domainkit 0.8.0 → 0.9.0

package/dist/Cloudflare.mjs

@@ -0,0 +1,225 @@
+import { __exportAll } from "./_virtual/_rolldown/runtime.mjs";
+import { decode } from "./DomainName.mjs";
+import { Unauthenticated, Unsupported } from "./Reason.mjs";
+import { fail } from "./internal/error.mjs";
+import { authorizationUrl, exchangeCode, refresh, revoke } from "./internal/oauth.mjs";
+import { make, resolveAmong, tokenAuth } from "./Provider.mjs";
+import { dns, listZones, provider as provider$1, tokenExpiry, verifyToken } from "./internal/cloudflare/client.mjs";
+import { resolve } from "./internal/config.mjs";
+import { Effect, Redacted, Schema } from "effect";
+//#region src/Cloudflare.ts
+/** Cloudflare: personal API tokens and OAuth. */
+var Cloudflare_exports = /* @__PURE__ */ __exportAll({
+	AccountContext: () => AccountContext,
+	TokenFields: () => TokenFields,
+	provider: () => provider,
+	server: () => server
+});
+/**
+* Authorization context: `accountId` is `null` when the credential spans several accounts or
+* none yet. Target context: the zone's account and zone id.
+*/
+const AccountContext = Schema.Struct({
+	accountId: Schema.NullOr(Schema.String),
+	/** How the token was verified: user tokens span accounts, account tokens are pinned. */
+	tokenKind: Schema.optionalKey(Schema.Literals(["user", "account"])),
+	zoneId: Schema.optionalKey(Schema.String)
+});
+/** Token-method input: the API token, and the account id for account-owned tokens. */
+const TokenFields = Schema.Struct({
+	token: Schema.RedactedFromValue(Schema.String),
+	accountId: Schema.optionalKey(Schema.String)
+});
+const server = {
+	authorization_endpoint: "https://dash.cloudflare.com/oauth2/auth",
+	issuer: "https://dash.cloudflare.com",
+	revocation_endpoint: "https://dash.cloudflare.com/oauth2/revoke",
+	token_endpoint: "https://dash.cloudflare.com/oauth2/token"
+};
+const defaultScopes = [
+	"zone:read",
+	"dns_records:edit",
+	"offline_access"
+];
+const capabilities = ["dns:read", "dns:write"];
+/** OAuth credentials pack both tokens into `secret`; token credentials are the token itself. */
+const Secret = Schema.fromJsonString(Schema.Struct({
+	accessToken: Schema.String,
+	refreshToken: Schema.NullOr(Schema.String)
+}));
+const parseSecret = (secret) => {
+	const raw = Redacted.value(secret);
+	const parsed = raw.startsWith("{") ? Schema.decodeUnknownOption(Secret)(raw) : void 0;
+	return parsed !== void 0 && parsed._tag === "Some" ? parsed.value : {
+		accessToken: raw,
+		refreshToken: null
+	};
+};
+const packSecret = (tokens) => Redacted.make(Schema.encodeSync(Secret)({
+	accessToken: tokens.accessToken,
+	refreshToken: tokens.refreshToken
+}));
+const provider = (options = {}) => {
+	const fetch = options.fetch ?? globalThis.fetch;
+	const baseUrl = (options.baseUrl ?? "https://api.cloudflare.com/client/v4").replace(/\/$/, "");
+	const client = (token) => ({
+		token,
+		fetch,
+		baseUrl
+	});
+	const discoverAccount = (token) => listZones(client(token)).pipe(Effect.map((zones) => {
+		const accounts = new Set(zones.map((zone) => zone.account.id));
+		const [only] = accounts;
+		return accounts.size === 1 && only !== void 0 ? only : null;
+	}));
+	const targetOf = (zone) => ({
+		zone: zone.name,
+		context: {
+			accountId: zone.account.id,
+			zoneId: zone.id
+		},
+		label: `${zone.name} (${zone.account.name})`,
+		nameservers: zone.name_servers ?? []
+	});
+	const oauthClient = (oauth) => Effect.gen(function* () {
+		return {
+			clientId: yield* resolve(oauth.clientId, "oauth.clientId"),
+			clientSecret: yield* resolve(oauth.clientSecret, "oauth.clientSecret"),
+			clientAuth: oauth.clientAuth ?? "client_secret_basic"
+		};
+	});
+	const issued = (tokens) => discoverAccount(tokens.accessToken).pipe(Effect.map((accountId) => ({
+		secret: packSecret(tokens),
+		context: { accountId },
+		expiresAt: tokens.expiresAt
+	})));
+	const oauth = options.oauth === void 0 ? void 0 : oauthAuth(options.oauth);
+	function oauthAuth(settings) {
+		const scopes = settings.scopes ?? defaultScopes;
+		return {
+			label: "Sign in with Cloudflare",
+			scopes,
+			start: (input) => oauthClient(settings).pipe(Effect.map(({ clientId }) => ({ authorizationUrl: authorizationUrl({
+				server,
+				clientId,
+				scopes,
+				state: input.state,
+				callbackUrl: input.callbackUrl,
+				codeChallenge: input.codeChallenge
+			}) }))),
+			complete: (input) => oauthClient(settings).pipe(Effect.flatMap((oauthClientValue) => exchangeCode({
+				provider: provider$1,
+				server,
+				client: oauthClientValue,
+				code: input.code,
+				state: input.params.state ?? "",
+				callbackUrl: input.callbackUrl,
+				codeVerifier: input.codeVerifier,
+				fetch
+			})), Effect.flatMap(issued)),
+			refresh: (credential) => Effect.gen(function* () {
+				const { refreshToken } = parseSecret(credential.secret);
+				if (refreshToken === null) return yield* fail(new Unauthenticated({ message: "Cloudflare credential has no refresh token" }));
+				const tokens = yield* refresh({
+					provider: provider$1,
+					server,
+					client: yield* oauthClient(settings),
+					refreshToken,
+					fetch
+				});
+				return {
+					secret: packSecret(tokens),
+					context: credential.context,
+					expiresAt: tokens.expiresAt
+				};
+			}),
+			revoke: (credential) => Effect.gen(function* () {
+				const { accessToken } = parseSecret(credential.secret);
+				yield* revoke({
+					provider: provider$1,
+					server,
+					client: yield* oauthClient(settings),
+					token: accessToken,
+					fetch
+				});
+			})
+		};
+	}
+	return make({
+		id: "cloudflare",
+		name: "Cloudflare",
+		context: AccountContext,
+		contextVersion: "cloudflare.v1",
+		auth: {
+			token: tokenAuth({
+				label: "API token",
+				docsUrl: "https://developers.cloudflare.com/fundamentals/api/get-started/create-token/",
+				requiredCapabilities: capabilities,
+				fields: TokenFields,
+				authenticate: ({ token, accountId }) => Effect.gen(function* () {
+					const raw = Redacted.value(token);
+					if (accountId !== void 0) {
+						const expiresAt = yield* verifyToken(client(raw), `/accounts/${encodeURIComponent(accountId)}/tokens/verify`);
+						return {
+							secret: token,
+							context: {
+								accountId,
+								tokenKind: "account"
+							},
+							expiresAt
+						};
+					}
+					const discovered = yield* discoverAccount(raw);
+					const verified = yield* tokenExpiry(client(raw), discovered);
+					return {
+						secret: token,
+						context: {
+							accountId: discovered,
+							tokenKind: verified.kind
+						},
+						expiresAt: verified.expiresAt
+					};
+				})
+			}),
+			...oauth === void 0 ? {} : { oauth }
+		},
+		session: (credential) => {
+			const { accessToken } = parseSecret(credential.secret);
+			const clientOptions = client(accessToken);
+			const context = Schema.decodeUnknownOption(AccountContext)(credential.context);
+			const accountId = context._tag === "Some" ? context.value.accountId ?? void 0 : void 0;
+			const listTargets = () => listZones(clientOptions, accountId).pipe(Effect.map((zones) => zones.map(targetOf)));
+			return {
+				capabilities: () => Effect.succeed(capabilities),
+				listTargets,
+				resolveTarget: (domain) => Effect.gen(function* () {
+					const name = yield* decode(domain);
+					const targets = yield* listTargets();
+					return resolveAmong(name, targets);
+				}),
+				dns: (target) => {
+					const zone = Schema.decodeUnknownOption(AccountContext)(target.context);
+					const zoneId = zone._tag === "Some" ? zone.value.zoneId : void 0;
+					if (zoneId === void 0) {
+						const failure = fail(new Unsupported({
+							provider: "cloudflare",
+							operation: "dns",
+							message: "Cloudflare target has no zone id; only zone targets host records"
+						}));
+						return {
+							list: () => failure,
+							create: () => failure,
+							get: () => failure,
+							delete: () => failure
+						};
+					}
+					return dns(clientOptions, zoneId);
+				}
+			};
+		}
+	});
+};
+//#endregion
+export { AccountContext, Cloudflare_exports, TokenFields, provider, server };
+
+//# sourceMappingURL=Cloudflare.mjs.map

package/dist/Cloudflare.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Cloudflare.mjs","names":["Client.listZones","OAuth.authorizationUrl","OAuth.exchangeCode","Client.provider","Errors.fail","Reason.Unauthenticated","OAuth.refresh","OAuth.revoke","Provider.make","Provider.tokenAuth","Client.verifyToken","Client.tokenExpiry","DomainName.decode","Provider.resolveAmong","Reason.Unsupported","Client.dns"],"sources":["../src/Cloudflare.ts"],"sourcesContent":["/** Cloudflare: personal API tokens and OAuth. */\nimport { type Config, Effect, Redacted, Schema } from \"effect\";\n\nimport * as Errors from \"./internal/error.ts\";\nimport * as Reason from \"./Reason.ts\";\nimport * as DomainName from \"./DomainName.ts\";\nimport * as Client from \"./internal/cloudflare/client.ts\";\nimport type * as Protocol from \"./internal/cloudflare/protocol.ts\";\nimport { resolve } from \"./internal/config.ts\";\nimport type { Fetch } from \"./internal/http.ts\";\nimport * as OAuth from \"./internal/oauth.ts\";\nimport * as Provider from \"./Provider.ts\";\n\n/**\n * Authorization context: `accountId` is `null` when the credential spans several accounts or\n * none yet. Target context: the zone's account and zone id.\n */\nexport const AccountContext = Schema.Struct({\n  accountId: Schema.NullOr(Schema.String),\n  /** How the token was verified: user tokens span accounts, account tokens are pinned. */\n  tokenKind: Schema.optionalKey(Schema.Literals([\"user\", \"account\"])),\n  zoneId: Schema.optionalKey(Schema.String),\n});\n\n/** Token-method input: the API token, and the account id for account-owned tokens. */\nexport const TokenFields = Schema.Struct({\n  token: Schema.RedactedFromValue(Schema.String),\n  accountId: Schema.optionalKey(Schema.String),\n});\nexport type AccountContext = typeof AccountContext.Type;\n\nexport interface Options {\n  /** Omit to offer tokens only. */\n  readonly oauth?: {\n    readonly clientId: string | Config.Config<string>;\n    readonly clientSecret: Redacted.Redacted<string> | Config.Config<Redacted.Redacted<string>>;\n    /** Scope ids assigned to the OAuth client. Default: `zone:read`, `dns_records:edit`, `offline_access`. */\n    readonly scopes?: ReadonlyArray<string>;\n    /** Default `client_secret_basic`. */\n    readonly clientAuth?: OAuth.ClientAuth;\n  };\n  readonly fetch?: Fetch;\n  readonly baseUrl?: string;\n}\n\nexport const server: OAuth.Server = {\n  authorization_endpoint: \"https://dash.cloudflare.com/oauth2/auth\",\n  issuer: \"https://dash.cloudflare.com\",\n  revocation_endpoint: \"https://dash.cloudflare.com/oauth2/revoke\",\n  token_endpoint: \"https://dash.cloudflare.com/oauth2/token\",\n};\n\nconst defaultScopes = [\"zone:read\", \"dns_records:edit\", \"offline_access\"];\nconst capabilities = [\"dns:read\", \"dns:write\"] as const;\n\n/** OAuth credentials pack both tokens into `secret`; token credentials are the token itself. */\nconst Secret = Schema.fromJsonString(\n  Schema.Struct({ accessToken: Schema.String, refreshToken: Schema.NullOr(Schema.String) }),\n);\n\nconst parseSecret = (secret: Redacted.Redacted<string>) => {\n  const raw = Redacted.value(secret);\n  const parsed = raw.startsWith(\"{\") ? Schema.decodeUnknownOption(Secret)(raw) : undefined;\n  return parsed !== undefined && parsed._tag === \"Some\"\n    ? parsed.value\n    : { accessToken: raw, refreshToken: null };\n};\n\nconst packSecret = (tokens: OAuth.Tokens) =>\n  Redacted.make(\n    Schema.encodeSync(Secret)({\n      accessToken: tokens.accessToken,\n      refreshToken: tokens.refreshToken,\n    }),\n  );\n\nexport const provider = (options: Options = {}): Provider.Definition<AccountContext> => {\n  const fetch = options.fetch ?? globalThis.fetch;\n  const baseUrl = (options.baseUrl ?? \"https://api.cloudflare.com/client/v4\").replace(/\\/$/, \"\");\n  const client = (token: string): Client.Options => ({ token, fetch, baseUrl });\n\n  const discoverAccount = (token: string) =>\n    Client.listZones(client(token)).pipe(\n      Effect.map((zones) => {\n        const accounts = new Set(zones.map((zone) => zone.account.id));\n        const [only] = accounts;\n        return accounts.size === 1 && only !== undefined ? only : null;\n      }),\n    );\n\n  const targetOf = (zone: Protocol.Zone): Provider.Target => ({\n    zone: zone.name,\n    context: { accountId: zone.account.id, zoneId: zone.id } satisfies AccountContext,\n    label: `${zone.name} (${zone.account.name})`,\n    nameservers: zone.name_servers ?? [],\n  });\n\n  const oauthClient = (oauth: NonNullable<Options[\"oauth\"]>) =>\n    Effect.gen(function* () {\n      const clientId = yield* resolve(oauth.clientId, \"oauth.clientId\");\n      const clientSecret = yield* resolve(oauth.clientSecret, \"oauth.clientSecret\");\n      return {\n        clientId,\n        clientSecret,\n        clientAuth: oauth.clientAuth ?? \"client_secret_basic\",\n      } satisfies OAuth.Client;\n    });\n\n  const issued = (\n    tokens: OAuth.Tokens,\n  ): Effect.Effect<Provider.IssuedCredential, Errors.DomainKitError> =>\n    discoverAccount(tokens.accessToken).pipe(\n      Effect.map((accountId) => ({\n        secret: packSecret(tokens),\n        context: { accountId } satisfies AccountContext,\n        expiresAt: tokens.expiresAt,\n      })),\n    );\n\n  const oauth = options.oauth === undefined ? undefined : oauthAuth(options.oauth);\n\n  function oauthAuth(settings: NonNullable<Options[\"oauth\"]>): Provider.OAuthAuth {\n    const scopes = settings.scopes ?? defaultScopes;\n    return {\n      label: \"Sign in with Cloudflare\",\n      scopes,\n      start: (input) =>\n        oauthClient(settings).pipe(\n          Effect.map(({ clientId }) => ({\n            authorizationUrl: OAuth.authorizationUrl({\n              server,\n              clientId,\n              scopes,\n              state: input.state,\n              callbackUrl: input.callbackUrl,\n              codeChallenge: input.codeChallenge,\n            }),\n          })),\n        ),\n      complete: (input) =>\n        oauthClient(settings).pipe(\n          Effect.flatMap((oauthClientValue) =>\n            OAuth.exchangeCode({\n              provider: Client.provider,\n              server,\n              client: oauthClientValue,\n              code: input.code,\n              state: input.params.state ?? \"\",\n              callbackUrl: input.callbackUrl,\n              codeVerifier: input.codeVerifier,\n              fetch,\n            }),\n          ),\n          Effect.flatMap(issued),\n        ),\n      refresh: (credential) =>\n        Effect.gen(function* () {\n          const { refreshToken } = parseSecret(credential.secret);\n          if (refreshToken === null) {\n            return yield* Errors.fail(\n              new Reason.Unauthenticated({\n                message: \"Cloudflare credential has no refresh token\",\n              }),\n            );\n          }\n          const tokens = yield* OAuth.refresh({\n            provider: Client.provider,\n            server,\n            client: yield* oauthClient(settings),\n            refreshToken,\n            fetch,\n          });\n          return {\n            secret: packSecret(tokens),\n            context: credential.context,\n            expiresAt: tokens.expiresAt,\n          };\n        }),\n      revoke: (credential) =>\n        Effect.gen(function* () {\n          const { accessToken } = parseSecret(credential.secret);\n          yield* OAuth.revoke({\n            provider: Client.provider,\n            server,\n            client: yield* oauthClient(settings),\n            token: accessToken,\n            fetch,\n          });\n        }),\n    };\n  }\n\n  return Provider.make<AccountContext>({\n    id: \"cloudflare\",\n    name: \"Cloudflare\",\n    context: AccountContext,\n    contextVersion: \"cloudflare.v1\",\n    auth: {\n      token: Provider.tokenAuth({\n        label: \"API token\",\n        docsUrl: \"https://developers.cloudflare.com/fundamentals/api/get-started/create-token/\",\n        requiredCapabilities: capabilities,\n        fields: TokenFields,\n        authenticate: ({ token, accountId }) =>\n          Effect.gen(function* () {\n            const raw = Redacted.value(token);\n            if (accountId !== undefined) {\n              const expiresAt = yield* Client.verifyToken(\n                client(raw),\n                `/accounts/${encodeURIComponent(accountId)}/tokens/verify`,\n              );\n              return {\n                secret: token,\n                context: { accountId, tokenKind: \"account\" } satisfies AccountContext,\n                expiresAt,\n              };\n            }\n            const discovered = yield* discoverAccount(raw);\n            const verified = yield* Client.tokenExpiry(client(raw), discovered);\n            return {\n              secret: token,\n              context: { accountId: discovered, tokenKind: verified.kind } satisfies AccountContext,\n              expiresAt: verified.expiresAt,\n            };\n          }),\n      }),\n      ...(oauth === undefined ? {} : { oauth }),\n    },\n    session: (credential) => {\n      const { accessToken } = parseSecret(credential.secret);\n      const clientOptions = client(accessToken);\n      const context = Schema.decodeUnknownOption(AccountContext)(credential.context);\n      const accountId =\n        context._tag === \"Some\" ? (context.value.accountId ?? undefined) : undefined;\n      const listTargets = () =>\n        Client.listZones(clientOptions, accountId).pipe(Effect.map((zones) => zones.map(targetOf)));\n      return {\n        capabilities: () => Effect.succeed(capabilities),\n        listTargets,\n        resolveTarget: (domain) =>\n          Effect.gen(function* () {\n            const name = yield* DomainName.decode(domain);\n            const targets = yield* listTargets();\n            return Provider.resolveAmong(name, targets);\n          }),\n        dns: (target) => {\n          const zone = Schema.decodeUnknownOption(AccountContext)(target.context);\n          const zoneId = zone._tag === \"Some\" ? zone.value.zoneId : undefined;\n          if (zoneId === undefined) {\n            const failure = Errors.fail(\n              new Reason.Unsupported({\n                provider: \"cloudflare\",\n                operation: \"dns\",\n                message: \"Cloudflare target has no zone id; only zone targets host records\",\n              }),\n            );\n            return {\n              list: () => failure,\n              create: () => failure,\n              get: () => failure,\n              delete: () => failure,\n            };\n          }\n          return Client.dns(clientOptions, zoneId);\n        },\n      };\n    },\n  });\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAiBA,MAAa,iBAAiB,OAAO,OAAO;CAC1C,WAAW,OAAO,OAAO,OAAO,MAAM;;CAEtC,WAAW,OAAO,YAAY,OAAO,SAAS,CAAC,QAAQ,SAAS,CAAC,CAAC;CAClE,QAAQ,OAAO,YAAY,OAAO,MAAM;AAC1C,CAAC;;AAGD,MAAa,cAAc,OAAO,OAAO;CACvC,OAAO,OAAO,kBAAkB,OAAO,MAAM;CAC7C,WAAW,OAAO,YAAY,OAAO,MAAM;AAC7C,CAAC;AAiBD,MAAa,SAAuB;CAClC,wBAAwB;CACxB,QAAQ;CACR,qBAAqB;CACrB,gBAAgB;AAClB;AAEA,MAAM,gBAAgB;CAAC;CAAa;CAAoB;AAAgB;AACxE,MAAM,eAAe,CAAC,YAAY,WAAW;;AAG7C,MAAM,SAAS,OAAO,eACpB,OAAO,OAAO;CAAE,aAAa,OAAO;CAAQ,cAAc,OAAO,OAAO,OAAO,MAAM;AAAE,CAAC,CAC1F;AAEA,MAAM,eAAe,WAAsC;CACzD,MAAM,MAAM,SAAS,MAAM,MAAM;CACjC,MAAM,SAAS,IAAI,WAAW,GAAG,IAAI,OAAO,oBAAoB,MAAM,CAAC,CAAC,GAAG,IAAI,KAAA;CAC/E,OAAO,WAAW,KAAA,KAAa,OAAO,SAAS,SAC3C,OAAO,QACP;EAAE,aAAa;EAAK,cAAc;CAAK;AAC7C;AAEA,MAAM,cAAc,WAClB,SAAS,KACP,OAAO,WAAW,MAAM,CAAC,CAAC;CACxB,aAAa,OAAO;CACpB,cAAc,OAAO;AACvB,CAAC,CACH;AAEF,MAAa,YAAY,UAAmB,CAAC,MAA2C;CACtF,MAAM,QAAQ,QAAQ,SAAS,WAAW;CAC1C,MAAM,WAAW,QAAQ,WAAW,uCAAA,CAAwC,QAAQ,OAAO,EAAE;CAC7F,MAAM,UAAU,WAAmC;EAAE;EAAO;EAAO;CAAQ;CAE3E,MAAM,mBAAmB,UACvBA,UAAiB,OAAO,KAAK,CAAC,CAAC,CAAC,KAC9B,OAAO,KAAK,UAAU;EACpB,MAAM,WAAW,IAAI,IAAI,MAAM,KAAK,SAAS,KAAK,QAAQ,EAAE,CAAC;EAC7D,MAAM,CAAC,QAAQ;EACf,OAAO,SAAS,SAAS,KAAK,SAAS,KAAA,IAAY,OAAO;CAC5D,CAAC,CACH;CAEF,MAAM,YAAY,UAA0C;EAC1D,MAAM,KAAK;EACX,SAAS;GAAE,WAAW,KAAK,QAAQ;GAAI,QAAQ,KAAK;EAAG;EACvD,OAAO,GAAG,KAAK,KAAK,IAAI,KAAK,QAAQ,KAAK;EAC1C,aAAa,KAAK,gBAAgB,CAAC;CACrC;CAEA,MAAM,eAAe,UACnB,OAAO,IAAI,aAAa;EAGtB,OAAO;GACL,UAAA,OAHsB,QAAQ,MAAM,UAAU,gBAAgB;GAI9D,cAAA,OAH0B,QAAQ,MAAM,cAAc,oBAAoB;GAI1E,YAAY,MAAM,cAAc;EAClC;CACF,CAAC;CAEH,MAAM,UACJ,WAEA,gBAAgB,OAAO,WAAW,CAAC,CAAC,KAClC,OAAO,KAAK,eAAe;EACzB,QAAQ,WAAW,MAAM;EACzB,SAAS,EAAE,UAAU;EACrB,WAAW,OAAO;CACpB,EAAE,CACJ;CAEF,MAAM,QAAQ,QAAQ,UAAU,KAAA,IAAY,KAAA,IAAY,UAAU,QAAQ,KAAK;CAE/E,SAAS,UAAU,UAA6D;EAC9E,MAAM,SAAS,SAAS,UAAU;EAClC,OAAO;GACL,OAAO;GACP;GACA,QAAQ,UACN,YAAY,QAAQ,CAAC,CAAC,KACpB,OAAO,KAAK,EAAE,gBAAgB,EAC5B,kBAAkBC,iBAAuB;IACvC;IACA;IACA;IACA,OAAO,MAAM;IACb,aAAa,MAAM;IACnB,eAAe,MAAM;GACvB,CAAC,EACH,EAAE,CACJ;GACF,WAAW,UACT,YAAY,QAAQ,CAAC,CAAC,KACpB,OAAO,SAAS,qBACdC,aAAmB;IACjB,UAAUC;IACV;IACA,QAAQ;IACR,MAAM,MAAM;IACZ,OAAO,MAAM,OAAO,SAAS;IAC7B,aAAa,MAAM;IACnB,cAAc,MAAM;IACpB;GACF,CAAC,CACH,GACA,OAAO,QAAQ,MAAM,CACvB;GACF,UAAU,eACR,OAAO,IAAI,aAAa;IACtB,MAAM,EAAE,iBAAiB,YAAY,WAAW,MAAM;IACtD,IAAI,iBAAiB,MACnB,OAAO,OAAOC,KACZ,IAAIC,gBAAuB,EACzB,SAAS,6CACX,CAAC,CACH;IAEF,MAAM,SAAS,OAAOC,QAAc;KAClC,UAAUH;KACV;KACA,QAAQ,OAAO,YAAY,QAAQ;KACnC;KACA;IACF,CAAC;IACD,OAAO;KACL,QAAQ,WAAW,MAAM;KACzB,SAAS,WAAW;KACpB,WAAW,OAAO;IACpB;GACF,CAAC;GACH,SAAS,eACP,OAAO,IAAI,aAAa;IACtB,MAAM,EAAE,gBAAgB,YAAY,WAAW,MAAM;IACrD,OAAOI,OAAa;KAClB,UAAUJ;KACV;KACA,QAAQ,OAAO,YAAY,QAAQ;KACnC,OAAO;KACP;IACF,CAAC;GACH,CAAC;EACL;CACF;CAEA,OAAOK,KAA8B;EACnC,IAAI;EACJ,MAAM;EACN,SAAS;EACT,gBAAgB;EAChB,MAAM;GACJ,OAAOC,UAAmB;IACxB,OAAO;IACP,SAAS;IACT,sBAAsB;IACtB,QAAQ;IACR,eAAe,EAAE,OAAO,gBACtB,OAAO,IAAI,aAAa;KACtB,MAAM,MAAM,SAAS,MAAM,KAAK;KAChC,IAAI,cAAc,KAAA,GAAW;MAC3B,MAAM,YAAY,OAAOC,YACvB,OAAO,GAAG,GACV,aAAa,mBAAmB,SAAS,EAAE,eAC7C;MACA,OAAO;OACL,QAAQ;OACR,SAAS;QAAE;QAAW,WAAW;OAAU;OAC3C;MACF;KACF;KACA,MAAM,aAAa,OAAO,gBAAgB,GAAG;KAC7C,MAAM,WAAW,OAAOC,YAAmB,OAAO,GAAG,GAAG,UAAU;KAClE,OAAO;MACL,QAAQ;MACR,SAAS;OAAE,WAAW;OAAY,WAAW,SAAS;MAAK;MAC3D,WAAW,SAAS;KACtB;IACF,CAAC;GACL,CAAC;GACD,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;EACzC;EACA,UAAU,eAAe;GACvB,MAAM,EAAE,gBAAgB,YAAY,WAAW,MAAM;GACrD,MAAM,gBAAgB,OAAO,WAAW;GACxC,MAAM,UAAU,OAAO,oBAAoB,cAAc,CAAC,CAAC,WAAW,OAAO;GAC7E,MAAM,YACJ,QAAQ,SAAS,SAAU,QAAQ,MAAM,aAAa,KAAA,IAAa,KAAA;GACrE,MAAM,oBACJX,UAAiB,eAAe,SAAS,CAAC,CAAC,KAAK,OAAO,KAAK,UAAU,MAAM,IAAI,QAAQ,CAAC,CAAC;GAC5F,OAAO;IACL,oBAAoB,OAAO,QAAQ,YAAY;IAC/C;IACA,gBAAgB,WACd,OAAO,IAAI,aAAa;KACtB,MAAM,OAAO,OAAOY,OAAkB,MAAM;KAC5C,MAAM,UAAU,OAAO,YAAY;KACnC,OAAOC,aAAsB,MAAM,OAAO;IAC5C,CAAC;IACH,MAAM,WAAW;KACf,MAAM,OAAO,OAAO,oBAAoB,cAAc,CAAC,CAAC,OAAO,OAAO;KACtE,MAAM,SAAS,KAAK,SAAS,SAAS,KAAK,MAAM,SAAS,KAAA;KAC1D,IAAI,WAAW,KAAA,GAAW;MACxB,MAAM,UAAUT,KACd,IAAIU,YAAmB;OACrB,UAAU;OACV,WAAW;OACX,SAAS;MACX,CAAC,CACH;MACA,OAAO;OACL,YAAY;OACZ,cAAc;OACd,WAAW;OACX,cAAc;MAChB;KACF;KACA,OAAOC,IAAW,eAAe,MAAM;IACzC;GACF;EACF;CACF,CAAC;AACH"}