS;EAC3B,IAAI,cAAc,KAAA,GAAW,MAAM,IAAI,MAAM,uCAAuC;EACpF,OAAO;GAAE,MAAM;GAAY;GAAW;GAAU,QAAQ;EAAW;CACrE;CAEA,MAAM,WAAW,SAAS,QAAQ,EAAE,8BAA8B,uBAAuB;CACzF,MAAM,YAAY,SAAS;CAC3B,OAAO,SAAS,WAAW,KAAK,cAAc,KAAA,IAC1C;EAAE,MAAM;EAAY;EAAW;EAAU,QAAQ;CAA0B,IAC3E;EACE,MAAM;EACN;EACA,QAAQ,SAAS,SAAS,IAAI,cAAc;CAC9C;AACN;AAEA,SAAS,YACP,WACA,eACU;CACV,MAAM,aAAa,IAAI,IAAI,cAAc,UAAU,WAAW,CAAC;CAC/D,MAAM,qBAAqB,cAAc,QAAQ,eAAe,WAAW,IAAI,UAAU,CAAC;CAC1F,OAAO;EACL,WAAW,UAAU,cAAc;EACnC,cAAc,UAAU,WAAW;EACnC,yBACE,cAAc,SAAS,KAAK,mBAAmB,WAAW,cAAc;EAC1E;EACA,YAAY,UAAU;EACtB,MAAMF,QAAiB,UAAU,IAAI;CACvC;AACF;AAEA,SAAS,cAAc,aAA0E;CAC/F,OAAO,CAAC,GAAG,IAAI,IAAI,YAAY,IAAIA,OAAgB,CAAC,CAAC,CAAC,CAAC,KAAK;AAC9D;;;;;;;;;;;;;AC9GA,MAAaG,cAAYC,OAAE,YAAY;CACrC,QAAQ;EACN,IAAIA,OAAE;EACN,aAAaC;CACf;CACA,MAAM;EACJ,IAAID,OAAE;EACN,aAAaC;EACb,UAAUD,OAAE;CACd;CACA,UAAU;EACR,UAAUA,OAAE,MAAME,QAAkB;EACpC,IAAIF,OAAE;EACN,QAAQA,OAAE;EACV,aAAaC;CACf;AACF,CAAC;AAGD,MAAaE,WAASH,OAAE,OAAO;CAC7B,QAAQA,OAAE;CACV,YAAYA,OAAE,MAAMD,WAAS;CAC7B,YAAYC,OAAE;CACd,SAASA,OAAE,QAAQ,uBAAuB;CAC1C,MAAMI;AACR,CAAC;AAGD,MAAaC,kBAAgBL,OAAE,OAAO;CACpC,cAAcA,OAAE;CAChB,cAAcA,OAAE,MAAMA,OAAE,MAAM;CAC9B,YAAYA,OAAE;CACd,SAASA,OAAE,QAAQ,iCAAiC;AACtD,CAAC;AAGD,MAAaM,YAAUN,OAAE,OAAO;CAC9B,WAAWA,OAAE;CACb,YAAYA,OAAE,MACZA,OAAE,OAAO;EACP,aAAaA,OAAE;EACf,kBAAkBA,OAAE,OAAOA,OAAE,MAAM;CACrC,CAAC,CACH;CACA,YAAYA,OAAE;CACd,YAAYA,OAAE;CACd,QAAQA,OAAE,SAAS,CAAC,YAAY,SAAS,CAAC;CAC1C,SAASA,OAAE,QAAQ,4BAA4B;CAC/C,MAAMI;AACR,CAAC;AAGD,MAAa,SAAS,OAAO,GAAG,gBAAgB,CAAC,EAAE,UACjDJ,OAAE,oBAAoBG,QAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KACnC,OAAO,UAAU,UAAU,IAAII,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AAEA,MAAa,SAASP,OAAE,WAAWG,QAAM;AACzC,MAAa,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,EAAE,UAC/DH,OAAE,oBAAoBM,SAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KACpC,OAAO,UAAU,UAAU,IAAIC,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AACA,MAAa,gBAAgBP,OAAE,WAAWM,SAAO;;;;;;;;;;;;;;AC7DjD,MAAME,iBAAeC,OAAE,OAAO;CAC5B,YAAYA,OAAE,MAAMC,WAAiB;CACrC,YAAYD,OAAE;CACd,SAASA,OAAE,QAAQ,uBAAuB;CAC1C,MAAME;AACR,CAAC;AAED,MAAM,oBAAoBF,OAAE,OAAO,EAAE,aAAaG,SAAiB,CAAC;AAEpE,IAAa,gBAAb,cAAmCH,OAAE,YAA2B,CAAC,CAAC,qBAAqB,EACrF,cAAcA,OAAE,MAAMA,OAAE,MAAM,EAChC,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,qBAAb,cAAwCA,OAAE,YAAgC,CAAC,CAAC,sBAAsB,EAChG,SAASA,OAAE,OACb,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,aAAb,cAAgCA,OAAE,YAAwB,CAAC,CAAC,kBAAkB;CAC5E,oBAAoBA,OAAE;CACtB,mBAAmBA,OAAE;AACvB,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,oBAAb,cAAuCA,OAAE,YAA+B,CAAC,CAAC,qBAAqB;CAC7F,UAAUA,OAAE,SAAS;EACnB;EACA;EACA;EACA;EACA;CACF,CAAC;CACD,mBAAmBA,OAAE;CACrB,SAASA,OAAE;CACX,SAASI;AACX,CAAC,CAAC,CAAC,CAAC;;AAwBJ,MAAaC,WAAS,OAAO,GAAG,qBAAqB,CAAC,CAAC,WAAW,OAAoB;CACpF,MAAM,WAAW,OAAOC;CACxB,MAAM,OAAO,OAAOC,SAAkB,MAAM,IAAI;CAChD,MAAM,gBAAgB,OAAO,OAAO,QAAQ,MAAM,cAAcC,UAAkB,EAChF,aAAa,YACf,CAAC,EAAA,CAAG,KAAK,cAAc;CACvB,MAAM,WAAW,CAAC,GAAI,OAAO,SAAS,YAAY,IAAI,CAAE,CAAC,CAAC,KAAK,cAAc;CAC7E,MAAM,EAAE,eAAe,OAAO,OAAO,OACnC,qBACsB;EAAE,YAAY,CAAC;EAAG,WAAW;CAAS,KAC3D,OAAO,gBACN,qBAAqB,aAAa,MAAM,SAAS,CAAC,CAAC,KACjD,OAAO,KAAK,eAAe;EACzB,YAAY,CAAC,GAAG,MAAM,YAAY,SAAS;EAC3C,WACE,UAAU,SAAS,WACf,CAAC,GAAG,MAAM,WAAW,UAAU,WAAW,CAAC,CAAC,KAAK,cAAc,IAC/D,MAAM;CACd,EAAE,CACJ,CACJ;CACA,MAAM,WAA+C;EACnD;EACA,YAAY,SAAS;EACrB,SAAS;EACT;CACF;CACA,OAAO;EAAE,GAAG;EAAU,QAAQ,OAAO,cAAcT,gBAAc,QAAQ;CAAE;AAC7E,CAAC;;AAQD,MAAaU,cAAY,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAC3D,MACA,cACA,UAA+C,CAAC,GAChD;CACA,OAAOC,WAAS,IAAI;CACpB,MAAM,YAAY,KAAK,WACpB,QAAQ,cAAc,UAAU,SAAS,QAAQ,CAAC,CAClD,KAAK,EAAE,SAAS,EAAE;CACrB,MAAM,WAAW,CAAC,GAAG,IAAI,IAAI,gBAAgB,SAAS,CAAC,CAAC,CAAC,KAAK;CAC9D,MAAM,UAAU,SAAS,QAAQ,OAAO,CAAC,UAAU,SAAS,EAAE,CAAC;CAC/D,IAAI,QAAQ,SAAS,GACnB,OAAO,OAAO,IAAI,mBAAmB,EACnC,SAAS,0BAA0B,QAAQ,KAAK,IAAI,IACtD,CAAC;CAEH,IAAI,CAAC,QAAQ,gBAAgB,SAAS,WAAW,UAAU,QACzD,OAAO,OAAO,IAAI,mBAAmB,EACnC,SAAS,8CACX,CAAC;CAEH,OAAO;EACL,cAAc,QAAQ,gBAAgB;EACtC,cAAc;EACd,YAAY,KAAK;EACjB,SAAS;CACX;AACF,CAAC;;AAGD,MAAaC,UAAQ,OAAO,GAAG,oBAAoB,CAAC,CAAC,WAAW,OAAmB;CACjF,MAAM,EAAE,eAAe,SAAS;CAChC,MAAM,WAAW,OAAOL;CACxB,OAAOI,WAAS,IAAI;CACpB,IAAI,cAAc,eAAe,KAAK,QACpC,OAAO,OAAO,IAAI,mBAAmB,EACnC,SAAS,4CACX,CAAC;CAEH,IAAI,SAAS,OAAO,KAAK,YACvB,OAAO,OAAO,IAAI,mBAAmB,EACnC,SAAS,4CACX,CAAC;CAEH,MAAM,YAAY,KAAK,WAAW,QAAQ,cAAc,UAAU,SAAS,UAAU;CACrF,IAAI,UAAU,SAAS,GACrB,OAAO,OAAO,IAAI,cAAc,EAC9B,cAAc,UAAU,KAAK,EAAE,SAAS,EAAE,EAC5C,CAAC;CAGH,MAAM,UAAU,KAAK,WAAW,OAAA,YAAyB,OAAO,MAAM;CACtE,MAAM,WAAW,IAAI,IAAI,cAAc,YAAY;CACnD,MAAM,UAAU,cAAc,aAAa,QACxC,OAAO,CAAC,QAAQ,MAAM,cAAc,UAAU,OAAO,EAAE,CAC1D;CACA,IAAI,QAAQ,SAAS,GACnB,OAAO,OAAO,IAAI,mBAAmB,EACnC,SAAS,8CAA8C,QAAQ,KAAK,IAAI,IAC1E,CAAC;CAEH,IAAI,CAAC,cAAc,gBAAgB,QAAQ,MAAM,EAAE,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,GAC3E,OAAO,OAAO,IAAI,mBAAmB,EACnC,SAAS,sDACX,CAAC;CAGH,MAAM,cAAc,OAAOL,SAAO;EAChC,cAAc,KAAK,WAAW,KAAK,EAAE,kBAAkB,WAAW;EAClE,MAAM,KAAK;CACb,CAAC;CACD,IAAI,YAAY,WAAW,KAAK,QAC9B,OAAO,OAAO,IAAI,WAAW;EAC3B,oBAAoB,KAAK;EACzB,mBAAmB,YAAY;CACjC,CAAC;CAGH,MAAM,aAGD,CAAC;CACN,KAAK,MAAM,aAAa,SAAS;EAC/B,IAAI,CAAC,SAAS,IAAI,UAAU,EAAE,GAAG;EACjC,OAAO,OAAO,IAAI,aAAa;GAC7B,OAAO,qBAAqB,MAAM,SAAS;GAC3C,MAAM,SAAS,OAAO,SAAS,aAAa,KAAK,MAAM,UAAU,WAAW;GAC5E,WAAW,KAAK;IACd,aAAa,UAAU;IACvB,kBAAkB,OAAO;GAC3B,CAAC;EACH,CAAC,CAAC,CAAC,KACD,OAAO,OAAO,YACZ,WAAW,WAAW,IAClB,OAAO,KAAK,OAAO,IACnBO,cAAY,OAAO,YAAY,SAAS,CAAC,CAAC,KACxC,OAAO,SAAS,YACd,OAAO,KACL,IAAI,kBAAkB;GACpB,UAAU,QAAQ;GAClB,mBAAmB,UAAU;GAC7B,SAAS,eAAe,OAAO;GAC/B;EACF,CAAC,CACH,CACF,CACF,CACN,GACA,OAAO,YAAY,UAAU;GAC3B,IAAI,CAAC,MAAM,kBAAkB,KAAK,KAAK,WAAW,WAAW,GAC3D,OAAO,OAAO,UAAU,KAAK;GAE/B,OAAOA,cAAY,OAAO,YAAY,SAAS,CAAC,CAAC,KAC/C,OAAO,SAAS,YACd,OAAO,KACL,IAAI,kBAAkB;IACpB,UAAU;IACV,mBAAmB,UAAU;IAC7B,SAAS;IACT;GACF,CAAC,CACH,CACF,CACF;EACF,CAAC,CACH;CACF;CACA,OAAO,OAAOA,cAAY,OAAO,YAAY,UAAU;AACzD,CAAC;AAED,SAAgB,yBAAyB,MAA8C;CACrF,OAAO,KAAK,WAAW,KAAK,cAAc;EACxC,MAAM,SAAS,UAAU;EACzB,MAAMC,SAAO,OAAO,QAAQC,KAAe,MAAM,CAAC,CAAC,CAChD,KAAK,CAAC,KAAK,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,CACxC,KAAK,GAAG;EACX,OAAO,GAAG,UAAU,KAAK,YAAY,EAAE,GAAG,OAAO,KAAK,GAAG,OAAO,KAAK,GAAGD,SAAO,KAAK;CACtF,CAAC;AACH;AAEA,SAASD,cACP,OACA,YAIA,QACqC;CACrC,OAAO,MAAM,kBAAkB,KAC7B,OAAO,KAAK,SAAS;EACnB,WAAW,IAAI,KAAK,GAAG;EACvB;EACA,YAAY,MAAM,KAAK;EACvB,YAAY,MAAM,KAAK;EACvB;EACA,SAAS;EACT,MAAM,MAAM,KAAK;CACnB,EAAE,CACJ;AACF;AAEA,SAAS,qBACP,MACA,WACoF;CACpF,OAAOP,SAAO;EACZ,cAAc,CAAC,UAAU,WAAW;EACpC,MAAM,KAAK;CACb,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,gBAAgB;EAC9B,MAAM,mBAAmB,YAAY,WAAW;EAChD,OAAO,kBAAkB,SAAS,YAAY,iBAAiB,OAAO,UAAU,KAC5E,OAAO,OACP,OAAO,KACL,IAAI,WAAW;GACb,oBAAoB,KAAK;GACzB,mBAAmB,YAAY;EACjC,CAAC,CACH;CACN,CAAC,CACH;AACF;AAEA,SAAS,qBACP,aACA,aAC8D;CAC9D,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,WAAW,YAAY,QAAQ,WAAW,OAAO,SAAS,YAAY,IAAI;EAChF,MAAM,UAAU,SAAS,QACtB,WACC,OAAO,SAAS,YAAY,OAAO,SAAS,YAAY,IAC5D;EACA,MAAM,QAAQ,QAAQ,MAAM,WAAWU,OAAiB,QAAQ,WAAW,CAAC;EAC5E,MAAM,KAAK,OAAO,cAAc,mBAAmB,EAAE,YAAY,CAAC;EAClE,IAAI,UAAU,KAAA,GACZ,OAAO;GACL,MAAM;GACN;GACA;GACA,UAAU,MAAM,QAAQ,YAAY;EACtC;EAKF,IAFE,SAAS,SAAS,MACjB,YAAY,SAAS,WAAW,SAAS,MAAM,WAAW,OAAO,SAAS,OAAO,IAElF,OAAO;GACL,MAAM;GACN,UAAU;GACV;GACA,QAAQ;GACR;EACF;EAEF,IACE,QAAQ,SAAS,MAChB,YAAY,WAAW,eAAe,QAAQ,MAAM,EAAE,aAAa,WAAW,WAAW,IAE1F,OAAO;GACL,MAAM;GACN,UAAU;GACV;GACA,QAAQ;GACR;EACF;EAEF,OAAO;GAAE,MAAM;GAAU;GAAI;EAAY;CAC3C,CAAC;AACH;AAEA,SAAgBL,WACd,MACoD;CACpD,MAAM,WAA+C;EACnD,YAAY,KAAK;EACjB,YAAY,KAAK;EACjB,SAAS,KAAK;EACd,MAAM,KAAK;CACb;CACA,OAAO,cAAcX,gBAAc,QAAQ,CAAC,CAAC,KAC3C,OAAO,SAAS,WACd,WAAW,KAAK,SACZ,OAAO,OACP,OAAO,KACL,IAAI,mBAAmB,EACrB,SAAS,0CACX,CAAC,CACH,CACN,CACF;AACF;AAEA,SAAS,eAAe,SAA2C;CACjE,OAAO,QAAQ,SAAS,mBACpB,uDACA,QAAQ;AACd;AAEA,SAAS,eAAe,MAA0B,OAAmC;CACnF,MAAM,SAASC,OAAE,WAAWgB,QAAkB;CAC9C,MAAM,SAAShB,OAAE,kBAAkBA,OAAE,IAAI;CACzC,MAAM,WAAW,UAAU,OAAO,OAAO,IAAI,CAAC,CAAC;CAC/C,MAAM,YAAY,UAAU,OAAO,OAAO,KAAK,CAAC,CAAC;CACjD,OAAO,WAAW,YAAY,KAAK,WAAW,YAAY,IAAI;AAChE;;;;ACtWA,MAAaiB,cAAY,OAAO,GAAG,mCAAmC,CAAC,CAAC,WAAW,OAOhF;CACD,MAAM,SAAS,OAAO,OAAO,IAAI;EAC/B,WACEC,YAAuB,MAAM,YAAY,MAAM,eAAe;GAC5D,YAAY;GACZ,QAAQ,MAAM;GACd,YAAY,MAAM,KAAK;EACzB,CAAC;EACH,QAAQ,UACN,iBAAiBC,wBAAiC,iBAAiBC,UAC/D,QACA,IAAID,qBAA8B,EAAE,SAAS,8BAA8B,CAAC;CACpF,CAAC;CACD,MAAM,gBAAgB,OAAOE,YAC3B,MAAM,MACN,MAAM,cACN,MAAM,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc,MAAM,aAAa,CAC7E;CACA,MAAM,WAAW,IAAI,IAAI,cAAc,YAAY;CAQnD,IAPqB,MAAM,KAAK,WAAW,QACxC,cACC,UAAU,SAAS,YACnB,SAAS,IAAI,UAAU,EAAE,KACzB,UAAU,YAAY,SAAS,UAC/B,CAAC,UAAU,YAAY,KAAK,SAAS,IAAI,QAAQ,CAEtC,CAAC,CAAC,SAAS,GACxB,OAAO,OAAO,IAAIF,qBAA8B,EAC9C,SAAS,kDAAkD,SAC7D,CAAC;CAEH,OAAO;AACT,CAAC;;;;;;;;;;;;;;;ACtCD,MAAa,YAAYG,OAAE,OAAO;CAChC,IAAIA,OAAE;CACN,kBAAkBA,OAAE;CACpB,QAAQC;AACV,CAAC;AAGD,MAAM,eAAeD,OAAE,OAAO;CAC5B,WAAWA,OAAE;CACb,WAAWA,OAAE;CACb,YAAYA,OAAE,MAAM,SAAS;CAC7B,YAAYA,OAAE;CACd,kBAAkBA,OAAE;CACpB,SAASA,OAAE,QAAQ,4BAA4B;CAC/C,MAAME;AACR,CAAC;AAED,MAAa,OAAOF,OAAE,OAAO;CAAE,GAAG,aAAa;CAAQ,QAAQA,OAAE;AAAO,CAAC;AAGzE,MAAa,gBAAgBA,OAAE,OAAO;CACpC,cAAcA,OAAE,MAAMA,OAAE,MAAM;CAC9B,YAAYA,OAAE;CACd,SAASA,OAAE,QAAQ,qCAAqC;AAC1D,CAAC;AAGD,MAAa,UAAUA,OAAE,OAAO;CAC9B,WAAWA,OAAE;CACb,YAAYA,OAAE,MAAMA,OAAE,OAAO;EAAE,aAAaA,OAAE;EAAQ,kBAAkBA,OAAE;CAAO,CAAC,CAAC;CACnF,YAAYA,OAAE;CACd,YAAYA,OAAE;CACd,QAAQA,OAAE,SAAS,CAAC,YAAY,SAAS,CAAC;CAC1C,SAASA,OAAE,QAAQ,+BAA+B;CAClD,MAAME;AACR,CAAC;AAGD,IAAaC,UAAb,cAA2BH,OAAE,YAAmB,CAAC,CAAC,uBAAuB;CACvE,SAASA,OAAE;CACX,aAAaA,OAAE,YAAYA,OAAE,MAAM;AACrC,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,eAAb,cAAkCA,OAAE,YAA0B,CAAC,CAAC,wBAAwB;CACtF,mBAAmBA,OAAE;CACrB,SAASA,OAAE;CACX,SAAS;AACX,CAAC,CAAC,CAAC,CAAC;;AASJ,MAAa,SAAS,OAAO,GAAG,iBAAiB,CAAC,CAAC,WAAW,OAAoB;CAChF,MAAM,WAAW,OAAOI;CACxB,OAAOC,WAAsB,MAAM,IAAI;CACvC,IACE,MAAM,QAAQ,eAAe,MAAM,KAAK,UACxC,MAAM,QAAQ,eAAe,MAAM,KAAK,cACxC,MAAM,QAAQ,SAAS,MAAM,KAAK,MAElC,OAAO,OAAO,IAAIF,QAAM,EAAE,SAAS,oDAAoD,CAAC;CAE1F,IAAI,SAAS,OAAO,MAAM,KAAK,YAC7B,OAAO,OAAO,IAAIA,QAAM,EAAE,SAAS,6CAA6C,CAAC;CAEnF,MAAM,aAAa,OAAO,OAAO,QAAQ,MAAM,QAAQ,aAAa,YAClE,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,MAAM,KAAK,WAAW,MAClC,cAAc,UAAU,SAAS,YAAY,UAAU,OAAO,QAAQ,WACzE;EACA,IAAI,WAAW,KAAA,KAAa,OAAO,SAAS,UAC1C,OAAO,OAAO,IAAIA,QAAM;GACtB,SAAS;GACT,aAAa,QAAQ;EACvB,CAAC;EAEH,IAAI,QAAQ,qBAAqB,MAC/B,OAAO,OAAO,IAAIA,QAAM;GACtB,SAAS;GACT,aAAa,QAAQ;EACvB,CAAC;EAEH,OAAO,YACL,UACA,MAAM,KAAK,MACX,QAAQ,kBACR,OAAO,aACP,OAAO,EACT;EACA,OAAO;GACL,IAAI,OAAO;GACX,kBAAkB,QAAQ;GAC1B,QAAQ,OAAO;EACjB;CACF,CAAC,CACH;CACA,MAAM,MAAM,OAAO,MAAM;CACzB,MAAM,WAA+C;EACnD,WAAW,IAAI,KAAK,GAAG;EACvB,WAAW,IAAI,KAAK,OAAO,MAAM,SAAS,IAAY;EACtD;EACA,YAAY,MAAM,KAAK;EACvB,kBAAkB,MAAM,KAAK;EAC7B,SAAS;EACT,MAAM,MAAM,KAAK;CACnB;CACA,OAAO;EAAE,GAAG;EAAU,QAAQ,OAAO,cAAc,cAAc,QAAQ;CAAE;AAC7E,CAAC;;AAGD,MAAa,YAAY,OAAO,GAAG,oBAAoB,CAAC,CAAC,WACvD,MACA,cACA;CACA,OAAO,SAAS,IAAI;CACpB,MAAM,WAAW,CAAC,GAAG,IAAI,IAAI,gBAAgB,KAAK,WAAW,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK;CACxF,MAAM,UAAU,SAAS,QACtB,OAAO,CAAC,KAAK,WAAW,MAAM,cAAc,UAAU,OAAO,EAAE,CAClE;CACA,IAAI,QAAQ,SAAS,GACnB,OAAO,OAAO,IAAIA,QAAM,EAAE,SAAS,mCAAmC,QAAQ,KAAK,IAAI,IAAI,CAAC;CAE9F,OAAO;EACL,cAAc;EACd,YAAY,KAAK;EACjB,SAAS;CACX;AACF,CAAC;;AAGD,MAAa,QAAQ,OAAO,GAAG,gBAAgB,CAAC,CAAC,WAAW,OAIzD;CACD,MAAM,WAAW,OAAOC;CACxB,OAAO,SAAS,MAAM,IAAI;CAC1B,IAAI,MAAM,cAAc,eAAe,MAAM,KAAK,QAChD,OAAO,OAAO,IAAID,QAAM,EAAE,SAAS,qDAAqD,CAAC;CAE3F,IAAI,SAAS,OAAO,MAAM,KAAK,YAC7B,OAAO,OAAO,IAAIA,QAAM,EAAE,SAAS,4CAA4C,CAAC;CAElF,MAAM,MAAM,OAAO,MAAM;CACzB,IAAI,MAAM,KAAK,aAAa,IAAI,KAAK,GAAG,GACtC,OAAO,OAAO,IAAIA,QAAM,EAAE,SAAS,4BAA4B,CAAC;CAElE,MAAM,WAAW,MAAM,KAAK,WAAW,QAAQ,EAAE,SAC/C,MAAM,cAAc,aAAa,SAAS,EAAE,CAC9C;CACA,IAAI,SAAS,WAAW,MAAM,cAAc,aAAa,QACvD,OAAO,OAAO,IAAIA,QAAM,EAAE,SAAS,qDAAqD,CAAC;CAE3F,MAAM,oBAAoB,OAAO,qBAAqB,MAAM,MAAM,MAAM,YAAY;CACpF,MAAM,eAAe,IAAI,IAAI,kBAAkB,KAAK,EAAE,kBAAkB,WAAW,CAAC;CACpF,IACE,kBAAkB,MACf,EAAE,kBAAkB,CAAC,MAAM,cAAc,aAAa,SAAS,WAAW,CAC7E,GAEA,OAAO,OAAO,IAAIA,QAAM,EAAE,SAAS,mDAAmD,CAAC;CAEzF,MAAM,YAAY,SAAS,QAAQ,EAAE,SAAS,CAAC,aAAa,IAAI,EAAE,CAAC;CACnE,OAAO,OAAO,QAAQ,YAAY,cAChC,YACE,UACA,MAAM,KAAK,MACX,UAAU,kBACV,UAAU,QACV,UAAU,EACZ,CACF;CAEA,MAAM,UAAoE,CAAC,GAAG,iBAAiB;CAC/F,KAAK,MAAM,aAAa,WAAW;EACjC,MAAM,UAAU,OAAO,OAAO,IAAI,aAAa;GAC7C,OAAO,YACL,UACA,MAAM,KAAK,MACX,UAAU,kBACV,UAAU,QACV,UAAU,EACZ;GACA,OAAO,SAAS,aAAa,MAAM,KAAK,MAAM,UAAU,gBAAgB;GACxE,QAAQ,KAAK;IAAE,aAAa,UAAU;IAAI,kBAAkB,UAAU;GAAiB,CAAC;EAC1F,CAAC,CAAC,CAAC,KAAK,OAAO,MAAM;GAAE,YAAY,UAAU;GAAO,iBAAiB;EAAK,CAAC,CAAC;EAC5E,IAAI,YAAY,MAAM;GACpB,IAAI,QAAQ,WAAW,GAAG,OAAO,OAAO;GACxC,OAAO,OAAO,IAAI,aAAa;IAC7B,mBAAmB,UAAU;IAC7B,SAAS,QAAQ;IACjB,SAAS,OAAO,YAAY,MAAM,MAAM,SAAS,SAAS;GAC5D,CAAC;EACH;CACF;CACA,OAAO,OAAO,YAAY,MAAM,MAAM,SAAS,UAAU;AAC3D,CAAC;AAED,SAAgB,SAAS,MAAqE;CAC5F,MAAM,WAA+C;EACnD,WAAW,KAAK;EAChB,WAAW,KAAK;EAChB,YAAY,KAAK;EACjB,YAAY,KAAK;EACjB,kBAAkB,KAAK;EACvB,SAAS,KAAK;EACd,MAAM,KAAK;CACb;CACA,OAAO,cAAc,cAAc,QAAQ,CAAC,CAAC,KAC3C,OAAO,SAAS,WACd,WAAW,KAAK,SACZ,OAAO,OACP,OAAO,KAAK,IAAIA,QAAM,EAAE,SAAS,mDAAmD,CAAC,CAAC,CAC5F,CACF;AACF;AAEA,SAAS,qBACP,MACA,SACwF;CACxF,IAAI,YAAY,KAAA,GAAW,OAAO,OAAO,QAAQ,CAAC,CAAC;CACnD,IACE,QAAQ,eAAe,KAAK,UAC5B,QAAQ,eAAe,KAAK,cAC5B,QAAQ,SAAS,KAAK,QACtB,QAAQ,WAAW,WAEnB,OAAO,OAAO,KACZ,IAAIA,QAAM,EAAE,SAAS,sDAAsD,CAAC,CAC9E;CAEF,KAAK,MAAM,aAAa,QAAQ,YAAY;EAC1C,MAAM,YAAY,KAAK,WAAW,MAAM,EAAE,SAAS,OAAO,UAAU,WAAW;EAC/E,IAAI,cAAc,KAAA,KAAa,UAAU,qBAAqB,UAAU,kBACtE,OAAO,OAAO,KACZ,IAAIA,QAAM,EAAE,SAAS,2DAA2D,CAAC,CACnF;CAEJ;CACA,OAAO,OAAO,QAAQ,CAAC,GAAG,QAAQ,UAAU,CAAC;AAC/C;AAEA,SAAS,YACP,UACA,MACA,kBACA,UACA,aACgD;CAChD,OAAO,SAAS,UAAU,MAAM,gBAAgB,CAAC,CAAC,KAChD,OAAO,SAAS,aACd,aAAa,QAAQ,SAAS,SAAS,YAAYG,OAAiB,UAAU,QAAQ,IAClF,OAAO,OACP,OAAO,KACL,IAAIH,QAAM;EACR,SACE,aAAa,OACT,oCACA;EACN;CACF,CAAC,CACH,CACN,CACF;AACF;AAEA,SAAS,YACP,MACA,YACA,QACwB;CACxB,OAAO,MAAM,kBAAkB,KAC7B,OAAO,KAAK,SAAS;EACnB,WAAW,IAAI,KAAK,GAAG;EACvB;EACA,YAAY,KAAK;EACjB,YAAY,KAAK;EACjB;EACA,SAAS;EACT,MAAM,KAAK;CACb,EAAE,CACJ;AACF;;;;ACnSA,MAAM,mBAAmB,OAAO,OAAO,KACrC,OAAO,SACL,OAAO,QACP,qBAAqB,UAAU;CAC7B,SAAS,UAAU,MAAM,KAAK,CAAC,CAAC,YAAY;CAC5C,SAAS,UAAU;AACrB,CAAC,CACH,CACF;AAEA,MAAM,kBAAkB,OAAO,OAAO,KACpC,OAAO,SACL,OAAO,QACP,qBAAqB,gBAAgB;CACnC,SAAS,OAAO,YACd,OAAO,IAAI;EACT,WAAWI,QAAiB,KAAK,CAAC,CAAC,SAAS;EAC5C,QAAQ,UACN,IAAI,YAAY,aACd,EAAE,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAClE,OACA,OACF;CACJ,CAAC;CACH,SAAS,UAAU,OAAO,QAAQ,KAAK;AACzC,CAAC,CACH,CACF;AAEA,MAAM,cAAc,gBAAgB,GAAG,CAAC;AACxC,MAAM,eAAe,gBAAgB,GAAG,CAAC;AAEzC,MAAM,eAAe,OAAO,OAAO,KACjC,OAAO,SACL,OAAO,QACP,qBAAqB,UAAU;CAC7B,SAAS,UAAU;EACjB,MAAM,UAAU,MAAM,KAAK;EAC3B,MAAM,SAAS,CAAC,GAAG,QAAQ,SAAS,oBAAoB,CAAC;EACzD,OAAO,OAAO,WAAW,IACrB,UACA,OACG,KAAK,WAAW,MAAM,MAAM,GAAA,CAAI,QAAQ,QAAQ,IAAG,CAAC,CAAC,QAAQ,SAAS,IAAI,CAAC,CAAC,CAC5E,KAAK,EAAE;CAChB;CACA,SAAS,UAAU;AACrB,CAAC,CACH,CACF;AAEA,MAAM,eAAe,OAAO,OAAO,KACjC,OAAO,SACL,OAAO,QACP,qBAAqB,UAAU;CAC7B,SAAS,UAAU,MAAM,KAAK,CAAC,CAAC,QAAQ,mBAAmB,KAAK;CAChE,SAAS,UAAU;AACrB,CAAC,CACH,CACF;AAEA,SAAgB,MAAM,MAAsB,OAAwB;CAClE,MAAM,gBAAgB;EACpB,QAAQ,MAAR;GACE,KAAK;GACL,KAAK,QACH,OAAO;GACT,KAAK;GACL,KAAK,MACH,OAAO;GACT,KAAK,MACH,OAAO;GACT,KAAK,OACH,OAAO;GACT,KAAK,OACH,OAAO;GACT,KAAK,OACH,OAAO;EACX;CACF,EAAA,CAAG;CACH,IAAI;EACF,OAAO,OAAO,kBAAkB,MAAM,CAAC,CAAC,KAAK;CAC/C,SAAS,OAAO;EACd,MAAM,IAAIC,QAAkB,EAC1B,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAChE,CAAC;CACH;AACF;AAEA,SAAS,gBAAgB,QAAgB,aAAqB;CAC5D,OAAO,OAAO,OAAO,KACnB,OAAO,SACL,OAAO,QACP,qBAAqB,gBAAgB;EACnC,SAAS,OAAO,YACd,OAAO,IAAI;GACT,WAAW;IACT,MAAM,QAAQ,MAAM,KAAK,CAAC,CAAC,MAAM,KAAK;IACtC,IAAI,MAAM,WAAW,QACnB,MAAM,IAAI,MAAM,4CAA4C;IAC9D,MAAM,SAAS,MAAM;IACrB,IAAI,WAAW,KAAA,GAAW,MAAM,IAAI,MAAM,8BAA8B;IACxE,MAAM,eAAeD,QAAiB,MAAM;IAC5C,OAAO,MAAM,KAAK,GAAG;GACvB;GACA,QAAQ,UACN,IAAI,YAAY,aACd,EAAE,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAClE,OACA,OACF;EACJ,CAAC;EACH,SAAS,UAAU,OAAO,QAAQ,KAAK;CACzC,CAAC,CACH,CACF;AACF;;;;;;;;ACzGA,SAAgBE,OAAK,SAAyC;CAC5D,MAAM,QAAQ,QAAQ,SAAS,WAAW;CAC1C,MAAM,YAAY,QAAQ,aAAa;CACvC,OAAO,EACL,SAAS,OAAO,GAAG,sBAAsB,CAAC,EAAE,UAC1C,OAAO,WAAW;EAChB,MAAM,iBACJ,QAAQ;GAAE;GAAc;GAAO;GAAO;GAAW,UAAU,QAAQ;EAAS,CAAC;EAC/E,QAAQ,UACN,iBAAiBC,UACb,QACA,IAAIA,QAAkB;GACpB;GACA,SAAS,iBAAiB,QAAQ,MAAM,UAAU;GAClD,QAAQ;EACV,CAAC;CACT,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,iBAAiB,OAAO,OAAO,CAAC,CAAC,CACvE,EACF;AACF;AAEA,MAAaC,WAAS,YACpB,MAAM,QAAQC,WAAqBH,OAAK,OAAO,CAAC;AAElD,MAAaI,aAAW,YACtBC,UAAoBL,OAAK,OAAO,CAAC;AAEnC,SAAS,iBACP,OACA,SAC0D;CAC1D,OAAO,OAAO,IAAI;EAChB,WAAW,UAAU,OAAO,OAAO;EACnC,QAAQ,UACN,IAAIC,QAAkB;GACpB;GACA,SAAS;GACT,QAAQ;EACV,CAAC;CACL,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,WAAW,eAAe,OAAO,MAAM,CAAC,GACxD,OAAO,QAAQ,YAAY,CAC7B;AACF;AAEA,SAAS,aACP,QAC0D;CAC1D,IAAI,OAAO,UAAU,YACnB,OAAO,OAAO,QAAQ,EAAE,MAAM,SAAS,CAAC;CAE1C,IAAI,OAAO,UAAU,WACnB,OAAO,OAAO,KACZ,IAAIA,QAAkB;EACpB,SAAS,yBAAyB,OAAO,SAAS;EAClD,QAAQ;CACV,CAAC,CACH;CAEF,IAAI,OAAO,YAAY,KAAA,KAAa,OAAO,QAAQ,WAAW,GAC5D,OAAO,OAAO,QAAQ,EAAE,MAAM,SAAS,CAAC;CAE1C,OAAO,OAAO,QAAQ,OAAO,SAAS,cAAc,EAAE,aAAa,YAAY,CAAC,CAAC,CAAC,KAChF,OAAO,KAAK,YAAoC;EAC9C,MAAM,mBAAmB,QAAQ,QAAQ,WAAW,WAAW,IAAI;EACnE,OAAO,iBAAiB,WAAW,IAC/B,EAAE,MAAM,SAAS,IACjB;GAAE,MAAM;GAAU,SAAS;EAAiB;CAClD,CAAC,CACH;AACF;AAEA,SAAS,eACP,OACA,QACoD;CACpD,OAAO,OAAO,IAAI;EAChB,WAAW;GACT,IAAI,OAAO,SAAS,YAAY,MAAM,IAAI,MAAM,0BAA0B;GAC1E,IAAI,OAAO,OAAO,GAAG,MAAM,IAAI,MAAM,4CAA4C;GACjF,IAAI,OAAO,SAAS,MAAM,IAAI,MAAM,uCAAuC;GAC3E,MAAM,YAAY,OAAO,aAAa,CAAC;GACvC,IAAI,UAAU,WAAW,GAAG,MAAM,IAAI,MAAM,2CAA2C;GACvF,MAAM,WAAW,UAAU;GAC3B,IAAI,aAAa,KAAA,GAAW,MAAM,IAAI,MAAM,uCAAuC;GACnF,IACE,SAAS,UAAU,QACnB,SAAS,SAAS,MAAM,QACxBK,QAAiB,SAAS,IAAI,MAAM,MAAM,MAE1C,MAAM,IAAI,MAAM,6CAA6C;GAE/D,OAAO;EACT;EACA,QAAQ,UACN,IAAIL,QAAkB;GACpB;GACA,SAAS,iBAAiB,QAAQ,MAAM,UAAU;GAClD,QAAQ;EACV,CAAC;CACL,CAAC;AACH;AAEA,SAAS,aACP,QAC6D;CAC7D,OAAO,OAAO,IAAI,aAAa;EAC7B,IAAI,OAAO,UAAU,MAAM,OAAO;EAClC,MAAM,UAAU,OAAO,OAAO,IAAI;GAChC,WAAW,WAAW,MAAM;GAC5B,QAAQ,UACN,IAAIA,QAAkB;IACpB;IACA,SAAS;IACT,QAAQ;GACV,CAAC;EACL,CAAC;EACD,IAAI,YAAY,KAAA,GAAW,OAAO;EAClC,MAAM,OAAO,OAAOM,SAAkB,OAAO,IAAI;EACjD,MAAM,OAAO,OAAO,OAAO,IAAI;GAC7B,WAAWC,MAAc,QAAQ,MAAM,QAAQ,IAAI;GACnD,QAAQ,UACN,IAAIP,QAAkB;IACpB;IACA,SAAS;IACT,QAAQ;GACV,CAAC;EACL,CAAC;EACD,IAAI,OAAO,QAAQ,KAAA,GACjB,OAAO,OAAO,IAAIA,QAAkB;GAClC,SAAS;GACT,QAAQ;EACV,CAAC;EAEH,OAAO;GAAE;GAAM;GAAM,KAAK,OAAO;GAAK,MAAM,QAAQ;EAAK;CAC3D,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,iBAAiBA,UACb,QACA,IAAIA,QAAkB;EAAE;EAAO,SAAS,MAAM;EAAS,QAAQ;CAAW,CAAC,CACjF,CACF;AACF;AAEA,SAAS,WACP,QACsE;CACtE,QAAQ,OAAO,MAAf;EACE,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,MACH,OAAO;GAAE,MAAM,OAAO;GAAM,MAAM,OAAO;EAAK;EAChD,KAAK,OACH,OAAO;GACL,MAAM,GAAG,OAAO,KAAK,SAAS,EAAE,GAAG,OAAO,KAAK,IAAI,GAAG,OAAO,KAAK;GAClE,MAAM,OAAO;EACf;EACF,KAAK,MACH,OAAO;GACL,MAAM,GAAG,eAAe,OAAO,KAAK,YAAY,eAAe,EAAE,GAAG,OAAO,KAAK;GAChF,MAAM,OAAO;EACf;EACF,KAAK,OACH,OAAO;GACL,MAAM;IACJ,eAAe,OAAO,KAAK,UAAU,cAAc;IACnD,eAAe,OAAO,KAAK,QAAQ,YAAY;IAC/C,eAAe,OAAO,KAAK,MAAM,UAAU;IAC3C,OAAO,KAAK;GACd,CAAC,CAAC,KAAK,GAAG;GACV,MAAM,OAAO;EACf;EACF,KAAK,OACH,OAAO;GAAE,MAAM,UAAU,OAAO,IAAI;GAAG,MAAM,OAAO;EAAK;EAC3D,SACE;CACJ;AACF;AAEA,SAAS,UAAU,MAAiC;CAElD,MAAM,WADS,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,IAAI,EAAA,CAC1B,KAAK,UAC1B,OAAO,UAAU,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,IAAI,KAChE;CACA,MAAM,SAAS,QAAQ,QAAQ,OAAO,UAAU,QAAQ,MAAM,QAAQ,CAAC;CACvE,MAAM,SAAS,IAAI,WAAW,MAAM;CACpC,IAAI,SAAS;CACb,KAAK,MAAM,SAAS,SAAS;EAC3B,OAAO,IAAI,OAAO,MAAM;EACxB,UAAU,MAAM;CAClB;CACA,OAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,MAAM;AAChE;AAEA,SAAS,eAAe,OAA2B,OAAuB;CACxE,IAAI,UAAU,KAAA,GAAW,MAAM,IAAI,MAAM,wBAAwB,OAAO;CACxE,OAAO;AACT;AAEA,eAAe,QAAQ,OAMC;CACtB,MAAM,aAAa,IAAI,gBAAgB;CACvC,IAAI,WAAW;CACf,MAAM,wBAAwB,WAAW,MAAM,MAAM,aAAa,MAAM;CACxE,MAAM,sBAAsB,WAAW,MAAM,MAAM,MAAM,QAAQ,MAAM;CACvE,MAAM,aAAa,iBAAiB,SAAS,iBAAiB,EAAE,MAAM,KAAK,CAAC;CAC5E,MAAM,MAAM,QAAQ,iBAAiB,SAAS,eAAe,EAAE,MAAM,KAAK,CAAC;CAC3E,MAAM,QAAQ,iBAAiB;EAC7B,WAAW;EACX,WAAW,sBAAM,IAAI,MAAM,0BAA0B,CAAC;CACxD,GAAG,MAAM,SAAS;CAClB,IAAI;EACF,MAAM,QAAQ,WAAW,KACvB,UAAU,OAAO;GACf,OAAO,UAAU;GACjB,IAAI;GACJ,WAAW,CAAC;IAAE,MAAM,MAAM,MAAM;IAAM,MAAM,MAAM,MAAM;GAAK,CAAC;GAC9D,MAAM;EACR,CAAC,CACH;EACA,MAAM,WAAW,MAAM,MAAM,MAAM,IAAI,IAAI,MAAM,QAAQ,GAAG;GAC1D,MAAM;GACN,SAAS;IACP,QAAQ;IACR,gBAAgB;GAClB;GACA,QAAQ;GACR,QAAQ,WAAW;EACrB,CAAC;EACD,IAAI,CAAC,SAAS,IACZ,MAAM,IAAIA,QAAkB;GAC1B,SAAS,qBAAqB,SAAS;GACvC,QAAQ;EACV,CAAC;EAEH,MAAM,cAAc,SAAS,QAC1B,IAAI,cAAc,CAAC,EAClB,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAChB,KAAK,CAAC,CACP,YAAY;EACf,IAAI,gBAAgB,2BAClB,MAAM,IAAIA,QAAkB;GAC1B,SAAS,yCAAyC,eAAe;GACjE,QAAQ;EACV,CAAC;EAEH,OAAO,IAAI,WAAW,MAAM,SAAS,YAAY,CAAC;CACpD,SAAS,OAAO;EACd,IAAI,UACF,MAAM,IAAIA,QAAkB;GAAE,SAAS;GAAuB,QAAQ;EAAU,CAAC;EAEnF,MAAM;CACR,UAAU;EACR,aAAa,KAAK;EAClB,MAAM,aAAa,oBAAoB,SAAS,eAAe;EAC/D,MAAM,MAAM,QAAQ,oBAAoB,SAAS,aAAa;CAChE;AACF;;;;;;;;AClRA,MAAM,WAAW;AAMjB,SAAgB,KAAK,UAAmB,CAAC,GAA0B;CACjE,OAAOQ,OAAkB;EAAE,GAAG;EAAS,UAAU,QAAQ,YAAY;CAAS,CAAC;AACjF;AAEA,MAAa,SAAS,UAAmB,CAAC,MACxC,MAAM,QAAQC,WAAqB,KAAK,OAAO,CAAC;AAElD,MAAa,WAAW,UAAmB,CAAC,MAC1CC,UAAoB,KAAK,OAAO,CAAC;;;;;;;;;ACXnC,MAAa,sBAAsB,OAAO,YAAY;CACpD,OAAO,CAAC;CACR,SAAS,CAAC;CACV,UAAU,EAAE,SAAS,OAAO,MAAMC,QAAgB,EAAE;CACpD,SAAS,EAAE,SAAS,OAAO,OAAO;AACpC,CAAC;AAGD,MAAa,uBAAuB,OAAO,YAAY;CACrD,YAAY,CAAC;CACb,SAAS,CAAC;CACV,UAAU,EAAE,SAAS,OAAO,MAAM,OAAO,MAAM,EAAE;CACjD,SAAS,CAAC;CACV,SAAS,EAAE,SAAS,OAAO,OAAO;AACpC,CAAC;AAGD,MAAa,SAAS,OAAO,OAAO;CAClC,UAAU;CACV,WAAW;CACX,QAAQ,OAAO,SAAS;EAAC;EAAY;EAAW;EAAY;CAAa,CAAC;AAC5E,CAAC;AAGD,MAAa,SAAS,OAAO,GAAG,qBAAqB,CAAC,CAAC,WAAW,OAG/D;CACD,MAAM,WAAW,OAAOC;CACxB,MAAM,WAAW,OAAOC;CACxB,MAAM,CAAC,qBAAqB,aAAa,OAAO,OAAO,IACrD,CACE,gBAAgB,UAAU,MAAM,MAAM,MAAM,MAAM,CAAC,CAAC,KAClD,OAAO,OAAO,YACZ,OAAO,QAA6B;EAAE,MAAM;EAAW,SAAS,QAAQ;CAAQ,CAAC,CACnF,CACF,GACA,SAAS,QAAQ;EAAE,MAAM,MAAM,OAAO;EAAM,MAAM,MAAM,OAAO;CAAK,CAAC,CAAC,CAAC,KACrE,OAAO,MAAM;EACX,YAAY,YACV,QAAQ,WAAW,YACf,EAAE,MAAM,UAAU,IAClB;GAAE,MAAM;GAAW,SAAS,QAAQ;EAAQ;EAClD,YAAY,eAAe,iBAAiB,MAAM,QAAQ,UAAU;CACtE,CAAC,CACH,CACF,GACA,EAAE,aAAa,YAAY,CAC7B;CAWA,OAAO;EAAE,UAAU;EAAqB;EAAW,QATjD,oBAAoB,SAAS,WAAW,UAAU,SAAS,eACvD,aACA,oBAAoB,SAAS,aAC3B,UAAU,SAAS,aACnB,UAAU,SAAS,YACnB,gBACA,oBAAoB,SAAS,cAAc,UAAU,SAAS,aAC5D,aACA;CACgD;AAC5D,CAAC;AAED,SAAS,gBACP,UACA,MACA,aACuD;CACvD,OAAO,SAAS,YAAY,IAAI,CAAC,CAAC,KAChC,OAAO,KAAK,YAAiC;EAC3C,IACE,QAAQ,MACL,aAAa,SAAS,SAAS,YAAYC,OAAiB,UAAU,WAAW,CACpF,GAEA,OAAO,EAAE,MAAM,QAAQ;EAEzB,MAAM,UAAU,QAAQ,QACrB,aACC,SAAS,SAAS,YAClB,SAAS,SAAS,YAAY,QAC9B,SAAS,SAAS,YAAY,IAClC;EACA,OAAO,QAAQ,WAAW,IAAI,EAAE,MAAM,UAAU,IAAI;GAAE,MAAM;GAAY,SAAS;EAAQ;CAC3F,CAAC,CACH;AACF;AAEA,SAAS,iBACP,aACA,YACsB;CACtB,IAAI,WAAW,SAAS,UAAU,OAAO,EAAE,MAAM,UAAU;CAC3D,MAAM,WAAWC,MAAc,YAAY,MAAM,YAAY,WAAW,CAAC;CACzE,OAAO,WAAW,QAAQ,MACvB,WACC,OAAO,SAAS,YAAY,QAC5B,OAAO,SAAS,YAAY,QAC5BA,MAAc,OAAO,MAAM,OAAO,IAAI,MAAM,QAChD,IACI,EAAE,MAAM,aAAa,IACrB;EAAE,MAAM;EAAY,SAAS,WAAW,QAAQ,KAAK,EAAE,WAAW,IAAI;CAAE;AAC9E;AAEA,SAAS,YAAY,aAA0C;CAC7D,MAAMC,SAAOC,KAAe,WAAW;CACvC,QAAQ,YAAY,MAApB;EACE,KAAK;EACL,KAAK,QACH,OAAO,OAAOD,OAAK,OAAO;EAC5B,KAAK;EACL,KAAK,MACH,OAAO,OAAOA,OAAK,MAAM;EAC3B,KAAK,OACH,OAAO,OAAOA,OAAK,KAAK;EAC1B,KAAK,MACH,OAAO,GAAGA,OAAK,SAAS,GAAGA,OAAK;EAClC,KAAK,OACH,OAAO,GAAGA,OAAK,MAAM,GAAGA,OAAK,IAAI,GAAGA,OAAK;EAC3C,KAAK,OACH,OAAO,GAAGA,OAAK,SAAS,GAAGA,OAAK,OAAO,GAAGA,OAAK,KAAK,GAAGA,OAAK;CAChE;AACF"}