domainkit 0.6.0 → 0.7.0

package/dist/verify-DAtUAEeg.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"verify-DAtUAEeg.mjs","names":["S","Schema","decode","InvalidInputError","make","DomainName.Schema","DomainName.parse","Zones.candidates","Connection.authorizationError","DnsProvider.fromAsync","toAsync","DnsProvider.toAsync","DnsProvider.Error","Lifecycle.Service","Connection.authorizationError","Connection.assertAttachment","Connection.AuthorizationError","InvalidInputError","Provisioning.authorize","Secret.make","failure","clientAuthentication","Connection.Error","ErrorDetail","S","Record","RecordListEnvelope","Data","S","decode","DomainName.decode","decodeOpaque","failure","DnsRecord.decode","DnsRecord.Opaque","encode","DnsProvider.Error","discovery","failure","reason","decode","Protocol.ZoneListEnvelope","Protocol.TokenEnvelope","Zones.candidates","make","makeClient","Protocol.RecordListEnvelope","Records.decode","Records.encode","Protocol.RecordEnvelope","projectZone","candidates","DomainName.decode","S","Protocol.BaseEnvelope","DnsProvider.Error","Context","contextCodec","ProviderContext.codec","tokenMethod","manifest","Client.discoverAuthorizationAccount","Client.make","Client.validateDomainToken","tokenConnectionMethod","restore","failure","Connection.Error","AuthorizationCode.complete","Secret.make","AuthorizationCode.start","DnsProvider.Error","S","decode","DomainName.decode","DnsRecord.decode","failure","S","DnsRecord.Opaque","DnsProvider.Error","make","failure","Protocol.TeamListEnvelope","Protocol.DomainListEnvelope","Protocol.DomainConfig","Protocol.DomainEnvelope","DomainName.decode","Protocol.RecordListEnvelope","Records.decode","Records.encode","DnsProvider.Error","Protocol.CreateRecordEnvelope","Protocol.UserEnvelope","Zones.candidates","candidates","S","Protocol.ErrorEnvelope","Context","S","ProviderContext.codec","Protocol.ErrorEnvelope","Protocol.IntegrationToken","Secret.make","Client.make","Connection.Error","DnsProvider.Error","DomainName.parse","InvalidInputError","make","DnsResolver.Error","layer","DnsResolver.Service","toAsync","DnsResolver.toAsync","DomainName.parse","DomainName.decode","DnsData.parse","endpoint","make","DnsOverHttps.make","layer","DnsResolver.Service","toAsync","DnsResolver.toAsync","make","DnsOverHttps.make","DnsResolver.Service","DnsResolver.toAsync","observe","CloudflareDnsOverHttps.make","GoogleDnsOverHttps.make","DnsProvider.Service","DnsRecord.equals","InvalidInputError","DnsResolverPool.Service","DnsResolverPool.defaultMake","DnsData.parse","data","DnsRecord.data"],"sources":["../package.json","../src/auth/diagnostic.ts","../src/auth/manifest.ts","../src/auth/secret.ts","../src/discovery/selection.ts","../src/provider/session.ts","../src/plan/connection-authorization.ts","../src/auth/authorization-code.ts","../src/providers/cloudflare/protocol.ts","../src/providers/cloudflare/records.ts","../src/providers/cloudflare/client.ts","../src/providers/cloudflare/auth.ts","../src/providers/vercel/protocol.ts","../src/providers/vercel/records.ts","../src/providers/vercel/client.ts","../src/providers/vercel/auth.ts","../src/verification/dns-data.ts","../src/verification/doh.ts","../src/verification/cloudflare-doh.ts","../src/verification/google-doh.ts","../src/verification/resolver-pool.ts","../src/verification/verify.ts"],"sourcesContent":["","import { Schema } from \"effect\";\n\nexport const Category = Schema.Literals([\n  \"authorization\",\n  \"configuration\",\n  \"provider\",\n  \"storage\",\n  \"validation\",\n]);\nexport type Category = typeof Category.Type;\n\nexport const RetryAdvice = Schema.Literals([\"never\", \"after-user-action\", \"safe\", \"unknown\"]);\nexport type RetryAdvice = typeof RetryAdvice.Type;\n\nexport const Fields = {\n  category: Category,\n  message: Schema.String,\n  operation: Schema.String,\n  retry: RetryAdvice,\n} as const;\n\nexport interface Diagnostic {\n  readonly category: Category;\n  readonly message: string;\n  readonly operation: string;\n  readonly retry: RetryAdvice;\n  readonly tag: string;\n}\n\nexport function from(error: {\n  readonly _tag: string;\n  readonly category: Category;\n  readonly message: string;\n  readonly operation: string;\n  readonly retry: RetryAdvice;\n}): Diagnostic {\n  return {\n    category: error.category,\n    message: error.message,\n    operation: error.operation,\n    retry: error.retry,\n    tag: error._tag,\n  };\n}\n","import { Effect, Schema as S } from \"effect\";\nimport type * as oauth from \"oauth4webapi\";\n\nimport type * as DnsProvider from \"../provider/provider.ts\";\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport type { Value as Secret } from \"./secret.ts\";\n\nexport const Method = S.TaggedUnion({\n  integration: {\n    capabilities: S.Array(S.Literals([\"dns:read\", \"dns:write\"])),\n    installUrl: S.String,\n    tokenEndpoint: S.String,\n  },\n  oauth2: {\n    authorizationServer: S.Struct({\n      authorization_endpoint: S.String,\n      issuer: S.String,\n      revocation_endpoint: S.optionalKey(S.String),\n      token_endpoint: S.String,\n    }),\n    capabilities: S.Array(S.Literals([\"dns:read\", \"dns:write\"])),\n    clientAuth: S.Literals([\"none\", \"client_secret_basic\", \"client_secret_post\"]),\n    scopes: S.Array(S.String),\n  },\n  token: {\n    capabilities: S.Array(S.Literals([\"dns:read\", \"dns:write\"])),\n    instructionsUrl: S.String,\n  },\n});\n\nexport const Schema = S.Struct({\n  methods: S.Array(Method),\n  providerId: S.String,\n});\nexport interface Manifest extends S.Schema.Type<typeof Schema> {}\nexport type OAuthMethod = Extract<Manifest[\"methods\"][number], { readonly _tag: \"oauth2\" }>;\n/** A provider-owned installation flow that returns a credential from a one-time code. */\nexport type IntegrationMethod = Extract<\n  Manifest[\"methods\"][number],\n  { readonly _tag: \"integration\" }\n>;\n\nexport const decode = Effect.fn(\"ProviderAuth.decode\")((input: unknown) =>\n  S.decodeUnknownEffect(Schema)(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport interface OAuthClientConfiguration {\n  readonly clientId: string;\n  readonly clientSecret?: Secret;\n}\n\nexport interface TokenValidation {\n  readonly accountId: string;\n  readonly capabilities: ReadonlyArray<\"dns:read\" | \"dns:write\">;\n  readonly expiresAt: Date | null;\n  readonly scopes: ReadonlyArray<string>;\n}\n\nexport interface OAuthSubjectResolver {\n  (\n    tokens: oauth.TokenEndpointResponse,\n    accessToken: Secret,\n  ): Effect.Effect<\n    { readonly accountId: string; readonly expiresAt: Date | null },\n    DnsProvider.Error\n  >;\n}\n\nexport interface AsyncOAuthSubjectResolver {\n  (\n    tokens: oauth.TokenEndpointResponse,\n    accessToken: Secret,\n  ): Promise<{ readonly accountId: string; readonly expiresAt: Date | null }>;\n}\n","/** A deliberately non-serializable credential value. */\nexport class Value {\n  readonly #value: string;\n\n  private constructor(value: string) {\n    this.#value = value;\n  }\n\n  static from(value: string): Value {\n    if (value.length === 0) throw new Error(\"Secret values cannot be empty\");\n    return new Value(value);\n  }\n\n  expose(): string {\n    return this.#value;\n  }\n\n  toJSON(): string {\n    return \"[REDACTED]\";\n  }\n\n  toString(): string {\n    return \"[REDACTED]\";\n  }\n}\n\nexport const make = Value.from;\n","import { Schema } from \"effect\";\n\nimport * as ProviderAuthorization from \"../auth/authorization.ts\";\nimport * as Connection from \"../auth/connection.ts\";\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport * as Zones from \"./zones.ts\";\n\nexport interface ConnectedZone {\n  readonly authorization: ProviderAuthorization.ProviderAuthorization;\n  readonly attachment: Connection.DomainAttachment;\n  readonly connection: Connection.ProviderConnection;\n  readonly nameservers: ReadonlyArray<string>;\n}\n\nexport const Evidence = Schema.Struct({\n  accountId: Schema.String,\n  connectionId: Schema.String,\n  decisiveNameserverMatch: Schema.Boolean,\n  matchedNameservers: Schema.Array(DomainName.Schema),\n  providerId: Schema.String,\n  zone: DomainName.Schema,\n});\nexport interface Evidence extends Schema.Schema.Type<typeof Evidence> {}\n\nexport const Selection = Schema.TaggedUnion({\n  selected: {\n    candidate: Evidence,\n    evidence: Schema.Array(Evidence),\n    reason: Schema.Literals([\"explicit\", \"unique-nameserver-match\"]),\n  },\n  manual: {\n    evidence: Schema.Array(Evidence),\n    reason: Schema.Literals([\"ambiguous\", \"unsupported\"]),\n  },\n});\nexport type Selection = typeof Selection.Type;\n\nexport function select(input: {\n  readonly authoritativeNameservers: ReadonlyArray<string>;\n  readonly connectedZones: ReadonlyArray<ConnectedZone>;\n  readonly domain: string;\n  readonly explicit?: {\n    readonly accountId: string;\n    readonly providerId: string;\n    readonly zone: string;\n  };\n  readonly now?: Date;\n}): Selection {\n  const domain = DomainName.parse(input.domain);\n  const zoneCandidates = new Set(Zones.candidates(domain));\n  const authoritative = nameserverSet(input.authoritativeNameservers);\n  const eligible = input.connectedZones.filter((connected) => {\n    if (!zoneCandidates.has(connected.attachment.target.zoneName)) return false;\n    try {\n      Connection.assertAttachment({\n        attachment: connected.attachment,\n        capability: \"dns:read\",\n        connection: connected.connection,\n        domain,\n        ...(input.now === undefined ? {} : { now: input.now }),\n        providerId: connected.connection.providerId,\n        authorization: connected.authorization,\n      });\n      return true;\n    } catch {\n      return false;\n    }\n  });\n  const evidence = eligible.map((connected) => evidenceFor(connected, authoritative));\n\n  if (input.explicit !== undefined) {\n    const explicitZone = DomainName.parse(input.explicit.zone);\n    const index = eligible.findIndex(\n      (connected) =>\n        connected.connection.providerId === input.explicit?.providerId &&\n        connected.attachment.target.accountId === input.explicit.accountId &&\n        connected.attachment.target.zoneName === explicitZone,\n    );\n    if (index < 0) {\n      throw Connection.authorizationError(\n        \"Explicit provider zone is not connected for this domain\",\n        \"ProviderDiscovery.select\",\n      );\n    }\n    const candidate = evidence[index];\n    if (candidate === undefined) throw new Error(\"Eligible provider evidence is missing\");\n    return { _tag: \"selected\", candidate, evidence, reason: \"explicit\" };\n  }\n\n  const decisive = evidence.filter(({ decisiveNameserverMatch }) => decisiveNameserverMatch);\n  const candidate = decisive[0];\n  return decisive.length === 1 && candidate !== undefined\n    ? { _tag: \"selected\", candidate, evidence, reason: \"unique-nameserver-match\" }\n    : {\n        _tag: \"manual\",\n        evidence,\n        reason: decisive.length > 1 ? \"ambiguous\" : \"unsupported\",\n      };\n}\n\nfunction evidenceFor(\n  connected: ConnectedZone,\n  authoritative: ReadonlyArray<DomainName.DomainName>,\n): Evidence {\n  const configured = new Set(nameserverSet(connected.nameservers));\n  const matchedNameservers = authoritative.filter((nameserver) => configured.has(nameserver));\n  return {\n    accountId: connected.attachment.target.accountId,\n    connectionId: connected.connection.id,\n    decisiveNameserverMatch:\n      authoritative.length > 0 && matchedNameservers.length === authoritative.length,\n    matchedNameservers,\n    providerId: connected.connection.providerId,\n    zone: connected.attachment.target.zoneName,\n  };\n}\n\nfunction nameserverSet(nameservers: ReadonlyArray<string>): ReadonlyArray<DomainName.DomainName> {\n  return [...new Set(nameservers.map(DomainName.parse))].sort();\n}\n","import { Data, Effect } from \"effect\";\n\nimport type * as Connection from \"../auth/connection.ts\";\nimport type * as ProviderAuthorization from \"../auth/authorization.ts\";\nimport type * as Secret from \"../auth/secret.ts\";\nimport type * as DomainName from \"../domain/domain-name.ts\";\nimport * as DnsProvider from \"./provider.ts\";\n\n/** A credential-scoped provider session that discovers safe targets before DNS access. */\nexport interface Interface {\n  /** The provider represented by this credential. */\n  readonly providerId: string;\n  /** Lists provider account and authoritative-zone targets visible to this credential. */\n  readonly listTargets: (\n    input?: ListTargetsInput,\n  ) => Effect.Effect<ReadonlyArray<Connection.ProviderTarget>, DnsProvider.Error>;\n  /** Resolves a domain without guessing when more than one account owns a matching zone. */\n  readonly resolveTarget: (\n    domain: DomainName.DomainName,\n  ) => Effect.Effect<Resolution, DnsProvider.Error>;\n  /** Creates the focused DNS-record capability bound to one exact discovered target. */\n  readonly forTarget: (\n    target: Connection.ProviderTarget,\n  ) => Effect.Effect<DnsProvider.Interface, DnsProvider.Error>;\n}\n\nexport interface ListTargetsInput {\n  /** Restrict results to the authoritative zone candidates for this domain. */\n  readonly domain?: DomainName.DomainName;\n  /** Provider-specific account filter, when supported by the adapter. */\n  readonly accountId?: string;\n}\n\nexport type Resolution = Data.TaggedEnum<{\n  NotFound: { readonly domain: DomainName.DomainName };\n  Resolved: { readonly target: Connection.ProviderTarget };\n  SelectionRequired: { readonly candidates: ReadonlyArray<Connection.ProviderTarget> };\n}>;\nexport const Resolution = Data.taggedEnum<Resolution>();\n\n/** The credential material a provider adapter needs to restore a session. */\nexport interface Credential {\n  readonly accessToken: Secret.Value;\n  readonly expiresAt: Date | null;\n  readonly refreshToken: Secret.Value | null;\n  readonly tokenType: string;\n}\n\n/** The non-secret authorization projection required when restoring a provider session. */\nexport type Authorization = Pick<\n  ProviderAuthorization.ProviderAuthorization,\n  | \"capabilityEvidence\"\n  | \"method\"\n  | \"providerContext\"\n  | \"providerId\"\n  | \"requiredCapabilities\"\n  | \"revocation\"\n>;\n\nexport interface RestoreInput {\n  readonly authorization: Authorization;\n  readonly credential: Credential;\n}\n\n/** Minimal Promise-shaped provider-session contract for hosts that do not use Effect directly. */\nexport interface AsyncInterface {\n  readonly providerId: string;\n  readonly listTargets: (\n    input?: ListTargetsInput,\n  ) => Promise<ReadonlyArray<Connection.ProviderTarget>>;\n  readonly resolveTarget: (domain: DomainName.DomainName) => Promise<Resolution>;\n  readonly forTarget: (target: Connection.ProviderTarget) => Promise<DnsProvider.AsyncInterface>;\n}\n\n/** Adapts a Promise-shaped session to the Effect-native session boundary. */\nexport const fromAsync = (session: AsyncInterface): Interface => ({\n  providerId: session.providerId,\n  listTargets: (input) =>\n    Effect.tryPromise({\n      try: () => session.listTargets(input),\n      catch: (cause) => sessionFailure(session.providerId, \"listTargets\", cause),\n    }),\n  resolveTarget: (domain) =>\n    Effect.tryPromise({\n      try: () => session.resolveTarget(domain),\n      catch: (cause) => sessionFailure(session.providerId, \"resolveTarget\", cause),\n    }),\n  forTarget: (target) =>\n    Effect.tryPromise({\n      try: () => session.forTarget(target),\n      catch: (cause) => sessionFailure(session.providerId, \"forTarget\", cause),\n    }).pipe(Effect.map(DnsProvider.fromAsync)),\n});\n\n/** Adapts an Effect-native session to the Promise facade. */\nexport const toAsync = (session: Interface): AsyncInterface => ({\n  providerId: session.providerId,\n  listTargets: (input) => Effect.runPromise(session.listTargets(input)),\n  resolveTarget: (domain) => Effect.runPromise(session.resolveTarget(domain)),\n  forTarget: (target) => Effect.runPromise(session.forTarget(target)).then(DnsProvider.toAsync),\n});\n\nfunction sessionFailure(providerId: string, operation: string, cause: unknown): DnsProvider.Error {\n  return cause instanceof DnsProvider.Error\n    ? cause\n    : new DnsProvider.Error({\n        message: cause instanceof globalThis.Error ? cause.message : String(cause),\n        operation: `ProviderSession.${operation}`,\n        providerId,\n        reason: \"transport\",\n      });\n}\n","import { Crypto, Effect } from \"effect\";\n\nimport * as Connection from \"../auth/connection.ts\";\nimport * as ProviderAuthorization from \"../auth/authorization.ts\";\nimport * as Lifecycle from \"../auth/lifecycle-repository.ts\";\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport { CryptoError } from \"./canonical-json.ts\";\nimport * as Provisioning from \"./plan.ts\";\nimport type * as DnsPlan from \"./types.ts\";\n\nexport const authorize = Effect.fn(\"ConnectionAuthorization.authorize\")(function* (input: {\n  readonly allowPartial?: boolean;\n  readonly authorization: ProviderAuthorization.ProviderAuthorization;\n  readonly connection: Connection.ProviderConnection | Connection.StoredConnection;\n  readonly domain: string;\n  readonly attachment: Connection.DomainAttachment;\n  readonly operationIds?: ReadonlyArray<string>;\n  readonly plan: DnsPlan.DnsPlan;\n}) {\n  const lifecycle = yield* Lifecycle.Service;\n  const aggregate = yield* lifecycle.getByConnectionId(input.connection.id);\n  const storedConnection = aggregate?.connections.find(({ id }) => id === input.connection.id);\n  const storedAttachment = aggregate?.attachments.find(({ id }) => id === input.attachment.id);\n  if (\n    aggregate === null ||\n    storedConnection === undefined ||\n    storedAttachment === undefined ||\n    storedConnection.ownerId !== input.connection.ownerId ||\n    storedConnection.providerId !== input.connection.providerId ||\n    storedConnection.method !== aggregate.authorization.method ||\n    storedConnection.authorizationId !== input.authorization.id ||\n    storedAttachment.connectionId !== storedConnection.id\n  ) {\n    return yield* Connection.authorizationError(\n      \"Domain attachment is not owned by the active provider connection\",\n      \"ConnectionAuthorization.authorize\",\n    );\n  }\n  const domain = yield* Effect.try({\n    try: () =>\n      Connection.assertAttachment({\n        attachment: storedAttachment,\n        capability: \"dns:write\",\n        authorization: aggregate.authorization,\n        connection: storedConnection,\n        credential: aggregate.credential,\n        domain: input.domain,\n        providerId: input.plan.providerId,\n      }),\n    catch: (cause) =>\n      cause instanceof Connection.AuthorizationError || cause instanceof InvalidInputError\n        ? cause\n        : Connection.authorizationError(\n            \"Domain attachment is invalid\",\n            \"ConnectionAuthorization.authorize\",\n          ),\n  });\n  const authorization = yield* Provisioning.authorize(\n    input.plan,\n    input.operationIds,\n    input.allowPartial === undefined ? {} : { allowPartial: input.allowPartial },\n  );\n  const selected = new Set(authorization.operationIds);\n  const outsideAttachment = input.plan.operations.filter(\n    (operation) =>\n      operation._tag === \"create\" &&\n      selected.has(operation.id) &&\n      operation.requirement.name !== domain &&\n      !operation.requirement.name.endsWith(`.${domain}`),\n  );\n  if (outsideAttachment.length > 0) {\n    return yield* Connection.authorizationError(\n      `Plan operations are outside the attached domain ${domain}`,\n      \"ConnectionAuthorization.authorize\",\n    );\n  }\n  return authorization;\n});\n\nexport type Error =\n  | Connection.AuthorizationError\n  | InvalidInputError\n  | CryptoError\n  | Lifecycle.Error;\nexport type Requirements = Crypto.Crypto | Lifecycle.Service;\n","import { Crypto, Effect, Schema } from \"effect\";\nimport * as oauth from \"oauth4webapi\";\n\nimport type * as ProviderAuth from \"./manifest.ts\";\nimport * as Connection from \"./connect.ts\";\nimport * as Secret from \"./secret.ts\";\n\nexport type Fetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;\n\nexport interface Payload {\n  readonly codeVerifier: string;\n  readonly redirectUri: string;\n  readonly state: string;\n}\n\nexport const start = Effect.fn(\"AuthorizationCode.start\")(function* (input: {\n  readonly client: ProviderAuth.OAuthClientConfiguration;\n  readonly method: ProviderAuth.OAuthMethod;\n  readonly redirectUri: string;\n  readonly state: string;\n}) {\n  const crypto = yield* Crypto.Crypto;\n  const codeVerifier = base64Url(yield* randomBytes(crypto, 32));\n  const challenge = base64Url(yield* digest(crypto, codeVerifier));\n  const authorizationUrl = new URL(input.method.authorizationServer.authorization_endpoint);\n  authorizationUrl.search = new URLSearchParams({\n    client_id: input.client.clientId,\n    code_challenge: challenge,\n    code_challenge_method: \"S256\",\n    redirect_uri: input.redirectUri,\n    response_type: \"code\",\n    scope: input.method.scopes.join(\" \"),\n    state: input.state,\n  }).toString();\n  return {\n    authorizationUrl,\n    payload: Secret.make(\n      JSON.stringify({ codeVerifier, redirectUri: input.redirectUri, state: input.state }),\n    ),\n  };\n});\n\nexport const complete = Effect.fn(\"AuthorizationCode.complete\")(function* (input: {\n  readonly callbackUrl: URL;\n  readonly client: ProviderAuth.OAuthClientConfiguration;\n  readonly fetch?: Fetch;\n  readonly method: ProviderAuth.OAuthMethod;\n  readonly payload: Secret.Value;\n  readonly providerId: string;\n}) {\n  const payload = yield* decodePayload(input.payload);\n  if (input.callbackUrl.searchParams.get(\"state\") !== payload.state) {\n    return yield* failure(\"Authorization callback state does not match its continuation\");\n  }\n  const server = input.method.authorizationServer as oauth.AuthorizationServer;\n  const client: oauth.Client = { client_id: input.client.clientId };\n  const authentication = yield* clientAuthentication(input.method, input.client);\n  return yield* Effect.tryPromise({\n    try: async (signal) => {\n      const callback = oauth.validateAuthResponse(server, client, input.callbackUrl, payload.state);\n      const response = await oauth.authorizationCodeGrantRequest(\n        server,\n        client,\n        authentication,\n        callback,\n        payload.redirectUri,\n        payload.codeVerifier,\n        requestOptions(input.fetch, signal),\n      );\n      return oauth.processAuthorizationCodeResponse(server, client, response);\n    },\n    catch: (cause) =>\n      new Connection.Error({\n        category: \"provider\",\n        message: cause instanceof globalThis.Error ? cause.name : \"OAuth provider request failed\",\n        operation: \"AuthorizationCode.complete\",\n        retry: \"unknown\",\n      }),\n  });\n});\n\nconst PayloadSchema = Schema.Struct({\n  codeVerifier: Schema.String,\n  redirectUri: Schema.String,\n  state: Schema.String,\n});\n\nfunction decodePayload(payload: Secret.Value): Effect.Effect<Payload, Connection.Error> {\n  return Schema.decodeUnknownEffect(Schema.fromJsonString(PayloadSchema))(payload.expose()).pipe(\n    Effect.mapError(\n      () =>\n        new Connection.Error({\n          category: \"authorization\",\n          message: \"OAuth continuation payload is invalid\",\n          operation: \"AuthorizationCode\",\n          retry: \"after-user-action\",\n        }),\n    ),\n  );\n}\n\nfunction clientAuthentication(\n  method: ProviderAuth.OAuthMethod,\n  client: ProviderAuth.OAuthClientConfiguration,\n): Effect.Effect<oauth.ClientAuth, Connection.Error> {\n  switch (method.clientAuth) {\n    case \"none\":\n      return Effect.succeed(oauth.None());\n    case \"client_secret_basic\":\n      return client.clientSecret === undefined\n        ? failure(\"OAuth client secret is required\")\n        : Effect.succeed(oauth.ClientSecretBasic(client.clientSecret.expose()));\n    case \"client_secret_post\":\n      return client.clientSecret === undefined\n        ? failure(\"OAuth client secret is required\")\n        : Effect.succeed(oauth.ClientSecretPost(client.clientSecret.expose()));\n  }\n}\n\nfunction requestOptions(\n  fetchImplementation: Fetch | undefined,\n  signal: AbortSignal,\n): oauth.TokenEndpointRequestOptions {\n  return fetchImplementation === undefined\n    ? { signal }\n    : {\n        signal,\n        [oauth.customFetch]: (url, options) =>\n          fetchImplementation(url, { ...options, body: options.body }),\n      };\n}\n\nconst failure = (message: string): Effect.Effect<never, Connection.Error> =>\n  Effect.fail(\n    new Connection.Error({\n      category: \"authorization\",\n      message,\n      operation: \"AuthorizationCode\",\n      retry: \"after-user-action\",\n    }),\n  );\n\nfunction randomBytes(\n  crypto: Crypto.Crypto,\n  size: number,\n): Effect.Effect<Uint8Array, Connection.Error> {\n  return crypto.randomBytes(size).pipe(\n    Effect.mapError(\n      (cause) =>\n        new Connection.Error({\n          category: \"validation\",\n          message: cause.message,\n          operation: \"AuthorizationCode.start\",\n          retry: \"safe\",\n        }),\n    ),\n  );\n}\n\nfunction digest(crypto: Crypto.Crypto, value: string): Effect.Effect<Uint8Array, Connection.Error> {\n  return crypto.digest(\"SHA-256\", new TextEncoder().encode(value)).pipe(\n    Effect.mapError(\n      (cause) =>\n        new Connection.Error({\n          category: \"validation\",\n          message: cause.message,\n          operation: \"AuthorizationCode.start\",\n          retry: \"safe\",\n        }),\n    ),\n  );\n}\n\nfunction base64Url(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replaceAll(\"=\", \"\");\n}\n","import { Schema as S } from \"effect\";\n\nexport const ErrorDetail = S.Struct({\n  code: S.Number,\n  message: S.String,\n});\nexport interface ErrorDetail extends S.Schema.Type<typeof ErrorDetail> {}\n\nexport const ResultInfo = S.Struct({\n  count: S.optionalKey(S.Number),\n  page: S.optionalKey(S.Number),\n  per_page: S.optionalKey(S.Number),\n  total_count: S.optionalKey(S.Number),\n  total_pages: S.optionalKey(S.Number),\n});\n\nconst Message = S.Struct({\n  code: S.optionalKey(S.Number),\n  message: S.String,\n});\n\nexport const BaseEnvelope = S.Struct({\n  errors: S.Array(ErrorDetail),\n  messages: S.Array(Message),\n  success: S.Boolean,\n});\n\nexport const Account = S.Struct({\n  id: S.String,\n  name: S.String,\n});\nexport interface Account extends S.Schema.Type<typeof Account> {}\n\nexport const Zone = S.Struct({\n  account: Account,\n  id: S.String,\n  name: S.String,\n  name_servers: S.Array(S.String),\n  status: S.optionalKey(S.String),\n  type: S.optionalKey(S.Literals([\"full\", \"partial\", \"secondary\", \"internal\"])),\n});\nexport interface Zone extends S.Schema.Type<typeof Zone> {}\n\nexport const Record = S.Struct({\n  content: S.optionalKey(S.String),\n  data: S.optionalKey(S.Unknown),\n  id: S.String,\n  name: S.String,\n  priority: S.optionalKey(S.Number),\n  proxied: S.optionalKey(S.Boolean),\n  ttl: S.Number,\n  type: S.String,\n});\nexport interface Record extends S.Schema.Type<typeof Record> {}\n\nexport const Token = S.Struct({\n  expires_on: S.optionalKey(S.String),\n  id: S.String,\n  not_before: S.optionalKey(S.String),\n  status: S.Literals([\"active\", \"disabled\", \"expired\"]),\n});\nexport interface Token extends S.Schema.Type<typeof Token> {}\n\nexport const ZoneListEnvelope = S.Struct({\n  errors: S.Array(ErrorDetail),\n  messages: S.Array(Message),\n  result: S.Array(Zone),\n  result_info: S.optionalKey(ResultInfo),\n  success: S.Boolean,\n});\nexport const RecordListEnvelope = S.Struct({\n  errors: S.Array(ErrorDetail),\n  messages: S.Array(Message),\n  result: S.Array(Record),\n  result_info: S.optionalKey(ResultInfo),\n  success: S.Boolean,\n});\nexport const RecordEnvelope = S.Struct({\n  errors: S.Array(ErrorDetail),\n  messages: S.Array(Message),\n  result: Record,\n  success: S.Boolean,\n});\nexport const TokenEnvelope = S.Struct({\n  errors: S.Array(ErrorDetail),\n  messages: S.Array(Message),\n  result: Token,\n  success: S.Boolean,\n});\n","import { Effect, Schema as S } from \"effect\";\n\nimport * as DomainName from \"../../domain/domain-name.ts\";\nimport * as DnsRecord from \"../../domain/dns-record.ts\";\nimport * as DnsProvider from \"../../provider/provider.ts\";\nimport type * as Protocol from \"./protocol.ts\";\n\nconst Data = S.Struct({\n  flags: S.optionalKey(S.Number),\n  port: S.optionalKey(S.Number),\n  priority: S.optionalKey(S.Number),\n  tag: S.optionalKey(S.String),\n  target: S.optionalKey(S.String),\n  value: S.optionalKey(S.String),\n  weight: S.optionalKey(S.Number),\n});\n\nexport type CreateBody = Readonly<Record<string, unknown>>;\n\nexport const decode = Effect.fn(\"CloudflareRecords.decode\")((record: Protocol.Record) =>\n  Effect.gen(function* () {\n    const name = yield* DomainName.decode(record.name).pipe(\n      Effect.match({ onFailure: () => null, onSuccess: (value) => value }),\n    );\n    if (name === null) return yield* decodeOpaque(record);\n    const common = {\n      metadata: {\n        ownership: \"provider\",\n        provenance: record.proxied === true ? \"cloudflare:proxied\" : \"cloudflare\",\n        purpose: \"existing DNS record\",\n      },\n      name,\n      policy: record.type === \"CNAME\" ? \"exclusive\" : \"append\",\n      ttl: record.ttl === 1 ? null : record.ttl,\n    } as const;\n    const content = () =>\n      record.content === undefined\n        ? Effect.fail(failure(\"decodeRecord\", `Cloudflare ${record.type} record has no content`))\n        : Effect.succeed(record.content);\n\n    switch (record.type) {\n      case \"A\":\n      case \"AAAA\":\n        return yield* DnsRecord.decode({\n          ...common,\n          _tag: record.type,\n          address: yield* content(),\n        }).pipe(Effect.mapError((cause) => failure(\"decodeRecord\", cause.message)));\n      case \"CNAME\":\n      case \"NS\":\n        return yield* DnsRecord.decode({\n          ...common,\n          _tag: record.type,\n          target: yield* content(),\n        }).pipe(Effect.mapError((cause) => failure(\"decodeRecord\", cause.message)));\n      case \"TXT\":\n        return yield* DnsRecord.decode({\n          ...common,\n          _tag: \"TXT\",\n          value: yield* content(),\n        }).pipe(Effect.mapError((cause) => failure(\"decodeRecord\", cause.message)));\n      case \"MX\":\n        return yield* DnsRecord.decode({\n          ...common,\n          _tag: \"MX\",\n          exchange: yield* content(),\n          priority: record.priority,\n        }).pipe(Effect.mapError((cause) => failure(\"decodeRecord\", cause.message)));\n      case \"CAA\": {\n        const data = yield* decodeData(record);\n        return yield* DnsRecord.decode({ ...common, _tag: \"CAA\", ...data }).pipe(\n          Effect.mapError((cause) => failure(\"decodeRecord\", cause.message)),\n        );\n      }\n      case \"SRV\": {\n        const data = yield* decodeData(record);\n        return yield* DnsRecord.decode({ ...common, _tag: \"SRV\", ...data }).pipe(\n          Effect.mapError((cause) => failure(\"decodeRecord\", cause.message)),\n        );\n      }\n      default:\n        return yield* decodeOpaque(record);\n    }\n  }),\n);\n\nconst decodeOpaque = Effect.fn(\"CloudflareRecords.decodeOpaque\")((record: Protocol.Record) =>\n  S.decodeUnknownEffect(DnsRecord.Opaque)({\n    _tag: \"Opaque\",\n    name: record.name,\n    providerRecordId: record.id,\n    providerType: record.type,\n  }).pipe(Effect.mapError((cause) => failure(\"decodeRecord\", cause.message))),\n);\n\nexport function encode(record: DnsRecord.DnsRecord): CreateBody {\n  const common = {\n    name: record.name,\n    proxied: false,\n    ttl: record.ttl ?? 1,\n    type: record._tag,\n  };\n  switch (record._tag) {\n    case \"A\":\n    case \"AAAA\":\n      return { ...common, content: record.address };\n    case \"CNAME\":\n    case \"NS\":\n      return { ...common, content: record.target };\n    case \"TXT\":\n      return { ...common, content: record.value };\n    case \"MX\":\n      return { ...common, content: record.exchange, priority: record.priority };\n    case \"CAA\":\n      return {\n        ...common,\n        data: { flags: record.flags, tag: record.tag, value: record.value },\n      };\n    case \"SRV\":\n      return {\n        ...common,\n        data: {\n          port: record.port,\n          priority: record.priority,\n          target: record.target,\n          weight: record.weight,\n        },\n      };\n  }\n}\n\nconst decodeData = Effect.fn(\"CloudflareRecords.decodeData\")((record: Protocol.Record) =>\n  S.decodeUnknownEffect(Data)(record.data).pipe(\n    Effect.mapError((cause) => failure(\"decodeRecord\", cause.message)),\n  ),\n);\n\nfunction failure(\n  operation: string,\n  message: string,\n  fields: Partial<Pick<DnsProvider.Error, \"reason\">> = {},\n): DnsProvider.Error {\n  return new DnsProvider.Error({\n    message,\n    operation,\n    providerId: \"cloudflare\",\n    reason: fields.reason ?? \"response\",\n  });\n}\n","import { Effect, Schema as S } from \"effect\";\n\nimport type * as ProviderAuth from \"../../auth/manifest.ts\";\nimport type * as Secret from \"../../auth/secret.ts\";\nimport * as Connection from \"../../auth/connection.ts\";\nimport * as DomainName from \"../../domain/domain-name.ts\";\nimport type * as DnsRecord from \"../../domain/dns-record.ts\";\nimport type * as ZoneDiscovery from \"../../discovery/zone-discovery.ts\";\nimport * as Zones from \"../../discovery/zones.ts\";\nimport * as DnsProvider from \"../../provider/provider.ts\";\nimport * as ProviderSession from \"../../provider/session.ts\";\nimport * as Protocol from \"./protocol.ts\";\nimport * as Records from \"./records.ts\";\n\nexport type Fetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;\n\n/** Configuration for an Effect-native Cloudflare authoritative-DNS client. */\nexport interface Options {\n  /** Account scope for account tokens; omit for user or OAuth credentials. */\n  readonly accountId?: string;\n  readonly baseUrl?: string;\n  /** Capabilities the host required when issuing or authorizing this credential. */\n  readonly capabilities: ProviderAuth.TokenValidation[\"capabilities\"];\n  readonly fetch?: Fetch;\n  readonly token: Secret.Value;\n  readonly tokenKind?: \"account\" | \"user\";\n}\n\nexport interface ListZonesInput {\n  readonly accountId?: string;\n  readonly name?: DomainName.DomainName;\n}\n\nexport type Account = Protocol.Account;\n\n/** A portable Cloudflare authoritative zone with normalized nameserver evidence. */\nexport interface Zone {\n  readonly accountId: string;\n  readonly id: string;\n  readonly name: DomainName.DomainName;\n  readonly nameservers: ReadonlyArray<DomainName.DomainName>;\n  readonly status: string | null;\n}\n\nexport interface Interface extends DnsProvider.Interface {\n  readonly providerId: \"cloudflare\";\n  readonly forTarget: (\n    target: Connection.ProviderTarget,\n  ) => Effect.Effect<DnsProvider.Interface, DnsProvider.Error>;\n  readonly listAccounts: () => Effect.Effect<ReadonlyArray<Account>, DnsProvider.Error>;\n  readonly listZones: (\n    input?: ListZonesInput,\n  ) => Effect.Effect<ReadonlyArray<Zone>, DnsProvider.Error>;\n  readonly listTargets: (\n    input?: ProviderSession.ListTargetsInput,\n  ) => Effect.Effect<ReadonlyArray<Connection.ProviderTarget>, DnsProvider.Error>;\n  readonly resolveTarget: (\n    domain: DomainName.DomainName,\n  ) => Effect.Effect<ProviderSession.Resolution, DnsProvider.Error>;\n  readonly validateToken: () => Effect.Effect<ProviderAuth.TokenValidation, DnsProvider.Error>;\n}\n\n/** Exposes Cloudflare zone lookup as the optional provider discovery capability. */\nexport function discovery(client: Interface): ZoneDiscovery.Source {\n  return {\n    listZones: (name) =>\n      client.listZones({ name }).pipe(\n        Effect.map((zones) =>\n          zones.map((zone) => ({\n            ...zone,\n            status: zone.status === \"active\" || zone.status === \"pending\" ? zone.status : \"unknown\",\n          })),\n        ),\n      ),\n    provider: client,\n  };\n}\n\ninterface CredentialOptions {\n  readonly baseUrl?: string;\n  readonly fetch?: Fetch;\n  readonly token: Secret.Value;\n}\n\ninterface DomainCredentialOptions extends CredentialOptions {\n  readonly capabilities: ProviderAuth.TokenValidation[\"capabilities\"];\n  readonly domain: DomainName.DomainName;\n  readonly tokenKind?: \"account\" | \"user\";\n}\n\ninterface TargetOptions {\n  readonly target: Connection.ProviderTarget;\n}\n\ntype InternalOptions = Options & Partial<TargetOptions>;\n\nconst makeTransport = (options: CredentialOptions) => {\n  const fetch = options.fetch ?? globalThis.fetch;\n  const baseUrl = (options.baseUrl ?? \"https://api.cloudflare.com/client/v4\").replace(/\\/$/, \"\");\n\n  const request = Effect.fn(\"CloudflareClient.request\")(\n    (path: string, operation: string, init?: RequestInit) =>\n      Effect.gen(function* () {\n        const response = yield* Effect.tryPromise({\n          try: () =>\n            fetch(`${baseUrl}${path}`, {\n              ...init,\n              headers: {\n                Accept: \"application/json\",\n                Authorization: `Bearer ${options.token.expose()}`,\n                ...(init?.body === undefined ? {} : { \"Content-Type\": \"application/json\" }),\n                ...init?.headers,\n              },\n            }),\n          catch: () =>\n            failure(operation, \"Cloudflare request failed\", {\n              reason: \"transport\",\n            }),\n        });\n        const body = yield* Effect.tryPromise({\n          try: () => response.json() as Promise<unknown>,\n          catch: () => {\n            const retryAfterMs = retryAfter(response.headers.get(\"retry-after\"));\n            return failure(\n              operation,\n              response.ok\n                ? \"Cloudflare returned a non-JSON response\"\n                : `Cloudflare request failed with HTTP ${response.status}`,\n              {\n                reason: response.ok ? \"response\" : reason(response.status),\n                ...(retryAfterMs === undefined ? {} : { retryAfterMs }),\n                status: response.status,\n              },\n            );\n          },\n        });\n        return { body, response } as const;\n      }),\n  );\n\n  const listZonesPage = Effect.fn(\"CloudflareClient.listZonesPage\")(\n    (accountId: string | undefined, name: DomainName.DomainName | undefined, page: number) =>\n      Effect.gen(function* () {\n        const query = new URLSearchParams({ page: String(page), per_page: \"50\" });\n        query.set(\"type\", \"full,partial,secondary,internal\");\n        if (accountId !== undefined) query.set(\"account.id\", accountId);\n        if (name !== undefined) query.set(\"name\", name);\n        const { body, response } = yield* request(`/zones?${query}`, \"listZones\");\n        yield* ensureSuccess(body, \"listZones\", response);\n        return yield* decode(Protocol.ZoneListEnvelope, body, \"listZones\", response);\n      }),\n  );\n\n  const allZones = Effect.fn(\"CloudflareClient.allZones\")(\n    (accountId?: string, name?: DomainName.DomainName) =>\n      Effect.gen(function* () {\n        const zones: Array<Protocol.Zone> = [];\n        let page = 1;\n        while (true) {\n          const envelope = yield* listZonesPage(accountId, name, page);\n          zones.push(...envelope.result);\n          const totalPages = envelope.result_info?.total_pages;\n          if (\n            (totalPages !== undefined && page >= totalPages) ||\n            (totalPages === undefined && envelope.result.length < 50)\n          ) {\n            return zones;\n          }\n          page += 1;\n        }\n      }),\n  );\n\n  const inspectToken = Effect.fn(\"CloudflareClient.inspectToken\")((path: string) =>\n    Effect.gen(function* () {\n      const { body, response } = yield* request(path, \"validateToken\");\n      yield* ensureSuccess(body, \"validateToken\", response);\n      const envelope = yield* decode(Protocol.TokenEnvelope, body, \"validateToken\", response);\n      if (envelope.result.status !== \"active\") {\n        return yield* Effect.fail(\n          failure(\"validateToken\", `Cloudflare token is ${envelope.result.status}`, {\n            reason: \"authentication\",\n            status: response.status,\n          }),\n        );\n      }\n      const expiresAt =\n        envelope.result.expires_on === undefined ? null : new Date(envelope.result.expires_on);\n      if (expiresAt !== null && Number.isNaN(expiresAt.valueOf())) {\n        return yield* Effect.fail(\n          failure(\"validateToken\", \"Cloudflare token expiry is not a valid timestamp\", {\n            reason: \"response\",\n            status: response.status,\n          }),\n        );\n      }\n      return expiresAt;\n    }),\n  );\n\n  return { allZones, inspectToken, request } as const;\n};\n\nconst discoverAccount = Effect.fn(\"CloudflareClient.discoverAccount\")(\n  (options: CredentialOptions & { readonly domain: DomainName.DomainName }) =>\n    Effect.gen(function* () {\n      const { allZones } = makeTransport(options);\n      for (const candidate of Zones.candidates(options.domain)) {\n        const matches = yield* allZones(undefined, candidate);\n        const match = matches[0];\n        if (matches.length === 0) continue;\n        if (matches.length === 1 && match !== undefined) return match.account;\n        return yield* Effect.fail(\n          failure(\n            \"discoverAccount\",\n            `Cloudflare returned multiple accessible zones named ${candidate}`,\n            { reason: \"conflict\" },\n          ),\n        );\n      }\n      return yield* Effect.fail(\n        failure(\n          \"discoverAccount\",\n          `Cloudflare did not expose an accessible zone for ${options.domain}`,\n          { reason: \"not_found\" },\n        ),\n      );\n    }),\n);\n\nexport const discoverAuthorizationAccount = discoverAccount;\n\nexport const validateDomainToken = Effect.fn(\"CloudflareClient.validateDomainToken\")(\n  (options: DomainCredentialOptions) =>\n    Effect.gen(function* () {\n      const transport = makeTransport(options);\n      const account = options.tokenKind === \"account\" ? yield* discoverAccount(options) : undefined;\n      const expiresAt = yield* transport.inspectToken(\n        account === undefined\n          ? \"/user/tokens/verify\"\n          : `/accounts/${encodeURIComponent(account.id)}/tokens/verify`,\n      );\n      const discoveredAccount = account ?? (yield* discoverAccount(options));\n      return {\n        accountId: discoveredAccount.id,\n        capabilities: options.capabilities,\n        expiresAt,\n        scopes: [],\n      } satisfies ProviderAuth.TokenValidation;\n    }),\n);\n\n/** Creates an Effect-native Cloudflare client without owning the credential lifecycle. */\nexport function make(options: Options): Interface {\n  return makeClient(options);\n}\n\nfunction makeClient(options: InternalOptions): Interface {\n  const { allZones, inspectToken, request } = makeTransport(options);\n\n  const resolveZone = Effect.fn(\"CloudflareClient.resolveZone\")((name: DomainName.DomainName) =>\n    Effect.gen(function* () {\n      if (options.target !== undefined) {\n        if (name !== options.target.zoneName && !name.endsWith(`.${options.target.zoneName}`)) {\n          return yield* Effect.fail(\n            failure(\n              \"resolveZone\",\n              `Cloudflare target ${options.target.zoneName} does not cover ${name}`,\n              { reason: \"not_found\" },\n            ),\n          );\n        }\n        return {\n          account: { id: options.target.accountId, name: options.target.accountId },\n          id: options.target.zoneId,\n          name: options.target.zoneName,\n          name_servers: options.target.evidence?.nameservers ?? [],\n        } satisfies Protocol.Zone;\n      }\n      const matches = yield* allZones(options.accountId, name);\n      const match = matches[0];\n      if (matches.length === 1 && match !== undefined) return match;\n      return yield* Effect.fail(\n        failure(\n          \"resolveZone\",\n          matches.length === 0\n            ? options.accountId === undefined\n              ? `Cloudflare zone ${name} was not found in the authorized accounts`\n              : `Cloudflare zone ${name} was not found in account ${options.accountId}`\n            : options.accountId === undefined\n              ? `Cloudflare returned multiple zones named ${name} across authorized accounts`\n              : `Cloudflare returned multiple zones named ${name} in account ${options.accountId}`,\n          { reason: matches.length === 0 ? \"not_found\" : \"response\" },\n        ),\n      );\n    }),\n  );\n\n  const listRecords = Effect.fn(\"CloudflareClient.listRecords\")((zoneName: DomainName.DomainName) =>\n    Effect.gen(function* () {\n      const zone = yield* resolveZone(zoneName);\n      const records: Array<DnsRecord.Observed> = [];\n      let page = 1;\n      while (true) {\n        const query = new URLSearchParams({ page: String(page), per_page: \"100\" });\n        const { body, response } = yield* request(\n          `/zones/${encodeURIComponent(zone.id)}/dns_records?${query}`,\n          \"listRecords\",\n        );\n        yield* ensureSuccess(body, \"listRecords\", response);\n        const envelope = yield* decode(Protocol.RecordListEnvelope, body, \"listRecords\", response);\n        records.push(...(yield* Effect.forEach(envelope.result, Records.decode)));\n        const totalPages = envelope.result_info?.total_pages;\n        if (\n          (totalPages !== undefined && page >= totalPages) ||\n          (totalPages === undefined && envelope.result.length < 100)\n        ) {\n          return records;\n        }\n        page += 1;\n      }\n    }),\n  );\n\n  const createRecord = Effect.fn(\"CloudflareClient.createRecord\")(\n    (zoneName: DomainName.DomainName, record: DnsRecord.DnsRecord) =>\n      Effect.gen(function* () {\n        const zone = yield* resolveZone(zoneName);\n        const { body, response } = yield* request(\n          `/zones/${encodeURIComponent(zone.id)}/dns_records`,\n          \"createRecord\",\n          { body: JSON.stringify(Records.encode(record)), method: \"POST\" },\n        );\n        yield* ensureSuccess(body, \"createRecord\", response);\n        const envelope = yield* decode(Protocol.RecordEnvelope, body, \"createRecord\", response);\n        return { providerRecordId: envelope.result.id };\n      }),\n  );\n\n  const getRecord = Effect.fn(\"CloudflareClient.getRecord\")(\n    (zoneName: DomainName.DomainName, providerRecordId: string) =>\n      Effect.gen(function* () {\n        const zone = yield* resolveZone(zoneName);\n        const { body, response } = yield* request(\n          `/zones/${encodeURIComponent(zone.id)}/dns_records/${encodeURIComponent(providerRecordId)}`,\n          \"getRecord\",\n        );\n        if (response.status === 404) return null;\n        yield* ensureSuccess(body, \"getRecord\", response);\n        const envelope = yield* decode(Protocol.RecordEnvelope, body, \"getRecord\", response);\n        return yield* Records.decode(envelope.result);\n      }),\n  );\n\n  const deleteRecord = Effect.fn(\"CloudflareClient.deleteRecord\")(\n    (zoneName: DomainName.DomainName, providerRecordId: string) =>\n      Effect.gen(function* () {\n        const zone = yield* resolveZone(zoneName);\n        const { body, response } = yield* request(\n          `/zones/${encodeURIComponent(zone.id)}/dns_records/${encodeURIComponent(providerRecordId)}`,\n          \"deleteRecord\",\n          { method: \"DELETE\" },\n        );\n        yield* ensureSuccess(body, \"deleteRecord\", response);\n      }),\n  );\n\n  const listAccounts = Effect.fn(\"CloudflareClient.listAccounts\")(() =>\n    allZones().pipe(\n      Effect.map((zones) => {\n        const accounts = new Map<string, Protocol.Account>();\n        for (const zone of zones) accounts.set(zone.account.id, zone.account);\n        return [...accounts.values()].sort((left, right) => left.name.localeCompare(right.name));\n      }),\n    ),\n  );\n\n  const listZones = Effect.fn(\"CloudflareClient.listZones\")((input: ListZonesInput = {}) =>\n    allZones(input.accountId ?? options.accountId, input.name).pipe(\n      Effect.flatMap((zones) => Effect.forEach(zones, projectZone)),\n    ),\n  );\n\n  const listTargets = Effect.fn(\"CloudflareClient.listTargets\")(\n    (input: ProviderSession.ListTargetsInput = {}) =>\n      Effect.gen(function* () {\n        const names =\n          input.domain === undefined\n            ? undefined\n            : new Set(Zones.candidates(input.domain).map((name) => String(name)));\n        const zones = yield* allZones(input.accountId ?? options.accountId);\n        return yield* Effect.forEach(\n          zones.filter(\n            (zone) => zone.type !== \"internal\" && (names === undefined || names.has(zone.name)),\n          ),\n          targetFromZone,\n        );\n      }),\n  );\n\n  const resolveTarget = Effect.fn(\"CloudflareClient.resolveTarget\")(\n    (domain: DomainName.DomainName) =>\n      Effect.gen(function* () {\n        const candidates = yield* listTargets({ domain });\n        for (const zoneName of Zones.candidates(domain)) {\n          const matches = candidates.filter((target) => target.zoneName === zoneName);\n          if (matches.length === 1) {\n            const target = matches[0];\n            if (target !== undefined) return ProviderSession.Resolution.Resolved({ target });\n          }\n          if (matches.length > 1) {\n            return ProviderSession.Resolution.SelectionRequired({ candidates: matches });\n          }\n        }\n        return ProviderSession.Resolution.NotFound({ domain });\n      }),\n  );\n\n  const forTarget = Effect.fn(\"CloudflareClient.forTarget\")((target: Connection.ProviderTarget) =>\n    Effect.gen(function* () {\n      if (target.accountKind !== null && target.accountKind !== \"account\") {\n        return yield* Effect.fail(\n          failure(\"forTarget\", \"Cloudflare targets must use the account account kind\", {\n            reason: \"request\",\n          }),\n        );\n      }\n      if (target.evidence?.zoneType === \"internal\") {\n        return yield* Effect.fail(\n          failure(\"forTarget\", \"Cloudflare internal zones cannot host managed DNS records\", {\n            reason: \"unsupported\",\n          }),\n        );\n      }\n      const discovered = yield* listTargets({\n        accountId: target.accountId,\n        domain: target.zoneName,\n      });\n      const selected = discovered.find(\n        (candidate) =>\n          candidate.accountId === target.accountId &&\n          candidate.zoneId === target.zoneId &&\n          candidate.zoneName === target.zoneName,\n      );\n      if (selected === undefined) {\n        return yield* Effect.fail(\n          failure(\n            \"forTarget\",\n            `Cloudflare target ${target.zoneName} is not visible to this credential`,\n            { reason: \"authorization\" },\n          ),\n        );\n      }\n      if (selected.evidence?.zoneType === \"internal\") {\n        return yield* Effect.fail(\n          failure(\"forTarget\", \"Cloudflare internal zones cannot host managed DNS records\", {\n            reason: \"unsupported\",\n          }),\n        );\n      }\n      const client = makeClient({ ...options, accountId: selected.accountId, target: selected });\n      return {\n        id: client.id,\n        createRecord: client.createRecord,\n        deleteRecord: client.deleteRecord,\n        getRecord: client.getRecord,\n        listRecords: client.listRecords,\n      } satisfies DnsProvider.Interface;\n    }),\n  );\n\n  const validateToken = Effect.fn(\"CloudflareClient.validateToken\")(() =>\n    Effect.gen(function* () {\n      const path =\n        options.tokenKind === \"account\"\n          ? options.accountId === undefined\n            ? yield* Effect.fail(\n                failure(\"validateToken\", \"Cloudflare account tokens require an account ID\", {\n                  reason: \"request\",\n                }),\n              )\n            : `/accounts/${encodeURIComponent(options.accountId)}/tokens/verify`\n          : \"/user/tokens/verify\";\n      const expiresAt = yield* inspectToken(path);\n      yield* allZones(options.accountId);\n      return {\n        accountId: options.accountId ?? \"\",\n        capabilities: options.capabilities,\n        expiresAt,\n        scopes: [],\n      };\n    }),\n  );\n\n  return {\n    id: \"cloudflare\",\n    providerId: \"cloudflare\",\n    createRecord,\n    deleteRecord,\n    getRecord,\n    listAccounts,\n    listRecords,\n    listZones,\n    listTargets,\n    resolveTarget,\n    forTarget,\n    validateToken,\n  };\n}\n\nconst targetFromZone = Effect.fn(\"CloudflareClient.targetFromZone\")((zone: Protocol.Zone) =>\n  Effect.gen(function* () {\n    const name = yield* DomainName.decode(zone.name).pipe(\n      Effect.mapError((cause) => failure(\"listTargets\", cause.message, { reason: \"response\" })),\n    );\n    const nameservers = yield* Effect.forEach(zone.name_servers, (nameserver) =>\n      DomainName.decode(nameserver).pipe(\n        Effect.mapError((cause) => failure(\"listTargets\", cause.message, { reason: \"response\" })),\n      ),\n    );\n    return {\n      accountId: zone.account.id,\n      accountKind: \"account\" as const,\n      evidence: {\n        accountName: zone.account.name,\n        nameservers,\n        status: zone.status ?? \"unknown\",\n        zoneType: zone.type ?? \"unknown\",\n      },\n      zoneId: zone.id,\n      zoneName: name,\n    } satisfies Connection.ProviderTarget;\n  }),\n);\n\nconst projectZone = Effect.fn(\"CloudflareClient.projectZone\")((zone: Protocol.Zone) =>\n  Effect.gen(function* () {\n    const name = yield* DomainName.decode(zone.name).pipe(\n      Effect.mapError((cause) => failure(\"listZones\", cause.message, { reason: \"response\" })),\n    );\n    const nameservers = yield* Effect.forEach(zone.name_servers, (nameserver) =>\n      DomainName.decode(nameserver).pipe(\n        Effect.mapError((cause) => failure(\"listZones\", cause.message, { reason: \"response\" })),\n      ),\n    );\n    return {\n      accountId: zone.account.id,\n      id: zone.id,\n      name,\n      nameservers,\n      status: zone.status ?? null,\n    };\n  }),\n);\n\nfunction decode<A>(\n  schema: S.ConstraintCodec<A, unknown, never, unknown>,\n  input: unknown,\n  operation: string,\n  response: Response,\n): Effect.Effect<A, DnsProvider.Error> {\n  return S.decodeUnknownEffect(schema)(input).pipe(\n    Effect.mapError((cause) =>\n      failure(operation, `Cloudflare response did not match its API contract: ${cause.message}`, {\n        reason: \"response\",\n        status: response.status,\n      }),\n    ),\n  );\n}\n\nfunction ensureSuccess(\n  input: unknown,\n  operation: string,\n  response: Response,\n): Effect.Effect<void, DnsProvider.Error> {\n  return S.decodeUnknownEffect(Protocol.BaseEnvelope)(input).pipe(\n    Effect.mapError(() =>\n      failure(operation, \"Cloudflare response did not contain a valid API envelope\", {\n        reason: \"response\",\n        status: response.status,\n      }),\n    ),\n    Effect.flatMap((envelope) => {\n      if (response.ok && envelope.success) return Effect.void;\n      const detail = envelope.errors[0];\n      const retryAfterMs = retryAfter(response.headers.get(\"retry-after\"));\n      return Effect.fail(\n        failure(\n          operation,\n          detail?.message ?? `Cloudflare request failed with HTTP ${response.status}`,\n          {\n            ...(detail === undefined ? {} : { code: detail.code }),\n            reason: reason(response.status, detail?.code),\n            ...(retryAfterMs === undefined ? {} : { retryAfterMs }),\n            status: response.status,\n          },\n        ),\n      );\n    }),\n  );\n}\n\nfunction reason(status: number, code?: number): DnsProvider.ErrorReason {\n  if (status === 401) return \"authentication\";\n  if (status === 403) return \"authorization\";\n  if (status === 404) return \"not_found\";\n  if (status === 409 || code === 81056 || code === 81057 || code === 81058) return \"conflict\";\n  if (status === 429) return \"rate_limit\";\n  if (status >= 500) return \"response\";\n  return \"request\";\n}\n\nfunction retryAfter(value: string | null): number | undefined {\n  if (value === null) return undefined;\n  const seconds = Number(value);\n  if (Number.isFinite(seconds)) return Math.max(0, seconds * 1_000);\n  const date = Date.parse(value);\n  return Number.isNaN(date) ? undefined : Math.max(0, date - Date.now());\n}\n\nfunction failure(\n  operation: string,\n  message: string,\n  fields: Partial<Pick<DnsProvider.Error, \"code\" | \"reason\" | \"retryAfterMs\" | \"status\">> = {},\n): DnsProvider.Error {\n  return new DnsProvider.Error({\n    ...fields,\n    message,\n    operation,\n    providerId: \"cloudflare\",\n  });\n}\n","import * as oauth from \"oauth4webapi\";\nimport { Clock, Effect, Schema } from \"effect\";\n\nimport * as AuthorizationCode from \"../../auth/authorization-code.ts\";\nimport * as Connection from \"../../auth/connect.ts\";\nimport * as ProviderAuthorization from \"../../auth/authorization.ts\";\nimport type * as ProviderAuth from \"../../auth/manifest.ts\";\nimport * as ProviderContext from \"../../auth/provider-context.ts\";\nimport * as Secret from \"../../auth/secret.ts\";\nimport type * as DomainName from \"../../domain/domain-name.ts\";\nimport * as DnsProvider from \"../../provider/provider.ts\";\nimport * as Client from \"./client.ts\";\nimport * as ProviderSession from \"../../provider/session.ts\";\n\nconst authorizationServer = {\n  authorization_endpoint: \"https://dash.cloudflare.com/oauth2/auth\",\n  issuer: \"https://dash.cloudflare.com\",\n  revocation_endpoint: \"https://dash.cloudflare.com/oauth2/revoke\",\n  token_endpoint: \"https://dash.cloudflare.com/oauth2/token\",\n} as const;\n\nconst Context = Schema.Struct({\n  accountId: Schema.optionalKey(Schema.String),\n  tokenKind: Schema.Literals([\"account\", \"user\"]),\n});\nexport type Context = typeof Context.Type;\nexport const contextCodec = ProviderContext.codec(\"cloudflare.v1\", Context);\n\n/** Describes Cloudflare's caller-created API-token authorization method. */\nexport function tokenMethod(\n  capabilities: ProviderAuth.TokenValidation[\"capabilities\"],\n): Extract<ProviderAuth.Manifest[\"methods\"][number], { readonly _tag: \"token\" }> {\n  return {\n    _tag: \"token\",\n    capabilities: [...capabilities],\n    instructionsUrl: \"https://developers.cloudflare.com/fundamentals/api/get-started/create-token/\",\n  };\n}\n\nexport interface OAuthMethodOptions {\n  /** Scope IDs assigned to the OAuth client by Cloudflare. */\n  readonly scopes: ReadonlyArray<string>;\n  /** Capabilities represented by those assigned scope IDs. */\n  readonly capabilities: ProviderAuth.TokenValidation[\"capabilities\"];\n  readonly clientAuth: ProviderAuth.OAuthMethod[\"clientAuth\"];\n}\n\n/** Describes a registered Cloudflare OAuth client and its assigned scope IDs. */\nexport function oauthMethod(options: OAuthMethodOptions): ProviderAuth.OAuthMethod {\n  return {\n    _tag: \"oauth2\",\n    authorizationServer,\n    capabilities: [...options.capabilities],\n    clientAuth: options.clientAuth,\n    scopes: [...options.scopes],\n  };\n}\n\n/** Creates the Cloudflare token and OAuth authorization manifest. */\nexport function manifest(options: OAuthMethodOptions): ProviderAuth.Manifest {\n  return {\n    methods: [tokenMethod(options.capabilities), oauthMethod(options)],\n    providerId: \"cloudflare\",\n  };\n}\n\ntype CredentialOptions = Omit<Client.Options, \"accountId\" | \"token\" | \"tokenKind\">;\n\n/** Selects an explicit Cloudflare account or discovers it from an authorized domain. */\nexport type CredentialTarget =\n  | {\n      readonly accountId: string;\n      readonly domain?: never;\n    }\n  | {\n      readonly accountId?: never;\n      readonly domain: DomainName.DomainName;\n    };\n\nexport type SubjectResolverOptions = CredentialOptions & CredentialTarget;\n\n/** Configuration for validating a Cloudflare token against an account or authorized domain. */\nexport type TokenValidatorOptions = CredentialOptions &\n  (\n    | {\n        readonly accountId: string;\n        readonly domain?: never;\n        readonly tokenKind?: \"account\" | \"user\";\n      }\n    | {\n        readonly accountId?: never;\n        readonly domain: DomainName.DomainName;\n        readonly tokenKind?: \"account\" | \"user\";\n      }\n  );\n\n/** Resolves the Cloudflare account selected by a completed OAuth authorization. */\nexport function subjectResolver(\n  options: SubjectResolverOptions,\n): ProviderAuth.OAuthSubjectResolver {\n  return (tokens: oauth.TokenEndpointResponse, accessToken: Secret.Value) =>\n    Effect.gen(function* () {\n      const accountId =\n        options.accountId ??\n        (yield* Client.discoverAuthorizationAccount({\n          ...(options.baseUrl === undefined ? {} : { baseUrl: options.baseUrl }),\n          domain: options.domain,\n          ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          token: accessToken,\n        }).pipe(Effect.map((account) => account.id)));\n      if (options.accountId !== undefined) {\n        yield* Client.make({\n          accountId: options.accountId,\n          ...(options.baseUrl === undefined ? {} : { baseUrl: options.baseUrl }),\n          capabilities: options.capabilities,\n          ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          token: accessToken,\n          tokenKind: \"user\",\n        }).listZones();\n      }\n      const now = yield* Clock.currentTimeMillis;\n      return {\n        accountId,\n        expiresAt:\n          typeof tokens.expires_in === \"number\" ? new Date(now + tokens.expires_in * 1_000) : null,\n      };\n    });\n}\n\n/** Creates a host callback that validates a Cloudflare API token. */\nexport function tokenValidator(\n  options: TokenValidatorOptions,\n): (token: Secret.Value) => ReturnType<Client.Interface[\"validateToken\"]> {\n  return (token) =>\n    options.accountId === undefined\n      ? Client.validateDomainToken({\n          ...(options.baseUrl === undefined ? {} : { baseUrl: options.baseUrl }),\n          capabilities: options.capabilities,\n          domain: options.domain,\n          ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          token,\n          ...(options.tokenKind === undefined ? {} : { tokenKind: options.tokenKind }),\n        })\n      : Client.make({\n          accountId: options.accountId,\n          ...(options.baseUrl === undefined ? {} : { baseUrl: options.baseUrl }),\n          capabilities: options.capabilities,\n          ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          token,\n          ...(options.tokenKind === undefined ? {} : { tokenKind: options.tokenKind }),\n        }).validateToken();\n}\n\nexport type TokenConnectionOptions = TokenValidatorOptions & {\n  readonly token: Secret.Value;\n};\n\n/** Creates a provider-independent token connection method backed by Cloudflare validation. */\nexport function tokenConnectionMethod(\n  options: TokenConnectionOptions,\n): Extract<Connection.Method, { readonly _tag: \"Token\" }> {\n  const requiredCapabilities = [...options.capabilities];\n  return Connection.Method.Token({\n    authenticate: Effect.fn(\"CloudflareAuth.authenticateToken\")(function* (token) {\n      const validated = yield* tokenValidator(options)(token);\n      const observedAt = new Date(yield* Clock.currentTimeMillis);\n      return {\n        capabilityEvidence: validated.capabilities.map((capability) => ({\n          capability,\n          evidence: ProviderAuthorization.Evidence.Introspected({ observedAt }),\n        })),\n        credential: {\n          accessToken: token,\n          expiresAt: validated.expiresAt,\n          refreshToken: null,\n          tokenType: \"bearer\",\n        },\n        providerAccountId: validated.accountId,\n        providerContext: yield* contextCodec.encode(\n          options.tokenKind === \"account\"\n            ? { accountId: validated.accountId, tokenKind: \"account\" }\n            : { tokenKind: \"user\" },\n        ),\n        scopes: [...validated.scopes],\n      } satisfies Connection.Authentication;\n    }),\n    providerId: \"cloudflare\",\n    requiredCapabilities,\n    token: options.token,\n  });\n}\n\n/** Converts a completed Cloudflare OAuth authorization into canonical connection authentication. */\nexport const oauthAuthentication = Effect.fn(\"CloudflareAuth.oauthAuthentication\")(function* (\n  options: SubjectResolverOptions & {\n    readonly accessToken: Secret.Value;\n    readonly tokens: oauth.TokenEndpointResponse;\n  },\n) {\n  const resolved = yield* subjectResolver(options)(options.tokens, options.accessToken);\n  const observedAt = new Date(yield* Clock.currentTimeMillis);\n  return {\n    capabilityEvidence: options.capabilities.map((capability) => ({\n      capability,\n      evidence: ProviderAuthorization.Evidence.Introspected({ observedAt }),\n    })),\n    credential: {\n      accessToken: options.accessToken,\n      expiresAt: resolved.expiresAt,\n      refreshToken:\n        options.tokens.refresh_token === undefined\n          ? null\n          : Secret.Value.from(options.tokens.refresh_token),\n      tokenType: options.tokens.token_type,\n    },\n    providerAccountId: resolved.accountId,\n    providerContext: yield* contextCodec.encode({ tokenKind: \"user\" }),\n    scopes: (options.tokens.scope ?? \"\").split(\" \").filter(Boolean),\n  } satisfies Connection.Authentication;\n});\n\n/** Restore a credential-scoped Cloudflare session from persisted authorization state. */\nexport function restore(\n  options: ProviderSession.RestoreInput & Pick<Client.Options, \"baseUrl\" | \"fetch\">,\n): Effect.Effect<Client.Interface, DnsProvider.Error> {\n  return Effect.gen(function* () {\n    if (options.authorization.providerId !== \"cloudflare\") {\n      return yield* Effect.fail(\n        failure(\"restore\", \"Provider authorization belongs to another provider\", \"authorization\"),\n      );\n    }\n    if (options.authorization.method === \"integration\") {\n      return yield* Effect.fail(\n        failure(\"restore\", \"Cloudflare does not support integration credentials\", \"unsupported\"),\n      );\n    }\n    if (options.authorization.revocation._tag !== \"Active\") {\n      return yield* Effect.fail(\n        failure(\"restore\", \"Cloudflare authorization is pending revocation\", \"authorization\"),\n      );\n    }\n    const missingCapability = options.authorization.requiredCapabilities.find(\n      (capability) =>\n        !options.authorization.capabilityEvidence.some((item) => item.capability === capability),\n    );\n    if (missingCapability !== undefined) {\n      return yield* Effect.fail(\n        failure(\n          \"restore\",\n          `Cloudflare authorization lacks evidence for ${missingCapability}`,\n          \"authorization\",\n        ),\n      );\n    }\n    if (\n      options.credential.expiresAt !== null &&\n      (Number.isNaN(options.credential.expiresAt.valueOf()) ||\n        options.credential.expiresAt <= new Date())\n    ) {\n      return yield* Effect.fail(\n        failure(\"restore\", \"Cloudflare authorization has expired\", \"authentication\"),\n      );\n    }\n    const context = yield* contextCodec\n      .decode(options.authorization.providerContext)\n      .pipe(Effect.mapError((cause) => failure(\"restore\", cause.message, \"response\")));\n    return Client.make({\n      ...(context.accountId === undefined ? {} : { accountId: context.accountId }),\n      ...(options.baseUrl === undefined ? {} : { baseUrl: options.baseUrl }),\n      capabilities: options.authorization.capabilityEvidence.map(({ capability }) => capability),\n      ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n      token: options.credential.accessToken,\n      tokenKind: context.tokenKind,\n    });\n  });\n}\n\nexport interface RefreshCredentialOptions {\n  readonly client: ProviderAuth.OAuthClientConfiguration;\n  readonly clientAuth: ProviderAuth.OAuthMethod[\"clientAuth\"];\n  readonly credential: ProviderSession.Credential;\n  readonly fetch?: Client.Fetch;\n}\n\n/** Exchanges a Cloudflare refresh token for a fresh provider credential. */\nexport const refreshCredential = Effect.fn(\"CloudflareAuth.refreshCredential\")(function* (\n  options: RefreshCredentialOptions,\n) {\n  if (options.credential.refreshToken === null) {\n    return yield* new Connection.Error({\n      category: \"authorization\",\n      message: \"Cloudflare credential has no refresh token\",\n      operation: \"CloudflareAuth.refreshCredential\",\n      retry: \"after-user-action\",\n    });\n  }\n  const refreshToken = options.credential.refreshToken;\n  const client: oauth.Client = { client_id: options.client.clientId };\n  const authentication = yield* Effect.try({\n    try: () => clientAuthentication(options.clientAuth, options.client),\n    catch: () =>\n      new Connection.Error({\n        category: \"authorization\",\n        message: \"Cloudflare OAuth client authentication is invalid\",\n        operation: \"CloudflareAuth.refreshCredential\",\n        retry: \"never\",\n      }),\n  });\n  const fetch = options.fetch;\n  const tokens = yield* Effect.tryPromise({\n    try: async (signal) => {\n      const request = await oauth.refreshTokenGrantRequest(\n        authorizationServer,\n        client,\n        authentication,\n        refreshToken.expose(),\n        fetch === undefined\n          ? { signal }\n          : {\n              signal,\n              [oauth.customFetch]: (url, init) => fetch(url, { ...init, body: init.body }),\n            },\n      );\n      return oauth.processRefreshTokenResponse(authorizationServer, client, request);\n    },\n    catch: (cause) => refreshFailure(cause),\n  });\n  const now = yield* Clock.currentTimeMillis;\n  return {\n    accessToken: Secret.Value.from(tokens.access_token),\n    expiresAt:\n      typeof tokens.expires_in === \"number\" ? new Date(now + tokens.expires_in * 1_000) : null,\n    refreshToken:\n      tokens.refresh_token === undefined ? refreshToken : Secret.Value.from(tokens.refresh_token),\n    tokenType: tokens.token_type,\n  } satisfies ProviderSession.Credential;\n});\n\nexport type OAuthFlowOptions = SubjectResolverOptions & {\n  readonly client: ProviderAuth.OAuthClientConfiguration;\n  readonly clientAuth: ProviderAuth.OAuthMethod[\"clientAuth\"];\n  readonly redirectUri: string;\n  readonly scopes: ReadonlyArray<string>;\n};\n\n/** Creates Cloudflare's OAuth implementation of the common interactive connection capability. */\nexport function oauthFlow(options: OAuthFlowOptions): Connection.InteractiveFlow {\n  const method = oauthMethod({\n    capabilities: options.capabilities,\n    clientAuth: options.clientAuth,\n    scopes: options.scopes,\n  });\n  return {\n    complete: Effect.fn(\"CloudflareAuth.oauthFlow.complete\")(function* (payload, callbackUrl) {\n      const tokens = yield* AuthorizationCode.complete({\n        callbackUrl,\n        client: options.client,\n        ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n        method,\n        payload,\n        providerId: \"cloudflare\",\n      });\n      return yield* oauthAuthentication({\n        ...(options.accountId === undefined\n          ? { domain: options.domain }\n          : { accountId: options.accountId }),\n        ...(options.baseUrl === undefined ? {} : { baseUrl: options.baseUrl }),\n        capabilities: options.capabilities,\n        ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n        accessToken: Secret.make(tokens.access_token),\n        tokens,\n      });\n    }),\n    method: \"oauth2\",\n    providerId: \"cloudflare\",\n    requiredCapabilities: [...options.capabilities],\n    start: (continuationId) =>\n      AuthorizationCode.start({\n        client: options.client,\n        method,\n        redirectUri: options.redirectUri,\n        state: continuationId,\n      }),\n  };\n}\n\nfunction failure(\n  operation: string,\n  message: string,\n  reason: DnsProvider.ErrorReason,\n): DnsProvider.Error {\n  return new DnsProvider.Error({ message, operation, providerId: \"cloudflare\", reason });\n}\n\nfunction clientAuthentication(\n  method: ProviderAuth.OAuthMethod[\"clientAuth\"],\n  client: ProviderAuth.OAuthClientConfiguration,\n): oauth.ClientAuth {\n  if (method === \"none\") return oauth.None();\n  if (client.clientSecret === undefined) throw new Error(\"Client secret is required\");\n  return method === \"client_secret_basic\"\n    ? oauth.ClientSecretBasic(client.clientSecret.expose())\n    : oauth.ClientSecretPost(client.clientSecret.expose());\n}\n\nfunction refreshFailure(cause: unknown): Connection.Error | DnsProvider.Error {\n  if (\n    cause instanceof oauth.ResponseBodyError &&\n    [\"invalid_client\", \"invalid_grant\"].includes(cause.error)\n  ) {\n    return new Connection.Error({\n      category: \"authorization\",\n      message: \"Cloudflare authorization can no longer be refreshed\",\n      operation: \"CloudflareAuth.refreshCredential\",\n      retry: \"after-user-action\",\n    });\n  }\n  return failure(\n    \"refreshCredential\",\n    cause instanceof Error ? cause.message : \"Cloudflare token refresh failed\",\n    cause instanceof oauth.ResponseBodyError ? \"response\" : \"transport\",\n  );\n}\n","import { Schema as S } from \"effect\";\n\nexport const Pagination = S.Struct({\n  count: S.Number,\n  next: S.NullOr(S.Number),\n  prev: S.NullOr(S.Number),\n});\nexport interface Pagination extends S.Schema.Type<typeof Pagination> {}\n\nexport const ErrorDetail = S.Struct({\n  code: S.String,\n  message: S.String,\n  limit: S.optionalKey(\n    S.Struct({\n      remaining: S.Number,\n      reset: S.optionalKey(S.Number),\n      resetMs: S.optionalKey(S.Number),\n      total: S.Number,\n    }),\n  ),\n});\nexport interface ErrorDetail extends S.Schema.Type<typeof ErrorDetail> {}\n\nexport const ErrorEnvelope = S.Struct({ error: ErrorDetail });\n\nexport const User = S.Struct({\n  id: S.String,\n  name: S.NullOr(S.String),\n  username: S.String,\n});\nexport interface User extends S.Schema.Type<typeof User> {}\n\nexport const UserEnvelope = S.Struct({ user: User });\n\nexport const Team = S.Struct({\n  id: S.String,\n  name: S.NullOr(S.String),\n  slug: S.String,\n});\nexport interface Team extends S.Schema.Type<typeof Team> {}\n\nexport const TeamListEnvelope = S.Struct({\n  pagination: Pagination,\n  teams: S.Array(Team),\n});\n\nexport const Domain = S.Struct({\n  id: S.String,\n  intendedNameservers: S.Array(S.String),\n  name: S.String,\n  nameservers: S.Array(S.String),\n  serviceType: S.Literals([\"zeit.world\", \"external\", \"na\"]),\n  teamId: S.NullOr(S.String),\n  userId: S.String,\n  verified: S.Boolean,\n  zone: S.optionalKey(S.Boolean),\n});\nexport interface Domain extends S.Schema.Type<typeof Domain> {}\n\nexport const DomainConfig = S.Struct({\n  misconfigured: S.Boolean,\n  serviceType: S.Literals([\"zeit.world\", \"external\", \"na\"]),\n});\nexport interface DomainConfig extends S.Schema.Type<typeof DomainConfig> {}\n\nexport const DomainEnvelope = S.Struct({ domain: Domain });\n\nexport const DomainListEnvelope = S.Struct({\n  domains: S.Array(Domain),\n  pagination: Pagination,\n});\n\nexport const Record = S.Struct({\n  id: S.String,\n  mxPriority: S.optionalKey(S.Number),\n  name: S.String,\n  priority: S.optionalKey(S.Number),\n  ttl: S.optionalKey(S.Number),\n  type: S.String,\n  value: S.String,\n});\nexport interface Record extends S.Schema.Type<typeof Record> {}\n\nexport const RecordListEnvelope = S.Struct({\n  pagination: S.optionalKey(Pagination),\n  records: S.Array(Record),\n});\n\nexport const CreateRecordEnvelope = S.Struct({\n  uid: S.String,\n  updated: S.optionalKey(S.Number),\n});\n\nexport const IntegrationToken = S.Struct({\n  access_token: S.String,\n  installation_id: S.optionalKey(S.String),\n  team_id: S.NullOr(S.String),\n  token_type: S.optionalKey(S.String),\n  user_id: S.String,\n});\nexport interface IntegrationToken extends S.Schema.Type<typeof IntegrationToken> {}\n","import { Effect, Schema as S } from \"effect\";\n\nimport * as DomainName from \"../../domain/domain-name.ts\";\nimport * as DnsRecord from \"../../domain/dns-record.ts\";\nimport * as DnsProvider from \"../../provider/provider.ts\";\nimport type * as Protocol from \"./protocol.ts\";\n\nexport type CreateBody = Readonly<Record<string, unknown>>;\n\nexport const decode = Effect.fn(\"VercelRecords.decode\")(\n  (zone: DomainName.DomainName, record: Protocol.Record) =>\n    Effect.gen(function* () {\n      const absolute = absoluteNameCandidate(zone, record.name);\n      const name = yield* DomainName.decode(absolute).pipe(\n        Effect.match({ onFailure: () => null, onSuccess: (value) => value }),\n      );\n      if (name === null) return yield* decodeOpaque(record, absolute);\n      const common = {\n        metadata: {\n          ownership: \"provider\",\n          provenance: \"vercel\",\n          purpose: \"existing DNS record\",\n        },\n        name,\n        policy: record.type === \"CNAME\" ? \"exclusive\" : \"append\",\n        ttl: record.ttl ?? 60,\n      } as const;\n      const fromRecord = (input: unknown) =>\n        DnsRecord.decode(input).pipe(\n          Effect.mapError((cause) => failure(\"decodeRecord\", cause.message)),\n        );\n\n      switch (record.type) {\n        case \"A\":\n        case \"AAAA\":\n          return yield* fromRecord({ ...common, _tag: record.type, address: record.value });\n        case \"CNAME\":\n        case \"NS\":\n          return yield* fromRecord({ ...common, _tag: record.type, target: record.value });\n        case \"TXT\":\n          return yield* fromRecord({ ...common, _tag: \"TXT\", value: record.value });\n        case \"MX\":\n          return yield* fromRecord({\n            ...common,\n            _tag: \"MX\",\n            exchange: record.value,\n            priority: record.mxPriority ?? record.priority,\n          });\n        case \"CAA\": {\n          const match = record.value.match(\n            /^(\\d{1,3})\\s+(issue|issuewild|iodef)\\s+(?:\"((?:\\\\.|[^\"])*)\"|(\\S.*))$/,\n          );\n          if (match === null) {\n            return yield* Effect.fail(\n              failure(\"decodeRecord\", \"Vercel CAA record has an invalid value\"),\n            );\n          }\n          return yield* fromRecord({\n            ...common,\n            _tag: \"CAA\",\n            flags: Number(match[1]),\n            tag: match[2],\n            value: unescapeQuoted(match[3] ?? match[4] ?? \"\"),\n          });\n        }\n        case \"SRV\": {\n          const parts = record.value.trim().split(/\\s+/);\n          const [priority, weight, port, target] =\n            parts.length === 4\n              ? parts\n              : [String(record.priority ?? \"\"), parts[0], parts[1], parts[2]];\n          return yield* fromRecord({\n            ...common,\n            _tag: \"SRV\",\n            port: Number(port),\n            priority: Number(priority),\n            target,\n            weight: Number(weight),\n          });\n        }\n        default:\n          return yield* decodeOpaque(record, name);\n      }\n    }),\n);\n\nconst decodeOpaque = Effect.fn(\"VercelRecords.decodeOpaque\")(\n  (record: Protocol.Record, name: string) =>\n    S.decodeUnknownEffect(DnsRecord.Opaque)({\n      _tag: \"Opaque\",\n      name,\n      providerRecordId: record.id,\n      providerType: record.type,\n    }).pipe(Effect.mapError((cause) => failure(\"decodeRecord\", cause.message))),\n);\n\nexport function encode(zone: DomainName.DomainName, record: DnsRecord.DnsRecord): CreateBody {\n  const common = {\n    name: relativeName(zone, record.name),\n    ...(record.ttl === null ? {} : { ttl: record.ttl }),\n    type: record._tag,\n  };\n  switch (record._tag) {\n    case \"A\":\n    case \"AAAA\":\n      return { ...common, value: record.address };\n    case \"CNAME\":\n    case \"NS\":\n      return { ...common, value: record.target };\n    case \"TXT\":\n      return { ...common, value: record.value };\n    case \"MX\":\n      return { ...common, mxPriority: record.priority, value: record.exchange };\n    case \"CAA\":\n      return {\n        ...common,\n        value: `${record.flags} ${record.tag} \"${escapeQuoted(record.value)}\"`,\n      };\n    case \"SRV\":\n      return {\n        ...common,\n        srv: {\n          port: record.port,\n          priority: record.priority,\n          target: record.target,\n          weight: record.weight,\n        },\n      };\n  }\n}\n\nfunction absoluteNameCandidate(zone: DomainName.DomainName, name: string): string {\n  return name === \"\" || name === \"@\"\n    ? zone\n    : name === zone || name.endsWith(`.${zone}`)\n      ? name\n      : `${name}.${zone}`;\n}\n\nfunction relativeName(zone: DomainName.DomainName, name: DomainName.DomainName): string {\n  if (name === zone) return \"\";\n  const suffix = `.${zone}`;\n  if (!name.endsWith(suffix)) {\n    throw failure(\"encodeRecord\", `DNS record ${name} is outside Vercel zone ${zone}`, {\n      reason: \"request\",\n    });\n  }\n  return name.slice(0, -suffix.length);\n}\n\nfunction escapeQuoted(value: string): string {\n  return value.replaceAll(\"\\\\\", \"\\\\\\\\\").replaceAll('\"', '\\\\\"');\n}\n\nfunction unescapeQuoted(value: string): string {\n  return value.replace(/\\\\([\\\\\"])/g, \"$1\");\n}\n\nfunction failure(\n  operation: string,\n  message: string,\n  fields: Partial<Pick<DnsProvider.Error, \"reason\">> = {},\n): DnsProvider.Error {\n  return new DnsProvider.Error({\n    message,\n    operation,\n    providerId: \"vercel\",\n    reason: fields.reason ?? \"response\",\n  });\n}\n","import { Effect, Schema as S } from \"effect\";\n\nimport type * as ProviderAuth from \"../../auth/manifest.ts\";\nimport type * as Secret from \"../../auth/secret.ts\";\nimport * as Connection from \"../../auth/connection.ts\";\nimport * as DomainName from \"../../domain/domain-name.ts\";\nimport type * as DnsRecord from \"../../domain/dns-record.ts\";\nimport type * as ZoneDiscovery from \"../../discovery/zone-discovery.ts\";\nimport * as Zones from \"../../discovery/zones.ts\";\nimport * as DnsProvider from \"../../provider/provider.ts\";\nimport * as ProviderSession from \"../../provider/session.ts\";\nimport * as Protocol from \"./protocol.ts\";\nimport * as Records from \"./records.ts\";\n\nexport type Fetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;\n\n/** Selects whether Vercel requests operate on a personal account or a team. */\nexport type AccountContext =\n  | { readonly _tag: \"personal\" }\n  | { readonly _tag: \"team\"; readonly teamId: string };\n\n/** Configuration for an Effect-native Vercel authoritative-DNS client. */\nexport interface Options {\n  readonly baseUrl?: string;\n  /** Capabilities the host required when issuing or authorizing this credential. */\n  readonly capabilities: ProviderAuth.TokenValidation[\"capabilities\"];\n  readonly context: AccountContext;\n  readonly fetch?: Fetch;\n  readonly token: Secret.Value;\n}\n\nexport interface ListZonesInput {\n  readonly name?: DomainName.DomainName;\n}\n\n/** A Vercel account visible to the supplied credential. */\nexport interface Account {\n  readonly id: string;\n  readonly name: string;\n  readonly type: \"personal\" | \"team\";\n}\n\n/** A Vercel-managed authoritative zone with normalized nameserver evidence. */\nexport interface Zone {\n  readonly accountId: string;\n  readonly id: string;\n  readonly name: DomainName.DomainName;\n  readonly nameservers: ReadonlyArray<DomainName.DomainName>;\n  readonly status: \"active\" | \"pending\";\n}\n\nexport interface Interface extends DnsProvider.Interface {\n  readonly providerId: \"vercel\";\n  readonly forTarget: (\n    target: Connection.ProviderTarget,\n  ) => Effect.Effect<DnsProvider.Interface, DnsProvider.Error>;\n  readonly listAccounts: () => Effect.Effect<ReadonlyArray<Account>, DnsProvider.Error>;\n  readonly listZones: (\n    input?: ListZonesInput,\n  ) => Effect.Effect<ReadonlyArray<Zone>, DnsProvider.Error>;\n  readonly listTargets: (\n    input?: ProviderSession.ListTargetsInput,\n  ) => Effect.Effect<ReadonlyArray<Connection.ProviderTarget>, DnsProvider.Error>;\n  readonly resolveTarget: (\n    domain: DomainName.DomainName,\n  ) => Effect.Effect<ProviderSession.Resolution, DnsProvider.Error>;\n  readonly validateToken: () => Effect.Effect<ProviderAuth.TokenValidation, DnsProvider.Error>;\n}\n\n/** Exposes Vercel zone lookup as the optional provider discovery capability. */\nexport function discovery(client: Interface): ZoneDiscovery.Source {\n  return {\n    listZones: (name) => client.listZones({ name }),\n    provider: client,\n  };\n}\n\ninterface TargetOptions {\n  readonly target: Connection.ProviderTarget;\n}\n\ntype InternalOptions = Options & Partial<TargetOptions>;\n\n/** Creates an Effect-native Vercel client without owning the credential lifecycle. */\nexport function make(options: Options): Interface {\n  return makeClient(options);\n}\n\nfunction makeClient(options: InternalOptions): Interface {\n  const fetch = options.fetch ?? globalThis.fetch;\n  const baseUrl = (options.baseUrl ?? \"https://api.vercel.com\").replace(/\\/$/, \"\");\n\n  const withContext = (path: string, values: Readonly<Record<string, string>> = {}) => {\n    const url = new URL(`${baseUrl}${path}`);\n    for (const [key, value] of Object.entries(values)) url.searchParams.set(key, value);\n    if (options.context._tag === \"team\") url.searchParams.set(\"teamId\", options.context.teamId);\n    return url;\n  };\n\n  const request = Effect.fn(\"VercelClient.request\")(\n    (url: URL, operation: string, init?: RequestInit) =>\n      Effect.gen(function* () {\n        const response = yield* Effect.tryPromise({\n          try: () =>\n            fetch(url, {\n              ...init,\n              headers: {\n                Accept: \"application/json\",\n                Authorization: `Bearer ${options.token.expose()}`,\n                ...(init?.body === undefined ? {} : { \"Content-Type\": \"application/json\" }),\n                ...init?.headers,\n              },\n            }),\n          catch: () => failure(operation, \"Vercel request failed\", { reason: \"transport\" }),\n        });\n        const body = yield* Effect.tryPromise({\n          try: () => response.json() as Promise<unknown>,\n          catch: () =>\n            failure(\n              operation,\n              response.ok\n                ? \"Vercel returned a non-JSON response\"\n                : `Vercel request failed with HTTP ${response.status}`,\n              {\n                reason: response.ok ? \"response\" : reason(response.status),\n                ...rateLimit(response),\n                status: response.status,\n              },\n            ),\n        });\n        if (!response.ok) return yield* Effect.fail(apiFailure(body, operation, response));\n        return { body, response } as const;\n      }),\n  );\n\n  const allTeams = Effect.fn(\"VercelClient.allTeams\")(() =>\n    Effect.gen(function* () {\n      const teams: Array<Protocol.Team> = [];\n      let until: number | null = null;\n      while (true) {\n        const url = new URL(`${baseUrl}/v2/teams`);\n        url.searchParams.set(\"limit\", \"100\");\n        if (until !== null) url.searchParams.set(\"until\", String(until));\n        const { body, response } = yield* request(url, \"listAccounts\");\n        const envelope = yield* decode(Protocol.TeamListEnvelope, body, \"listAccounts\", response);\n        teams.push(...envelope.teams);\n        if (envelope.pagination.next === null) return teams;\n        until = envelope.pagination.next;\n      }\n    }),\n  );\n\n  const allDomains = Effect.fn(\"VercelClient.allDomains\")(() =>\n    Effect.gen(function* () {\n      const domains: Array<Protocol.Domain> = [];\n      let until: number | null = null;\n      while (true) {\n        const values: Record<string, string> = { limit: \"100\" };\n        if (until !== null) values.until = String(until);\n        const { body, response } = yield* request(withContext(\"/v5/domains\", values), \"listZones\");\n        const envelope = yield* decode(Protocol.DomainListEnvelope, body, \"listZones\", response);\n        domains.push(...envelope.domains);\n        if (envelope.pagination.next === null) return domains;\n        until = envelope.pagination.next;\n      }\n    }),\n  );\n\n  const discoverZone = Effect.fn(\"VercelClient.discoverZone\")((name: DomainName.DomainName) =>\n    Effect.gen(function* () {\n      const configResult = yield* request(\n        withContext(`/v6/domains/${encodeURIComponent(name)}/config`),\n        \"resolveZone\",\n      );\n      const config = yield* decode(\n        Protocol.DomainConfig,\n        configResult.body,\n        \"resolveZone\",\n        configResult.response,\n      );\n      const domainResult = yield* request(\n        withContext(`/v5/domains/${encodeURIComponent(name)}`),\n        \"resolveZone\",\n      );\n      const envelope = yield* decode(\n        Protocol.DomainEnvelope,\n        domainResult.body,\n        \"resolveZone\",\n        domainResult.response,\n      );\n      if (!hasDnsStorage(envelope.domain, config.serviceType)) {\n        return null;\n      }\n      return envelope.domain;\n    }).pipe(\n      Effect.catchTag(\"ProviderError\", (cause) =>\n        cause.reason === \"not_found\" ? Effect.succeed(null) : Effect.fail(cause),\n      ),\n    ),\n  );\n\n  const resolveZone = Effect.fn(\"VercelClient.resolveZone\")((name: DomainName.DomainName) =>\n    Effect.gen(function* () {\n      if (options.target !== undefined) {\n        if (name !== options.target.zoneName && !name.endsWith(`.${options.target.zoneName}`)) {\n          return yield* Effect.fail(\n            failure(\n              \"resolveZone\",\n              `Vercel target ${options.target.zoneName} does not cover ${name}`,\n              { reason: \"not_found\" },\n            ),\n          );\n        }\n        return options.target.zoneName;\n      }\n      const domain = yield* discoverZone(name);\n      if (domain === null) {\n        return yield* Effect.fail(\n          failure(\n            \"resolveZone\",\n            `Vercel zone ${name} is not configured for authoritative DNS in the selected account`,\n            { reason: \"not_found\" },\n          ),\n        );\n      }\n      return yield* DomainName.decode(domain.name).pipe(\n        Effect.mapError((cause) =>\n          failure(\"resolveZone\", `Vercel returned an invalid storage zone: ${cause.message}`),\n        ),\n      );\n    }),\n  );\n\n  const listRecords = Effect.fn(\"VercelClient.listRecords\")((zoneName: DomainName.DomainName) =>\n    Effect.gen(function* () {\n      const storageZone = yield* resolveZone(zoneName);\n      const records: Array<DnsRecord.Observed> = [];\n      let until: number | null = null;\n      while (true) {\n        const values: Record<string, string> = { limit: \"100\" };\n        if (until !== null) values.until = String(until);\n        const { body, response } = yield* request(\n          withContext(`/v5/domains/${encodeURIComponent(storageZone)}/records`, values),\n          \"listRecords\",\n        );\n        const envelope = yield* decode(Protocol.RecordListEnvelope, body, \"listRecords\", response);\n        records.push(\n          ...(yield* Effect.forEach(envelope.records, (record) =>\n            Records.decode(storageZone, record),\n          )),\n        );\n        const next = envelope.pagination?.next ?? null;\n        if (next === null) {\n          return records.filter(\n            (record) => record.name === zoneName || record.name.endsWith(`.${zoneName}`),\n          );\n        }\n        until = next;\n      }\n    }),\n  );\n\n  const createRecord = Effect.fn(\"VercelClient.createRecord\")(\n    (zoneName: DomainName.DomainName, record: DnsRecord.DnsRecord) =>\n      Effect.gen(function* () {\n        const storageZone = yield* resolveZone(zoneName);\n        const body = yield* Effect.try({\n          try: () => Records.encode(storageZone, record),\n          catch: (cause) =>\n            cause instanceof DnsProvider.Error\n              ? cause\n              : failure(\"createRecord\", \"Vercel record could not be encoded\", {\n                  reason: \"request\",\n                }),\n        });\n        const result = yield* request(\n          withContext(`/v2/domains/${encodeURIComponent(storageZone)}/records`),\n          \"createRecord\",\n          { body: JSON.stringify(body), method: \"POST\" },\n        );\n        const envelope = yield* decode(\n          Protocol.CreateRecordEnvelope,\n          result.body,\n          \"createRecord\",\n          result.response,\n        );\n        return { providerRecordId: envelope.uid };\n      }),\n  );\n\n  const getRecord = Effect.fn(\"VercelClient.getRecord\")(\n    (zoneName: DomainName.DomainName, providerRecordId: string) =>\n      Effect.gen(function* () {\n        const storageZone = yield* resolveZone(zoneName);\n        let until: number | null = null;\n        while (true) {\n          const values: Record<string, string> = { limit: \"100\" };\n          if (until !== null) values.until = String(until);\n          const { body, response } = yield* request(\n            withContext(`/v5/domains/${encodeURIComponent(storageZone)}/records`, values),\n            \"getRecord\",\n          );\n          const envelope = yield* decode(Protocol.RecordListEnvelope, body, \"getRecord\", response);\n          const record = envelope.records.find(({ id }) => id === providerRecordId);\n          if (record !== undefined) return yield* Records.decode(storageZone, record);\n          const next = envelope.pagination?.next ?? null;\n          if (next === null) return null;\n          until = next;\n        }\n      }),\n  );\n\n  const deleteRecord = Effect.fn(\"VercelClient.deleteRecord\")(\n    (zoneName: DomainName.DomainName, providerRecordId: string) =>\n      Effect.gen(function* () {\n        const storageZone = yield* resolveZone(zoneName);\n        yield* request(\n          withContext(\n            `/v2/domains/${encodeURIComponent(storageZone)}/records/${encodeURIComponent(providerRecordId)}`,\n          ),\n          \"deleteRecord\",\n          { method: \"DELETE\" },\n        );\n      }),\n  );\n\n  const listAccounts = Effect.fn(\"VercelClient.listAccounts\")(() =>\n    Effect.gen(function* () {\n      const userResult = yield* request(new URL(`${baseUrl}/v2/user`), \"listAccounts\");\n      const { user } = yield* decode(\n        Protocol.UserEnvelope,\n        userResult.body,\n        \"listAccounts\",\n        userResult.response,\n      );\n      const teams = yield* allTeams();\n      return [\n        { id: user.id, name: user.name ?? user.username, type: \"personal\" as const },\n        ...teams.map((team) => ({\n          id: team.id,\n          name: team.name ?? team.slug,\n          type: \"team\" as const,\n        })),\n      ];\n    }),\n  );\n\n  const listZones = Effect.fn(\"VercelClient.listZones\")((input: ListZonesInput = {}) =>\n    Effect.gen(function* () {\n      const domains = (yield* allDomains()).filter(\n        (domain) =>\n          hasDnsStorage(domain) && (input.name === undefined || domain.name === input.name),\n      );\n      if (domains.length > 0 || input.name === undefined) {\n        return yield* Effect.forEach(domains, projectZone);\n      }\n      const discovered = yield* discoverZone(input.name);\n      return discovered === null ? [] : [yield* projectZone(discovered)];\n    }),\n  );\n\n  const listTargets = Effect.fn(\"VercelClient.listTargets\")(\n    (input: ProviderSession.ListTargetsInput = {}) =>\n      Effect.gen(function* () {\n        const names =\n          input.domain === undefined\n            ? undefined\n            : new Set(Zones.candidates(input.domain).map((name) => String(name)));\n        const domains = (yield* allDomains()).filter(\n          (domain) =>\n            hasDnsStorage(domain) &&\n            (names === undefined || names.has(domain.name)) &&\n            (input.accountId === undefined || (domain.teamId ?? domain.userId) === input.accountId),\n        );\n        if (domains.length > 0 || input.domain === undefined) {\n          return yield* Effect.forEach(domains, targetFromDomain);\n        }\n        for (const name of Zones.candidates(input.domain)) {\n          const discovered = yield* discoverZone(name);\n          if (\n            discovered !== null &&\n            (input.accountId === undefined ||\n              (discovered.teamId ?? discovered.userId) === input.accountId)\n          ) {\n            return [yield* targetFromDomain(discovered)];\n          }\n        }\n        return [];\n      }),\n  );\n\n  const resolveTarget = Effect.fn(\"VercelClient.resolveTarget\")((domain: DomainName.DomainName) =>\n    Effect.gen(function* () {\n      const candidates = yield* listTargets({ domain });\n      for (const zoneName of Zones.candidates(domain)) {\n        const matches = candidates.filter((target) => target.zoneName === zoneName);\n        if (matches.length === 1) {\n          const target = matches[0];\n          if (target !== undefined) return ProviderSession.Resolution.Resolved({ target });\n        }\n        if (matches.length > 1) {\n          return ProviderSession.Resolution.SelectionRequired({ candidates: matches });\n        }\n      }\n      return ProviderSession.Resolution.NotFound({ domain });\n    }),\n  );\n\n  const forTarget = Effect.fn(\"VercelClient.forTarget\")((target: Connection.ProviderTarget) =>\n    Effect.gen(function* () {\n      if (target.accountKind === \"team\") {\n        if (options.context._tag !== \"team\" || options.context.teamId !== target.accountId) {\n          return yield* Effect.fail(\n            failure(\"forTarget\", \"Vercel team target is outside the selected installation\", {\n              reason: \"authorization\",\n            }),\n          );\n        }\n      } else if (target.accountKind === \"personal\" && options.context._tag !== \"personal\") {\n        return yield* Effect.fail(\n          failure(\"forTarget\", \"Vercel personal target is outside the selected installation\", {\n            reason: \"authorization\",\n          }),\n        );\n      } else if (target.accountKind === \"account\") {\n        return yield* Effect.fail(\n          failure(\"forTarget\", \"Vercel does not support account-kind targets\", {\n            reason: \"unsupported\",\n          }),\n        );\n      } else if (target.accountKind === null) {\n        return yield* Effect.fail(\n          failure(\"forTarget\", \"Vercel targets must identify a personal or team account\", {\n            reason: \"request\",\n          }),\n        );\n      }\n      const discovered = yield* listTargets({\n        accountId: target.accountId,\n        domain: target.zoneName,\n      });\n      const selected = discovered.find(\n        (candidate) =>\n          candidate.accountId === target.accountId &&\n          candidate.accountKind === target.accountKind &&\n          candidate.zoneId === target.zoneId &&\n          candidate.zoneName === target.zoneName,\n      );\n      if (selected === undefined) {\n        return yield* Effect.fail(\n          failure(\n            \"forTarget\",\n            `Vercel target ${target.zoneName} is not visible to this installation`,\n            { reason: \"authorization\" },\n          ),\n        );\n      }\n      const client = makeClient({ ...options, target: selected });\n      return {\n        id: client.id,\n        createRecord: client.createRecord,\n        deleteRecord: client.deleteRecord,\n        getRecord: client.getRecord,\n        listRecords: client.listRecords,\n      } satisfies DnsProvider.Interface;\n    }),\n  );\n\n  const validateToken = Effect.fn(\"VercelClient.validateToken\")(() =>\n    Effect.gen(function* () {\n      let accountId: string;\n      if (options.context._tag === \"team\") {\n        yield* allDomains();\n        accountId = options.context.teamId;\n      } else {\n        const result = yield* request(new URL(`${baseUrl}/v2/user`), \"validateToken\");\n        const { user } = yield* decode(\n          Protocol.UserEnvelope,\n          result.body,\n          \"validateToken\",\n          result.response,\n        );\n        accountId = user.id;\n      }\n      return {\n        accountId,\n        capabilities: options.capabilities,\n        expiresAt: null,\n        scopes: [],\n      };\n    }),\n  );\n\n  return {\n    id: \"vercel\",\n    providerId: \"vercel\",\n    createRecord,\n    deleteRecord,\n    getRecord,\n    listAccounts,\n    listRecords,\n    listZones,\n    listTargets,\n    resolveTarget,\n    forTarget,\n    validateToken,\n  };\n}\n\nfunction hasDnsStorage(\n  domain: Protocol.Domain,\n  configuredServiceType: Protocol.DomainConfig[\"serviceType\"] = domain.serviceType,\n): boolean {\n  return (\n    configuredServiceType === \"zeit.world\" ||\n    domain.zone === true ||\n    domain.intendedNameservers.length > 0\n  );\n}\n\nconst projectZone = Effect.fn(\"VercelClient.projectZone\")((domain: Protocol.Domain) =>\n  Effect.gen(function* () {\n    const name = yield* DomainName.decode(domain.name).pipe(\n      Effect.mapError((cause) => failure(\"listZones\", cause.message, { reason: \"response\" })),\n    );\n    const nameservers = yield* Effect.forEach(domain.intendedNameservers, (nameserver) =>\n      DomainName.decode(nameserver).pipe(\n        Effect.mapError((cause) => failure(\"listZones\", cause.message, { reason: \"response\" })),\n      ),\n    );\n    return {\n      accountId: domain.teamId ?? domain.userId,\n      id: domain.id,\n      name,\n      nameservers,\n      status: domain.verified ? \"active\" : \"pending\",\n    } as const;\n  }),\n);\n\nconst targetFromDomain = Effect.fn(\"VercelClient.targetFromDomain\")((domain: Protocol.Domain) =>\n  Effect.gen(function* () {\n    const zoneName = yield* DomainName.decode(domain.name).pipe(\n      Effect.mapError((cause) => failure(\"listTargets\", cause.message, { reason: \"response\" })),\n    );\n    const nameservers = yield* Effect.forEach(\n      domain.nameservers.length > 0 ? domain.nameservers : domain.intendedNameservers,\n      (nameserver) =>\n        DomainName.decode(nameserver).pipe(\n          Effect.mapError((cause) => failure(\"listTargets\", cause.message, { reason: \"response\" })),\n        ),\n    );\n    return {\n      accountId: domain.teamId ?? domain.userId,\n      accountKind: domain.teamId === null ? (\"personal\" as const) : (\"team\" as const),\n      evidence: {\n        nameservers,\n        status: domain.verified ? \"active\" : \"pending\",\n        zoneType: domain.serviceType,\n      },\n      zoneId: domain.id,\n      zoneName,\n    } satisfies Connection.ProviderTarget;\n  }),\n);\n\nfunction decode<A>(\n  schema: S.ConstraintCodec<A, unknown, never, unknown>,\n  input: unknown,\n  operation: string,\n  response: Response,\n): Effect.Effect<A, DnsProvider.Error> {\n  return S.decodeUnknownEffect(schema)(input).pipe(\n    Effect.mapError((cause) =>\n      failure(operation, `Vercel response did not match its API contract: ${cause.message}`, {\n        reason: \"response\",\n        status: response.status,\n      }),\n    ),\n  );\n}\n\nfunction apiFailure(input: unknown, operation: string, response: Response): DnsProvider.Error {\n  const detail = S.decodeUnknownOption(Protocol.ErrorEnvelope)(input);\n  return failure(\n    operation,\n    detail._tag === \"Some\"\n      ? detail.value.error.message\n      : `Vercel request failed with HTTP ${response.status}`,\n    {\n      ...(detail._tag === \"Some\" ? { code: detail.value.error.code } : {}),\n      reason: reason(response.status, detail._tag === \"Some\" ? detail.value.error.code : undefined),\n      ...rateLimit(response, detail._tag === \"Some\" ? detail.value.error : undefined),\n      status: response.status,\n    },\n  );\n}\n\nfunction reason(status: number, code?: string): DnsProvider.ErrorReason {\n  if (status === 401 || code === \"invalid_token\") return \"authentication\";\n  if (status === 403) return \"authorization\";\n  if (status === 404 || code === \"not_found\") return \"not_found\";\n  if (status === 409 || code === \"conflict\") return \"conflict\";\n  if (status === 429 || code === \"rate_limited\") return \"rate_limit\";\n  if (status >= 500) return \"response\";\n  return \"request\";\n}\n\nfunction rateLimit(\n  response: Response,\n  detail?: Protocol.ErrorDetail,\n): Partial<Pick<DnsProvider.Error, \"retryAfterMs\">> {\n  const resetMs = detail?.limit?.resetMs;\n  const header = response.headers.get(\"x-ratelimit-reset\");\n  const reset = resetMs ?? (header === null ? undefined : Number(header) * 1_000);\n  return reset === undefined || !Number.isFinite(reset)\n    ? {}\n    : { retryAfterMs: Math.max(0, reset - Date.now()) };\n}\n\nfunction failure(\n  operation: string,\n  message: string,\n  fields: Partial<Pick<DnsProvider.Error, \"code\" | \"reason\" | \"retryAfterMs\" | \"status\">> = {},\n): DnsProvider.Error {\n  return new DnsProvider.Error({ ...fields, message, operation, providerId: \"vercel\" });\n}\n","import { Clock, Effect, Schema as S } from \"effect\";\n\nimport * as Connection from \"../../auth/connect.ts\";\nimport * as ProviderAuthorization from \"../../auth/authorization.ts\";\nimport type * as ProviderAuth from \"../../auth/manifest.ts\";\nimport * as ProviderContext from \"../../auth/provider-context.ts\";\nimport * as Secret from \"../../auth/secret.ts\";\nimport * as DnsProvider from \"../../provider/provider.ts\";\nimport * as ProviderSession from \"../../provider/session.ts\";\nimport * as Client from \"./client.ts\";\nimport * as Protocol from \"./protocol.ts\";\n\nconst Context = S.TaggedUnion({\n  personal: { installationId: S.NullOr(S.String) },\n  team: { installationId: S.NullOr(S.String), teamId: S.String },\n});\nexport type Context = typeof Context.Type;\nexport const contextCodec = ProviderContext.codec(\"vercel.v1\", Context);\n\n/** Describes Vercel's caller-created personal access-token method. */\nexport function tokenMethod(\n  capabilities: ProviderAuth.TokenValidation[\"capabilities\"],\n): Extract<ProviderAuth.Manifest[\"methods\"][number], { readonly _tag: \"token\" }> {\n  return {\n    _tag: \"token\",\n    capabilities: [...capabilities],\n    instructionsUrl: \"https://vercel.com/account/settings/tokens\",\n  };\n}\n\nexport interface IntegrationMethodOptions {\n  readonly capabilities: ProviderAuth.TokenValidation[\"capabilities\"];\n  readonly slug: string;\n}\n\n/** Describes Vercel's provider-specific integration installation flow. */\nexport function integrationMethod(\n  options: IntegrationMethodOptions,\n): ProviderAuth.IntegrationMethod {\n  return {\n    _tag: \"integration\",\n    capabilities: [...options.capabilities],\n    installUrl: `https://vercel.com/integrations/${encodeURIComponent(options.slug)}/new`,\n    tokenEndpoint: \"https://api.vercel.com/v2/oauth/access_token\",\n  };\n}\n\n/** Creates the Vercel token and integration authorization manifest. */\nexport function manifest(options: IntegrationMethodOptions): ProviderAuth.Manifest {\n  return {\n    methods: [tokenMethod(options.capabilities), integrationMethod(options)],\n    providerId: \"vercel\",\n  };\n}\n\nexport interface ExchangeCodeOptions {\n  readonly baseUrl?: string;\n  readonly clientId: string;\n  readonly clientSecret: Secret.Value;\n  readonly code: Secret.Value;\n  /** Configuration ID returned by Vercel's integration callback, when available. */\n  readonly configurationId?: string;\n  readonly fetch?: Client.Fetch;\n  readonly redirectUri: string;\n}\n\nexport interface IntegrationCredential {\n  readonly accessToken: Secret.Value;\n  readonly context: Client.AccountContext;\n  readonly installationId: string | null;\n  readonly userId: string;\n}\n\n/** Exchanges Vercel's one-time integration code and preserves its account context. */\nexport const exchangeCode = Effect.fn(\"VercelAuth.exchangeCode\")((options: ExchangeCodeOptions) =>\n  Effect.gen(function* () {\n    const fetch = options.fetch ?? globalThis.fetch;\n    const baseUrl = (options.baseUrl ?? \"https://api.vercel.com\").replace(/\\/$/, \"\");\n    const body = new URLSearchParams({\n      client_id: options.clientId,\n      client_secret: options.clientSecret.expose(),\n      code: options.code.expose(),\n      redirect_uri: options.redirectUri,\n    });\n    const response = yield* Effect.tryPromise({\n      try: () =>\n        fetch(`${baseUrl}/v2/oauth/access_token`, {\n          body,\n          headers: {\n            Accept: \"application/json\",\n            \"Content-Type\": \"application/x-www-form-urlencoded\",\n          },\n          method: \"POST\",\n        }),\n      catch: () => failure(\"exchangeCode\", \"Vercel token exchange failed\", \"transport\"),\n    });\n    const input = yield* Effect.tryPromise({\n      try: () => response.json() as Promise<unknown>,\n      catch: () =>\n        failure(\n          \"exchangeCode\",\n          response.ok\n            ? \"Vercel returned a non-JSON token response\"\n            : `Vercel token exchange failed with HTTP ${response.status}`,\n          response.ok ? \"response\" : response.status === 401 ? \"authentication\" : \"request\",\n          response.status,\n        ),\n    });\n    if (!response.ok) {\n      const detail = S.decodeUnknownOption(Protocol.ErrorEnvelope)(input);\n      return yield* Effect.fail(\n        failure(\n          \"exchangeCode\",\n          detail._tag === \"Some\"\n            ? detail.value.error.message\n            : `Vercel token exchange failed with HTTP ${response.status}`,\n          response.status === 401 ? \"authentication\" : \"request\",\n          response.status,\n          detail._tag === \"Some\" ? detail.value.error.code : undefined,\n        ),\n      );\n    }\n    const token = yield* S.decodeUnknownEffect(Protocol.IntegrationToken)(input).pipe(\n      Effect.mapError((cause) =>\n        failure(\n          \"exchangeCode\",\n          `Vercel token response did not match its API contract: ${cause.message}`,\n          \"response\",\n          response.status,\n        ),\n      ),\n    );\n    return {\n      accessToken: Secret.make(token.access_token),\n      context:\n        token.team_id === null\n          ? ({ _tag: \"personal\" } as const)\n          : ({ _tag: \"team\", teamId: token.team_id } as const),\n      installationId: token.installation_id ?? options.configurationId ?? null,\n      userId: token.user_id,\n    };\n  }),\n);\n\nexport interface TokenConnectionOptions extends Omit<Client.Options, \"token\"> {\n  readonly token: Secret.Value;\n}\n\n/** Creates a provider-independent token connection method backed by Vercel validation. */\nexport function tokenConnectionMethod(\n  options: TokenConnectionOptions,\n): Extract<Connection.Method, { readonly _tag: \"Token\" }> {\n  const requiredCapabilities = [...options.capabilities];\n  return Connection.Method.Token({\n    authenticate: Effect.fn(\"VercelAuth.authenticateToken\")(function* (token) {\n      const validated = yield* Client.make({ ...options, token }).validateToken();\n      const observedAt = new Date(yield* Clock.currentTimeMillis);\n      return {\n        capabilityEvidence: validated.capabilities.map((capability) => ({\n          capability,\n          evidence: ProviderAuthorization.Evidence.Introspected({ observedAt }),\n        })),\n        credential: {\n          accessToken: token,\n          expiresAt: validated.expiresAt,\n          refreshToken: null,\n          tokenType: \"bearer\",\n        },\n        providerAccountId: validated.accountId,\n        providerContext: yield* contextCodec.encode(\n          options.context._tag === \"team\"\n            ? { _tag: \"team\", installationId: null, teamId: options.context.teamId }\n            : { _tag: \"personal\", installationId: null },\n        ),\n        scopes: [...validated.scopes],\n      } satisfies Connection.Authentication;\n    }),\n    providerId: \"vercel\",\n    requiredCapabilities,\n    token: options.token,\n  });\n}\n\n/** Converts a completed Vercel Integration exchange into canonical connection authentication. */\nexport const integrationAuthentication = Effect.fn(\"VercelAuth.integrationAuthentication\")(\n  function* (\n    options: ExchangeCodeOptions & {\n      readonly capabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n    },\n  ) {\n    const exchanged = yield* exchangeCode(options);\n    const observedAt = new Date(yield* Clock.currentTimeMillis);\n    return {\n      capabilityEvidence: options.capabilities.map((capability) => ({\n        capability,\n        evidence: ProviderAuthorization.Evidence.Introspected({ observedAt }),\n      })),\n      credential: {\n        accessToken: exchanged.accessToken,\n        expiresAt: null,\n        refreshToken: null,\n        tokenType: \"bearer\",\n      },\n      providerAccountId:\n        exchanged.context._tag === \"team\" ? exchanged.context.teamId : exchanged.userId,\n      providerContext: yield* contextCodec.encode(\n        exchanged.context._tag === \"team\"\n          ? {\n              _tag: \"team\",\n              installationId: exchanged.installationId,\n              teamId: exchanged.context.teamId,\n            }\n          : { _tag: \"personal\", installationId: exchanged.installationId },\n      ),\n      scopes: [],\n    } satisfies Connection.Authentication;\n  },\n);\n\n/** Restore a credential-scoped Vercel session from persisted authorization state. */\nexport function restore(\n  options: ProviderSession.RestoreInput & Pick<Client.Options, \"baseUrl\" | \"fetch\">,\n): Effect.Effect<Client.Interface, DnsProvider.Error> {\n  return Effect.gen(function* () {\n    if (options.authorization.providerId !== \"vercel\") {\n      return yield* Effect.fail(\n        failure(\"restore\", \"Provider authorization belongs to another provider\", \"authorization\"),\n      );\n    }\n    if (options.authorization.revocation._tag !== \"Active\") {\n      return yield* Effect.fail(\n        failure(\"restore\", \"Vercel authorization is pending revocation\", \"authorization\"),\n      );\n    }\n    const missingCapability = options.authorization.requiredCapabilities.find(\n      (capability) =>\n        !options.authorization.capabilityEvidence.some((item) => item.capability === capability),\n    );\n    if (missingCapability !== undefined) {\n      return yield* Effect.fail(\n        failure(\n          \"restore\",\n          `Vercel authorization lacks evidence for ${missingCapability}`,\n          \"authorization\",\n        ),\n      );\n    }\n    if (\n      options.credential.expiresAt !== null &&\n      (Number.isNaN(options.credential.expiresAt.valueOf()) ||\n        options.credential.expiresAt <= new Date())\n    ) {\n      return yield* Effect.fail(\n        failure(\"restore\", \"Vercel authorization has expired\", \"authentication\"),\n      );\n    }\n    const context = yield* contextCodec\n      .decode(options.authorization.providerContext)\n      .pipe(Effect.mapError((cause) => failure(\"restore\", cause.message, \"response\")));\n    return Client.make({\n      ...(options.baseUrl === undefined ? {} : { baseUrl: options.baseUrl }),\n      capabilities: options.authorization.capabilityEvidence.map(({ capability }) => capability),\n      ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n      context:\n        context._tag === \"team\" ? { _tag: \"team\", teamId: context.teamId } : { _tag: \"personal\" },\n      token: options.credential.accessToken,\n    });\n  });\n}\n\nexport interface IntegrationFlowOptions\n  extends Omit<ExchangeCodeOptions, \"code\">, IntegrationMethodOptions {}\n\n/** Creates Vercel Integration's implementation of the common interactive connection capability. */\nexport function integrationFlow(options: IntegrationFlowOptions): Connection.InteractiveFlow {\n  const method = integrationMethod(options);\n  const Payload = S.fromJsonString(S.Struct({ state: S.String }));\n  return {\n    complete: Effect.fn(\"VercelAuth.integrationFlow.complete\")(function* (payload, callbackUrl) {\n      const continuation = yield* S.decodeUnknownEffect(Payload)(payload.expose()).pipe(\n        Effect.mapError(\n          () =>\n            new Connection.Error({\n              category: \"authorization\",\n              message: \"Vercel Integration continuation payload is invalid\",\n              operation: \"VercelAuth.integrationFlow.complete\",\n              retry: \"after-user-action\",\n            }),\n        ),\n      );\n      const code = callbackUrl.searchParams.get(\"code\");\n      const configurationId = callbackUrl.searchParams.get(\"configurationId\");\n      if (\n        callbackUrl.searchParams.get(\"state\") !== continuation.state ||\n        code === null ||\n        configurationId === null\n      ) {\n        return yield* new Connection.Error({\n          category: \"authorization\",\n          message: \"Vercel Integration callback does not match its continuation\",\n          operation: \"VercelAuth.integrationFlow.complete\",\n          retry: \"after-user-action\",\n        });\n      }\n      const authentication = yield* integrationAuthentication({\n        ...(options.baseUrl === undefined ? {} : { baseUrl: options.baseUrl }),\n        capabilities: options.capabilities,\n        clientId: options.clientId,\n        clientSecret: options.clientSecret,\n        code: Secret.make(code),\n        configurationId,\n        ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n        redirectUri: options.redirectUri,\n      });\n      const callbackTeamId = callbackUrl.searchParams.get(\"teamId\");\n      if (callbackTeamId !== null) {\n        const context = yield* contextCodec.decode(authentication.providerContext).pipe(\n          Effect.mapError(\n            (cause) =>\n              new Connection.Error({\n                category: \"provider\",\n                message: cause.message,\n                operation: \"VercelAuth.integrationFlow.complete\",\n                retry: \"unknown\",\n              }),\n          ),\n        );\n        if (context._tag !== \"team\" || context.teamId !== callbackTeamId) {\n          return yield* new Connection.Error({\n            category: \"authorization\",\n            message: \"Vercel Integration callback team does not match the exchanged installation\",\n            operation: \"VercelAuth.integrationFlow.complete\",\n            retry: \"after-user-action\",\n          });\n        }\n      }\n      return authentication;\n    }),\n    method: \"integration\",\n    providerId: \"vercel\",\n    requiredCapabilities: [...options.capabilities],\n    start: (continuationId) => {\n      const authorizationUrl = new URL(method.installUrl);\n      authorizationUrl.searchParams.set(\"source\", \"external\");\n      authorizationUrl.searchParams.set(\"state\", continuationId);\n      return Effect.succeed({\n        authorizationUrl,\n        payload: Secret.make(JSON.stringify({ state: continuationId })),\n      });\n    },\n  };\n}\n\nfunction failure(\n  operation: string,\n  message: string,\n  reason: DnsProvider.ErrorReason,\n  status?: number,\n  code?: string,\n): DnsProvider.Error {\n  return new DnsProvider.Error({\n    ...(code === undefined ? {} : { code }),\n    message,\n    operation,\n    providerId: \"vercel\",\n    reason,\n    ...(status === undefined ? {} : { status }),\n  });\n}\n","import { Effect, Schema, SchemaIssue, SchemaTransformation } from \"effect\";\n\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport type * as DnsRecord from \"../domain/dns-record.ts\";\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\n\nconst CanonicalAddress = Schema.String.pipe(\n  Schema.decodeTo(\n    Schema.String,\n    SchemaTransformation.transform({\n      decode: (value) => value.trim().toLowerCase(),\n      encode: (value) => value,\n    }),\n  ),\n);\n\nconst CanonicalDomain = Schema.String.pipe(\n  Schema.decodeTo(\n    Schema.String,\n    SchemaTransformation.transformOrFail({\n      decode: (value, options) =>\n        Effect.try({\n          try: () => DomainName.parse(value).toString(),\n          catch: (cause) =>\n            new SchemaIssue.InvalidValue(\n              { message: cause instanceof Error ? cause.message : String(cause) },\n              value,\n              options,\n            ),\n        }),\n      encode: (value) => Effect.succeed(value),\n    }),\n  ),\n);\n\nconst CanonicalMx = tokenizedDomain(2, 1);\nconst CanonicalSrv = tokenizedDomain(4, 3);\n\nconst CanonicalTxt = Schema.String.pipe(\n  Schema.decodeTo(\n    Schema.String,\n    SchemaTransformation.transform({\n      decode: (value) => {\n        const trimmed = value.trim();\n        const chunks = [...trimmed.matchAll(/\"((?:\\\\.|[^\"])*)\"/g)];\n        return chunks.length === 0\n          ? trimmed\n          : chunks\n              .map((match) => (match[1] ?? \"\").replace(/\\\\\"/g, '\"').replace(/\\\\\\\\/g, \"\\\\\"))\n              .join(\"\");\n      },\n      encode: (value) => value,\n    }),\n  ),\n);\n\nconst CanonicalCaa = Schema.String.pipe(\n  Schema.decodeTo(\n    Schema.String,\n    SchemaTransformation.transform({\n      decode: (value) => value.trim().replace(/\\s+\"([\\s\\S]*)\"$/, \" $1\"),\n      encode: (value) => value,\n    }),\n  ),\n);\n\nexport function parse(type: DnsRecord.Type, input: unknown): string {\n  const schema = (() => {\n    switch (type) {\n      case \"A\":\n      case \"AAAA\":\n        return CanonicalAddress;\n      case \"CNAME\":\n      case \"NS\":\n        return CanonicalDomain;\n      case \"MX\":\n        return CanonicalMx;\n      case \"SRV\":\n        return CanonicalSrv;\n      case \"TXT\":\n        return CanonicalTxt;\n      case \"CAA\":\n        return CanonicalCaa;\n    }\n  })();\n  try {\n    return Schema.decodeUnknownSync(schema)(input);\n  } catch (cause) {\n    throw new InvalidInputError({\n      message: cause instanceof Error ? cause.message : String(cause),\n    });\n  }\n}\n\nfunction tokenizedDomain(length: number, domainIndex: number) {\n  return Schema.String.pipe(\n    Schema.decodeTo(\n      Schema.String,\n      SchemaTransformation.transformOrFail({\n        decode: (value, options) =>\n          Effect.try({\n            try: () => {\n              const parts = value.trim().split(/\\s+/);\n              if (parts.length !== length)\n                throw new Error(\"DNS record data has an invalid field count\");\n              const domain = parts[domainIndex];\n              if (domain === undefined) throw new Error(\"DNS record target is missing\");\n              parts[domainIndex] = DomainName.parse(domain);\n              return parts.join(\" \");\n            },\n            catch: (cause) =>\n              new SchemaIssue.InvalidValue(\n                { message: cause instanceof Error ? cause.message : String(cause) },\n                value,\n                options,\n              ),\n          }),\n        encode: (value) => Effect.succeed(value),\n      }),\n    ),\n  );\n}\n","import * as DnsPacket from \"@leichtgewicht/dns-packet\";\nimport { Effect, Layer } from \"effect\";\n\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport * as DnsRecord from \"../domain/dns-record.ts\";\nimport * as DnsData from \"./dns-data.ts\";\nimport * as DnsResolver from \"./resolver.ts\";\n\nexport type Fetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;\n\nexport interface Options {\n  readonly endpoint: string;\n  readonly fetch?: Fetch;\n  readonly timeoutMs?: number;\n}\n\nexport function make(options: Options): DnsResolver.Interface {\n  const fetch = options.fetch ?? globalThis.fetch;\n  const timeoutMs = options.timeoutMs ?? 5_000;\n  return {\n    resolve: Effect.fn(\"DnsOverHttps.resolve\")((query) =>\n      Effect.tryPromise({\n        try: (effectSignal) =>\n          request({ effectSignal, fetch, query, timeoutMs, endpoint: options.endpoint }),\n        catch: (cause) =>\n          cause instanceof DnsResolver.Error\n            ? cause\n            : new DnsResolver.Error({\n                cause,\n                message: cause instanceof Error ? cause.message : \"DNS resolution failed\",\n                reason: \"transport\",\n              }),\n      }).pipe(Effect.flatMap((message) => decodeResolution(query, message))),\n    ),\n  };\n}\n\nexport const layer = (options: Options): Layer.Layer<DnsResolver.Service> =>\n  Layer.succeed(DnsResolver.Service, make(options));\n\nexport const toAsync = (options: Options): DnsResolver.AsyncInterface =>\n  DnsResolver.toAsync(make(options));\n\nfunction decodeResolution(\n  query: DnsResolver.Query,\n  message: Uint8Array,\n): Effect.Effect<DnsResolver.Resolution, DnsResolver.Error> {\n  return Effect.try({\n    try: () => DnsPacket.decode(message),\n    catch: (cause) =>\n      new DnsResolver.Error({\n        cause,\n        message: \"DoH returned an invalid DNS message\",\n        reason: \"response\",\n      }),\n  }).pipe(\n    Effect.flatMap((packet) => validatePacket(query, packet)),\n    Effect.flatMap(decodePacket),\n  );\n}\n\nfunction decodePacket(\n  packet: DnsPacket.Packet,\n): Effect.Effect<DnsResolver.Resolution, DnsResolver.Error> {\n  if (packet.rcode === \"NXDOMAIN\") {\n    return Effect.succeed({ _tag: \"nodata\" });\n  }\n  if (packet.rcode !== \"NOERROR\") {\n    return Effect.fail(\n      new DnsResolver.Error({\n        message: `DNS resolver returned ${packet.rcode ?? \"an unknown response code\"}`,\n        reason: \"response\",\n      }),\n    );\n  }\n  if (packet.answers === undefined || packet.answers.length === 0) {\n    return Effect.succeed({ _tag: \"nodata\" });\n  }\n  return Effect.forEach(packet.answers, decodeAnswer, { concurrency: \"unbounded\" }).pipe(\n    Effect.map((answers): DnsResolver.Resolution => {\n      const supportedAnswers = answers.filter((answer) => answer !== null);\n      return supportedAnswers.length === 0\n        ? { _tag: \"nodata\" }\n        : { _tag: \"answer\", answers: supportedAnswers };\n    }),\n  );\n}\n\nfunction validatePacket(\n  query: DnsResolver.Query,\n  packet: DnsPacket.Packet,\n): Effect.Effect<DnsPacket.Packet, DnsResolver.Error> {\n  return Effect.try({\n    try: () => {\n      if (packet.type !== \"response\") throw new Error(\"DoH returned a DNS query\");\n      if (packet.id !== 0) throw new Error(\"DoH response used an unexpected message ID\");\n      if (packet.flag_tc) throw new Error(\"DoH returned a truncated DNS response\");\n      const questions = packet.questions ?? [];\n      if (questions.length !== 1) throw new Error(\"DoH returned an unexpected question count\");\n      const question = questions[0];\n      if (question === undefined) throw new Error(\"DoH response omitted the DNS question\");\n      if (\n        question.class !== \"IN\" ||\n        question.type !== query.type ||\n        DomainName.parse(question.name) !== query.name\n      ) {\n        throw new Error(\"DoH response did not match the DNS question\");\n      }\n      return packet;\n    },\n    catch: (cause) =>\n      new DnsResolver.Error({\n        cause,\n        message: cause instanceof Error ? cause.message : \"DoH returned an invalid DNS response\",\n        reason: \"response\",\n      }),\n  });\n}\n\nfunction decodeAnswer(\n  answer: DnsPacket.Answer,\n): Effect.Effect<DnsResolver.Answer | null, DnsResolver.Error> {\n  return Effect.gen(function* () {\n    if (answer.class !== \"IN\") return null;\n    const decoded = yield* Effect.try({\n      try: () => answerData(answer),\n      catch: (cause) =>\n        new DnsResolver.Error({\n          cause,\n          message: \"DoH returned invalid DNS record data\",\n          reason: \"response\",\n        }),\n    });\n    if (decoded === undefined) return null;\n    const name = yield* DomainName.decode(answer.name);\n    const data = yield* Effect.try({\n      try: () => DnsData.parse(decoded.type, decoded.data),\n      catch: (cause) =>\n        new DnsResolver.Error({\n          cause,\n          message: \"DoH returned invalid DNS record data\",\n          reason: \"response\",\n        }),\n    });\n    if (answer.ttl === undefined) {\n      return yield* new DnsResolver.Error({\n        message: \"DoH response omitted the DNS record TTL\",\n        reason: \"response\",\n      });\n    }\n    return { data, name, ttl: answer.ttl, type: decoded.type };\n  }).pipe(\n    Effect.mapError((cause) =>\n      cause instanceof DnsResolver.Error\n        ? cause\n        : new DnsResolver.Error({ cause, message: cause.message, reason: \"response\" }),\n    ),\n  );\n}\n\nfunction answerData(\n  answer: DnsPacket.Answer,\n): { readonly data: string; readonly type: DnsRecord.Type } | undefined {\n  switch (answer.type) {\n    case \"A\":\n    case \"AAAA\":\n    case \"CNAME\":\n    case \"NS\":\n      return { data: answer.data, type: answer.type };\n    case \"CAA\":\n      return {\n        data: `${answer.data.flags ?? 0} ${answer.data.tag} ${answer.data.value}`,\n        type: answer.type,\n      };\n    case \"MX\":\n      return {\n        data: `${requiredNumber(answer.data.preference, \"MX preference\")} ${answer.data.exchange}`,\n        type: answer.type,\n      };\n    case \"SRV\":\n      return {\n        data: [\n          requiredNumber(answer.data.priority, \"SRV priority\"),\n          requiredNumber(answer.data.weight, \"SRV weight\"),\n          requiredNumber(answer.data.port, \"SRV port\"),\n          answer.data.target,\n        ].join(\" \"),\n        type: answer.type,\n      };\n    case \"TXT\":\n      return { data: decodeTxt(answer.data), type: answer.type };\n    default:\n      return undefined;\n  }\n}\n\nfunction decodeTxt(data: DnsPacket.TxtData): string {\n  const chunks = Array.isArray(data) ? data : [data];\n  const encoded = chunks.map((chunk) =>\n    typeof chunk === \"string\" ? new TextEncoder().encode(chunk) : chunk,\n  );\n  const length = encoded.reduce((total, chunk) => total + chunk.length, 0);\n  const joined = new Uint8Array(length);\n  let offset = 0;\n  for (const chunk of encoded) {\n    joined.set(chunk, offset);\n    offset += chunk.length;\n  }\n  return new TextDecoder(\"utf-8\", { fatal: true }).decode(joined);\n}\n\nfunction requiredNumber(value: number | undefined, field: string): number {\n  if (value === undefined) throw new Error(`DoH response omitted ${field}`);\n  return value;\n}\n\nasync function request(input: {\n  readonly effectSignal: AbortSignal;\n  readonly endpoint: string;\n  readonly fetch: Fetch;\n  readonly query: DnsResolver.Query;\n  readonly timeoutMs: number;\n}): Promise<Uint8Array> {\n  const controller = new AbortController();\n  let timedOut = false;\n  const abortFromEffect = () => controller.abort(input.effectSignal.reason);\n  const abortFromHost = () => controller.abort(input.query.signal?.reason);\n  input.effectSignal.addEventListener(\"abort\", abortFromEffect, { once: true });\n  input.query.signal?.addEventListener(\"abort\", abortFromHost, { once: true });\n  const timer = setTimeout(() => {\n    timedOut = true;\n    controller.abort(new Error(\"DNS resolution timed out\"));\n  }, input.timeoutMs);\n  try {\n    const query = Uint8Array.from(\n      DnsPacket.encode({\n        flags: DnsPacket.RECURSION_DESIRED,\n        id: 0,\n        questions: [{ name: input.query.name, type: input.query.type }],\n        type: \"query\",\n      }),\n    );\n    const response = await input.fetch(new URL(input.endpoint), {\n      body: query,\n      headers: {\n        accept: \"application/dns-message\",\n        \"content-type\": \"application/dns-message\",\n      },\n      method: \"POST\",\n      signal: controller.signal,\n    });\n    if (!response.ok) {\n      throw new DnsResolver.Error({\n        message: `DoH returned HTTP ${response.status}`,\n        reason: \"transport\",\n      });\n    }\n    const contentType = response.headers\n      .get(\"content-type\")\n      ?.split(\";\", 1)[0]\n      ?.trim()\n      .toLowerCase();\n    if (contentType !== \"application/dns-message\") {\n      throw new DnsResolver.Error({\n        message: `DoH returned unsupported content type ${contentType ?? \"<missing>\"}`,\n        reason: \"response\",\n      });\n    }\n    return new Uint8Array(await response.arrayBuffer());\n  } catch (cause) {\n    if (timedOut) {\n      throw new DnsResolver.Error({ message: \"DNS query timed out\", reason: \"timeout\" });\n    }\n    throw cause;\n  } finally {\n    clearTimeout(timer);\n    input.effectSignal.removeEventListener(\"abort\", abortFromEffect);\n    input.query.signal?.removeEventListener(\"abort\", abortFromHost);\n  }\n}\n","import { Layer } from \"effect\";\n\nimport * as DnsOverHttps from \"./doh.ts\";\nimport * as DnsResolver from \"./resolver.ts\";\n\nconst endpoint = \"https://cloudflare-dns.com/dns-query\";\n\nexport interface Options extends Omit<DnsOverHttps.Options, \"endpoint\"> {\n  readonly endpoint?: string;\n}\n\nexport function make(options: Options = {}): DnsResolver.Interface {\n  return DnsOverHttps.make({ ...options, endpoint: options.endpoint ?? endpoint });\n}\n\nexport const layer = (options: Options = {}): Layer.Layer<DnsResolver.Service> =>\n  Layer.succeed(DnsResolver.Service, make(options));\n\nexport const toAsync = (options: Options = {}): DnsResolver.AsyncInterface =>\n  DnsResolver.toAsync(make(options));\n","import { Layer } from \"effect\";\n\nimport * as DnsOverHttps from \"./doh.ts\";\nimport * as DnsResolver from \"./resolver.ts\";\n\nconst endpoint = \"https://dns.google/dns-query\";\n\nexport interface Options extends Omit<DnsOverHttps.Options, \"endpoint\"> {\n  readonly endpoint?: string;\n}\n\nexport function make(options: Options = {}): DnsResolver.Interface {\n  return DnsOverHttps.make({ ...options, endpoint: options.endpoint ?? endpoint });\n}\n\nexport const layer = (options: Options = {}): Layer.Layer<DnsResolver.Service> =>\n  Layer.succeed(DnsResolver.Service, make(options));\n\nexport const toAsync = (options: Options = {}): DnsResolver.AsyncInterface =>\n  DnsResolver.toAsync(make(options));\n","import { Context, Data, Effect, Layer, Schema } from \"effect\";\n\nimport * as CloudflareDnsOverHttps from \"./cloudflare-doh.ts\";\nimport * as DnsOverHttps from \"./doh.ts\";\nimport * as DnsResolver from \"./resolver.ts\";\nimport * as GoogleDnsOverHttps from \"./google-doh.ts\";\n\nexport interface Entry {\n  readonly id: string;\n  readonly resolver: DnsResolver.Interface;\n  readonly timeoutMs?: number;\n}\n\nexport type Observation = Data.TaggedEnum<{\n  Answer: { readonly answers: ReadonlyArray<DnsResolver.Answer>; readonly resolverId: string };\n  Failed: {\n    readonly message: string;\n    readonly reason: Exclude<DnsResolver.Error[\"reason\"], \"timeout\">;\n    readonly resolverId: string;\n  };\n  NoData: { readonly resolverId: string };\n  TimedOut: { readonly resolverId: string; readonly timeoutMs: number };\n}>;\nexport const Observation = Data.taggedEnum<Observation>();\n\nexport type Policy = Data.TaggedEnum<{\n  AllMatch: {};\n  AnyMatch: {};\n  Quorum: { readonly minimum: number };\n}>;\nconst PolicyVariants = Data.taggedEnum<Policy>();\nconst QuorumMinimum = Schema.Int.check(Schema.isGreaterThanOrEqualTo(1));\nconst PolicySchema = Schema.TaggedUnion({\n  AllMatch: {},\n  AnyMatch: {},\n  Quorum: { minimum: QuorumMinimum },\n});\nexport const Policy = {\n  AllMatch: PolicyVariants.AllMatch,\n  AnyMatch: PolicyVariants.AnyMatch,\n  Quorum: ({ minimum }: { readonly minimum: number }): Policy =>\n    PolicyVariants.Quorum({ minimum: Schema.decodeUnknownSync(QuorumMinimum)(minimum) }),\n  Schema: PolicySchema,\n};\n\nexport interface Interface {\n  readonly observe: (query: DnsResolver.Query) => Effect.Effect<ReadonlyArray<Observation>>;\n}\n\nexport class Service extends Context.Service<Service, Interface>()(\"@domainkit/DnsResolverPool\") {}\n\nexport function make(entries: ReadonlyArray<Entry>): Interface {\n  return Service.of({\n    observe: Effect.fn(\"DnsResolverPool.observe\")((query) =>\n      Effect.forEach(entries, (entry) => observe(entry, query), { concurrency: \"unbounded\" }),\n    ),\n  });\n}\n\nexport interface DefaultOptions extends Omit<DnsOverHttps.Options, \"endpoint\"> {}\n\n/** Cloudflare and Google RFC wire-format DoH resolvers. */\nexport function defaultMake(options: DefaultOptions = {}): Interface {\n  const timeoutMs = options.timeoutMs ?? 5_000;\n  return make([\n    {\n      id: \"cloudflare\",\n      resolver: CloudflareDnsOverHttps.make(options),\n      timeoutMs,\n    },\n    { id: \"google\", resolver: GoogleDnsOverHttps.make(options), timeoutMs },\n  ]);\n}\n\nexport const defaultLayer = (options: DefaultOptions = {}): Layer.Layer<Service> =>\n  Layer.succeed(Service, defaultMake(options));\n\nfunction observe(entry: Entry, query: DnsResolver.Query): Effect.Effect<Observation> {\n  const timeoutMs = entry.timeoutMs ?? 5_000;\n  return entry.resolver.resolve(query).pipe(\n    Effect.timeout(timeoutMs),\n    Effect.match({\n      onFailure: (failure): Observation => {\n        if (\n          failure._tag === \"TimeoutError\" ||\n          (failure._tag === \"ResolverError\" && failure.reason === \"timeout\")\n        ) {\n          return Observation.TimedOut({ resolverId: entry.id, timeoutMs });\n        }\n        return Observation.Failed({\n          message: failure.message,\n          reason: failure.reason === \"response\" ? \"response\" : \"transport\",\n          resolverId: entry.id,\n        });\n      },\n      onSuccess: (resolution): Observation =>\n        resolution._tag === \"nodata\"\n          ? Observation.NoData({ resolverId: entry.id })\n          : Observation.Answer({ answers: resolution.answers, resolverId: entry.id }),\n    }),\n  );\n}\n","import { Data, Effect, Option, Schema } from \"effect\";\n\nimport type * as DomainName from \"../domain/domain-name.ts\";\nimport * as DnsRecord from \"../domain/dns-record.ts\";\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport * as DnsProvider from \"../provider/provider.ts\";\nimport * as DnsData from \"./dns-data.ts\";\nimport * as DnsResolverPool from \"./resolver-pool.ts\";\n\nexport type PublicDns = Data.TaggedEnum<{\n  Disabled: {};\n  Enabled: { readonly policy?: DnsResolverPool.Policy };\n}>;\nexport const PublicDns = Data.taggedEnum<PublicDns>();\n\nexport type Provider = Data.TaggedEnum<{\n  Disabled: {};\n  Enabled: { readonly zone: DomainName.DomainName };\n}>;\nexport const Provider = Data.taggedEnum<Provider>();\n\ntype ProviderEnabled = Extract<Provider, { readonly _tag: \"Enabled\" }>;\ntype ProviderDisabled = Extract<Provider, { readonly _tag: \"Disabled\" }>;\n\nexport interface PublicOnlyConfig {\n  readonly provider?: ProviderDisabled;\n  readonly publicDns?: PublicDns;\n  readonly record: DnsRecord.DnsRecord;\n}\n\nexport interface ProviderConfig {\n  readonly provider: ProviderEnabled;\n  readonly publicDns?: PublicDns;\n  readonly record: DnsRecord.DnsRecord;\n}\n\nexport type Config = ProviderConfig | PublicOnlyConfig;\n\nexport type ProviderObservation = Data.TaggedEnum<{\n  Matched: {};\n  Mismatch: { readonly records: ReadonlyArray<DnsRecord.DnsRecord> };\n  Pending: {};\n  Unavailable: { readonly message: string };\n}>;\nexport const ProviderObservation = Data.taggedEnum<ProviderObservation>();\n\nexport type PublicDnsObservation = Data.TaggedEnum<{\n  Verified: {\n    readonly evidence: ReadonlyArray<DnsResolverPool.Observation>;\n    readonly matchedResolverIds: ReadonlyArray<string>;\n  };\n  Mismatch: { readonly evidence: ReadonlyArray<DnsResolverPool.Observation> };\n  Pending: { readonly evidence: ReadonlyArray<DnsResolverPool.Observation> };\n  Unavailable: { readonly evidence: ReadonlyArray<DnsResolverPool.Observation> };\n}>;\nexport const PublicDnsObservation = Data.taggedEnum<PublicDnsObservation>();\n\ninterface Evidence {\n  readonly provider: ProviderObservation | null;\n  readonly publicDns: PublicDnsObservation | null;\n}\n\nexport type Result = Data.TaggedEnum<{\n  Mismatch: Evidence;\n  NotObserved: Evidence;\n  Pending: Evidence;\n  Unavailable: Evidence;\n  Verified: Evidence;\n}>;\nexport const Result = Data.taggedEnum<Result>();\n\nexport function observe(input: PublicOnlyConfig): Effect.Effect<Result, InvalidInputError>;\nexport function observe(\n  input: ProviderConfig,\n): Effect.Effect<Result, InvalidInputError, DnsProvider.Service>;\nexport function observe(\n  input: Config,\n): Effect.Effect<Result, InvalidInputError, DnsProvider.Service>;\nexport function observe(\n  input: Config,\n): Effect.Effect<Result, InvalidInputError, DnsProvider.Service> {\n  return observeEffect(input);\n}\n\nconst observeEffect = Effect.fn(\"Verification.observe\")(function* (input: Config) {\n  const publicDns = input.publicDns ?? PublicDns.Enabled({});\n  const provider = input.provider ?? Provider.Disabled();\n  const publicEffect =\n    publicDns._tag === \"Disabled\"\n      ? Effect.succeed<PublicDnsObservation | null>(null)\n      : observePublicDns(input.record, publicDns.policy ?? DnsResolverPool.Policy.AnyMatch());\n  const providerEffect =\n    provider._tag === \"Disabled\"\n      ? Effect.succeed<ProviderObservation | null>(null)\n      : Effect.flatMap(DnsProvider.Service, (service) =>\n          observeProvider(service, provider.zone, input.record).pipe(\n            Effect.catch((failure) =>\n              Effect.succeed<ProviderObservation>(\n                ProviderObservation.Unavailable({ message: failure.message }),\n              ),\n            ),\n          ),\n        );\n  const [providerObservation, publicDnsObservation] = yield* Effect.all(\n    [providerEffect, publicEffect] as const,\n    { concurrency: \"unbounded\" },\n  );\n  return aggregate({ provider: providerObservation, publicDns: publicDnsObservation });\n});\n\nfunction observeProvider(\n  provider: DnsProvider.Interface,\n  zone: DomainName.DomainName,\n  requirement: DnsRecord.DnsRecord,\n): Effect.Effect<ProviderObservation, DnsProvider.Error> {\n  return provider.listRecords(zone).pipe(\n    Effect.map((records): ProviderObservation => {\n      if (\n        records.some(\n          (existing) => existing._tag !== \"Opaque\" && DnsRecord.equals(existing, requirement),\n        )\n      ) {\n        return ProviderObservation.Matched();\n      }\n      const sameSet = records.filter(\n        (existing): existing is DnsRecord.DnsRecord =>\n          existing._tag !== \"Opaque\" &&\n          existing.name === requirement.name &&\n          existing._tag === requirement._tag,\n      );\n      return sameSet.length === 0\n        ? ProviderObservation.Pending()\n        : ProviderObservation.Mismatch({ records: sameSet });\n    }),\n  );\n}\n\nfunction observePublicDns(\n  requirement: DnsRecord.DnsRecord,\n  policy: DnsResolverPool.Policy,\n): Effect.Effect<PublicDnsObservation, InvalidInputError> {\n  return Effect.gen(function* () {\n    const validatedPolicy = yield* Schema.decodeUnknownEffect(DnsResolverPool.Policy.Schema)(\n      policy,\n    ).pipe(Effect.mapError((cause) => new InvalidInputError({ message: cause.message })));\n    const configuredPool = yield* Effect.serviceOption(DnsResolverPool.Service);\n    const pool = Option.getOrElse(configuredPool, () => DnsResolverPool.defaultMake());\n    const evidence = yield* pool.observe({ name: requirement.name, type: requirement._tag });\n    if (validatedPolicy._tag === \"Quorum\" && validatedPolicy.minimum > evidence.length) {\n      return yield* new InvalidInputError({\n        message: `Quorum minimum ${validatedPolicy.minimum} exceeds the ${evidence.length} configured resolvers`,\n      });\n    }\n    return evaluatePublicDns(requirement, validatedPolicy, evidence);\n  });\n}\n\nfunction evaluatePublicDns(\n  requirement: DnsRecord.DnsRecord,\n  policy: DnsResolverPool.Policy,\n  evidence: ReadonlyArray<DnsResolverPool.Observation>,\n): PublicDnsObservation {\n  const matchedResolverIds = evidence.flatMap((observation) =>\n    observation._tag === \"Answer\" && answersMatch(requirement, observation.answers)\n      ? [observation.resolverId]\n      : [],\n  );\n  const required =\n    policy._tag === \"AnyMatch\" ? 1 : policy._tag === \"AllMatch\" ? evidence.length : policy.minimum;\n  if (required > 0 && matchedResolverIds.length >= required) {\n    return PublicDnsObservation.Verified({ evidence, matchedResolverIds });\n  }\n  const unavailable = evidence.filter(\n    (observation) => observation._tag === \"TimedOut\" || observation._tag === \"Failed\",\n  ).length;\n  if (unavailable > 0 && matchedResolverIds.length + unavailable >= required) {\n    return PublicDnsObservation.Unavailable({ evidence });\n  }\n  if (\n    evidence.some(\n      (observation) =>\n        observation._tag === \"Answer\" && !answersMatch(requirement, observation.answers),\n    )\n  ) {\n    return PublicDnsObservation.Mismatch({ evidence });\n  }\n  if (evidence.some((observation) => observation._tag === \"NoData\")) {\n    return PublicDnsObservation.Pending({ evidence });\n  }\n  return PublicDnsObservation.Unavailable({ evidence });\n}\n\nfunction answersMatch(\n  requirement: DnsRecord.DnsRecord,\n  answers: ReadonlyArray<{ readonly data: string; readonly name: string; readonly type: string }>,\n): boolean {\n  const expected = DnsData.parse(requirement._tag, recordValue(requirement));\n  return answers.some(\n    (answer) =>\n      answer.name === requirement.name &&\n      answer.type === requirement._tag &&\n      DnsData.parse(requirement._tag, answer.data) === expected,\n  );\n}\n\nfunction aggregate(evidence: Evidence): Result {\n  const requested = [evidence.provider, evidence.publicDns].filter(\n    (observation): observation is ProviderObservation | PublicDnsObservation =>\n      observation !== null,\n  );\n  if (requested.length === 0) return Result.NotObserved(evidence);\n  if (\n    requested.every(\n      (observation) => observation._tag === \"Matched\" || observation._tag === \"Verified\",\n    )\n  ) {\n    return Result.Verified(evidence);\n  }\n  if (requested.some((observation) => observation._tag === \"Unavailable\")) {\n    return Result.Unavailable(evidence);\n  }\n  if (requested.some((observation) => observation._tag === \"Mismatch\")) {\n    return Result.Mismatch(evidence);\n  }\n  return Result.Pending(evidence);\n}\n\nfunction recordValue(requirement: DnsRecord.DnsRecord): string {\n  const data = DnsRecord.data(requirement);\n  switch (requirement._tag) {\n    case \"A\":\n    case \"AAAA\":\n      return String(data.address);\n    case \"CNAME\":\n    case \"NS\":\n      return String(data.target);\n    case \"TXT\":\n      return String(data.value);\n    case \"MX\":\n      return `${data.priority} ${data.exchange}`;\n    case \"CAA\":\n      return `${data.flags} ${data.tag} ${data.value}`;\n    case \"SRV\":\n      return `${data.priority} ${data.weight} ${data.port} ${data.target}`;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;ACEA,MAAa,WAAW,OAAO,SAAS;CACtC;CACA;CACA;CACA;CACA;AACF,CAAC;AAGD,MAAa,cAAc,OAAO,SAAS;CAAC;CAAS;CAAqB;CAAQ;AAAS,CAAC;AAG5F,MAAa,SAAS;CACpB,UAAU;CACV,SAAS,OAAO;CAChB,WAAW,OAAO;CAClB,OAAO;AACT;AAUA,SAAgB,KAAK,OAMN;CACb,OAAO;EACL,UAAU,MAAM;EAChB,SAAS,MAAM;EACf,WAAW,MAAM;EACjB,OAAO,MAAM;EACb,KAAK,MAAM;CACb;AACF;;;;;;;;ACpCA,MAAa,SAASA,OAAE,YAAY;CAClC,aAAa;EACX,cAAcA,OAAE,MAAMA,OAAE,SAAS,CAAC,YAAY,WAAW,CAAC,CAAC;EAC3D,YAAYA,OAAE;EACd,eAAeA,OAAE;CACnB;CACA,QAAQ;EACN,qBAAqBA,OAAE,OAAO;GAC5B,wBAAwBA,OAAE;GAC1B,QAAQA,OAAE;GACV,qBAAqBA,OAAE,YAAYA,OAAE,MAAM;GAC3C,gBAAgBA,OAAE;EACpB,CAAC;EACD,cAAcA,OAAE,MAAMA,OAAE,SAAS,CAAC,YAAY,WAAW,CAAC,CAAC;EAC3D,YAAYA,OAAE,SAAS;GAAC;GAAQ;GAAuB;EAAoB,CAAC;EAC5E,QAAQA,OAAE,MAAMA,OAAE,MAAM;CAC1B;CACA,OAAO;EACL,cAAcA,OAAE,MAAMA,OAAE,SAAS,CAAC,YAAY,WAAW,CAAC,CAAC;EAC3D,iBAAiBA,OAAE;CACrB;AACF,CAAC;AAED,MAAaC,WAASD,OAAE,OAAO;CAC7B,SAASA,OAAE,MAAM,MAAM;CACvB,YAAYA,OAAE;AAChB,CAAC;AASD,MAAaE,WAAS,OAAO,GAAG,qBAAqB,CAAC,EAAE,UACtDF,OAAE,oBAAoBC,QAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KACnC,OAAO,UAAU,UAAU,IAAIE,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;;;;;;;;AC7CA,IAAa,QAAb,MAAa,MAAM;CACjB;CAEA,YAAoB,OAAe;EACjC,KAAK,SAAS;CAChB;CAEA,OAAO,KAAK,OAAsB;EAChC,IAAI,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,+BAA+B;EACvE,OAAO,IAAI,MAAM,KAAK;CACxB;CAEA,SAAiB;EACf,OAAO,KAAK;CACd;CAEA,SAAiB;EACf,OAAO;CACT;CAEA,WAAmB;EACjB,OAAO;CACT;AACF;AAEA,MAAaC,SAAO,MAAM;;;;;;;;ACZ1B,MAAa,WAAW,OAAO,OAAO;CACpC,WAAW,OAAO;CAClB,cAAc,OAAO;CACrB,yBAAyB,OAAO;CAChC,oBAAoB,OAAO,MAAMC,QAAiB;CAClD,YAAY,OAAO;CACnB,MAAMA;AACR,CAAC;AAGD,MAAa,YAAY,OAAO,YAAY;CAC1C,UAAU;EACR,WAAW;EACX,UAAU,OAAO,MAAM,QAAQ;EAC/B,QAAQ,OAAO,SAAS,CAAC,YAAY,yBAAyB,CAAC;CACjE;CACA,QAAQ;EACN,UAAU,OAAO,MAAM,QAAQ;EAC/B,QAAQ,OAAO,SAAS,CAAC,aAAa,aAAa,CAAC;CACtD;AACF,CAAC;AAGD,SAAgB,OAAO,OAUT;CACZ,MAAM,SAASC,QAAiB,MAAM,MAAM;CAC5C,MAAM,iBAAiB,IAAI,IAAIC,WAAiB,MAAM,CAAC;CACvD,MAAM,gBAAgB,cAAc,MAAM,wBAAwB;CAClE,MAAM,WAAW,MAAM,eAAe,QAAQ,cAAc;EAC1D,IAAI,CAAC,eAAe,IAAI,UAAU,WAAW,OAAO,QAAQ,GAAG,OAAO;EACtE,IAAI;GACF,iBAA4B;IAC1B,YAAY,UAAU;IACtB,YAAY;IACZ,YAAY,UAAU;IACtB;IACA,GAAI,MAAM,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK,MAAM,IAAI;IACpD,YAAY,UAAU,WAAW;IACjC,eAAe,UAAU;GAC3B,CAAC;GACD,OAAO;EACT,QAAQ;GACN,OAAO;EACT;CACF,CAAC;CACD,MAAM,WAAW,SAAS,KAAK,cAAc,YAAY,WAAW,aAAa,CAAC;CAElF,IAAI,MAAM,aAAa,KAAA,GAAW;EAChC,MAAM,eAAeD,QAAiB,MAAM,SAAS,IAAI;EACzD,MAAM,QAAQ,SAAS,WACpB,cACC,UAAU,WAAW,eAAe,MAAM,UAAU,cACpD,UAAU,WAAW,OAAO,cAAc,MAAM,SAAS,aACzD,UAAU,WAAW,OAAO,aAAa,YAC7C;EACA,IAAI,QAAQ,GACV,MAAME,mBACJ,2DACA,0BACF;EAEF,MAAM,YAAY,SAAS;EAC3B,IAAI,cAAc,KAAA,GAAW,MAAM,IAAI,MAAM,uCAAuC;EACpF,OAAO;GAAE,MAAM;GAAY;GAAW;GAAU,QAAQ;EAAW;CACrE;CAEA,MAAM,WAAW,SAAS,QAAQ,EAAE,8BAA8B,uBAAuB;CACzF,MAAM,YAAY,SAAS;CAC3B,OAAO,SAAS,WAAW,KAAK,cAAc,KAAA,IAC1C;EAAE,MAAM;EAAY;EAAW;EAAU,QAAQ;CAA0B,IAC3E;EACE,MAAM;EACN;EACA,QAAQ,SAAS,SAAS,IAAI,cAAc;CAC9C;AACN;AAEA,SAAS,YACP,WACA,eACU;CACV,MAAM,aAAa,IAAI,IAAI,cAAc,UAAU,WAAW,CAAC;CAC/D,MAAM,qBAAqB,cAAc,QAAQ,eAAe,WAAW,IAAI,UAAU,CAAC;CAC1F,OAAO;EACL,WAAW,UAAU,WAAW,OAAO;EACvC,cAAc,UAAU,WAAW;EACnC,yBACE,cAAc,SAAS,KAAK,mBAAmB,WAAW,cAAc;EAC1E;EACA,YAAY,UAAU,WAAW;EACjC,MAAM,UAAU,WAAW,OAAO;CACpC;AACF;AAEA,SAAS,cAAc,aAA0E;CAC/F,OAAO,CAAC,GAAG,IAAI,IAAI,YAAY,IAAIF,OAAgB,CAAC,CAAC,CAAC,CAAC,KAAK;AAC9D;;;;;;;;ACjFA,MAAa,aAAa,KAAK,WAAuB;;AAqCtD,MAAa,aAAa,aAAwC;CAChE,YAAY,QAAQ;CACpB,cAAc,UACZ,OAAO,WAAW;EAChB,WAAW,QAAQ,YAAY,KAAK;EACpC,QAAQ,UAAU,eAAe,QAAQ,YAAY,eAAe,KAAK;CAC3E,CAAC;CACH,gBAAgB,WACd,OAAO,WAAW;EAChB,WAAW,QAAQ,cAAc,MAAM;EACvC,QAAQ,UAAU,eAAe,QAAQ,YAAY,iBAAiB,KAAK;CAC7E,CAAC;CACH,YAAY,WACV,OAAO,WAAW;EAChB,WAAW,QAAQ,UAAU,MAAM;EACnC,QAAQ,UAAU,eAAe,QAAQ,YAAY,aAAa,KAAK;CACzE,CAAC,CAAC,CAAC,KAAK,OAAO,IAAIG,WAAqB,CAAC;AAC7C;;AAGA,MAAaC,aAAW,aAAwC;CAC9D,YAAY,QAAQ;CACpB,cAAc,UAAU,OAAO,WAAW,QAAQ,YAAY,KAAK,CAAC;CACpE,gBAAgB,WAAW,OAAO,WAAW,QAAQ,cAAc,MAAM,CAAC;CAC1E,YAAY,WAAW,OAAO,WAAW,QAAQ,UAAU,MAAM,CAAC,CAAC,CAAC,KAAKC,SAAmB;AAC9F;AAEA,SAAS,eAAe,YAAoB,WAAmB,OAAmC;CAChG,OAAO,iBAAiBC,UACpB,QACA,IAAIA,QAAkB;EACpB,SAAS,iBAAiB,WAAW,QAAQ,MAAM,UAAU,OAAO,KAAK;EACzE,WAAW,mBAAmB;EAC9B;EACA,QAAQ;CACV,CAAC;AACP;;;;ACrGA,MAAa,YAAY,OAAO,GAAG,mCAAmC,CAAC,CAAC,WAAW,OAQhF;CAED,MAAM,YAAY,QAAO,OADAC,UAAAA,CACU,kBAAkB,MAAM,WAAW,EAAE;CACxE,MAAM,mBAAmB,WAAW,YAAY,MAAM,EAAE,SAAS,OAAO,MAAM,WAAW,EAAE;CAC3F,MAAM,mBAAmB,WAAW,YAAY,MAAM,EAAE,SAAS,OAAO,MAAM,WAAW,EAAE;CAC3F,IACE,cAAc,QACd,qBAAqB,KAAA,KACrB,qBAAqB,KAAA,KACrB,iBAAiB,YAAY,MAAM,WAAW,WAC9C,iBAAiB,eAAe,MAAM,WAAW,cACjD,iBAAiB,WAAW,UAAU,cAAc,UACpD,iBAAiB,oBAAoB,MAAM,cAAc,MACzD,iBAAiB,iBAAiB,iBAAiB,IAEnD,OAAO,OAAOC,mBACZ,oEACA,mCACF;CAEF,MAAM,SAAS,OAAO,OAAO,IAAI;EAC/B,WACEC,iBAA4B;GAC1B,YAAY;GACZ,YAAY;GACZ,eAAe,UAAU;GACzB,YAAY;GACZ,YAAY,UAAU;GACtB,QAAQ,MAAM;GACd,YAAY,MAAM,KAAK;EACzB,CAAC;EACH,QAAQ,UACN,iBAAiBC,sBAAiC,iBAAiBC,UAC/D,QACAH,mBACE,gCACA,mCACF;CACR,CAAC;CACD,MAAM,gBAAgB,OAAOI,YAC3B,MAAM,MACN,MAAM,cACN,MAAM,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc,MAAM,aAAa,CAC7E;CACA,MAAM,WAAW,IAAI,IAAI,cAAc,YAAY;CAQnD,IAP0B,MAAM,KAAK,WAAW,QAC7C,cACC,UAAU,SAAS,YACnB,SAAS,IAAI,UAAU,EAAE,KACzB,UAAU,YAAY,SAAS,UAC/B,CAAC,UAAU,YAAY,KAAK,SAAS,IAAI,QAAQ,CAEjC,CAAC,CAAC,SAAS,GAC7B,OAAO,OAAOJ,mBACZ,mDAAmD,UACnD,mCACF;CAEF,OAAO;AACT,CAAC;;;AC9DD,MAAa,QAAQ,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,OAKlE;CACD,MAAM,SAAS,OAAO,OAAO;CAC7B,MAAM,eAAe,UAAU,OAAO,YAAY,QAAQ,EAAE,CAAC;CAC7D,MAAM,YAAY,UAAU,OAAO,OAAO,QAAQ,YAAY,CAAC;CAC/D,MAAM,mBAAmB,IAAI,IAAI,MAAM,OAAO,oBAAoB,sBAAsB;CACxF,iBAAiB,SAAS,IAAI,gBAAgB;EAC5C,WAAW,MAAM,OAAO;EACxB,gBAAgB;EAChB,uBAAuB;EACvB,cAAc,MAAM;EACpB,eAAe;EACf,OAAO,MAAM,OAAO,OAAO,KAAK,GAAG;EACnC,OAAO,MAAM;CACf,CAAC,CAAC,CAAC,SAAS;CACZ,OAAO;EACL;EACA,SAASK,OACP,KAAK,UAAU;GAAE;GAAc,aAAa,MAAM;GAAa,OAAO,MAAM;EAAM,CAAC,CACrF;CACF;AACF,CAAC;AAED,MAAa,WAAW,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAAW,OAOxE;CACD,MAAM,UAAU,OAAO,cAAc,MAAM,OAAO;CAClD,IAAI,MAAM,YAAY,aAAa,IAAI,OAAO,MAAM,QAAQ,OAC1D,OAAO,OAAOC,UAAQ,8DAA8D;CAEtF,MAAM,SAAS,MAAM,OAAO;CAC5B,MAAM,SAAuB,EAAE,WAAW,MAAM,OAAO,SAAS;CAChE,MAAM,iBAAiB,OAAOC,uBAAqB,MAAM,QAAQ,MAAM,MAAM;CAC7E,OAAO,OAAO,OAAO,WAAW;EAC9B,KAAK,OAAO,WAAW;GACrB,MAAM,WAAW,MAAM,qBAAqB,QAAQ,QAAQ,MAAM,aAAa,QAAQ,KAAK;GAC5F,MAAM,WAAW,MAAM,MAAM,8BAC3B,QACA,QACA,gBACA,UACA,QAAQ,aACR,QAAQ,cACR,eAAe,MAAM,OAAO,MAAM,CACpC;GACA,OAAO,MAAM,iCAAiC,QAAQ,QAAQ,QAAQ;EACxE;EACA,QAAQ,UACN,IAAIC,QAAiB;GACnB,UAAU;GACV,SAAS,iBAAiB,WAAW,QAAQ,MAAM,OAAO;GAC1D,WAAW;GACX,OAAO;EACT,CAAC;CACL,CAAC;AACH,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO;CAClC,cAAc,OAAO;CACrB,aAAa,OAAO;CACpB,OAAO,OAAO;AAChB,CAAC;AAED,SAAS,cAAc,SAAiE;CACtF,OAAO,OAAO,oBAAoB,OAAO,eAAe,aAAa,CAAC,CAAC,CAAC,QAAQ,OAAO,CAAC,CAAC,CAAC,KACxF,OAAO,eAEH,IAAIA,QAAiB;EACnB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC,CACL,CACF;AACF;AAEA,SAASD,uBACP,QACA,QACmD;CACnD,QAAQ,OAAO,YAAf;EACE,KAAK,QACH,OAAO,OAAO,QAAQ,MAAM,KAAK,CAAC;EACpC,KAAK,uBACH,OAAO,OAAO,iBAAiB,KAAA,IAC3BD,UAAQ,iCAAiC,IACzC,OAAO,QAAQ,MAAM,kBAAkB,OAAO,aAAa,OAAO,CAAC,CAAC;EAC1E,KAAK,sBACH,OAAO,OAAO,iBAAiB,KAAA,IAC3BA,UAAQ,iCAAiC,IACzC,OAAO,QAAQ,MAAM,iBAAiB,OAAO,aAAa,OAAO,CAAC,CAAC;CAC3E;AACF;AAEA,SAAS,eACP,qBACA,QACmC;CACnC,OAAO,wBAAwB,KAAA,IAC3B,EAAE,OAAO,IACT;EACE;GACC,MAAM,eAAe,KAAK,YACzB,oBAAoB,KAAK;GAAE,GAAG;GAAS,MAAM,QAAQ;EAAK,CAAC;CAC/D;AACN;AAEA,MAAMA,aAAW,YACf,OAAO,KACL,IAAIE,QAAiB;CACnB,UAAU;CACV;CACA,WAAW;CACX,OAAO;AACT,CAAC,CACH;AAEF,SAAS,YACP,QACA,MAC6C;CAC7C,OAAO,OAAO,YAAY,IAAI,CAAC,CAAC,KAC9B,OAAO,UACJ,UACC,IAAIA,QAAiB;EACnB,UAAU;EACV,SAAS,MAAM;EACf,WAAW;EACX,OAAO;CACT,CAAC,CACL,CACF;AACF;AAEA,SAAS,OAAO,QAAuB,OAA4D;CACjG,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAC/D,OAAO,UACJ,UACC,IAAIA,QAAiB;EACnB,UAAU;EACV,SAAS,MAAM;EACf,WAAW;EACX,OAAO;CACT,CAAC,CACL,CACF;AACF;AAEA,SAAS,UAAU,OAA2B;CAC5C,IAAI,SAAS;CACb,KAAK,MAAM,QAAQ,OAAO,UAAU,OAAO,aAAa,IAAI;CAC5D,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,EAAE;AAClF;;;AC/KA,MAAaC,gBAAcC,OAAE,OAAO;CAClC,MAAMA,OAAE;CACR,SAASA,OAAE;AACb,CAAC;AAGD,MAAa,aAAaA,OAAE,OAAO;CACjC,OAAOA,OAAE,YAAYA,OAAE,MAAM;CAC7B,MAAMA,OAAE,YAAYA,OAAE,MAAM;CAC5B,UAAUA,OAAE,YAAYA,OAAE,MAAM;CAChC,aAAaA,OAAE,YAAYA,OAAE,MAAM;CACnC,aAAaA,OAAE,YAAYA,OAAE,MAAM;AACrC,CAAC;AAED,MAAM,UAAUA,OAAE,OAAO;CACvB,MAAMA,OAAE,YAAYA,OAAE,MAAM;CAC5B,SAASA,OAAE;AACb,CAAC;AAED,MAAa,eAAeA,OAAE,OAAO;CACnC,QAAQA,OAAE,MAAMD,aAAW;CAC3B,UAAUC,OAAE,MAAM,OAAO;CACzB,SAASA,OAAE;AACb,CAAC;AAED,MAAa,UAAUA,OAAE,OAAO;CAC9B,IAAIA,OAAE;CACN,MAAMA,OAAE;AACV,CAAC;AAGD,MAAa,OAAOA,OAAE,OAAO;CAC3B,SAAS;CACT,IAAIA,OAAE;CACN,MAAMA,OAAE;CACR,cAAcA,OAAE,MAAMA,OAAE,MAAM;CAC9B,QAAQA,OAAE,YAAYA,OAAE,MAAM;CAC9B,MAAMA,OAAE,YAAYA,OAAE,SAAS;EAAC;EAAQ;EAAW;EAAa;CAAU,CAAC,CAAC;AAC9E,CAAC;AAGD,MAAaC,WAASD,OAAE,OAAO;CAC7B,SAASA,OAAE,YAAYA,OAAE,MAAM;CAC/B,MAAMA,OAAE,YAAYA,OAAE,OAAO;CAC7B,IAAIA,OAAE;CACN,MAAMA,OAAE;CACR,UAAUA,OAAE,YAAYA,OAAE,MAAM;CAChC,SAASA,OAAE,YAAYA,OAAE,OAAO;CAChC,KAAKA,OAAE;CACP,MAAMA,OAAE;AACV,CAAC;AAGD,MAAa,QAAQA,OAAE,OAAO;CAC5B,YAAYA,OAAE,YAAYA,OAAE,MAAM;CAClC,IAAIA,OAAE;CACN,YAAYA,OAAE,YAAYA,OAAE,MAAM;CAClC,QAAQA,OAAE,SAAS;EAAC;EAAU;EAAY;CAAS,CAAC;AACtD,CAAC;AAGD,MAAa,mBAAmBA,OAAE,OAAO;CACvC,QAAQA,OAAE,MAAMD,aAAW;CAC3B,UAAUC,OAAE,MAAM,OAAO;CACzB,QAAQA,OAAE,MAAM,IAAI;CACpB,aAAaA,OAAE,YAAY,UAAU;CACrC,SAASA,OAAE;AACb,CAAC;AACD,MAAaE,uBAAqBF,OAAE,OAAO;CACzC,QAAQA,OAAE,MAAMD,aAAW;CAC3B,UAAUC,OAAE,MAAM,OAAO;CACzB,QAAQA,OAAE,MAAMC,QAAM;CACtB,aAAaD,OAAE,YAAY,UAAU;CACrC,SAASA,OAAE;AACb,CAAC;AACD,MAAa,iBAAiBA,OAAE,OAAO;CACrC,QAAQA,OAAE,MAAMD,aAAW;CAC3B,UAAUC,OAAE,MAAM,OAAO;CACzB,QAAQC;CACR,SAASD,OAAE;AACb,CAAC;AACD,MAAa,gBAAgBA,OAAE,OAAO;CACpC,QAAQA,OAAE,MAAMD,aAAW;CAC3B,UAAUC,OAAE,MAAM,OAAO;CACzB,QAAQ;CACR,SAASA,OAAE;AACb,CAAC;;;ACjFD,MAAMG,SAAOC,OAAE,OAAO;CACpB,OAAOA,OAAE,YAAYA,OAAE,MAAM;CAC7B,MAAMA,OAAE,YAAYA,OAAE,MAAM;CAC5B,UAAUA,OAAE,YAAYA,OAAE,MAAM;CAChC,KAAKA,OAAE,YAAYA,OAAE,MAAM;CAC3B,QAAQA,OAAE,YAAYA,OAAE,MAAM;CAC9B,OAAOA,OAAE,YAAYA,OAAE,MAAM;CAC7B,QAAQA,OAAE,YAAYA,OAAE,MAAM;AAChC,CAAC;AAID,MAAaC,WAAS,OAAO,GAAG,0BAA0B,CAAC,EAAE,WAC3D,OAAO,IAAI,aAAa;CACtB,MAAM,OAAO,OAAOC,SAAkB,OAAO,IAAI,CAAC,CAAC,KACjD,OAAO,MAAM;EAAE,iBAAiB;EAAM,YAAY,UAAU;CAAM,CAAC,CACrE;CACA,IAAI,SAAS,MAAM,OAAO,OAAOC,eAAa,MAAM;CACpD,MAAM,SAAS;EACb,UAAU;GACR,WAAW;GACX,YAAY,OAAO,YAAY,OAAO,uBAAuB;GAC7D,SAAS;EACX;EACA;EACA,QAAQ,OAAO,SAAS,UAAU,cAAc;EAChD,KAAK,OAAO,QAAQ,IAAI,OAAO,OAAO;CACxC;CACA,MAAM,gBACJ,OAAO,YAAY,KAAA,IACf,OAAO,KAAKC,UAAQ,gBAAgB,cAAc,OAAO,KAAK,uBAAuB,CAAC,IACtF,OAAO,QAAQ,OAAO,OAAO;CAEnC,QAAQ,OAAO,MAAf;EACE,KAAK;EACL,KAAK,QACH,OAAO,OAAOC,SAAiB;GAC7B,GAAG;GACH,MAAM,OAAO;GACb,SAAS,OAAO,QAAQ;EAC1B,CAAC,CAAC,CAAC,KAAK,OAAO,UAAU,UAAUD,UAAQ,gBAAgB,MAAM,OAAO,CAAC,CAAC;EAC5E,KAAK;EACL,KAAK,MACH,OAAO,OAAOC,SAAiB;GAC7B,GAAG;GACH,MAAM,OAAO;GACb,QAAQ,OAAO,QAAQ;EACzB,CAAC,CAAC,CAAC,KAAK,OAAO,UAAU,UAAUD,UAAQ,gBAAgB,MAAM,OAAO,CAAC,CAAC;EAC5E,KAAK,OACH,OAAO,OAAOC,SAAiB;GAC7B,GAAG;GACH,MAAM;GACN,OAAO,OAAO,QAAQ;EACxB,CAAC,CAAC,CAAC,KAAK,OAAO,UAAU,UAAUD,UAAQ,gBAAgB,MAAM,OAAO,CAAC,CAAC;EAC5E,KAAK,MACH,OAAO,OAAOC,SAAiB;GAC7B,GAAG;GACH,MAAM;GACN,UAAU,OAAO,QAAQ;GACzB,UAAU,OAAO;EACnB,CAAC,CAAC,CAAC,KAAK,OAAO,UAAU,UAAUD,UAAQ,gBAAgB,MAAM,OAAO,CAAC,CAAC;EAC5E,KAAK,OAAO;GACV,MAAM,OAAO,OAAO,WAAW,MAAM;GACrC,OAAO,OAAOC,SAAiB;IAAE,GAAG;IAAQ,MAAM;IAAO,GAAG;GAAK,CAAC,CAAC,CAAC,KAClE,OAAO,UAAU,UAAUD,UAAQ,gBAAgB,MAAM,OAAO,CAAC,CACnE;EACF;EACA,KAAK,OAAO;GACV,MAAM,OAAO,OAAO,WAAW,MAAM;GACrC,OAAO,OAAOC,SAAiB;IAAE,GAAG;IAAQ,MAAM;IAAO,GAAG;GAAK,CAAC,CAAC,CAAC,KAClE,OAAO,UAAU,UAAUD,UAAQ,gBAAgB,MAAM,OAAO,CAAC,CACnE;EACF;EACA,SACE,OAAO,OAAOD,eAAa,MAAM;CACrC;AACF,CAAC,CACH;AAEA,MAAMA,iBAAe,OAAO,GAAG,gCAAgC,CAAC,EAAE,WAChEH,OAAE,oBAAoBM,MAAgB,CAAC,CAAC;CACtC,MAAM;CACN,MAAM,OAAO;CACb,kBAAkB,OAAO;CACzB,cAAc,OAAO;AACvB,CAAC,CAAC,CAAC,KAAK,OAAO,UAAU,UAAUF,UAAQ,gBAAgB,MAAM,OAAO,CAAC,CAAC,CAC5E;AAEA,SAAgBG,SAAO,QAAyC;CAC9D,MAAM,SAAS;EACb,MAAM,OAAO;EACb,SAAS;EACT,KAAK,OAAO,OAAO;EACnB,MAAM,OAAO;CACf;CACA,QAAQ,OAAO,MAAf;EACE,KAAK;EACL,KAAK,QACH,OAAO;GAAE,GAAG;GAAQ,SAAS,OAAO;EAAQ;EAC9C,KAAK;EACL,KAAK,MACH,OAAO;GAAE,GAAG;GAAQ,SAAS,OAAO;EAAO;EAC7C,KAAK,OACH,OAAO;GAAE,GAAG;GAAQ,SAAS,OAAO;EAAM;EAC5C,KAAK,MACH,OAAO;GAAE,GAAG;GAAQ,SAAS,OAAO;GAAU,UAAU,OAAO;EAAS;EAC1E,KAAK,OACH,OAAO;GACL,GAAG;GACH,MAAM;IAAE,OAAO,OAAO;IAAO,KAAK,OAAO;IAAK,OAAO,OAAO;GAAM;EACpE;EACF,KAAK,OACH,OAAO;GACL,GAAG;GACH,MAAM;IACJ,MAAM,OAAO;IACb,UAAU,OAAO;IACjB,QAAQ,OAAO;IACf,QAAQ,OAAO;GACjB;EACF;CACJ;AACF;AAEA,MAAM,aAAa,OAAO,GAAG,8BAA8B,CAAC,EAAE,WAC5DP,OAAE,oBAAoBD,MAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KACvC,OAAO,UAAU,UAAUK,UAAQ,gBAAgB,MAAM,OAAO,CAAC,CACnE,CACF;AAEA,SAASA,UACP,WACA,SACA,SAAqD,CAAC,GACnC;CACnB,OAAO,IAAII,QAAkB;EAC3B;EACA;EACA,YAAY;EACZ,QAAQ,OAAO,UAAU;CAC3B,CAAC;AACH;;;;;;;;;;ACrFA,SAAgBC,YAAU,QAAyC;CACjE,OAAO;EACL,YAAY,SACV,OAAO,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,KACzB,OAAO,KAAK,UACV,MAAM,KAAK,UAAU;GACnB,GAAG;GACH,QAAQ,KAAK,WAAW,YAAY,KAAK,WAAW,YAAY,KAAK,SAAS;EAChF,EAAE,CACJ,CACF;EACF,UAAU;CACZ;AACF;AAoBA,MAAM,iBAAiB,YAA+B;CACpD,MAAM,QAAQ,QAAQ,SAAS,WAAW;CAC1C,MAAM,WAAW,QAAQ,WAAW,uCAAA,CAAwC,QAAQ,OAAO,EAAE;CAE7F,MAAM,UAAU,OAAO,GAAG,0BAA0B,CAAC,EAClD,MAAc,WAAmB,SAChC,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,OAAO,OAAO,WAAW;GACxC,WACE,MAAM,GAAG,UAAU,QAAQ;IACzB,GAAG;IACH,SAAS;KACP,QAAQ;KACR,eAAe,UAAU,QAAQ,MAAM,OAAO;KAC9C,GAAI,MAAM,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;KACzE,GAAG,MAAM;IACX;GACF,CAAC;GACH,aACEC,UAAQ,WAAW,6BAA6B,EAC9C,QAAQ,YACV,CAAC;EACL,CAAC;EAkBD,OAAO;GAAE,MAAA,OAjBW,OAAO,WAAW;IACpC,WAAW,SAAS,KAAK;IACzB,aAAa;KACX,MAAM,eAAe,WAAW,SAAS,QAAQ,IAAI,aAAa,CAAC;KACnE,OAAOA,UACL,WACA,SAAS,KACL,4CACA,uCAAuC,SAAS,UACpD;MACE,QAAQ,SAAS,KAAK,aAAaC,SAAO,SAAS,MAAM;MACzD,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa;MACrD,QAAQ,SAAS;KACnB,CACF;IACF;GACF,CAAC;GACc;EAAS;CAC1B,CAAC,CACL;CAEA,MAAM,gBAAgB,OAAO,GAAG,gCAAgC,CAAC,EAC9D,WAA+B,MAAyC,SACvE,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,IAAI,gBAAgB;GAAE,MAAM,OAAO,IAAI;GAAG,UAAU;EAAK,CAAC;EACxE,MAAM,IAAI,QAAQ,iCAAiC;EACnD,IAAI,cAAc,KAAA,GAAW,MAAM,IAAI,cAAc,SAAS;EAC9D,IAAI,SAAS,KAAA,GAAW,MAAM,IAAI,QAAQ,IAAI;EAC9C,MAAM,EAAE,MAAM,aAAa,OAAO,QAAQ,UAAU,SAAS,WAAW;EACxE,OAAO,cAAc,MAAM,aAAa,QAAQ;EAChD,OAAO,OAAOC,SAAOC,kBAA2B,MAAM,aAAa,QAAQ;CAC7E,CAAC,CACL;CAiDA,OAAO;EAAE,UA/CQ,OAAO,GAAG,2BAA2B,CAAC,EACpD,WAAoB,SACnB,OAAO,IAAI,aAAa;GACtB,MAAM,QAA8B,CAAC;GACrC,IAAI,OAAO;GACX,OAAO,MAAM;IACX,MAAM,WAAW,OAAO,cAAc,WAAW,MAAM,IAAI;IAC3D,MAAM,KAAK,GAAG,SAAS,MAAM;IAC7B,MAAM,aAAa,SAAS,aAAa;IACzC,IACG,eAAe,KAAA,KAAa,QAAQ,cACpC,eAAe,KAAA,KAAa,SAAS,OAAO,SAAS,IAEtD,OAAO;IAET,QAAQ;GACV;EACF,CAAC,CA8BW;EAAG,cA3BE,OAAO,GAAG,+BAA+B,CAAC,EAAE,SAC/D,OAAO,IAAI,aAAa;GACtB,MAAM,EAAE,MAAM,aAAa,OAAO,QAAQ,MAAM,eAAe;GAC/D,OAAO,cAAc,MAAM,iBAAiB,QAAQ;GACpD,MAAM,WAAW,OAAOD,SAAOE,eAAwB,MAAM,iBAAiB,QAAQ;GACtF,IAAI,SAAS,OAAO,WAAW,UAC7B,OAAO,OAAO,OAAO,KACnBJ,UAAQ,iBAAiB,uBAAuB,SAAS,OAAO,UAAU;IACxE,QAAQ;IACR,QAAQ,SAAS;GACnB,CAAC,CACH;GAEF,MAAM,YACJ,SAAS,OAAO,eAAe,KAAA,IAAY,OAAO,IAAI,KAAK,SAAS,OAAO,UAAU;GACvF,IAAI,cAAc,QAAQ,OAAO,MAAM,UAAU,QAAQ,CAAC,GACxD,OAAO,OAAO,OAAO,KACnBA,UAAQ,iBAAiB,oDAAoD;IAC3E,QAAQ;IACR,QAAQ,SAAS;GACnB,CAAC,CACH;GAEF,OAAO;EACT,CAAC,CAG2B;EAAG;CAAQ;AAC3C;AAEA,MAAM,kBAAkB,OAAO,GAAG,kCAAkC,CAAC,EAClE,YACC,OAAO,IAAI,aAAa;CACtB,MAAM,EAAE,aAAa,cAAc,OAAO;CAC1C,KAAK,MAAM,aAAaK,WAAiB,QAAQ,MAAM,GAAG;EACxD,MAAM,UAAU,OAAO,SAAS,KAAA,GAAW,SAAS;EACpD,MAAM,QAAQ,QAAQ;EACtB,IAAI,QAAQ,WAAW,GAAG;EAC1B,IAAI,QAAQ,WAAW,KAAK,UAAU,KAAA,GAAW,OAAO,MAAM;EAC9D,OAAO,OAAO,OAAO,KACnBL,UACE,mBACA,uDAAuD,aACvD,EAAE,QAAQ,WAAW,CACvB,CACF;CACF;CACA,OAAO,OAAO,OAAO,KACnBA,UACE,mBACA,oDAAoD,QAAQ,UAC5D,EAAE,QAAQ,YAAY,CACxB,CACF;AACF,CAAC,CACL;AAEA,MAAa,+BAA+B;AAE5C,MAAa,sBAAsB,OAAO,GAAG,sCAAsC,CAAC,EACjF,YACC,OAAO,IAAI,aAAa;CACtB,MAAM,YAAY,cAAc,OAAO;CACvC,MAAM,UAAU,QAAQ,cAAc,YAAY,OAAO,gBAAgB,OAAO,IAAI,KAAA;CACpF,MAAM,YAAY,OAAO,UAAU,aACjC,YAAY,KAAA,IACR,wBACA,aAAa,mBAAmB,QAAQ,EAAE,EAAE,eAClD;CAEA,OAAO;EACL,YAFwB,YAAY,OAAO,gBAAgB,OAAO,GAAA,CAErC;EAC7B,cAAc,QAAQ;EACtB;EACA,QAAQ,CAAC;CACX;AACF,CAAC,CACL;;AAGA,SAAgBM,OAAK,SAA6B;CAChD,OAAOC,aAAW,OAAO;AAC3B;AAEA,SAASA,aAAW,SAAqC;CACvD,MAAM,EAAE,UAAU,cAAc,YAAY,cAAc,OAAO;CAEjE,MAAM,cAAc,OAAO,GAAG,8BAA8B,CAAC,EAAE,SAC7D,OAAO,IAAI,aAAa;EACtB,IAAI,QAAQ,WAAW,KAAA,GAAW;GAChC,IAAI,SAAS,QAAQ,OAAO,YAAY,CAAC,KAAK,SAAS,IAAI,QAAQ,OAAO,UAAU,GAClF,OAAO,OAAO,OAAO,KACnBP,UACE,eACA,qBAAqB,QAAQ,OAAO,SAAS,kBAAkB,QAC/D,EAAE,QAAQ,YAAY,CACxB,CACF;GAEF,OAAO;IACL,SAAS;KAAE,IAAI,QAAQ,OAAO;KAAW,MAAM,QAAQ,OAAO;IAAU;IACxE,IAAI,QAAQ,OAAO;IACnB,MAAM,QAAQ,OAAO;IACrB,cAAc,QAAQ,OAAO,UAAU,eAAe,CAAC;GACzD;EACF;EACA,MAAM,UAAU,OAAO,SAAS,QAAQ,WAAW,IAAI;EACvD,MAAM,QAAQ,QAAQ;EACtB,IAAI,QAAQ,WAAW,KAAK,UAAU,KAAA,GAAW,OAAO;EACxD,OAAO,OAAO,OAAO,KACnBA,UACE,eACA,QAAQ,WAAW,IACf,QAAQ,cAAc,KAAA,IACpB,mBAAmB,KAAK,6CACxB,mBAAmB,KAAK,4BAA4B,QAAQ,cAC9D,QAAQ,cAAc,KAAA,IACpB,4CAA4C,KAAK,+BACjD,4CAA4C,KAAK,cAAc,QAAQ,aAC7E,EAAE,QAAQ,QAAQ,WAAW,IAAI,cAAc,WAAW,CAC5D,CACF;CACF,CAAC,CACH;CAEA,MAAM,cAAc,OAAO,GAAG,8BAA8B,CAAC,EAAE,aAC7D,OAAO,IAAI,aAAa;EACtB,MAAM,OAAO,OAAO,YAAY,QAAQ;EACxC,MAAM,UAAqC,CAAC;EAC5C,IAAI,OAAO;EACX,OAAO,MAAM;GACX,MAAM,QAAQ,IAAI,gBAAgB;IAAE,MAAM,OAAO,IAAI;IAAG,UAAU;GAAM,CAAC;GACzE,MAAM,EAAE,MAAM,aAAa,OAAO,QAChC,UAAU,mBAAmB,KAAK,EAAE,EAAE,eAAe,SACrD,aACF;GACA,OAAO,cAAc,MAAM,eAAe,QAAQ;GAClD,MAAM,WAAW,OAAOE,SAAOM,sBAA6B,MAAM,eAAe,QAAQ;GACzF,QAAQ,KAAK,GAAI,OAAO,OAAO,QAAQ,SAAS,QAAQC,QAAc,CAAE;GACxE,MAAM,aAAa,SAAS,aAAa;GACzC,IACG,eAAe,KAAA,KAAa,QAAQ,cACpC,eAAe,KAAA,KAAa,SAAS,OAAO,SAAS,KAEtD,OAAO;GAET,QAAQ;EACV;CACF,CAAC,CACH;CAEA,MAAM,eAAe,OAAO,GAAG,+BAA+B,CAAC,EAC5D,UAAiC,WAChC,OAAO,IAAI,aAAa;EACtB,MAAM,OAAO,OAAO,YAAY,QAAQ;EACxC,MAAM,EAAE,MAAM,aAAa,OAAO,QAChC,UAAU,mBAAmB,KAAK,EAAE,EAAE,eACtC,gBACA;GAAE,MAAM,KAAK,UAAUC,SAAe,MAAM,CAAC;GAAG,QAAQ;EAAO,CACjE;EACA,OAAO,cAAc,MAAM,gBAAgB,QAAQ;EAEnD,OAAO,EAAE,mBAAkB,OADHR,SAAOS,gBAAyB,MAAM,gBAAgB,QAAQ,EAAA,CAClD,OAAO,GAAG;CAChD,CAAC,CACL;CAEA,MAAM,YAAY,OAAO,GAAG,4BAA4B,CAAC,EACtD,UAAiC,qBAChC,OAAO,IAAI,aAAa;EACtB,MAAM,OAAO,OAAO,YAAY,QAAQ;EACxC,MAAM,EAAE,MAAM,aAAa,OAAO,QAChC,UAAU,mBAAmB,KAAK,EAAE,EAAE,eAAe,mBAAmB,gBAAgB,KACxF,WACF;EACA,IAAI,SAAS,WAAW,KAAK,OAAO;EACpC,OAAO,cAAc,MAAM,aAAa,QAAQ;EAChD,MAAM,WAAW,OAAOT,SAAOS,gBAAyB,MAAM,aAAa,QAAQ;EACnF,OAAO,OAAOF,SAAe,SAAS,MAAM;CAC9C,CAAC,CACL;CAEA,MAAM,eAAe,OAAO,GAAG,+BAA+B,CAAC,EAC5D,UAAiC,qBAChC,OAAO,IAAI,aAAa;EACtB,MAAM,OAAO,OAAO,YAAY,QAAQ;EACxC,MAAM,EAAE,MAAM,aAAa,OAAO,QAChC,UAAU,mBAAmB,KAAK,EAAE,EAAE,eAAe,mBAAmB,gBAAgB,KACxF,gBACA,EAAE,QAAQ,SAAS,CACrB;EACA,OAAO,cAAc,MAAM,gBAAgB,QAAQ;CACrD,CAAC,CACL;CAEA,MAAM,eAAe,OAAO,GAAG,+BAA+B,CAAC,OAC7D,SAAS,CAAC,CAAC,KACT,OAAO,KAAK,UAAU;EACpB,MAAM,2BAAW,IAAI,IAA8B;EACnD,KAAK,MAAM,QAAQ,OAAO,SAAS,IAAI,KAAK,QAAQ,IAAI,KAAK,OAAO;EACpE,OAAO,CAAC,GAAG,SAAS,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC;CACzF,CAAC,CACH,CACF;CAEA,MAAM,YAAY,OAAO,GAAG,4BAA4B,CAAC,EAAE,QAAwB,CAAC,MAClF,SAAS,MAAM,aAAa,QAAQ,WAAW,MAAM,IAAI,CAAC,CAAC,KACzD,OAAO,SAAS,UAAU,OAAO,QAAQ,OAAOG,aAAW,CAAC,CAC9D,CACF;CAEA,MAAM,cAAc,OAAO,GAAG,8BAA8B,CAAC,EAC1D,QAA0C,CAAC,MAC1C,OAAO,IAAI,aAAa;EACtB,MAAM,QACJ,MAAM,WAAW,KAAA,IACb,KAAA,IACA,IAAI,IAAIP,WAAiB,MAAM,MAAM,CAAC,CAAC,KAAK,SAAS,OAAO,IAAI,CAAC,CAAC;EACxE,MAAM,QAAQ,OAAO,SAAS,MAAM,aAAa,QAAQ,SAAS;EAClE,OAAO,OAAO,OAAO,QACnB,MAAM,QACH,SAAS,KAAK,SAAS,eAAe,UAAU,KAAA,KAAa,MAAM,IAAI,KAAK,IAAI,EACnF,GACA,cACF;CACF,CAAC,CACL;CAgGA,OAAO;EACL,IAAI;EACJ,YAAY;EACZ;EACA;EACA;EACA;EACA;EACA;EACA;EACA,eAxGoB,OAAO,GAAG,gCAAgC,CAAC,EAC9D,WACC,OAAO,IAAI,aAAa;GACtB,MAAMQ,eAAa,OAAO,YAAY,EAAE,OAAO,CAAC;GAChD,KAAK,MAAM,YAAYR,WAAiB,MAAM,GAAG;IAC/C,MAAM,UAAUQ,aAAW,QAAQ,WAAW,OAAO,aAAa,QAAQ;IAC1E,IAAI,QAAQ,WAAW,GAAG;KACxB,MAAM,SAAS,QAAQ;KACvB,IAAI,WAAW,KAAA,GAAW,OAAA,WAAkC,SAAS,EAAE,OAAO,CAAC;IACjF;IACA,IAAI,QAAQ,SAAS,GACnB,OAAA,WAAkC,kBAAkB,EAAE,YAAY,QAAQ,CAAC;GAE/E;GACA,OAAA,WAAkC,SAAS,EAAE,OAAO,CAAC;EACvD,CAAC,CAyFS;EACZ,WAvFgB,OAAO,GAAG,4BAA4B,CAAC,EAAE,WACzD,OAAO,IAAI,aAAa;GACtB,IAAI,OAAO,gBAAgB,QAAQ,OAAO,gBAAgB,WACxD,OAAO,OAAO,OAAO,KACnBb,UAAQ,aAAa,wDAAwD,EAC3E,QAAQ,UACV,CAAC,CACH;GAEF,IAAI,OAAO,UAAU,aAAa,YAChC,OAAO,OAAO,OAAO,KACnBA,UAAQ,aAAa,6DAA6D,EAChF,QAAQ,cACV,CAAC,CACH;GAMF,MAAM,YAAW,OAJS,YAAY;IACpC,WAAW,OAAO;IAClB,QAAQ,OAAO;GACjB,CAAC,EAAA,CAC2B,MACzB,cACC,UAAU,cAAc,OAAO,aAC/B,UAAU,WAAW,OAAO,UAC5B,UAAU,aAAa,OAAO,QAClC;GACA,IAAI,aAAa,KAAA,GACf,OAAO,OAAO,OAAO,KACnBA,UACE,aACA,qBAAqB,OAAO,SAAS,qCACrC,EAAE,QAAQ,gBAAgB,CAC5B,CACF;GAEF,IAAI,SAAS,UAAU,aAAa,YAClC,OAAO,OAAO,OAAO,KACnBA,UAAQ,aAAa,6DAA6D,EAChF,QAAQ,cACV,CAAC,CACH;GAEF,MAAM,SAASO,aAAW;IAAE,GAAG;IAAS,WAAW,SAAS;IAAW,QAAQ;GAAS,CAAC;GACzF,OAAO;IACL,IAAI,OAAO;IACX,cAAc,OAAO;IACrB,cAAc,OAAO;IACrB,WAAW,OAAO;IAClB,aAAa,OAAO;GACtB;EACF,CAAC,CAqCO;EACR,eAnCoB,OAAO,GAAG,gCAAgC,CAAC,OAC/D,OAAO,IAAI,aAAa;GACtB,MAAM,OACJ,QAAQ,cAAc,YAClB,QAAQ,cAAc,KAAA,IACpB,OAAO,OAAO,KACZP,UAAQ,iBAAiB,mDAAmD,EAC1E,QAAQ,UACV,CAAC,CACH,IACA,aAAa,mBAAmB,QAAQ,SAAS,EAAE,kBACrD;GACN,MAAM,YAAY,OAAO,aAAa,IAAI;GAC1C,OAAO,SAAS,QAAQ,SAAS;GACjC,OAAO;IACL,WAAW,QAAQ,aAAa;IAChC,cAAc,QAAQ;IACtB;IACA,QAAQ,CAAC;GACX;EACF,CAAC,CAeW;CACd;AACF;AAEA,MAAM,iBAAiB,OAAO,GAAG,iCAAiC,CAAC,EAAE,SACnE,OAAO,IAAI,aAAa;CACtB,MAAM,OAAO,OAAOc,SAAkB,KAAK,IAAI,CAAC,CAAC,KAC/C,OAAO,UAAU,UAAUd,UAAQ,eAAe,MAAM,SAAS,EAAE,QAAQ,WAAW,CAAC,CAAC,CAC1F;CACA,MAAM,cAAc,OAAO,OAAO,QAAQ,KAAK,eAAe,eAC5Dc,SAAkB,UAAU,CAAC,CAAC,KAC5B,OAAO,UAAU,UAAUd,UAAQ,eAAe,MAAM,SAAS,EAAE,QAAQ,WAAW,CAAC,CAAC,CAC1F,CACF;CACA,OAAO;EACL,WAAW,KAAK,QAAQ;EACxB,aAAa;EACb,UAAU;GACR,aAAa,KAAK,QAAQ;GAC1B;GACA,QAAQ,KAAK,UAAU;GACvB,UAAU,KAAK,QAAQ;EACzB;EACA,QAAQ,KAAK;EACb,UAAU;CACZ;AACF,CAAC,CACH;AAEA,MAAMY,gBAAc,OAAO,GAAG,8BAA8B,CAAC,EAAE,SAC7D,OAAO,IAAI,aAAa;CACtB,MAAM,OAAO,OAAOE,SAAkB,KAAK,IAAI,CAAC,CAAC,KAC/C,OAAO,UAAU,UAAUd,UAAQ,aAAa,MAAM,SAAS,EAAE,QAAQ,WAAW,CAAC,CAAC,CACxF;CACA,MAAM,cAAc,OAAO,OAAO,QAAQ,KAAK,eAAe,eAC5Dc,SAAkB,UAAU,CAAC,CAAC,KAC5B,OAAO,UAAU,UAAUd,UAAQ,aAAa,MAAM,SAAS,EAAE,QAAQ,WAAW,CAAC,CAAC,CACxF,CACF;CACA,OAAO;EACL,WAAW,KAAK,QAAQ;EACxB,IAAI,KAAK;EACT;EACA;EACA,QAAQ,KAAK,UAAU;CACzB;AACF,CAAC,CACH;AAEA,SAASE,SACP,QACA,OACA,WACA,UACqC;CACrC,OAAOa,OAAE,oBAAoB,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAC1C,OAAO,UAAU,UACff,UAAQ,WAAW,uDAAuD,MAAM,WAAW;EACzF,QAAQ;EACR,QAAQ,SAAS;CACnB,CAAC,CACH,CACF;AACF;AAEA,SAAS,cACP,OACA,WACA,UACwC;CACxC,OAAOe,OAAE,oBAAoBC,YAAqB,CAAC,CAAC,KAAK,CAAC,CAAC,KACzD,OAAO,eACLhB,UAAQ,WAAW,4DAA4D;EAC7E,QAAQ;EACR,QAAQ,SAAS;CACnB,CAAC,CACH,GACA,OAAO,SAAS,aAAa;EAC3B,IAAI,SAAS,MAAM,SAAS,SAAS,OAAO,OAAO;EACnD,MAAM,SAAS,SAAS,OAAO;EAC/B,MAAM,eAAe,WAAW,SAAS,QAAQ,IAAI,aAAa,CAAC;EACnE,OAAO,OAAO,KACZA,UACE,WACA,QAAQ,WAAW,uCAAuC,SAAS,UACnE;GACE,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,OAAO,KAAK;GACpD,QAAQC,SAAO,SAAS,QAAQ,QAAQ,IAAI;GAC5C,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa;GACrD,QAAQ,SAAS;EACnB,CACF,CACF;CACF,CAAC,CACH;AACF;AAEA,SAASA,SAAO,QAAgB,MAAwC;CACtE,IAAI,WAAW,KAAK,OAAO;CAC3B,IAAI,WAAW,KAAK,OAAO;CAC3B,IAAI,WAAW,KAAK,OAAO;CAC3B,IAAI,WAAW,OAAO,SAAS,SAAS,SAAS,SAAS,SAAS,OAAO,OAAO;CACjF,IAAI,WAAW,KAAK,OAAO;CAC3B,IAAI,UAAU,KAAK,OAAO;CAC1B,OAAO;AACT;AAEA,SAAS,WAAW,OAA0C;CAC5D,IAAI,UAAU,MAAM,OAAO,KAAA;CAC3B,MAAM,UAAU,OAAO,KAAK;CAC5B,IAAI,OAAO,SAAS,OAAO,GAAG,OAAO,KAAK,IAAI,GAAG,UAAU,GAAK;CAChE,MAAM,OAAO,KAAK,MAAM,KAAK;CAC7B,OAAO,OAAO,MAAM,IAAI,IAAI,KAAA,IAAY,KAAK,IAAI,GAAG,OAAO,KAAK,IAAI,CAAC;AACvE;AAEA,SAASD,UACP,WACA,SACA,SAA0F,CAAC,GACxE;CACnB,OAAO,IAAIiB,QAAkB;EAC3B,GAAG;EACH;EACA;EACA,YAAY;CACd,CAAC;AACH;;;;;;;;;;;;;;;;AC1mBA,MAAM,sBAAsB;CAC1B,wBAAwB;CACxB,QAAQ;CACR,qBAAqB;CACrB,gBAAgB;AAClB;AAEA,MAAMC,YAAU,OAAO,OAAO;CAC5B,WAAW,OAAO,YAAY,OAAO,MAAM;CAC3C,WAAW,OAAO,SAAS,CAAC,WAAW,MAAM,CAAC;AAChD,CAAC;AAED,MAAaC,iBAAeC,MAAsB,iBAAiBF,SAAO;;AAG1E,SAAgBG,cACd,cAC+E;CAC/E,OAAO;EACL,MAAM;EACN,cAAc,CAAC,GAAG,YAAY;EAC9B,iBAAiB;CACnB;AACF;;AAWA,SAAgB,YAAY,SAAuD;CACjF,OAAO;EACL,MAAM;EACN;EACA,cAAc,CAAC,GAAG,QAAQ,YAAY;EACtC,YAAY,QAAQ;EACpB,QAAQ,CAAC,GAAG,QAAQ,MAAM;CAC5B;AACF;;AAGA,SAAgBC,WAAS,SAAoD;CAC3E,OAAO;EACL,SAAS,CAACD,cAAY,QAAQ,YAAY,GAAG,YAAY,OAAO,CAAC;EACjE,YAAY;CACd;AACF;;AAiCA,SAAgB,gBACd,SACmC;CACnC,QAAQ,QAAqC,gBAC3C,OAAO,IAAI,aAAa;EACtB,MAAM,YACJ,QAAQ,cACP,OAAOE,6BAAoC;GAC1C,GAAI,QAAQ,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;GACpE,QAAQ,QAAQ;GAChB,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;GAC9D,OAAO;EACT,CAAC,CAAC,CAAC,KAAK,OAAO,KAAK,YAAY,QAAQ,EAAE,CAAC;EAC7C,IAAI,QAAQ,cAAc,KAAA,GACxB,OAAOC,OAAY;GACjB,WAAW,QAAQ;GACnB,GAAI,QAAQ,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;GACpE,cAAc,QAAQ;GACtB,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;GAC9D,OAAO;GACP,WAAW;EACb,CAAC,CAAC,CAAC,UAAU;EAEf,MAAM,MAAM,OAAO,MAAM;EACzB,OAAO;GACL;GACA,WACE,OAAO,OAAO,eAAe,WAAW,IAAI,KAAK,MAAM,OAAO,aAAa,GAAK,IAAI;EACxF;CACF,CAAC;AACL;;AAGA,SAAgB,eACd,SACwE;CACxE,QAAQ,UACN,QAAQ,cAAc,KAAA,IAClBC,oBAA2B;EACzB,GAAI,QAAQ,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;EACpE,cAAc,QAAQ;EACtB,QAAQ,QAAQ;EAChB,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAC9D;EACA,GAAI,QAAQ,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,QAAQ,UAAU;CAC5E,CAAC,IACDD,OAAY;EACV,WAAW,QAAQ;EACnB,GAAI,QAAQ,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;EACpE,cAAc,QAAQ;EACtB,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAC9D;EACA,GAAI,QAAQ,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,QAAQ,UAAU;CAC5E,CAAC,CAAC,CAAC,cAAc;AACzB;;AAOA,SAAgBE,wBACd,SACwD;CACxD,MAAM,uBAAuB,CAAC,GAAG,QAAQ,YAAY;CACrD,OAAA,SAAyB,MAAM;EAC7B,cAAc,OAAO,GAAG,kCAAkC,CAAC,CAAC,WAAW,OAAO;GAC5E,MAAM,YAAY,OAAO,eAAe,OAAO,CAAC,CAAC,KAAK;GACtD,MAAM,aAAa,IAAI,KAAK,OAAO,MAAM,iBAAiB;GAC1D,OAAO;IACL,oBAAoB,UAAU,aAAa,KAAK,gBAAgB;KAC9D;KACA,UAAA,WAAyC,aAAa,EAAE,WAAW,CAAC;IACtE,EAAE;IACF,YAAY;KACV,aAAa;KACb,WAAW,UAAU;KACrB,cAAc;KACd,WAAW;IACb;IACA,mBAAmB,UAAU;IAC7B,iBAAiB,OAAOP,eAAa,OACnC,QAAQ,cAAc,YAClB;KAAE,WAAW,UAAU;KAAW,WAAW;IAAU,IACvD,EAAE,WAAW,OAAO,CAC1B;IACA,QAAQ,CAAC,GAAG,UAAU,MAAM;GAC9B;EACF,CAAC;EACD,YAAY;EACZ;EACA,OAAO,QAAQ;CACjB,CAAC;AACH;;AAGA,MAAa,sBAAsB,OAAO,GAAG,oCAAoC,CAAC,CAAC,WACjF,SAIA;CACA,MAAM,WAAW,OAAO,gBAAgB,OAAO,CAAC,CAAC,QAAQ,QAAQ,QAAQ,WAAW;CACpF,MAAM,aAAa,IAAI,KAAK,OAAO,MAAM,iBAAiB;CAC1D,OAAO;EACL,oBAAoB,QAAQ,aAAa,KAAK,gBAAgB;GAC5D;GACA,UAAA,WAAyC,aAAa,EAAE,WAAW,CAAC;EACtE,EAAE;EACF,YAAY;GACV,aAAa,QAAQ;GACrB,WAAW,SAAS;GACpB,cACE,QAAQ,OAAO,kBAAkB,KAAA,IAC7B,OAAA,MACa,KAAK,QAAQ,OAAO,aAAa;GACpD,WAAW,QAAQ,OAAO;EAC5B;EACA,mBAAmB,SAAS;EAC5B,iBAAiB,OAAOA,eAAa,OAAO,EAAE,WAAW,OAAO,CAAC;EACjE,SAAS,QAAQ,OAAO,SAAS,GAAA,CAAI,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO;CAChE;AACF,CAAC;;AAGD,SAAgBQ,UACd,SACoD;CACpD,OAAO,OAAO,IAAI,aAAa;EAC7B,IAAI,QAAQ,cAAc,eAAe,cACvC,OAAO,OAAO,OAAO,KACnBC,UAAQ,WAAW,sDAAsD,eAAe,CAC1F;EAEF,IAAI,QAAQ,cAAc,WAAW,eACnC,OAAO,OAAO,OAAO,KACnBA,UAAQ,WAAW,uDAAuD,aAAa,CACzF;EAEF,IAAI,QAAQ,cAAc,WAAW,SAAS,UAC5C,OAAO,OAAO,OAAO,KACnBA,UAAQ,WAAW,kDAAkD,eAAe,CACtF;EAEF,MAAM,oBAAoB,QAAQ,cAAc,qBAAqB,MAClE,eACC,CAAC,QAAQ,cAAc,mBAAmB,MAAM,SAAS,KAAK,eAAe,UAAU,CAC3F;EACA,IAAI,sBAAsB,KAAA,GACxB,OAAO,OAAO,OAAO,KACnBA,UACE,WACA,+CAA+C,qBAC/C,eACF,CACF;EAEF,IACE,QAAQ,WAAW,cAAc,SAChC,OAAO,MAAM,QAAQ,WAAW,UAAU,QAAQ,CAAC,KAClD,QAAQ,WAAW,6BAAa,IAAI,KAAK,IAE3C,OAAO,OAAO,OAAO,KACnBA,UAAQ,WAAW,wCAAwC,gBAAgB,CAC7E;EAEF,MAAM,UAAU,OAAOT,eACpB,OAAO,QAAQ,cAAc,eAAe,CAAC,CAC7C,KAAK,OAAO,UAAU,UAAUS,UAAQ,WAAW,MAAM,SAAS,UAAU,CAAC,CAAC;EACjF,OAAOJ,OAAY;GACjB,GAAI,QAAQ,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,QAAQ,UAAU;GAC1E,GAAI,QAAQ,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;GACpE,cAAc,QAAQ,cAAc,mBAAmB,KAAK,EAAE,iBAAiB,UAAU;GACzF,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;GAC9D,OAAO,QAAQ,WAAW;GAC1B,WAAW,QAAQ;EACrB,CAAC;CACH,CAAC;AACH;;AAUA,MAAa,oBAAoB,OAAO,GAAG,kCAAkC,CAAC,CAAC,WAC7E,SACA;CACA,IAAI,QAAQ,WAAW,iBAAiB,MACtC,OAAO,OAAO,IAAIK,QAAiB;EACjC,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAEH,MAAM,eAAe,QAAQ,WAAW;CACxC,MAAM,SAAuB,EAAE,WAAW,QAAQ,OAAO,SAAS;CAClE,MAAM,iBAAiB,OAAO,OAAO,IAAI;EACvC,WAAW,qBAAqB,QAAQ,YAAY,QAAQ,MAAM;EAClE,aACE,IAAIA,QAAiB;GACnB,UAAU;GACV,SAAS;GACT,WAAW;GACX,OAAO;EACT,CAAC;CACL,CAAC;CACD,MAAM,QAAQ,QAAQ;CACtB,MAAM,SAAS,OAAO,OAAO,WAAW;EACtC,KAAK,OAAO,WAAW;GACrB,MAAM,UAAU,MAAM,MAAM,yBAC1B,qBACA,QACA,gBACA,aAAa,OAAO,GACpB,UAAU,KAAA,IACN,EAAE,OAAO,IACT;IACE;KACC,MAAM,eAAe,KAAK,SAAS,MAAM,KAAK;KAAE,GAAG;KAAM,MAAM,KAAK;IAAK,CAAC;GAC7E,CACN;GACA,OAAO,MAAM,4BAA4B,qBAAqB,QAAQ,OAAO;EAC/E;EACA,QAAQ,UAAU,eAAe,KAAK;CACxC,CAAC;CACD,MAAM,MAAM,OAAO,MAAM;CACzB,OAAO;EACL,aAAA,MAA0B,KAAK,OAAO,YAAY;EAClD,WACE,OAAO,OAAO,eAAe,WAAW,IAAI,KAAK,MAAM,OAAO,aAAa,GAAK,IAAI;EACtF,cACE,OAAO,kBAAkB,KAAA,IAAY,eAAA,MAA4B,KAAK,OAAO,aAAa;EAC5F,WAAW,OAAO;CACpB;AACF,CAAC;;AAUD,SAAgB,UAAU,SAAuD;CAC/E,MAAM,SAAS,YAAY;EACzB,cAAc,QAAQ;EACtB,YAAY,QAAQ;EACpB,QAAQ,QAAQ;CAClB,CAAC;CACD,OAAO;EACL,UAAU,OAAO,GAAG,mCAAmC,CAAC,CAAC,WAAW,SAAS,aAAa;GACxF,MAAM,SAAS,OAAOC,SAA2B;IAC/C;IACA,QAAQ,QAAQ;IAChB,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;IAC9D;IACA;IACA,YAAY;GACd,CAAC;GACD,OAAO,OAAO,oBAAoB;IAChC,GAAI,QAAQ,cAAc,KAAA,IACtB,EAAE,QAAQ,QAAQ,OAAO,IACzB,EAAE,WAAW,QAAQ,UAAU;IACnC,GAAI,QAAQ,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;IACpE,cAAc,QAAQ;IACtB,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;IAC9D,aAAaC,OAAY,OAAO,YAAY;IAC5C;GACF,CAAC;EACH,CAAC;EACD,QAAQ;EACR,YAAY;EACZ,sBAAsB,CAAC,GAAG,QAAQ,YAAY;EAC9C,QAAQ,mBACNC,MAAwB;GACtB,QAAQ,QAAQ;GAChB;GACA,aAAa,QAAQ;GACrB,OAAO;EACT,CAAC;CACL;AACF;AAEA,SAASJ,UACP,WACA,SACA,QACmB;CACnB,OAAO,IAAIK,QAAkB;EAAE;EAAS;EAAW,YAAY;EAAc;CAAO,CAAC;AACvF;AAEA,SAAS,qBACP,QACA,QACkB;CAClB,IAAI,WAAW,QAAQ,OAAO,MAAM,KAAK;CACzC,IAAI,OAAO,iBAAiB,KAAA,GAAW,MAAM,IAAI,MAAM,2BAA2B;CAClF,OAAO,WAAW,wBACd,MAAM,kBAAkB,OAAO,aAAa,OAAO,CAAC,IACpD,MAAM,iBAAiB,OAAO,aAAa,OAAO,CAAC;AACzD;AAEA,SAAS,eAAe,OAAsD;CAC5E,IACE,iBAAiB,MAAM,qBACvB,CAAC,kBAAkB,eAAe,CAAC,CAAC,SAAS,MAAM,KAAK,GAExD,OAAO,IAAIJ,QAAiB;EAC1B,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAEH,OAAOD,UACL,qBACA,iBAAiB,QAAQ,MAAM,UAAU,mCACzC,iBAAiB,MAAM,oBAAoB,aAAa,WAC1D;AACF;;;ACpaA,MAAa,aAAaM,OAAE,OAAO;CACjC,OAAOA,OAAE;CACT,MAAMA,OAAE,OAAOA,OAAE,MAAM;CACvB,MAAMA,OAAE,OAAOA,OAAE,MAAM;AACzB,CAAC;AAGD,MAAa,cAAcA,OAAE,OAAO;CAClC,MAAMA,OAAE;CACR,SAASA,OAAE;CACX,OAAOA,OAAE,YACPA,OAAE,OAAO;EACP,WAAWA,OAAE;EACb,OAAOA,OAAE,YAAYA,OAAE,MAAM;EAC7B,SAASA,OAAE,YAAYA,OAAE,MAAM;EAC/B,OAAOA,OAAE;CACX,CAAC,CACH;AACF,CAAC;AAGD,MAAa,gBAAgBA,OAAE,OAAO,EAAE,OAAO,YAAY,CAAC;AAE5D,MAAa,OAAOA,OAAE,OAAO;CAC3B,IAAIA,OAAE;CACN,MAAMA,OAAE,OAAOA,OAAE,MAAM;CACvB,UAAUA,OAAE;AACd,CAAC;AAGD,MAAa,eAAeA,OAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AAEnD,MAAa,OAAOA,OAAE,OAAO;CAC3B,IAAIA,OAAE;CACN,MAAMA,OAAE,OAAOA,OAAE,MAAM;CACvB,MAAMA,OAAE;AACV,CAAC;AAGD,MAAa,mBAAmBA,OAAE,OAAO;CACvC,YAAY;CACZ,OAAOA,OAAE,MAAM,IAAI;AACrB,CAAC;AAED,MAAa,SAASA,OAAE,OAAO;CAC7B,IAAIA,OAAE;CACN,qBAAqBA,OAAE,MAAMA,OAAE,MAAM;CACrC,MAAMA,OAAE;CACR,aAAaA,OAAE,MAAMA,OAAE,MAAM;CAC7B,aAAaA,OAAE,SAAS;EAAC;EAAc;EAAY;CAAI,CAAC;CACxD,QAAQA,OAAE,OAAOA,OAAE,MAAM;CACzB,QAAQA,OAAE;CACV,UAAUA,OAAE;CACZ,MAAMA,OAAE,YAAYA,OAAE,OAAO;AAC/B,CAAC;AAGD,MAAa,eAAeA,OAAE,OAAO;CACnC,eAAeA,OAAE;CACjB,aAAaA,OAAE,SAAS;EAAC;EAAc;EAAY;CAAI,CAAC;AAC1D,CAAC;AAGD,MAAa,iBAAiBA,OAAE,OAAO,EAAE,QAAQ,OAAO,CAAC;AAEzD,MAAa,qBAAqBA,OAAE,OAAO;CACzC,SAASA,OAAE,MAAM,MAAM;CACvB,YAAY;AACd,CAAC;AAED,MAAa,SAASA,OAAE,OAAO;CAC7B,IAAIA,OAAE;CACN,YAAYA,OAAE,YAAYA,OAAE,MAAM;CAClC,MAAMA,OAAE;CACR,UAAUA,OAAE,YAAYA,OAAE,MAAM;CAChC,KAAKA,OAAE,YAAYA,OAAE,MAAM;CAC3B,MAAMA,OAAE;CACR,OAAOA,OAAE;AACX,CAAC;AAGD,MAAa,qBAAqBA,OAAE,OAAO;CACzC,YAAYA,OAAE,YAAY,UAAU;CACpC,SAASA,OAAE,MAAM,MAAM;AACzB,CAAC;AAED,MAAa,uBAAuBA,OAAE,OAAO;CAC3C,KAAKA,OAAE;CACP,SAASA,OAAE,YAAYA,OAAE,MAAM;AACjC,CAAC;AAED,MAAa,mBAAmBA,OAAE,OAAO;CACvC,cAAcA,OAAE;CAChB,iBAAiBA,OAAE,YAAYA,OAAE,MAAM;CACvC,SAASA,OAAE,OAAOA,OAAE,MAAM;CAC1B,YAAYA,OAAE,YAAYA,OAAE,MAAM;CAClC,SAASA,OAAE;AACb,CAAC;;;AC1FD,MAAaC,WAAS,OAAO,GAAG,sBAAsB,CAAC,EACpD,MAA6B,WAC5B,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,sBAAsB,MAAM,OAAO,IAAI;CACxD,MAAM,OAAO,OAAOC,SAAkB,QAAQ,CAAC,CAAC,KAC9C,OAAO,MAAM;EAAE,iBAAiB;EAAM,YAAY,UAAU;CAAM,CAAC,CACrE;CACA,IAAI,SAAS,MAAM,OAAO,OAAO,aAAa,QAAQ,QAAQ;CAC9D,MAAM,SAAS;EACb,UAAU;GACR,WAAW;GACX,YAAY;GACZ,SAAS;EACX;EACA;EACA,QAAQ,OAAO,SAAS,UAAU,cAAc;EAChD,KAAK,OAAO,OAAO;CACrB;CACA,MAAM,cAAc,UAClBC,SAAiB,KAAK,CAAC,CAAC,KACtB,OAAO,UAAU,UAAUC,UAAQ,gBAAgB,MAAM,OAAO,CAAC,CACnE;CAEF,QAAQ,OAAO,MAAf;EACE,KAAK;EACL,KAAK,QACH,OAAO,OAAO,WAAW;GAAE,GAAG;GAAQ,MAAM,OAAO;GAAM,SAAS,OAAO;EAAM,CAAC;EAClF,KAAK;EACL,KAAK,MACH,OAAO,OAAO,WAAW;GAAE,GAAG;GAAQ,MAAM,OAAO;GAAM,QAAQ,OAAO;EAAM,CAAC;EACjF,KAAK,OACH,OAAO,OAAO,WAAW;GAAE,GAAG;GAAQ,MAAM;GAAO,OAAO,OAAO;EAAM,CAAC;EAC1E,KAAK,MACH,OAAO,OAAO,WAAW;GACvB,GAAG;GACH,MAAM;GACN,UAAU,OAAO;GACjB,UAAU,OAAO,cAAc,OAAO;EACxC,CAAC;EACH,KAAK,OAAO;GACV,MAAM,QAAQ,OAAO,MAAM,MACzB,sEACF;GACA,IAAI,UAAU,MACZ,OAAO,OAAO,OAAO,KACnBA,UAAQ,gBAAgB,wCAAwC,CAClE;GAEF,OAAO,OAAO,WAAW;IACvB,GAAG;IACH,MAAM;IACN,OAAO,OAAO,MAAM,EAAE;IACtB,KAAK,MAAM;IACX,OAAO,eAAe,MAAM,MAAM,MAAM,MAAM,EAAE;GAClD,CAAC;EACH;EACA,KAAK,OAAO;GACV,MAAM,QAAQ,OAAO,MAAM,KAAK,CAAC,CAAC,MAAM,KAAK;GAC7C,MAAM,CAAC,UAAU,QAAQ,MAAM,UAC7B,MAAM,WAAW,IACb,QACA;IAAC,OAAO,OAAO,YAAY,EAAE;IAAG,MAAM;IAAI,MAAM;IAAI,MAAM;GAAE;GAClE,OAAO,OAAO,WAAW;IACvB,GAAG;IACH,MAAM;IACN,MAAM,OAAO,IAAI;IACjB,UAAU,OAAO,QAAQ;IACzB;IACA,QAAQ,OAAO,MAAM;GACvB,CAAC;EACH;EACA,SACE,OAAO,OAAO,aAAa,QAAQ,IAAI;CAC3C;AACF,CAAC,CACL;AAEA,MAAM,eAAe,OAAO,GAAG,4BAA4B,CAAC,EACzD,QAAyB,SACxBC,OAAE,oBAAoBC,MAAgB,CAAC,CAAC;CACtC,MAAM;CACN;CACA,kBAAkB,OAAO;CACzB,cAAc,OAAO;AACvB,CAAC,CAAC,CAAC,KAAK,OAAO,UAAU,UAAUF,UAAQ,gBAAgB,MAAM,OAAO,CAAC,CAAC,CAC9E;AAEA,SAAgB,OAAO,MAA6B,QAAyC;CAC3F,MAAM,SAAS;EACb,MAAM,aAAa,MAAM,OAAO,IAAI;EACpC,GAAI,OAAO,QAAQ,OAAO,CAAC,IAAI,EAAE,KAAK,OAAO,IAAI;EACjD,MAAM,OAAO;CACf;CACA,QAAQ,OAAO,MAAf;EACE,KAAK;EACL,KAAK,QACH,OAAO;GAAE,GAAG;GAAQ,OAAO,OAAO;EAAQ;EAC5C,KAAK;EACL,KAAK,MACH,OAAO;GAAE,GAAG;GAAQ,OAAO,OAAO;EAAO;EAC3C,KAAK,OACH,OAAO;GAAE,GAAG;GAAQ,OAAO,OAAO;EAAM;EAC1C,KAAK,MACH,OAAO;GAAE,GAAG;GAAQ,YAAY,OAAO;GAAU,OAAO,OAAO;EAAS;EAC1E,KAAK,OACH,OAAO;GACL,GAAG;GACH,OAAO,GAAG,OAAO,MAAM,GAAG,OAAO,IAAI,IAAI,aAAa,OAAO,KAAK,EAAE;EACtE;EACF,KAAK,OACH,OAAO;GACL,GAAG;GACH,KAAK;IACH,MAAM,OAAO;IACb,UAAU,OAAO;IACjB,QAAQ,OAAO;IACf,QAAQ,OAAO;GACjB;EACF;CACJ;AACF;AAEA,SAAS,sBAAsB,MAA6B,MAAsB;CAChF,OAAO,SAAS,MAAM,SAAS,MAC3B,OACA,SAAS,QAAQ,KAAK,SAAS,IAAI,MAAM,IACvC,OACA,GAAG,KAAK,GAAG;AACnB;AAEA,SAAS,aAAa,MAA6B,MAAqC;CACtF,IAAI,SAAS,MAAM,OAAO;CAC1B,MAAM,SAAS,IAAI;CACnB,IAAI,CAAC,KAAK,SAAS,MAAM,GACvB,MAAMA,UAAQ,gBAAgB,cAAc,KAAK,0BAA0B,QAAQ,EACjF,QAAQ,UACV,CAAC;CAEH,OAAO,KAAK,MAAM,GAAG,CAAC,OAAO,MAAM;AACrC;AAEA,SAAS,aAAa,OAAuB;CAC3C,OAAO,MAAM,WAAW,MAAM,MAAM,CAAC,CAAC,WAAW,MAAK,MAAK;AAC7D;AAEA,SAAS,eAAe,OAAuB;CAC7C,OAAO,MAAM,QAAQ,cAAc,IAAI;AACzC;AAEA,SAASA,UACP,WACA,SACA,SAAqD,CAAC,GACnC;CACnB,OAAO,IAAIG,QAAkB;EAC3B;EACA;EACA,YAAY;EACZ,QAAQ,OAAO,UAAU;CAC3B,CAAC;AACH;;;;;;;;ACnGA,SAAgB,UAAU,QAAyC;CACjE,OAAO;EACL,YAAY,SAAS,OAAO,UAAU,EAAE,KAAK,CAAC;EAC9C,UAAU;CACZ;AACF;;AASA,SAAgBC,OAAK,SAA6B;CAChD,OAAO,WAAW,OAAO;AAC3B;AAEA,SAAS,WAAW,SAAqC;CACvD,MAAM,QAAQ,QAAQ,SAAS,WAAW;CAC1C,MAAM,WAAW,QAAQ,WAAW,yBAAA,CAA0B,QAAQ,OAAO,EAAE;CAE/E,MAAM,eAAe,MAAc,SAA2C,CAAC,MAAM;EACnF,MAAM,MAAM,IAAI,IAAI,GAAG,UAAU,MAAM;EACvC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,GAAG,IAAI,aAAa,IAAI,KAAK,KAAK;EAClF,IAAI,QAAQ,QAAQ,SAAS,QAAQ,IAAI,aAAa,IAAI,UAAU,QAAQ,QAAQ,MAAM;EAC1F,OAAO;CACT;CAEA,MAAM,UAAU,OAAO,GAAG,sBAAsB,CAAC,EAC9C,KAAU,WAAmB,SAC5B,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,OAAO,OAAO,WAAW;GACxC,WACE,MAAM,KAAK;IACT,GAAG;IACH,SAAS;KACP,QAAQ;KACR,eAAe,UAAU,QAAQ,MAAM,OAAO;KAC9C,GAAI,MAAM,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;KACzE,GAAG,MAAM;IACX;GACF,CAAC;GACH,aAAaC,UAAQ,WAAW,yBAAyB,EAAE,QAAQ,YAAY,CAAC;EAClF,CAAC;EACD,MAAM,OAAO,OAAO,OAAO,WAAW;GACpC,WAAW,SAAS,KAAK;GACzB,aACEA,UACE,WACA,SAAS,KACL,wCACA,mCAAmC,SAAS,UAChD;IACE,QAAQ,SAAS,KAAK,aAAa,OAAO,SAAS,MAAM;IACzD,GAAG,UAAU,QAAQ;IACrB,QAAQ,SAAS;GACnB,CACF;EACJ,CAAC;EACD,IAAI,CAAC,SAAS,IAAI,OAAO,OAAO,OAAO,KAAK,WAAW,MAAM,WAAW,QAAQ,CAAC;EACjF,OAAO;GAAE;GAAM;EAAS;CAC1B,CAAC,CACL;CAEA,MAAM,WAAW,OAAO,GAAG,uBAAuB,CAAC,OACjD,OAAO,IAAI,aAAa;EACtB,MAAM,QAA8B,CAAC;EACrC,IAAI,QAAuB;EAC3B,OAAO,MAAM;GACX,MAAM,MAAM,IAAI,IAAI,GAAG,QAAQ,UAAU;GACzC,IAAI,aAAa,IAAI,SAAS,KAAK;GACnC,IAAI,UAAU,MAAM,IAAI,aAAa,IAAI,SAAS,OAAO,KAAK,CAAC;GAC/D,MAAM,EAAE,MAAM,aAAa,OAAO,QAAQ,KAAK,cAAc;GAC7D,MAAM,WAAW,OAAO,OAAOC,kBAA2B,MAAM,gBAAgB,QAAQ;GACxF,MAAM,KAAK,GAAG,SAAS,KAAK;GAC5B,IAAI,SAAS,WAAW,SAAS,MAAM,OAAO;GAC9C,QAAQ,SAAS,WAAW;EAC9B;CACF,CAAC,CACH;CAEA,MAAM,aAAa,OAAO,GAAG,yBAAyB,CAAC,OACrD,OAAO,IAAI,aAAa;EACtB,MAAM,UAAkC,CAAC;EACzC,IAAI,QAAuB;EAC3B,OAAO,MAAM;GACX,MAAM,SAAiC,EAAE,OAAO,MAAM;GACtD,IAAI,UAAU,MAAM,OAAO,QAAQ,OAAO,KAAK;GAC/C,MAAM,EAAE,MAAM,aAAa,OAAO,QAAQ,YAAY,eAAe,MAAM,GAAG,WAAW;GACzF,MAAM,WAAW,OAAO,OAAOC,oBAA6B,MAAM,aAAa,QAAQ;GACvF,QAAQ,KAAK,GAAG,SAAS,OAAO;GAChC,IAAI,SAAS,WAAW,SAAS,MAAM,OAAO;GAC9C,QAAQ,SAAS,WAAW;EAC9B;CACF,CAAC,CACH;CAEA,MAAM,eAAe,OAAO,GAAG,2BAA2B,CAAC,EAAE,SAC3D,OAAO,IAAI,aAAa;EACtB,MAAM,eAAe,OAAO,QAC1B,YAAY,eAAe,mBAAmB,IAAI,EAAE,QAAQ,GAC5D,aACF;EACA,MAAM,SAAS,OAAO,OACpBC,cACA,aAAa,MACb,eACA,aAAa,QACf;EACA,MAAM,eAAe,OAAO,QAC1B,YAAY,eAAe,mBAAmB,IAAI,GAAG,GACrD,aACF;EACA,MAAM,WAAW,OAAO,OACtBC,gBACA,aAAa,MACb,eACA,aAAa,QACf;EACA,IAAI,CAAC,cAAc,SAAS,QAAQ,OAAO,WAAW,GACpD,OAAO;EAET,OAAO,SAAS;CAClB,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,kBAAkB,UAChC,MAAM,WAAW,cAAc,OAAO,QAAQ,IAAI,IAAI,OAAO,KAAK,KAAK,CACzE,CACF,CACF;CAEA,MAAM,cAAc,OAAO,GAAG,0BAA0B,CAAC,EAAE,SACzD,OAAO,IAAI,aAAa;EACtB,IAAI,QAAQ,WAAW,KAAA,GAAW;GAChC,IAAI,SAAS,QAAQ,OAAO,YAAY,CAAC,KAAK,SAAS,IAAI,QAAQ,OAAO,UAAU,GAClF,OAAO,OAAO,OAAO,KACnBJ,UACE,eACA,iBAAiB,QAAQ,OAAO,SAAS,kBAAkB,QAC3D,EAAE,QAAQ,YAAY,CACxB,CACF;GAEF,OAAO,QAAQ,OAAO;EACxB;EACA,MAAM,SAAS,OAAO,aAAa,IAAI;EACvC,IAAI,WAAW,MACb,OAAO,OAAO,OAAO,KACnBA,UACE,eACA,eAAe,KAAK,mEACpB,EAAE,QAAQ,YAAY,CACxB,CACF;EAEF,OAAO,OAAOK,SAAkB,OAAO,IAAI,CAAC,CAAC,KAC3C,OAAO,UAAU,UACfL,UAAQ,eAAe,4CAA4C,MAAM,SAAS,CACpF,CACF;CACF,CAAC,CACH;CAEA,MAAM,cAAc,OAAO,GAAG,0BAA0B,CAAC,EAAE,aACzD,OAAO,IAAI,aAAa;EACtB,MAAM,cAAc,OAAO,YAAY,QAAQ;EAC/C,MAAM,UAAqC,CAAC;EAC5C,IAAI,QAAuB;EAC3B,OAAO,MAAM;GACX,MAAM,SAAiC,EAAE,OAAO,MAAM;GACtD,IAAI,UAAU,MAAM,OAAO,QAAQ,OAAO,KAAK;GAC/C,MAAM,EAAE,MAAM,aAAa,OAAO,QAChC,YAAY,eAAe,mBAAmB,WAAW,EAAE,WAAW,MAAM,GAC5E,aACF;GACA,MAAM,WAAW,OAAO,OAAOM,oBAA6B,MAAM,eAAe,QAAQ;GACzF,QAAQ,KACN,GAAI,OAAO,OAAO,QAAQ,SAAS,UAAU,WAC3CC,SAAe,aAAa,MAAM,CACpC,CACF;GACA,MAAM,OAAO,SAAS,YAAY,QAAQ;GAC1C,IAAI,SAAS,MACX,OAAO,QAAQ,QACZ,WAAW,OAAO,SAAS,YAAY,OAAO,KAAK,SAAS,IAAI,UAAU,CAC7E;GAEF,QAAQ;EACV;CACF,CAAC,CACH;CAEA,MAAM,eAAe,OAAO,GAAG,2BAA2B,CAAC,EACxD,UAAiC,WAChC,OAAO,IAAI,aAAa;EACtB,MAAM,cAAc,OAAO,YAAY,QAAQ;EAC/C,MAAM,OAAO,OAAO,OAAO,IAAI;GAC7B,WAAWC,OAAe,aAAa,MAAM;GAC7C,QAAQ,UACN,iBAAiBC,UACb,QACAT,UAAQ,gBAAgB,sCAAsC,EAC5D,QAAQ,UACV,CAAC;EACT,CAAC;EACD,MAAM,SAAS,OAAO,QACpB,YAAY,eAAe,mBAAmB,WAAW,EAAE,SAAS,GACpE,gBACA;GAAE,MAAM,KAAK,UAAU,IAAI;GAAG,QAAQ;EAAO,CAC/C;EAOA,OAAO,EAAE,mBAAkB,OANH,OACtBU,sBACA,OAAO,MACP,gBACA,OAAO,QACT,EAAA,CACoC,IAAI;CAC1C,CAAC,CACL;CAEA,MAAM,YAAY,OAAO,GAAG,wBAAwB,CAAC,EAClD,UAAiC,qBAChC,OAAO,IAAI,aAAa;EACtB,MAAM,cAAc,OAAO,YAAY,QAAQ;EAC/C,IAAI,QAAuB;EAC3B,OAAO,MAAM;GACX,MAAM,SAAiC,EAAE,OAAO,MAAM;GACtD,IAAI,UAAU,MAAM,OAAO,QAAQ,OAAO,KAAK;GAC/C,MAAM,EAAE,MAAM,aAAa,OAAO,QAChC,YAAY,eAAe,mBAAmB,WAAW,EAAE,WAAW,MAAM,GAC5E,WACF;GACA,MAAM,WAAW,OAAO,OAAOJ,oBAA6B,MAAM,aAAa,QAAQ;GACvF,MAAM,SAAS,SAAS,QAAQ,MAAM,EAAE,SAAS,OAAO,gBAAgB;GACxE,IAAI,WAAW,KAAA,GAAW,OAAO,OAAOC,SAAe,aAAa,MAAM;GAC1E,MAAM,OAAO,SAAS,YAAY,QAAQ;GAC1C,IAAI,SAAS,MAAM,OAAO;GAC1B,QAAQ;EACV;CACF,CAAC,CACL;CAEA,MAAM,eAAe,OAAO,GAAG,2BAA2B,CAAC,EACxD,UAAiC,qBAChC,OAAO,IAAI,aAAa;EACtB,MAAM,cAAc,OAAO,YAAY,QAAQ;EAC/C,OAAO,QACL,YACE,eAAe,mBAAmB,WAAW,EAAE,WAAW,mBAAmB,gBAAgB,GAC/F,GACA,gBACA,EAAE,QAAQ,SAAS,CACrB;CACF,CAAC,CACL;CAEA,MAAM,eAAe,OAAO,GAAG,2BAA2B,CAAC,OACzD,OAAO,IAAI,aAAa;EACtB,MAAM,aAAa,OAAO,QAAQ,IAAI,IAAI,GAAG,QAAQ,SAAS,GAAG,cAAc;EAC/E,MAAM,EAAE,SAAS,OAAO,OACtBI,cACA,WAAW,MACX,gBACA,WAAW,QACb;EACA,MAAM,QAAQ,OAAO,SAAS;EAC9B,OAAO,CACL;GAAE,IAAI,KAAK;GAAI,MAAM,KAAK,QAAQ,KAAK;GAAU,MAAM;EAAoB,GAC3E,GAAG,MAAM,KAAK,UAAU;GACtB,IAAI,KAAK;GACT,MAAM,KAAK,QAAQ,KAAK;GACxB,MAAM;EACR,EAAE,CACJ;CACF,CAAC,CACH;CAEA,MAAM,YAAY,OAAO,GAAG,wBAAwB,CAAC,EAAE,QAAwB,CAAC,MAC9E,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,OAAO,WAAW,EAAA,CAAG,QACnC,WACC,cAAc,MAAM,MAAM,MAAM,SAAS,KAAA,KAAa,OAAO,SAAS,MAAM,KAChF;EACA,IAAI,QAAQ,SAAS,KAAK,MAAM,SAAS,KAAA,GACvC,OAAO,OAAO,OAAO,QAAQ,SAAS,WAAW;EAEnD,MAAM,aAAa,OAAO,aAAa,MAAM,IAAI;EACjD,OAAO,eAAe,OAAO,CAAC,IAAI,CAAC,OAAO,YAAY,UAAU,CAAC;CACnE,CAAC,CACH;CAEA,MAAM,cAAc,OAAO,GAAG,0BAA0B,CAAC,EACtD,QAA0C,CAAC,MAC1C,OAAO,IAAI,aAAa;EACtB,MAAM,QACJ,MAAM,WAAW,KAAA,IACb,KAAA,IACA,IAAI,IAAIC,WAAiB,MAAM,MAAM,CAAC,CAAC,KAAK,SAAS,OAAO,IAAI,CAAC,CAAC;EACxE,MAAM,WAAW,OAAO,WAAW,EAAA,CAAG,QACnC,WACC,cAAc,MAAM,MACnB,UAAU,KAAA,KAAa,MAAM,IAAI,OAAO,IAAI,OAC5C,MAAM,cAAc,KAAA,MAAc,OAAO,UAAU,OAAO,YAAY,MAAM,UACjF;EACA,IAAI,QAAQ,SAAS,KAAK,MAAM,WAAW,KAAA,GACzC,OAAO,OAAO,OAAO,QAAQ,SAAS,gBAAgB;EAExD,KAAK,MAAM,QAAQA,WAAiB,MAAM,MAAM,GAAG;GACjD,MAAM,aAAa,OAAO,aAAa,IAAI;GAC3C,IACE,eAAe,SACd,MAAM,cAAc,KAAA,MAClB,WAAW,UAAU,WAAW,YAAY,MAAM,YAErD,OAAO,CAAC,OAAO,iBAAiB,UAAU,CAAC;EAE/C;EACA,OAAO,CAAC;CACV,CAAC,CACL;CAwGA,OAAO;EACL,IAAI;EACJ,YAAY;EACZ;EACA;EACA;EACA;EACA;EACA;EACA;EACA,eAhHoB,OAAO,GAAG,4BAA4B,CAAC,EAAE,WAC7D,OAAO,IAAI,aAAa;GACtB,MAAMC,eAAa,OAAO,YAAY,EAAE,OAAO,CAAC;GAChD,KAAK,MAAM,YAAYD,WAAiB,MAAM,GAAG;IAC/C,MAAM,UAAUC,aAAW,QAAQ,WAAW,OAAO,aAAa,QAAQ;IAC1E,IAAI,QAAQ,WAAW,GAAG;KACxB,MAAM,SAAS,QAAQ;KACvB,IAAI,WAAW,KAAA,GAAW,OAAA,WAAkC,SAAS,EAAE,OAAO,CAAC;IACjF;IACA,IAAI,QAAQ,SAAS,GACnB,OAAA,WAAkC,kBAAkB,EAAE,YAAY,QAAQ,CAAC;GAE/E;GACA,OAAA,WAAkC,SAAS,EAAE,OAAO,CAAC;EACvD,CAAC,CAkGW;EACZ,WAhGgB,OAAO,GAAG,wBAAwB,CAAC,EAAE,WACrD,OAAO,IAAI,aAAa;GACtB,IAAI,OAAO,gBAAgB,QACrB;QAAA,QAAQ,QAAQ,SAAS,UAAU,QAAQ,QAAQ,WAAW,OAAO,WACvE,OAAO,OAAO,OAAO,KACnBb,UAAQ,aAAa,2DAA2D,EAC9E,QAAQ,gBACV,CAAC,CACH;GAAA,OAEG,IAAI,OAAO,gBAAgB,cAAc,QAAQ,QAAQ,SAAS,YACvE,OAAO,OAAO,OAAO,KACnBA,UAAQ,aAAa,+DAA+D,EAClF,QAAQ,gBACV,CAAC,CACH;QACK,IAAI,OAAO,gBAAgB,WAChC,OAAO,OAAO,OAAO,KACnBA,UAAQ,aAAa,gDAAgD,EACnE,QAAQ,cACV,CAAC,CACH;QACK,IAAI,OAAO,gBAAgB,MAChC,OAAO,OAAO,OAAO,KACnBA,UAAQ,aAAa,2DAA2D,EAC9E,QAAQ,UACV,CAAC,CACH;GAMF,MAAM,YAAW,OAJS,YAAY;IACpC,WAAW,OAAO;IAClB,QAAQ,OAAO;GACjB,CAAC,EAAA,CAC2B,MACzB,cACC,UAAU,cAAc,OAAO,aAC/B,UAAU,gBAAgB,OAAO,eACjC,UAAU,WAAW,OAAO,UAC5B,UAAU,aAAa,OAAO,QAClC;GACA,IAAI,aAAa,KAAA,GACf,OAAO,OAAO,OAAO,KACnBA,UACE,aACA,iBAAiB,OAAO,SAAS,uCACjC,EAAE,QAAQ,gBAAgB,CAC5B,CACF;GAEF,MAAM,SAAS,WAAW;IAAE,GAAG;IAAS,QAAQ;GAAS,CAAC;GAC1D,OAAO;IACL,IAAI,OAAO;IACX,cAAc,OAAO;IACrB,cAAc,OAAO;IACrB,WAAW,OAAO;IAClB,aAAa,OAAO;GACtB;EACF,CAAC,CAuCO;EACR,eArCoB,OAAO,GAAG,4BAA4B,CAAC,OAC3D,OAAO,IAAI,aAAa;GACtB,IAAI;GACJ,IAAI,QAAQ,QAAQ,SAAS,QAAQ;IACnC,OAAO,WAAW;IAClB,YAAY,QAAQ,QAAQ;GAC9B,OAAO;IACL,MAAM,SAAS,OAAO,QAAQ,IAAI,IAAI,GAAG,QAAQ,SAAS,GAAG,eAAe;IAC5E,MAAM,EAAE,SAAS,OAAO,OACtBW,cACA,OAAO,MACP,iBACA,OAAO,QACT;IACA,YAAY,KAAK;GACnB;GACA,OAAO;IACL;IACA,cAAc,QAAQ;IACtB,WAAW;IACX,QAAQ,CAAC;GACX;EACF,CAAC,CAeW;CACd;AACF;AAEA,SAAS,cACP,QACA,wBAA8D,OAAO,aAC5D;CACT,OACE,0BAA0B,gBAC1B,OAAO,SAAS,QAChB,OAAO,oBAAoB,SAAS;AAExC;AAEA,MAAM,cAAc,OAAO,GAAG,0BAA0B,CAAC,EAAE,WACzD,OAAO,IAAI,aAAa;CACtB,MAAM,OAAO,OAAON,SAAkB,OAAO,IAAI,CAAC,CAAC,KACjD,OAAO,UAAU,UAAUL,UAAQ,aAAa,MAAM,SAAS,EAAE,QAAQ,WAAW,CAAC,CAAC,CACxF;CACA,MAAM,cAAc,OAAO,OAAO,QAAQ,OAAO,sBAAsB,eACrEK,SAAkB,UAAU,CAAC,CAAC,KAC5B,OAAO,UAAU,UAAUL,UAAQ,aAAa,MAAM,SAAS,EAAE,QAAQ,WAAW,CAAC,CAAC,CACxF,CACF;CACA,OAAO;EACL,WAAW,OAAO,UAAU,OAAO;EACnC,IAAI,OAAO;EACX;EACA;EACA,QAAQ,OAAO,WAAW,WAAW;CACvC;AACF,CAAC,CACH;AAEA,MAAM,mBAAmB,OAAO,GAAG,+BAA+B,CAAC,EAAE,WACnE,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,OAAOK,SAAkB,OAAO,IAAI,CAAC,CAAC,KACrD,OAAO,UAAU,UAAUL,UAAQ,eAAe,MAAM,SAAS,EAAE,QAAQ,WAAW,CAAC,CAAC,CAC1F;CACA,MAAM,cAAc,OAAO,OAAO,QAChC,OAAO,YAAY,SAAS,IAAI,OAAO,cAAc,OAAO,sBAC3D,eACCK,SAAkB,UAAU,CAAC,CAAC,KAC5B,OAAO,UAAU,UAAUL,UAAQ,eAAe,MAAM,SAAS,EAAE,QAAQ,WAAW,CAAC,CAAC,CAC1F,CACJ;CACA,OAAO;EACL,WAAW,OAAO,UAAU,OAAO;EACnC,aAAa,OAAO,WAAW,OAAQ,aAAwB;EAC/D,UAAU;GACR;GACA,QAAQ,OAAO,WAAW,WAAW;GACrC,UAAU,OAAO;EACnB;EACA,QAAQ,OAAO;EACf;CACF;AACF,CAAC,CACH;AAEA,SAAS,OACP,QACA,OACA,WACA,UACqC;CACrC,OAAOc,OAAE,oBAAoB,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAC1C,OAAO,UAAU,UACfd,UAAQ,WAAW,mDAAmD,MAAM,WAAW;EACrF,QAAQ;EACR,QAAQ,SAAS;CACnB,CAAC,CACH,CACF;AACF;AAEA,SAAS,WAAW,OAAgB,WAAmB,UAAuC;CAC5F,MAAM,SAASc,OAAE,oBAAoBC,aAAsB,CAAC,CAAC,KAAK;CAClE,OAAOf,UACL,WACA,OAAO,SAAS,SACZ,OAAO,MAAM,MAAM,UACnB,mCAAmC,SAAS,UAChD;EACE,GAAI,OAAO,SAAS,SAAS,EAAE,MAAM,OAAO,MAAM,MAAM,KAAK,IAAI,CAAC;EAClE,QAAQ,OAAO,SAAS,QAAQ,OAAO,SAAS,SAAS,OAAO,MAAM,MAAM,OAAO,KAAA,CAAS;EAC5F,GAAG,UAAU,UAAU,OAAO,SAAS,SAAS,OAAO,MAAM,QAAQ,KAAA,CAAS;EAC9E,QAAQ,SAAS;CACnB,CACF;AACF;AAEA,SAAS,OAAO,QAAgB,MAAwC;CACtE,IAAI,WAAW,OAAO,SAAS,iBAAiB,OAAO;CACvD,IAAI,WAAW,KAAK,OAAO;CAC3B,IAAI,WAAW,OAAO,SAAS,aAAa,OAAO;CACnD,IAAI,WAAW,OAAO,SAAS,YAAY,OAAO;CAClD,IAAI,WAAW,OAAO,SAAS,gBAAgB,OAAO;CACtD,IAAI,UAAU,KAAK,OAAO;CAC1B,OAAO;AACT;AAEA,SAAS,UACP,UACA,QACkD;CAClD,MAAM,UAAU,QAAQ,OAAO;CAC/B,MAAM,SAAS,SAAS,QAAQ,IAAI,mBAAmB;CACvD,MAAM,QAAQ,YAAY,WAAW,OAAO,KAAA,IAAY,OAAO,MAAM,IAAI;CACzE,OAAO,UAAU,KAAA,KAAa,CAAC,OAAO,SAAS,KAAK,IAChD,CAAC,IACD,EAAE,cAAc,KAAK,IAAI,GAAG,QAAQ,KAAK,IAAI,CAAC,EAAE;AACtD;AAEA,SAASA,UACP,WACA,SACA,SAA0F,CAAC,GACxE;CACnB,OAAO,IAAIS,QAAkB;EAAE,GAAG;EAAQ;EAAS;EAAW,YAAY;CAAS,CAAC;AACtF;;;;;;;;;;;;;;ACtmBA,MAAMO,YAAUC,OAAE,YAAY;CAC5B,UAAU,EAAE,gBAAgBA,OAAE,OAAOA,OAAE,MAAM,EAAE;CAC/C,MAAM;EAAE,gBAAgBA,OAAE,OAAOA,OAAE,MAAM;EAAG,QAAQA,OAAE;CAAO;AAC/D,CAAC;AAED,MAAa,eAAeC,MAAsB,aAAaF,SAAO;;AAGtE,SAAgB,YACd,cAC+E;CAC/E,OAAO;EACL,MAAM;EACN,cAAc,CAAC,GAAG,YAAY;EAC9B,iBAAiB;CACnB;AACF;;AAQA,SAAgB,kBACd,SACgC;CAChC,OAAO;EACL,MAAM;EACN,cAAc,CAAC,GAAG,QAAQ,YAAY;EACtC,YAAY,mCAAmC,mBAAmB,QAAQ,IAAI,EAAE;EAChF,eAAe;CACjB;AACF;;AAGA,SAAgB,SAAS,SAA0D;CACjF,OAAO;EACL,SAAS,CAAC,YAAY,QAAQ,YAAY,GAAG,kBAAkB,OAAO,CAAC;EACvE,YAAY;CACd;AACF;;AAqBA,MAAa,eAAe,OAAO,GAAG,yBAAyB,CAAC,EAAE,YAChE,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,QAAQ,SAAS,WAAW;CAC1C,MAAM,WAAW,QAAQ,WAAW,yBAAA,CAA0B,QAAQ,OAAO,EAAE;CAC/E,MAAM,OAAO,IAAI,gBAAgB;EAC/B,WAAW,QAAQ;EACnB,eAAe,QAAQ,aAAa,OAAO;EAC3C,MAAM,QAAQ,KAAK,OAAO;EAC1B,cAAc,QAAQ;CACxB,CAAC;CACD,MAAM,WAAW,OAAO,OAAO,WAAW;EACxC,WACE,MAAM,GAAG,QAAQ,yBAAyB;GACxC;GACA,SAAS;IACP,QAAQ;IACR,gBAAgB;GAClB;GACA,QAAQ;EACV,CAAC;EACH,aAAa,QAAQ,gBAAgB,gCAAgC,WAAW;CAClF,CAAC;CACD,MAAM,QAAQ,OAAO,OAAO,WAAW;EACrC,WAAW,SAAS,KAAK;EACzB,aACE,QACE,gBACA,SAAS,KACL,8CACA,0CAA0C,SAAS,UACvD,SAAS,KAAK,aAAa,SAAS,WAAW,MAAM,mBAAmB,WACxE,SAAS,MACX;CACJ,CAAC;CACD,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,SAASC,OAAE,oBAAoBE,aAAsB,CAAC,CAAC,KAAK;EAClE,OAAO,OAAO,OAAO,KACnB,QACE,gBACA,OAAO,SAAS,SACZ,OAAO,MAAM,MAAM,UACnB,0CAA0C,SAAS,UACvD,SAAS,WAAW,MAAM,mBAAmB,WAC7C,SAAS,QACT,OAAO,SAAS,SAAS,OAAO,MAAM,MAAM,OAAO,KAAA,CACrD,CACF;CACF;CACA,MAAM,QAAQ,OAAOF,OAAE,oBAAoBG,gBAAyB,CAAC,CAAC,KAAK,CAAC,CAAC,KAC3E,OAAO,UAAU,UACf,QACE,gBACA,yDAAyD,MAAM,WAC/D,YACA,SAAS,MACX,CACF,CACF;CACA,OAAO;EACL,aAAaC,OAAY,MAAM,YAAY;EAC3C,SACE,MAAM,YAAY,OACb,EAAE,MAAM,WAAW,IACnB;GAAE,MAAM;GAAQ,QAAQ,MAAM;EAAQ;EAC7C,gBAAgB,MAAM,mBAAmB,QAAQ,mBAAmB;EACpE,QAAQ,MAAM;CAChB;AACF,CAAC,CACH;;AAOA,SAAgB,sBACd,SACwD;CACxD,MAAM,uBAAuB,CAAC,GAAG,QAAQ,YAAY;CACrD,OAAA,SAAyB,MAAM;EAC7B,cAAc,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAAW,OAAO;GACxE,MAAM,YAAY,OAAOC,OAAY;IAAE,GAAG;IAAS;GAAM,CAAC,CAAC,CAAC,cAAc;GAC1E,MAAM,aAAa,IAAI,KAAK,OAAO,MAAM,iBAAiB;GAC1D,OAAO;IACL,oBAAoB,UAAU,aAAa,KAAK,gBAAgB;KAC9D;KACA,UAAA,WAAyC,aAAa,EAAE,WAAW,CAAC;IACtE,EAAE;IACF,YAAY;KACV,aAAa;KACb,WAAW,UAAU;KACrB,cAAc;KACd,WAAW;IACb;IACA,mBAAmB,UAAU;IAC7B,iBAAiB,OAAO,aAAa,OACnC,QAAQ,QAAQ,SAAS,SACrB;KAAE,MAAM;KAAQ,gBAAgB;KAAM,QAAQ,QAAQ,QAAQ;IAAO,IACrE;KAAE,MAAM;KAAY,gBAAgB;IAAK,CAC/C;IACA,QAAQ,CAAC,GAAG,UAAU,MAAM;GAC9B;EACF,CAAC;EACD,YAAY;EACZ;EACA,OAAO,QAAQ;CACjB,CAAC;AACH;;AAGA,MAAa,4BAA4B,OAAO,GAAG,sCAAsC,CAAC,CACxF,WACE,SAGA;CACA,MAAM,YAAY,OAAO,aAAa,OAAO;CAC7C,MAAM,aAAa,IAAI,KAAK,OAAO,MAAM,iBAAiB;CAC1D,OAAO;EACL,oBAAoB,QAAQ,aAAa,KAAK,gBAAgB;GAC5D;GACA,UAAA,WAAyC,aAAa,EAAE,WAAW,CAAC;EACtE,EAAE;EACF,YAAY;GACV,aAAa,UAAU;GACvB,WAAW;GACX,cAAc;GACd,WAAW;EACb;EACA,mBACE,UAAU,QAAQ,SAAS,SAAS,UAAU,QAAQ,SAAS,UAAU;EAC3E,iBAAiB,OAAO,aAAa,OACnC,UAAU,QAAQ,SAAS,SACvB;GACE,MAAM;GACN,gBAAgB,UAAU;GAC1B,QAAQ,UAAU,QAAQ;EAC5B,IACA;GAAE,MAAM;GAAY,gBAAgB,UAAU;EAAe,CACnE;EACA,QAAQ,CAAC;CACX;AACF,CACF;;AAGA,SAAgB,QACd,SACoD;CACpD,OAAO,OAAO,IAAI,aAAa;EAC7B,IAAI,QAAQ,cAAc,eAAe,UACvC,OAAO,OAAO,OAAO,KACnB,QAAQ,WAAW,sDAAsD,eAAe,CAC1F;EAEF,IAAI,QAAQ,cAAc,WAAW,SAAS,UAC5C,OAAO,OAAO,OAAO,KACnB,QAAQ,WAAW,8CAA8C,eAAe,CAClF;EAEF,MAAM,oBAAoB,QAAQ,cAAc,qBAAqB,MAClE,eACC,CAAC,QAAQ,cAAc,mBAAmB,MAAM,SAAS,KAAK,eAAe,UAAU,CAC3F;EACA,IAAI,sBAAsB,KAAA,GACxB,OAAO,OAAO,OAAO,KACnB,QACE,WACA,2CAA2C,qBAC3C,eACF,CACF;EAEF,IACE,QAAQ,WAAW,cAAc,SAChC,OAAO,MAAM,QAAQ,WAAW,UAAU,QAAQ,CAAC,KAClD,QAAQ,WAAW,6BAAa,IAAI,KAAK,IAE3C,OAAO,OAAO,OAAO,KACnB,QAAQ,WAAW,oCAAoC,gBAAgB,CACzE;EAEF,MAAM,UAAU,OAAO,aACpB,OAAO,QAAQ,cAAc,eAAe,CAAC,CAC7C,KAAK,OAAO,UAAU,UAAU,QAAQ,WAAW,MAAM,SAAS,UAAU,CAAC,CAAC;EACjF,OAAOA,OAAY;GACjB,GAAI,QAAQ,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;GACpE,cAAc,QAAQ,cAAc,mBAAmB,KAAK,EAAE,iBAAiB,UAAU;GACzF,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;GAC9D,SACE,QAAQ,SAAS,SAAS;IAAE,MAAM;IAAQ,QAAQ,QAAQ;GAAO,IAAI,EAAE,MAAM,WAAW;GAC1F,OAAO,QAAQ,WAAW;EAC5B,CAAC;CACH,CAAC;AACH;;AAMA,SAAgB,gBAAgB,SAA6D;CAC3F,MAAM,SAAS,kBAAkB,OAAO;CACxC,MAAM,UAAUL,OAAE,eAAeA,OAAE,OAAO,EAAE,OAAOA,OAAE,OAAO,CAAC,CAAC;CAC9D,OAAO;EACL,UAAU,OAAO,GAAG,qCAAqC,CAAC,CAAC,WAAW,SAAS,aAAa;GAC1F,MAAM,eAAe,OAAOA,OAAE,oBAAoB,OAAO,CAAC,CAAC,QAAQ,OAAO,CAAC,CAAC,CAAC,KAC3E,OAAO,eAEH,IAAIM,QAAiB;IACnB,UAAU;IACV,SAAS;IACT,WAAW;IACX,OAAO;GACT,CAAC,CACL,CACF;GACA,MAAM,OAAO,YAAY,aAAa,IAAI,MAAM;GAChD,MAAM,kBAAkB,YAAY,aAAa,IAAI,iBAAiB;GACtE,IACE,YAAY,aAAa,IAAI,OAAO,MAAM,aAAa,SACvD,SAAS,QACT,oBAAoB,MAEpB,OAAO,OAAO,IAAIA,QAAiB;IACjC,UAAU;IACV,SAAS;IACT,WAAW;IACX,OAAO;GACT,CAAC;GAEH,MAAM,iBAAiB,OAAO,0BAA0B;IACtD,GAAI,QAAQ,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;IACpE,cAAc,QAAQ;IACtB,UAAU,QAAQ;IAClB,cAAc,QAAQ;IACtB,MAAMF,OAAY,IAAI;IACtB;IACA,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;IAC9D,aAAa,QAAQ;GACvB,CAAC;GACD,MAAM,iBAAiB,YAAY,aAAa,IAAI,QAAQ;GAC5D,IAAI,mBAAmB,MAAM;IAC3B,MAAM,UAAU,OAAO,aAAa,OAAO,eAAe,eAAe,CAAC,CAAC,KACzE,OAAO,UACJ,UACC,IAAIE,QAAiB;KACnB,UAAU;KACV,SAAS,MAAM;KACf,WAAW;KACX,OAAO;IACT,CAAC,CACL,CACF;IACA,IAAI,QAAQ,SAAS,UAAU,QAAQ,WAAW,gBAChD,OAAO,OAAO,IAAIA,QAAiB;KACjC,UAAU;KACV,SAAS;KACT,WAAW;KACX,OAAO;IACT,CAAC;GAEL;GACA,OAAO;EACT,CAAC;EACD,QAAQ;EACR,YAAY;EACZ,sBAAsB,CAAC,GAAG,QAAQ,YAAY;EAC9C,QAAQ,mBAAmB;GACzB,MAAM,mBAAmB,IAAI,IAAI,OAAO,UAAU;GAClD,iBAAiB,aAAa,IAAI,UAAU,UAAU;GACtD,iBAAiB,aAAa,IAAI,SAAS,cAAc;GACzD,OAAO,OAAO,QAAQ;IACpB;IACA,SAASF,OAAY,KAAK,UAAU,EAAE,OAAO,eAAe,CAAC,CAAC;GAChE,CAAC;EACH;CACF;AACF;AAEA,SAAS,QACP,WACA,SACA,QACA,QACA,MACmB;CACnB,OAAO,IAAIG,QAAkB;EAC3B,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK;EACrC;EACA;EACA,YAAY;EACZ;EACA,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;CAC3C,CAAC;AACH;;;;AC1WA,MAAM,mBAAmB,OAAO,OAAO,KACrC,OAAO,SACL,OAAO,QACP,qBAAqB,UAAU;CAC7B,SAAS,UAAU,MAAM,KAAK,CAAC,CAAC,YAAY;CAC5C,SAAS,UAAU;AACrB,CAAC,CACH,CACF;AAEA,MAAM,kBAAkB,OAAO,OAAO,KACpC,OAAO,SACL,OAAO,QACP,qBAAqB,gBAAgB;CACnC,SAAS,OAAO,YACd,OAAO,IAAI;EACT,WAAWC,QAAiB,KAAK,CAAC,CAAC,SAAS;EAC5C,QAAQ,UACN,IAAI,YAAY,aACd,EAAE,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAClE,OACA,OACF;CACJ,CAAC;CACH,SAAS,UAAU,OAAO,QAAQ,KAAK;AACzC,CAAC,CACH,CACF;AAEA,MAAM,cAAc,gBAAgB,GAAG,CAAC;AACxC,MAAM,eAAe,gBAAgB,GAAG,CAAC;AAEzC,MAAM,eAAe,OAAO,OAAO,KACjC,OAAO,SACL,OAAO,QACP,qBAAqB,UAAU;CAC7B,SAAS,UAAU;EACjB,MAAM,UAAU,MAAM,KAAK;EAC3B,MAAM,SAAS,CAAC,GAAG,QAAQ,SAAS,oBAAoB,CAAC;EACzD,OAAO,OAAO,WAAW,IACrB,UACA,OACG,KAAK,WAAW,MAAM,MAAM,GAAA,CAAI,QAAQ,QAAQ,IAAG,CAAC,CAAC,QAAQ,SAAS,IAAI,CAAC,CAAC,CAC5E,KAAK,EAAE;CAChB;CACA,SAAS,UAAU;AACrB,CAAC,CACH,CACF;AAEA,MAAM,eAAe,OAAO,OAAO,KACjC,OAAO,SACL,OAAO,QACP,qBAAqB,UAAU;CAC7B,SAAS,UAAU,MAAM,KAAK,CAAC,CAAC,QAAQ,mBAAmB,KAAK;CAChE,SAAS,UAAU;AACrB,CAAC,CACH,CACF;AAEA,SAAgB,MAAM,MAAsB,OAAwB;CAClE,MAAM,gBAAgB;EACpB,QAAQ,MAAR;GACE,KAAK;GACL,KAAK,QACH,OAAO;GACT,KAAK;GACL,KAAK,MACH,OAAO;GACT,KAAK,MACH,OAAO;GACT,KAAK,OACH,OAAO;GACT,KAAK,OACH,OAAO;GACT,KAAK,OACH,OAAO;EACX;CACF,EAAA,CAAG;CACH,IAAI;EACF,OAAO,OAAO,kBAAkB,MAAM,CAAC,CAAC,KAAK;CAC/C,SAAS,OAAO;EACd,MAAM,IAAIC,QAAkB,EAC1B,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAChE,CAAC;CACH;AACF;AAEA,SAAS,gBAAgB,QAAgB,aAAqB;CAC5D,OAAO,OAAO,OAAO,KACnB,OAAO,SACL,OAAO,QACP,qBAAqB,gBAAgB;EACnC,SAAS,OAAO,YACd,OAAO,IAAI;GACT,WAAW;IACT,MAAM,QAAQ,MAAM,KAAK,CAAC,CAAC,MAAM,KAAK;IACtC,IAAI,MAAM,WAAW,QACnB,MAAM,IAAI,MAAM,4CAA4C;IAC9D,MAAM,SAAS,MAAM;IACrB,IAAI,WAAW,KAAA,GAAW,MAAM,IAAI,MAAM,8BAA8B;IACxE,MAAM,eAAeD,QAAiB,MAAM;IAC5C,OAAO,MAAM,KAAK,GAAG;GACvB;GACA,QAAQ,UACN,IAAI,YAAY,aACd,EAAE,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAClE,OACA,OACF;EACJ,CAAC;EACH,SAAS,UAAU,OAAO,QAAQ,KAAK;CACzC,CAAC,CACH,CACF;AACF;;;;;;;;ACzGA,SAAgBE,OAAK,SAAyC;CAC5D,MAAM,QAAQ,QAAQ,SAAS,WAAW;CAC1C,MAAM,YAAY,QAAQ,aAAa;CACvC,OAAO,EACL,SAAS,OAAO,GAAG,sBAAsB,CAAC,EAAE,UAC1C,OAAO,WAAW;EAChB,MAAM,iBACJ,QAAQ;GAAE;GAAc;GAAO;GAAO;GAAW,UAAU,QAAQ;EAAS,CAAC;EAC/E,QAAQ,UACN,iBAAiBC,UACb,QACA,IAAIA,QAAkB;GACpB;GACA,SAAS,iBAAiB,QAAQ,MAAM,UAAU;GAClD,QAAQ;EACV,CAAC;CACT,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,iBAAiB,OAAO,OAAO,CAAC,CAAC,CACvE,EACF;AACF;AAEA,MAAaC,WAAS,YACpB,MAAM,QAAQC,WAAqBH,OAAK,OAAO,CAAC;AAElD,MAAaI,aAAW,YACtBC,UAAoBL,OAAK,OAAO,CAAC;AAEnC,SAAS,iBACP,OACA,SAC0D;CAC1D,OAAO,OAAO,IAAI;EAChB,WAAW,UAAU,OAAO,OAAO;EACnC,QAAQ,UACN,IAAIC,QAAkB;GACpB;GACA,SAAS;GACT,QAAQ;EACV,CAAC;CACL,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,WAAW,eAAe,OAAO,MAAM,CAAC,GACxD,OAAO,QAAQ,YAAY,CAC7B;AACF;AAEA,SAAS,aACP,QAC0D;CAC1D,IAAI,OAAO,UAAU,YACnB,OAAO,OAAO,QAAQ,EAAE,MAAM,SAAS,CAAC;CAE1C,IAAI,OAAO,UAAU,WACnB,OAAO,OAAO,KACZ,IAAIA,QAAkB;EACpB,SAAS,yBAAyB,OAAO,SAAS;EAClD,QAAQ;CACV,CAAC,CACH;CAEF,IAAI,OAAO,YAAY,KAAA,KAAa,OAAO,QAAQ,WAAW,GAC5D,OAAO,OAAO,QAAQ,EAAE,MAAM,SAAS,CAAC;CAE1C,OAAO,OAAO,QAAQ,OAAO,SAAS,cAAc,EAAE,aAAa,YAAY,CAAC,CAAC,CAAC,KAChF,OAAO,KAAK,YAAoC;EAC9C,MAAM,mBAAmB,QAAQ,QAAQ,WAAW,WAAW,IAAI;EACnE,OAAO,iBAAiB,WAAW,IAC/B,EAAE,MAAM,SAAS,IACjB;GAAE,MAAM;GAAU,SAAS;EAAiB;CAClD,CAAC,CACH;AACF;AAEA,SAAS,eACP,OACA,QACoD;CACpD,OAAO,OAAO,IAAI;EAChB,WAAW;GACT,IAAI,OAAO,SAAS,YAAY,MAAM,IAAI,MAAM,0BAA0B;GAC1E,IAAI,OAAO,OAAO,GAAG,MAAM,IAAI,MAAM,4CAA4C;GACjF,IAAI,OAAO,SAAS,MAAM,IAAI,MAAM,uCAAuC;GAC3E,MAAM,YAAY,OAAO,aAAa,CAAC;GACvC,IAAI,UAAU,WAAW,GAAG,MAAM,IAAI,MAAM,2CAA2C;GACvF,MAAM,WAAW,UAAU;GAC3B,IAAI,aAAa,KAAA,GAAW,MAAM,IAAI,MAAM,uCAAuC;GACnF,IACE,SAAS,UAAU,QACnB,SAAS,SAAS,MAAM,QACxBK,QAAiB,SAAS,IAAI,MAAM,MAAM,MAE1C,MAAM,IAAI,MAAM,6CAA6C;GAE/D,OAAO;EACT;EACA,QAAQ,UACN,IAAIL,QAAkB;GACpB;GACA,SAAS,iBAAiB,QAAQ,MAAM,UAAU;GAClD,QAAQ;EACV,CAAC;CACL,CAAC;AACH;AAEA,SAAS,aACP,QAC6D;CAC7D,OAAO,OAAO,IAAI,aAAa;EAC7B,IAAI,OAAO,UAAU,MAAM,OAAO;EAClC,MAAM,UAAU,OAAO,OAAO,IAAI;GAChC,WAAW,WAAW,MAAM;GAC5B,QAAQ,UACN,IAAIA,QAAkB;IACpB;IACA,SAAS;IACT,QAAQ;GACV,CAAC;EACL,CAAC;EACD,IAAI,YAAY,KAAA,GAAW,OAAO;EAClC,MAAM,OAAO,OAAOM,SAAkB,OAAO,IAAI;EACjD,MAAM,OAAO,OAAO,OAAO,IAAI;GAC7B,WAAWC,MAAc,QAAQ,MAAM,QAAQ,IAAI;GACnD,QAAQ,UACN,IAAIP,QAAkB;IACpB;IACA,SAAS;IACT,QAAQ;GACV,CAAC;EACL,CAAC;EACD,IAAI,OAAO,QAAQ,KAAA,GACjB,OAAO,OAAO,IAAIA,QAAkB;GAClC,SAAS;GACT,QAAQ;EACV,CAAC;EAEH,OAAO;GAAE;GAAM;GAAM,KAAK,OAAO;GAAK,MAAM,QAAQ;EAAK;CAC3D,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,iBAAiBA,UACb,QACA,IAAIA,QAAkB;EAAE;EAAO,SAAS,MAAM;EAAS,QAAQ;CAAW,CAAC,CACjF,CACF;AACF;AAEA,SAAS,WACP,QACsE;CACtE,QAAQ,OAAO,MAAf;EACE,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,MACH,OAAO;GAAE,MAAM,OAAO;GAAM,MAAM,OAAO;EAAK;EAChD,KAAK,OACH,OAAO;GACL,MAAM,GAAG,OAAO,KAAK,SAAS,EAAE,GAAG,OAAO,KAAK,IAAI,GAAG,OAAO,KAAK;GAClE,MAAM,OAAO;EACf;EACF,KAAK,MACH,OAAO;GACL,MAAM,GAAG,eAAe,OAAO,KAAK,YAAY,eAAe,EAAE,GAAG,OAAO,KAAK;GAChF,MAAM,OAAO;EACf;EACF,KAAK,OACH,OAAO;GACL,MAAM;IACJ,eAAe,OAAO,KAAK,UAAU,cAAc;IACnD,eAAe,OAAO,KAAK,QAAQ,YAAY;IAC/C,eAAe,OAAO,KAAK,MAAM,UAAU;IAC3C,OAAO,KAAK;GACd,CAAC,CAAC,KAAK,GAAG;GACV,MAAM,OAAO;EACf;EACF,KAAK,OACH,OAAO;GAAE,MAAM,UAAU,OAAO,IAAI;GAAG,MAAM,OAAO;EAAK;EAC3D,SACE;CACJ;AACF;AAEA,SAAS,UAAU,MAAiC;CAElD,MAAM,WADS,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,IAAI,EAAA,CAC1B,KAAK,UAC1B,OAAO,UAAU,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,IAAI,KAChE;CACA,MAAM,SAAS,QAAQ,QAAQ,OAAO,UAAU,QAAQ,MAAM,QAAQ,CAAC;CACvE,MAAM,SAAS,IAAI,WAAW,MAAM;CACpC,IAAI,SAAS;CACb,KAAK,MAAM,SAAS,SAAS;EAC3B,OAAO,IAAI,OAAO,MAAM;EACxB,UAAU,MAAM;CAClB;CACA,OAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,MAAM;AAChE;AAEA,SAAS,eAAe,OAA2B,OAAuB;CACxE,IAAI,UAAU,KAAA,GAAW,MAAM,IAAI,MAAM,wBAAwB,OAAO;CACxE,OAAO;AACT;AAEA,eAAe,QAAQ,OAMC;CACtB,MAAM,aAAa,IAAI,gBAAgB;CACvC,IAAI,WAAW;CACf,MAAM,wBAAwB,WAAW,MAAM,MAAM,aAAa,MAAM;CACxE,MAAM,sBAAsB,WAAW,MAAM,MAAM,MAAM,QAAQ,MAAM;CACvE,MAAM,aAAa,iBAAiB,SAAS,iBAAiB,EAAE,MAAM,KAAK,CAAC;CAC5E,MAAM,MAAM,QAAQ,iBAAiB,SAAS,eAAe,EAAE,MAAM,KAAK,CAAC;CAC3E,MAAM,QAAQ,iBAAiB;EAC7B,WAAW;EACX,WAAW,sBAAM,IAAI,MAAM,0BAA0B,CAAC;CACxD,GAAG,MAAM,SAAS;CAClB,IAAI;EACF,MAAM,QAAQ,WAAW,KACvB,UAAU,OAAO;GACf,OAAO,UAAU;GACjB,IAAI;GACJ,WAAW,CAAC;IAAE,MAAM,MAAM,MAAM;IAAM,MAAM,MAAM,MAAM;GAAK,CAAC;GAC9D,MAAM;EACR,CAAC,CACH;EACA,MAAM,WAAW,MAAM,MAAM,MAAM,IAAI,IAAI,MAAM,QAAQ,GAAG;GAC1D,MAAM;GACN,SAAS;IACP,QAAQ;IACR,gBAAgB;GAClB;GACA,QAAQ;GACR,QAAQ,WAAW;EACrB,CAAC;EACD,IAAI,CAAC,SAAS,IACZ,MAAM,IAAIA,QAAkB;GAC1B,SAAS,qBAAqB,SAAS;GACvC,QAAQ;EACV,CAAC;EAEH,MAAM,cAAc,SAAS,QAC1B,IAAI,cAAc,CAAC,EAClB,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAChB,KAAK,CAAC,CACP,YAAY;EACf,IAAI,gBAAgB,2BAClB,MAAM,IAAIA,QAAkB;GAC1B,SAAS,yCAAyC,eAAe;GACjE,QAAQ;EACV,CAAC;EAEH,OAAO,IAAI,WAAW,MAAM,SAAS,YAAY,CAAC;CACpD,SAAS,OAAO;EACd,IAAI,UACF,MAAM,IAAIA,QAAkB;GAAE,SAAS;GAAuB,QAAQ;EAAU,CAAC;EAEnF,MAAM;CACR,UAAU;EACR,aAAa,KAAK;EAClB,MAAM,aAAa,oBAAoB,SAAS,eAAe;EAC/D,MAAM,MAAM,QAAQ,oBAAoB,SAAS,aAAa;CAChE;AACF;;;;;;;;AClRA,MAAMQ,aAAW;AAMjB,SAAgBC,OAAK,UAAmB,CAAC,GAA0B;CACjE,OAAOC,OAAkB;EAAE,GAAG;EAAS,UAAU,QAAQ,YAAYF;CAAS,CAAC;AACjF;AAEA,MAAaG,WAAS,UAAmB,CAAC,MACxC,MAAM,QAAQC,WAAqBH,OAAK,OAAO,CAAC;AAElD,MAAaI,aAAW,UAAmB,CAAC,MAC1CC,UAAoBL,OAAK,OAAO,CAAC;;;;;;;;ACdnC,MAAM,WAAW;AAMjB,SAAgBM,OAAK,UAAmB,CAAC,GAA0B;CACjE,OAAOC,OAAkB;EAAE,GAAG;EAAS,UAAU,QAAQ,YAAY;CAAS,CAAC;AACjF;AAEA,MAAa,SAAS,UAAmB,CAAC,MACxC,MAAM,QAAQC,WAAqBF,OAAK,OAAO,CAAC;AAElD,MAAa,WAAW,UAAmB,CAAC,MAC1CG,UAAoBH,OAAK,OAAO,CAAC;;;;;;;;;;;ACInC,MAAa,cAAc,KAAK,WAAwB;AAOxD,MAAM,iBAAiB,KAAK,WAAmB;AAC/C,MAAM,gBAAgB,OAAO,IAAI,MAAM,OAAO,uBAAuB,CAAC,CAAC;AACvE,MAAM,eAAe,OAAO,YAAY;CACtC,UAAU,CAAC;CACX,UAAU,CAAC;CACX,QAAQ,EAAE,SAAS,cAAc;AACnC,CAAC;AACD,MAAa,SAAS;CACpB,UAAU,eAAe;CACzB,UAAU,eAAe;CACzB,SAAS,EAAE,cACT,eAAe,OAAO,EAAE,SAAS,OAAO,kBAAkB,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC;CACrF,QAAQ;AACV;AAMA,IAAa,UAAb,cAA6B,QAAQ,QAA4B,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC;AAElG,SAAgB,KAAK,SAA0C;CAC7D,OAAO,QAAQ,GAAG,EAChB,SAAS,OAAO,GAAG,yBAAyB,CAAC,EAAE,UAC7C,OAAO,QAAQ,UAAU,UAAUI,UAAQ,OAAO,KAAK,GAAG,EAAE,aAAa,YAAY,CAAC,CACxF,EACF,CAAC;AACH;;AAKA,SAAgB,YAAY,UAA0B,CAAC,GAAc;CACnE,MAAM,YAAY,QAAQ,aAAa;CACvC,OAAO,KAAK,CACV;EACE,IAAI;EACJ,UAAUC,OAA4B,OAAO;EAC7C;CACF,GACA;EAAE,IAAI;EAAU,UAAUC,OAAwB,OAAO;EAAG;CAAU,CACxE,CAAC;AACH;AAEA,MAAa,gBAAgB,UAA0B,CAAC,MACtD,MAAM,QAAQ,SAAS,YAAY,OAAO,CAAC;AAE7C,SAASF,UAAQ,OAAc,OAAsD;CACnF,MAAM,YAAY,MAAM,aAAa;CACrC,OAAO,MAAM,SAAS,QAAQ,KAAK,CAAC,CAAC,KACnC,OAAO,QAAQ,SAAS,GACxB,OAAO,MAAM;EACX,YAAY,YAAyB;GACnC,IACE,QAAQ,SAAS,kBAChB,QAAQ,SAAS,mBAAmB,QAAQ,WAAW,WAExD,OAAO,YAAY,SAAS;IAAE,YAAY,MAAM;IAAI;GAAU,CAAC;GAEjE,OAAO,YAAY,OAAO;IACxB,SAAS,QAAQ;IACjB,QAAQ,QAAQ,WAAW,aAAa,aAAa;IACrD,YAAY,MAAM;GACpB,CAAC;EACH;EACA,YAAY,eACV,WAAW,SAAS,WAChB,YAAY,OAAO,EAAE,YAAY,MAAM,GAAG,CAAC,IAC3C,YAAY,OAAO;GAAE,SAAS,WAAW;GAAS,YAAY,MAAM;EAAG,CAAC;CAChF,CAAC,CACH;AACF;;;;;;;;;;;ACxFA,MAAa,YAAY,KAAK,WAAsB;AAMpD,MAAa,WAAW,KAAK,WAAqB;AAyBlD,MAAa,sBAAsB,KAAK,WAAgC;AAWxE,MAAa,uBAAuB,KAAK,WAAiC;AAc1E,MAAa,SAAS,KAAK,WAAmB;AAS9C,SAAgB,QACd,OAC+D;CAC/D,OAAO,cAAc,KAAK;AAC5B;AAEA,MAAM,gBAAgB,OAAO,GAAG,sBAAsB,CAAC,CAAC,WAAW,OAAe;CAChF,MAAM,YAAY,MAAM,aAAa,UAAU,QAAQ,CAAC,CAAC;CACzD,MAAM,WAAW,MAAM,YAAY,SAAS,SAAS;CACrD,MAAM,eACJ,UAAU,SAAS,aACf,OAAO,QAAqC,IAAI,IAChD,iBAAiB,MAAM,QAAQ,UAAU,UAAA,OAAiC,SAAS,CAAC;CAC1F,MAAM,iBACJ,SAAS,SAAS,aACd,OAAO,QAAoC,IAAI,IAC/C,OAAO,QAAQG,YAAsB,YACnC,gBAAgB,SAAS,SAAS,MAAM,MAAM,MAAM,CAAC,CAAC,KACpD,OAAO,OAAO,YACZ,OAAO,QACL,oBAAoB,YAAY,EAAE,SAAS,QAAQ,QAAQ,CAAC,CAC9D,CACF,CACF,CACF;CACN,MAAM,CAAC,qBAAqB,wBAAwB,OAAO,OAAO,IAChE,CAAC,gBAAgB,YAAY,GAC7B,EAAE,aAAa,YAAY,CAC7B;CACA,OAAO,UAAU;EAAE,UAAU;EAAqB,WAAW;CAAqB,CAAC;AACrF,CAAC;AAED,SAAS,gBACP,UACA,MACA,aACuD;CACvD,OAAO,SAAS,YAAY,IAAI,CAAC,CAAC,KAChC,OAAO,KAAK,YAAiC;EAC3C,IACE,QAAQ,MACL,aAAa,SAAS,SAAS,YAAYC,OAAiB,UAAU,WAAW,CACpF,GAEA,OAAO,oBAAoB,QAAQ;EAErC,MAAM,UAAU,QAAQ,QACrB,aACC,SAAS,SAAS,YAClB,SAAS,SAAS,YAAY,QAC9B,SAAS,SAAS,YAAY,IAClC;EACA,OAAO,QAAQ,WAAW,IACtB,oBAAoB,QAAQ,IAC5B,oBAAoB,SAAS,EAAE,SAAS,QAAQ,CAAC;CACvD,CAAC,CACH;AACF;AAEA,SAAS,iBACP,aACA,QACwD;CACxD,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,kBAAkB,OAAO,OAAO,oBAAA,OAA2C,MAAM,CAAC,CACtF,MACF,CAAC,CAAC,KAAK,OAAO,UAAU,UAAU,IAAIC,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAAC;EACpF,MAAM,iBAAiB,OAAO,OAAO,cAAcC,OAAuB;EAE1E,MAAM,WAAW,OADJ,OAAO,UAAU,sBAAsBC,YAA4B,CACrD,CAAC,CAAC,QAAQ;GAAE,MAAM,YAAY;GAAM,MAAM,YAAY;EAAK,CAAC;EACvF,IAAI,gBAAgB,SAAS,YAAY,gBAAgB,UAAU,SAAS,QAC1E,OAAO,OAAO,IAAIF,QAAkB,EAClC,SAAS,kBAAkB,gBAAgB,QAAQ,eAAe,SAAS,OAAO,uBACpF,CAAC;EAEH,OAAO,kBAAkB,aAAa,iBAAiB,QAAQ;CACjE,CAAC;AACH;AAEA,SAAS,kBACP,aACA,QACA,UACsB;CACtB,MAAM,qBAAqB,SAAS,SAAS,gBAC3C,YAAY,SAAS,YAAY,aAAa,aAAa,YAAY,OAAO,IAC1E,CAAC,YAAY,UAAU,IACvB,CAAC,CACP;CACA,MAAM,WACJ,OAAO,SAAS,aAAa,IAAI,OAAO,SAAS,aAAa,SAAS,SAAS,OAAO;CACzF,IAAI,WAAW,KAAK,mBAAmB,UAAU,UAC/C,OAAO,qBAAqB,SAAS;EAAE;EAAU;CAAmB,CAAC;CAEvE,MAAM,cAAc,SAAS,QAC1B,gBAAgB,YAAY,SAAS,cAAc,YAAY,SAAS,QAC3E,CAAC,CAAC;CACF,IAAI,cAAc,KAAK,mBAAmB,SAAS,eAAe,UAChE,OAAO,qBAAqB,YAAY,EAAE,SAAS,CAAC;CAEtD,IACE,SAAS,MACN,gBACC,YAAY,SAAS,YAAY,CAAC,aAAa,aAAa,YAAY,OAAO,CACnF,GAEA,OAAO,qBAAqB,SAAS,EAAE,SAAS,CAAC;CAEnD,IAAI,SAAS,MAAM,gBAAgB,YAAY,SAAS,QAAQ,GAC9D,OAAO,qBAAqB,QAAQ,EAAE,SAAS,CAAC;CAElD,OAAO,qBAAqB,YAAY,EAAE,SAAS,CAAC;AACtD;AAEA,SAAS,aACP,aACA,SACS;CACT,MAAM,WAAWG,MAAc,YAAY,MAAM,YAAY,WAAW,CAAC;CACzE,OAAO,QAAQ,MACZ,WACC,OAAO,SAAS,YAAY,QAC5B,OAAO,SAAS,YAAY,QAC5BA,MAAc,YAAY,MAAM,OAAO,IAAI,MAAM,QACrD;AACF;AAEA,SAAS,UAAU,UAA4B;CAC7C,MAAM,YAAY,CAAC,SAAS,UAAU,SAAS,SAAS,CAAC,CAAC,QACvD,gBACC,gBAAgB,IACpB;CACA,IAAI,UAAU,WAAW,GAAG,OAAO,OAAO,YAAY,QAAQ;CAC9D,IACE,UAAU,OACP,gBAAgB,YAAY,SAAS,aAAa,YAAY,SAAS,UAC1E,GAEA,OAAO,OAAO,SAAS,QAAQ;CAEjC,IAAI,UAAU,MAAM,gBAAgB,YAAY,SAAS,aAAa,GACpE,OAAO,OAAO,YAAY,QAAQ;CAEpC,IAAI,UAAU,MAAM,gBAAgB,YAAY,SAAS,UAAU,GACjE,OAAO,OAAO,SAAS,QAAQ;CAEjC,OAAO,OAAO,QAAQ,QAAQ;AAChC;AAEA,SAAS,YAAY,aAA0C;CAC7D,MAAMC,SAAOC,KAAe,WAAW;CACvC,QAAQ,YAAY,MAApB;EACE,KAAK;EACL,KAAK,QACH,OAAO,OAAOD,OAAK,OAAO;EAC5B,KAAK;EACL,KAAK,MACH,OAAO,OAAOA,OAAK,MAAM;EAC3B,KAAK,OACH,OAAO,OAAOA,OAAK,KAAK;EAC1B,KAAK,MACH,OAAO,GAAGA,OAAK,SAAS,GAAGA,OAAK;EAClC,KAAK,OACH,OAAO,GAAGA,OAAK,MAAM,GAAGA,OAAK,IAAI,GAAGA,OAAK;EAC3C,KAAK,OACH,OAAO,GAAGA,OAAK,SAAS,GAAGA,OAAK,OAAO,GAAGA,OAAK,KAAK,GAAGA,OAAK;CAChE;AACF"}