domainkit 0.1.0 → 0.2.0

package/dist/testing.mjs

@@ -1,83 +1,166 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { C as toAsync$7, D as parse, b as Service } from "./dns-record-C_KwGPLf.mjs";
-import { _ as toAsync$10, a as toAsync$11, l as toAsync$12, m as Service$3, n as Service$4, o as Service$5, p as toAsync$9, u as Service$2, v as Service$1, x as toAsync$8 } from "./resolver-tEXpKxmH.mjs";
-import { r as toAsync$13, t as Service$6 } from "./receipt-CGSnfZQ6.mjs";
-import { Effect, Layer } from "effect";
-//#region src/stores/in-memory-connection.ts
-var in_memory_connection_exports = /* @__PURE__ */ __exportAll({
-	layer: () => layer$6,
-	make: () => make$6,
-	toAsync: () => toAsync$6
+import { M as Service, O as parse, _ as equals, b as Service$1, j as Error$1, v as parse$1, w as toAsync$2, x as fromAsync$1, y as Error$2 } from "./dns-record-BLeqo56C.mjs";
+import { i as webCryptoLayer } from "./canonical-json-CpvqGMcr.mjs";
+import { S as create, _ as PartialApplyError, b as apply, d as apply$1, f as authorize$1, h as ConflictError, i as toAsync$3, n as Service$2, p as create$1, v as StaleError, x as authorize, y as Target } from "./resolver-CxE-VDw4.mjs";
+import { Effect, Layer, Ref, Schema, Semaphore } from "effect";
+//#region src/stores/in-memory-lifecycle-repository.ts
+var in_memory_lifecycle_repository_exports = /* @__PURE__ */ __exportAll({
+	layer: () => layer$2,
+	make: () => make$3
 });
-function make$6() {
-	const connections = /* @__PURE__ */ new Map();
-	return {
-		delete: Effect.fn("InMemoryConnectionStore.delete")((connectionId) => Effect.sync(() => void connections.delete(connectionId))),
-		find: Effect.fn("InMemoryConnectionStore.find")((ownerId, authorizationId) => Effect.sync(() => [...connections.values()].find((connection) => connection.ownerId === ownerId && connection.authorizationId === authorizationId) ?? null)),
-		get: Effect.fn("InMemoryConnectionStore.get")((connectionId) => Effect.sync(() => connections.get(connectionId) ?? null)),
-		listByAuthorizationId: Effect.fn("InMemoryConnectionStore.listByAuthorizationId")((authorizationId) => Effect.sync(() => [...connections.values()].filter((connection) => connection.authorizationId === authorizationId))),
-		put: Effect.fn("InMemoryConnectionStore.put")((connection) => Effect.sync(() => void connections.set(connection.id, connection)))
-	};
+function missing(operation, message) {
+	return new Error$1({
+		category: "storage",
+		message,
+		operation,
+		retry: "never"
+	});
 }
-const layer$6 = () => Layer.succeed(Service$1, make$6());
-const toAsync$6 = (store = make$6()) => toAsync$8(store);
-//#endregion
-//#region src/stores/in-memory-authorization.ts
-var in_memory_authorization_exports = /* @__PURE__ */ __exportAll({
-	layer: () => layer$5,
-	make: () => make$5,
-	toAsync: () => toAsync$5
-});
-const accountKey = (providerId, accountId) => `${providerId}\0${accountId}`;
-function make$5() {
-	const authorizations = /* @__PURE__ */ new Map();
-	const accounts = /* @__PURE__ */ new Map();
-	return {
-		delete: Effect.fn("InMemoryProviderAuthorizationStore.delete")((authorizationId) => Effect.sync(() => {
-			const authorization = authorizations.get(authorizationId);
-			if (authorization !== void 0) {
-				accounts.delete(accountKey(authorization.providerId, authorization.accountId));
-				authorizations.delete(authorizationId);
+function make$3(options = {}) {
+	const state = Effect.runSync(Ref.make(/* @__PURE__ */ new Map()));
+	const mutations = Semaphore.makeUnsafe(1);
+	const serialize = (effect) => mutations.withPermit(effect);
+	const commit = Effect.fn("InMemoryAuthorizationLifecycleRepository.commit")(function* (operation, aggregate) {
+		if (options.beforeCommit !== void 0) yield* options.beforeCommit(operation, aggregate);
+		yield* Ref.update(state, (entries) => {
+			const next = new Map(entries);
+			if (aggregate === null) return next;
+			next.set(aggregate.authorization.id, aggregate);
+			return next;
+		});
+	});
+	const remove = Effect.fn("InMemoryAuthorizationLifecycleRepository.remove")(function* (authorizationId) {
+		if (options.beforeCommit !== void 0) yield* options.beforeCommit("remove", null);
+		yield* Ref.update(state, (entries) => {
+			const next = new Map(entries);
+			next.delete(authorizationId);
+			return next;
+		});
+	});
+	const get = Effect.fn("AuthorizationLifecycleRepository.get")((authorizationId) => Ref.get(state).pipe(Effect.map((entries) => entries.get(authorizationId) ?? null)));
+	const getByConnectionId = Effect.fn("AuthorizationLifecycleRepository.getByConnectionId")((connectionId) => Ref.get(state).pipe(Effect.map((entries) => [...entries.values()].find((aggregate) => aggregate.bindings.some((binding) => binding.id === connectionId)) ?? null)));
+	const finishRevocation = Effect.fn("AuthorizationLifecycleRepository.finishRevocation")(function* (aggregate, revoke) {
+		const pending = {
+			...aggregate,
+			authorization: {
+				...aggregate.authorization,
+				revocation: aggregate.authorization.revocation._tag === "Pending" ? aggregate.authorization.revocation : {
+					_tag: "Pending",
+					requestedAt: /* @__PURE__ */ new Date()
+				}
 			}
-		})),
-		findByProviderAccount: Effect.fn("InMemoryProviderAuthorizationStore.findByProviderAccount")((providerId, accountId) => Effect.sync(() => {
-			const id = accounts.get(accountKey(providerId, accountId));
-			return id === void 0 ? null : authorizations.get(id) ?? null;
-		})),
-		get: Effect.fn("InMemoryProviderAuthorizationStore.get")((authorizationId) => Effect.sync(() => authorizations.get(authorizationId) ?? null)),
-		put: Effect.fn("InMemoryProviderAuthorizationStore.put")((authorization) => Effect.sync(() => {
-			authorizations.set(authorization.id, authorization);
-			accounts.set(accountKey(authorization.providerId, authorization.accountId), authorization.id);
-		}))
-	};
+		};
+		yield* commit("prepareRevocation", pending);
+		yield* revoke(pending);
+		yield* remove(pending.authorization.id);
+		return {
+			authorizationId: pending.authorization.id,
+			remainingBindings: 0,
+			revokedAuthorization: true
+		};
+	});
+	return Service.of({
+		bind: Effect.fn("AuthorizationLifecycleRepository.bind")((authorizationId, binding) => serialize(Effect.gen(function* () {
+			const aggregate = yield* get(authorizationId);
+			if (aggregate === null) return yield* missing("bind", "Authorization aggregate does not exist");
+			const next = {
+				...aggregate,
+				bindings: [...aggregate.bindings.filter((candidate) => candidate.id !== binding.id), binding]
+			};
+			yield* commit("bind", next);
+			return next;
+		}))),
+		connect: Effect.fn("AuthorizationLifecycleRepository.connect")((aggregate) => serialize(Effect.gen(function* () {
+			yield* commit("connect", aggregate);
+			return aggregate;
+		}))),
+		detach: ({ connectionId, revoke }) => serialize(Effect.gen(function* () {
+			const aggregate = yield* getByConnectionId(connectionId);
+			if (aggregate === null) return yield* missing("detach", "Connection binding does not exist");
+			const remaining = aggregate.bindings.filter((binding) => binding.id !== connectionId);
+			if (remaining.length > 0) {
+				yield* commit("detachBinding", {
+					...aggregate,
+					bindings: remaining
+				});
+				return {
+					authorizationId: aggregate.authorization.id,
+					remainingBindings: remaining.length,
+					revokedAuthorization: false
+				};
+			}
+			return yield* finishRevocation(aggregate, revoke);
+		}).pipe(Effect.withSpan("AuthorizationLifecycleRepository.detach"))),
+		findByProviderAccount: Effect.fn("AuthorizationLifecycleRepository.findByProviderAccount")((providerId, providerAccountId) => Ref.get(state).pipe(Effect.map((entries) => [...entries.values()].find(({ authorization }) => authorization.providerId === providerId && authorization.providerAccountId === providerAccountId) ?? null))),
+		get,
+		getByConnectionId,
+		promoteEvidence: Effect.fn("AuthorizationLifecycleRepository.promoteEvidence")((authorizationId, evidence) => serialize(Effect.gen(function* () {
+			const aggregate = yield* get(authorizationId);
+			if (aggregate === null) return yield* missing("promoteEvidence", "Authorization aggregate does not exist");
+			const byCapability = new Map(aggregate.authorization.capabilityEvidence.map((item) => [item.capability, item]));
+			for (const item of evidence) byCapability.set(item.capability, item);
+			const next = {
+				...aggregate,
+				authorization: {
+					...aggregate.authorization,
+					capabilityEvidence: [...byCapability.values()]
+				}
+			};
+			yield* commit("promoteEvidence", next);
+			return next;
+		}))),
+		recover: ({ authorizationId, revoke }) => serialize(Effect.gen(function* () {
+			const aggregate = yield* get(authorizationId);
+			if (aggregate === null) return yield* missing("recover", "Authorization aggregate does not exist");
+			if (aggregate.authorization.revocation._tag !== "Pending") return yield* missing("recover", "Authorization is not awaiting revocation");
+			return yield* finishRevocation(aggregate, revoke);
+		}).pipe(Effect.withSpan("AuthorizationLifecycleRepository.recover"))),
+		rotate: Effect.fn("AuthorizationLifecycleRepository.rotate")((authorizationId, credential, expiresAt) => serialize(Effect.gen(function* () {
+			const aggregate = yield* get(authorizationId);
+			if (aggregate === null) return yield* missing("rotate", "Authorization aggregate does not exist");
+			const next = {
+				...aggregate,
+				authorization: {
+					...aggregate.authorization,
+					expiresAt
+				},
+				credential
+			};
+			yield* commit("rotate", next);
+			return next;
+		})))
+	});
 }
-const layer$5 = () => Layer.succeed(Service$2, make$5());
-const toAsync$5 = (store = make$5()) => toAsync$9(store);
+const layer$2 = (options = {}) => Layer.sync(Service, () => make$3(options));
 //#endregion
-//#region src/stores/in-memory-credential.ts
-var in_memory_credential_exports = /* @__PURE__ */ __exportAll({
-	layer: () => layer$4,
-	make: () => make$4,
-	toAsync: () => toAsync$4
-});
-function make$4() {
-	const credentials = /* @__PURE__ */ new Map();
+//#region src/stores/in-memory-continuation.ts
+var in_memory_continuation_exports = /* @__PURE__ */ __exportAll({ make: () => make$2 });
+function make$2() {
+	const state = Effect.runSync(Ref.make(/* @__PURE__ */ new Map()));
 	return {
-		delete: Effect.fn("InMemoryCredentialStore.delete")((authorizationId) => Effect.sync(() => void credentials.delete(authorizationId))),
-		get: Effect.fn("InMemoryCredentialStore.get")((authorizationId) => Effect.sync(() => credentials.get(authorizationId) ?? null)),
-		put: Effect.fn("InMemoryCredentialStore.put")((authorizationId, credential) => Effect.sync(() => void credentials.set(authorizationId, credential)))
+		consume: Effect.fn("ConnectionContinuations.consume")(function* (id, now) {
+			return yield* Ref.modify(state, (entries) => {
+				const continuation = entries.get(id);
+				const next = new Map(entries);
+				next.delete(id);
+				return [continuation !== void 0 && continuation.expiresAt > now ? continuation : null, next];
+			});
+		}),
+		put: Effect.fn("ConnectionContinuations.put")((continuation) => Ref.update(state, (entries) => {
+			const next = new Map(entries);
+			next.set(continuation.id, continuation);
+			return next;
+		}))
 	};
 }
-const layer$4 = () => Layer.succeed(Service$3, make$4());
-const toAsync$4 = (store = make$4()) => toAsync$10(store);
 //#endregion
 //#region src/provider/in-memory.ts
 var in_memory_exports = /* @__PURE__ */ __exportAll({
-	layer: () => layer$3,
-	make: () => make$3,
-	toAsync: () => toAsync$3
+	layer: () => layer$1,
+	make: () => make$1,
+	toAsync: () => toAsync$1
 });
-function make$3(options = {}) {
+function make$1(options = {}) {
 	const id = options.id ?? "memory";
 	const records = /* @__PURE__ */ new Map();
 	const recordIds = /* @__PURE__ */ new Map();
@@ -105,61 +188,250 @@ function make$3(options = {}) {
 		getRecord: Effect.fn("InMemoryDnsProvider.getRecord")((_zone, providerRecordId) => Effect.sync(() => recordIds.get(providerRecordId) ?? null))
 	};
 }
-const layer$3 = (options = {}) => Layer.succeed(Service, make$3(options));
-const toAsync$3 = (options = {}) => toAsync$7(make$3(options));
+const layer$1 = (options = {}) => Layer.succeed(Service$1, make$1(options));
+const toAsync$1 = (options = {}) => toAsync$2(make$1(options));
 //#endregion
 //#region src/verification/in-memory.ts
 var in_memory_exports$1 = /* @__PURE__ */ __exportAll({
-	layer: () => layer$2,
-	make: () => make$2,
-	toAsync: () => toAsync$2
+	layer: () => layer,
+	make: () => make,
+	toAsync: () => toAsync
 });
-function make$2(resolve) {
+function make(resolve) {
 	return { resolve: Effect.fn("InMemoryDnsResolver.resolve")((query) => Effect.suspend(() => {
 		const resolution = resolve(query);
 		return Effect.isEffect(resolution) ? resolution : Effect.succeed(resolution);
 	})) };
 }
-const layer$2 = (resolve) => Layer.succeed(Service$4, make$2(resolve));
-const toAsync$2 = (resolve) => toAsync$11(make$2(resolve));
+const layer = (resolve) => Layer.succeed(Service$2, make(resolve));
+const toAsync = (resolve) => toAsync$3(make(resolve));
 //#endregion
-//#region src/stores/in-memory-oauth-state.ts
-var in_memory_oauth_state_exports = /* @__PURE__ */ __exportAll({
-	layer: () => layer$1,
-	make: () => make$1,
-	toAsync: () => toAsync$1
+//#region src/testing/provider-conformance.ts
+var provider_conformance_exports = /* @__PURE__ */ __exportAll({
+	Error: () => Error,
+	fromAsync: () => fromAsync,
+	run: () => run
 });
-function make$1() {
-	const continuations = /* @__PURE__ */ new Map();
-	return {
-		put: Effect.fn("InMemoryOAuthStateStore.put")((continuation) => Effect.sync(() => void continuations.set(continuation.stateHash, continuation))),
-		consume: Effect.fn("InMemoryOAuthStateStore.consume")((stateHash, now) => Effect.sync(() => {
-			const continuation = continuations.get(stateHash) ?? null;
-			if (continuation === null) return null;
-			continuations.delete(stateHash);
-			return continuation.expiresAt > now ? continuation : null;
-		}))
-	};
+var Error = class extends Schema.TaggedError()("ProviderConformanceError", {
+	case: Schema.String,
+	message: Schema.String,
+	providerId: Schema.String
+}) {};
+/** Adapt a fresh Promise-shaped provider factory for the Effect-native conformance runner. */
+function fromAsync(makeProvider) {
+	return () => Effect.sync(() => fromAsync$1(makeProvider()));
 }
-const layer$1 = () => Layer.succeed(Service$5, make$1());
-const toAsync$1 = (store = make$1()) => toAsync$12(store);
-//#endregion
-//#region src/stores/in-memory-receipt.ts
-var in_memory_receipt_exports = /* @__PURE__ */ __exportAll({
-	layer: () => layer,
-	make: () => make,
-	toAsync: () => toAsync
-});
-function make() {
-	const receipts = /* @__PURE__ */ new Map();
+const cases = [
+	"create-readback-cleanup",
+	"exact-noop",
+	"conflict",
+	"stale-plan",
+	"partial-apply-cleanup"
+];
+/** Run the deterministic offline contract every DomainKit DNS adapter must satisfy. */
+const run = Effect.fn("ProviderConformance.run")(function* (input) {
+	const makeProvider = () => Effect.suspend(input.makeProvider).pipe(Effect.catchDefect((cause) => Effect.fail(new Error({
+		case: "factory",
+		message: cause instanceof globalThis.Error ? cause.message : "Provider factory failed",
+		providerId: "unknown"
+	}))));
+	const first = yield* makeProvider();
+	const providerId = first.id;
+	const prefix = input.prefix ?? "domainkit-conformance";
+	yield* createReadbackCleanup(first, input.zone, prefix);
+	yield* exactNoop(yield* makeProvider(), input.zone, prefix);
+	yield* conflict(yield* makeProvider(), input.zone, prefix);
+	yield* stalePlan(yield* makeProvider(), input.zone, prefix);
+	yield* partialApplyCleanup(yield* makeProvider(), input.zone, prefix);
 	return {
-		get: Effect.fn("InMemoryReceiptStore.get")((planDigest) => Effect.sync(() => receipts.get(planDigest) ?? null)),
-		put: Effect.fn("InMemoryReceiptStore.put")((receipt) => Effect.sync(() => void receipts.set(receipt.planDigest, receipt)))
+		cases,
+		providerId,
+		zone: input.zone
 	};
+});
+function createReadbackCleanup(provider, zone, prefix) {
+	const requirements = createRequirements(zone, prefix);
+	let cleanupRecordIds = [];
+	return Effect.gen(function* () {
+		const { plan } = yield* create({
+			requirements,
+			target: Target.ExactZone({ zone })
+		});
+		yield* requireTags(provider, "create-readback-cleanup", plan.operations, ["create", "create"]);
+		const receipt = yield* apply({
+			authorization: yield* authorize(plan),
+			plan
+		}).pipe(Effect.tapError((failure) => failure instanceof PartialApplyError ? Effect.sync(() => {
+			cleanupRecordIds = providerRecordIds(failure.receipt.operations);
+		}) : Effect.void));
+		cleanupRecordIds = providerRecordIds(receipt.operations);
+		yield* requireCondition(provider, "create-readback-cleanup", receipt.status === "complete" && receipt.operations.every(({ providerRecordId }) => providerRecordId !== null), "apply must return a complete receipt with provider record IDs");
+		const observed = yield* provider.listRecords(zone);
+		yield* requireCondition(provider, "create-readback-cleanup", requirements.every((requirement) => observed.some((record) => record._tag !== "Opaque" && equals(record, requirement))), "listRecords must return every created record, including across provider pages");
+		const deletion = yield* create$1({
+			plan,
+			receipt
+		});
+		yield* requireCondition(provider, "create-readback-cleanup", (yield* apply$1({
+			authorization: yield* authorize$1(deletion),
+			plan: deletion
+		})).status === "complete" && (yield* recordIdsAbsent(provider, zone, cleanupRecordIds)), "receipt-bound cleanup must remove every created record");
+	}).pipe(Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)), Effect.provide(providerLayer(provider)));
+}
+function exactNoop(provider, zone, prefix) {
+	const requirement = cname(zone, `${prefix}-exact`);
+	let cleanupRecordIds = [];
+	return Effect.gen(function* () {
+		const created = yield* provider.createRecord(zone, requirement);
+		cleanupRecordIds = created.providerRecordId === null ? [] : [created.providerRecordId];
+		const { plan } = yield* create({
+			requirements: [requirement],
+			target: Target.ExactZone({ zone })
+		});
+		yield* requireTags(provider, "exact-noop", plan.operations, ["noop"]);
+		yield* requireCondition(provider, "exact-noop", (yield* apply({
+			authorization: yield* authorize(plan),
+			plan
+		})).operations.length === 0, "an exact plan must not create another record");
+		yield* deleteCreated(provider, zone, created.providerRecordId, "exact-noop");
+	}).pipe(Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)), Effect.provide(providerLayer(provider)));
+}
+function conflict(provider, zone, prefix) {
+	const requirement = cname(zone, `${prefix}-conflict`);
+	const occupied = txt(zone, `${prefix}-conflict`, "occupied");
+	let cleanupRecordIds = [];
+	return Effect.gen(function* () {
+		const created = yield* provider.createRecord(zone, occupied);
+		cleanupRecordIds = created.providerRecordId === null ? [] : [created.providerRecordId];
+		const { plan } = yield* create({
+			requirements: [requirement],
+			target: Target.ExactZone({ zone })
+		});
+		yield* requireTags(provider, "conflict", plan.operations, ["conflict"]);
+		yield* requireCondition(provider, "conflict", (yield* apply({
+			authorization: yield* authorize(plan),
+			plan
+		}).pipe(Effect.flip)) instanceof ConflictError, "apply must fail closed on incompatible state");
+		yield* deleteCreated(provider, zone, created.providerRecordId, "conflict");
+	}).pipe(Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)), Effect.provide(providerLayer(provider)));
+}
+function stalePlan(provider, zone, prefix) {
+	const requirement = cname(zone, `${prefix}-stale`);
+	let cleanupRecordIds = [];
+	return Effect.gen(function* () {
+		const { plan } = yield* create({
+			requirements: [requirement],
+			target: Target.ExactZone({ zone })
+		});
+		const authorization = yield* authorize(plan);
+		const created = yield* provider.createRecord(zone, requirement);
+		cleanupRecordIds = created.providerRecordId === null ? [] : [created.providerRecordId];
+		yield* requireCondition(provider, "stale-plan", (yield* apply({
+			authorization,
+			plan
+		}).pipe(Effect.flip)) instanceof StaleError, "apply must reject provider state that changed after authorization");
+		yield* deleteCreated(provider, zone, created.providerRecordId, "stale-plan");
+	}).pipe(Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)), Effect.provide(providerLayer(provider)));
+}
+function partialApplyCleanup(provider, zone, prefix) {
+	let creates = 0;
+	const flaky = Service$1.of({
+		...provider,
+		createRecord: Effect.fn("ProviderConformance.createRecord")((target, record) => {
+			creates += 1;
+			return creates === 1 ? provider.createRecord(target, record) : Effect.fail(new Error$2({
+				message: "injected conformance failure",
+				operation: "createRecord",
+				providerId: provider.id
+			}));
+		})
+	});
+	const requirements = [cname(zone, `${prefix}-partial-one`), txt(zone, `${prefix}-partial-two`, "domainkit")];
+	let cleanupRecordIds = [];
+	return Effect.gen(function* () {
+		const { plan } = yield* create({
+			requirements,
+			target: Target.ExactZone({ zone })
+		});
+		const failure = yield* apply({
+			authorization: yield* authorize(plan),
+			plan
+		}).pipe(Effect.flip);
+		cleanupRecordIds = failure instanceof PartialApplyError ? providerRecordIds(failure.receipt.operations) : [];
+		yield* requireCondition(provider, "partial-apply-cleanup", failure instanceof PartialApplyError && failure.receipt.operations.length === 1, "a later write failure must preserve the first confirmed write in a partial receipt");
+		if (!(failure instanceof PartialApplyError)) return;
+		const deletion = yield* create$1({
+			plan,
+			receipt: failure.receipt
+		}).pipe(Effect.provide(providerLayer(provider)));
+		yield* apply$1({
+			authorization: yield* authorize$1(deletion),
+			plan: deletion
+		}).pipe(Effect.provide(providerLayer(provider)));
+		yield* requireCondition(provider, "partial-apply-cleanup", yield* recordIdsAbsent(provider, zone, cleanupRecordIds), "partial receipt cleanup must remove the confirmed write");
+	}).pipe(Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)), Effect.provide(providerLayer(flaky)));
+}
+function providerRecordIds(operations) {
+	return operations.flatMap(({ providerRecordId }) => providerRecordId === null ? [] : [providerRecordId]);
+}
+function recordIdsAbsent(provider, zone, recordIds) {
+	return Effect.forEach(recordIds, (providerRecordId) => provider.getRecord(zone, providerRecordId)).pipe(Effect.map((records) => records.every((record) => record === null)));
+}
+function bestEffortDelete(provider, zone, recordIds) {
+	return Effect.suspend(() => Effect.forEach(recordIds(), (providerRecordId) => provider.deleteRecord(zone, providerRecordId).pipe(Effect.ignore), { discard: true }));
+}
+function providerLayer(provider) {
+	return Layer.merge(Layer.succeed(Service$1, provider), webCryptoLayer);
+}
+function createRequirements(zone, prefix) {
+	return [cname(zone, `${prefix}-create`), txt(zone, `${prefix}-page`, "domainkit")];
+}
+function cname(zone, label) {
+	return parse$1({
+		_tag: "CNAME",
+		metadata: {
+			ownership: "tester",
+			provenance: "domainkit",
+			purpose: "conformance"
+		},
+		name: `${label}.${zone}`,
+		policy: "exclusive",
+		target: "target.example.net",
+		ttl: 300
+	});
+}
+function txt(zone, label, value) {
+	return parse$1({
+		_tag: "TXT",
+		metadata: {
+			ownership: "tester",
+			provenance: "domainkit",
+			purpose: "conformance"
+		},
+		name: `${label}.${zone}`,
+		policy: "append",
+		ttl: 300,
+		value
+	});
+}
+function requireTags(provider, testCase, operations, expected) {
+	return requireCondition(provider, testCase, JSON.stringify(operations.map(({ _tag }) => _tag)) === JSON.stringify(expected), `expected operations ${expected.join(", ")}`);
+}
+function requireCondition(provider, testCase, condition, message) {
+	return condition ? Effect.void : Effect.fail(new Error({
+		case: testCase,
+		message,
+		providerId: provider.id
+	}));
+}
+function deleteCreated(provider, zone, providerRecordId, testCase) {
+	return providerRecordId === null ? Effect.fail(new Error({
+		case: testCase,
+		message: "provider must return record IDs for safe cleanup",
+		providerId: provider.id
+	})) : provider.deleteRecord(zone, providerRecordId);
 }
-const layer = () => Layer.succeed(Service$6, make());
-const toAsync = (store = make()) => toAsync$13(store);
 //#endregion
-export { in_memory_connection_exports as InMemoryConnectionStore, in_memory_credential_exports as InMemoryCredentialStore, in_memory_exports as InMemoryDnsProvider, in_memory_exports$1 as InMemoryDnsResolver, in_memory_oauth_state_exports as InMemoryOAuthStateStore, in_memory_authorization_exports as InMemoryProviderAuthorizationStore, in_memory_receipt_exports as InMemoryReceiptStore };
+export { in_memory_lifecycle_repository_exports as InMemoryAuthorizationLifecycle, in_memory_continuation_exports as InMemoryConnectionContinuations, in_memory_exports as InMemoryDnsProvider, in_memory_exports$1 as InMemoryDnsResolver, provider_conformance_exports as ProviderConformance };
 
 //# sourceMappingURL=testing.mjs.map