domainkit 0.1.0 → 0.1.1

package/README.md

@@ -58,10 +58,25 @@ The Promise namespaces delegate to the canonical Effect programs rather than mai
 planning, authorization, or verification implementation. Hosts supply providers and stores
 explicitly; DomainKit does not own a hidden runtime.
 
-The Cloudflare adapter accepts a host-owned API or OAuth token and an explicitly selected account.
-The host also declares the capabilities required when that credential was issued; Cloudflare's
-non-mutating token-verification endpoint cannot infer DNS write permission. The adapter creates
-DNS-only records and leaves credential storage and user interaction to the host:
+The Cloudflare authorization helpers can discover the account selected by an OAuth grant or API
+token from a domain the host already owns. They walk from the requested name to its registrable
+domain, require exactly one accessible authoritative zone, and return its Cloudflare account ID.
+Hosts therefore do not need to ask users to find or paste an account ID. The host still declares
+the capabilities required when the credential was issued because Cloudflare's non-mutating token
+verification endpoint cannot infer DNS write permission:
+
+```ts
+import { Cloudflare, DomainName } from "domainkit";
+
+const resolveSubject = Cloudflare.Auth.subjectResolver({
+  capabilities: ["dns:read", "dns:write"],
+  domain: DomainName.parse("mail.customer.example.com"),
+});
+```
+
+Once authorized, the DNS client remains explicitly account-scoped. The host supplies the discovered
+account ID with its stored credential. The adapter creates DNS-only records and leaves credential
+storage and user interaction to the host:
 
 ```ts
 import { Cloudflare, Provisioning, Secret } from "domainkit";
@@ -77,7 +92,8 @@ const plan = await Provisioning.create({ provider, requirements, zone: "example.
 
 OAuth helpers own Cloudflare's endpoints and client-auth variants while accepting the scope IDs
 assigned during OAuth client registration. `Cloudflare.Auth.tokenMethod` describes the equivalent
-API-token capability.
+API-token capability. Explicit `accountId` authorization remains available for hosts that already
+have a trusted account selection.
 
 The Vercel adapter accepts either explicit personal or team context. It supports personal access
 tokens and Vercel's integration-code exchange without treating that provider-specific installation

package/dist/{auth-Vi-hhXbV.mjs → auth-B0owkrpk.mjs}

@@ -1,6 +1,20 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { T as decode$2, c as Opaque, h as decode$3, y as Error } from "./dns-record-C_KwGPLf.mjs";
+import { D as parse, O as Error, T as decode$2, c as Opaque, h as decode$3, y as Error$1 } from "./dns-record-C_KwGPLf.mjs";
 import { Clock, Effect, Schema } from "effect";
+import { getDomain } from "tldts";
+//#region src/discovery/zones.ts
+var zones_exports = /* @__PURE__ */ __exportAll({ candidates: () => candidates });
+function candidates(input) {
+	const domain = parse(input);
+	const registrable = getDomain(domain, { allowPrivateDomains: true });
+	if (registrable === null) throw new Error({ message: "Domain does not have a registrable DNS zone" });
+	const labels = domain.split(".");
+	const registrableLabels = registrable.split(".").length;
+	const values = [];
+	for (let index = 0; index <= labels.length - registrableLabels; index += 1) values.push(parse(labels.slice(index).join(".")));
+	return values;
+}
+//#endregion
 //#region src/providers/cloudflare/protocol.ts
 const ErrorDetail = Schema.Struct({
 	code: Schema.Number,
@@ -204,7 +218,7 @@ function encode(record) {
 }
 const decodeData = Effect.fn("CloudflareRecords.decodeData")((record) => Schema.decodeUnknownEffect(Data)(record.data).pipe(Effect.mapError((cause) => failure$1("decodeRecord", cause.message))));
 function failure$1(operation, message, fields = {}) {
-	return new Error({
+	return new Error$1({
 		message,
 		operation,
 		providerId: "cloudflare",
@@ -213,9 +227,12 @@ function failure$1(operation, message, fields = {}) {
 }
 //#endregion
 //#region src/providers/cloudflare/client.ts
-var client_exports = /* @__PURE__ */ __exportAll({ make: () => make });
-/** Creates an Effect-native Cloudflare client without owning the credential lifecycle. */
-function make(options) {
+var client_exports = /* @__PURE__ */ __exportAll({
+	discoverAuthorizationAccount: () => discoverAuthorizationAccount,
+	make: () => make,
+	validateDomainToken: () => validateDomainToken
+});
+const makeTransport = (options) => {
 	const fetch = options.fetch ?? globalThis.fetch;
 	const baseUrl = (options.baseUrl ?? "https://api.cloudflare.com/client/v4").replace(/\/$/, "");
 	const request = Effect.fn("CloudflareClient.request")((path, operation, init) => Effect.gen(function* () {
@@ -258,17 +275,62 @@ function make(options) {
 		yield* ensureSuccess(body, "listZones", response);
 		return yield* decode(ZoneListEnvelope, body, "listZones", response);
 	}));
-	const allZones = Effect.fn("CloudflareClient.allZones")((accountId, name) => Effect.gen(function* () {
-		const zones = [];
-		let page = 1;
-		while (true) {
-			const envelope = yield* listZonesPage(accountId, name, page);
-			zones.push(...envelope.result);
-			const totalPages = envelope.result_info?.total_pages;
-			if (totalPages !== void 0 && page >= totalPages || totalPages === void 0 && envelope.result.length < 50) return zones;
-			page += 1;
-		}
-	}));
+	return {
+		allZones: Effect.fn("CloudflareClient.allZones")((accountId, name) => Effect.gen(function* () {
+			const zones = [];
+			let page = 1;
+			while (true) {
+				const envelope = yield* listZonesPage(accountId, name, page);
+				zones.push(...envelope.result);
+				const totalPages = envelope.result_info?.total_pages;
+				if (totalPages !== void 0 && page >= totalPages || totalPages === void 0 && envelope.result.length < 50) return zones;
+				page += 1;
+			}
+		})),
+		inspectToken: Effect.fn("CloudflareClient.inspectToken")((path) => Effect.gen(function* () {
+			const { body, response } = yield* request(path, "validateToken");
+			yield* ensureSuccess(body, "validateToken", response);
+			const envelope = yield* decode(TokenEnvelope, body, "validateToken", response);
+			if (envelope.result.status !== "active") return yield* Effect.fail(failure("validateToken", `Cloudflare token is ${envelope.result.status}`, {
+				reason: "authentication",
+				status: response.status
+			}));
+			const expiresAt = envelope.result.expires_on === void 0 ? null : new Date(envelope.result.expires_on);
+			if (expiresAt !== null && Number.isNaN(expiresAt.valueOf())) return yield* Effect.fail(failure("validateToken", "Cloudflare token expiry is not a valid timestamp", {
+				reason: "response",
+				status: response.status
+			}));
+			return expiresAt;
+		})),
+		request
+	};
+};
+const discoverAccount = Effect.fn("CloudflareClient.discoverAccount")((options) => Effect.gen(function* () {
+	const { allZones } = makeTransport(options);
+	for (const candidate of candidates(options.domain)) {
+		const matches = yield* allZones(void 0, candidate);
+		const match = matches[0];
+		if (matches.length === 0) continue;
+		if (matches.length === 1 && match !== void 0) return match.account;
+		return yield* Effect.fail(failure("discoverAccount", `Cloudflare returned multiple accessible zones named ${candidate}`, { reason: "conflict" }));
+	}
+	return yield* Effect.fail(failure("discoverAccount", `Cloudflare did not expose an accessible zone for ${options.domain}`, { reason: "not_found" }));
+}));
+const discoverAuthorizationAccount = discoverAccount;
+const validateDomainToken = Effect.fn("CloudflareClient.validateDomainToken")((options) => Effect.gen(function* () {
+	const transport = makeTransport(options);
+	const account = options.tokenKind === "account" ? yield* discoverAccount(options) : void 0;
+	const expiresAt = yield* transport.inspectToken(account === void 0 ? "/user/tokens/verify" : `/accounts/${encodeURIComponent(account.id)}/tokens/verify`);
+	return {
+		accountId: (account ?? (yield* discoverAccount(options))).id,
+		capabilities: options.capabilities,
+		expiresAt,
+		scopes: []
+	};
+}));
+/** Creates an Effect-native Cloudflare client without owning the credential lifecycle. */
+function make(options) {
+	const { allZones, inspectToken, request } = makeTransport(options);
 	const resolveZone = Effect.fn("CloudflareClient.resolveZone")((name) => Effect.gen(function* () {
 		const matches = yield* allZones(options.accountId, name);
 		const match = matches[0];
@@ -328,19 +390,8 @@ function make(options) {
 		listZones: Effect.fn("CloudflareClient.listZones")((input = {}) => allZones(input.accountId ?? options.accountId, input.name).pipe(Effect.flatMap((zones) => Effect.forEach(zones, projectZone)))),
 		validateToken: Effect.fn("CloudflareClient.validateToken")(() => Effect.gen(function* () {
 			const path = options.tokenKind === "account" ? `/accounts/${encodeURIComponent(options.accountId)}/tokens/verify` : "/user/tokens/verify";
-			const { body, response } = yield* request(path, "validateToken");
-			yield* ensureSuccess(body, "validateToken", response);
-			const envelope = yield* decode(TokenEnvelope, body, "validateToken", response);
-			if (envelope.result.status !== "active") return yield* Effect.fail(failure("validateToken", `Cloudflare token is ${envelope.result.status}`, {
-				reason: "authentication",
-				status: response.status
-			}));
+			const expiresAt = yield* inspectToken(path);
 			yield* allZones(options.accountId);
-			const expiresAt = envelope.result.expires_on === void 0 ? null : new Date(envelope.result.expires_on);
-			if (expiresAt !== null && Number.isNaN(expiresAt.valueOf())) return yield* Effect.fail(failure("validateToken", "Cloudflare token expiry is not a valid timestamp", {
-				reason: "response",
-				status: response.status
-			}));
 			return {
 				accountId: options.accountId,
 				capabilities: options.capabilities,
@@ -400,7 +451,7 @@ function retryAfter(value) {
 	return Number.isNaN(date) ? void 0 : Math.max(0, date - Date.now());
 }
 function failure(operation, message, fields = {}) {
-	return new Error({
+	return new Error$1({
 		...fields,
 		message,
 		operation,
@@ -450,26 +501,46 @@ function manifest(options) {
 /** Resolves the Cloudflare account selected by a completed OAuth grant. */
 function subjectResolver(options) {
 	return (tokens, accessToken) => Effect.gen(function* () {
-		yield* make({
-			...options,
+		const accountId = options.accountId ?? (yield* discoverAuthorizationAccount({
+			...options.baseUrl === void 0 ? {} : { baseUrl: options.baseUrl },
+			domain: options.domain,
+			...options.fetch === void 0 ? {} : { fetch: options.fetch },
+			token: accessToken
+		}).pipe(Effect.map((account) => account.id)));
+		if (options.accountId !== void 0) yield* make({
+			accountId: options.accountId,
+			...options.baseUrl === void 0 ? {} : { baseUrl: options.baseUrl },
+			capabilities: options.capabilities,
+			...options.fetch === void 0 ? {} : { fetch: options.fetch },
 			token: accessToken,
 			tokenKind: "user"
 		}).listZones();
 		const now = yield* Clock.currentTimeMillis;
 		return {
-			accountId: options.accountId,
+			accountId,
 			expiresAt: typeof tokens.expires_in === "number" ? new Date(now + tokens.expires_in * 1e3) : null
 		};
 	});
 }
 /** Creates a host callback that validates a Cloudflare API token. */
 function tokenValidator(options) {
-	return (token) => make({
-		...options,
-		token
+	return (token) => options.accountId === void 0 ? validateDomainToken({
+		...options.baseUrl === void 0 ? {} : { baseUrl: options.baseUrl },
+		capabilities: options.capabilities,
+		domain: options.domain,
+		...options.fetch === void 0 ? {} : { fetch: options.fetch },
+		token,
+		...options.tokenKind === void 0 ? {} : { tokenKind: options.tokenKind }
+	}) : make({
+		accountId: options.accountId,
+		...options.baseUrl === void 0 ? {} : { baseUrl: options.baseUrl },
+		capabilities: options.capabilities,
+		...options.fetch === void 0 ? {} : { fetch: options.fetch },
+		token,
+		...options.tokenKind === void 0 ? {} : { tokenKind: options.tokenKind }
 	}).validateToken();
 }
 //#endregion
-export { tokenMethod as a, subjectResolver as i, manifest as n, client_exports as o, oauthMethod as r, make as s, auth_exports as t };
+export { tokenMethod as a, make as c, subjectResolver as i, candidates as l, manifest as n, tokenValidator as o, oauthMethod as r, client_exports as s, auth_exports as t, zones_exports as u };
 
-//# sourceMappingURL=auth-Vi-hhXbV.mjs.map
+//# sourceMappingURL=auth-B0owkrpk.mjs.map

package/dist/auth-B0owkrpk.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-B0owkrpk.mjs","names":["DomainName.parse","InvalidInputError","S","S","decode","DomainName.decode","failure","DnsRecord.decode","DnsRecord.Opaque","DnsProvider.Error","Protocol.ZoneListEnvelope","Protocol.TokenEnvelope","Zones.candidates","Protocol.RecordListEnvelope","Records.decode","Records.encode","Protocol.RecordEnvelope","DomainName.decode","S","Protocol.BaseEnvelope","DnsProvider.Error","Client.discoverAuthorizationAccount","Client.make","Client.validateDomainToken"],"sources":["../src/discovery/zones.ts","../src/providers/cloudflare/protocol.ts","../src/providers/cloudflare/records.ts","../src/providers/cloudflare/client.ts","../src/providers/cloudflare/auth.ts"],"sourcesContent":["import { getDomain } from \"tldts\";\n\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\n\nexport function candidates(input: string): ReadonlyArray<DomainName.DomainName> {\n  const domain = DomainName.parse(input);\n  const registrable = getDomain(domain, { allowPrivateDomains: true });\n  if (registrable === null) {\n    throw new InvalidInputError({ message: \"Domain does not have a registrable DNS zone\" });\n  }\n  const labels = domain.split(\".\");\n  const registrableLabels = registrable.split(\".\").length;\n  const values: Array<DomainName.DomainName> = [];\n  for (let index = 0; index <= labels.length - registrableLabels; index += 1) {\n    values.push(DomainName.parse(labels.slice(index).join(\".\")));\n  }\n  return values;\n}\n","import { Schema as S } from \"effect\";\n\nexport const ErrorDetail = S.Struct({\n  code: S.Number,\n  message: S.String,\n});\nexport interface ErrorDetail extends S.Schema.Type<typeof ErrorDetail> {}\n\nexport const ResultInfo = S.Struct({\n  count: S.optionalKey(S.Number),\n  page: S.optionalKey(S.Number),\n  per_page: S.optionalKey(S.Number),\n  total_count: S.optionalKey(S.Number),\n  total_pages: S.optionalKey(S.Number),\n});\n\nconst Message = S.Struct({\n  code: S.optionalKey(S.Number),\n  message: S.String,\n});\n\nexport const BaseEnvelope = S.Struct({\n  errors: S.Array(ErrorDetail),\n  messages: S.Array(Message),\n  success: S.Boolean,\n});\n\nexport const Account = S.Struct({\n  id: S.String,\n  name: S.String,\n});\nexport interface Account extends S.Schema.Type<typeof Account> {}\n\nexport const Zone = S.Struct({\n  account: Account,\n  id: S.String,\n  name: S.String,\n  name_servers: S.Array(S.String),\n  status: S.optionalKey(S.String),\n});\nexport interface Zone extends S.Schema.Type<typeof Zone> {}\n\nexport const Record = S.Struct({\n  content: S.optionalKey(S.String),\n  data: S.optionalKey(S.Unknown),\n  id: S.String,\n  name: S.String,\n  priority: S.optionalKey(S.Number),\n  proxied: S.optionalKey(S.Boolean),\n  ttl: S.Number,\n  type: S.String,\n});\nexport interface Record extends S.Schema.Type<typeof Record> {}\n\nexport const Token = S.Struct({\n  expires_on: S.optionalKey(S.String),\n  id: S.String,\n  not_before: S.optionalKey(S.String),\n  status: S.Literals([\"active\", \"disabled\", \"expired\"]),\n});\nexport interface Token extends S.Schema.Type<typeof Token> {}\n\nexport const ZoneListEnvelope = S.Struct({\n  errors: S.Array(ErrorDetail),\n  messages: S.Array(Message),\n  result: S.Array(Zone),\n  result_info: S.optionalKey(ResultInfo),\n  success: S.Boolean,\n});\nexport const RecordListEnvelope = S.Struct({\n  errors: S.Array(ErrorDetail),\n  messages: S.Array(Message),\n  result: S.Array(Record),\n  result_info: S.optionalKey(ResultInfo),\n  success: S.Boolean,\n});\nexport const RecordEnvelope = S.Struct({\n  errors: S.Array(ErrorDetail),\n  messages: S.Array(Message),\n  result: Record,\n  success: S.Boolean,\n});\nexport const TokenEnvelope = S.Struct({\n  errors: S.Array(ErrorDetail),\n  messages: S.Array(Message),\n  result: Token,\n  success: S.Boolean,\n});\n","import { Effect, Schema as S } from \"effect\";\n\nimport * as DomainName from \"../../domain/domain-name.ts\";\nimport * as DnsRecord from \"../../domain/dns-record.ts\";\nimport * as DnsProvider from \"../../provider/provider.ts\";\nimport type * as Protocol from \"./protocol.ts\";\n\nconst Data = S.Struct({\n  flags: S.optionalKey(S.Number),\n  port: S.optionalKey(S.Number),\n  priority: S.optionalKey(S.Number),\n  tag: S.optionalKey(S.String),\n  target: S.optionalKey(S.String),\n  value: S.optionalKey(S.String),\n  weight: S.optionalKey(S.Number),\n});\n\nexport type CreateBody = Readonly<Record<string, unknown>>;\n\nexport const decode = Effect.fn(\"CloudflareRecords.decode\")((record: Protocol.Record) =>\n  Effect.gen(function* () {\n    const name = yield* DomainName.decode(record.name).pipe(\n      Effect.match({ onFailure: () => null, onSuccess: (value) => value }),\n    );\n    if (name === null) return yield* decodeOpaque(record);\n    const common = {\n      metadata: {\n        ownership: \"provider\",\n        provenance: record.proxied === true ? \"cloudflare:proxied\" : \"cloudflare\",\n        purpose: \"existing DNS record\",\n      },\n      name,\n      policy: record.type === \"CNAME\" ? \"exclusive\" : \"append\",\n      ttl: record.ttl === 1 ? null : record.ttl,\n    } as const;\n    const content = () =>\n      record.content === undefined\n        ? Effect.fail(failure(\"decodeRecord\", `Cloudflare ${record.type} record has no content`))\n        : Effect.succeed(record.content);\n\n    switch (record.type) {\n      case \"A\":\n      case \"AAAA\":\n        return yield* DnsRecord.decode({\n          ...common,\n          _tag: record.type,\n          address: yield* content(),\n        }).pipe(Effect.mapError((cause) => failure(\"decodeRecord\", cause.message)));\n      case \"CNAME\":\n      case \"NS\":\n        return yield* DnsRecord.decode({\n          ...common,\n          _tag: record.type,\n          target: yield* content(),\n        }).pipe(Effect.mapError((cause) => failure(\"decodeRecord\", cause.message)));\n      case \"TXT\":\n        return yield* DnsRecord.decode({\n          ...common,\n          _tag: \"TXT\",\n          value: yield* content(),\n        }).pipe(Effect.mapError((cause) => failure(\"decodeRecord\", cause.message)));\n      case \"MX\":\n        return yield* DnsRecord.decode({\n          ...common,\n          _tag: \"MX\",\n          exchange: yield* content(),\n          priority: record.priority,\n        }).pipe(Effect.mapError((cause) => failure(\"decodeRecord\", cause.message)));\n      case \"CAA\": {\n        const data = yield* decodeData(record);\n        return yield* DnsRecord.decode({ ...common, _tag: \"CAA\", ...data }).pipe(\n          Effect.mapError((cause) => failure(\"decodeRecord\", cause.message)),\n        );\n      }\n      case \"SRV\": {\n        const data = yield* decodeData(record);\n        return yield* DnsRecord.decode({ ...common, _tag: \"SRV\", ...data }).pipe(\n          Effect.mapError((cause) => failure(\"decodeRecord\", cause.message)),\n        );\n      }\n      default:\n        return yield* decodeOpaque(record);\n    }\n  }),\n);\n\nconst decodeOpaque = Effect.fn(\"CloudflareRecords.decodeOpaque\")((record: Protocol.Record) =>\n  S.decodeUnknownEffect(DnsRecord.Opaque)({\n    _tag: \"Opaque\",\n    name: record.name,\n    providerRecordId: record.id,\n    providerType: record.type,\n  }).pipe(Effect.mapError((cause) => failure(\"decodeRecord\", cause.message))),\n);\n\nexport function encode(record: DnsRecord.DnsRecord): CreateBody {\n  const common = {\n    name: record.name,\n    proxied: false,\n    ttl: record.ttl ?? 1,\n    type: record._tag,\n  };\n  switch (record._tag) {\n    case \"A\":\n    case \"AAAA\":\n      return { ...common, content: record.address };\n    case \"CNAME\":\n    case \"NS\":\n      return { ...common, content: record.target };\n    case \"TXT\":\n      return { ...common, content: record.value };\n    case \"MX\":\n      return { ...common, content: record.exchange, priority: record.priority };\n    case \"CAA\":\n      return {\n        ...common,\n        data: { flags: record.flags, tag: record.tag, value: record.value },\n      };\n    case \"SRV\":\n      return {\n        ...common,\n        data: {\n          port: record.port,\n          priority: record.priority,\n          target: record.target,\n          weight: record.weight,\n        },\n      };\n  }\n}\n\nconst decodeData = Effect.fn(\"CloudflareRecords.decodeData\")((record: Protocol.Record) =>\n  S.decodeUnknownEffect(Data)(record.data).pipe(\n    Effect.mapError((cause) => failure(\"decodeRecord\", cause.message)),\n  ),\n);\n\nfunction failure(\n  operation: string,\n  message: string,\n  fields: Partial<Pick<DnsProvider.Error, \"reason\">> = {},\n): DnsProvider.Error {\n  return new DnsProvider.Error({\n    message,\n    operation,\n    providerId: \"cloudflare\",\n    reason: fields.reason ?? \"response\",\n  });\n}\n","import { Effect, Schema as S } from \"effect\";\n\nimport type * as ProviderAuth from \"../../auth/manifest.ts\";\nimport type * as Secret from \"../../auth/secret.ts\";\nimport * as DomainName from \"../../domain/domain-name.ts\";\nimport type * as DnsRecord from \"../../domain/dns-record.ts\";\nimport * as Zones from \"../../discovery/zones.ts\";\nimport * as DnsProvider from \"../../provider/provider.ts\";\nimport * as Protocol from \"./protocol.ts\";\nimport * as Records from \"./records.ts\";\n\nexport type Fetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;\n\n/** Configuration for an Effect-native Cloudflare authoritative-DNS client. */\nexport interface Options {\n  readonly accountId: string;\n  readonly baseUrl?: string;\n  /** Capabilities the host required when issuing or authorizing this credential. */\n  readonly capabilities: ProviderAuth.TokenValidation[\"capabilities\"];\n  readonly fetch?: Fetch;\n  readonly token: Secret.Value;\n  readonly tokenKind?: \"account\" | \"user\";\n}\n\nexport interface ListZonesInput {\n  readonly accountId?: string;\n  readonly name?: DomainName.DomainName;\n}\n\nexport type Account = Protocol.Account;\n\n/** A portable Cloudflare authoritative zone with normalized nameserver evidence. */\nexport interface Zone {\n  readonly accountId: string;\n  readonly id: string;\n  readonly name: DomainName.DomainName;\n  readonly nameservers: ReadonlyArray<DomainName.DomainName>;\n  readonly status: string | null;\n}\n\nexport interface Interface extends DnsProvider.Interface {\n  readonly listAccounts: () => Effect.Effect<ReadonlyArray<Account>, DnsProvider.Error>;\n  readonly listZones: (\n    input?: ListZonesInput,\n  ) => Effect.Effect<ReadonlyArray<Zone>, DnsProvider.Error>;\n  readonly validateToken: () => Effect.Effect<ProviderAuth.TokenValidation, DnsProvider.Error>;\n}\n\ninterface CredentialOptions {\n  readonly baseUrl?: string;\n  readonly fetch?: Fetch;\n  readonly token: Secret.Value;\n}\n\ninterface DomainCredentialOptions extends CredentialOptions {\n  readonly capabilities: ProviderAuth.TokenValidation[\"capabilities\"];\n  readonly domain: DomainName.DomainName;\n  readonly tokenKind?: \"account\" | \"user\";\n}\n\nconst makeTransport = (options: CredentialOptions) => {\n  const fetch = options.fetch ?? globalThis.fetch;\n  const baseUrl = (options.baseUrl ?? \"https://api.cloudflare.com/client/v4\").replace(/\\/$/, \"\");\n\n  const request = Effect.fn(\"CloudflareClient.request\")(\n    (path: string, operation: string, init?: RequestInit) =>\n      Effect.gen(function* () {\n        const response = yield* Effect.tryPromise({\n          try: () =>\n            fetch(`${baseUrl}${path}`, {\n              ...init,\n              headers: {\n                Accept: \"application/json\",\n                Authorization: `Bearer ${options.token.expose()}`,\n                ...(init?.body === undefined ? {} : { \"Content-Type\": \"application/json\" }),\n                ...init?.headers,\n              },\n            }),\n          catch: () =>\n            failure(operation, \"Cloudflare request failed\", {\n              reason: \"transport\",\n            }),\n        });\n        const body = yield* Effect.tryPromise({\n          try: () => response.json() as Promise<unknown>,\n          catch: () => {\n            const retryAfterMs = retryAfter(response.headers.get(\"retry-after\"));\n            return failure(\n              operation,\n              response.ok\n                ? \"Cloudflare returned a non-JSON response\"\n                : `Cloudflare request failed with HTTP ${response.status}`,\n              {\n                reason: response.ok ? \"response\" : reason(response.status),\n                ...(retryAfterMs === undefined ? {} : { retryAfterMs }),\n                status: response.status,\n              },\n            );\n          },\n        });\n        return { body, response } as const;\n      }),\n  );\n\n  const listZonesPage = Effect.fn(\"CloudflareClient.listZonesPage\")(\n    (accountId: string | undefined, name: DomainName.DomainName | undefined, page: number) =>\n      Effect.gen(function* () {\n        const query = new URLSearchParams({ page: String(page), per_page: \"50\" });\n        query.set(\"type\", \"full,partial,secondary,internal\");\n        if (accountId !== undefined) query.set(\"account.id\", accountId);\n        if (name !== undefined) query.set(\"name\", name);\n        const { body, response } = yield* request(`/zones?${query}`, \"listZones\");\n        yield* ensureSuccess(body, \"listZones\", response);\n        return yield* decode(Protocol.ZoneListEnvelope, body, \"listZones\", response);\n      }),\n  );\n\n  const allZones = Effect.fn(\"CloudflareClient.allZones\")(\n    (accountId?: string, name?: DomainName.DomainName) =>\n      Effect.gen(function* () {\n        const zones: Array<Protocol.Zone> = [];\n        let page = 1;\n        while (true) {\n          const envelope = yield* listZonesPage(accountId, name, page);\n          zones.push(...envelope.result);\n          const totalPages = envelope.result_info?.total_pages;\n          if (\n            (totalPages !== undefined && page >= totalPages) ||\n            (totalPages === undefined && envelope.result.length < 50)\n          ) {\n            return zones;\n          }\n          page += 1;\n        }\n      }),\n  );\n\n  const inspectToken = Effect.fn(\"CloudflareClient.inspectToken\")((path: string) =>\n    Effect.gen(function* () {\n      const { body, response } = yield* request(path, \"validateToken\");\n      yield* ensureSuccess(body, \"validateToken\", response);\n      const envelope = yield* decode(Protocol.TokenEnvelope, body, \"validateToken\", response);\n      if (envelope.result.status !== \"active\") {\n        return yield* Effect.fail(\n          failure(\"validateToken\", `Cloudflare token is ${envelope.result.status}`, {\n            reason: \"authentication\",\n            status: response.status,\n          }),\n        );\n      }\n      const expiresAt =\n        envelope.result.expires_on === undefined ? null : new Date(envelope.result.expires_on);\n      if (expiresAt !== null && Number.isNaN(expiresAt.valueOf())) {\n        return yield* Effect.fail(\n          failure(\"validateToken\", \"Cloudflare token expiry is not a valid timestamp\", {\n            reason: \"response\",\n            status: response.status,\n          }),\n        );\n      }\n      return expiresAt;\n    }),\n  );\n\n  return { allZones, inspectToken, request } as const;\n};\n\nconst discoverAccount = Effect.fn(\"CloudflareClient.discoverAccount\")(\n  (options: CredentialOptions & { readonly domain: DomainName.DomainName }) =>\n    Effect.gen(function* () {\n      const { allZones } = makeTransport(options);\n      for (const candidate of Zones.candidates(options.domain)) {\n        const matches = yield* allZones(undefined, candidate);\n        const match = matches[0];\n        if (matches.length === 0) continue;\n        if (matches.length === 1 && match !== undefined) return match.account;\n        return yield* Effect.fail(\n          failure(\n            \"discoverAccount\",\n            `Cloudflare returned multiple accessible zones named ${candidate}`,\n            { reason: \"conflict\" },\n          ),\n        );\n      }\n      return yield* Effect.fail(\n        failure(\n          \"discoverAccount\",\n          `Cloudflare did not expose an accessible zone for ${options.domain}`,\n          { reason: \"not_found\" },\n        ),\n      );\n    }),\n);\n\nexport const discoverAuthorizationAccount = discoverAccount;\n\nexport const validateDomainToken = Effect.fn(\"CloudflareClient.validateDomainToken\")(\n  (options: DomainCredentialOptions) =>\n    Effect.gen(function* () {\n      const transport = makeTransport(options);\n      const account = options.tokenKind === \"account\" ? yield* discoverAccount(options) : undefined;\n      const expiresAt = yield* transport.inspectToken(\n        account === undefined\n          ? \"/user/tokens/verify\"\n          : `/accounts/${encodeURIComponent(account.id)}/tokens/verify`,\n      );\n      const discoveredAccount = account ?? (yield* discoverAccount(options));\n      return {\n        accountId: discoveredAccount.id,\n        capabilities: options.capabilities,\n        expiresAt,\n        scopes: [],\n      } satisfies ProviderAuth.TokenValidation;\n    }),\n);\n\n/** Creates an Effect-native Cloudflare client without owning the credential lifecycle. */\nexport function make(options: Options): Interface {\n  const { allZones, inspectToken, request } = makeTransport(options);\n\n  const resolveZone = Effect.fn(\"CloudflareClient.resolveZone\")((name: DomainName.DomainName) =>\n    Effect.gen(function* () {\n      const matches = yield* allZones(options.accountId, name);\n      const match = matches[0];\n      if (matches.length === 1 && match !== undefined) return match;\n      return yield* Effect.fail(\n        failure(\n          \"resolveZone\",\n          matches.length === 0\n            ? `Cloudflare zone ${name} was not found in account ${options.accountId}`\n            : `Cloudflare returned multiple zones named ${name} in account ${options.accountId}`,\n          { reason: matches.length === 0 ? \"not_found\" : \"response\" },\n        ),\n      );\n    }),\n  );\n\n  const listRecords = Effect.fn(\"CloudflareClient.listRecords\")((zoneName: DomainName.DomainName) =>\n    Effect.gen(function* () {\n      const zone = yield* resolveZone(zoneName);\n      const records: Array<DnsRecord.Observed> = [];\n      let page = 1;\n      while (true) {\n        const query = new URLSearchParams({ page: String(page), per_page: \"100\" });\n        const { body, response } = yield* request(\n          `/zones/${encodeURIComponent(zone.id)}/dns_records?${query}`,\n          \"listRecords\",\n        );\n        yield* ensureSuccess(body, \"listRecords\", response);\n        const envelope = yield* decode(Protocol.RecordListEnvelope, body, \"listRecords\", response);\n        records.push(...(yield* Effect.forEach(envelope.result, Records.decode)));\n        const totalPages = envelope.result_info?.total_pages;\n        if (\n          (totalPages !== undefined && page >= totalPages) ||\n          (totalPages === undefined && envelope.result.length < 100)\n        ) {\n          return records;\n        }\n        page += 1;\n      }\n    }),\n  );\n\n  const createRecord = Effect.fn(\"CloudflareClient.createRecord\")(\n    (zoneName: DomainName.DomainName, record: DnsRecord.DnsRecord) =>\n      Effect.gen(function* () {\n        const zone = yield* resolveZone(zoneName);\n        const { body, response } = yield* request(\n          `/zones/${encodeURIComponent(zone.id)}/dns_records`,\n          \"createRecord\",\n          { body: JSON.stringify(Records.encode(record)), method: \"POST\" },\n        );\n        yield* ensureSuccess(body, \"createRecord\", response);\n        const envelope = yield* decode(Protocol.RecordEnvelope, body, \"createRecord\", response);\n        return { providerRecordId: envelope.result.id };\n      }),\n  );\n\n  const getRecord = Effect.fn(\"CloudflareClient.getRecord\")(\n    (zoneName: DomainName.DomainName, providerRecordId: string) =>\n      Effect.gen(function* () {\n        const zone = yield* resolveZone(zoneName);\n        const { body, response } = yield* request(\n          `/zones/${encodeURIComponent(zone.id)}/dns_records/${encodeURIComponent(providerRecordId)}`,\n          \"getRecord\",\n        );\n        if (response.status === 404) return null;\n        yield* ensureSuccess(body, \"getRecord\", response);\n        const envelope = yield* decode(Protocol.RecordEnvelope, body, \"getRecord\", response);\n        return yield* Records.decode(envelope.result);\n      }),\n  );\n\n  const deleteRecord = Effect.fn(\"CloudflareClient.deleteRecord\")(\n    (zoneName: DomainName.DomainName, providerRecordId: string) =>\n      Effect.gen(function* () {\n        const zone = yield* resolveZone(zoneName);\n        const { body, response } = yield* request(\n          `/zones/${encodeURIComponent(zone.id)}/dns_records/${encodeURIComponent(providerRecordId)}`,\n          \"deleteRecord\",\n          { method: \"DELETE\" },\n        );\n        yield* ensureSuccess(body, \"deleteRecord\", response);\n      }),\n  );\n\n  const listAccounts = Effect.fn(\"CloudflareClient.listAccounts\")(() =>\n    allZones().pipe(\n      Effect.map((zones) => {\n        const accounts = new Map<string, Protocol.Account>();\n        for (const zone of zones) accounts.set(zone.account.id, zone.account);\n        return [...accounts.values()].sort((left, right) => left.name.localeCompare(right.name));\n      }),\n    ),\n  );\n\n  const listZones = Effect.fn(\"CloudflareClient.listZones\")((input: ListZonesInput = {}) =>\n    allZones(input.accountId ?? options.accountId, input.name).pipe(\n      Effect.flatMap((zones) => Effect.forEach(zones, projectZone)),\n    ),\n  );\n\n  const validateToken = Effect.fn(\"CloudflareClient.validateToken\")(() =>\n    Effect.gen(function* () {\n      const path =\n        options.tokenKind === \"account\"\n          ? `/accounts/${encodeURIComponent(options.accountId)}/tokens/verify`\n          : \"/user/tokens/verify\";\n      const expiresAt = yield* inspectToken(path);\n      yield* allZones(options.accountId);\n      return {\n        accountId: options.accountId,\n        capabilities: options.capabilities,\n        expiresAt,\n        scopes: [],\n      };\n    }),\n  );\n\n  return {\n    id: \"cloudflare\",\n    createRecord,\n    deleteRecord,\n    getRecord,\n    listAccounts,\n    listRecords,\n    listZones,\n    validateToken,\n  };\n}\n\nconst projectZone = Effect.fn(\"CloudflareClient.projectZone\")((zone: Protocol.Zone) =>\n  Effect.gen(function* () {\n    const name = yield* DomainName.decode(zone.name).pipe(\n      Effect.mapError((cause) => failure(\"listZones\", cause.message, { reason: \"response\" })),\n    );\n    const nameservers = yield* Effect.forEach(zone.name_servers, (nameserver) =>\n      DomainName.decode(nameserver).pipe(\n        Effect.mapError((cause) => failure(\"listZones\", cause.message, { reason: \"response\" })),\n      ),\n    );\n    return {\n      accountId: zone.account.id,\n      id: zone.id,\n      name,\n      nameservers,\n      status: zone.status ?? null,\n    };\n  }),\n);\n\nfunction decode<A>(\n  schema: S.ConstraintCodec<A, unknown, never, unknown>,\n  input: unknown,\n  operation: string,\n  response: Response,\n): Effect.Effect<A, DnsProvider.Error> {\n  return S.decodeUnknownEffect(schema)(input).pipe(\n    Effect.mapError((cause) =>\n      failure(operation, `Cloudflare response did not match its API contract: ${cause.message}`, {\n        reason: \"response\",\n        status: response.status,\n      }),\n    ),\n  );\n}\n\nfunction ensureSuccess(\n  input: unknown,\n  operation: string,\n  response: Response,\n): Effect.Effect<void, DnsProvider.Error> {\n  return S.decodeUnknownEffect(Protocol.BaseEnvelope)(input).pipe(\n    Effect.mapError(() =>\n      failure(operation, \"Cloudflare response did not contain a valid API envelope\", {\n        reason: \"response\",\n        status: response.status,\n      }),\n    ),\n    Effect.flatMap((envelope) => {\n      if (response.ok && envelope.success) return Effect.void;\n      const detail = envelope.errors[0];\n      const retryAfterMs = retryAfter(response.headers.get(\"retry-after\"));\n      return Effect.fail(\n        failure(\n          operation,\n          detail?.message ?? `Cloudflare request failed with HTTP ${response.status}`,\n          {\n            ...(detail === undefined ? {} : { code: detail.code }),\n            reason: reason(response.status, detail?.code),\n            ...(retryAfterMs === undefined ? {} : { retryAfterMs }),\n            status: response.status,\n          },\n        ),\n      );\n    }),\n  );\n}\n\nfunction reason(status: number, code?: number): DnsProvider.ErrorReason {\n  if (status === 401) return \"authentication\";\n  if (status === 403) return \"authorization\";\n  if (status === 404) return \"not_found\";\n  if (status === 409 || code === 81056 || code === 81057 || code === 81058) return \"conflict\";\n  if (status === 429) return \"rate_limit\";\n  if (status >= 500) return \"response\";\n  return \"request\";\n}\n\nfunction retryAfter(value: string | null): number | undefined {\n  if (value === null) return undefined;\n  const seconds = Number(value);\n  if (Number.isFinite(seconds)) return Math.max(0, seconds * 1_000);\n  const date = Date.parse(value);\n  return Number.isNaN(date) ? undefined : Math.max(0, date - Date.now());\n}\n\nfunction failure(\n  operation: string,\n  message: string,\n  fields: Partial<Pick<DnsProvider.Error, \"code\" | \"reason\" | \"retryAfterMs\" | \"status\">> = {},\n): DnsProvider.Error {\n  return new DnsProvider.Error({\n    ...fields,\n    message,\n    operation,\n    providerId: \"cloudflare\",\n  });\n}\n","import type * as oauth from \"oauth4webapi\";\nimport { Clock, Effect } from \"effect\";\n\nimport type * as ProviderAuth from \"../../auth/manifest.ts\";\nimport type * as Secret from \"../../auth/secret.ts\";\nimport type * as DomainName from \"../../domain/domain-name.ts\";\nimport * as Client from \"./client.ts\";\n\nconst authorizationServer = {\n  authorization_endpoint: \"https://dash.cloudflare.com/oauth2/auth\",\n  issuer: \"https://dash.cloudflare.com\",\n  revocation_endpoint: \"https://dash.cloudflare.com/oauth2/revoke\",\n  token_endpoint: \"https://dash.cloudflare.com/oauth2/token\",\n} as const;\n\n/** Describes Cloudflare's caller-created API-token authorization method. */\nexport function tokenMethod(\n  capabilities: ProviderAuth.TokenValidation[\"capabilities\"],\n): Extract<ProviderAuth.Manifest[\"methods\"][number], { readonly _tag: \"token\" }> {\n  return {\n    _tag: \"token\",\n    capabilities: [...capabilities],\n    instructionsUrl: \"https://developers.cloudflare.com/fundamentals/api/get-started/create-token/\",\n  };\n}\n\nexport interface OAuthMethodOptions {\n  /** Scope IDs assigned to the OAuth client by Cloudflare. */\n  readonly scopes: ReadonlyArray<string>;\n  /** Capabilities represented by those assigned scope IDs. */\n  readonly capabilities: ProviderAuth.TokenValidation[\"capabilities\"];\n  readonly clientAuth: ProviderAuth.OAuthMethod[\"clientAuth\"];\n}\n\n/** Describes a registered Cloudflare OAuth client and its assigned scope IDs. */\nexport function oauthMethod(options: OAuthMethodOptions): ProviderAuth.OAuthMethod {\n  return {\n    _tag: \"oauth2\",\n    authorizationServer,\n    capabilities: [...options.capabilities],\n    clientAuth: options.clientAuth,\n    scopes: [...options.scopes],\n  };\n}\n\n/** Creates the Cloudflare token and OAuth authorization manifest. */\nexport function manifest(options: OAuthMethodOptions): ProviderAuth.Manifest {\n  return {\n    methods: [tokenMethod(options.capabilities), oauthMethod(options)],\n    providerId: \"cloudflare\",\n  };\n}\n\ntype CredentialOptions = Omit<Client.Options, \"accountId\" | \"token\" | \"tokenKind\">;\n\n/** Selects an explicit Cloudflare account or discovers it from an authorized domain. */\nexport type CredentialTarget =\n  | {\n      readonly accountId: string;\n      readonly domain?: never;\n    }\n  | {\n      readonly accountId?: never;\n      readonly domain: DomainName.DomainName;\n    };\n\nexport type SubjectResolverOptions = CredentialOptions & CredentialTarget;\n\n/** Configuration for validating a Cloudflare token against an account or authorized domain. */\nexport type TokenValidatorOptions = CredentialOptions &\n  (\n    | {\n        readonly accountId: string;\n        readonly domain?: never;\n        readonly tokenKind?: \"account\" | \"user\";\n      }\n    | {\n        readonly accountId?: never;\n        readonly domain: DomainName.DomainName;\n        readonly tokenKind?: \"account\" | \"user\";\n      }\n  );\n\n/** Resolves the Cloudflare account selected by a completed OAuth grant. */\nexport function subjectResolver(\n  options: SubjectResolverOptions,\n): ProviderAuth.OAuthSubjectResolver {\n  return (tokens: oauth.TokenEndpointResponse, accessToken: Secret.Value) =>\n    Effect.gen(function* () {\n      const accountId =\n        options.accountId ??\n        (yield* Client.discoverAuthorizationAccount({\n          ...(options.baseUrl === undefined ? {} : { baseUrl: options.baseUrl }),\n          domain: options.domain,\n          ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          token: accessToken,\n        }).pipe(Effect.map((account) => account.id)));\n      if (options.accountId !== undefined) {\n        yield* Client.make({\n          accountId: options.accountId,\n          ...(options.baseUrl === undefined ? {} : { baseUrl: options.baseUrl }),\n          capabilities: options.capabilities,\n          ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          token: accessToken,\n          tokenKind: \"user\",\n        }).listZones();\n      }\n      const now = yield* Clock.currentTimeMillis;\n      return {\n        accountId,\n        expiresAt:\n          typeof tokens.expires_in === \"number\" ? new Date(now + tokens.expires_in * 1_000) : null,\n      };\n    });\n}\n\n/** Creates a host callback that validates a Cloudflare API token. */\nexport function tokenValidator(\n  options: TokenValidatorOptions,\n): (token: Secret.Value) => ReturnType<Client.Interface[\"validateToken\"]> {\n  return (token) =>\n    options.accountId === undefined\n      ? Client.validateDomainToken({\n          ...(options.baseUrl === undefined ? {} : { baseUrl: options.baseUrl }),\n          capabilities: options.capabilities,\n          domain: options.domain,\n          ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          token,\n          ...(options.tokenKind === undefined ? {} : { tokenKind: options.tokenKind }),\n        })\n      : Client.make({\n          accountId: options.accountId,\n          ...(options.baseUrl === undefined ? {} : { baseUrl: options.baseUrl }),\n          capabilities: options.capabilities,\n          ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          token,\n          ...(options.tokenKind === undefined ? {} : { tokenKind: options.tokenKind }),\n        }).validateToken();\n}\n"],"mappings":";;;;;;AAKA,SAAgB,WAAW,OAAqD;CAC9E,MAAM,SAASA,MAAiB,KAAK;CACrC,MAAM,cAAc,UAAU,QAAQ,EAAE,qBAAqB,KAAK,CAAC;CACnE,IAAI,gBAAgB,MAClB,MAAM,IAAIC,MAAkB,EAAE,SAAS,8CAA8C,CAAC;CAExF,MAAM,SAAS,OAAO,MAAM,GAAG;CAC/B,MAAM,oBAAoB,YAAY,MAAM,GAAG,CAAC,CAAC;CACjD,MAAM,SAAuC,CAAC;CAC9C,KAAK,IAAI,QAAQ,GAAG,SAAS,OAAO,SAAS,mBAAmB,SAAS,GACvE,OAAO,KAAKD,MAAiB,OAAO,MAAM,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;CAE7D,OAAO;AACT;;;AChBA,MAAa,cAAcE,OAAE,OAAO;CAClC,MAAMA,OAAE;CACR,SAASA,OAAE;AACb,CAAC;AAGD,MAAa,aAAaA,OAAE,OAAO;CACjC,OAAOA,OAAE,YAAYA,OAAE,MAAM;CAC7B,MAAMA,OAAE,YAAYA,OAAE,MAAM;CAC5B,UAAUA,OAAE,YAAYA,OAAE,MAAM;CAChC,aAAaA,OAAE,YAAYA,OAAE,MAAM;CACnC,aAAaA,OAAE,YAAYA,OAAE,MAAM;AACrC,CAAC;AAED,MAAM,UAAUA,OAAE,OAAO;CACvB,MAAMA,OAAE,YAAYA,OAAE,MAAM;CAC5B,SAASA,OAAE;AACb,CAAC;AAED,MAAa,eAAeA,OAAE,OAAO;CACnC,QAAQA,OAAE,MAAM,WAAW;CAC3B,UAAUA,OAAE,MAAM,OAAO;CACzB,SAASA,OAAE;AACb,CAAC;AAED,MAAa,UAAUA,OAAE,OAAO;CAC9B,IAAIA,OAAE;CACN,MAAMA,OAAE;AACV,CAAC;AAGD,MAAa,OAAOA,OAAE,OAAO;CAC3B,SAAS;CACT,IAAIA,OAAE;CACN,MAAMA,OAAE;CACR,cAAcA,OAAE,MAAMA,OAAE,MAAM;CAC9B,QAAQA,OAAE,YAAYA,OAAE,MAAM;AAChC,CAAC;AAGD,MAAa,SAASA,OAAE,OAAO;CAC7B,SAASA,OAAE,YAAYA,OAAE,MAAM;CAC/B,MAAMA,OAAE,YAAYA,OAAE,OAAO;CAC7B,IAAIA,OAAE;CACN,MAAMA,OAAE;CACR,UAAUA,OAAE,YAAYA,OAAE,MAAM;CAChC,SAASA,OAAE,YAAYA,OAAE,OAAO;CAChC,KAAKA,OAAE;CACP,MAAMA,OAAE;AACV,CAAC;AAGD,MAAa,QAAQA,OAAE,OAAO;CAC5B,YAAYA,OAAE,YAAYA,OAAE,MAAM;CAClC,IAAIA,OAAE;CACN,YAAYA,OAAE,YAAYA,OAAE,MAAM;CAClC,QAAQA,OAAE,SAAS;EAAC;EAAU;EAAY;CAAS,CAAC;AACtD,CAAC;AAGD,MAAa,mBAAmBA,OAAE,OAAO;CACvC,QAAQA,OAAE,MAAM,WAAW;CAC3B,UAAUA,OAAE,MAAM,OAAO;CACzB,QAAQA,OAAE,MAAM,IAAI;CACpB,aAAaA,OAAE,YAAY,UAAU;CACrC,SAASA,OAAE;AACb,CAAC;AACD,MAAa,qBAAqBA,OAAE,OAAO;CACzC,QAAQA,OAAE,MAAM,WAAW;CAC3B,UAAUA,OAAE,MAAM,OAAO;CACzB,QAAQA,OAAE,MAAM,MAAM;CACtB,aAAaA,OAAE,YAAY,UAAU;CACrC,SAASA,OAAE;AACb,CAAC;AACD,MAAa,iBAAiBA,OAAE,OAAO;CACrC,QAAQA,OAAE,MAAM,WAAW;CAC3B,UAAUA,OAAE,MAAM,OAAO;CACzB,QAAQ;CACR,SAASA,OAAE;AACb,CAAC;AACD,MAAa,gBAAgBA,OAAE,OAAO;CACpC,QAAQA,OAAE,MAAM,WAAW;CAC3B,UAAUA,OAAE,MAAM,OAAO;CACzB,QAAQ;CACR,SAASA,OAAE;AACb,CAAC;;;AChFD,MAAM,OAAOC,OAAE,OAAO;CACpB,OAAOA,OAAE,YAAYA,OAAE,MAAM;CAC7B,MAAMA,OAAE,YAAYA,OAAE,MAAM;CAC5B,UAAUA,OAAE,YAAYA,OAAE,MAAM;CAChC,KAAKA,OAAE,YAAYA,OAAE,MAAM;CAC3B,QAAQA,OAAE,YAAYA,OAAE,MAAM;CAC9B,OAAOA,OAAE,YAAYA,OAAE,MAAM;CAC7B,QAAQA,OAAE,YAAYA,OAAE,MAAM;AAChC,CAAC;AAID,MAAaC,WAAS,OAAO,GAAG,0BAA0B,CAAC,EAAE,WAC3D,OAAO,IAAI,aAAa;CACtB,MAAM,OAAO,OAAOC,SAAkB,OAAO,IAAI,CAAC,CAAC,KACjD,OAAO,MAAM;EAAE,iBAAiB;EAAM,YAAY,UAAU;CAAM,CAAC,CACrE;CACA,IAAI,SAAS,MAAM,OAAO,OAAO,aAAa,MAAM;CACpD,MAAM,SAAS;EACb,UAAU;GACR,WAAW;GACX,YAAY,OAAO,YAAY,OAAO,uBAAuB;GAC7D,SAAS;EACX;EACA;EACA,QAAQ,OAAO,SAAS,UAAU,cAAc;EAChD,KAAK,OAAO,QAAQ,IAAI,OAAO,OAAO;CACxC;CACA,MAAM,gBACJ,OAAO,YAAY,KAAA,IACf,OAAO,KAAKC,UAAQ,gBAAgB,cAAc,OAAO,KAAK,uBAAuB,CAAC,IACtF,OAAO,QAAQ,OAAO,OAAO;CAEnC,QAAQ,OAAO,MAAf;EACE,KAAK;EACL,KAAK,QACH,OAAO,OAAOC,SAAiB;GAC7B,GAAG;GACH,MAAM,OAAO;GACb,SAAS,OAAO,QAAQ;EAC1B,CAAC,CAAC,CAAC,KAAK,OAAO,UAAU,UAAUD,UAAQ,gBAAgB,MAAM,OAAO,CAAC,CAAC;EAC5E,KAAK;EACL,KAAK,MACH,OAAO,OAAOC,SAAiB;GAC7B,GAAG;GACH,MAAM,OAAO;GACb,QAAQ,OAAO,QAAQ;EACzB,CAAC,CAAC,CAAC,KAAK,OAAO,UAAU,UAAUD,UAAQ,gBAAgB,MAAM,OAAO,CAAC,CAAC;EAC5E,KAAK,OACH,OAAO,OAAOC,SAAiB;GAC7B,GAAG;GACH,MAAM;GACN,OAAO,OAAO,QAAQ;EACxB,CAAC,CAAC,CAAC,KAAK,OAAO,UAAU,UAAUD,UAAQ,gBAAgB,MAAM,OAAO,CAAC,CAAC;EAC5E,KAAK,MACH,OAAO,OAAOC,SAAiB;GAC7B,GAAG;GACH,MAAM;GACN,UAAU,OAAO,QAAQ;GACzB,UAAU,OAAO;EACnB,CAAC,CAAC,CAAC,KAAK,OAAO,UAAU,UAAUD,UAAQ,gBAAgB,MAAM,OAAO,CAAC,CAAC;EAC5E,KAAK,OAAO;GACV,MAAM,OAAO,OAAO,WAAW,MAAM;GACrC,OAAO,OAAOC,SAAiB;IAAE,GAAG;IAAQ,MAAM;IAAO,GAAG;GAAK,CAAC,CAAC,CAAC,KAClE,OAAO,UAAU,UAAUD,UAAQ,gBAAgB,MAAM,OAAO,CAAC,CACnE;EACF;EACA,KAAK,OAAO;GACV,MAAM,OAAO,OAAO,WAAW,MAAM;GACrC,OAAO,OAAOC,SAAiB;IAAE,GAAG;IAAQ,MAAM;IAAO,GAAG;GAAK,CAAC,CAAC,CAAC,KAClE,OAAO,UAAU,UAAUD,UAAQ,gBAAgB,MAAM,OAAO,CAAC,CACnE;EACF;EACA,SACE,OAAO,OAAO,aAAa,MAAM;CACrC;AACF,CAAC,CACH;AAEA,MAAM,eAAe,OAAO,GAAG,gCAAgC,CAAC,EAAE,WAChEH,OAAE,oBAAoBK,MAAgB,CAAC,CAAC;CACtC,MAAM;CACN,MAAM,OAAO;CACb,kBAAkB,OAAO;CACzB,cAAc,OAAO;AACvB,CAAC,CAAC,CAAC,KAAK,OAAO,UAAU,UAAUF,UAAQ,gBAAgB,MAAM,OAAO,CAAC,CAAC,CAC5E;AAEA,SAAgB,OAAO,QAAyC;CAC9D,MAAM,SAAS;EACb,MAAM,OAAO;EACb,SAAS;EACT,KAAK,OAAO,OAAO;EACnB,MAAM,OAAO;CACf;CACA,QAAQ,OAAO,MAAf;EACE,KAAK;EACL,KAAK,QACH,OAAO;GAAE,GAAG;GAAQ,SAAS,OAAO;EAAQ;EAC9C,KAAK;EACL,KAAK,MACH,OAAO;GAAE,GAAG;GAAQ,SAAS,OAAO;EAAO;EAC7C,KAAK,OACH,OAAO;GAAE,GAAG;GAAQ,SAAS,OAAO;EAAM;EAC5C,KAAK,MACH,OAAO;GAAE,GAAG;GAAQ,SAAS,OAAO;GAAU,UAAU,OAAO;EAAS;EAC1E,KAAK,OACH,OAAO;GACL,GAAG;GACH,MAAM;IAAE,OAAO,OAAO;IAAO,KAAK,OAAO;IAAK,OAAO,OAAO;GAAM;EACpE;EACF,KAAK,OACH,OAAO;GACL,GAAG;GACH,MAAM;IACJ,MAAM,OAAO;IACb,UAAU,OAAO;IACjB,QAAQ,OAAO;IACf,QAAQ,OAAO;GACjB;EACF;CACJ;AACF;AAEA,MAAM,aAAa,OAAO,GAAG,8BAA8B,CAAC,EAAE,WAC5DH,OAAE,oBAAoB,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KACvC,OAAO,UAAU,UAAUG,UAAQ,gBAAgB,MAAM,OAAO,CAAC,CACnE,CACF;AAEA,SAASA,UACP,WACA,SACA,SAAqD,CAAC,GACnC;CACnB,OAAO,IAAIG,QAAkB;EAC3B;EACA;EACA,YAAY;EACZ,QAAQ,OAAO,UAAU;CAC3B,CAAC;AACH;;;;;;;;ACxFA,MAAM,iBAAiB,YAA+B;CACpD,MAAM,QAAQ,QAAQ,SAAS,WAAW;CAC1C,MAAM,WAAW,QAAQ,WAAW,uCAAA,CAAwC,QAAQ,OAAO,EAAE;CAE7F,MAAM,UAAU,OAAO,GAAG,0BAA0B,CAAC,EAClD,MAAc,WAAmB,SAChC,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,OAAO,OAAO,WAAW;GACxC,WACE,MAAM,GAAG,UAAU,QAAQ;IACzB,GAAG;IACH,SAAS;KACP,QAAQ;KACR,eAAe,UAAU,QAAQ,MAAM,OAAO;KAC9C,GAAI,MAAM,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;KACzE,GAAG,MAAM;IACX;GACF,CAAC;GACH,aACE,QAAQ,WAAW,6BAA6B,EAC9C,QAAQ,YACV,CAAC;EACL,CAAC;EAkBD,OAAO;GAAE,MAAA,OAjBW,OAAO,WAAW;IACpC,WAAW,SAAS,KAAK;IACzB,aAAa;KACX,MAAM,eAAe,WAAW,SAAS,QAAQ,IAAI,aAAa,CAAC;KACnE,OAAO,QACL,WACA,SAAS,KACL,4CACA,uCAAuC,SAAS,UACpD;MACE,QAAQ,SAAS,KAAK,aAAa,OAAO,SAAS,MAAM;MACzD,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa;MACrD,QAAQ,SAAS;KACnB,CACF;IACF;GACF,CAAC;GACc;EAAS;CAC1B,CAAC,CACL;CAEA,MAAM,gBAAgB,OAAO,GAAG,gCAAgC,CAAC,EAC9D,WAA+B,MAAyC,SACvE,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,IAAI,gBAAgB;GAAE,MAAM,OAAO,IAAI;GAAG,UAAU;EAAK,CAAC;EACxE,MAAM,IAAI,QAAQ,iCAAiC;EACnD,IAAI,cAAc,KAAA,GAAW,MAAM,IAAI,cAAc,SAAS;EAC9D,IAAI,SAAS,KAAA,GAAW,MAAM,IAAI,QAAQ,IAAI;EAC9C,MAAM,EAAE,MAAM,aAAa,OAAO,QAAQ,UAAU,SAAS,WAAW;EACxE,OAAO,cAAc,MAAM,aAAa,QAAQ;EAChD,OAAO,OAAO,OAAOC,kBAA2B,MAAM,aAAa,QAAQ;CAC7E,CAAC,CACL;CAiDA,OAAO;EAAE,UA/CQ,OAAO,GAAG,2BAA2B,CAAC,EACpD,WAAoB,SACnB,OAAO,IAAI,aAAa;GACtB,MAAM,QAA8B,CAAC;GACrC,IAAI,OAAO;GACX,OAAO,MAAM;IACX,MAAM,WAAW,OAAO,cAAc,WAAW,MAAM,IAAI;IAC3D,MAAM,KAAK,GAAG,SAAS,MAAM;IAC7B,MAAM,aAAa,SAAS,aAAa;IACzC,IACG,eAAe,KAAA,KAAa,QAAQ,cACpC,eAAe,KAAA,KAAa,SAAS,OAAO,SAAS,IAEtD,OAAO;IAET,QAAQ;GACV;EACF,CAAC,CA8BW;EAAG,cA3BE,OAAO,GAAG,+BAA+B,CAAC,EAAE,SAC/D,OAAO,IAAI,aAAa;GACtB,MAAM,EAAE,MAAM,aAAa,OAAO,QAAQ,MAAM,eAAe;GAC/D,OAAO,cAAc,MAAM,iBAAiB,QAAQ;GACpD,MAAM,WAAW,OAAO,OAAOC,eAAwB,MAAM,iBAAiB,QAAQ;GACtF,IAAI,SAAS,OAAO,WAAW,UAC7B,OAAO,OAAO,OAAO,KACnB,QAAQ,iBAAiB,uBAAuB,SAAS,OAAO,UAAU;IACxE,QAAQ;IACR,QAAQ,SAAS;GACnB,CAAC,CACH;GAEF,MAAM,YACJ,SAAS,OAAO,eAAe,KAAA,IAAY,OAAO,IAAI,KAAK,SAAS,OAAO,UAAU;GACvF,IAAI,cAAc,QAAQ,OAAO,MAAM,UAAU,QAAQ,CAAC,GACxD,OAAO,OAAO,OAAO,KACnB,QAAQ,iBAAiB,oDAAoD;IAC3E,QAAQ;IACR,QAAQ,SAAS;GACnB,CAAC,CACH;GAEF,OAAO;EACT,CAAC,CAG2B;EAAG;CAAQ;AAC3C;AAEA,MAAM,kBAAkB,OAAO,GAAG,kCAAkC,CAAC,EAClE,YACC,OAAO,IAAI,aAAa;CACtB,MAAM,EAAE,aAAa,cAAc,OAAO;CAC1C,KAAK,MAAM,aAAaC,WAAiB,QAAQ,MAAM,GAAG;EACxD,MAAM,UAAU,OAAO,SAAS,KAAA,GAAW,SAAS;EACpD,MAAM,QAAQ,QAAQ;EACtB,IAAI,QAAQ,WAAW,GAAG;EAC1B,IAAI,QAAQ,WAAW,KAAK,UAAU,KAAA,GAAW,OAAO,MAAM;EAC9D,OAAO,OAAO,OAAO,KACnB,QACE,mBACA,uDAAuD,aACvD,EAAE,QAAQ,WAAW,CACvB,CACF;CACF;CACA,OAAO,OAAO,OAAO,KACnB,QACE,mBACA,oDAAoD,QAAQ,UAC5D,EAAE,QAAQ,YAAY,CACxB,CACF;AACF,CAAC,CACL;AAEA,MAAa,+BAA+B;AAE5C,MAAa,sBAAsB,OAAO,GAAG,sCAAsC,CAAC,EACjF,YACC,OAAO,IAAI,aAAa;CACtB,MAAM,YAAY,cAAc,OAAO;CACvC,MAAM,UAAU,QAAQ,cAAc,YAAY,OAAO,gBAAgB,OAAO,IAAI,KAAA;CACpF,MAAM,YAAY,OAAO,UAAU,aACjC,YAAY,KAAA,IACR,wBACA,aAAa,mBAAmB,QAAQ,EAAE,EAAE,eAClD;CAEA,OAAO;EACL,YAFwB,YAAY,OAAO,gBAAgB,OAAO,GAAA,CAErC;EAC7B,cAAc,QAAQ;EACtB;EACA,QAAQ,CAAC;CACX;AACF,CAAC,CACL;;AAGA,SAAgB,KAAK,SAA6B;CAChD,MAAM,EAAE,UAAU,cAAc,YAAY,cAAc,OAAO;CAEjE,MAAM,cAAc,OAAO,GAAG,8BAA8B,CAAC,EAAE,SAC7D,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,SAAS,QAAQ,WAAW,IAAI;EACvD,MAAM,QAAQ,QAAQ;EACtB,IAAI,QAAQ,WAAW,KAAK,UAAU,KAAA,GAAW,OAAO;EACxD,OAAO,OAAO,OAAO,KACnB,QACE,eACA,QAAQ,WAAW,IACf,mBAAmB,KAAK,4BAA4B,QAAQ,cAC5D,4CAA4C,KAAK,cAAc,QAAQ,aAC3E,EAAE,QAAQ,QAAQ,WAAW,IAAI,cAAc,WAAW,CAC5D,CACF;CACF,CAAC,CACH;CAEA,MAAM,cAAc,OAAO,GAAG,8BAA8B,CAAC,EAAE,aAC7D,OAAO,IAAI,aAAa;EACtB,MAAM,OAAO,OAAO,YAAY,QAAQ;EACxC,MAAM,UAAqC,CAAC;EAC5C,IAAI,OAAO;EACX,OAAO,MAAM;GACX,MAAM,QAAQ,IAAI,gBAAgB;IAAE,MAAM,OAAO,IAAI;IAAG,UAAU;GAAM,CAAC;GACzE,MAAM,EAAE,MAAM,aAAa,OAAO,QAChC,UAAU,mBAAmB,KAAK,EAAE,EAAE,eAAe,SACrD,aACF;GACA,OAAO,cAAc,MAAM,eAAe,QAAQ;GAClD,MAAM,WAAW,OAAO,OAAOC,oBAA6B,MAAM,eAAe,QAAQ;GACzF,QAAQ,KAAK,GAAI,OAAO,OAAO,QAAQ,SAAS,QAAQC,QAAc,CAAE;GACxE,MAAM,aAAa,SAAS,aAAa;GACzC,IACG,eAAe,KAAA,KAAa,QAAQ,cACpC,eAAe,KAAA,KAAa,SAAS,OAAO,SAAS,KAEtD,OAAO;GAET,QAAQ;EACV;CACF,CAAC,CACH;CAEA,MAAM,eAAe,OAAO,GAAG,+BAA+B,CAAC,EAC5D,UAAiC,WAChC,OAAO,IAAI,aAAa;EACtB,MAAM,OAAO,OAAO,YAAY,QAAQ;EACxC,MAAM,EAAE,MAAM,aAAa,OAAO,QAChC,UAAU,mBAAmB,KAAK,EAAE,EAAE,eACtC,gBACA;GAAE,MAAM,KAAK,UAAUC,OAAe,MAAM,CAAC;GAAG,QAAQ;EAAO,CACjE;EACA,OAAO,cAAc,MAAM,gBAAgB,QAAQ;EAEnD,OAAO,EAAE,mBAAkB,OADH,OAAOC,gBAAyB,MAAM,gBAAgB,QAAQ,EAAA,CAClD,OAAO,GAAG;CAChD,CAAC,CACL;CAEA,MAAM,YAAY,OAAO,GAAG,4BAA4B,CAAC,EACtD,UAAiC,qBAChC,OAAO,IAAI,aAAa;EACtB,MAAM,OAAO,OAAO,YAAY,QAAQ;EACxC,MAAM,EAAE,MAAM,aAAa,OAAO,QAChC,UAAU,mBAAmB,KAAK,EAAE,EAAE,eAAe,mBAAmB,gBAAgB,KACxF,WACF;EACA,IAAI,SAAS,WAAW,KAAK,OAAO;EACpC,OAAO,cAAc,MAAM,aAAa,QAAQ;EAChD,MAAM,WAAW,OAAO,OAAOA,gBAAyB,MAAM,aAAa,QAAQ;EACnF,OAAO,OAAOF,SAAe,SAAS,MAAM;CAC9C,CAAC,CACL;CAgDA,OAAO;EACL,IAAI;EACJ;EACA,cAjDmB,OAAO,GAAG,+BAA+B,CAAC,EAC5D,UAAiC,qBAChC,OAAO,IAAI,aAAa;GACtB,MAAM,OAAO,OAAO,YAAY,QAAQ;GACxC,MAAM,EAAE,MAAM,aAAa,OAAO,QAChC,UAAU,mBAAmB,KAAK,EAAE,EAAE,eAAe,mBAAmB,gBAAgB,KACxF,gBACA,EAAE,QAAQ,SAAS,CACrB;GACA,OAAO,cAAc,MAAM,gBAAgB,QAAQ;EACrD,CAAC,CAuCQ;EACX;EACA,cAtCmB,OAAO,GAAG,+BAA+B,CAAC,OAC7D,SAAS,CAAC,CAAC,KACT,OAAO,KAAK,UAAU;GACpB,MAAM,2BAAW,IAAI,IAA8B;GACnD,KAAK,MAAM,QAAQ,OAAO,SAAS,IAAI,KAAK,QAAQ,IAAI,KAAK,OAAO;GACpE,OAAO,CAAC,GAAG,SAAS,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC;EACzF,CAAC,CACH,CA+BW;EACX;EACA,WA9BgB,OAAO,GAAG,4BAA4B,CAAC,EAAE,QAAwB,CAAC,MAClF,SAAS,MAAM,aAAa,QAAQ,WAAW,MAAM,IAAI,CAAC,CAAC,KACzD,OAAO,SAAS,UAAU,OAAO,QAAQ,OAAO,WAAW,CAAC,CAC9D,CA2BQ;EACR,eAzBoB,OAAO,GAAG,gCAAgC,CAAC,OAC/D,OAAO,IAAI,aAAa;GACtB,MAAM,OACJ,QAAQ,cAAc,YAClB,aAAa,mBAAmB,QAAQ,SAAS,EAAE,kBACnD;GACN,MAAM,YAAY,OAAO,aAAa,IAAI;GAC1C,OAAO,SAAS,QAAQ,SAAS;GACjC,OAAO;IACL,WAAW,QAAQ;IACnB,cAAc,QAAQ;IACtB;IACA,QAAQ,CAAC;GACX;EACF,CAAC,CAWW;CACd;AACF;AAEA,MAAM,cAAc,OAAO,GAAG,8BAA8B,CAAC,EAAE,SAC7D,OAAO,IAAI,aAAa;CACtB,MAAM,OAAO,OAAOG,SAAkB,KAAK,IAAI,CAAC,CAAC,KAC/C,OAAO,UAAU,UAAU,QAAQ,aAAa,MAAM,SAAS,EAAE,QAAQ,WAAW,CAAC,CAAC,CACxF;CACA,MAAM,cAAc,OAAO,OAAO,QAAQ,KAAK,eAAe,eAC5DA,SAAkB,UAAU,CAAC,CAAC,KAC5B,OAAO,UAAU,UAAU,QAAQ,aAAa,MAAM,SAAS,EAAE,QAAQ,WAAW,CAAC,CAAC,CACxF,CACF;CACA,OAAO;EACL,WAAW,KAAK,QAAQ;EACxB,IAAI,KAAK;EACT;EACA;EACA,QAAQ,KAAK,UAAU;CACzB;AACF,CAAC,CACH;AAEA,SAAS,OACP,QACA,OACA,WACA,UACqC;CACrC,OAAOC,OAAE,oBAAoB,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAC1C,OAAO,UAAU,UACf,QAAQ,WAAW,uDAAuD,MAAM,WAAW;EACzF,QAAQ;EACR,QAAQ,SAAS;CACnB,CAAC,CACH,CACF;AACF;AAEA,SAAS,cACP,OACA,WACA,UACwC;CACxC,OAAOA,OAAE,oBAAoBC,YAAqB,CAAC,CAAC,KAAK,CAAC,CAAC,KACzD,OAAO,eACL,QAAQ,WAAW,4DAA4D;EAC7E,QAAQ;EACR,QAAQ,SAAS;CACnB,CAAC,CACH,GACA,OAAO,SAAS,aAAa;EAC3B,IAAI,SAAS,MAAM,SAAS,SAAS,OAAO,OAAO;EACnD,MAAM,SAAS,SAAS,OAAO;EAC/B,MAAM,eAAe,WAAW,SAAS,QAAQ,IAAI,aAAa,CAAC;EACnE,OAAO,OAAO,KACZ,QACE,WACA,QAAQ,WAAW,uCAAuC,SAAS,UACnE;GACE,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,OAAO,KAAK;GACpD,QAAQ,OAAO,SAAS,QAAQ,QAAQ,IAAI;GAC5C,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa;GACrD,QAAQ,SAAS;EACnB,CACF,CACF;CACF,CAAC,CACH;AACF;AAEA,SAAS,OAAO,QAAgB,MAAwC;CACtE,IAAI,WAAW,KAAK,OAAO;CAC3B,IAAI,WAAW,KAAK,OAAO;CAC3B,IAAI,WAAW,KAAK,OAAO;CAC3B,IAAI,WAAW,OAAO,SAAS,SAAS,SAAS,SAAS,SAAS,OAAO,OAAO;CACjF,IAAI,WAAW,KAAK,OAAO;CAC3B,IAAI,UAAU,KAAK,OAAO;CAC1B,OAAO;AACT;AAEA,SAAS,WAAW,OAA0C;CAC5D,IAAI,UAAU,MAAM,OAAO,KAAA;CAC3B,MAAM,UAAU,OAAO,KAAK;CAC5B,IAAI,OAAO,SAAS,OAAO,GAAG,OAAO,KAAK,IAAI,GAAG,UAAU,GAAK;CAChE,MAAM,OAAO,KAAK,MAAM,KAAK;CAC7B,OAAO,OAAO,MAAM,IAAI,IAAI,KAAA,IAAY,KAAK,IAAI,GAAG,OAAO,KAAK,IAAI,CAAC;AACvE;AAEA,SAAS,QACP,WACA,SACA,SAA0F,CAAC,GACxE;CACnB,OAAO,IAAIC,QAAkB;EAC3B,GAAG;EACH;EACA;EACA,YAAY;CACd,CAAC;AACH;;;;;;;;;;ACxbA,MAAM,sBAAsB;CAC1B,wBAAwB;CACxB,QAAQ;CACR,qBAAqB;CACrB,gBAAgB;AAClB;;AAGA,SAAgB,YACd,cAC+E;CAC/E,OAAO;EACL,MAAM;EACN,cAAc,CAAC,GAAG,YAAY;EAC9B,iBAAiB;CACnB;AACF;;AAWA,SAAgB,YAAY,SAAuD;CACjF,OAAO;EACL,MAAM;EACN;EACA,cAAc,CAAC,GAAG,QAAQ,YAAY;EACtC,YAAY,QAAQ;EACpB,QAAQ,CAAC,GAAG,QAAQ,MAAM;CAC5B;AACF;;AAGA,SAAgB,SAAS,SAAoD;CAC3E,OAAO;EACL,SAAS,CAAC,YAAY,QAAQ,YAAY,GAAG,YAAY,OAAO,CAAC;EACjE,YAAY;CACd;AACF;;AAiCA,SAAgB,gBACd,SACmC;CACnC,QAAQ,QAAqC,gBAC3C,OAAO,IAAI,aAAa;EACtB,MAAM,YACJ,QAAQ,cACP,OAAOC,6BAAoC;GAC1C,GAAI,QAAQ,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;GACpE,QAAQ,QAAQ;GAChB,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;GAC9D,OAAO;EACT,CAAC,CAAC,CAAC,KAAK,OAAO,KAAK,YAAY,QAAQ,EAAE,CAAC;EAC7C,IAAI,QAAQ,cAAc,KAAA,GACxB,OAAOC,KAAY;GACjB,WAAW,QAAQ;GACnB,GAAI,QAAQ,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;GACpE,cAAc,QAAQ;GACtB,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;GAC9D,OAAO;GACP,WAAW;EACb,CAAC,CAAC,CAAC,UAAU;EAEf,MAAM,MAAM,OAAO,MAAM;EACzB,OAAO;GACL;GACA,WACE,OAAO,OAAO,eAAe,WAAW,IAAI,KAAK,MAAM,OAAO,aAAa,GAAK,IAAI;EACxF;CACF,CAAC;AACL;;AAGA,SAAgB,eACd,SACwE;CACxE,QAAQ,UACN,QAAQ,cAAc,KAAA,IAClBC,oBAA2B;EACzB,GAAI,QAAQ,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;EACpE,cAAc,QAAQ;EACtB,QAAQ,QAAQ;EAChB,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAC9D;EACA,GAAI,QAAQ,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,QAAQ,UAAU;CAC5E,CAAC,IACDD,KAAY;EACV,WAAW,QAAQ;EACnB,GAAI,QAAQ,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;EACpE,cAAc,QAAQ;EACtB,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAC9D;EACA,GAAI,QAAQ,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,QAAQ,UAAU;CAC5E,CAAC,CAAC,CAAC,cAAc;AACzB"}

package/dist/{cloudflare-tdjNS8vE.d.mts → cloudflare-CprjjXfm.d.mts}

@@ -1,13 +1,13 @@
 import { d as Value, l as TokenValidation, p as AsyncInterface, t as AsyncOAuthSubjectResolver } from "./manifest-CP85ePFn.mjs";
-import { a as manifest$1, c as Account, d as ListZonesInput, f as Options, l as Fetch, n as OAuthMethodOptions, o as oauthMethod$1, p as Zone, r as SubjectResolverOptions, s as tokenMethod$1 } from "./index-CS9Rl5LQ.mjs";
+import { a as TokenValidatorOptions, c as oauthMethod$1, d as Fetch, h as Zone, i as SubjectResolverOptions, l as tokenMethod$1, m as Options, n as CredentialTarget, p as ListZonesInput, r as OAuthMethodOptions, s as manifest$1, u as Account } from "./index-D2howbNz.mjs";
 declare namespace cloudflare_auth_d_exports {
-  export { OAuthMethodOptions, SubjectResolverOptions, manifest, oauthMethod, subjectResolver, tokenMethod, tokenValidator };
+  export { CredentialTarget, OAuthMethodOptions, SubjectResolverOptions, TokenValidatorOptions, manifest, oauthMethod, subjectResolver, tokenMethod, tokenValidator };
 }
 declare const manifest: typeof manifest$1;
 declare const oauthMethod: typeof oauthMethod$1;
 declare const tokenMethod: typeof tokenMethod$1;
 declare function subjectResolver(options: SubjectResolverOptions): AsyncOAuthSubjectResolver;
-declare function tokenValidator(options: Omit<Options, "token">): (token: Value) => Promise<TokenValidation>;
+declare function tokenValidator(options: TokenValidatorOptions): (token: Value) => Promise<TokenValidation>;
 declare namespace cloudflare_d_exports {
   export { Account, cloudflare_auth_d_exports as Auth, Fetch, Interface, ListZonesInput, Options, Zone, make };
 }
@@ -20,4 +20,4 @@ interface Interface extends AsyncInterface {
 declare function make(options: Options): Interface;
 //#endregion
 export { cloudflare_auth_d_exports as i, cloudflare_d_exports as n, make as r, Interface as t };
-//# sourceMappingURL=cloudflare-tdjNS8vE.d.mts.map
+//# sourceMappingURL=cloudflare-CprjjXfm.d.mts.map

package/dist/{cloudflare-C6ryPlCZ.mjs → cloudflare-D0-J2MfP.mjs}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { a as tokenMethod$1, i as subjectResolver$1, n as manifest$1, r as oauthMethod$1, s as make$1 } from "./auth-Vi-hhXbV.mjs";
+import { a as tokenMethod$1, c as make$1, i as subjectResolver$1, n as manifest$1, o as tokenValidator$1, r as oauthMethod$1 } from "./auth-B0owkrpk.mjs";
 import { Effect } from "effect";
 //#region src/promise/cloudflare-auth.ts
 var cloudflare_auth_exports = /* @__PURE__ */ __exportAll({
@@ -17,10 +17,8 @@ function subjectResolver(options) {
 	return (tokens, accessToken) => Effect.runPromise(resolve(tokens, accessToken));
 }
 function tokenValidator(options) {
-	return (token) => Effect.runPromise(make$1({
-		...options,
-		token
-	}).validateToken());
+	const validate = tokenValidator$1(options);
+	return (token) => Effect.runPromise(validate(token));
 }
 //#endregion
 //#region src/promise/cloudflare.ts
@@ -45,4 +43,4 @@ function make(options) {
 //#endregion
 export { make as n, cloudflare_auth_exports as r, cloudflare_exports as t };
 
-//# sourceMappingURL=cloudflare-C6ryPlCZ.mjs.map
+//# sourceMappingURL=cloudflare-D0-J2MfP.mjs.map

package/dist/cloudflare-D0-J2MfP.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-D0-J2MfP.mjs","names":["EffectAuth.manifest","EffectAuth.oauthMethod","EffectAuth.tokenMethod","EffectAuth.subjectResolver","EffectAuth.tokenValidator","Cloudflare.make"],"sources":["../src/promise/cloudflare-auth.ts","../src/promise/cloudflare.ts"],"sourcesContent":["import type * as oauth from \"oauth4webapi\";\nimport { Effect } from \"effect\";\n\nimport type * as ProviderAuth from \"../auth/manifest.ts\";\nimport type * as Secret from \"../auth/secret.ts\";\nimport * as EffectAuth from \"../providers/cloudflare/auth.ts\";\n\nexport const manifest = EffectAuth.manifest;\nexport const oauthMethod = EffectAuth.oauthMethod;\nexport const tokenMethod = EffectAuth.tokenMethod;\nexport type {\n  CredentialTarget,\n  OAuthMethodOptions,\n  SubjectResolverOptions,\n  TokenValidatorOptions,\n} from \"../providers/cloudflare/auth.ts\";\n\nexport function subjectResolver(\n  options: EffectAuth.SubjectResolverOptions,\n): ProviderAuth.AsyncOAuthSubjectResolver {\n  const resolve = EffectAuth.subjectResolver(options);\n  return (tokens: oauth.TokenEndpointResponse, accessToken: Secret.Value) =>\n    Effect.runPromise(resolve(tokens, accessToken));\n}\n\nexport function tokenValidator(\n  options: EffectAuth.TokenValidatorOptions,\n): (token: Secret.Value) => Promise<ProviderAuth.TokenValidation> {\n  const validate = EffectAuth.tokenValidator(options);\n  return (token) => Effect.runPromise(validate(token));\n}\n","import { Effect } from \"effect\";\n\nimport type * as ProviderAuth from \"../auth/manifest.ts\";\nimport type * as DnsProvider from \"../provider/provider.ts\";\nimport * as Cloudflare from \"../providers/cloudflare/index.ts\";\n\nexport * as Auth from \"./cloudflare-auth.ts\";\nexport type {\n  Account,\n  Fetch,\n  ListZonesInput,\n  Options,\n  Zone,\n} from \"../providers/cloudflare/client.ts\";\n\nexport interface Interface extends DnsProvider.AsyncInterface {\n  readonly listAccounts: () => Promise<ReadonlyArray<Cloudflare.Account>>;\n  readonly listZones: (\n    input?: Cloudflare.Client.ListZonesInput,\n  ) => Promise<ReadonlyArray<Cloudflare.Zone>>;\n  readonly validateToken: () => Promise<ProviderAuth.TokenValidation>;\n}\n\n/** Creates a Promise-compatible facade over the Effect-native Cloudflare client. */\nexport function make(options: Cloudflare.Client.Options): Interface {\n  const client = Cloudflare.make(options);\n  return {\n    id: client.id,\n    createRecord: (zone, record) => Effect.runPromise(client.createRecord(zone, record)),\n    deleteRecord: (zone, providerRecordId) =>\n      Effect.runPromise(client.deleteRecord(zone, providerRecordId)),\n    getRecord: (zone, providerRecordId) =>\n      Effect.runPromise(client.getRecord(zone, providerRecordId)),\n    listAccounts: () => Effect.runPromise(client.listAccounts()),\n    listRecords: (zone) => Effect.runPromise(client.listRecords(zone)),\n    listZones: (input) => Effect.runPromise(client.listZones(input)),\n    validateToken: () => Effect.runPromise(client.validateToken()),\n  };\n}\n"],"mappings":";;;;;;;;;;;AAOA,MAAa,WAAWA;AACxB,MAAa,cAAcC;AAC3B,MAAa,cAAcC;AAQ3B,SAAgB,gBACd,SACwC;CACxC,MAAM,UAAUC,kBAA2B,OAAO;CAClD,QAAQ,QAAqC,gBAC3C,OAAO,WAAW,QAAQ,QAAQ,WAAW,CAAC;AAClD;AAEA,SAAgB,eACd,SACgE;CAChE,MAAM,WAAWC,iBAA0B,OAAO;CAClD,QAAQ,UAAU,OAAO,WAAW,SAAS,KAAK,CAAC;AACrD;;;;;;;;ACNA,SAAgB,KAAK,SAA+C;CAClE,MAAM,SAASC,OAAgB,OAAO;CACtC,OAAO;EACL,IAAI,OAAO;EACX,eAAe,MAAM,WAAW,OAAO,WAAW,OAAO,aAAa,MAAM,MAAM,CAAC;EACnF,eAAe,MAAM,qBACnB,OAAO,WAAW,OAAO,aAAa,MAAM,gBAAgB,CAAC;EAC/D,YAAY,MAAM,qBAChB,OAAO,WAAW,OAAO,UAAU,MAAM,gBAAgB,CAAC;EAC5D,oBAAoB,OAAO,WAAW,OAAO,aAAa,CAAC;EAC3D,cAAc,SAAS,OAAO,WAAW,OAAO,YAAY,IAAI,CAAC;EACjE,YAAY,UAAU,OAAO,WAAW,OAAO,UAAU,KAAK,CAAC;EAC/D,qBAAqB,OAAO,WAAW,OAAO,cAAc,CAAC;CAC/D;AACF"}

package/dist/cloudflare.d.mts

@@ -1,3 +1,3 @@
-import { c as Account, d as ListZonesInput, f as Options, l as Fetch, p as Zone } from "./index-CS9Rl5LQ.mjs";
-import { i as cloudflare_auth_d_exports, r as make, t as Interface } from "./cloudflare-tdjNS8vE.mjs";
+import { d as Fetch, h as Zone, m as Options, p as ListZonesInput, u as Account } from "./index-D2howbNz.mjs";
+import { i as cloudflare_auth_d_exports, r as make, t as Interface } from "./cloudflare-CprjjXfm.mjs";
 export { type Account, cloudflare_auth_d_exports as Auth, type Fetch, Interface, type ListZonesInput, type Options, type Zone, make };

package/dist/cloudflare.mjs

@@ -1,2 +1,2 @@
-import { n as make, r as cloudflare_auth_exports } from "./cloudflare-C6ryPlCZ.mjs";
+import { n as make, r as cloudflare_auth_exports } from "./cloudflare-D0-J2MfP.mjs";
 export { cloudflare_auth_exports as Auth, make };

package/dist/effect-cloudflare.d.mts

@@ -1,2 +1,2 @@
-import { c as Account, d as ListZonesInput, f as Options, h as make, i as auth_d_exports, l as Fetch, m as client_d_exports, p as Zone, u as Interface } from "./index-CS9Rl5LQ.mjs";
+import { _ as make, d as Fetch, f as Interface, g as client_d_exports, h as Zone, m as Options, o as auth_d_exports, p as ListZonesInput, u as Account } from "./index-D2howbNz.mjs";
 export { type Account, auth_d_exports as Auth, client_d_exports as Client, type Fetch, type Interface, type ListZonesInput, type Options, type Zone, make };

package/dist/effect-cloudflare.mjs

@@ -1,2 +1,2 @@
-import { o as client_exports, s as make, t as auth_exports } from "./auth-Vi-hhXbV.mjs";
+import { c as make, s as client_exports, t as auth_exports } from "./auth-B0owkrpk.mjs";
 export { auth_exports as Auth, client_exports as Client, make };

package/dist/effect.d.mts

@@ -1,5 +1,5 @@
 import { B as domain_name_d_exports, F as dns_record_d_exports, H as Error$3, N as Type, U as invalid_input_d_exports, d as Value, f as secret_d_exports, h as Error$2, l as TokenValidation, u as manifest_d_exports, v as provider_d_exports } from "./manifest-CP85ePFn.mjs";
-import { t as index_d_exports } from "./index-CS9Rl5LQ.mjs";
+import { t as index_d_exports } from "./index-D2howbNz.mjs";
 import { t as index_d_exports$1 } from "./index-CEzk2gbZ.mjs";
 import { A as Service$2, B as Error$4, C as types_d_exports, D as oauth_state_d_exports, F as credential_d_exports, H as AuthorizationError, P as Service$1, Q as ProviderAuthorization, R as Service, U as Connection, V as error_d_exports, W as Grant, Y as connection_d_exports, et as authorization_d_exports, g as DnsPlan, j as authorization_d_exports$1, l as resolver_d_exports, p as receipt_d_exports, z as connection_d_exports$1 } from "./resolver-BHPsADzE.mjs";
 import { E as canonical_json_d_exports, T as CryptoError, b as zones_d_exports, g as AuthorizeError, h as deletion_d_exports, i as cloudflare_doh_d_exports, k as connection_lifecycle_d_exports, n as verify_d_exports, o as doh_d_exports, v as plan_d_exports, w as oauth_d_exports, x as selection_d_exports } from "./verify-B80xCBh2.mjs";

package/dist/effect.mjs

@@ -1,7 +1,7 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
 import { E as domain_name_exports, S as provider_exports, g as dns_record_exports, k as invalid_input_exports } from "./dns-record-C_KwGPLf.mjs";
-import { o as client_exports, s as make, t as auth_exports } from "./auth-Vi-hhXbV.mjs";
-import { C as plan_exports, F as zones_exports, L as token_exports, N as types_exports, P as selection_exports, V as manifest_exports, W as oauth_exports, Z as authorization_exports, _ as deletion_exports, a as doh_exports, ct as connection_exports, dt as version, n as verify_exports, q as canonical_json_exports, r as cloudflare_doh_exports, s as dns_data_exports, tt as connection_lifecycle_exports, y as connection_authorization_exports } from "./verify-BjrR_4NF.mjs";
+import { c as make, s as client_exports, t as auth_exports, u as zones_exports } from "./auth-B0owkrpk.mjs";
+import { B as manifest_exports, C as plan_exports, I as token_exports, K as canonical_json_exports, N as types_exports, P as selection_exports, U as oauth_exports, X as authorization_exports, _ as deletion_exports, a as doh_exports, et as connection_lifecycle_exports, n as verify_exports, r as cloudflare_doh_exports, s as dns_data_exports, st as connection_exports, ut as version, y as connection_authorization_exports } from "./verify-BXOvXE20.mjs";
 import { S as error_exports, c as oauth_state_exports, d as authorization_exports$1, h as credential_exports, i as resolver_exports, y as connection_exports$1 } from "./resolver-tEXpKxmH.mjs";
 import { l as secret_exports, n as make$1, r as auth_exports$1, t as client_exports$1 } from "./client-BnD7QLRF.mjs";
 import { n as receipt_exports } from "./receipt-CGSnfZQ6.mjs";

package/dist/{index-CS9Rl5LQ.d.mts → index-D2howbNz.d.mts}

@@ -7,7 +7,7 @@ declare const Account$1: Schema.Struct<{
 }>;
 interface Account$1 extends Schema.Schema.Type<typeof Account$1> {}
 declare namespace client_d_exports {
-  export { Account, Fetch, Interface, ListZonesInput, Options, Zone, make };
+  export { Account, Fetch, Interface, ListZonesInput, Options, Zone, discoverAuthorizationAccount, make, validateDomainToken };
 }
 type Fetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
 /** Configuration for an Effect-native Cloudflare authoritative-DNS client. */
@@ -38,10 +38,32 @@ interface Interface extends Interface$1 {
   readonly listZones: (input?: ListZonesInput) => Effect.Effect<ReadonlyArray<Zone>, Error>;
   readonly validateToken: () => Effect.Effect<TokenValidation, Error>;
 }
+interface CredentialOptions$1 {
+  readonly baseUrl?: string;
+  readonly fetch?: Fetch;
+  readonly token: Value;
+}
+interface DomainCredentialOptions extends CredentialOptions$1 {
+  readonly capabilities: TokenValidation["capabilities"];
+  readonly domain: DomainName;
+  readonly tokenKind?: "account" | "user";
+}
+declare const discoverAuthorizationAccount: (options: CredentialOptions$1 & {
+  readonly domain: DomainName;
+}) => Effect.Effect<{
+  readonly id: string;
+  readonly name: string;
+}, Error, never>;
+declare const validateDomainToken: (options: DomainCredentialOptions) => Effect.Effect<{
+  accountId: string;
+  capabilities: readonly ("dns:read" | "dns:write")[];
+  expiresAt: Date | null;
+  scopes: never[];
+}, Error, never>;
 /** Creates an Effect-native Cloudflare client without owning the credential lifecycle. */
 declare function make(options: Options): Interface;
 declare namespace auth_d_exports {
-  export { OAuthMethodOptions, SubjectResolverOptions, manifest, oauthMethod, subjectResolver, tokenMethod, tokenValidator };
+  export { CredentialTarget, OAuthMethodOptions, SubjectResolverOptions, TokenValidatorOptions, manifest, oauthMethod, subjectResolver, tokenMethod, tokenValidator };
 }
 /** Describes Cloudflare's caller-created API-token authorization method. */
 declare function tokenMethod(capabilities: TokenValidation["capabilities"]): Extract<Manifest["methods"][number], {
@@ -58,14 +80,33 @@ interface OAuthMethodOptions {
 declare function oauthMethod(options: OAuthMethodOptions): OAuthMethod;
 /** Creates the Cloudflare token and OAuth authorization manifest. */
 declare function manifest(options: OAuthMethodOptions): Manifest;
-interface SubjectResolverOptions extends Omit<Options, "token" | "tokenKind"> {}
+type CredentialOptions = Omit<Options, "accountId" | "token" | "tokenKind">;
+/** Selects an explicit Cloudflare account or discovers it from an authorized domain. */
+type CredentialTarget = {
+  readonly accountId: string;
+  readonly domain?: never;
+} | {
+  readonly accountId?: never;
+  readonly domain: DomainName;
+};
+type SubjectResolverOptions = CredentialOptions & CredentialTarget;
+/** Configuration for validating a Cloudflare token against an account or authorized domain. */
+type TokenValidatorOptions = CredentialOptions & ({
+  readonly accountId: string;
+  readonly domain?: never;
+  readonly tokenKind?: "account" | "user";
+} | {
+  readonly accountId?: never;
+  readonly domain: DomainName;
+  readonly tokenKind?: "account" | "user";
+});
 /** Resolves the Cloudflare account selected by a completed OAuth grant. */
 declare function subjectResolver(options: SubjectResolverOptions): OAuthSubjectResolver;
 /** Creates a host callback that validates a Cloudflare API token. */
-declare function tokenValidator(options: Omit<Options, "token">): (token: Value) => ReturnType<Interface["validateToken"]>;
+declare function tokenValidator(options: TokenValidatorOptions): (token: Value) => ReturnType<Interface["validateToken"]>;
 declare namespace index_d_exports {
   export { Account, auth_d_exports as Auth, client_d_exports as Client, Fetch, Interface, ListZonesInput, Options, Zone, make };
 }
 //#endregion
-export { manifest as a, Account as c, ListZonesInput as d, Options as f, make as h, auth_d_exports as i, Fetch as l, client_d_exports as m, OAuthMethodOptions as n, oauthMethod as o, Zone as p, SubjectResolverOptions as r, tokenMethod as s, index_d_exports as t, Interface as u };
-//# sourceMappingURL=index-CS9Rl5LQ.d.mts.map
+export { make as _, TokenValidatorOptions as a, oauthMethod as c, Fetch as d, Interface as f, client_d_exports as g, Zone as h, SubjectResolverOptions as i, tokenMethod as l, Options as m, CredentialTarget as n, auth_d_exports as o, ListZonesInput as p, OAuthMethodOptions as r, manifest as s, index_d_exports as t, Account as u };
+//# sourceMappingURL=index-D2howbNz.d.mts.map

package/dist/index.d.mts

@@ -1,5 +1,5 @@
 import { A as Schema$1, C as DnsRecord, D as Observed, E as Ns, I as equals, L as parse, M as Txt, N as Type, O as Opaque, P as data, R as DomainName, S as Cname, T as Mx, U as invalid_input_d_exports, V as parse$1, a as OAuthClientConfiguration, b as Aaaa, c as Schema, d as Value, f as secret_d_exports, i as Method, j as Srv, k as RequirementMetadata, l as TokenValidation, m as CreateResult, o as OAuthMethod, p as AsyncInterface, r as Manifest, t as AsyncOAuthSubjectResolver, w as Encoded, x as Caa, y as A, z as Schema$2 } from "./manifest-CP85ePFn.mjs";
-import { n as cloudflare_d_exports } from "./cloudflare-tdjNS8vE.mjs";
+import { n as cloudflare_d_exports } from "./cloudflare-CprjjXfm.mjs";
 import { $ as Schema$4, G as OAuthContinuation, H as AuthorizationError, I as AsyncInterface$1, J as assertGrant, K as Schema$3, M as AsyncInterface$3, O as AsyncInterface$2, Q as ProviderAuthorization, S as encodeReceipt, U as Connection, W as Grant, X as encode, Z as Capability, _ as Operation, b as Schema$5, g as DnsPlan, h as Authorization, m as ApplyReceipt, n as AsyncInterface$4, o as Query, q as StoredCredential, r as AsyncResolution, t as Answer, tt as encode$1, u as AsyncInterface$6, v as PlanAuthorization, w as AsyncInterface$5, x as encode$2, y as Receipt } from "./resolver-BHPsADzE.mjs";
 import { A as updateGrant$1, C as Fetch$1, D as DetachResult, O as Error, S as BeginInput$1, _ as CreateInput$1, a as Options$3, b as zones_d_exports, c as Authorization$1, d as Operation$1, f as PartialError, l as CreateError, m as Receipt$1, p as Plan, r as Options$2, s as ApplyError, t as Result, u as Error$1, x as selection_d_exports, y as renderManualInstructions$1 } from "./verify-B80xCBh2.mjs";
 import { r as vercel_d_exports } from "./vercel-D-E2aqb1.mjs";

package/dist/index.mjs

@@ -1,7 +1,8 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
 import { D as parse$1, O as Error$1, _ as equals, a as Mx, c as Opaque, d as Srv, f as Txt, i as Cname, k as invalid_input_exports, l as RequirementMetadata, m as data, n as Aaaa, o as Ns, p as Type, r as Caa, s as Observed, t as A, u as Schema$1, v as parse, w as Schema$2, x as layerFromAsync, y as Error$2 } from "./dns-record-C_KwGPLf.mjs";
-import { t as cloudflare_exports } from "./cloudflare-C6ryPlCZ.mjs";
-import { $ as encode$1, A as decodeReceipt$1, B as decode$6, D as Receipt, E as Operation, F as zones_exports, G as refresh$1, H as begin$1, I as connect$1, J as webCryptoLayer, K as revoke$1, M as encodeReceipt, O as Schema$6, P as selection_exports, Q as decode$5, R as Method, S as create$3, T as Authorization, U as complete$1, X as Schema$4, Y as Capability, at as Grant, b as apply$3, c as Authorization$1, d as PartialError, dt as version, et as Error$3, f as Plan, g as create$2, h as authorize$2, i as toAsync, it as AuthorizationError, j as encode$2, k as decode$7, l as Error$4, lt as decode$4, m as apply$2, nt as detach$1, o as toAsync$1, ot as Schema$3, p as Receipt$1, rt as updateGrant$1, st as assertGrant, t as record$1, u as Operation$1, ut as encode, v as authorize$4, w as renderManualInstructions$1, x as authorize$3, z as Schema$5 } from "./verify-BjrR_4NF.mjs";
+import { u as zones_exports } from "./auth-B0owkrpk.mjs";
+import { t as cloudflare_exports } from "./cloudflare-D0-J2MfP.mjs";
+import { $ as Error$3, A as decodeReceipt$1, D as Receipt, E as Operation, F as connect$1, G as revoke$1, H as complete$1, J as Capability, L as Method, M as encodeReceipt, O as Schema$6, P as selection_exports, Q as encode$1, R as Schema$5, S as create$3, T as Authorization, V as begin$1, W as refresh$1, Y as Schema$4, Z as decode$5, at as Schema$3, b as apply$3, c as Authorization$1, ct as decode$4, d as PartialError, f as Plan, g as create$2, h as authorize$2, i as toAsync, it as Grant, j as encode$2, k as decode$7, l as Error$4, lt as encode, m as apply$2, nt as updateGrant$1, o as toAsync$1, ot as assertGrant, p as Receipt$1, q as webCryptoLayer, rt as AuthorizationError, t as record$1, tt as detach$1, u as Operation$1, ut as version, v as authorize$4, w as renderManualInstructions$1, x as authorize$3, z as decode$6 } from "./verify-BXOvXE20.mjs";
 import { b as layerFromAsync$1, f as layerFromAsync$2, g as layerFromAsync$3, r as layerFromAsync$5, s as layerFromAsync$4 } from "./resolver-tEXpKxmH.mjs";
 import { l as secret_exports } from "./client-BnD7QLRF.mjs";
 import { n as vercel_exports } from "./vercel-DD89DCqH.mjs";