domainkit 0.1.1 → 0.2.1

package/dist/{client-BnD7QLRF.mjs → auth-6-KRy1gN.mjs}

@@ -1,33 +1,7 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { T as decode$2, c as Opaque, h as decode$3, y as Error$1 } from "./dns-record-C_KwGPLf.mjs";
-import { Effect, Schema } from "effect";
-//#region src/auth/secret.ts
-var secret_exports = /* @__PURE__ */ __exportAll({
-	Value: () => Value,
-	make: () => make$1
-});
-/** A deliberately non-serializable credential value. */
-var Value = class Value {
-	#value;
-	constructor(value) {
-		this.#value = value;
-	}
-	static from(value) {
-		if (value.length === 0) throw new Error("Secret values cannot be empty");
-		return new Value(value);
-	}
-	expose() {
-		return this.#value;
-	}
-	toJSON() {
-		return "[REDACTED]";
-	}
-	toString() {
-		return "[REDACTED]";
-	}
-};
-const make$1 = Value.from;
-//#endregion
+import { E as decode$2, c as Opaque, h as decode$3, y as Error } from "./dns-record-BLeqo56C.mjs";
+import { g as Method, h as Error$1, p as make$1, r as Evidence, u as codec } from "./authorization-CQSKKMrW.mjs";
+import { Clock, Effect, Schema } from "effect";
 //#region src/providers/vercel/protocol.ts
 const Pagination = Schema.Struct({
 	count: Schema.Number,
@@ -113,88 +87,6 @@ const IntegrationToken = Schema.Struct({
 	user_id: Schema.String
 });
 //#endregion
-//#region src/providers/vercel/auth.ts
-var auth_exports = /* @__PURE__ */ __exportAll({
-	exchangeCode: () => exchangeCode,
-	integrationMethod: () => integrationMethod,
-	manifest: () => manifest,
-	tokenMethod: () => tokenMethod
-});
-/** Describes Vercel's caller-created personal access-token method. */
-function tokenMethod(capabilities) {
-	return {
-		_tag: "token",
-		capabilities: [...capabilities],
-		instructionsUrl: "https://vercel.com/account/settings/tokens"
-	};
-}
-/** Describes Vercel's provider-specific integration installation flow. */
-function integrationMethod(options) {
-	return {
-		_tag: "integration",
-		capabilities: [...options.capabilities],
-		installUrl: `https://vercel.com/integrations/${encodeURIComponent(options.slug)}/new`,
-		tokenEndpoint: "https://api.vercel.com/oauth/access_token"
-	};
-}
-/** Creates the Vercel token and integration authorization manifest. */
-function manifest(options) {
-	return {
-		methods: [tokenMethod(options.capabilities), integrationMethod(options)],
-		providerId: "vercel"
-	};
-}
-/** Exchanges Vercel's one-time integration code and preserves its account context. */
-const exchangeCode = Effect.fn("VercelAuth.exchangeCode")((options) => Effect.gen(function* () {
-	const fetch = options.fetch ?? globalThis.fetch;
-	const baseUrl = (options.baseUrl ?? "https://api.vercel.com").replace(/\/$/, "");
-	const body = new URLSearchParams({
-		client_id: options.clientId,
-		client_secret: options.clientSecret.expose(),
-		code: options.code.expose(),
-		redirect_uri: options.redirectUri
-	});
-	const response = yield* Effect.tryPromise({
-		try: () => fetch(`${baseUrl}/oauth/access_token`, {
-			body,
-			headers: {
-				Accept: "application/json",
-				"Content-Type": "application/x-www-form-urlencoded"
-			},
-			method: "POST"
-		}),
-		catch: () => failure$2("exchangeCode", "Vercel token exchange failed", "transport")
-	});
-	const input = yield* Effect.tryPromise({
-		try: () => response.json(),
-		catch: () => failure$2("exchangeCode", response.ok ? "Vercel returned a non-JSON token response" : `Vercel token exchange failed with HTTP ${response.status}`, response.ok ? "response" : response.status === 401 ? "authentication" : "request", response.status)
-	});
-	if (!response.ok) {
-		const detail = Schema.decodeUnknownOption(ErrorEnvelope)(input);
-		return yield* Effect.fail(failure$2("exchangeCode", detail._tag === "Some" ? detail.value.error.message : `Vercel token exchange failed with HTTP ${response.status}`, response.status === 401 ? "authentication" : "request", response.status, detail._tag === "Some" ? detail.value.error.code : void 0));
-	}
-	const token = yield* Schema.decodeUnknownEffect(IntegrationToken)(input).pipe(Effect.mapError((cause) => failure$2("exchangeCode", `Vercel token response did not match its API contract: ${cause.message}`, "response", response.status)));
-	return {
-		accessToken: make$1(token.access_token),
-		context: token.team_id === null ? { _tag: "personal" } : {
-			_tag: "team",
-			teamId: token.team_id
-		},
-		installationId: token.installation_id ?? null,
-		userId: token.user_id
-	};
-}));
-function failure$2(operation, message, reason, status, code) {
-	return new Error$1({
-		...code === void 0 ? {} : { code },
-		message,
-		operation,
-		providerId: "vercel",
-		reason,
-		...status === void 0 ? {} : { status }
-	});
-}
-//#endregion
 //#region src/providers/vercel/records.ts
 const decode$1 = Effect.fn("VercelRecords.decode")((zone, record) => Effect.gen(function* () {
 	const absolute = absoluteNameCandidate(zone, record.name);
@@ -213,7 +105,7 @@ const decode$1 = Effect.fn("VercelRecords.decode")((zone, record) => Effect.gen(
 		policy: record.type === "CNAME" ? "exclusive" : "append",
 		ttl: record.ttl ?? 60
 	};
-	const fromRecord = (input) => decode$3(input).pipe(Effect.mapError((cause) => failure$1("decodeRecord", cause.message)));
+	const fromRecord = (input) => decode$3(input).pipe(Effect.mapError((cause) => failure$2("decodeRecord", cause.message)));
 	switch (record.type) {
 		case "A":
 		case "AAAA": return yield* fromRecord({
@@ -240,7 +132,7 @@ const decode$1 = Effect.fn("VercelRecords.decode")((zone, record) => Effect.gen(
 		});
 		case "CAA": {
 			const match = record.value.match(/^(\d{1,3})\s+(issue|issuewild|iodef)\s+(?:"((?:\\.|[^"])*)"|(\S.*))$/);
-			if (match === null) return yield* Effect.fail(failure$1("decodeRecord", "Vercel CAA record has an invalid value"));
+			if (match === null) return yield* Effect.fail(failure$2("decodeRecord", "Vercel CAA record has an invalid value"));
 			return yield* fromRecord({
 				...common,
 				_tag: "CAA",
@@ -274,7 +166,7 @@ const decodeOpaque = Effect.fn("VercelRecords.decodeOpaque")((record, name) => S
 	name,
 	providerRecordId: record.id,
 	providerType: record.type
-}).pipe(Effect.mapError((cause) => failure$1("decodeRecord", cause.message))));
+}).pipe(Effect.mapError((cause) => failure$2("decodeRecord", cause.message))));
 function encode(zone, record) {
 	const common = {
 		name: relativeName(zone, record.name),
@@ -322,7 +214,7 @@ function absoluteNameCandidate(zone, name) {
 function relativeName(zone, name) {
 	if (name === zone) return "";
 	const suffix = `.${zone}`;
-	if (!name.endsWith(suffix)) throw failure$1("encodeRecord", `DNS record ${name} is outside Vercel zone ${zone}`, { reason: "request" });
+	if (!name.endsWith(suffix)) throw failure$2("encodeRecord", `DNS record ${name} is outside Vercel zone ${zone}`, { reason: "request" });
 	return name.slice(0, -suffix.length);
 }
 function escapeQuoted(value) {
@@ -331,8 +223,8 @@ function escapeQuoted(value) {
 function unescapeQuoted(value) {
 	return value.replace(/\\([\\"])/g, "$1");
 }
-function failure$1(operation, message, fields = {}) {
-	return new Error$1({
+function failure$2(operation, message, fields = {}) {
+	return new Error({
 		message,
 		operation,
 		providerId: "vercel",
@@ -341,7 +233,17 @@ function failure$1(operation, message, fields = {}) {
 }
 //#endregion
 //#region src/providers/vercel/client.ts
-var client_exports = /* @__PURE__ */ __exportAll({ make: () => make });
+var client_exports = /* @__PURE__ */ __exportAll({
+	discovery: () => discovery,
+	make: () => make
+});
+/** Exposes Vercel zone lookup as the optional provider discovery capability. */
+function discovery(client) {
+	return {
+		listZones: (name) => client.listZones({ name }),
+		provider: client
+	};
+}
 /** Creates an Effect-native Vercel client without owning the credential lifecycle. */
 function make(options) {
 	const fetch = options.fetch ?? globalThis.fetch;
@@ -363,11 +265,11 @@ function make(options) {
 					...init?.headers
 				}
 			}),
-			catch: () => failure(operation, "Vercel request failed", { reason: "transport" })
+			catch: () => failure$1(operation, "Vercel request failed", { reason: "transport" })
 		});
 		const body = yield* Effect.tryPromise({
 			try: () => response.json(),
-			catch: () => failure(operation, response.ok ? "Vercel returned a non-JSON response" : `Vercel request failed with HTTP ${response.status}`, {
+			catch: () => failure$1(operation, response.ok ? "Vercel returned a non-JSON response" : `Vercel request failed with HTTP ${response.status}`, {
 				reason: response.ok ? "response" : reason(response.status),
 				...rateLimit(response),
 				status: response.status
@@ -416,8 +318,8 @@ function make(options) {
 	}).pipe(Effect.catchTag("ProviderError", (cause) => cause.reason === "not_found" ? Effect.succeed(null) : Effect.fail(cause))));
 	const resolveZone = Effect.fn("VercelClient.resolveZone")((name) => Effect.gen(function* () {
 		const domain = yield* discoverZone(name);
-		if (domain === null) return yield* Effect.fail(failure("resolveZone", `Vercel zone ${name} is not configured for authoritative DNS in the selected account`, { reason: "not_found" }));
-		return yield* decode$2(domain.name).pipe(Effect.mapError((cause) => failure("resolveZone", `Vercel returned an invalid storage zone: ${cause.message}`)));
+		if (domain === null) return yield* Effect.fail(failure$1("resolveZone", `Vercel zone ${name} is not configured for authoritative DNS in the selected account`, { reason: "not_found" }));
+		return yield* decode$2(domain.name).pipe(Effect.mapError((cause) => failure$1("resolveZone", `Vercel returned an invalid storage zone: ${cause.message}`)));
 	}));
 	const listRecords = Effect.fn("VercelClient.listRecords")((zoneName) => Effect.gen(function* () {
 		const storageZone = yield* resolveZone(zoneName);
@@ -438,7 +340,7 @@ function make(options) {
 		const storageZone = yield* resolveZone(zoneName);
 		const body = yield* Effect.try({
 			try: () => encode(storageZone, record),
-			catch: (cause) => cause instanceof Error$1 ? cause : failure("createRecord", "Vercel record could not be encoded", { reason: "request" })
+			catch: (cause) => cause instanceof Error ? cause : failure$1("createRecord", "Vercel record could not be encoded", { reason: "request" })
 		});
 		const result = yield* request(withContext(`/v2/domains/${encodeURIComponent(storageZone)}/records`), "createRecord", {
 			body: JSON.stringify(body),
@@ -513,8 +415,8 @@ function hasDnsStorage(domain, configuredServiceType = domain.serviceType) {
 	return configuredServiceType === "zeit.world" || domain.zone === true || domain.intendedNameservers.length > 0;
 }
 const projectZone = Effect.fn("VercelClient.projectZone")((domain) => Effect.gen(function* () {
-	const name = yield* decode$2(domain.name).pipe(Effect.mapError((cause) => failure("listZones", cause.message, { reason: "response" })));
-	const nameservers = yield* Effect.forEach(domain.intendedNameservers, (nameserver) => decode$2(nameserver).pipe(Effect.mapError((cause) => failure("listZones", cause.message, { reason: "response" }))));
+	const name = yield* decode$2(domain.name).pipe(Effect.mapError((cause) => failure$1("listZones", cause.message, { reason: "response" })));
+	const nameservers = yield* Effect.forEach(domain.intendedNameservers, (nameserver) => decode$2(nameserver).pipe(Effect.mapError((cause) => failure$1("listZones", cause.message, { reason: "response" }))));
 	return {
 		accountId: domain.teamId ?? domain.userId,
 		id: domain.id,
@@ -524,14 +426,14 @@ const projectZone = Effect.fn("VercelClient.projectZone")((domain) => Effect.gen
 	};
 }));
 function decode(schema, input, operation, response) {
-	return Schema.decodeUnknownEffect(schema)(input).pipe(Effect.mapError((cause) => failure(operation, `Vercel response did not match its API contract: ${cause.message}`, {
+	return Schema.decodeUnknownEffect(schema)(input).pipe(Effect.mapError((cause) => failure$1(operation, `Vercel response did not match its API contract: ${cause.message}`, {
 		reason: "response",
 		status: response.status
 	})));
 }
 function apiFailure(input, operation, response) {
 	const detail = Schema.decodeUnknownOption(ErrorEnvelope)(input);
-	return failure(operation, detail._tag === "Some" ? detail.value.error.message : `Vercel request failed with HTTP ${response.status}`, {
+	return failure$1(operation, detail._tag === "Some" ? detail.value.error.message : `Vercel request failed with HTTP ${response.status}`, {
 		...detail._tag === "Some" ? { code: detail.value.error.code } : {},
 		reason: reason(response.status, detail._tag === "Some" ? detail.value.error.code : void 0),
 		...rateLimit(response, detail._tag === "Some" ? detail.value.error : void 0),
@@ -553,8 +455,8 @@ function rateLimit(response, detail) {
 	const reset = resetMs ?? (header === null ? void 0 : Number(header) * 1e3);
 	return reset === void 0 || !Number.isFinite(reset) ? {} : { retryAfterMs: Math.max(0, reset - Date.now()) };
 }
-function failure(operation, message, fields = {}) {
-	return new Error$1({
+function failure$1(operation, message, fields = {}) {
+	return new Error({
 		...fields,
 		message,
 		operation,
@@ -562,6 +464,208 @@ function failure(operation, message, fields = {}) {
 	});
 }
 //#endregion
-export { integrationMethod as a, Value as c, exchangeCode as i, secret_exports as l, make as n, manifest as o, auth_exports as r, tokenMethod as s, client_exports as t };
+//#region src/providers/vercel/auth.ts
+var auth_exports = /* @__PURE__ */ __exportAll({
+	contextCodec: () => contextCodec,
+	exchangeCode: () => exchangeCode,
+	integrationAuthentication: () => integrationAuthentication,
+	integrationFlow: () => integrationFlow,
+	integrationMethod: () => integrationMethod,
+	manifest: () => manifest,
+	tokenConnectionMethod: () => tokenConnectionMethod,
+	tokenMethod: () => tokenMethod
+});
+const Context$1 = Schema.TaggedUnion({
+	personal: { installationId: Schema.NullOr(Schema.String) },
+	team: {
+		installationId: Schema.NullOr(Schema.String),
+		teamId: Schema.String
+	}
+});
+const contextCodec = codec("vercel.v1", Context$1);
+/** Describes Vercel's caller-created personal access-token method. */
+function tokenMethod(capabilities) {
+	return {
+		_tag: "token",
+		capabilities: [...capabilities],
+		instructionsUrl: "https://vercel.com/account/settings/tokens"
+	};
+}
+/** Describes Vercel's provider-specific integration installation flow. */
+function integrationMethod(options) {
+	return {
+		_tag: "integration",
+		capabilities: [...options.capabilities],
+		installUrl: `https://vercel.com/integrations/${encodeURIComponent(options.slug)}/new`,
+		tokenEndpoint: "https://api.vercel.com/oauth/access_token"
+	};
+}
+/** Creates the Vercel token and integration authorization manifest. */
+function manifest(options) {
+	return {
+		methods: [tokenMethod(options.capabilities), integrationMethod(options)],
+		providerId: "vercel"
+	};
+}
+/** Exchanges Vercel's one-time integration code and preserves its account context. */
+const exchangeCode = Effect.fn("VercelAuth.exchangeCode")((options) => Effect.gen(function* () {
+	const fetch = options.fetch ?? globalThis.fetch;
+	const baseUrl = (options.baseUrl ?? "https://api.vercel.com").replace(/\/$/, "");
+	const body = new URLSearchParams({
+		client_id: options.clientId,
+		client_secret: options.clientSecret.expose(),
+		code: options.code.expose(),
+		redirect_uri: options.redirectUri
+	});
+	const response = yield* Effect.tryPromise({
+		try: () => fetch(`${baseUrl}/oauth/access_token`, {
+			body,
+			headers: {
+				Accept: "application/json",
+				"Content-Type": "application/x-www-form-urlencoded"
+			},
+			method: "POST"
+		}),
+		catch: () => failure("exchangeCode", "Vercel token exchange failed", "transport")
+	});
+	const input = yield* Effect.tryPromise({
+		try: () => response.json(),
+		catch: () => failure("exchangeCode", response.ok ? "Vercel returned a non-JSON token response" : `Vercel token exchange failed with HTTP ${response.status}`, response.ok ? "response" : response.status === 401 ? "authentication" : "request", response.status)
+	});
+	if (!response.ok) {
+		const detail = Schema.decodeUnknownOption(ErrorEnvelope)(input);
+		return yield* Effect.fail(failure("exchangeCode", detail._tag === "Some" ? detail.value.error.message : `Vercel token exchange failed with HTTP ${response.status}`, response.status === 401 ? "authentication" : "request", response.status, detail._tag === "Some" ? detail.value.error.code : void 0));
+	}
+	const token = yield* Schema.decodeUnknownEffect(IntegrationToken)(input).pipe(Effect.mapError((cause) => failure("exchangeCode", `Vercel token response did not match its API contract: ${cause.message}`, "response", response.status)));
+	return {
+		accessToken: make$1(token.access_token),
+		context: token.team_id === null ? { _tag: "personal" } : {
+			_tag: "team",
+			teamId: token.team_id
+		},
+		installationId: token.installation_id ?? null,
+		userId: token.user_id
+	};
+}));
+/** Creates a provider-independent token connection method backed by Vercel validation. */
+function tokenConnectionMethod(options) {
+	const requiredCapabilities = [...options.capabilities];
+	return Method.Token({
+		authenticate: Effect.fn("VercelAuth.authenticateToken")(function* (token) {
+			const validated = yield* make({
+				...options,
+				token
+			}).validateToken();
+			const observedAt = new Date(yield* Clock.currentTimeMillis);
+			return {
+				capabilityEvidence: validated.capabilities.map((capability) => ({
+					capability,
+					evidence: Evidence.Introspected({ observedAt })
+				})),
+				credential: {
+					accessToken: token,
+					refreshToken: null,
+					tokenType: "bearer"
+				},
+				expiresAt: validated.expiresAt,
+				providerAccountId: validated.accountId,
+				providerContext: yield* contextCodec.encode(options.context._tag === "team" ? {
+					_tag: "team",
+					installationId: null,
+					teamId: options.context.teamId
+				} : {
+					_tag: "personal",
+					installationId: null
+				}),
+				scopes: [...validated.scopes]
+			};
+		}),
+		providerId: "vercel",
+		requiredCapabilities,
+		token: options.token
+	});
+}
+/** Converts a completed Vercel Integration exchange into canonical connection authentication. */
+const integrationAuthentication = Effect.fn("VercelAuth.integrationAuthentication")(function* (options) {
+	const exchanged = yield* exchangeCode(options);
+	const observedAt = new Date(yield* Clock.currentTimeMillis);
+	return {
+		capabilityEvidence: options.capabilities.map((capability) => ({
+			capability,
+			evidence: Evidence.Introspected({ observedAt })
+		})),
+		credential: {
+			accessToken: exchanged.accessToken,
+			refreshToken: null,
+			tokenType: "bearer"
+		},
+		expiresAt: null,
+		providerAccountId: exchanged.context._tag === "team" ? exchanged.context.teamId : exchanged.userId,
+		providerContext: yield* contextCodec.encode(exchanged.context._tag === "team" ? {
+			_tag: "team",
+			installationId: exchanged.installationId,
+			teamId: exchanged.context.teamId
+		} : {
+			_tag: "personal",
+			installationId: exchanged.installationId
+		}),
+		scopes: []
+	};
+});
+/** Creates Vercel Integration's implementation of the common interactive connection capability. */
+function integrationFlow(options) {
+	const method = integrationMethod(options);
+	const Payload = Schema.fromJsonString(Schema.Struct({ state: Schema.String }));
+	return {
+		complete: Effect.fn("VercelAuth.integrationFlow.complete")(function* (payload, callbackUrl) {
+			const continuation = yield* Schema.decodeUnknownEffect(Payload)(payload.expose()).pipe(Effect.mapError(() => new Error$1({
+				category: "authorization",
+				message: "Vercel Integration continuation payload is invalid",
+				operation: "VercelAuth.integrationFlow.complete",
+				retry: "after-user-action"
+			})));
+			const code = callbackUrl.searchParams.get("code");
+			if (callbackUrl.searchParams.get("state") !== continuation.state || code === null) return yield* new Error$1({
+				category: "authorization",
+				message: "Vercel Integration callback does not match its continuation",
+				operation: "VercelAuth.integrationFlow.complete",
+				retry: "after-user-action"
+			});
+			return yield* integrationAuthentication({
+				...options.baseUrl === void 0 ? {} : { baseUrl: options.baseUrl },
+				capabilities: options.capabilities,
+				clientId: options.clientId,
+				clientSecret: options.clientSecret,
+				code: make$1(code),
+				...options.fetch === void 0 ? {} : { fetch: options.fetch },
+				redirectUri: options.redirectUri
+			});
+		}),
+		method: "integration",
+		providerId: "vercel",
+		requiredCapabilities: [...options.capabilities],
+		start: (continuationId) => {
+			const authorizationUrl = new URL(method.installUrl);
+			authorizationUrl.searchParams.set("source", "external");
+			authorizationUrl.searchParams.set("state", continuationId);
+			return Effect.succeed({
+				authorizationUrl,
+				payload: make$1(JSON.stringify({ state: continuationId }))
+			});
+		}
+	};
+}
+function failure(operation, message, reason, status, code) {
+	return new Error({
+		...code === void 0 ? {} : { code },
+		message,
+		operation,
+		providerId: "vercel",
+		reason,
+		...status === void 0 ? {} : { status }
+	});
+}
+//#endregion
+export { manifest as a, client_exports as c, integrationMethod as i, discovery as l, exchangeCode as n, tokenConnectionMethod as o, integrationFlow as r, tokenMethod as s, auth_exports as t, make as u };
 
-//# sourceMappingURL=client-BnD7QLRF.mjs.map
+//# sourceMappingURL=auth-6-KRy1gN.mjs.map

package/dist/auth-6-KRy1gN.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-6-KRy1gN.mjs","names":["S","decode","DomainName.decode","DnsRecord.decode","failure","S","DnsRecord.Opaque","DnsProvider.Error","failure","Protocol.TeamListEnvelope","Protocol.DomainListEnvelope","Protocol.DomainConfig","Protocol.DomainEnvelope","DomainName.decode","Protocol.RecordListEnvelope","Records.decode","Records.encode","DnsProvider.Error","Protocol.CreateRecordEnvelope","Protocol.UserEnvelope","S","Protocol.ErrorEnvelope","Context","S","ProviderContext.codec","Protocol.ErrorEnvelope","Protocol.IntegrationToken","Secret.make","Client.make","Connection.Error","DnsProvider.Error"],"sources":["../src/providers/vercel/protocol.ts","../src/providers/vercel/records.ts","../src/providers/vercel/client.ts","../src/providers/vercel/auth.ts"],"sourcesContent":["import { Schema as S } from \"effect\";\n\nexport const Pagination = S.Struct({\n  count: S.Number,\n  next: S.NullOr(S.Number),\n  prev: S.NullOr(S.Number),\n});\nexport interface Pagination extends S.Schema.Type<typeof Pagination> {}\n\nexport const ErrorDetail = S.Struct({\n  code: S.String,\n  message: S.String,\n  limit: S.optionalKey(\n    S.Struct({\n      remaining: S.Number,\n      reset: S.optionalKey(S.Number),\n      resetMs: S.optionalKey(S.Number),\n      total: S.Number,\n    }),\n  ),\n});\nexport interface ErrorDetail extends S.Schema.Type<typeof ErrorDetail> {}\n\nexport const ErrorEnvelope = S.Struct({ error: ErrorDetail });\n\nexport const User = S.Struct({\n  id: S.String,\n  name: S.NullOr(S.String),\n  username: S.String,\n});\nexport interface User extends S.Schema.Type<typeof User> {}\n\nexport const UserEnvelope = S.Struct({ user: User });\n\nexport const Team = S.Struct({\n  id: S.String,\n  name: S.NullOr(S.String),\n  slug: S.String,\n});\nexport interface Team extends S.Schema.Type<typeof Team> {}\n\nexport const TeamListEnvelope = S.Struct({\n  pagination: Pagination,\n  teams: S.Array(Team),\n});\n\nexport const Domain = S.Struct({\n  id: S.String,\n  intendedNameservers: S.Array(S.String),\n  name: S.String,\n  nameservers: S.Array(S.String),\n  serviceType: S.Literals([\"zeit.world\", \"external\", \"na\"]),\n  teamId: S.NullOr(S.String),\n  userId: S.String,\n  verified: S.Boolean,\n  zone: S.optionalKey(S.Boolean),\n});\nexport interface Domain extends S.Schema.Type<typeof Domain> {}\n\nexport const DomainConfig = S.Struct({\n  misconfigured: S.Boolean,\n  serviceType: S.Literals([\"zeit.world\", \"external\", \"na\"]),\n});\nexport interface DomainConfig extends S.Schema.Type<typeof DomainConfig> {}\n\nexport const DomainEnvelope = S.Struct({ domain: Domain });\n\nexport const DomainListEnvelope = S.Struct({\n  domains: S.Array(Domain),\n  pagination: Pagination,\n});\n\nexport const Record = S.Struct({\n  id: S.String,\n  mxPriority: S.optionalKey(S.Number),\n  name: S.String,\n  priority: S.optionalKey(S.Number),\n  ttl: S.optionalKey(S.Number),\n  type: S.String,\n  value: S.String,\n});\nexport interface Record extends S.Schema.Type<typeof Record> {}\n\nexport const RecordListEnvelope = S.Struct({\n  pagination: S.optionalKey(Pagination),\n  records: S.Array(Record),\n});\n\nexport const CreateRecordEnvelope = S.Struct({\n  uid: S.String,\n  updated: S.optionalKey(S.Number),\n});\n\nexport const IntegrationToken = S.Struct({\n  access_token: S.String,\n  installation_id: S.optionalKey(S.String),\n  team_id: S.NullOr(S.String),\n  token_type: S.optionalKey(S.String),\n  user_id: S.String,\n});\nexport interface IntegrationToken extends S.Schema.Type<typeof IntegrationToken> {}\n","import { Effect, Schema as S } from \"effect\";\n\nimport * as DomainName from \"../../domain/domain-name.ts\";\nimport * as DnsRecord from \"../../domain/dns-record.ts\";\nimport * as DnsProvider from \"../../provider/provider.ts\";\nimport type * as Protocol from \"./protocol.ts\";\n\nexport type CreateBody = Readonly<Record<string, unknown>>;\n\nexport const decode = Effect.fn(\"VercelRecords.decode\")(\n  (zone: DomainName.DomainName, record: Protocol.Record) =>\n    Effect.gen(function* () {\n      const absolute = absoluteNameCandidate(zone, record.name);\n      const name = yield* DomainName.decode(absolute).pipe(\n        Effect.match({ onFailure: () => null, onSuccess: (value) => value }),\n      );\n      if (name === null) return yield* decodeOpaque(record, absolute);\n      const common = {\n        metadata: {\n          ownership: \"provider\",\n          provenance: \"vercel\",\n          purpose: \"existing DNS record\",\n        },\n        name,\n        policy: record.type === \"CNAME\" ? \"exclusive\" : \"append\",\n        ttl: record.ttl ?? 60,\n      } as const;\n      const fromRecord = (input: unknown) =>\n        DnsRecord.decode(input).pipe(\n          Effect.mapError((cause) => failure(\"decodeRecord\", cause.message)),\n        );\n\n      switch (record.type) {\n        case \"A\":\n        case \"AAAA\":\n          return yield* fromRecord({ ...common, _tag: record.type, address: record.value });\n        case \"CNAME\":\n        case \"NS\":\n          return yield* fromRecord({ ...common, _tag: record.type, target: record.value });\n        case \"TXT\":\n          return yield* fromRecord({ ...common, _tag: \"TXT\", value: record.value });\n        case \"MX\":\n          return yield* fromRecord({\n            ...common,\n            _tag: \"MX\",\n            exchange: record.value,\n            priority: record.mxPriority ?? record.priority,\n          });\n        case \"CAA\": {\n          const match = record.value.match(\n            /^(\\d{1,3})\\s+(issue|issuewild|iodef)\\s+(?:\"((?:\\\\.|[^\"])*)\"|(\\S.*))$/,\n          );\n          if (match === null) {\n            return yield* Effect.fail(\n              failure(\"decodeRecord\", \"Vercel CAA record has an invalid value\"),\n            );\n          }\n          return yield* fromRecord({\n            ...common,\n            _tag: \"CAA\",\n            flags: Number(match[1]),\n            tag: match[2],\n            value: unescapeQuoted(match[3] ?? match[4] ?? \"\"),\n          });\n        }\n        case \"SRV\": {\n          const parts = record.value.trim().split(/\\s+/);\n          const [priority, weight, port, target] =\n            parts.length === 4\n              ? parts\n              : [String(record.priority ?? \"\"), parts[0], parts[1], parts[2]];\n          return yield* fromRecord({\n            ...common,\n            _tag: \"SRV\",\n            port: Number(port),\n            priority: Number(priority),\n            target,\n            weight: Number(weight),\n          });\n        }\n        default:\n          return yield* decodeOpaque(record, name);\n      }\n    }),\n);\n\nconst decodeOpaque = Effect.fn(\"VercelRecords.decodeOpaque\")(\n  (record: Protocol.Record, name: string) =>\n    S.decodeUnknownEffect(DnsRecord.Opaque)({\n      _tag: \"Opaque\",\n      name,\n      providerRecordId: record.id,\n      providerType: record.type,\n    }).pipe(Effect.mapError((cause) => failure(\"decodeRecord\", cause.message))),\n);\n\nexport function encode(zone: DomainName.DomainName, record: DnsRecord.DnsRecord): CreateBody {\n  const common = {\n    name: relativeName(zone, record.name),\n    ...(record.ttl === null ? {} : { ttl: record.ttl }),\n    type: record._tag,\n  };\n  switch (record._tag) {\n    case \"A\":\n    case \"AAAA\":\n      return { ...common, value: record.address };\n    case \"CNAME\":\n    case \"NS\":\n      return { ...common, value: record.target };\n    case \"TXT\":\n      return { ...common, value: record.value };\n    case \"MX\":\n      return { ...common, mxPriority: record.priority, value: record.exchange };\n    case \"CAA\":\n      return {\n        ...common,\n        value: `${record.flags} ${record.tag} \"${escapeQuoted(record.value)}\"`,\n      };\n    case \"SRV\":\n      return {\n        ...common,\n        srv: {\n          port: record.port,\n          priority: record.priority,\n          target: record.target,\n          weight: record.weight,\n        },\n      };\n  }\n}\n\nfunction absoluteNameCandidate(zone: DomainName.DomainName, name: string): string {\n  return name === \"\" || name === \"@\"\n    ? zone\n    : name === zone || name.endsWith(`.${zone}`)\n      ? name\n      : `${name}.${zone}`;\n}\n\nfunction relativeName(zone: DomainName.DomainName, name: DomainName.DomainName): string {\n  if (name === zone) return \"\";\n  const suffix = `.${zone}`;\n  if (!name.endsWith(suffix)) {\n    throw failure(\"encodeRecord\", `DNS record ${name} is outside Vercel zone ${zone}`, {\n      reason: \"request\",\n    });\n  }\n  return name.slice(0, -suffix.length);\n}\n\nfunction escapeQuoted(value: string): string {\n  return value.replaceAll(\"\\\\\", \"\\\\\\\\\").replaceAll('\"', '\\\\\"');\n}\n\nfunction unescapeQuoted(value: string): string {\n  return value.replace(/\\\\([\\\\\"])/g, \"$1\");\n}\n\nfunction failure(\n  operation: string,\n  message: string,\n  fields: Partial<Pick<DnsProvider.Error, \"reason\">> = {},\n): DnsProvider.Error {\n  return new DnsProvider.Error({\n    message,\n    operation,\n    providerId: \"vercel\",\n    reason: fields.reason ?? \"response\",\n  });\n}\n","import { Effect, Schema as S } from \"effect\";\n\nimport type * as ProviderAuth from \"../../auth/manifest.ts\";\nimport type * as Secret from \"../../auth/secret.ts\";\nimport * as DomainName from \"../../domain/domain-name.ts\";\nimport type * as DnsRecord from \"../../domain/dns-record.ts\";\nimport type * as ZoneDiscovery from \"../../discovery/zone-discovery.ts\";\nimport * as DnsProvider from \"../../provider/provider.ts\";\nimport * as Protocol from \"./protocol.ts\";\nimport * as Records from \"./records.ts\";\n\nexport type Fetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;\n\n/** Selects whether Vercel requests operate on a personal account or a team. */\nexport type AccountContext =\n  | { readonly _tag: \"personal\" }\n  | { readonly _tag: \"team\"; readonly teamId: string };\n\n/** Configuration for an Effect-native Vercel authoritative-DNS client. */\nexport interface Options {\n  readonly baseUrl?: string;\n  /** Capabilities the host required when issuing or authorizing this credential. */\n  readonly capabilities: ProviderAuth.TokenValidation[\"capabilities\"];\n  readonly context: AccountContext;\n  readonly fetch?: Fetch;\n  readonly token: Secret.Value;\n}\n\nexport interface ListZonesInput {\n  readonly name?: DomainName.DomainName;\n}\n\n/** A Vercel account visible to the supplied credential. */\nexport interface Account {\n  readonly id: string;\n  readonly name: string;\n  readonly type: \"personal\" | \"team\";\n}\n\n/** A Vercel-managed authoritative zone with normalized nameserver evidence. */\nexport interface Zone {\n  readonly accountId: string;\n  readonly id: string;\n  readonly name: DomainName.DomainName;\n  readonly nameservers: ReadonlyArray<DomainName.DomainName>;\n  readonly status: \"active\" | \"pending\";\n}\n\nexport interface Interface extends DnsProvider.Interface {\n  readonly listAccounts: () => Effect.Effect<ReadonlyArray<Account>, DnsProvider.Error>;\n  readonly listZones: (\n    input?: ListZonesInput,\n  ) => Effect.Effect<ReadonlyArray<Zone>, DnsProvider.Error>;\n  readonly validateToken: () => Effect.Effect<ProviderAuth.TokenValidation, DnsProvider.Error>;\n}\n\n/** Exposes Vercel zone lookup as the optional provider discovery capability. */\nexport function discovery(client: Interface): ZoneDiscovery.Source {\n  return {\n    listZones: (name) => client.listZones({ name }),\n    provider: client,\n  };\n}\n\n/** Creates an Effect-native Vercel client without owning the credential lifecycle. */\nexport function make(options: Options): Interface {\n  const fetch = options.fetch ?? globalThis.fetch;\n  const baseUrl = (options.baseUrl ?? \"https://api.vercel.com\").replace(/\\/$/, \"\");\n\n  const withContext = (path: string, values: Readonly<Record<string, string>> = {}) => {\n    const url = new URL(`${baseUrl}${path}`);\n    for (const [key, value] of Object.entries(values)) url.searchParams.set(key, value);\n    if (options.context._tag === \"team\") url.searchParams.set(\"teamId\", options.context.teamId);\n    return url;\n  };\n\n  const request = Effect.fn(\"VercelClient.request\")(\n    (url: URL, operation: string, init?: RequestInit) =>\n      Effect.gen(function* () {\n        const response = yield* Effect.tryPromise({\n          try: () =>\n            fetch(url, {\n              ...init,\n              headers: {\n                Accept: \"application/json\",\n                Authorization: `Bearer ${options.token.expose()}`,\n                ...(init?.body === undefined ? {} : { \"Content-Type\": \"application/json\" }),\n                ...init?.headers,\n              },\n            }),\n          catch: () => failure(operation, \"Vercel request failed\", { reason: \"transport\" }),\n        });\n        const body = yield* Effect.tryPromise({\n          try: () => response.json() as Promise<unknown>,\n          catch: () =>\n            failure(\n              operation,\n              response.ok\n                ? \"Vercel returned a non-JSON response\"\n                : `Vercel request failed with HTTP ${response.status}`,\n              {\n                reason: response.ok ? \"response\" : reason(response.status),\n                ...rateLimit(response),\n                status: response.status,\n              },\n            ),\n        });\n        if (!response.ok) return yield* Effect.fail(apiFailure(body, operation, response));\n        return { body, response } as const;\n      }),\n  );\n\n  const allTeams = Effect.fn(\"VercelClient.allTeams\")(() =>\n    Effect.gen(function* () {\n      const teams: Array<Protocol.Team> = [];\n      let until: number | null = null;\n      while (true) {\n        const url = new URL(`${baseUrl}/v2/teams`);\n        url.searchParams.set(\"limit\", \"100\");\n        if (until !== null) url.searchParams.set(\"until\", String(until));\n        const { body, response } = yield* request(url, \"listAccounts\");\n        const envelope = yield* decode(Protocol.TeamListEnvelope, body, \"listAccounts\", response);\n        teams.push(...envelope.teams);\n        if (envelope.pagination.next === null) return teams;\n        until = envelope.pagination.next;\n      }\n    }),\n  );\n\n  const allDomains = Effect.fn(\"VercelClient.allDomains\")(() =>\n    Effect.gen(function* () {\n      const domains: Array<Protocol.Domain> = [];\n      let until: number | null = null;\n      while (true) {\n        const values: Record<string, string> = { limit: \"100\" };\n        if (until !== null) values.until = String(until);\n        const { body, response } = yield* request(withContext(\"/v5/domains\", values), \"listZones\");\n        const envelope = yield* decode(Protocol.DomainListEnvelope, body, \"listZones\", response);\n        domains.push(...envelope.domains);\n        if (envelope.pagination.next === null) return domains;\n        until = envelope.pagination.next;\n      }\n    }),\n  );\n\n  const discoverZone = Effect.fn(\"VercelClient.discoverZone\")((name: DomainName.DomainName) =>\n    Effect.gen(function* () {\n      const configResult = yield* request(\n        withContext(`/v6/domains/${encodeURIComponent(name)}/config`),\n        \"resolveZone\",\n      );\n      const config = yield* decode(\n        Protocol.DomainConfig,\n        configResult.body,\n        \"resolveZone\",\n        configResult.response,\n      );\n      const domainResult = yield* request(\n        withContext(`/v5/domains/${encodeURIComponent(name)}`),\n        \"resolveZone\",\n      );\n      const envelope = yield* decode(\n        Protocol.DomainEnvelope,\n        domainResult.body,\n        \"resolveZone\",\n        domainResult.response,\n      );\n      if (!hasDnsStorage(envelope.domain, config.serviceType)) {\n        return null;\n      }\n      return envelope.domain;\n    }).pipe(\n      Effect.catchTag(\"ProviderError\", (cause) =>\n        cause.reason === \"not_found\" ? Effect.succeed(null) : Effect.fail(cause),\n      ),\n    ),\n  );\n\n  const resolveZone = Effect.fn(\"VercelClient.resolveZone\")((name: DomainName.DomainName) =>\n    Effect.gen(function* () {\n      const domain = yield* discoverZone(name);\n      if (domain === null) {\n        return yield* Effect.fail(\n          failure(\n            \"resolveZone\",\n            `Vercel zone ${name} is not configured for authoritative DNS in the selected account`,\n            { reason: \"not_found\" },\n          ),\n        );\n      }\n      return yield* DomainName.decode(domain.name).pipe(\n        Effect.mapError((cause) =>\n          failure(\"resolveZone\", `Vercel returned an invalid storage zone: ${cause.message}`),\n        ),\n      );\n    }),\n  );\n\n  const listRecords = Effect.fn(\"VercelClient.listRecords\")((zoneName: DomainName.DomainName) =>\n    Effect.gen(function* () {\n      const storageZone = yield* resolveZone(zoneName);\n      const records: Array<DnsRecord.Observed> = [];\n      let until: number | null = null;\n      while (true) {\n        const values: Record<string, string> = { limit: \"100\" };\n        if (until !== null) values.until = String(until);\n        const { body, response } = yield* request(\n          withContext(`/v5/domains/${encodeURIComponent(storageZone)}/records`, values),\n          \"listRecords\",\n        );\n        const envelope = yield* decode(Protocol.RecordListEnvelope, body, \"listRecords\", response);\n        records.push(\n          ...(yield* Effect.forEach(envelope.records, (record) =>\n            Records.decode(storageZone, record),\n          )),\n        );\n        const next = envelope.pagination?.next ?? null;\n        if (next === null) {\n          return records.filter(\n            (record) => record.name === zoneName || record.name.endsWith(`.${zoneName}`),\n          );\n        }\n        until = next;\n      }\n    }),\n  );\n\n  const createRecord = Effect.fn(\"VercelClient.createRecord\")(\n    (zoneName: DomainName.DomainName, record: DnsRecord.DnsRecord) =>\n      Effect.gen(function* () {\n        const storageZone = yield* resolveZone(zoneName);\n        const body = yield* Effect.try({\n          try: () => Records.encode(storageZone, record),\n          catch: (cause) =>\n            cause instanceof DnsProvider.Error\n              ? cause\n              : failure(\"createRecord\", \"Vercel record could not be encoded\", {\n                  reason: \"request\",\n                }),\n        });\n        const result = yield* request(\n          withContext(`/v2/domains/${encodeURIComponent(storageZone)}/records`),\n          \"createRecord\",\n          { body: JSON.stringify(body), method: \"POST\" },\n        );\n        const envelope = yield* decode(\n          Protocol.CreateRecordEnvelope,\n          result.body,\n          \"createRecord\",\n          result.response,\n        );\n        return { providerRecordId: envelope.uid };\n      }),\n  );\n\n  const getRecord = Effect.fn(\"VercelClient.getRecord\")(\n    (zoneName: DomainName.DomainName, providerRecordId: string) =>\n      Effect.gen(function* () {\n        const storageZone = yield* resolveZone(zoneName);\n        let until: number | null = null;\n        while (true) {\n          const values: Record<string, string> = { limit: \"100\" };\n          if (until !== null) values.until = String(until);\n          const { body, response } = yield* request(\n            withContext(`/v5/domains/${encodeURIComponent(storageZone)}/records`, values),\n            \"getRecord\",\n          );\n          const envelope = yield* decode(Protocol.RecordListEnvelope, body, \"getRecord\", response);\n          const record = envelope.records.find(({ id }) => id === providerRecordId);\n          if (record !== undefined) return yield* Records.decode(storageZone, record);\n          const next = envelope.pagination?.next ?? null;\n          if (next === null) return null;\n          until = next;\n        }\n      }),\n  );\n\n  const deleteRecord = Effect.fn(\"VercelClient.deleteRecord\")(\n    (zoneName: DomainName.DomainName, providerRecordId: string) =>\n      Effect.gen(function* () {\n        const storageZone = yield* resolveZone(zoneName);\n        yield* request(\n          withContext(\n            `/v2/domains/${encodeURIComponent(storageZone)}/records/${encodeURIComponent(providerRecordId)}`,\n          ),\n          \"deleteRecord\",\n          { method: \"DELETE\" },\n        );\n      }),\n  );\n\n  const listAccounts = Effect.fn(\"VercelClient.listAccounts\")(() =>\n    Effect.gen(function* () {\n      const userResult = yield* request(new URL(`${baseUrl}/v2/user`), \"listAccounts\");\n      const { user } = yield* decode(\n        Protocol.UserEnvelope,\n        userResult.body,\n        \"listAccounts\",\n        userResult.response,\n      );\n      const teams = yield* allTeams();\n      return [\n        { id: user.id, name: user.name ?? user.username, type: \"personal\" as const },\n        ...teams.map((team) => ({\n          id: team.id,\n          name: team.name ?? team.slug,\n          type: \"team\" as const,\n        })),\n      ];\n    }),\n  );\n\n  const listZones = Effect.fn(\"VercelClient.listZones\")((input: ListZonesInput = {}) =>\n    Effect.gen(function* () {\n      const domains = (yield* allDomains()).filter(\n        (domain) =>\n          hasDnsStorage(domain) && (input.name === undefined || domain.name === input.name),\n      );\n      if (domains.length > 0 || input.name === undefined) {\n        return yield* Effect.forEach(domains, projectZone);\n      }\n      const discovered = yield* discoverZone(input.name);\n      return discovered === null ? [] : [yield* projectZone(discovered)];\n    }),\n  );\n\n  const validateToken = Effect.fn(\"VercelClient.validateToken\")(() =>\n    Effect.gen(function* () {\n      let accountId: string;\n      if (options.context._tag === \"team\") {\n        yield* allDomains();\n        accountId = options.context.teamId;\n      } else {\n        const result = yield* request(new URL(`${baseUrl}/v2/user`), \"validateToken\");\n        const { user } = yield* decode(\n          Protocol.UserEnvelope,\n          result.body,\n          \"validateToken\",\n          result.response,\n        );\n        accountId = user.id;\n      }\n      return {\n        accountId,\n        capabilities: options.capabilities,\n        expiresAt: null,\n        scopes: [],\n      };\n    }),\n  );\n\n  return {\n    id: \"vercel\",\n    createRecord,\n    deleteRecord,\n    getRecord,\n    listAccounts,\n    listRecords,\n    listZones,\n    validateToken,\n  };\n}\n\nfunction hasDnsStorage(\n  domain: Protocol.Domain,\n  configuredServiceType: Protocol.DomainConfig[\"serviceType\"] = domain.serviceType,\n): boolean {\n  return (\n    configuredServiceType === \"zeit.world\" ||\n    domain.zone === true ||\n    domain.intendedNameservers.length > 0\n  );\n}\n\nconst projectZone = Effect.fn(\"VercelClient.projectZone\")((domain: Protocol.Domain) =>\n  Effect.gen(function* () {\n    const name = yield* DomainName.decode(domain.name).pipe(\n      Effect.mapError((cause) => failure(\"listZones\", cause.message, { reason: \"response\" })),\n    );\n    const nameservers = yield* Effect.forEach(domain.intendedNameservers, (nameserver) =>\n      DomainName.decode(nameserver).pipe(\n        Effect.mapError((cause) => failure(\"listZones\", cause.message, { reason: \"response\" })),\n      ),\n    );\n    return {\n      accountId: domain.teamId ?? domain.userId,\n      id: domain.id,\n      name,\n      nameservers,\n      status: domain.verified ? \"active\" : \"pending\",\n    } as const;\n  }),\n);\n\nfunction decode<A>(\n  schema: S.ConstraintCodec<A, unknown, never, unknown>,\n  input: unknown,\n  operation: string,\n  response: Response,\n): Effect.Effect<A, DnsProvider.Error> {\n  return S.decodeUnknownEffect(schema)(input).pipe(\n    Effect.mapError((cause) =>\n      failure(operation, `Vercel response did not match its API contract: ${cause.message}`, {\n        reason: \"response\",\n        status: response.status,\n      }),\n    ),\n  );\n}\n\nfunction apiFailure(input: unknown, operation: string, response: Response): DnsProvider.Error {\n  const detail = S.decodeUnknownOption(Protocol.ErrorEnvelope)(input);\n  return failure(\n    operation,\n    detail._tag === \"Some\"\n      ? detail.value.error.message\n      : `Vercel request failed with HTTP ${response.status}`,\n    {\n      ...(detail._tag === \"Some\" ? { code: detail.value.error.code } : {}),\n      reason: reason(response.status, detail._tag === \"Some\" ? detail.value.error.code : undefined),\n      ...rateLimit(response, detail._tag === \"Some\" ? detail.value.error : undefined),\n      status: response.status,\n    },\n  );\n}\n\nfunction reason(status: number, code?: string): DnsProvider.ErrorReason {\n  if (status === 401 || code === \"invalid_token\") return \"authentication\";\n  if (status === 403) return \"authorization\";\n  if (status === 404 || code === \"not_found\") return \"not_found\";\n  if (status === 409 || code === \"conflict\") return \"conflict\";\n  if (status === 429 || code === \"rate_limited\") return \"rate_limit\";\n  if (status >= 500) return \"response\";\n  return \"request\";\n}\n\nfunction rateLimit(\n  response: Response,\n  detail?: Protocol.ErrorDetail,\n): Partial<Pick<DnsProvider.Error, \"retryAfterMs\">> {\n  const resetMs = detail?.limit?.resetMs;\n  const header = response.headers.get(\"x-ratelimit-reset\");\n  const reset = resetMs ?? (header === null ? undefined : Number(header) * 1_000);\n  return reset === undefined || !Number.isFinite(reset)\n    ? {}\n    : { retryAfterMs: Math.max(0, reset - Date.now()) };\n}\n\nfunction failure(\n  operation: string,\n  message: string,\n  fields: Partial<Pick<DnsProvider.Error, \"code\" | \"reason\" | \"retryAfterMs\" | \"status\">> = {},\n): DnsProvider.Error {\n  return new DnsProvider.Error({ ...fields, message, operation, providerId: \"vercel\" });\n}\n","import { Clock, Effect, Schema as S } from \"effect\";\n\nimport * as Connection from \"../../auth/connect.ts\";\nimport * as ProviderAuthorization from \"../../auth/authorization.ts\";\nimport type * as ProviderAuth from \"../../auth/manifest.ts\";\nimport * as ProviderContext from \"../../auth/provider-context.ts\";\nimport * as Secret from \"../../auth/secret.ts\";\nimport * as DnsProvider from \"../../provider/provider.ts\";\nimport * as Client from \"./client.ts\";\nimport * as Protocol from \"./protocol.ts\";\n\nconst Context = S.TaggedUnion({\n  personal: { installationId: S.NullOr(S.String) },\n  team: { installationId: S.NullOr(S.String), teamId: S.String },\n});\nexport type Context = typeof Context.Type;\nexport const contextCodec = ProviderContext.codec(\"vercel.v1\", Context);\n\n/** Describes Vercel's caller-created personal access-token method. */\nexport function tokenMethod(\n  capabilities: ProviderAuth.TokenValidation[\"capabilities\"],\n): Extract<ProviderAuth.Manifest[\"methods\"][number], { readonly _tag: \"token\" }> {\n  return {\n    _tag: \"token\",\n    capabilities: [...capabilities],\n    instructionsUrl: \"https://vercel.com/account/settings/tokens\",\n  };\n}\n\nexport interface IntegrationMethodOptions {\n  readonly capabilities: ProviderAuth.TokenValidation[\"capabilities\"];\n  readonly slug: string;\n}\n\n/** Describes Vercel's provider-specific integration installation flow. */\nexport function integrationMethod(\n  options: IntegrationMethodOptions,\n): ProviderAuth.IntegrationMethod {\n  return {\n    _tag: \"integration\",\n    capabilities: [...options.capabilities],\n    installUrl: `https://vercel.com/integrations/${encodeURIComponent(options.slug)}/new`,\n    tokenEndpoint: \"https://api.vercel.com/oauth/access_token\",\n  };\n}\n\n/** Creates the Vercel token and integration authorization manifest. */\nexport function manifest(options: IntegrationMethodOptions): ProviderAuth.Manifest {\n  return {\n    methods: [tokenMethod(options.capabilities), integrationMethod(options)],\n    providerId: \"vercel\",\n  };\n}\n\nexport interface ExchangeCodeOptions {\n  readonly baseUrl?: string;\n  readonly clientId: string;\n  readonly clientSecret: Secret.Value;\n  readonly code: Secret.Value;\n  readonly fetch?: Client.Fetch;\n  readonly redirectUri: string;\n}\n\nexport interface IntegrationCredential {\n  readonly accessToken: Secret.Value;\n  readonly context: Client.AccountContext;\n  readonly installationId: string | null;\n  readonly userId: string;\n}\n\n/** Exchanges Vercel's one-time integration code and preserves its account context. */\nexport const exchangeCode = Effect.fn(\"VercelAuth.exchangeCode\")((options: ExchangeCodeOptions) =>\n  Effect.gen(function* () {\n    const fetch = options.fetch ?? globalThis.fetch;\n    const baseUrl = (options.baseUrl ?? \"https://api.vercel.com\").replace(/\\/$/, \"\");\n    const body = new URLSearchParams({\n      client_id: options.clientId,\n      client_secret: options.clientSecret.expose(),\n      code: options.code.expose(),\n      redirect_uri: options.redirectUri,\n    });\n    const response = yield* Effect.tryPromise({\n      try: () =>\n        fetch(`${baseUrl}/oauth/access_token`, {\n          body,\n          headers: {\n            Accept: \"application/json\",\n            \"Content-Type\": \"application/x-www-form-urlencoded\",\n          },\n          method: \"POST\",\n        }),\n      catch: () => failure(\"exchangeCode\", \"Vercel token exchange failed\", \"transport\"),\n    });\n    const input = yield* Effect.tryPromise({\n      try: () => response.json() as Promise<unknown>,\n      catch: () =>\n        failure(\n          \"exchangeCode\",\n          response.ok\n            ? \"Vercel returned a non-JSON token response\"\n            : `Vercel token exchange failed with HTTP ${response.status}`,\n          response.ok ? \"response\" : response.status === 401 ? \"authentication\" : \"request\",\n          response.status,\n        ),\n    });\n    if (!response.ok) {\n      const detail = S.decodeUnknownOption(Protocol.ErrorEnvelope)(input);\n      return yield* Effect.fail(\n        failure(\n          \"exchangeCode\",\n          detail._tag === \"Some\"\n            ? detail.value.error.message\n            : `Vercel token exchange failed with HTTP ${response.status}`,\n          response.status === 401 ? \"authentication\" : \"request\",\n          response.status,\n          detail._tag === \"Some\" ? detail.value.error.code : undefined,\n        ),\n      );\n    }\n    const token = yield* S.decodeUnknownEffect(Protocol.IntegrationToken)(input).pipe(\n      Effect.mapError((cause) =>\n        failure(\n          \"exchangeCode\",\n          `Vercel token response did not match its API contract: ${cause.message}`,\n          \"response\",\n          response.status,\n        ),\n      ),\n    );\n    return {\n      accessToken: Secret.make(token.access_token),\n      context:\n        token.team_id === null\n          ? ({ _tag: \"personal\" } as const)\n          : ({ _tag: \"team\", teamId: token.team_id } as const),\n      installationId: token.installation_id ?? null,\n      userId: token.user_id,\n    };\n  }),\n);\n\nexport interface TokenConnectionOptions extends Omit<Client.Options, \"token\"> {\n  readonly token: Secret.Value;\n}\n\n/** Creates a provider-independent token connection method backed by Vercel validation. */\nexport function tokenConnectionMethod(\n  options: TokenConnectionOptions,\n): Extract<Connection.Method, { readonly _tag: \"Token\" }> {\n  const requiredCapabilities = [...options.capabilities];\n  return Connection.Method.Token({\n    authenticate: Effect.fn(\"VercelAuth.authenticateToken\")(function* (token) {\n      const validated = yield* Client.make({ ...options, token }).validateToken();\n      const observedAt = new Date(yield* Clock.currentTimeMillis);\n      return {\n        capabilityEvidence: validated.capabilities.map((capability) => ({\n          capability,\n          evidence: ProviderAuthorization.Evidence.Introspected({ observedAt }),\n        })),\n        credential: { accessToken: token, refreshToken: null, tokenType: \"bearer\" },\n        expiresAt: validated.expiresAt,\n        providerAccountId: validated.accountId,\n        providerContext: yield* contextCodec.encode(\n          options.context._tag === \"team\"\n            ? { _tag: \"team\", installationId: null, teamId: options.context.teamId }\n            : { _tag: \"personal\", installationId: null },\n        ),\n        scopes: [...validated.scopes],\n      } satisfies Connection.Authentication;\n    }),\n    providerId: \"vercel\",\n    requiredCapabilities,\n    token: options.token,\n  });\n}\n\n/** Converts a completed Vercel Integration exchange into canonical connection authentication. */\nexport const integrationAuthentication = Effect.fn(\"VercelAuth.integrationAuthentication\")(\n  function* (\n    options: ExchangeCodeOptions & {\n      readonly capabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n    },\n  ) {\n    const exchanged = yield* exchangeCode(options);\n    const observedAt = new Date(yield* Clock.currentTimeMillis);\n    return {\n      capabilityEvidence: options.capabilities.map((capability) => ({\n        capability,\n        evidence: ProviderAuthorization.Evidence.Introspected({ observedAt }),\n      })),\n      credential: {\n        accessToken: exchanged.accessToken,\n        refreshToken: null,\n        tokenType: \"bearer\",\n      },\n      expiresAt: null,\n      providerAccountId:\n        exchanged.context._tag === \"team\" ? exchanged.context.teamId : exchanged.userId,\n      providerContext: yield* contextCodec.encode(\n        exchanged.context._tag === \"team\"\n          ? {\n              _tag: \"team\",\n              installationId: exchanged.installationId,\n              teamId: exchanged.context.teamId,\n            }\n          : { _tag: \"personal\", installationId: exchanged.installationId },\n      ),\n      scopes: [],\n    } satisfies Connection.Authentication;\n  },\n);\n\nexport interface IntegrationFlowOptions\n  extends Omit<ExchangeCodeOptions, \"code\">, IntegrationMethodOptions {}\n\n/** Creates Vercel Integration's implementation of the common interactive connection capability. */\nexport function integrationFlow(options: IntegrationFlowOptions): Connection.InteractiveFlow {\n  const method = integrationMethod(options);\n  const Payload = S.fromJsonString(S.Struct({ state: S.String }));\n  return {\n    complete: Effect.fn(\"VercelAuth.integrationFlow.complete\")(function* (payload, callbackUrl) {\n      const continuation = yield* S.decodeUnknownEffect(Payload)(payload.expose()).pipe(\n        Effect.mapError(\n          () =>\n            new Connection.Error({\n              category: \"authorization\",\n              message: \"Vercel Integration continuation payload is invalid\",\n              operation: \"VercelAuth.integrationFlow.complete\",\n              retry: \"after-user-action\",\n            }),\n        ),\n      );\n      const code = callbackUrl.searchParams.get(\"code\");\n      if (callbackUrl.searchParams.get(\"state\") !== continuation.state || code === null) {\n        return yield* new Connection.Error({\n          category: \"authorization\",\n          message: \"Vercel Integration callback does not match its continuation\",\n          operation: \"VercelAuth.integrationFlow.complete\",\n          retry: \"after-user-action\",\n        });\n      }\n      return yield* integrationAuthentication({\n        ...(options.baseUrl === undefined ? {} : { baseUrl: options.baseUrl }),\n        capabilities: options.capabilities,\n        clientId: options.clientId,\n        clientSecret: options.clientSecret,\n        code: Secret.make(code),\n        ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n        redirectUri: options.redirectUri,\n      });\n    }),\n    method: \"integration\",\n    providerId: \"vercel\",\n    requiredCapabilities: [...options.capabilities],\n    start: (continuationId) => {\n      const authorizationUrl = new URL(method.installUrl);\n      authorizationUrl.searchParams.set(\"source\", \"external\");\n      authorizationUrl.searchParams.set(\"state\", continuationId);\n      return Effect.succeed({\n        authorizationUrl,\n        payload: Secret.make(JSON.stringify({ state: continuationId })),\n      });\n    },\n  };\n}\n\nfunction failure(\n  operation: string,\n  message: string,\n  reason: DnsProvider.ErrorReason,\n  status?: number,\n  code?: string,\n): DnsProvider.Error {\n  return new DnsProvider.Error({\n    ...(code === undefined ? {} : { code }),\n    message,\n    operation,\n    providerId: \"vercel\",\n    reason,\n    ...(status === undefined ? {} : { status }),\n  });\n}\n"],"mappings":";;;;;AAEA,MAAa,aAAaA,OAAE,OAAO;CACjC,OAAOA,OAAE;CACT,MAAMA,OAAE,OAAOA,OAAE,MAAM;CACvB,MAAMA,OAAE,OAAOA,OAAE,MAAM;AACzB,CAAC;AAGD,MAAa,cAAcA,OAAE,OAAO;CAClC,MAAMA,OAAE;CACR,SAASA,OAAE;CACX,OAAOA,OAAE,YACPA,OAAE,OAAO;EACP,WAAWA,OAAE;EACb,OAAOA,OAAE,YAAYA,OAAE,MAAM;EAC7B,SAASA,OAAE,YAAYA,OAAE,MAAM;EAC/B,OAAOA,OAAE;CACX,CAAC,CACH;AACF,CAAC;AAGD,MAAa,gBAAgBA,OAAE,OAAO,EAAE,OAAO,YAAY,CAAC;AAE5D,MAAa,OAAOA,OAAE,OAAO;CAC3B,IAAIA,OAAE;CACN,MAAMA,OAAE,OAAOA,OAAE,MAAM;CACvB,UAAUA,OAAE;AACd,CAAC;AAGD,MAAa,eAAeA,OAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AAEnD,MAAa,OAAOA,OAAE,OAAO;CAC3B,IAAIA,OAAE;CACN,MAAMA,OAAE,OAAOA,OAAE,MAAM;CACvB,MAAMA,OAAE;AACV,CAAC;AAGD,MAAa,mBAAmBA,OAAE,OAAO;CACvC,YAAY;CACZ,OAAOA,OAAE,MAAM,IAAI;AACrB,CAAC;AAED,MAAa,SAASA,OAAE,OAAO;CAC7B,IAAIA,OAAE;CACN,qBAAqBA,OAAE,MAAMA,OAAE,MAAM;CACrC,MAAMA,OAAE;CACR,aAAaA,OAAE,MAAMA,OAAE,MAAM;CAC7B,aAAaA,OAAE,SAAS;EAAC;EAAc;EAAY;CAAI,CAAC;CACxD,QAAQA,OAAE,OAAOA,OAAE,MAAM;CACzB,QAAQA,OAAE;CACV,UAAUA,OAAE;CACZ,MAAMA,OAAE,YAAYA,OAAE,OAAO;AAC/B,CAAC;AAGD,MAAa,eAAeA,OAAE,OAAO;CACnC,eAAeA,OAAE;CACjB,aAAaA,OAAE,SAAS;EAAC;EAAc;EAAY;CAAI,CAAC;AAC1D,CAAC;AAGD,MAAa,iBAAiBA,OAAE,OAAO,EAAE,QAAQ,OAAO,CAAC;AAEzD,MAAa,qBAAqBA,OAAE,OAAO;CACzC,SAASA,OAAE,MAAM,MAAM;CACvB,YAAY;AACd,CAAC;AAED,MAAa,SAASA,OAAE,OAAO;CAC7B,IAAIA,OAAE;CACN,YAAYA,OAAE,YAAYA,OAAE,MAAM;CAClC,MAAMA,OAAE;CACR,UAAUA,OAAE,YAAYA,OAAE,MAAM;CAChC,KAAKA,OAAE,YAAYA,OAAE,MAAM;CAC3B,MAAMA,OAAE;CACR,OAAOA,OAAE;AACX,CAAC;AAGD,MAAa,qBAAqBA,OAAE,OAAO;CACzC,YAAYA,OAAE,YAAY,UAAU;CACpC,SAASA,OAAE,MAAM,MAAM;AACzB,CAAC;AAED,MAAa,uBAAuBA,OAAE,OAAO;CAC3C,KAAKA,OAAE;CACP,SAASA,OAAE,YAAYA,OAAE,MAAM;AACjC,CAAC;AAED,MAAa,mBAAmBA,OAAE,OAAO;CACvC,cAAcA,OAAE;CAChB,iBAAiBA,OAAE,YAAYA,OAAE,MAAM;CACvC,SAASA,OAAE,OAAOA,OAAE,MAAM;CAC1B,YAAYA,OAAE,YAAYA,OAAE,MAAM;CAClC,SAASA,OAAE;AACb,CAAC;;;AC1FD,MAAaC,WAAS,OAAO,GAAG,sBAAsB,CAAC,EACpD,MAA6B,WAC5B,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,sBAAsB,MAAM,OAAO,IAAI;CACxD,MAAM,OAAO,OAAOC,SAAkB,QAAQ,CAAC,CAAC,KAC9C,OAAO,MAAM;EAAE,iBAAiB;EAAM,YAAY,UAAU;CAAM,CAAC,CACrE;CACA,IAAI,SAAS,MAAM,OAAO,OAAO,aAAa,QAAQ,QAAQ;CAC9D,MAAM,SAAS;EACb,UAAU;GACR,WAAW;GACX,YAAY;GACZ,SAAS;EACX;EACA;EACA,QAAQ,OAAO,SAAS,UAAU,cAAc;EAChD,KAAK,OAAO,OAAO;CACrB;CACA,MAAM,cAAc,UAClBC,SAAiB,KAAK,CAAC,CAAC,KACtB,OAAO,UAAU,UAAUC,UAAQ,gBAAgB,MAAM,OAAO,CAAC,CACnE;CAEF,QAAQ,OAAO,MAAf;EACE,KAAK;EACL,KAAK,QACH,OAAO,OAAO,WAAW;GAAE,GAAG;GAAQ,MAAM,OAAO;GAAM,SAAS,OAAO;EAAM,CAAC;EAClF,KAAK;EACL,KAAK,MACH,OAAO,OAAO,WAAW;GAAE,GAAG;GAAQ,MAAM,OAAO;GAAM,QAAQ,OAAO;EAAM,CAAC;EACjF,KAAK,OACH,OAAO,OAAO,WAAW;GAAE,GAAG;GAAQ,MAAM;GAAO,OAAO,OAAO;EAAM,CAAC;EAC1E,KAAK,MACH,OAAO,OAAO,WAAW;GACvB,GAAG;GACH,MAAM;GACN,UAAU,OAAO;GACjB,UAAU,OAAO,cAAc,OAAO;EACxC,CAAC;EACH,KAAK,OAAO;GACV,MAAM,QAAQ,OAAO,MAAM,MACzB,sEACF;GACA,IAAI,UAAU,MACZ,OAAO,OAAO,OAAO,KACnBA,UAAQ,gBAAgB,wCAAwC,CAClE;GAEF,OAAO,OAAO,WAAW;IACvB,GAAG;IACH,MAAM;IACN,OAAO,OAAO,MAAM,EAAE;IACtB,KAAK,MAAM;IACX,OAAO,eAAe,MAAM,MAAM,MAAM,MAAM,EAAE;GAClD,CAAC;EACH;EACA,KAAK,OAAO;GACV,MAAM,QAAQ,OAAO,MAAM,KAAK,CAAC,CAAC,MAAM,KAAK;GAC7C,MAAM,CAAC,UAAU,QAAQ,MAAM,UAC7B,MAAM,WAAW,IACb,QACA;IAAC,OAAO,OAAO,YAAY,EAAE;IAAG,MAAM;IAAI,MAAM;IAAI,MAAM;GAAE;GAClE,OAAO,OAAO,WAAW;IACvB,GAAG;IACH,MAAM;IACN,MAAM,OAAO,IAAI;IACjB,UAAU,OAAO,QAAQ;IACzB;IACA,QAAQ,OAAO,MAAM;GACvB,CAAC;EACH;EACA,SACE,OAAO,OAAO,aAAa,QAAQ,IAAI;CAC3C;AACF,CAAC,CACL;AAEA,MAAM,eAAe,OAAO,GAAG,4BAA4B,CAAC,EACzD,QAAyB,SACxBC,OAAE,oBAAoBC,MAAgB,CAAC,CAAC;CACtC,MAAM;CACN;CACA,kBAAkB,OAAO;CACzB,cAAc,OAAO;AACvB,CAAC,CAAC,CAAC,KAAK,OAAO,UAAU,UAAUF,UAAQ,gBAAgB,MAAM,OAAO,CAAC,CAAC,CAC9E;AAEA,SAAgB,OAAO,MAA6B,QAAyC;CAC3F,MAAM,SAAS;EACb,MAAM,aAAa,MAAM,OAAO,IAAI;EACpC,GAAI,OAAO,QAAQ,OAAO,CAAC,IAAI,EAAE,KAAK,OAAO,IAAI;EACjD,MAAM,OAAO;CACf;CACA,QAAQ,OAAO,MAAf;EACE,KAAK;EACL,KAAK,QACH,OAAO;GAAE,GAAG;GAAQ,OAAO,OAAO;EAAQ;EAC5C,KAAK;EACL,KAAK,MACH,OAAO;GAAE,GAAG;GAAQ,OAAO,OAAO;EAAO;EAC3C,KAAK,OACH,OAAO;GAAE,GAAG;GAAQ,OAAO,OAAO;EAAM;EAC1C,KAAK,MACH,OAAO;GAAE,GAAG;GAAQ,YAAY,OAAO;GAAU,OAAO,OAAO;EAAS;EAC1E,KAAK,OACH,OAAO;GACL,GAAG;GACH,OAAO,GAAG,OAAO,MAAM,GAAG,OAAO,IAAI,IAAI,aAAa,OAAO,KAAK,EAAE;EACtE;EACF,KAAK,OACH,OAAO;GACL,GAAG;GACH,KAAK;IACH,MAAM,OAAO;IACb,UAAU,OAAO;IACjB,QAAQ,OAAO;IACf,QAAQ,OAAO;GACjB;EACF;CACJ;AACF;AAEA,SAAS,sBAAsB,MAA6B,MAAsB;CAChF,OAAO,SAAS,MAAM,SAAS,MAC3B,OACA,SAAS,QAAQ,KAAK,SAAS,IAAI,MAAM,IACvC,OACA,GAAG,KAAK,GAAG;AACnB;AAEA,SAAS,aAAa,MAA6B,MAAqC;CACtF,IAAI,SAAS,MAAM,OAAO;CAC1B,MAAM,SAAS,IAAI;CACnB,IAAI,CAAC,KAAK,SAAS,MAAM,GACvB,MAAMA,UAAQ,gBAAgB,cAAc,KAAK,0BAA0B,QAAQ,EACjF,QAAQ,UACV,CAAC;CAEH,OAAO,KAAK,MAAM,GAAG,CAAC,OAAO,MAAM;AACrC;AAEA,SAAS,aAAa,OAAuB;CAC3C,OAAO,MAAM,WAAW,MAAM,MAAM,CAAC,CAAC,WAAW,MAAK,MAAK;AAC7D;AAEA,SAAS,eAAe,OAAuB;CAC7C,OAAO,MAAM,QAAQ,cAAc,IAAI;AACzC;AAEA,SAASA,UACP,WACA,SACA,SAAqD,CAAC,GACnC;CACnB,OAAO,IAAIG,MAAkB;EAC3B;EACA;EACA,YAAY;EACZ,QAAQ,OAAO,UAAU;CAC3B,CAAC;AACH;;;;;;;;AChHA,SAAgB,UAAU,QAAyC;CACjE,OAAO;EACL,YAAY,SAAS,OAAO,UAAU,EAAE,KAAK,CAAC;EAC9C,UAAU;CACZ;AACF;;AAGA,SAAgB,KAAK,SAA6B;CAChD,MAAM,QAAQ,QAAQ,SAAS,WAAW;CAC1C,MAAM,WAAW,QAAQ,WAAW,yBAAA,CAA0B,QAAQ,OAAO,EAAE;CAE/E,MAAM,eAAe,MAAc,SAA2C,CAAC,MAAM;EACnF,MAAM,MAAM,IAAI,IAAI,GAAG,UAAU,MAAM;EACvC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,GAAG,IAAI,aAAa,IAAI,KAAK,KAAK;EAClF,IAAI,QAAQ,QAAQ,SAAS,QAAQ,IAAI,aAAa,IAAI,UAAU,QAAQ,QAAQ,MAAM;EAC1F,OAAO;CACT;CAEA,MAAM,UAAU,OAAO,GAAG,sBAAsB,CAAC,EAC9C,KAAU,WAAmB,SAC5B,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,OAAO,OAAO,WAAW;GACxC,WACE,MAAM,KAAK;IACT,GAAG;IACH,SAAS;KACP,QAAQ;KACR,eAAe,UAAU,QAAQ,MAAM,OAAO;KAC9C,GAAI,MAAM,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;KACzE,GAAG,MAAM;IACX;GACF,CAAC;GACH,aAAaC,UAAQ,WAAW,yBAAyB,EAAE,QAAQ,YAAY,CAAC;EAClF,CAAC;EACD,MAAM,OAAO,OAAO,OAAO,WAAW;GACpC,WAAW,SAAS,KAAK;GACzB,aACEA,UACE,WACA,SAAS,KACL,wCACA,mCAAmC,SAAS,UAChD;IACE,QAAQ,SAAS,KAAK,aAAa,OAAO,SAAS,MAAM;IACzD,GAAG,UAAU,QAAQ;IACrB,QAAQ,SAAS;GACnB,CACF;EACJ,CAAC;EACD,IAAI,CAAC,SAAS,IAAI,OAAO,OAAO,OAAO,KAAK,WAAW,MAAM,WAAW,QAAQ,CAAC;EACjF,OAAO;GAAE;GAAM;EAAS;CAC1B,CAAC,CACL;CAEA,MAAM,WAAW,OAAO,GAAG,uBAAuB,CAAC,OACjD,OAAO,IAAI,aAAa;EACtB,MAAM,QAA8B,CAAC;EACrC,IAAI,QAAuB;EAC3B,OAAO,MAAM;GACX,MAAM,MAAM,IAAI,IAAI,GAAG,QAAQ,UAAU;GACzC,IAAI,aAAa,IAAI,SAAS,KAAK;GACnC,IAAI,UAAU,MAAM,IAAI,aAAa,IAAI,SAAS,OAAO,KAAK,CAAC;GAC/D,MAAM,EAAE,MAAM,aAAa,OAAO,QAAQ,KAAK,cAAc;GAC7D,MAAM,WAAW,OAAO,OAAOC,kBAA2B,MAAM,gBAAgB,QAAQ;GACxF,MAAM,KAAK,GAAG,SAAS,KAAK;GAC5B,IAAI,SAAS,WAAW,SAAS,MAAM,OAAO;GAC9C,QAAQ,SAAS,WAAW;EAC9B;CACF,CAAC,CACH;CAEA,MAAM,aAAa,OAAO,GAAG,yBAAyB,CAAC,OACrD,OAAO,IAAI,aAAa;EACtB,MAAM,UAAkC,CAAC;EACzC,IAAI,QAAuB;EAC3B,OAAO,MAAM;GACX,MAAM,SAAiC,EAAE,OAAO,MAAM;GACtD,IAAI,UAAU,MAAM,OAAO,QAAQ,OAAO,KAAK;GAC/C,MAAM,EAAE,MAAM,aAAa,OAAO,QAAQ,YAAY,eAAe,MAAM,GAAG,WAAW;GACzF,MAAM,WAAW,OAAO,OAAOC,oBAA6B,MAAM,aAAa,QAAQ;GACvF,QAAQ,KAAK,GAAG,SAAS,OAAO;GAChC,IAAI,SAAS,WAAW,SAAS,MAAM,OAAO;GAC9C,QAAQ,SAAS,WAAW;EAC9B;CACF,CAAC,CACH;CAEA,MAAM,eAAe,OAAO,GAAG,2BAA2B,CAAC,EAAE,SAC3D,OAAO,IAAI,aAAa;EACtB,MAAM,eAAe,OAAO,QAC1B,YAAY,eAAe,mBAAmB,IAAI,EAAE,QAAQ,GAC5D,aACF;EACA,MAAM,SAAS,OAAO,OACpBC,cACA,aAAa,MACb,eACA,aAAa,QACf;EACA,MAAM,eAAe,OAAO,QAC1B,YAAY,eAAe,mBAAmB,IAAI,GAAG,GACrD,aACF;EACA,MAAM,WAAW,OAAO,OACtBC,gBACA,aAAa,MACb,eACA,aAAa,QACf;EACA,IAAI,CAAC,cAAc,SAAS,QAAQ,OAAO,WAAW,GACpD,OAAO;EAET,OAAO,SAAS;CAClB,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,kBAAkB,UAChC,MAAM,WAAW,cAAc,OAAO,QAAQ,IAAI,IAAI,OAAO,KAAK,KAAK,CACzE,CACF,CACF;CAEA,MAAM,cAAc,OAAO,GAAG,0BAA0B,CAAC,EAAE,SACzD,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,OAAO,aAAa,IAAI;EACvC,IAAI,WAAW,MACb,OAAO,OAAO,OAAO,KACnBJ,UACE,eACA,eAAe,KAAK,mEACpB,EAAE,QAAQ,YAAY,CACxB,CACF;EAEF,OAAO,OAAOK,SAAkB,OAAO,IAAI,CAAC,CAAC,KAC3C,OAAO,UAAU,UACfL,UAAQ,eAAe,4CAA4C,MAAM,SAAS,CACpF,CACF;CACF,CAAC,CACH;CAEA,MAAM,cAAc,OAAO,GAAG,0BAA0B,CAAC,EAAE,aACzD,OAAO,IAAI,aAAa;EACtB,MAAM,cAAc,OAAO,YAAY,QAAQ;EAC/C,MAAM,UAAqC,CAAC;EAC5C,IAAI,QAAuB;EAC3B,OAAO,MAAM;GACX,MAAM,SAAiC,EAAE,OAAO,MAAM;GACtD,IAAI,UAAU,MAAM,OAAO,QAAQ,OAAO,KAAK;GAC/C,MAAM,EAAE,MAAM,aAAa,OAAO,QAChC,YAAY,eAAe,mBAAmB,WAAW,EAAE,WAAW,MAAM,GAC5E,aACF;GACA,MAAM,WAAW,OAAO,OAAOM,oBAA6B,MAAM,eAAe,QAAQ;GACzF,QAAQ,KACN,GAAI,OAAO,OAAO,QAAQ,SAAS,UAAU,WAC3CC,SAAe,aAAa,MAAM,CACpC,CACF;GACA,MAAM,OAAO,SAAS,YAAY,QAAQ;GAC1C,IAAI,SAAS,MACX,OAAO,QAAQ,QACZ,WAAW,OAAO,SAAS,YAAY,OAAO,KAAK,SAAS,IAAI,UAAU,CAC7E;GAEF,QAAQ;EACV;CACF,CAAC,CACH;CAEA,MAAM,eAAe,OAAO,GAAG,2BAA2B,CAAC,EACxD,UAAiC,WAChC,OAAO,IAAI,aAAa;EACtB,MAAM,cAAc,OAAO,YAAY,QAAQ;EAC/C,MAAM,OAAO,OAAO,OAAO,IAAI;GAC7B,WAAWC,OAAe,aAAa,MAAM;GAC7C,QAAQ,UACN,iBAAiBC,QACb,QACAT,UAAQ,gBAAgB,sCAAsC,EAC5D,QAAQ,UACV,CAAC;EACT,CAAC;EACD,MAAM,SAAS,OAAO,QACpB,YAAY,eAAe,mBAAmB,WAAW,EAAE,SAAS,GACpE,gBACA;GAAE,MAAM,KAAK,UAAU,IAAI;GAAG,QAAQ;EAAO,CAC/C;EAOA,OAAO,EAAE,mBAAkB,OANH,OACtBU,sBACA,OAAO,MACP,gBACA,OAAO,QACT,EAAA,CACoC,IAAI;CAC1C,CAAC,CACL;CAEA,MAAM,YAAY,OAAO,GAAG,wBAAwB,CAAC,EAClD,UAAiC,qBAChC,OAAO,IAAI,aAAa;EACtB,MAAM,cAAc,OAAO,YAAY,QAAQ;EAC/C,IAAI,QAAuB;EAC3B,OAAO,MAAM;GACX,MAAM,SAAiC,EAAE,OAAO,MAAM;GACtD,IAAI,UAAU,MAAM,OAAO,QAAQ,OAAO,KAAK;GAC/C,MAAM,EAAE,MAAM,aAAa,OAAO,QAChC,YAAY,eAAe,mBAAmB,WAAW,EAAE,WAAW,MAAM,GAC5E,WACF;GACA,MAAM,WAAW,OAAO,OAAOJ,oBAA6B,MAAM,aAAa,QAAQ;GACvF,MAAM,SAAS,SAAS,QAAQ,MAAM,EAAE,SAAS,OAAO,gBAAgB;GACxE,IAAI,WAAW,KAAA,GAAW,OAAO,OAAOC,SAAe,aAAa,MAAM;GAC1E,MAAM,OAAO,SAAS,YAAY,QAAQ;GAC1C,IAAI,SAAS,MAAM,OAAO;GAC1B,QAAQ;EACV;CACF,CAAC,CACL;CA4EA,OAAO;EACL,IAAI;EACJ;EACA,cA7EmB,OAAO,GAAG,2BAA2B,CAAC,EACxD,UAAiC,qBAChC,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO,YAAY,QAAQ;GAC/C,OAAO,QACL,YACE,eAAe,mBAAmB,WAAW,EAAE,WAAW,mBAAmB,gBAAgB,GAC/F,GACA,gBACA,EAAE,QAAQ,SAAS,CACrB;EACF,CAAC,CAkEQ;EACX;EACA,cAjEmB,OAAO,GAAG,2BAA2B,CAAC,OACzD,OAAO,IAAI,aAAa;GACtB,MAAM,aAAa,OAAO,QAAQ,IAAI,IAAI,GAAG,QAAQ,SAAS,GAAG,cAAc;GAC/E,MAAM,EAAE,SAAS,OAAO,OACtBI,cACA,WAAW,MACX,gBACA,WAAW,QACb;GACA,MAAM,QAAQ,OAAO,SAAS;GAC9B,OAAO,CACL;IAAE,IAAI,KAAK;IAAI,MAAM,KAAK,QAAQ,KAAK;IAAU,MAAM;GAAoB,GAC3E,GAAG,MAAM,KAAK,UAAU;IACtB,IAAI,KAAK;IACT,MAAM,KAAK,QAAQ,KAAK;IACxB,MAAM;GACR,EAAE,CACJ;EACF,CAAC,CA+CU;EACX;EACA,WA9CgB,OAAO,GAAG,wBAAwB,CAAC,EAAE,QAAwB,CAAC,MAC9E,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,OAAO,WAAW,EAAA,CAAG,QACnC,WACC,cAAc,MAAM,MAAM,MAAM,SAAS,KAAA,KAAa,OAAO,SAAS,MAAM,KAChF;GACA,IAAI,QAAQ,SAAS,KAAK,MAAM,SAAS,KAAA,GACvC,OAAO,OAAO,OAAO,QAAQ,SAAS,WAAW;GAEnD,MAAM,aAAa,OAAO,aAAa,MAAM,IAAI;GACjD,OAAO,eAAe,OAAO,CAAC,IAAI,CAAC,OAAO,YAAY,UAAU,CAAC;EACnE,CAAC,CAmCO;EACR,eAjCoB,OAAO,GAAG,4BAA4B,CAAC,OAC3D,OAAO,IAAI,aAAa;GACtB,IAAI;GACJ,IAAI,QAAQ,QAAQ,SAAS,QAAQ;IACnC,OAAO,WAAW;IAClB,YAAY,QAAQ,QAAQ;GAC9B,OAAO;IACL,MAAM,SAAS,OAAO,QAAQ,IAAI,IAAI,GAAG,QAAQ,SAAS,GAAG,eAAe;IAC5E,MAAM,EAAE,SAAS,OAAO,OACtBA,cACA,OAAO,MACP,iBACA,OAAO,QACT;IACA,YAAY,KAAK;GACnB;GACA,OAAO;IACL;IACA,cAAc,QAAQ;IACtB,WAAW;IACX,QAAQ,CAAC;GACX;EACF,CAAC,CAWW;CACd;AACF;AAEA,SAAS,cACP,QACA,wBAA8D,OAAO,aAC5D;CACT,OACE,0BAA0B,gBAC1B,OAAO,SAAS,QAChB,OAAO,oBAAoB,SAAS;AAExC;AAEA,MAAM,cAAc,OAAO,GAAG,0BAA0B,CAAC,EAAE,WACzD,OAAO,IAAI,aAAa;CACtB,MAAM,OAAO,OAAON,SAAkB,OAAO,IAAI,CAAC,CAAC,KACjD,OAAO,UAAU,UAAUL,UAAQ,aAAa,MAAM,SAAS,EAAE,QAAQ,WAAW,CAAC,CAAC,CACxF;CACA,MAAM,cAAc,OAAO,OAAO,QAAQ,OAAO,sBAAsB,eACrEK,SAAkB,UAAU,CAAC,CAAC,KAC5B,OAAO,UAAU,UAAUL,UAAQ,aAAa,MAAM,SAAS,EAAE,QAAQ,WAAW,CAAC,CAAC,CACxF,CACF;CACA,OAAO;EACL,WAAW,OAAO,UAAU,OAAO;EACnC,IAAI,OAAO;EACX;EACA;EACA,QAAQ,OAAO,WAAW,WAAW;CACvC;AACF,CAAC,CACH;AAEA,SAAS,OACP,QACA,OACA,WACA,UACqC;CACrC,OAAOY,OAAE,oBAAoB,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAC1C,OAAO,UAAU,UACfZ,UAAQ,WAAW,mDAAmD,MAAM,WAAW;EACrF,QAAQ;EACR,QAAQ,SAAS;CACnB,CAAC,CACH,CACF;AACF;AAEA,SAAS,WAAW,OAAgB,WAAmB,UAAuC;CAC5F,MAAM,SAASY,OAAE,oBAAoBC,aAAsB,CAAC,CAAC,KAAK;CAClE,OAAOb,UACL,WACA,OAAO,SAAS,SACZ,OAAO,MAAM,MAAM,UACnB,mCAAmC,SAAS,UAChD;EACE,GAAI,OAAO,SAAS,SAAS,EAAE,MAAM,OAAO,MAAM,MAAM,KAAK,IAAI,CAAC;EAClE,QAAQ,OAAO,SAAS,QAAQ,OAAO,SAAS,SAAS,OAAO,MAAM,MAAM,OAAO,KAAA,CAAS;EAC5F,GAAG,UAAU,UAAU,OAAO,SAAS,SAAS,OAAO,MAAM,QAAQ,KAAA,CAAS;EAC9E,QAAQ,SAAS;CACnB,CACF;AACF;AAEA,SAAS,OAAO,QAAgB,MAAwC;CACtE,IAAI,WAAW,OAAO,SAAS,iBAAiB,OAAO;CACvD,IAAI,WAAW,KAAK,OAAO;CAC3B,IAAI,WAAW,OAAO,SAAS,aAAa,OAAO;CACnD,IAAI,WAAW,OAAO,SAAS,YAAY,OAAO;CAClD,IAAI,WAAW,OAAO,SAAS,gBAAgB,OAAO;CACtD,IAAI,UAAU,KAAK,OAAO;CAC1B,OAAO;AACT;AAEA,SAAS,UACP,UACA,QACkD;CAClD,MAAM,UAAU,QAAQ,OAAO;CAC/B,MAAM,SAAS,SAAS,QAAQ,IAAI,mBAAmB;CACvD,MAAM,QAAQ,YAAY,WAAW,OAAO,KAAA,IAAY,OAAO,MAAM,IAAI;CACzE,OAAO,UAAU,KAAA,KAAa,CAAC,OAAO,SAAS,KAAK,IAChD,CAAC,IACD,EAAE,cAAc,KAAK,IAAI,GAAG,QAAQ,KAAK,IAAI,CAAC,EAAE;AACtD;AAEA,SAASA,UACP,WACA,SACA,SAA0F,CAAC,GACxE;CACnB,OAAO,IAAIS,MAAkB;EAAE,GAAG;EAAQ;EAAS;EAAW,YAAY;CAAS,CAAC;AACtF;;;;;;;;;;;;;AC3bA,MAAMK,YAAUC,OAAE,YAAY;CAC5B,UAAU,EAAE,gBAAgBA,OAAE,OAAOA,OAAE,MAAM,EAAE;CAC/C,MAAM;EAAE,gBAAgBA,OAAE,OAAOA,OAAE,MAAM;EAAG,QAAQA,OAAE;CAAO;AAC/D,CAAC;AAED,MAAa,eAAeC,MAAsB,aAAaF,SAAO;;AAGtE,SAAgB,YACd,cAC+E;CAC/E,OAAO;EACL,MAAM;EACN,cAAc,CAAC,GAAG,YAAY;EAC9B,iBAAiB;CACnB;AACF;;AAQA,SAAgB,kBACd,SACgC;CAChC,OAAO;EACL,MAAM;EACN,cAAc,CAAC,GAAG,QAAQ,YAAY;EACtC,YAAY,mCAAmC,mBAAmB,QAAQ,IAAI,EAAE;EAChF,eAAe;CACjB;AACF;;AAGA,SAAgB,SAAS,SAA0D;CACjF,OAAO;EACL,SAAS,CAAC,YAAY,QAAQ,YAAY,GAAG,kBAAkB,OAAO,CAAC;EACvE,YAAY;CACd;AACF;;AAmBA,MAAa,eAAe,OAAO,GAAG,yBAAyB,CAAC,EAAE,YAChE,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,QAAQ,SAAS,WAAW;CAC1C,MAAM,WAAW,QAAQ,WAAW,yBAAA,CAA0B,QAAQ,OAAO,EAAE;CAC/E,MAAM,OAAO,IAAI,gBAAgB;EAC/B,WAAW,QAAQ;EACnB,eAAe,QAAQ,aAAa,OAAO;EAC3C,MAAM,QAAQ,KAAK,OAAO;EAC1B,cAAc,QAAQ;CACxB,CAAC;CACD,MAAM,WAAW,OAAO,OAAO,WAAW;EACxC,WACE,MAAM,GAAG,QAAQ,sBAAsB;GACrC;GACA,SAAS;IACP,QAAQ;IACR,gBAAgB;GAClB;GACA,QAAQ;EACV,CAAC;EACH,aAAa,QAAQ,gBAAgB,gCAAgC,WAAW;CAClF,CAAC;CACD,MAAM,QAAQ,OAAO,OAAO,WAAW;EACrC,WAAW,SAAS,KAAK;EACzB,aACE,QACE,gBACA,SAAS,KACL,8CACA,0CAA0C,SAAS,UACvD,SAAS,KAAK,aAAa,SAAS,WAAW,MAAM,mBAAmB,WACxE,SAAS,MACX;CACJ,CAAC;CACD,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,SAASC,OAAE,oBAAoBE,aAAsB,CAAC,CAAC,KAAK;EAClE,OAAO,OAAO,OAAO,KACnB,QACE,gBACA,OAAO,SAAS,SACZ,OAAO,MAAM,MAAM,UACnB,0CAA0C,SAAS,UACvD,SAAS,WAAW,MAAM,mBAAmB,WAC7C,SAAS,QACT,OAAO,SAAS,SAAS,OAAO,MAAM,MAAM,OAAO,KAAA,CACrD,CACF;CACF;CACA,MAAM,QAAQ,OAAOF,OAAE,oBAAoBG,gBAAyB,CAAC,CAAC,KAAK,CAAC,CAAC,KAC3E,OAAO,UAAU,UACf,QACE,gBACA,yDAAyD,MAAM,WAC/D,YACA,SAAS,MACX,CACF,CACF;CACA,OAAO;EACL,aAAaC,OAAY,MAAM,YAAY;EAC3C,SACE,MAAM,YAAY,OACb,EAAE,MAAM,WAAW,IACnB;GAAE,MAAM;GAAQ,QAAQ,MAAM;EAAQ;EAC7C,gBAAgB,MAAM,mBAAmB;EACzC,QAAQ,MAAM;CAChB;AACF,CAAC,CACH;;AAOA,SAAgB,sBACd,SACwD;CACxD,MAAM,uBAAuB,CAAC,GAAG,QAAQ,YAAY;CACrD,OAAA,OAAyB,MAAM;EAC7B,cAAc,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAAW,OAAO;GACxE,MAAM,YAAY,OAAOC,KAAY;IAAE,GAAG;IAAS;GAAM,CAAC,CAAC,CAAC,cAAc;GAC1E,MAAM,aAAa,IAAI,KAAK,OAAO,MAAM,iBAAiB;GAC1D,OAAO;IACL,oBAAoB,UAAU,aAAa,KAAK,gBAAgB;KAC9D;KACA,UAAA,SAAyC,aAAa,EAAE,WAAW,CAAC;IACtE,EAAE;IACF,YAAY;KAAE,aAAa;KAAO,cAAc;KAAM,WAAW;IAAS;IAC1E,WAAW,UAAU;IACrB,mBAAmB,UAAU;IAC7B,iBAAiB,OAAO,aAAa,OACnC,QAAQ,QAAQ,SAAS,SACrB;KAAE,MAAM;KAAQ,gBAAgB;KAAM,QAAQ,QAAQ,QAAQ;IAAO,IACrE;KAAE,MAAM;KAAY,gBAAgB;IAAK,CAC/C;IACA,QAAQ,CAAC,GAAG,UAAU,MAAM;GAC9B;EACF,CAAC;EACD,YAAY;EACZ;EACA,OAAO,QAAQ;CACjB,CAAC;AACH;;AAGA,MAAa,4BAA4B,OAAO,GAAG,sCAAsC,CAAC,CACxF,WACE,SAGA;CACA,MAAM,YAAY,OAAO,aAAa,OAAO;CAC7C,MAAM,aAAa,IAAI,KAAK,OAAO,MAAM,iBAAiB;CAC1D,OAAO;EACL,oBAAoB,QAAQ,aAAa,KAAK,gBAAgB;GAC5D;GACA,UAAA,SAAyC,aAAa,EAAE,WAAW,CAAC;EACtE,EAAE;EACF,YAAY;GACV,aAAa,UAAU;GACvB,cAAc;GACd,WAAW;EACb;EACA,WAAW;EACX,mBACE,UAAU,QAAQ,SAAS,SAAS,UAAU,QAAQ,SAAS,UAAU;EAC3E,iBAAiB,OAAO,aAAa,OACnC,UAAU,QAAQ,SAAS,SACvB;GACE,MAAM;GACN,gBAAgB,UAAU;GAC1B,QAAQ,UAAU,QAAQ;EAC5B,IACA;GAAE,MAAM;GAAY,gBAAgB,UAAU;EAAe,CACnE;EACA,QAAQ,CAAC;CACX;AACF,CACF;;AAMA,SAAgB,gBAAgB,SAA6D;CAC3F,MAAM,SAAS,kBAAkB,OAAO;CACxC,MAAM,UAAUL,OAAE,eAAeA,OAAE,OAAO,EAAE,OAAOA,OAAE,OAAO,CAAC,CAAC;CAC9D,OAAO;EACL,UAAU,OAAO,GAAG,qCAAqC,CAAC,CAAC,WAAW,SAAS,aAAa;GAC1F,MAAM,eAAe,OAAOA,OAAE,oBAAoB,OAAO,CAAC,CAAC,QAAQ,OAAO,CAAC,CAAC,CAAC,KAC3E,OAAO,eAEH,IAAIM,QAAiB;IACnB,UAAU;IACV,SAAS;IACT,WAAW;IACX,OAAO;GACT,CAAC,CACL,CACF;GACA,MAAM,OAAO,YAAY,aAAa,IAAI,MAAM;GAChD,IAAI,YAAY,aAAa,IAAI,OAAO,MAAM,aAAa,SAAS,SAAS,MAC3E,OAAO,OAAO,IAAIA,QAAiB;IACjC,UAAU;IACV,SAAS;IACT,WAAW;IACX,OAAO;GACT,CAAC;GAEH,OAAO,OAAO,0BAA0B;IACtC,GAAI,QAAQ,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;IACpE,cAAc,QAAQ;IACtB,UAAU,QAAQ;IAClB,cAAc,QAAQ;IACtB,MAAMF,OAAY,IAAI;IACtB,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;IAC9D,aAAa,QAAQ;GACvB,CAAC;EACH,CAAC;EACD,QAAQ;EACR,YAAY;EACZ,sBAAsB,CAAC,GAAG,QAAQ,YAAY;EAC9C,QAAQ,mBAAmB;GACzB,MAAM,mBAAmB,IAAI,IAAI,OAAO,UAAU;GAClD,iBAAiB,aAAa,IAAI,UAAU,UAAU;GACtD,iBAAiB,aAAa,IAAI,SAAS,cAAc;GACzD,OAAO,OAAO,QAAQ;IACpB;IACA,SAASA,OAAY,KAAK,UAAU,EAAE,OAAO,eAAe,CAAC,CAAC;GAChE,CAAC;EACH;CACF;AACF;AAEA,SAAS,QACP,WACA,SACA,QACA,QACA,MACmB;CACnB,OAAO,IAAIG,MAAkB;EAC3B,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK;EACrC;EACA;EACA,YAAY;EACZ;EACA,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;CAC3C,CAAC;AACH"}