@alchemy.run/acme 0.0.0 → 2.0.0-beta.85

package/lib/DnsSolver.d.ts

@@ -0,0 +1,60 @@
+/**
+ * DNS-01 solvers: how the ACME flow publishes `_acme-challenge` TXT
+ * records.
+ *
+ * A solver has two forms:
+ *
+ * - a **descriptor** — plain, serializable data in a resource's props
+ *   (`{ type: "Cloudflare.DNS", zoneId }`) that survives state and the RPC
+ *   boundary. Each DNS solver has a constructor
+ *   (`Cloudflare.ACME.ZoneSolver(zone)`) and a layer registering the
+ *   matching implementation, so the ACME provider never imports a DNS SDK
+ *   itself.
+ * - a **runtime solver** — the {@link DnsSolver} interface a running
+ *   Worker or Service hands to `IssueCertificate.issue`, built from a
+ *   runtime DNS write client (`Cloudflare.ACME.zoneSolver(dns)`).
+ */
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import type * as HttpClient from "effect/http/HttpClient";
+import * as Layer from "effect/Layer";
+import type { PropagationOptions } from "./Dns.ts";
+import { DnsSolverNotRegistered, type DnsPropagationTimeout, type DnsSolverError } from "./Errors.ts";
+/** A challenge record to publish: the `_acme-challenge.<name>` FQDN and its TXT value. */
+export interface DnsChallengeRecord {
+    readonly fqdn: string;
+    readonly value: string;
+}
+/** Runtime DNS-01 solver. `R` is whatever context the underlying client needs. */
+export interface DnsSolver<R = never> {
+    /** Publish `value` as a TXT record at `fqdn`. Idempotent. */
+    readonly present: (record: DnsChallengeRecord) => Effect.Effect<void, DnsSolverError, R>;
+    /** Remove the record published by `present`. Idempotent; runs in a finalizer. */
+    readonly cleanup: (record: DnsChallengeRecord) => Effect.Effect<void, DnsSolverError, R>;
+    /**
+     * Wait until the record is visible. Defaults to polling public DNS over
+     * HTTPS; a solver for a private DNS (tests, split-horizon zones) overrides it.
+     */
+    readonly propagated?: ((record: DnsChallengeRecord, options: PropagationOptions) => Effect.Effect<void, DnsSolverError | DnsPropagationTimeout, R | HttpClient.HttpClient>) | undefined;
+}
+/**
+ * Serializable solver description stored in `ACME.Certificate` props.
+ * `type` selects the registered implementation; the rest is provider data.
+ */
+export interface DnsSolverDescriptor {
+    readonly type: string;
+    readonly [key: string]: unknown;
+}
+/** Builds a runtime solver from a descriptor at reconcile time. */
+export type DnsSolverFactory = (descriptor: DnsSolverDescriptor) => Effect.Effect<DnsSolver, DnsSolverError>;
+/** Resolve the registered implementation for a descriptor. */
+export declare const resolveDnsSolver: (descriptor: DnsSolverDescriptor) => Effect.Effect<DnsSolver, DnsSolverNotRegistered | DnsSolverError>;
+/** A solver whose methods run with `context` provided (drops `R`). */
+export declare const provideSolver: <R>(solver: DnsSolver<R>, context: Context.Context<R>) => DnsSolver;
+/**
+ * Register a solver implementation from a `providers()` layer, capturing
+ * whatever services `R` the solver needs from that layer's own context so
+ * the ACME provider can run it without knowing about the DNS provider.
+ */
+export declare const dnsSolverLayer: <R>(type: string, make: (descriptor: DnsSolverDescriptor) => Effect.Effect<DnsSolver<R>, DnsSolverError>) => Layer.Layer<DnsSolverFactory, never, R>;
+//# sourceMappingURL=DnsSolver.d.ts.map

package/lib/DnsSolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DnsSolver.d.ts","sourceRoot":"","sources":["../src/DnsSolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,EACL,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACpB,MAAM,aAAa,CAAC;AAErB,0FAA0F;AAC1F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,kFAAkF;AAClF,MAAM,WAAW,SAAS,CAAC,CAAC,GAAG,KAAK;IAClC,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;IACzF,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;IACzF;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAChB,CAAC,CACC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,EAAE,kBAAkB,KACxB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,GAAG,qBAAqB,EAAE,CAAC,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,GAC5F,SAAS,CAAC;CACf;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACjC;AAED,mEAAmE;AACnE,MAAM,MAAM,gBAAgB,GAAG,CAC7B,UAAU,EAAE,mBAAmB,KAC5B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;AAK9C,8DAA8D;AAC9D,eAAO,MAAM,gBAAgB,eACf,mBAAmB,KAC9B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,sBAAsB,GAAG,cAAc,CAO/D,CAAC;AAEL,sEAAsE;AACtE,eAAO,MAAM,aAAa,GAAI,CAAC,UAAU,SAAS,CAAC,CAAC,CAAC,WAAW,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAG,SAQnF,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,cAAc,GAAI,CAAC,QACxB,MAAM,QACN,CAAC,UAAU,EAAE,mBAAmB,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,KACrF,KAAK,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAQtC,CAAC"}

package/lib/DnsSolver.js

@@ -0,0 +1,48 @@
+/**
+ * DNS-01 solvers: how the ACME flow publishes `_acme-challenge` TXT
+ * records.
+ *
+ * A solver has two forms:
+ *
+ * - a **descriptor** — plain, serializable data in a resource's props
+ *   (`{ type: "Cloudflare.DNS", zoneId }`) that survives state and the RPC
+ *   boundary. Each DNS solver has a constructor
+ *   (`Cloudflare.ACME.ZoneSolver(zone)`) and a layer registering the
+ *   matching implementation, so the ACME provider never imports a DNS SDK
+ *   itself.
+ * - a **runtime solver** — the {@link DnsSolver} interface a running
+ *   Worker or Service hands to `IssueCertificate.issue`, built from a
+ *   runtime DNS write client (`Cloudflare.ACME.zoneSolver(dns)`).
+ */
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import { DnsSolverNotRegistered, } from "./Errors.js";
+const solverService = (type) => Context.Service(`alchemy/ACME/DnsSolver/${type}`);
+/** Resolve the registered implementation for a descriptor. */
+export const resolveDnsSolver = (descriptor) => Effect.gen(function* () {
+    const factory = yield* Effect.serviceOption(solverService(descriptor.type));
+    if (Option.isNone(factory)) {
+        return yield* new DnsSolverNotRegistered({ type: descriptor.type });
+    }
+    return yield* factory.value(descriptor);
+});
+/** A solver whose methods run with `context` provided (drops `R`). */
+export const provideSolver = (solver, context) => ({
+    present: (record) => solver.present(record).pipe(Effect.provideContext(context)),
+    cleanup: (record) => solver.cleanup(record).pipe(Effect.provideContext(context)),
+    propagated: solver.propagated === undefined
+        ? undefined
+        : (record, options) => solver.propagated(record, options).pipe(Effect.provideContext(context)),
+});
+/**
+ * Register a solver implementation from a `providers()` layer, capturing
+ * whatever services `R` the solver needs from that layer's own context so
+ * the ACME provider can run it without knowing about the DNS provider.
+ */
+export const dnsSolverLayer = (type, make) => Layer.effect(solverService(type), Effect.gen(function* () {
+    const context = yield* Effect.context();
+    return (descriptor) => make(descriptor).pipe(Effect.map((solver) => provideSolver(solver, context)));
+}));
+//# sourceMappingURL=DnsSolver.js.map

package/lib/DnsSolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DnsSolver.js","sourceRoot":"","sources":["../src/DnsSolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EACL,sBAAsB,GAGvB,MAAM,aAAa,CAAC;AAwCrB,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,EAAE,CACrC,OAAO,CAAC,OAAO,CAAmB,0BAA0B,IAAI,EAAE,CAAC,CAAC;AAEtE,8DAA8D;AAC9D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,UAA+B,EACoC,EAAE,CACrE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC,CAAC,IAAI,sBAAsB,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC;AAEL,sEAAsE;AACtE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAI,MAAoB,EAAE,OAA2B,EAAa,EAAE,CAAC,CAAC;IACjG,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IAChF,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IAChF,UAAU,EACR,MAAM,CAAC,UAAU,KAAK,SAAS;QAC7B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAClB,MAAM,CAAC,UAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;CACjF,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,IAAY,EACZ,IAAsF,EAC7C,EAAE,CAC3C,KAAK,CAAC,MAAM,CACV,aAAa,CAAC,IAAI,CAAC,EACnB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAK,CAAC;IAC3C,OAAO,CAAC,UAA+B,EAAE,EAAE,CACzC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC,CAAC,CACH,CAAC"}

package/lib/Errors.d.ts

@@ -0,0 +1,93 @@
+/** A problem the CA attached to an order or one of its identifiers. */
+export interface IdentifierProblem {
+    /** The identifier the problem concerns, when the CA said. */
+    readonly identifier?: string | undefined;
+    /** The `urn:ietf:params:acme:error:*` type. */
+    readonly type?: string | undefined;
+    /** Human-readable detail from the CA. */
+    readonly detail?: string | undefined;
+}
+declare const OrderInvalid_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ACME.OrderInvalid";
+} & Readonly<A>;
+/**
+ * The CA moved the order to `invalid`. Carries the problem documents the
+ * order and its authorizations reported, one per failed identifier where
+ * the CA said which.
+ */
+export declare class OrderInvalid extends OrderInvalid_base<{
+    readonly orderUrl: string;
+    readonly problems: ReadonlyArray<IdentifierProblem>;
+}> {
+    get message(): string;
+}
+declare const ChallengeFailed_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ACME.ChallengeFailed";
+} & Readonly<A>;
+/** The CA rejected the DNS-01 challenge for one identifier. */
+export declare class ChallengeFailed extends ChallengeFailed_base<{
+    readonly identifier: string;
+    readonly type?: string | undefined;
+    readonly detail?: string | undefined;
+}> {
+    get message(): string;
+}
+declare const ChallengeUnsupported_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ACME.ChallengeUnsupported";
+} & Readonly<A>;
+/** The CA offered no `dns-01` challenge for an identifier. */
+export declare class ChallengeUnsupported extends ChallengeUnsupported_base<{
+    readonly identifier: string;
+    readonly offered: ReadonlyArray<string>;
+}> {
+    get message(): string;
+}
+declare const OrderTimeout_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ACME.OrderTimeout";
+} & Readonly<A>;
+/** The order never reached a terminal state within the polling budget. */
+export declare class OrderTimeout extends OrderTimeout_base<{
+    readonly orderUrl: string;
+    readonly status: string;
+}> {
+    get message(): string;
+}
+declare const DnsPropagationTimeout_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ACME.DnsPropagationTimeout";
+} & Readonly<A>;
+/** The `_acme-challenge` TXT record never became visible to public resolvers. */
+export declare class DnsPropagationTimeout extends DnsPropagationTimeout_base<{
+    readonly fqdn: string;
+    readonly value: string;
+}> {
+    get message(): string;
+}
+declare const DnsSolverError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ACME.DnsSolverError";
+} & Readonly<A>;
+/** A DNS solver could not publish or remove a challenge record. */
+export declare class DnsSolverError extends DnsSolverError_base<{
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+declare const DnsSolverNotRegistered_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ACME.DnsSolverNotRegistered";
+} & Readonly<A>;
+/** A solver descriptor names a `type` no registered DNS provider handles. */
+export declare class DnsSolverNotRegistered extends DnsSolverNotRegistered_base<{
+    readonly type: string;
+}> {
+    get message(): string;
+}
+declare const PkiError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ACME.PkiError";
+} & Readonly<A>;
+/** Key generation, CSR encoding or certificate parsing failed. */
+export declare class PkiError extends PkiError_base<{
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export {};
+//# sourceMappingURL=Errors.d.ts.map

package/lib/Errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Errors.d.ts","sourceRoot":"","sources":["../src/Errors.ts"],"names":[],"mappings":"AAEA,uEAAuE;AACvE,MAAM,WAAW,iBAAiB;IAChC,6DAA6D;IAC7D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,yCAAyC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;;;;AAED;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,kBAAsC;IACtE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;CACrD,CAAC;IACA,IAAa,OAAO,WAKnB;CACF;;;;AAED,+DAA+D;AAC/D,qBAAa,eAAgB,SAAQ,qBAAyC;IAC5E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC,CAAC;IACA,IAAa,OAAO,WAEnB;CACF;;;;AAED,8DAA8D;AAC9D,qBAAa,oBAAqB,SAAQ,0BAA8C;IACtF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACzC,CAAC;IACA,IAAa,OAAO,WAEnB;CACF;;;;AAED,0EAA0E;AAC1E,qBAAa,YAAa,SAAQ,kBAAsC;IACtE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;IACA,IAAa,OAAO,WAEnB;CACF;;;;AAED,iFAAiF;AACjF,qBAAa,qBAAsB,SAAQ,2BAA+C;IACxF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;IACA,IAAa,OAAO,WAEnB;CACF;;;;AAED,mEAAmE;AACnE,qBAAa,cAAe,SAAQ,oBAAwC;IAC1E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;;;;AAEL,6EAA6E;AAC7E,qBAAa,sBAAuB,SAAQ,4BAAgD;IAC1F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;IACA,IAAa,OAAO,WAEnB;CACF;;;;AAED,kEAAkE;AAClE,qBAAa,QAAS,SAAQ,cAAkC;IAC9D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG"}

package/lib/Errors.js

@@ -0,0 +1,51 @@
+import * as Data from "effect/Data";
+/**
+ * The CA moved the order to `invalid`. Carries the problem documents the
+ * order and its authorizations reported, one per failed identifier where
+ * the CA said which.
+ */
+export class OrderInvalid extends Data.TaggedError("ACME.OrderInvalid") {
+    get message() {
+        const details = this.problems
+            .map((p) => [p.identifier, p.type, p.detail].filter(Boolean).join(": "))
+            .join("; ");
+        return `ACME order ${this.orderUrl} is invalid${details ? `: ${details}` : ""}`;
+    }
+}
+/** The CA rejected the DNS-01 challenge for one identifier. */
+export class ChallengeFailed extends Data.TaggedError("ACME.ChallengeFailed") {
+    get message() {
+        return `DNS-01 challenge for ${this.identifier} failed${this.detail ? `: ${this.detail}` : ""}`;
+    }
+}
+/** The CA offered no `dns-01` challenge for an identifier. */
+export class ChallengeUnsupported extends Data.TaggedError("ACME.ChallengeUnsupported") {
+    get message() {
+        return `The CA offered no dns-01 challenge for ${this.identifier} (offered: ${this.offered.join(", ") || "none"})`;
+    }
+}
+/** The order never reached a terminal state within the polling budget. */
+export class OrderTimeout extends Data.TaggedError("ACME.OrderTimeout") {
+    get message() {
+        return `ACME order ${this.orderUrl} is still "${this.status}" after the polling budget`;
+    }
+}
+/** The `_acme-challenge` TXT record never became visible to public resolvers. */
+export class DnsPropagationTimeout extends Data.TaggedError("ACME.DnsPropagationTimeout") {
+    get message() {
+        return `TXT ${this.fqdn} did not propagate within the wait budget`;
+    }
+}
+/** A DNS solver could not publish or remove a challenge record. */
+export class DnsSolverError extends Data.TaggedError("ACME.DnsSolverError") {
+}
+/** A solver descriptor names a `type` no registered DNS provider handles. */
+export class DnsSolverNotRegistered extends Data.TaggedError("ACME.DnsSolverNotRegistered") {
+    get message() {
+        return `No DNS-01 solver is registered for "${this.type}". Include ACME.providers() in the stack.`;
+    }
+}
+/** Key generation, CSR encoding or certificate parsing failed. */
+export class PkiError extends Data.TaggedError("ACME.PkiError") {
+}
+//# sourceMappingURL=Errors.js.map

package/lib/Errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Errors.js","sourceRoot":"","sources":["../src/Errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AAYpC;;;;GAIG;AACH,MAAM,OAAO,YAAa,SAAQ,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAGpE;IACA,IAAa,OAAO;QAClB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ;aAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aACvE,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,cAAc,IAAI,CAAC,QAAQ,cAAc,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAClF,CAAC;CACF;AAED,+DAA+D;AAC/D,MAAM,OAAO,eAAgB,SAAQ,IAAI,CAAC,WAAW,CAAC,sBAAsB,CAI1E;IACA,IAAa,OAAO;QAClB,OAAO,wBAAwB,IAAI,CAAC,UAAU,UAAU,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAClG,CAAC;CACF;AAED,8DAA8D;AAC9D,MAAM,OAAO,oBAAqB,SAAQ,IAAI,CAAC,WAAW,CAAC,2BAA2B,CAGpF;IACA,IAAa,OAAO;QAClB,OAAO,0CAA0C,IAAI,CAAC,UAAU,cAAc,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG,CAAC;IACrH,CAAC;CACF;AAED,0EAA0E;AAC1E,MAAM,OAAO,YAAa,SAAQ,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAGpE;IACA,IAAa,OAAO;QAClB,OAAO,cAAc,IAAI,CAAC,QAAQ,cAAc,IAAI,CAAC,MAAM,4BAA4B,CAAC;IAC1F,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,OAAO,qBAAsB,SAAQ,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAGtF;IACA,IAAa,OAAO;QAClB,OAAO,OAAO,IAAI,CAAC,IAAI,2CAA2C,CAAC;IACrE,CAAC;CACF;AAED,mEAAmE;AACnE,MAAM,OAAO,cAAe,SAAQ,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAGxE;CAAG;AAEL,6EAA6E;AAC7E,MAAM,OAAO,sBAAuB,SAAQ,IAAI,CAAC,WAAW,CAAC,6BAA6B,CAExF;IACA,IAAa,OAAO;QAClB,OAAO,uCAAuC,IAAI,CAAC,IAAI,2CAA2C,CAAC;IACrG,CAAC;CACF;AAED,kEAAkE;AAClE,MAAM,OAAO,QAAS,SAAQ,IAAI,CAAC,WAAW,CAAC,eAAe,CAG5D;CAAG"}

package/lib/IssueCertificate.d.ts

@@ -0,0 +1,76 @@
+import * as Binding from "alchemy/Binding";
+import type { RuntimeContext } from "alchemy/RuntimeContext";
+import type * as Effect from "effect/Effect";
+import type { Account } from "./Account.ts";
+import type { IssueError, IssueRequest, IssuedCertificate, RevokeError, RevokeRequest } from "./Client.ts";
+/**
+ * Issue (and revoke) certificates at runtime as an {@link Account} — for
+ * services that terminate TLS themselves and need certificates on demand,
+ * like a relay minting `*.<tenant>.example.com` when a tenant first
+ * connects.
+ *
+ * Init transports the account's directory URL, account URL and redacted
+ * private key through resource Outputs. Protect the runtime and state store
+ * as secret material. The caller chooses where to store the issued PEMs.
+ *
+ * ### Issue on demand
+ * Publish the DNS-01 record through any runtime DNS write client wrapped
+ * as a solver (`Cloudflare.ACME.zoneSolver(dns)`).
+ *
+ * **Example:** Mint a wildcard from a Fly Service and upload it to its App
+ * ```typescript
+ * export default class Relay extends Fly.Service<Relay>()(
+ *   "Relay",
+ *   { app: RelayApp, main: import.meta.url },
+ *   Effect.gen(function* () {
+ *     const acme = yield* ACME.IssueCertificate(ZeroSsl);
+ *     const dns = yield* Cloudflare.DNS.WriteDns(Zone);
+ *     const certs = yield* Fly.WriteCertificates(RelayApp);
+ *     return {
+ *       fetch: Effect.gen(function* () {
+ *         const issued = yield* acme.issue({
+ *           identifiers: ["*.tenant.example.com"],
+ *           solver: Cloudflare.ACME.zoneSolver(dns),
+ *         });
+ *         yield* certs.upload({
+ *           hostname: "*.tenant.example.com",
+ *           fullchain: issued.chain,
+ *           privateKey: issued.privateKey,
+ *         });
+ *         return HttpServerResponse.text("ok");
+ *       }),
+ *     };
+ *   }).pipe(
+ *     Effect.provide(ACME.IssueCertificateHttp),
+ *     Effect.provide(Cloudflare.DNS.WriteDnsHttp),
+ *     Effect.provide(Fly.WriteCertificatesHttp),
+ *   ),
+ * ) {}
+ * ```
+ *
+ * ### Rate limits
+ * The SDK retry policy applies to individual requests. Apply
+ * `Acme.Retry.none` from `@distilled.cloud/acme` to surface failures
+ * immediately; `AcmeRateLimited.retryAfter` carries the CA's retry hint.
+ *
+ * ### Which CA from a Cloudflare Worker
+ * CA reachability depends on the host's egress. Let's Encrypt has returned
+ * TLS failures from deployed Cloudflare Workers in live testing; the
+ * deployed-Worker example uses ZeroSSL instead. Verify the selected CA
+ * from the runtime where issuance will run.
+ *
+ * @binding
+ * @product Certificate
+ * @category Certificates
+ */
+export interface IssueCertificate extends Binding.Service<IssueCertificate, "ACME.IssueCertificate", (account: Account) => Effect.Effect<IssueCertificateClient>> {
+}
+export declare const IssueCertificate: IssueCertificate;
+/** Runtime issuance client bound to one account. */
+export interface IssueCertificateClient {
+    /** Order, solve DNS-01, finalize and download a certificate. */
+    issue<R = never>(request: IssueRequest<R>): Effect.Effect<IssuedCertificate, IssueError, RuntimeContext | R>;
+    /** Revoke a certificate (`AcmeAlreadyRevoked` counts as success). */
+    revoke(request: RevokeRequest): Effect.Effect<void, RevokeError, RuntimeContext>;
+}
+//# sourceMappingURL=IssueCertificate.d.ts.map

package/lib/IssueCertificate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IssueCertificate.d.ts","sourceRoot":"","sources":["../src/IssueCertificate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AAC3C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EACV,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,WAAW,EACX,aAAa,EACd,MAAM,aAAa,CAAC;AAErB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,MAAM,WAAW,gBAAiB,SAAQ,OAAO,CAAC,OAAO,CACvD,gBAAgB,EAChB,uBAAuB,EACvB,CAAC,OAAO,EAAE,OAAO,KAAK,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAC5D;CAAG;AAEJ,eAAO,MAAM,gBAAgB,kBAA6D,CAAC;AAE3F,oDAAoD;AACpD,MAAM,WAAW,sBAAsB;IACrC,gEAAgE;IAChE,KAAK,CAAC,CAAC,GAAG,KAAK,EACb,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,GACvB,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,UAAU,EAAE,cAAc,GAAG,CAAC,CAAC,CAAC;IACpE,qEAAqE;IACrE,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;CAClF"}

package/lib/IssueCertificate.js

@@ -0,0 +1,3 @@
+import * as Binding from "alchemy/Binding";
+export const IssueCertificate = Binding.Service("ACME.IssueCertificate");
+//# sourceMappingURL=IssueCertificate.js.map

package/lib/IssueCertificate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IssueCertificate.js","sourceRoot":"","sources":["../src/IssueCertificate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AA8E3C,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAmB,uBAAuB,CAAC,CAAC"}

package/lib/IssueCertificateHttp.d.ts

@@ -0,0 +1,24 @@
+import * as Layer from "effect/Layer";
+import { IssueCertificate } from "./IssueCertificate.ts";
+/**
+ * Implementation of {@link IssueCertificate}: the account's directory
+ * URL, account URL and private key are bound into the host at deploy time
+ * and read back at runtime; every call signs with them over HTTPS.
+ *
+ * Provide it on the Worker / Service / Action Effect.
+ *
+ * ### Provide the layer
+ * **Example:** On a Fly Service
+ * ```typescript
+ * Effect.gen(function* () {
+ *   const acme = yield* ACME.IssueCertificate(LetsEncrypt);
+ *   // ...
+ * }).pipe(Effect.provide(ACME.IssueCertificateHttp))
+ * ```
+ *
+ * @layer
+ * @product Certificate
+ * @provides ACME.IssueCertificate
+ */
+export declare const IssueCertificateHttp: Layer.Layer<IssueCertificate, never, never>;
+//# sourceMappingURL=IssueCertificateHttp.d.ts.map

package/lib/IssueCertificateHttp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IssueCertificateHttp.d.ts","sourceRoot":"","sources":["../src/IssueCertificateHttp.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAQtC,OAAO,EAAE,gBAAgB,EAA+B,MAAM,uBAAuB,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,oBAAoB,6CAkChC,CAAC"}

package/lib/IssueCertificateHttp.js

@@ -0,0 +1,56 @@
+import * as Output from "alchemy/Output";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { accountLayer, issueCertificate, revokeCertificate, } from "./Client.js";
+import { IssueCertificate } from "./IssueCertificate.js";
+/**
+ * Implementation of {@link IssueCertificate}: the account's directory
+ * URL, account URL and private key are bound into the host at deploy time
+ * and read back at runtime; every call signs with them over HTTPS.
+ *
+ * Provide it on the Worker / Service / Action Effect.
+ *
+ * ### Provide the layer
+ * **Example:** On a Fly Service
+ * ```typescript
+ * Effect.gen(function* () {
+ *   const acme = yield* ACME.IssueCertificate(LetsEncrypt);
+ *   // ...
+ * }).pipe(Effect.provide(ACME.IssueCertificateHttp))
+ * ```
+ *
+ * @layer
+ * @product Certificate
+ * @provides ACME.IssueCertificate
+ */
+export const IssueCertificateHttp = Layer.succeed(IssueCertificate, Effect.fn(function* (account) {
+    const directoryUrl = yield* account.directoryUrl;
+    const accountUrl = yield* account.accountUrl;
+    const trustedRoot = yield* account.trustedRoot.pipe(Output.map((root) => root ?? ""));
+    const privateKey = yield* account.privateKey;
+    const credentials = Effect.all({
+        directoryUrl,
+        trustedRoot,
+        accountUrl,
+        privateKey,
+    }).pipe(Effect.map((bound) => ({
+        ca: {
+            directoryUrl: bound.directoryUrl,
+            trustedRoot: bound.trustedRoot || undefined,
+        },
+        accountKey: bound.privateKey,
+        accountUrl: bound.accountUrl,
+    })));
+    const client = {
+        issue: Effect.fn("ACME.IssueCertificate.issue")(function* (request) {
+            const creds = yield* credentials;
+            return yield* issueCertificate(request).pipe(Effect.provide(accountLayer(creds)));
+        }),
+        revoke: Effect.fn("ACME.IssueCertificate.revoke")(function* (request) {
+            const creds = yield* credentials;
+            return yield* revokeCertificate(request).pipe(Effect.provide(accountLayer(creds)));
+        }),
+    };
+    return client;
+}));
+//# sourceMappingURL=IssueCertificateHttp.js.map

package/lib/IssueCertificateHttp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IssueCertificateHttp.js","sourceRoot":"","sources":["../src/IssueCertificateHttp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,GAElB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAA+B,MAAM,uBAAuB,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC,OAAO,CAC/C,gBAAgB,EAChB,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAgB;IACnC,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IACjD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAC7C,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IACtF,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAC7C,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC;QAC7B,YAAY;QACZ,WAAW;QACX,UAAU;QACV,UAAU;KACX,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAsB,EAAE,CAAC,CAAC;QACzC,EAAE,EAAE;YACF,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,SAAS;SAC5C;QACD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC,CACJ,CAAC;IACF,MAAM,MAAM,GAA2B;QACrC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAO;YAChE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;YACjC,OAAO,KAAK,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpF,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,8BAA8B,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAO;YAClE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;YACjC,OAAO,KAAK,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrF,CAAC,CAAC;KACH,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC,CACH,CAAC"}

package/lib/Pki.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Keys, PKCS#10 certificate requests and X.509 parsing for the ACME flow.
+ * WebCrypto plus the tiny DER codec in `Der.ts` — no native code, so the
+ * same code runs at deploy time and inside a Worker or Fly Service.
+ */
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { PkiError } from "./Errors.ts";
+export type KeyAlgorithm = "ES256" | "RS256";
+/** The DER bytes of the first (or `index`-th) PEM block in `pem`. */
+export declare const fromPem: (pem: string, index?: number) => Uint8Array;
+/** Every PEM block in a chain, leaf first. */
+export declare const splitPemChain: (pem: string) => string[];
+export interface GeneratedKey {
+    readonly algorithm: KeyAlgorithm;
+    /** PKCS#8 PEM. */
+    readonly privateKeyPem: Redacted.Redacted<string>;
+    readonly privateKey: CryptoKey;
+    /** SubjectPublicKeyInfo DER. */
+    readonly spki: Uint8Array;
+}
+/** Generate a certificate key pair (ES256 P-256 by default). */
+export declare const generateKey: (algorithm?: KeyAlgorithm) => Effect.Effect<GeneratedKey, PkiError>;
+/** Import a PKCS#8 PEM private key (ES256 or RS256, detected from the DER). */
+export declare const importPrivateKey: (pem: Redacted.Redacted<string> | string) => Effect.Effect<{
+    readonly key: CryptoKey;
+    readonly algorithm: KeyAlgorithm;
+}, PkiError>;
+/** The private JWK of a PKCS#8 PEM key (for revocation signed by the certificate key). */
+export declare const privateKeyToJwk: (pem: Redacted.Redacted<string> | string) => Effect.Effect<Redacted.Redacted<string>, PkiError>;
+/**
+ * A PKCS#10 certificate request for `identifiers` signed by `key`: the
+ * first identifier is the subject CN, all of them are `subjectAltName`
+ * dNSName entries. Returned as DER.
+ */
+export declare const createCsr: (options: {
+    readonly key: GeneratedKey;
+    readonly identifiers: ReadonlyArray<string>;
+}) => Effect.Effect<Uint8Array, PkiError>;
+/** base64url of a DER CSR, as ACME's `finalize` expects. */
+export declare const csrToBase64Url: (der: Uint8Array) => string;
+export interface ParsedCertificate {
+    /** Serial number as lowercase hex. */
+    readonly serial: string;
+    readonly notBefore: Date;
+    readonly notAfter: Date;
+    /** Issuer distinguished name, `CN` first (`CN=R11, O=Let's Encrypt`). */
+    readonly issuer: string;
+    /** Subject distinguished name in the same form. */
+    readonly subject: string;
+    /** `subjectAltName` dNSName entries. */
+    readonly dnsNames: ReadonlyArray<string>;
+}
+/** Parse the first certificate of a PEM (or a DER buffer). */
+export declare const parseCertificate: (input: string | Uint8Array) => Effect.Effect<ParsedCertificate, PkiError>;
+//# sourceMappingURL=Pki.d.ts.map

package/lib/Pki.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Pki.d.ts","sourceRoot":"","sources":["../src/Pki.ts"],"names":[],"mappings":"AACA;;;;GAIG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,CAAC;AAmC7C,qEAAqE;AACrE,eAAO,MAAM,OAAO,QAAS,MAAM,qBAAc,UAchD,CAAC;AAEF,8CAA8C;AAC9C,eAAO,MAAM,aAAa,QAAS,MAAM,KAAG,MAAM,EACoB,CAAC;AAQvE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,kBAAkB;IAClB,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClD,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,gCAAgC;IAChC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;CAC3B;AAED,gEAAgE;AAChE,eAAO,MAAM,WAAW,eACX,YAAY,KACtB,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAWnC,CAAC;AAUL,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,QACtB,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,KACtC,MAAM,CAAC,MAAM,CAAC;IAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAA;CAAE,EAAE,QAAQ,CAapF,CAAC;AAEL,0FAA0F;AAC1F,eAAO,MAAM,eAAe,QACrB,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,KACtC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAOjD,CAAC;AAQJ;;;;GAIG;AACH,eAAO,MAAM,SAAS,YAAa;IACjC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC7C,KAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAmClC,CAAC;AAEL,4DAA4D;AAC5D,eAAO,MAAM,cAAc,QAAS,UAAU,KAAG,MAA6B,CAAC;AAM/E,MAAM,WAAW,iBAAiB;IAChC,sCAAsC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,wCAAwC;IACxC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC1C;AAyBD,8DAA8D;AAC9D,eAAO,MAAM,gBAAgB,UACpB,MAAM,GAAG,UAAU,KACzB,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,QAAQ,CAyCxC,CAAC"}