domainkit 0.1.1 → 0.2.1

package/dist/authorization-CQSKKMrW.mjs

@@ -0,0 +1,255 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
+import { M as Service, k as Error$2 } from "./dns-record-BLeqo56C.mjs";
+import { Clock, Crypto, Data, Effect, Schema } from "effect";
+//#region src/auth/connect.ts
+const Method = Data.taggedEnum();
+const StartResult = Data.taggedEnum();
+var Error$1 = class extends Schema.TaggedError()("ConnectionError", {
+	category: Schema.Literals([
+		"authorization",
+		"provider",
+		"validation"
+	]),
+	message: Schema.String,
+	operation: Schema.String,
+	retry: Schema.Literals([
+		"never",
+		"after-user-action",
+		"safe",
+		"unknown"
+	])
+}) {};
+const mergeGrant = (current, requested) => {
+	if (current === void 0) return requested;
+	if (current._tag === "account" || requested._tag === "account") return { _tag: "account" };
+	return {
+		_tag: "domains",
+		domains: [.../* @__PURE__ */ new Set([...current.domains, ...requested.domains])]
+	};
+};
+const persist = Effect.fn("Connection.persist")(function* (input) {
+	const repository = yield* Service;
+	const crypto = yield* Crypto.Crypto;
+	const now = new Date(yield* Clock.currentTimeMillis);
+	const missingCapability = input.requiredCapabilities.find((capability) => !input.authentication.capabilityEvidence.some((item) => item.capability === capability));
+	if (missingCapability !== void 0) return yield* new Error$1({
+		category: "authorization",
+		message: `Provider authorization lacks evidence for ${missingCapability}`,
+		operation: "Connection.persist",
+		retry: "after-user-action"
+	});
+	const existing = yield* repository.findByProviderAccount(input.providerId, input.authentication.providerAccountId);
+	const authorizationId = existing?.authorization.id ?? (yield* crypto.randomUUIDv4.pipe(Effect.mapError((cause) => new Error$1({
+		category: "validation",
+		message: cause.message,
+		operation: "Connection.persist",
+		retry: "safe"
+	}))));
+	const existingBinding = existing?.bindings.find((binding) => binding.ownerId === input.ownerId);
+	const binding = {
+		authorizationId,
+		createdAt: existingBinding?.createdAt ?? now,
+		grant: mergeGrant(existingBinding?.grant, input.grant),
+		id: existingBinding?.id ?? (yield* crypto.randomUUIDv4.pipe(Effect.mapError((cause) => new Error$1({
+			category: "validation",
+			message: cause.message,
+			operation: "Connection.persist",
+			retry: "safe"
+		})))),
+		ownerId: input.ownerId
+	};
+	const aggregate = {
+		authorization: {
+			authorizedById: input.authorizedById,
+			capabilityEvidence: [...input.authentication.capabilityEvidence],
+			createdAt: existing?.authorization.createdAt ?? now,
+			expiresAt: input.authentication.expiresAt,
+			id: authorizationId,
+			method: input.method,
+			providerAccountId: input.authentication.providerAccountId,
+			providerContext: input.authentication.providerContext,
+			providerId: input.providerId,
+			requiredCapabilities: [...input.requiredCapabilities],
+			revocation: { _tag: "Active" },
+			scopes: [...input.authentication.scopes]
+		},
+		bindings: [...existing?.bindings.filter((candidate) => candidate.id !== binding.id) ?? [], binding],
+		credential: input.authentication.credential
+	};
+	return yield* repository.connect(aggregate);
+});
+const start = Effect.fn("Connection.start")(function* (input) {
+	if (input.method._tag === "Interactive") {
+		const crypto = yield* Crypto.Crypto;
+		const now = yield* Clock.currentTimeMillis;
+		const continuationId = yield* crypto.randomUUIDv4.pipe(Effect.mapError((cause) => new Error$1({
+			category: "validation",
+			message: cause.message,
+			operation: "Connection.start",
+			retry: "safe"
+		})));
+		const started = yield* input.method.flow.start(continuationId);
+		yield* input.method.continuations.put({
+			authorizedById: input.authorizedById,
+			expiresAt: new Date(now + (input.method.ttlMs ?? 6e5)),
+			grant: input.grant,
+			id: continuationId,
+			method: input.method.flow.method,
+			ownerId: input.ownerId,
+			payload: started.payload,
+			providerId: input.method.flow.providerId,
+			requiredCapabilities: [...input.method.flow.requiredCapabilities]
+		});
+		return StartResult.Redirect({
+			authorizationUrl: started.authorizationUrl,
+			continuationId
+		});
+	}
+	const authentication = yield* input.method.authenticate(input.method.token);
+	const aggregate = yield* persist({
+		authentication,
+		authorizedById: input.authorizedById,
+		grant: input.grant,
+		method: "token",
+		ownerId: input.ownerId,
+		providerId: input.method.providerId,
+		requiredCapabilities: input.method.requiredCapabilities
+	});
+	return StartResult.Connected({ aggregate });
+});
+const complete = Effect.fn("Connection.complete")(function* (input) {
+	const continuation = yield* input.continuations.consume(input.continuationId, new Date(yield* Clock.currentTimeMillis));
+	if (continuation === null) return yield* new Error$1({
+		category: "authorization",
+		message: "Connection continuation is expired, unknown, or already consumed",
+		operation: "Connection.complete",
+		retry: "after-user-action"
+	});
+	if (continuation.providerId !== input.flow.providerId || continuation.method !== input.flow.method) return yield* new Error$1({
+		category: "authorization",
+		message: "Connection continuation does not match the provider flow",
+		operation: "Connection.complete",
+		retry: "never"
+	});
+	const authentication = yield* input.flow.complete(continuation.payload, input.callbackUrl);
+	return yield* persist({
+		authentication,
+		authorizedById: continuation.authorizedById,
+		grant: continuation.grant,
+		method: continuation.method,
+		ownerId: continuation.ownerId,
+		providerId: continuation.providerId,
+		requiredCapabilities: continuation.requiredCapabilities
+	});
+});
+//#endregion
+//#region src/auth/secret.ts
+var secret_exports = /* @__PURE__ */ __exportAll({
+	Value: () => Value,
+	make: () => make
+});
+/** A deliberately non-serializable credential value. */
+var Value = class Value {
+	#value;
+	constructor(value) {
+		this.#value = value;
+	}
+	static from(value) {
+		if (value.length === 0) throw new Error("Secret values cannot be empty");
+		return new Value(value);
+	}
+	expose() {
+		return this.#value;
+	}
+	toJSON() {
+		return "[REDACTED]";
+	}
+	toString() {
+		return "[REDACTED]";
+	}
+};
+const make = Value.from;
+//#endregion
+//#region src/auth/provider-context.ts
+var provider_context_exports = /* @__PURE__ */ __exportAll({
+	Envelope: () => Envelope,
+	codec: () => codec,
+	decode: () => decode$1,
+	encode: () => encode$1
+});
+/** A provider-owned, versioned, non-secret context value persisted by the host. */
+const Envelope = Schema.Struct({
+	value: Schema.Json,
+	version: Schema.String
+});
+/** Build an adapter-owned context codec from a schema and stable version identifier. */
+function codec(version, schema) {
+	return {
+		decode: Effect.fn("ProviderContext.decode")((envelope) => envelope.version !== version ? Effect.fail(new Error$2({ message: `Unsupported provider context version: ${envelope.version}` })) : Schema.decodeUnknownEffect(schema)(envelope.value).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message })))),
+		encode: Effect.fn("ProviderContext.encode")((value) => Schema.encodeEffect(schema)(value).pipe(Effect.flatMap((encoded) => Schema.decodeUnknownEffect(Schema.Json)(encoded)), Effect.map((encoded) => ({
+			value: encoded,
+			version
+		})), Effect.mapError((cause) => new Error$2({ message: cause.message })))),
+		version
+	};
+}
+const decode$1 = Effect.fn("ProviderContext.Envelope.decode")((input) => Schema.decodeUnknownEffect(Envelope)(input).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message }))));
+const encode$1 = Schema.encodeSync(Envelope);
+//#endregion
+//#region src/auth/authorization.ts
+var authorization_exports = /* @__PURE__ */ __exportAll({
+	Capability: () => Capability,
+	CapabilityEvidence: () => CapabilityEvidence,
+	Evidence: () => Evidence,
+	EvidenceSchema: () => EvidenceSchema,
+	Revocation: () => Revocation,
+	Schema: () => Schema$1,
+	decode: () => decode,
+	encode: () => encode,
+	evidenceFor: () => evidenceFor,
+	validate: () => validate
+});
+const Capability = Schema.Literals(["dns:read", "dns:write"]);
+const Evidence = Data.taggedEnum();
+const EvidenceSchema = Schema.TaggedUnion({
+	Declared: {},
+	Exercised: { observedAt: Schema.DateFromString },
+	Introspected: { observedAt: Schema.DateFromString }
+});
+const CapabilityEvidence = Schema.Struct({
+	capability: Capability,
+	evidence: EvidenceSchema
+});
+const Revocation = Schema.TaggedUnion({
+	Active: {},
+	Pending: { requestedAt: Schema.DateFromString }
+});
+/** A provider credential authorization shared by one or more owner connections. */
+const Schema$1 = Schema.Struct({
+	authorizedById: Schema.String,
+	capabilityEvidence: Schema.Array(CapabilityEvidence),
+	createdAt: Schema.DateFromString,
+	expiresAt: Schema.NullOr(Schema.DateFromString),
+	id: Schema.String,
+	method: Schema.Literals([
+		"integration",
+		"oauth2",
+		"token"
+	]),
+	providerAccountId: Schema.String,
+	providerContext: Envelope,
+	providerId: Schema.String,
+	requiredCapabilities: Schema.Array(Capability),
+	revocation: Revocation,
+	scopes: Schema.Array(Schema.String)
+});
+const decode = Effect.fn("ProviderAuthorization.decode")((input) => Schema.decodeUnknownEffect(Schema$1)(input).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message }))));
+const validate = Effect.fn("ProviderAuthorization.validate")((input) => Schema.decodeUnknownEffect(Schema.toType(Schema$1))(input).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message }))));
+const encode = Schema.encodeSync(Schema$1);
+function evidenceFor(authorization, capability) {
+	return authorization.capabilityEvidence.find((item) => item.capability === capability)?.evidence;
+}
+//#endregion
+export { StartResult as _, Schema$1 as a, encode as c, provider_context_exports as d, Value as f, Method as g, Error$1 as h, EvidenceSchema as i, evidenceFor as l, secret_exports as m, CapabilityEvidence as n, authorization_exports as o, make as p, Evidence as r, decode as s, Capability as t, codec as u, complete as v, start as y };
+
+//# sourceMappingURL=authorization-CQSKKMrW.mjs.map

package/dist/authorization-CQSKKMrW.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-CQSKKMrW.mjs","names":["Error","Repository.Service","InvalidInputError","decode","encode","S","Schema","ProviderContext.Envelope","InvalidInputError"],"sources":["../src/auth/connect.ts","../src/auth/secret.ts","../src/auth/provider-context.ts","../src/auth/authorization.ts"],"sourcesContent":["import { Clock, Crypto, Data, Effect, Schema } from \"effect\";\n\nimport { CryptoError } from \"../plan/canonical-json.ts\";\nimport type { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport type * as DnsProvider from \"../provider/provider.ts\";\nimport * as ProviderAuthorization from \"./authorization.ts\";\nimport type * as Binding from \"./connection.ts\";\nimport * as Repository from \"./lifecycle-repository.ts\";\nimport type * as ProviderContext from \"./provider-context.ts\";\nimport type * as Secret from \"./secret.ts\";\n\nexport interface Authentication {\n  readonly capabilityEvidence: ReadonlyArray<ProviderAuthorization.CapabilityEvidence>;\n  readonly credential: Binding.StoredCredential;\n  readonly expiresAt: Date | null;\n  readonly providerAccountId: string;\n  readonly providerContext: ProviderContext.Envelope;\n  readonly scopes: ReadonlyArray<string>;\n}\n\nexport type AuthenticationFailure = Error | InvalidInputError | DnsProvider.Error;\n\nexport interface InteractiveStart {\n  readonly authorizationUrl: URL;\n  readonly payload: Secret.Value;\n}\n\nexport interface Continuation extends BaseInput {\n  readonly expiresAt: Date;\n  readonly id: string;\n  readonly method: \"integration\" | \"oauth2\";\n  readonly payload: Secret.Value;\n  readonly providerId: string;\n  readonly requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n}\n\nexport interface ContinuationStore {\n  readonly consume: (id: string, now: Date) => Effect.Effect<Continuation | null, Error>;\n  readonly put: (continuation: Continuation) => Effect.Effect<void, Error>;\n}\n\nexport interface InteractiveFlow {\n  readonly complete: (\n    payload: Secret.Value,\n    callbackUrl: URL,\n  ) => Effect.Effect<Authentication, AuthenticationFailure>;\n  readonly method: \"integration\" | \"oauth2\";\n  readonly providerId: string;\n  readonly requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n  readonly start: (\n    continuationId: string,\n  ) => Effect.Effect<InteractiveStart, AuthenticationFailure, Crypto.Crypto>;\n}\n\nexport type Method = Data.TaggedEnum<{\n  Interactive: {\n    readonly continuations: ContinuationStore;\n    readonly flow: InteractiveFlow;\n    readonly ttlMs?: number;\n  };\n  Token: {\n    readonly authenticate: (\n      token: Secret.Value,\n    ) => Effect.Effect<Authentication, AuthenticationFailure>;\n    readonly providerId: string;\n    readonly requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n    readonly token: Secret.Value;\n  };\n}>;\nexport const Method = Data.taggedEnum<Method>();\n\nexport type StartResult = Data.TaggedEnum<{\n  Connected: { readonly aggregate: Repository.Aggregate };\n  Redirect: { readonly authorizationUrl: URL; readonly continuationId: string };\n}>;\nexport const StartResult = Data.taggedEnum<StartResult>();\n\nexport class Error extends Schema.TaggedError<Error>()(\"ConnectionError\", {\n  category: Schema.Literals([\"authorization\", \"provider\", \"validation\"]),\n  message: Schema.String,\n  operation: Schema.String,\n  retry: Schema.Literals([\"never\", \"after-user-action\", \"safe\", \"unknown\"]),\n}) {}\n\nexport interface BaseInput {\n  readonly authorizedById: string;\n  readonly grant: Binding.Grant;\n  readonly ownerId: string;\n}\n\nexport interface CompleteInput {\n  readonly callbackUrl: URL;\n  readonly continuationId: string;\n  readonly continuations: ContinuationStore;\n  readonly flow: InteractiveFlow;\n}\n\nconst mergeGrant = (\n  current: Binding.Grant | undefined,\n  requested: Binding.Grant,\n): Binding.Grant => {\n  if (current === undefined) return requested;\n  if (current._tag === \"account\" || requested._tag === \"account\") return { _tag: \"account\" };\n  return {\n    _tag: \"domains\",\n    domains: [...new Set([...current.domains, ...requested.domains])],\n  };\n};\n\nconst persist = Effect.fn(\"Connection.persist\")(function* (\n  input: BaseInput & {\n    readonly authentication: Authentication;\n    readonly method: \"integration\" | \"oauth2\" | \"token\";\n    readonly providerId: string;\n    readonly requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n  },\n) {\n  const repository = yield* Repository.Service;\n  const crypto = yield* Crypto.Crypto;\n  const now = new Date(yield* Clock.currentTimeMillis);\n  const missingCapability = input.requiredCapabilities.find(\n    (capability) =>\n      !input.authentication.capabilityEvidence.some((item) => item.capability === capability),\n  );\n  if (missingCapability !== undefined) {\n    return yield* new Error({\n      category: \"authorization\",\n      message: `Provider authorization lacks evidence for ${missingCapability}`,\n      operation: \"Connection.persist\",\n      retry: \"after-user-action\",\n    });\n  }\n  const existing = yield* repository.findByProviderAccount(\n    input.providerId,\n    input.authentication.providerAccountId,\n  );\n  const authorizationId =\n    existing?.authorization.id ??\n    (yield* crypto.randomUUIDv4.pipe(\n      Effect.mapError(\n        (cause) =>\n          new Error({\n            category: \"validation\",\n            message: cause.message,\n            operation: \"Connection.persist\",\n            retry: \"safe\",\n          }),\n      ),\n    ));\n  const existingBinding = existing?.bindings.find((binding) => binding.ownerId === input.ownerId);\n  const binding: Binding.Connection = {\n    authorizationId,\n    createdAt: existingBinding?.createdAt ?? now,\n    grant: mergeGrant(existingBinding?.grant, input.grant),\n    id:\n      existingBinding?.id ??\n      (yield* crypto.randomUUIDv4.pipe(\n        Effect.mapError(\n          (cause) =>\n            new Error({\n              category: \"validation\",\n              message: cause.message,\n              operation: \"Connection.persist\",\n              retry: \"safe\",\n            }),\n        ),\n      )),\n    ownerId: input.ownerId,\n  };\n  const aggregate: Repository.Aggregate = {\n    authorization: {\n      authorizedById: input.authorizedById,\n      capabilityEvidence: [...input.authentication.capabilityEvidence],\n      createdAt: existing?.authorization.createdAt ?? now,\n      expiresAt: input.authentication.expiresAt,\n      id: authorizationId,\n      method: input.method,\n      providerAccountId: input.authentication.providerAccountId,\n      providerContext: input.authentication.providerContext,\n      providerId: input.providerId,\n      requiredCapabilities: [...input.requiredCapabilities],\n      revocation: { _tag: \"Active\" },\n      scopes: [...input.authentication.scopes],\n    },\n    bindings: [\n      ...(existing?.bindings.filter((candidate) => candidate.id !== binding.id) ?? []),\n      binding,\n    ],\n    credential: input.authentication.credential,\n  };\n  return yield* repository.connect(aggregate);\n});\n\nexport const start = Effect.fn(\"Connection.start\")(function* (\n  input: BaseInput & { readonly method: Method },\n) {\n  if (input.method._tag === \"Interactive\") {\n    const crypto = yield* Crypto.Crypto;\n    const now = yield* Clock.currentTimeMillis;\n    const continuationId = yield* crypto.randomUUIDv4.pipe(\n      Effect.mapError(\n        (cause) =>\n          new Error({\n            category: \"validation\",\n            message: cause.message,\n            operation: \"Connection.start\",\n            retry: \"safe\",\n          }),\n      ),\n    );\n    const started = yield* input.method.flow.start(continuationId);\n    yield* input.method.continuations.put({\n      authorizedById: input.authorizedById,\n      expiresAt: new Date(now + (input.method.ttlMs ?? 10 * 60_000)),\n      grant: input.grant,\n      id: continuationId,\n      method: input.method.flow.method,\n      ownerId: input.ownerId,\n      payload: started.payload,\n      providerId: input.method.flow.providerId,\n      requiredCapabilities: [...input.method.flow.requiredCapabilities],\n    });\n    return StartResult.Redirect({\n      authorizationUrl: started.authorizationUrl,\n      continuationId,\n    });\n  }\n  const authentication = yield* input.method.authenticate(input.method.token);\n  const aggregate = yield* persist({\n    authentication,\n    authorizedById: input.authorizedById,\n    grant: input.grant,\n    method: \"token\",\n    ownerId: input.ownerId,\n    providerId: input.method.providerId,\n    requiredCapabilities: input.method.requiredCapabilities,\n  });\n  return StartResult.Connected({ aggregate });\n});\n\nexport const complete = Effect.fn(\"Connection.complete\")(function* (input: CompleteInput) {\n  const continuation = yield* input.continuations.consume(\n    input.continuationId,\n    new Date(yield* Clock.currentTimeMillis),\n  );\n  if (continuation === null) {\n    return yield* new Error({\n      category: \"authorization\",\n      message: \"Connection continuation is expired, unknown, or already consumed\",\n      operation: \"Connection.complete\",\n      retry: \"after-user-action\",\n    });\n  }\n  if (\n    continuation.providerId !== input.flow.providerId ||\n    continuation.method !== input.flow.method\n  ) {\n    return yield* new Error({\n      category: \"authorization\",\n      message: \"Connection continuation does not match the provider flow\",\n      operation: \"Connection.complete\",\n      retry: \"never\",\n    });\n  }\n  const authentication = yield* input.flow.complete(continuation.payload, input.callbackUrl);\n  return yield* persist({\n    authentication,\n    authorizedById: continuation.authorizedById,\n    grant: continuation.grant,\n    method: continuation.method,\n    ownerId: continuation.ownerId,\n    providerId: continuation.providerId,\n    requiredCapabilities: continuation.requiredCapabilities,\n  });\n});\n\nexport type Requirements = Repository.Service | Crypto.Crypto;\nexport type Failure = AuthenticationFailure | Repository.Error | CryptoError;\n","/** A deliberately non-serializable credential value. */\nexport class Value {\n  readonly #value: string;\n\n  private constructor(value: string) {\n    this.#value = value;\n  }\n\n  static from(value: string): Value {\n    if (value.length === 0) throw new Error(\"Secret values cannot be empty\");\n    return new Value(value);\n  }\n\n  expose(): string {\n    return this.#value;\n  }\n\n  toJSON(): string {\n    return \"[REDACTED]\";\n  }\n\n  toString(): string {\n    return \"[REDACTED]\";\n  }\n}\n\nexport const make = Value.from;\n","import { Effect, Schema } from \"effect\";\n\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\n\n/** A provider-owned, versioned, non-secret context value persisted by the host. */\nexport const Envelope = Schema.Struct({\n  value: Schema.Json,\n  version: Schema.String,\n});\nexport interface Envelope extends Schema.Schema.Type<typeof Envelope> {}\n\nexport interface Codec<A> {\n  readonly decode: (envelope: Envelope) => Effect.Effect<A, InvalidInputError>;\n  readonly encode: (value: A) => Effect.Effect<Envelope, InvalidInputError>;\n  readonly version: string;\n}\n\n/** Build an adapter-owned context codec from a schema and stable version identifier. */\nexport function codec<A, I>(version: string, schema: Schema.Codec<A, I>): Codec<A> {\n  return {\n    decode: Effect.fn(\"ProviderContext.decode\")((envelope) =>\n      envelope.version !== version\n        ? Effect.fail(\n            new InvalidInputError({\n              message: `Unsupported provider context version: ${envelope.version}`,\n            }),\n          )\n        : Schema.decodeUnknownEffect(schema)(envelope.value).pipe(\n            Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n          ),\n    ),\n    encode: Effect.fn(\"ProviderContext.encode\")((value) =>\n      Schema.encodeEffect(schema)(value).pipe(\n        Effect.flatMap((encoded) => Schema.decodeUnknownEffect(Schema.Json)(encoded)),\n        Effect.map((encoded) => ({ value: encoded, version })),\n        Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n      ),\n    ),\n    version,\n  };\n}\n\nexport const decode = Effect.fn(\"ProviderContext.Envelope.decode\")((input: unknown) =>\n  Schema.decodeUnknownEffect(Envelope)(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport const encode = Schema.encodeSync(Envelope);\n","import { Data, Effect, Schema as S } from \"effect\";\n\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport * as ProviderContext from \"./provider-context.ts\";\n\nexport const Capability = S.Literals([\"dns:read\", \"dns:write\"]);\nexport type Capability = typeof Capability.Type;\n\nexport type Evidence = Data.TaggedEnum<{\n  Declared: {};\n  Exercised: { readonly observedAt: Date };\n  Introspected: { readonly observedAt: Date };\n}>;\nexport const Evidence = Data.taggedEnum<Evidence>();\n\nexport const EvidenceSchema = S.TaggedUnion({\n  Declared: {},\n  Exercised: { observedAt: S.DateFromString },\n  Introspected: { observedAt: S.DateFromString },\n});\n\nexport const CapabilityEvidence = S.Struct({\n  capability: Capability,\n  evidence: EvidenceSchema,\n});\nexport interface CapabilityEvidence extends S.Schema.Type<typeof CapabilityEvidence> {}\n\nexport const Revocation = S.TaggedUnion({\n  Active: {},\n  Pending: { requestedAt: S.DateFromString },\n});\nexport type Revocation = typeof Revocation.Type;\n\n/** A provider credential authorization shared by one or more owner connections. */\nexport const Schema = S.Struct({\n  authorizedById: S.String,\n  capabilityEvidence: S.Array(CapabilityEvidence),\n  createdAt: S.DateFromString,\n  expiresAt: S.NullOr(S.DateFromString),\n  id: S.String,\n  method: S.Literals([\"integration\", \"oauth2\", \"token\"]),\n  providerAccountId: S.String,\n  providerContext: ProviderContext.Envelope,\n  providerId: S.String,\n  requiredCapabilities: S.Array(Capability),\n  revocation: Revocation,\n  scopes: S.Array(S.String),\n});\nexport interface ProviderAuthorization extends S.Schema.Type<typeof Schema> {}\n\nexport const decode = Effect.fn(\"ProviderAuthorization.decode\")((input: unknown) =>\n  S.decodeUnknownEffect(Schema)(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport const validate = Effect.fn(\"ProviderAuthorization.validate\")((input: unknown) =>\n  S.decodeUnknownEffect(S.toType(Schema))(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport const encode = S.encodeSync(Schema);\n\nexport function evidenceFor(\n  authorization: ProviderAuthorization,\n  capability: Capability,\n): Evidence | undefined {\n  return authorization.capabilityEvidence.find((item) => item.capability === capability)?.evidence;\n}\n"],"mappings":";;;;AAqEA,MAAa,SAAS,KAAK,WAAmB;AAM9C,MAAa,cAAc,KAAK,WAAwB;AAExD,IAAaA,UAAb,cAA2B,OAAO,YAAmB,CAAC,CAAC,mBAAmB;CACxE,UAAU,OAAO,SAAS;EAAC;EAAiB;EAAY;CAAY,CAAC;CACrE,SAAS,OAAO;CAChB,WAAW,OAAO;CAClB,OAAO,OAAO,SAAS;EAAC;EAAS;EAAqB;EAAQ;CAAS,CAAC;AAC1E,CAAC,CAAC,CAAC,CAAC;AAeJ,MAAM,cACJ,SACA,cACkB;CAClB,IAAI,YAAY,KAAA,GAAW,OAAO;CAClC,IAAI,QAAQ,SAAS,aAAa,UAAU,SAAS,WAAW,OAAO,EAAE,MAAM,UAAU;CACzF,OAAO;EACL,MAAM;EACN,SAAS,CAAC,mBAAG,IAAI,IAAI,CAAC,GAAG,QAAQ,SAAS,GAAG,UAAU,OAAO,CAAC,CAAC;CAClE;AACF;AAEA,MAAM,UAAU,OAAO,GAAG,oBAAoB,CAAC,CAAC,WAC9C,OAMA;CACA,MAAM,aAAa,OAAOC;CAC1B,MAAM,SAAS,OAAO,OAAO;CAC7B,MAAM,MAAM,IAAI,KAAK,OAAO,MAAM,iBAAiB;CACnD,MAAM,oBAAoB,MAAM,qBAAqB,MAClD,eACC,CAAC,MAAM,eAAe,mBAAmB,MAAM,SAAS,KAAK,eAAe,UAAU,CAC1F;CACA,IAAI,sBAAsB,KAAA,GACxB,OAAO,OAAO,IAAID,QAAM;EACtB,UAAU;EACV,SAAS,6CAA6C;EACtD,WAAW;EACX,OAAO;CACT,CAAC;CAEH,MAAM,WAAW,OAAO,WAAW,sBACjC,MAAM,YACN,MAAM,eAAe,iBACvB;CACA,MAAM,kBACJ,UAAU,cAAc,OACvB,OAAO,OAAO,aAAa,KAC1B,OAAO,UACJ,UACC,IAAIA,QAAM;EACR,UAAU;EACV,SAAS,MAAM;EACf,WAAW;EACX,OAAO;CACT,CAAC,CACL,CACF;CACF,MAAM,kBAAkB,UAAU,SAAS,MAAM,YAAY,QAAQ,YAAY,MAAM,OAAO;CAC9F,MAAM,UAA8B;EAClC;EACA,WAAW,iBAAiB,aAAa;EACzC,OAAO,WAAW,iBAAiB,OAAO,MAAM,KAAK;EACrD,IACE,iBAAiB,OAChB,OAAO,OAAO,aAAa,KAC1B,OAAO,UACJ,UACC,IAAIA,QAAM;GACR,UAAU;GACV,SAAS,MAAM;GACf,WAAW;GACX,OAAO;EACT,CAAC,CACL,CACF;EACF,SAAS,MAAM;CACjB;CACA,MAAM,YAAkC;EACtC,eAAe;GACb,gBAAgB,MAAM;GACtB,oBAAoB,CAAC,GAAG,MAAM,eAAe,kBAAkB;GAC/D,WAAW,UAAU,cAAc,aAAa;GAChD,WAAW,MAAM,eAAe;GAChC,IAAI;GACJ,QAAQ,MAAM;GACd,mBAAmB,MAAM,eAAe;GACxC,iBAAiB,MAAM,eAAe;GACtC,YAAY,MAAM;GAClB,sBAAsB,CAAC,GAAG,MAAM,oBAAoB;GACpD,YAAY,EAAE,MAAM,SAAS;GAC7B,QAAQ,CAAC,GAAG,MAAM,eAAe,MAAM;EACzC;EACA,UAAU,CACR,GAAI,UAAU,SAAS,QAAQ,cAAc,UAAU,OAAO,QAAQ,EAAE,KAAK,CAAC,GAC9E,OACF;EACA,YAAY,MAAM,eAAe;CACnC;CACA,OAAO,OAAO,WAAW,QAAQ,SAAS;AAC5C,CAAC;AAED,MAAa,QAAQ,OAAO,GAAG,kBAAkB,CAAC,CAAC,WACjD,OACA;CACA,IAAI,MAAM,OAAO,SAAS,eAAe;EACvC,MAAM,SAAS,OAAO,OAAO;EAC7B,MAAM,MAAM,OAAO,MAAM;EACzB,MAAM,iBAAiB,OAAO,OAAO,aAAa,KAChD,OAAO,UACJ,UACC,IAAIA,QAAM;GACR,UAAU;GACV,SAAS,MAAM;GACf,WAAW;GACX,OAAO;EACT,CAAC,CACL,CACF;EACA,MAAM,UAAU,OAAO,MAAM,OAAO,KAAK,MAAM,cAAc;EAC7D,OAAO,MAAM,OAAO,cAAc,IAAI;GACpC,gBAAgB,MAAM;GACtB,WAAW,IAAI,KAAK,OAAO,MAAM,OAAO,SAAS,IAAY;GAC7D,OAAO,MAAM;GACb,IAAI;GACJ,QAAQ,MAAM,OAAO,KAAK;GAC1B,SAAS,MAAM;GACf,SAAS,QAAQ;GACjB,YAAY,MAAM,OAAO,KAAK;GAC9B,sBAAsB,CAAC,GAAG,MAAM,OAAO,KAAK,oBAAoB;EAClE,CAAC;EACD,OAAO,YAAY,SAAS;GAC1B,kBAAkB,QAAQ;GAC1B;EACF,CAAC;CACH;CACA,MAAM,iBAAiB,OAAO,MAAM,OAAO,aAAa,MAAM,OAAO,KAAK;CAC1E,MAAM,YAAY,OAAO,QAAQ;EAC/B;EACA,gBAAgB,MAAM;EACtB,OAAO,MAAM;EACb,QAAQ;EACR,SAAS,MAAM;EACf,YAAY,MAAM,OAAO;EACzB,sBAAsB,MAAM,OAAO;CACrC,CAAC;CACD,OAAO,YAAY,UAAU,EAAE,UAAU,CAAC;AAC5C,CAAC;AAED,MAAa,WAAW,OAAO,GAAG,qBAAqB,CAAC,CAAC,WAAW,OAAsB;CACxF,MAAM,eAAe,OAAO,MAAM,cAAc,QAC9C,MAAM,gBACN,IAAI,KAAK,OAAO,MAAM,iBAAiB,CACzC;CACA,IAAI,iBAAiB,MACnB,OAAO,OAAO,IAAIA,QAAM;EACtB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAEH,IACE,aAAa,eAAe,MAAM,KAAK,cACvC,aAAa,WAAW,MAAM,KAAK,QAEnC,OAAO,OAAO,IAAIA,QAAM;EACtB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAEH,MAAM,iBAAiB,OAAO,MAAM,KAAK,SAAS,aAAa,SAAS,MAAM,WAAW;CACzF,OAAO,OAAO,QAAQ;EACpB;EACA,gBAAgB,aAAa;EAC7B,OAAO,aAAa;EACpB,QAAQ,aAAa;EACrB,SAAS,aAAa;EACtB,YAAY,aAAa;EACzB,sBAAsB,aAAa;CACrC,CAAC;AACH,CAAC;;;;;;;;ACjRD,IAAa,QAAb,MAAa,MAAM;CACjB;CAEA,YAAoB,OAAe;EACjC,KAAK,SAAS;CAChB;CAEA,OAAO,KAAK,OAAsB;EAChC,IAAI,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,+BAA+B;EACvE,OAAO,IAAI,MAAM,KAAK;CACxB;CAEA,SAAiB;EACf,OAAO,KAAK;CACd;CAEA,SAAiB;EACf,OAAO;CACT;CAEA,WAAmB;EACjB,OAAO;CACT;AACF;AAEA,MAAa,OAAO,MAAM;;;;;;;;;;ACrB1B,MAAa,WAAW,OAAO,OAAO;CACpC,OAAO,OAAO;CACd,SAAS,OAAO;AAClB,CAAC;;AAUD,SAAgB,MAAY,SAAiB,QAAsC;CACjF,OAAO;EACL,QAAQ,OAAO,GAAG,wBAAwB,CAAC,EAAE,aAC3C,SAAS,YAAY,UACjB,OAAO,KACL,IAAIE,QAAkB,EACpB,SAAS,yCAAyC,SAAS,UAC7D,CAAC,CACH,IACA,OAAO,oBAAoB,MAAM,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,KACjD,OAAO,UAAU,UAAU,IAAIA,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACN;EACA,QAAQ,OAAO,GAAG,wBAAwB,CAAC,EAAE,UAC3C,OAAO,aAAa,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KACjC,OAAO,SAAS,YAAY,OAAO,oBAAoB,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,GAC5E,OAAO,KAAK,aAAa;GAAE,OAAO;GAAS;EAAQ,EAAE,GACrD,OAAO,UAAU,UAAU,IAAIA,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;EACA;CACF;AACF;AAEA,MAAaC,WAAS,OAAO,GAAG,iCAAiC,CAAC,EAAE,UAClE,OAAO,oBAAoB,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,KAC1C,OAAO,UAAU,UAAU,IAAID,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AAEA,MAAaE,WAAS,OAAO,WAAW,QAAQ;;;;;;;;;;;;;;;AC3ChD,MAAa,aAAaC,OAAE,SAAS,CAAC,YAAY,WAAW,CAAC;AAQ9D,MAAa,WAAW,KAAK,WAAqB;AAElD,MAAa,iBAAiBA,OAAE,YAAY;CAC1C,UAAU,CAAC;CACX,WAAW,EAAE,YAAYA,OAAE,eAAe;CAC1C,cAAc,EAAE,YAAYA,OAAE,eAAe;AAC/C,CAAC;AAED,MAAa,qBAAqBA,OAAE,OAAO;CACzC,YAAY;CACZ,UAAU;AACZ,CAAC;AAGD,MAAa,aAAaA,OAAE,YAAY;CACtC,QAAQ,CAAC;CACT,SAAS,EAAE,aAAaA,OAAE,eAAe;AAC3C,CAAC;;AAID,MAAaC,WAASD,OAAE,OAAO;CAC7B,gBAAgBA,OAAE;CAClB,oBAAoBA,OAAE,MAAM,kBAAkB;CAC9C,WAAWA,OAAE;CACb,WAAWA,OAAE,OAAOA,OAAE,cAAc;CACpC,IAAIA,OAAE;CACN,QAAQA,OAAE,SAAS;EAAC;EAAe;EAAU;CAAO,CAAC;CACrD,mBAAmBA,OAAE;CACrB,iBAAiBE;CACjB,YAAYF,OAAE;CACd,sBAAsBA,OAAE,MAAM,UAAU;CACxC,YAAY;CACZ,QAAQA,OAAE,MAAMA,OAAE,MAAM;AAC1B,CAAC;AAGD,MAAa,SAAS,OAAO,GAAG,8BAA8B,CAAC,EAAE,UAC/DA,OAAE,oBAAoBC,QAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KACnC,OAAO,UAAU,UAAU,IAAIE,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AAEA,MAAa,WAAW,OAAO,GAAG,gCAAgC,CAAC,EAAE,UACnEH,OAAE,oBAAoBA,OAAE,OAAOC,QAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAC7C,OAAO,UAAU,UAAU,IAAIE,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AAEA,MAAa,SAASH,OAAE,WAAWC,QAAM;AAEzC,SAAgB,YACd,eACA,YACsB;CACtB,OAAO,cAAc,mBAAmB,MAAM,SAAS,KAAK,eAAe,UAAU,CAAC,EAAE;AAC1F"}

package/dist/canonical-json-CpvqGMcr.mjs

@@ -0,0 +1,57 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
+import { Crypto, Effect, Layer, PlatformError, Schema } from "effect";
+//#region src/plan/canonical-json.ts
+var canonical_json_exports = /* @__PURE__ */ __exportAll({
+	CryptoError: () => CryptoError,
+	sha256Encoded: () => sha256Encoded,
+	sha256Json: () => sha256Json,
+	sha256Text: () => sha256Text,
+	stringify: () => stringify,
+	webCryptoLayer: () => webCryptoLayer
+});
+var CryptoError = class extends Schema.TaggedError()("CryptoError", { message: Schema.String }) {};
+/** Deterministic JSON serialization for already schema-encoded protocol values. */
+function stringify(value) {
+	if (value === null || typeof value !== "object") {
+		const encoded = JSON.stringify(value);
+		if (encoded === void 0) throw new TypeError("Value is not representable as JSON");
+		return encoded;
+	}
+	if (isJsonArray(value)) return `[${value.map(stringify).join(",")}]`;
+	return `{${Object.entries(value).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, entry]) => `${JSON.stringify(key)}:${stringify(entry)}`).join(",")}}`;
+}
+function isJsonArray(value) {
+	return Array.isArray(value);
+}
+const sha256Text = Effect.fn("Digest.sha256Text")(function* (value) {
+	return [...yield* (yield* Crypto.Crypto).digest("SHA-256", new TextEncoder().encode(value)).pipe(Effect.mapError((cause) => new CryptoError({ message: cause.message })))].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+});
+const sha256Json = Effect.fn("Digest.sha256Json")((value) => Effect.try({
+	try: () => stringify(value),
+	catch: (cause) => new CryptoError({ message: cause instanceof Error ? cause.message : String(cause) })
+}).pipe(Effect.flatMap(sha256Text)));
+function sha256EncodedProgram(schema, value) {
+	return Schema.encodeEffect(schema)(value).pipe(Effect.mapError((cause) => new CryptoError({ message: cause.message })), Effect.flatMap(Schema.decodeUnknownEffect(Schema.Json)), Effect.mapError((cause) => new CryptoError({ message: cause.message })), Effect.flatMap(sha256Json));
+}
+const sha256Encoded = Effect.fn("Digest.sha256Encoded")(sha256EncodedProgram);
+/** Portable Web Crypto implementation for hosts that want a ready-made Layer. */
+const webCryptoLayer = Layer.succeed(Crypto.Crypto, Crypto.make({
+	randomBytes: (size) => crypto.getRandomValues(new Uint8Array(size)),
+	digest: (algorithm, data) => Effect.tryPromise({
+		try: async () => {
+			const bytes = new Uint8Array(data.byteLength);
+			bytes.set(data);
+			return new Uint8Array(await crypto.subtle.digest(algorithm, bytes.buffer));
+		},
+		catch: (cause) => PlatformError.systemError({
+			_tag: "Unknown",
+			module: "WebCrypto",
+			method: "digest",
+			cause
+		})
+	})
+}));
+//#endregion
+export { webCryptoLayer as i, sha256Encoded as n, stringify as r, canonical_json_exports as t };
+
+//# sourceMappingURL=canonical-json-CpvqGMcr.mjs.map

package/dist/canonical-json-CpvqGMcr.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-json-CpvqGMcr.mjs","names":[],"sources":["../src/plan/canonical-json.ts"],"sourcesContent":["import { Crypto, Effect, Layer, PlatformError, Schema } from \"effect\";\n\nexport class CryptoError extends Schema.TaggedError<CryptoError>()(\"CryptoError\", {\n  message: Schema.String,\n}) {}\n\nexport type Json =\n  | null\n  | boolean\n  | number\n  | string\n  | ReadonlyArray<Json>\n  | { readonly [key: string]: Json };\n\n/** Deterministic JSON serialization for already schema-encoded protocol values. */\nexport function stringify(value: Json): string {\n  if (value === null || typeof value !== \"object\") {\n    const encoded = JSON.stringify(value);\n    if (encoded === undefined) throw new TypeError(\"Value is not representable as JSON\");\n    return encoded;\n  }\n  if (isJsonArray(value)) return `[${value.map(stringify).join(\",\")}]`;\n  return `{${Object.entries(value)\n    .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))\n    .map(([key, entry]) => `${JSON.stringify(key)}:${stringify(entry)}`)\n    .join(\",\")}}`;\n}\n\nfunction isJsonArray(value: Json): value is ReadonlyArray<Json> {\n  return Array.isArray(value);\n}\n\nexport const sha256Text = Effect.fn(\"Digest.sha256Text\")(function* (value: string) {\n  const cryptoService = yield* Crypto.Crypto;\n  const digest = yield* cryptoService\n    .digest(\"SHA-256\", new TextEncoder().encode(value))\n    .pipe(Effect.mapError((cause) => new CryptoError({ message: cause.message })));\n  return [...digest].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n});\n\nexport const sha256Json = Effect.fn(\"Digest.sha256Json\")((value: Json) =>\n  Effect.try({\n    try: () => stringify(value),\n    catch: (cause) =>\n      new CryptoError({ message: cause instanceof Error ? cause.message : String(cause) }),\n  }).pipe(Effect.flatMap(sha256Text)),\n);\n\nfunction sha256EncodedProgram<S extends Schema.Constraint>(\n  schema: S,\n  value: S[\"Type\"],\n): Effect.Effect<string, CryptoError, Crypto.Crypto | S[\"EncodingServices\"]> {\n  return Schema.encodeEffect(schema)(value).pipe(\n    Effect.mapError((cause) => new CryptoError({ message: cause.message })),\n    Effect.flatMap(Schema.decodeUnknownEffect(Schema.Json)),\n    Effect.mapError((cause) => new CryptoError({ message: cause.message })),\n    Effect.flatMap(sha256Json),\n  );\n}\n\nexport const sha256Encoded = Effect.fn(\"Digest.sha256Encoded\")(sha256EncodedProgram);\n\n/** Portable Web Crypto implementation for hosts that want a ready-made Layer. */\nexport const webCryptoLayer: Layer.Layer<Crypto.Crypto> = Layer.succeed(\n  Crypto.Crypto,\n  Crypto.make({\n    randomBytes: (size) => crypto.getRandomValues(new Uint8Array(size)),\n    digest: (algorithm, data) =>\n      Effect.tryPromise({\n        try: async () => {\n          const bytes = new Uint8Array(data.byteLength);\n          bytes.set(data);\n          return new Uint8Array(await crypto.subtle.digest(algorithm, bytes.buffer));\n        },\n        catch: (cause) =>\n          PlatformError.systemError({\n            _tag: \"Unknown\",\n            module: \"WebCrypto\",\n            method: \"digest\",\n            cause,\n          }),\n      }),\n  }),\n);\n"],"mappings":";;;;;;;;;;;AAEA,IAAa,cAAb,cAAiC,OAAO,YAAyB,CAAC,CAAC,eAAe,EAChF,SAAS,OAAO,OAClB,CAAC,CAAC,CAAC,CAAC;;AAWJ,SAAgB,UAAU,OAAqB;CAC7C,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;EAC/C,MAAM,UAAU,KAAK,UAAU,KAAK;EACpC,IAAI,YAAY,KAAA,GAAW,MAAM,IAAI,UAAU,oCAAoC;EACnF,OAAO;CACT;CACA,IAAI,YAAY,KAAK,GAAG,OAAO,IAAI,MAAM,IAAI,SAAS,CAAC,CAAC,KAAK,GAAG,EAAE;CAClE,OAAO,IAAI,OAAO,QAAQ,KAAK,CAAC,CAC7B,MAAM,CAAC,OAAO,CAAC,WAAY,OAAO,QAAQ,KAAK,OAAO,QAAQ,IAAI,CAAE,CAAC,CACrE,KAAK,CAAC,KAAK,WAAW,GAAG,KAAK,UAAU,GAAG,EAAE,GAAG,UAAU,KAAK,GAAG,CAAC,CACnE,KAAK,GAAG,EAAE;AACf;AAEA,SAAS,YAAY,OAA2C;CAC9D,OAAO,MAAM,QAAQ,KAAK;AAC5B;AAEA,MAAa,aAAa,OAAO,GAAG,mBAAmB,CAAC,CAAC,WAAW,OAAe;CAKjF,OAAO,CAAC,GAAG,QAHW,OADO,OAAO,OAAA,CAEjC,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAClD,KAAK,OAAO,UAAU,UAAU,IAAI,YAAY,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAAC,CAC9D,CAAC,CAAC,KAAK,SAAS,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;AAC9E,CAAC;AAED,MAAa,aAAa,OAAO,GAAG,mBAAmB,CAAC,EAAE,UACxD,OAAO,IAAI;CACT,WAAW,UAAU,KAAK;CAC1B,QAAQ,UACN,IAAI,YAAY,EAAE,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,CAAC;AACvF,CAAC,CAAC,CAAC,KAAK,OAAO,QAAQ,UAAU,CAAC,CACpC;AAEA,SAAS,qBACP,QACA,OAC2E;CAC3E,OAAO,OAAO,aAAa,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KACxC,OAAO,UAAU,UAAU,IAAI,YAAY,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,GACtE,OAAO,QAAQ,OAAO,oBAAoB,OAAO,IAAI,CAAC,GACtD,OAAO,UAAU,UAAU,IAAI,YAAY,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,GACtE,OAAO,QAAQ,UAAU,CAC3B;AACF;AAEA,MAAa,gBAAgB,OAAO,GAAG,sBAAsB,CAAC,CAAC,oBAAoB;;AAGnF,MAAa,iBAA6C,MAAM,QAC9D,OAAO,QACP,OAAO,KAAK;CACV,cAAc,SAAS,OAAO,gBAAgB,IAAI,WAAW,IAAI,CAAC;CAClE,SAAS,WAAW,SAClB,OAAO,WAAW;EAChB,KAAK,YAAY;GACf,MAAM,QAAQ,IAAI,WAAW,KAAK,UAAU;GAC5C,MAAM,IAAI,IAAI;GACd,OAAO,IAAI,WAAW,MAAM,OAAO,OAAO,OAAO,WAAW,MAAM,MAAM,CAAC;EAC3E;EACA,QAAQ,UACN,cAAc,YAAY;GACxB,MAAM;GACN,QAAQ;GACR,QAAQ;GACR;EACF,CAAC;CACL,CAAC;AACL,CAAC,CACH"}

package/dist/{cloudflare-D0-J2MfP.mjs → cloudflare-Bg_p-M2c.mjs}

@@ -1,11 +1,14 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { a as tokenMethod$1, c as make$1, i as subjectResolver$1, n as manifest$1, o as tokenValidator$1, r as oauthMethod$1 } from "./auth-B0owkrpk.mjs";
+import { a as subjectResolver$1, c as tokenValidator$1, d as make$1, i as oauthMethod$1, n as manifest$1, o as tokenConnectionMethod$1, r as oauthFlow$1, s as tokenMethod$1 } from "./auth-B4jq3yk3.mjs";
+import { n as fromEffectFlow, r as fromEffectTokenMethod } from "./connection-X3rZhrBZ.mjs";
 import { Effect } from "effect";
 //#region src/promise/cloudflare-auth.ts
 var cloudflare_auth_exports = /* @__PURE__ */ __exportAll({
 	manifest: () => manifest,
+	oauthFlow: () => oauthFlow,
 	oauthMethod: () => oauthMethod,
 	subjectResolver: () => subjectResolver,
+	tokenConnectionMethod: () => tokenConnectionMethod,
 	tokenMethod: () => tokenMethod,
 	tokenValidator: () => tokenValidator
 });
@@ -16,6 +19,14 @@ function subjectResolver(options) {
 	const resolve = subjectResolver$1(options);
 	return (tokens, accessToken) => Effect.runPromise(resolve(tokens, accessToken));
 }
+/** Creates Cloudflare's OAuth implementation for the Promise connection facade. */
+function oauthFlow(options) {
+	return fromEffectFlow(oauthFlow$1(options));
+}
+/** Creates a Cloudflare token method for the Promise connection facade. */
+function tokenConnectionMethod(options) {
+	return fromEffectTokenMethod(tokenConnectionMethod$1(options));
+}
 function tokenValidator(options) {
 	const validate = tokenValidator$1(options);
 	return (token) => Effect.runPromise(validate(token));
@@ -24,6 +35,7 @@ function tokenValidator(options) {
 //#region src/promise/cloudflare.ts
 var cloudflare_exports = /* @__PURE__ */ __exportAll({
 	Auth: () => cloudflare_auth_exports,
+	discovery: () => discovery,
 	make: () => make
 });
 /** Creates a Promise-compatible facade over the Effect-native Cloudflare client. */
@@ -40,7 +52,18 @@ function make(options) {
 		validateToken: () => Effect.runPromise(client.validateToken())
 	};
 }
+/** Creates the optional Cloudflare discovery source for Promise consumers. */
+function discovery(options) {
+	const client = make(options);
+	return {
+		listZones: async (name) => (await client.listZones({ name })).map((zone) => ({
+			...zone,
+			status: zone.status === "active" || zone.status === "pending" ? zone.status : "unknown"
+		})),
+		provider: client
+	};
+}
 //#endregion
-export { make as n, cloudflare_auth_exports as r, cloudflare_exports as t };
+export { cloudflare_auth_exports as i, discovery as n, make as r, cloudflare_exports as t };
 
-//# sourceMappingURL=cloudflare-D0-J2MfP.mjs.map
+//# sourceMappingURL=cloudflare-Bg_p-M2c.mjs.map

package/dist/cloudflare-Bg_p-M2c.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-Bg_p-M2c.mjs","names":["EffectAuth.manifest","EffectAuth.oauthMethod","EffectAuth.tokenMethod","EffectAuth.subjectResolver","Connection.fromEffectFlow","EffectAuth.oauthFlow","Connection.fromEffectTokenMethod","EffectAuth.tokenConnectionMethod","EffectAuth.tokenValidator","Cloudflare.make"],"sources":["../src/promise/cloudflare-auth.ts","../src/promise/cloudflare.ts"],"sourcesContent":["import type * as oauth from \"oauth4webapi\";\nimport { Effect } from \"effect\";\n\nimport type * as ProviderAuth from \"../auth/manifest.ts\";\nimport type * as Secret from \"../auth/secret.ts\";\nimport * as EffectAuth from \"../providers/cloudflare/auth.ts\";\nimport * as Connection from \"./connection.ts\";\n\nexport const manifest = EffectAuth.manifest;\nexport const oauthMethod = EffectAuth.oauthMethod;\nexport const tokenMethod = EffectAuth.tokenMethod;\nexport type {\n  CredentialTarget,\n  OAuthFlowOptions,\n  OAuthMethodOptions,\n  SubjectResolverOptions,\n  TokenValidatorOptions,\n} from \"../providers/cloudflare/auth.ts\";\n\nexport function subjectResolver(\n  options: EffectAuth.SubjectResolverOptions,\n): ProviderAuth.AsyncOAuthSubjectResolver {\n  const resolve = EffectAuth.subjectResolver(options);\n  return (tokens: oauth.TokenEndpointResponse, accessToken: Secret.Value) =>\n    Effect.runPromise(resolve(tokens, accessToken));\n}\n\n/** Creates Cloudflare's OAuth implementation for the Promise connection facade. */\nexport function oauthFlow(options: EffectAuth.OAuthFlowOptions): Connection.InteractiveFlow {\n  return Connection.fromEffectFlow(EffectAuth.oauthFlow(options));\n}\n\n/** Creates a Cloudflare token method for the Promise connection facade. */\nexport function tokenConnectionMethod(\n  options: EffectAuth.TokenConnectionOptions,\n): Extract<Connection.Method, { readonly _tag: \"Token\" }> {\n  return Connection.fromEffectTokenMethod(EffectAuth.tokenConnectionMethod(options));\n}\n\nexport function tokenValidator(\n  options: EffectAuth.TokenValidatorOptions,\n): (token: Secret.Value) => Promise<ProviderAuth.TokenValidation> {\n  const validate = EffectAuth.tokenValidator(options);\n  return (token) => Effect.runPromise(validate(token));\n}\n","import { Effect } from \"effect\";\n\nimport type * as ProviderAuth from \"../auth/manifest.ts\";\nimport type * as DnsProvider from \"../provider/provider.ts\";\nimport * as Cloudflare from \"../providers/cloudflare/index.ts\";\nimport type * as ZoneDiscovery from \"./zone-discovery.ts\";\n\nexport * as Auth from \"./cloudflare-auth.ts\";\nexport type {\n  Account,\n  Fetch,\n  ListZonesInput,\n  Options,\n  Zone,\n} from \"../providers/cloudflare/client.ts\";\n\nexport interface Interface extends DnsProvider.AsyncInterface {\n  readonly listAccounts: () => Promise<ReadonlyArray<Cloudflare.Account>>;\n  readonly listZones: (\n    input?: Cloudflare.Client.ListZonesInput,\n  ) => Promise<ReadonlyArray<Cloudflare.Zone>>;\n  readonly validateToken: () => Promise<ProviderAuth.TokenValidation>;\n}\n\n/** Creates a Promise-compatible facade over the Effect-native Cloudflare client. */\nexport function make(options: Cloudflare.Client.Options): Interface {\n  const client = Cloudflare.make(options);\n  return {\n    id: client.id,\n    createRecord: (zone, record) => Effect.runPromise(client.createRecord(zone, record)),\n    deleteRecord: (zone, providerRecordId) =>\n      Effect.runPromise(client.deleteRecord(zone, providerRecordId)),\n    getRecord: (zone, providerRecordId) =>\n      Effect.runPromise(client.getRecord(zone, providerRecordId)),\n    listAccounts: () => Effect.runPromise(client.listAccounts()),\n    listRecords: (zone) => Effect.runPromise(client.listRecords(zone)),\n    listZones: (input) => Effect.runPromise(client.listZones(input)),\n    validateToken: () => Effect.runPromise(client.validateToken()),\n  };\n}\n\n/** Creates the optional Cloudflare discovery source for Promise consumers. */\nexport function discovery(options: Cloudflare.Client.Options): ZoneDiscovery.Source {\n  const client = make(options);\n  return {\n    listZones: async (name) =>\n      (await client.listZones({ name })).map((zone) => ({\n        ...zone,\n        status: zone.status === \"active\" || zone.status === \"pending\" ? zone.status : \"unknown\",\n      })),\n    provider: client,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;AAQA,MAAa,WAAWA;AACxB,MAAa,cAAcC;AAC3B,MAAa,cAAcC;AAS3B,SAAgB,gBACd,SACwC;CACxC,MAAM,UAAUC,kBAA2B,OAAO;CAClD,QAAQ,QAAqC,gBAC3C,OAAO,WAAW,QAAQ,QAAQ,WAAW,CAAC;AAClD;;AAGA,SAAgB,UAAU,SAAkE;CAC1F,OAAOC,eAA0BC,YAAqB,OAAO,CAAC;AAChE;;AAGA,SAAgB,sBACd,SACwD;CACxD,OAAOC,sBAAiCC,wBAAiC,OAAO,CAAC;AACnF;AAEA,SAAgB,eACd,SACgE;CAChE,MAAM,WAAWC,iBAA0B,OAAO;CAClD,QAAQ,UAAU,OAAO,WAAW,SAAS,KAAK,CAAC;AACrD;;;;;;;;;ACnBA,SAAgB,KAAK,SAA+C;CAClE,MAAM,SAASC,OAAgB,OAAO;CACtC,OAAO;EACL,IAAI,OAAO;EACX,eAAe,MAAM,WAAW,OAAO,WAAW,OAAO,aAAa,MAAM,MAAM,CAAC;EACnF,eAAe,MAAM,qBACnB,OAAO,WAAW,OAAO,aAAa,MAAM,gBAAgB,CAAC;EAC/D,YAAY,MAAM,qBAChB,OAAO,WAAW,OAAO,UAAU,MAAM,gBAAgB,CAAC;EAC5D,oBAAoB,OAAO,WAAW,OAAO,aAAa,CAAC;EAC3D,cAAc,SAAS,OAAO,WAAW,OAAO,YAAY,IAAI,CAAC;EACjE,YAAY,UAAU,OAAO,WAAW,OAAO,UAAU,KAAK,CAAC;EAC/D,qBAAqB,OAAO,WAAW,OAAO,cAAc,CAAC;CAC/D;AACF;;AAGA,SAAgB,UAAU,SAA0D;CAClF,MAAM,SAAS,KAAK,OAAO;CAC3B,OAAO;EACL,WAAW,OAAO,UACf,MAAM,OAAO,UAAU,EAAE,KAAK,CAAC,EAAA,CAAG,KAAK,UAAU;GAChD,GAAG;GACH,QAAQ,KAAK,WAAW,YAAY,KAAK,WAAW,YAAY,KAAK,SAAS;EAChF,EAAE;EACJ,UAAU;CACZ;AACF"}

package/dist/cloudflare-FDl5q7Dm.d.mts

@@ -0,0 +1,32 @@
+import { X as AsyncOAuthSubjectResolver, ct as AsyncInterface, it as TokenValidation, ot as Value } from "./zone-discovery-BA5I24vu.mjs";
+import { _ as Zone, a as SubjectResolverOptions, d as tokenMethod$1, f as Account, g as Options, h as ListZonesInput, i as OAuthMethodOptions, l as manifest$1, n as CredentialTarget, o as TokenConnectionOptions, p as Fetch, r as OAuthFlowOptions, s as TokenValidatorOptions, u as oauthMethod$1 } from "./index-B1opsgls.mjs";
+import { a as Source, n as Method, t as InteractiveFlow } from "./connection-CEqadXSm.mjs";
+declare namespace cloudflare_auth_d_exports {
+  export { CredentialTarget, OAuthFlowOptions, OAuthMethodOptions, SubjectResolverOptions, TokenValidatorOptions, manifest, oauthFlow, oauthMethod, subjectResolver, tokenConnectionMethod, tokenMethod, tokenValidator };
+}
+declare const manifest: typeof manifest$1;
+declare const oauthMethod: typeof oauthMethod$1;
+declare const tokenMethod: typeof tokenMethod$1;
+declare function subjectResolver(options: SubjectResolverOptions): AsyncOAuthSubjectResolver;
+/** Creates Cloudflare's OAuth implementation for the Promise connection facade. */
+declare function oauthFlow(options: OAuthFlowOptions): InteractiveFlow;
+/** Creates a Cloudflare token method for the Promise connection facade. */
+declare function tokenConnectionMethod(options: TokenConnectionOptions): Extract<Method, {
+  readonly _tag: "Token";
+}>;
+declare function tokenValidator(options: TokenValidatorOptions): (token: Value) => Promise<TokenValidation>;
+declare namespace cloudflare_d_exports {
+  export { Account, cloudflare_auth_d_exports as Auth, Fetch, Interface, ListZonesInput, Options, Zone, discovery, make };
+}
+interface Interface extends AsyncInterface {
+  readonly listAccounts: () => Promise<ReadonlyArray<Account>>;
+  readonly listZones: (input?: ListZonesInput) => Promise<ReadonlyArray<Zone>>;
+  readonly validateToken: () => Promise<TokenValidation>;
+}
+/** Creates a Promise-compatible facade over the Effect-native Cloudflare client. */
+declare function make(options: Options): Interface;
+/** Creates the optional Cloudflare discovery source for Promise consumers. */
+declare function discovery(options: Options): Source;
+//#endregion
+export { cloudflare_auth_d_exports as a, make as i, cloudflare_d_exports as n, discovery as r, Interface as t };
+//# sourceMappingURL=cloudflare-FDl5q7Dm.d.mts.map

package/dist/cloudflare.d.mts

@@ -1,3 +1,3 @@
-import { d as Fetch, h as Zone, m as Options, p as ListZonesInput, u as Account } from "./index-D2howbNz.mjs";
-import { i as cloudflare_auth_d_exports, r as make, t as Interface } from "./cloudflare-CprjjXfm.mjs";
-export { type Account, cloudflare_auth_d_exports as Auth, type Fetch, Interface, type ListZonesInput, type Options, type Zone, make };
+import { _ as Zone, f as Account, g as Options, h as ListZonesInput, p as Fetch } from "./index-B1opsgls.mjs";
+import { a as cloudflare_auth_d_exports, i as make, r as discovery, t as Interface } from "./cloudflare-FDl5q7Dm.mjs";
+export { type Account, cloudflare_auth_d_exports as Auth, type Fetch, Interface, type ListZonesInput, type Options, type Zone, discovery, make };

package/dist/cloudflare.mjs

@@ -1,2 +1,2 @@
-import { n as make, r as cloudflare_auth_exports } from "./cloudflare-D0-J2MfP.mjs";
-export { cloudflare_auth_exports as Auth, make };
+import { i as cloudflare_auth_exports, n as discovery, r as make } from "./cloudflare-Bg_p-M2c.mjs";
+export { cloudflare_auth_exports as Auth, discovery, make };

package/dist/connection-BXoSrhZs.mjs

@@ -0,0 +1,58 @@
+import { O as parse, T as Schema$2, k as Error$1 } from "./dns-record-BLeqo56C.mjs";
+import { l as evidenceFor } from "./authorization-CQSKKMrW.mjs";
+import { Effect, Schema } from "effect";
+//#region src/auth/connection.ts
+const Grant = Schema.TaggedUnion({
+	account: {},
+	domains: { domains: Schema.Array(Schema$2) }
+});
+/** An owner-scoped grant bound to one provider authorization. */
+const Schema$1 = Schema.Struct({
+	authorizationId: Schema.String,
+	createdAt: Schema.DateFromString,
+	grant: Grant,
+	id: Schema.String,
+	ownerId: Schema.String
+});
+const decode = Effect.fn("Connection.decode")((input) => Schema.decodeUnknownEffect(Schema$1)(input).pipe(Effect.mapError((cause) => new Error$1({ message: cause.message }))));
+const validate = Effect.fn("Connection.validate")((input) => Schema.decodeUnknownEffect(Schema.toType(Schema$1))(input).pipe(Effect.mapError((cause) => new Error$1({ message: cause.message }))));
+const encode = Schema.encodeSync(Schema$1);
+var AuthorizationError = class extends Schema.TaggedError()("AuthorizationError", {
+	category: Schema.Literal("authorization"),
+	message: Schema.String,
+	operation: Schema.String,
+	retry: Schema.Literals([
+		"never",
+		"after-user-action",
+		"safe",
+		"unknown"
+	])
+}) {};
+const authorizationError = (message, operation) => new AuthorizationError({
+	category: "authorization",
+	message,
+	operation,
+	retry: "after-user-action"
+});
+function assertGrant(connection, authorization, request) {
+	if (connection.authorizationId !== authorization.id || authorization.providerId !== request.providerId || authorization.revocation._tag !== "Active") throw authorizationError("Connection does not grant this provider account", "Connection.assertGrant");
+	if (authorization.expiresAt !== null) {
+		if (Number.isNaN(authorization.expiresAt.getTime())) throw authorizationError("Connection expiration is invalid", "Connection.assertGrant");
+		if (authorization.expiresAt <= (request.now ?? /* @__PURE__ */ new Date())) throw authorizationError("Connection has expired", "Connection.assertGrant");
+	}
+	if (!authorization.requiredCapabilities.includes(request.capability)) throw authorizationError(`Connection lacks the ${request.capability} capability`, "Connection.assertGrant");
+	if (evidenceFor(authorization, request.capability) === void 0) throw authorizationError(`Connection has no evidence for the ${request.capability} capability`, "Connection.assertGrant");
+	let domain;
+	try {
+		domain = parse(request.domain);
+	} catch (cause) {
+		if (cause instanceof Error$1) throw cause;
+		throw new Error$1({ message: cause instanceof Error ? cause.message : String(cause) });
+	}
+	if (connection.grant._tag === "domains" && !connection.grant.domains.includes(domain)) throw authorizationError("Connection does not grant this domain", "Connection.assertGrant");
+	return domain;
+}
+//#endregion
+export { authorizationError as a, validate as c, assertGrant as i, Grant as n, decode as o, Schema$1 as r, encode as s, AuthorizationError as t };
+
+//# sourceMappingURL=connection-BXoSrhZs.mjs.map

package/dist/connection-BXoSrhZs.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-BXoSrhZs.mjs","names":["S","DomainName.Schema","Schema","InvalidInputError","ProviderAuthorization.evidenceFor","DomainName.parse"],"sources":["../src/auth/connection.ts"],"sourcesContent":["import { Effect, Schema as S } from \"effect\";\n\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport type { Value as Secret } from \"./secret.ts\";\nimport type { OAuthMethod } from \"./manifest.ts\";\nimport * as ProviderAuthorization from \"./authorization.ts\";\n\nexport const Grant = S.TaggedUnion({\n  account: {},\n  domains: { domains: S.Array(DomainName.Schema) },\n});\nexport type Grant = typeof Grant.Type;\n\n/** An owner-scoped grant bound to one provider authorization. */\nexport const Schema = S.Struct({\n  authorizationId: S.String,\n  createdAt: S.DateFromString,\n  grant: Grant,\n  id: S.String,\n  ownerId: S.String,\n});\nexport interface Connection extends S.Schema.Type<typeof Schema> {}\n\nexport const decode = Effect.fn(\"Connection.decode\")((input: unknown) =>\n  S.decodeUnknownEffect(Schema)(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport const validate = Effect.fn(\"Connection.validate\")((input: unknown) =>\n  S.decodeUnknownEffect(S.toType(Schema))(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport const encode = S.encodeSync(Schema);\n\nexport interface OAuthContinuation {\n  readonly clientId: string;\n  readonly codeVerifier: Secret;\n  readonly expiresAt: Date;\n  readonly grant: Grant;\n  readonly method: OAuthMethod;\n  readonly ownerId: string;\n  readonly redirectUri: string;\n  readonly stateHash: string;\n  readonly authorizedById: string;\n}\n\nexport interface StoredCredential {\n  readonly accessToken: Secret;\n  readonly refreshToken: Secret | null;\n  readonly tokenType: string;\n}\n\nexport class AuthorizationError extends S.TaggedError<AuthorizationError>()(\"AuthorizationError\", {\n  category: S.Literal(\"authorization\"),\n  message: S.String,\n  operation: S.String,\n  retry: S.Literals([\"never\", \"after-user-action\", \"safe\", \"unknown\"]),\n}) {}\n\nexport const authorizationError = (message: string, operation: string): AuthorizationError =>\n  new AuthorizationError({\n    category: \"authorization\",\n    message,\n    operation,\n    retry: \"after-user-action\",\n  });\n\nexport function assertGrant(\n  connection: Connection,\n  authorization: ProviderAuthorization.ProviderAuthorization,\n  request: {\n    readonly capability: ProviderAuthorization.Capability;\n    readonly domain: string;\n    readonly now?: Date;\n    readonly providerId: string;\n  },\n): DomainName.DomainName {\n  if (\n    connection.authorizationId !== authorization.id ||\n    authorization.providerId !== request.providerId ||\n    authorization.revocation._tag !== \"Active\"\n  ) {\n    throw authorizationError(\n      \"Connection does not grant this provider account\",\n      \"Connection.assertGrant\",\n    );\n  }\n  if (authorization.expiresAt !== null) {\n    if (Number.isNaN(authorization.expiresAt.getTime())) {\n      throw authorizationError(\"Connection expiration is invalid\", \"Connection.assertGrant\");\n    }\n    if (authorization.expiresAt <= (request.now ?? new Date())) {\n      throw authorizationError(\"Connection has expired\", \"Connection.assertGrant\");\n    }\n  }\n  if (!authorization.requiredCapabilities.includes(request.capability)) {\n    throw authorizationError(\n      `Connection lacks the ${request.capability} capability`,\n      \"Connection.assertGrant\",\n    );\n  }\n  if (ProviderAuthorization.evidenceFor(authorization, request.capability) === undefined) {\n    throw authorizationError(\n      `Connection has no evidence for the ${request.capability} capability`,\n      \"Connection.assertGrant\",\n    );\n  }\n  let domain: DomainName.DomainName;\n  try {\n    domain = DomainName.parse(request.domain);\n  } catch (cause) {\n    if (cause instanceof InvalidInputError) throw cause;\n    throw new InvalidInputError({\n      message: cause instanceof Error ? cause.message : String(cause),\n    });\n  }\n  if (connection.grant._tag === \"domains\" && !connection.grant.domains.includes(domain)) {\n    throw authorizationError(\"Connection does not grant this domain\", \"Connection.assertGrant\");\n  }\n  return domain;\n}\n"],"mappings":";;;;AAQA,MAAa,QAAQA,OAAE,YAAY;CACjC,SAAS,CAAC;CACV,SAAS,EAAE,SAASA,OAAE,MAAMC,QAAiB,EAAE;AACjD,CAAC;;AAID,MAAaC,WAASF,OAAE,OAAO;CAC7B,iBAAiBA,OAAE;CACnB,WAAWA,OAAE;CACb,OAAO;CACP,IAAIA,OAAE;CACN,SAASA,OAAE;AACb,CAAC;AAGD,MAAa,SAAS,OAAO,GAAG,mBAAmB,CAAC,EAAE,UACpDA,OAAE,oBAAoBE,QAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KACnC,OAAO,UAAU,UAAU,IAAIC,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AAEA,MAAa,WAAW,OAAO,GAAG,qBAAqB,CAAC,EAAE,UACxDH,OAAE,oBAAoBA,OAAE,OAAOE,QAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAC7C,OAAO,UAAU,UAAU,IAAIC,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AAEA,MAAa,SAASH,OAAE,WAAWE,QAAM;AAoBzC,IAAa,qBAAb,cAAwCF,OAAE,YAAgC,CAAC,CAAC,sBAAsB;CAChG,UAAUA,OAAE,QAAQ,eAAe;CACnC,SAASA,OAAE;CACX,WAAWA,OAAE;CACb,OAAOA,OAAE,SAAS;EAAC;EAAS;EAAqB;EAAQ;CAAS,CAAC;AACrE,CAAC,CAAC,CAAC,CAAC;AAEJ,MAAa,sBAAsB,SAAiB,cAClD,IAAI,mBAAmB;CACrB,UAAU;CACV;CACA;CACA,OAAO;AACT,CAAC;AAEH,SAAgB,YACd,YACA,eACA,SAMuB;CACvB,IACE,WAAW,oBAAoB,cAAc,MAC7C,cAAc,eAAe,QAAQ,cACrC,cAAc,WAAW,SAAS,UAElC,MAAM,mBACJ,mDACA,wBACF;CAEF,IAAI,cAAc,cAAc,MAAM;EACpC,IAAI,OAAO,MAAM,cAAc,UAAU,QAAQ,CAAC,GAChD,MAAM,mBAAmB,oCAAoC,wBAAwB;EAEvF,IAAI,cAAc,cAAc,QAAQ,uBAAO,IAAI,KAAK,IACtD,MAAM,mBAAmB,0BAA0B,wBAAwB;CAE/E;CACA,IAAI,CAAC,cAAc,qBAAqB,SAAS,QAAQ,UAAU,GACjE,MAAM,mBACJ,wBAAwB,QAAQ,WAAW,cAC3C,wBACF;CAEF,IAAII,YAAkC,eAAe,QAAQ,UAAU,MAAM,KAAA,GAC3E,MAAM,mBACJ,sCAAsC,QAAQ,WAAW,cACzD,wBACF;CAEF,IAAI;CACJ,IAAI;EACF,SAASC,MAAiB,QAAQ,MAAM;CAC1C,SAAS,OAAO;EACd,IAAI,iBAAiBF,SAAmB,MAAM;EAC9C,MAAM,IAAIA,QAAkB,EAC1B,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAChE,CAAC;CACH;CACA,IAAI,WAAW,MAAM,SAAS,aAAa,CAAC,WAAW,MAAM,QAAQ,SAAS,MAAM,GAClF,MAAM,mBAAmB,yCAAyC,wBAAwB;CAE5F,OAAO;AACT"}