domainkit 0.14.0 → 0.15.0

package/dist/Verify.mjs

@@ -84,7 +84,9 @@ const requirementKey = (record) => [
 ].join(":");
 /**
 * How a readiness stands, as counts. Pure and total: a host renders "3 of 4 found" from the stored
-* fact without deciding what an absent readiness means, because `observed` says so.
+* fact without deciding what an absent readiness means, because `observed` says so. The parameter
+* is the least a value has to carry to be summarised, so core `Readiness` and the wire shape both
+* pass without naming a type between them.
 */
 const summary = (readiness) => {
 	const statuses = readiness?.requirements.map(({ status }) => status) ?? [];
@@ -222,6 +224,7 @@ const make = Effect.gen(function* () {
 			nextCheckAt
 		};
 		yield* observer.readinessChanged({
+			ownerId: principal.ownerId,
 			domain: row.domain,
 			readiness,
 			cause: input.cause

package/dist/Verify.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"Verify.mjs","names":["Storage.RequirementStatus","DnsRecord.data","DnsRecord.equals","DnsRecord.sameSet","Storage.Service","Connect.Service","Resolver.Service","DomainName.decode","Errors.decode","Principal.Service","Storage.Readiness","Errors.fail","Reason.InvalidInput"],"sources":["../src/Verify.ts"],"sourcesContent":["/**\n * Observe provider and public DNS for an attachment, persist per-requirement readiness, and say\n * when to look again. The host keeps its own state machine (and any provider-side verification\n * such as SES) and feeds that in as `HostEvidence`.\n */\nimport { Context, DateTime, Duration, Effect, Layer, Option, Schema } from \"effect\";\n\nimport * as Connect from \"./Connect.ts\";\nimport * as DnsRecord from \"./DnsRecord.ts\";\nimport * as Errors from \"./internal/error.ts\";\nimport * as Reason from \"./Reason.ts\";\nimport * as DomainName from \"./DomainName.ts\";\nimport type * as Plan from \"./Plan.ts\";\nimport * as Principal from \"./Principal.ts\";\nimport * as Resolver from \"./Resolver.ts\";\nimport * as Storage from \"./Storage.ts\";\n\n/**\n * Every piece of evidence carries `values`, what the observer returned for the requirement's name\n * and type (empty when nothing was found, the lookup timed out, or the resolver failed), and\n * `detail`, `null` when the requirement is satisfied and otherwise the mismatch summary or the\n * resolver's error text, so a host can render \"found X, expected Y\".\n */\n// Rows written before these fields existed decode with the empty values.\nconst Values = Schema.Array(Schema.String).pipe(Schema.withDecodingDefaultKey(Effect.succeed([])));\nconst Detail = Schema.NullOr(Schema.String).pipe(\n  Schema.withDecodingDefaultKey(Effect.succeed(null)),\n);\n\nexport class ProviderEvidence extends Schema.TaggedClass<ProviderEvidence>(\n  \"@domainkit/Evidence/Provider\",\n)(\"Provider\", {\n  provider: Schema.String,\n  status: Storage.RequirementStatus,\n  values: Values,\n  detail: Detail,\n  observedAt: Schema.DateTimeUtcFromString,\n}) {}\nexport class PublicDnsEvidence extends Schema.TaggedClass<PublicDnsEvidence>(\n  \"@domainkit/Evidence/PublicDns\",\n)(\"PublicDns\", {\n  resolver: Schema.String,\n  status: Storage.RequirementStatus,\n  values: Values,\n  detail: Detail,\n  observedAt: Schema.DateTimeUtcFromString,\n}) {}\n/** Anything the host knows that DomainKit cannot observe: SES identity status, a CDN cert, ... */\nexport class HostEvidence extends Schema.TaggedClass<HostEvidence>(\"@domainkit/Evidence/Host\")(\n  \"Host\",\n  {\n    source: Schema.String,\n    status: Schema.Literals([\"ok\", \"pending\", \"failed\"]),\n    label: Schema.String,\n    detail: Detail,\n    observedAt: Schema.DateTimeUtcFromString,\n  },\n) {}\nexport const Evidence = Schema.Union([ProviderEvidence, PublicDnsEvidence, HostEvidence]);\nexport type Evidence = typeof Evidence.Type;\n\nexport interface Requirement {\n  /** `requirementKey(record)`: what a host pairs its own row against, by content. */\n  readonly key: string;\n  readonly operationId: Plan.OperationId | null;\n  readonly record: DnsRecord.Model;\n  readonly status: Storage.RequirementStatus;\n  readonly evidence: ReadonlyArray<Evidence>;\n}\n\nexport interface Readiness {\n  readonly domain: string;\n  /** `null` for observe-only domains that have no attachment. */\n  readonly attachmentId: string | null;\n  readonly overall: Storage.Overall;\n  readonly requirements: ReadonlyArray<Requirement>;\n  readonly host: ReadonlyArray<HostEvidence>;\n  readonly checkedAt: DateTime.Utc;\n  readonly nextCheckAt: DateTime.Utc | null;\n}\n\ntype Fx<A> = Effect.Effect<A, Errors.DomainKitError, Principal.Service>;\n\nexport interface Interface {\n  /**\n   * What to observe, in order of precedence: `requirements` when supplied (an attached domain\n   * without a provisioning receipt, or a domain with no attachment whose records the customer\n   * applies by hand), else the latest provisioning receipt of the domain's attachment (records it\n   * applied or found in place). Neither is `InvalidInput`. Provider evidence is added when the\n   * attachment's session can be built; public DNS is always observed, and readiness is stored\n   * per domain either way.\n   */\n  readonly observe: (input: {\n    readonly domain: string;\n    readonly requirements?: ReadonlyArray<DnsRecord.Model>;\n  }) => Fx<Readiness>;\n  /** Merge host evidence into stored readiness without re-observing DNS. */\n  readonly attachEvidence: (input: {\n    readonly domain: string;\n    readonly evidence: ReadonlyArray<HostEvidence>;\n  }) => Fx<Readiness>;\n  readonly latest: (domain: string) => Fx<Readiness | null>;\n}\n\nexport class Service extends Context.Service<Service, Interface>()(\"@domainkit/Verify\") {}\n\n/**\n * A requirement's identity: the record's type, name, and data, and nothing else. It is what a host\n * pairs its own rows against readiness by, instead of trusting the order of the array.\n * `@domainkit/react`'s `Records.identity` is this function.\n */\nexport const requirementKey = (record: DnsRecord.Model): string =>\n  [record._tag, record.name, DnsRecord.data(record)].join(\":\");\n\n/** Counts across a readiness's requirements. `observed` is false when there is no readiness yet. */\nexport interface Summary {\n  readonly observed: boolean;\n  readonly total: number;\n  readonly satisfied: number;\n  readonly missing: number;\n  readonly mismatch: number;\n  readonly unknown: number;\n}\n\n/** The least a value has to carry to be summarised: core `Readiness` and the wire shape both do. */\nexport interface Summarisable {\n  readonly requirements: ReadonlyArray<{ readonly status: Storage.RequirementStatus }>;\n}\n\n/**\n * How a readiness stands, as counts. Pure and total: a host renders \"3 of 4 found\" from the stored\n * fact without deciding what an absent readiness means, because `observed` says so.\n */\nexport const summary = (readiness: Summarisable | null): Summary => {\n  const statuses = readiness?.requirements.map(({ status }) => status) ?? [];\n  const count = (status: Storage.RequirementStatus): number =>\n    statuses.filter((candidate) => candidate === status).length;\n  return {\n    observed: readiness !== null,\n    total: statuses.length,\n    satisfied: count(\"satisfied\"),\n    missing: count(\"missing\"),\n    mismatch: count(\"mismatch\"),\n    unknown: count(\"unknown\"),\n  };\n};\n\nexport interface PolicyShape {\n  /** Delay before the next check, given time since the first pending observation. Default ladder: 15s, 1m, 5m, 30m. */\n  readonly backoff: (pendingForMs: number) => number;\n  /** Which resolvers must agree for `satisfied`: default `any`. */\n  readonly quorum: \"any\" | \"all\" | { readonly minimum: number };\n}\nexport const defaults: PolicyShape = {\n  backoff: (pendingForMs) =>\n    pendingForMs < 60_000\n      ? 15_000\n      : pendingForMs < 10 * 60_000\n        ? 60_000\n        : pendingForMs < 60 * 60_000\n          ? 5 * 60_000\n          : 30 * 60_000,\n  quorum: \"any\",\n};\nexport class Policy extends Context.Reference<PolicyShape>(\"@domainkit/Verify/Policy\", {\n  defaultValue: () => defaults,\n}) {}\n\n/** Why readiness was written: a DNS observation, or host evidence merged into the stored row. */\nexport type Cause = \"observe\" | \"evidence\";\n\nexport interface ReadinessChanged {\n  readonly domain: string;\n  readonly readiness: Readiness;\n  readonly cause: Cause;\n}\n\nexport interface ObserverShape {\n  /**\n   * Called once per stored readiness, after the write. A host that projects readiness onto its own\n   * rows, wakes a durable job at `nextCheckAt`, or notifies a customer hangs it here instead of\n   * mirroring the fact at every call site.\n   *\n   * Events for one domain are not ordered against each other: two observations that overlap both\n   * store, last write wins in `Storage`, and their callbacks can finish in either order. A\n   * projection compares `readiness.checkedAt`, which is the moment the row was written, and keeps\n   * the later one; `latest` remains the authority.\n   */\n  readonly readinessChanged: (event: ReadinessChanged) => Effect.Effect<void, unknown>;\n}\n\n/**\n * The host seam for \"DomainKit wrote readiness\". The default does nothing; provide one with\n * `Effect.provideService(Verify.Observer, ...)` or `Layer.succeed(Verify.Observer, ...)` over\n * `DomainKit.layer`, the same way `Policy` is overridden.\n *\n * It runs after `storage.readiness.put` returns, outside any transaction, because `Storage`\n * exposes none. A failure or defect in the observer is logged and swallowed: the observation is\n * already durable, and losing it because a projection failed would make the stored fact depend on\n * the host's side effects. A host that needs the projection to be reliable enqueues durable work\n * here rather than doing the work inline.\n */\nexport class Observer extends Context.Reference<ObserverShape>(\"@domainkit/Verify/Observer\", {\n  defaultValue: (): ObserverShape => ({ readinessChanged: () => Effect.void }),\n}) {}\n\n// ---------------------------------------------------------------------------------------------\n// Implementation\n// ---------------------------------------------------------------------------------------------\n\nconst StoredEvidence = Schema.Array(Evidence);\n\ninterface ProviderSide {\n  readonly provider: string;\n  readonly records: ReadonlyArray<DnsRecord.Observed>;\n}\nconst StoredHost = Schema.Array(HostEvidence);\n\n/** A requirement is satisfied by an exact match; an exclusive one is contradicted by any same-set record. */\nexport const statusAgainst = (\n  record: DnsRecord.Model,\n  observed: ReadonlyArray<DnsRecord.Observed>,\n): Storage.RequirementStatus => {\n  if (observed.some((candidate) => DnsRecord.equals(candidate, record))) return \"satisfied\";\n  if (\n    record.policy === \"exclusive\" &&\n    observed.some((candidate) => DnsRecord.sameSet(candidate, record))\n  ) {\n    return \"mismatch\";\n  }\n  return \"missing\";\n};\n\ninterface Observation {\n  readonly status: Storage.RequirementStatus;\n  readonly values: ReadonlyArray<string>;\n  readonly detail: string | null;\n}\n\nconst render = (observed: DnsRecord.Observed): string =>\n  observed._tag === \"Opaque\" ? JSON.stringify(observed.raw) : DnsRecord.data(observed);\n\n/** Status plus what the observer holds for the requirement's name and type. */\nconst observation = (\n  record: DnsRecord.Model,\n  observed: ReadonlyArray<DnsRecord.Observed>,\n): Observation => {\n  const status = statusAgainst(record, observed);\n  const values = observed.filter((candidate) => DnsRecord.sameSet(candidate, record)).map(render);\n  const detail =\n    status === \"satisfied\"\n      ? null\n      : values.length === 0\n        ? `no ${record._tag} record at ${record.name}`\n        : `expected ${DnsRecord.data(record)}; found ${values.join(\", \")}`;\n  return { status, values, detail };\n};\n\nconst combine = (statuses: ReadonlyArray<Storage.RequirementStatus>): Storage.RequirementStatus => {\n  const known = statuses.filter((status) => status !== \"unknown\");\n  if (known.length === 0) return \"unknown\";\n  if (known.includes(\"mismatch\")) return \"mismatch\";\n  return known.every((status) => status === \"satisfied\") ? \"satisfied\" : \"missing\";\n};\n\nconst quorumStatus = (\n  quorum: PolicyShape[\"quorum\"],\n  statuses: ReadonlyArray<Storage.RequirementStatus>,\n): Storage.RequirementStatus => {\n  const known = statuses.filter((status) => status !== \"unknown\");\n  const satisfied = known.filter((status) => status === \"satisfied\").length;\n  const needed =\n    quorum === \"any\" ? 1 : quorum === \"all\" ? Math.max(1, known.length) : quorum.minimum;\n  if (known.includes(\"mismatch\")) return \"mismatch\";\n  if (known.length > 0 && satisfied >= needed) return \"satisfied\";\n  return known.length === 0 ? \"unknown\" : \"missing\";\n};\n\nconst overallOf = (\n  requirements: ReadonlyArray<{ readonly status: Storage.RequirementStatus }>,\n  host: ReadonlyArray<HostEvidence>,\n): Storage.Overall => {\n  if (\n    requirements.some(({ status }) => status === \"mismatch\") ||\n    host.some(({ status }) => status === \"failed\")\n  ) {\n    return \"failed\";\n  }\n  const ready =\n    requirements.length + host.length > 0 &&\n    requirements.every(({ status }) => status === \"satisfied\") &&\n    host.every(({ status }) => status === \"ok\");\n  return ready ? \"ready\" : \"pending\";\n};\n\n/** The identity of a requirement set: type, name, data, and policy, independent of labels and order. */\nconst requirementSetKey = (requirements: ReadonlyArray<{ readonly record: DnsRecord.Model }>) =>\n  requirements\n    .map(({ record }) => `${record._tag} ${record.name} ${DnsRecord.data(record)} ${record.policy}`)\n    .sort()\n    .join(\"\\n\");\n\nexport const make: Effect.Effect<\n  Interface,\n  never,\n  Storage.Service | Connect.Service | Resolver.Service\n> = Effect.gen(function* () {\n  const storage = yield* Storage.Service;\n  const connect = yield* Connect.Service;\n  const resolver = yield* Resolver.Service;\n\n  const attachmentFor = (\n    input: string,\n  ): Fx<{\n    readonly domain: DomainName.Model;\n    readonly attachment: Storage.Attachment | null;\n  }> =>\n    Effect.gen(function* () {\n      const domain = yield* DomainName.decode(input);\n      const attachment = yield* storage.attachments.byDomain(domain);\n      return { domain, attachment: Option.getOrNull(attachment) };\n    });\n\n  const decodeRow = (row: Storage.Readiness): Effect.Effect<Readiness, Errors.DomainKitError> =>\n    Effect.gen(function* () {\n      const requirements = yield* Effect.forEach(row.requirements, (requirement) =>\n        Errors.decode(StoredEvidence, requirement.evidence, \"evidence\").pipe(\n          Effect.map((evidence): Requirement => ({\n            key: requirementKey(requirement.record),\n            operationId: requirement.operationId,\n            record: requirement.record,\n            status: requirement.status,\n            evidence,\n          })),\n        ),\n      );\n      const host = yield* Errors.decode(StoredHost, row.host, \"host\");\n      return {\n        domain: row.domain,\n        attachmentId: row.attachmentId,\n        overall: row.overall,\n        requirements,\n        host,\n        checkedAt: row.checkedAt,\n        nextCheckAt: row.nextCheckAt,\n      };\n    });\n\n  /** Persist readiness, carrying the pending streak forward for the backoff ladder. */\n  const store = (input: {\n    readonly domain: string;\n    readonly attachment: Storage.Attachment | null;\n    readonly requirements: ReadonlyArray<Requirement>;\n    readonly host: ReadonlyArray<HostEvidence>;\n    readonly previous: Option.Option<Storage.Readiness>;\n    readonly cause: Cause;\n  }): Fx<Readiness> =>\n    Effect.gen(function* () {\n      const principal = yield* Principal.Service;\n      const policy = yield* Policy;\n      const observer = yield* Observer;\n      const now = yield* DateTime.now;\n      const overall = overallOf(input.requirements, input.host);\n      const sameRequirements =\n        Option.isSome(input.previous) &&\n        requirementSetKey(input.previous.value.requirements) ===\n          requirementSetKey(input.requirements);\n      const pendingSince =\n        overall === \"ready\"\n          ? null\n          : sameRequirements &&\n              Option.isSome(input.previous) &&\n              input.previous.value.pendingSince !== null\n            ? input.previous.value.pendingSince\n            : now;\n      const nextCheckAt =\n        pendingSince === null\n          ? null\n          : DateTime.addDuration(\n              now,\n              Duration.millis(\n                policy.backoff(DateTime.toEpochMillis(now) - DateTime.toEpochMillis(pendingSince)),\n              ),\n            );\n      const row = new Storage.Readiness({\n        domain: input.domain,\n        attachmentId: input.attachment?.id ?? null,\n        ownerId: principal.ownerId,\n        overall,\n        requirements: input.requirements.map((requirement) => ({\n          operationId: requirement.operationId,\n          record: requirement.record,\n          status: requirement.status,\n          evidence: Schema.encodeSync(StoredEvidence)(requirement.evidence),\n        })),\n        host: Schema.encodeSync(StoredHost)(input.host),\n        pendingSince,\n        checkedAt: now,\n        nextCheckAt,\n      });\n      yield* storage.readiness.put(row);\n      const readiness: Readiness = {\n        domain: row.domain,\n        attachmentId: row.attachmentId,\n        overall,\n        requirements: input.requirements,\n        host: input.host,\n        checkedAt: now,\n        nextCheckAt,\n      };\n      yield* observer\n        .readinessChanged({ domain: row.domain, readiness, cause: input.cause })\n        .pipe(\n          Effect.catchCause((cause) =>\n            Effect.logWarning(`Verify.Observer failed for ${row.domain}`, cause),\n          ),\n        );\n      return readiness;\n    });\n\n  const defaultRequirements = (\n    attachment: Storage.Attachment,\n  ): Fx<\n    ReadonlyArray<{\n      readonly operationId: Plan.OperationId | null;\n      readonly record: DnsRecord.Model;\n    }>\n  > =>\n    Effect.gen(function* () {\n      const latest = yield* storage.attempts.latest(attachment.id, \"provisioning\");\n      if (Option.isNone(latest) || latest.value.receipt === null) {\n        return yield* Errors.fail(\n          new Reason.InvalidInput({\n            message: `${attachment.domain} has no provisioning receipt; pass requirements to observe`,\n            field: \"requirements\",\n          }),\n        );\n      }\n      const receipt = latest.value.receipt;\n      const inPlace = new Set(\n        receipt.outcomes.flatMap((outcome) =>\n          outcome._tag === \"Applied\" || (outcome._tag === \"Skipped\" && outcome.reason === \"noop\")\n            ? [outcome.operationId]\n            : [],\n        ),\n      );\n      return latest.value.plan.operations\n        .filter((operation) => inPlace.has(operation.id))\n        .map((operation) => ({ operationId: operation.id, record: operation.record }));\n    });\n\n  const observe: Interface[\"observe\"] = (input) =>\n    Effect.gen(function* () {\n      const policy = yield* Policy;\n      const { domain, attachment } = yield* attachmentFor(input.domain);\n      if (input.requirements === undefined && attachment === null) {\n        return yield* Errors.fail(\n          new Reason.InvalidInput({\n            message: `${domain} is not attached; pass requirements to observe public DNS`,\n            field: \"requirements\",\n          }),\n        );\n      }\n      const requirements =\n        input.requirements === undefined && attachment !== null\n          ? yield* defaultRequirements(attachment)\n          : (input.requirements ?? []).map((record) => ({ operationId: null, record }));\n      if (requirements.length === 0) {\n        return yield* Errors.fail(\n          new Reason.InvalidInput({\n            message: \"Nothing to observe: pass at least one requirement\",\n            field: \"requirements\",\n          }),\n        );\n      }\n      const now = yield* DateTime.now;\n      // Provider readback is evidence when the attachment's session can be built; when it\n      // cannot (no attachment, revoked credential, provider outage) public DNS stands alone.\n      const providerSide = yield* attachment === null\n        ? Effect.succeed(Option.none<ProviderSide>())\n        : Effect.gen(function* () {\n            const connection = yield* storage.connections.get(attachment.connectionId);\n            const authorization = yield* storage.authorizations.get(connection.authorizationId);\n            const { session, target } = yield* connect.session(attachment.id);\n            const observed = yield* session.dns(target).list(target.zone);\n            return Option.some<ProviderSide>({\n              provider: authorization.provider,\n              records: observed.map(({ record }) => record),\n            });\n          }).pipe(Effect.catch(() => Effect.succeed(Option.none<ProviderSide>())));\n      const observed = yield* Effect.forEach(\n        requirements,\n        ({ operationId, record }) =>\n          Effect.gen(function* () {\n            const providerEvidence = Option.isSome(providerSide)\n              ? [\n                  new ProviderEvidence({\n                    provider: providerSide.value.provider,\n                    ...observation(record, providerSide.value.records),\n                    observedAt: now,\n                  }),\n                ]\n              : [];\n            const outcomes = yield* resolver.resolve(record.name, record._tag);\n            const publicEvidence = outcomes.map((outcome) =>\n              outcome._tag === \"Answered\"\n                ? new PublicDnsEvidence({\n                    resolver: outcome.answer.resolver,\n                    ...observation(record, outcome.answer.records),\n                    observedAt: now,\n                  })\n                : new PublicDnsEvidence({\n                    resolver: outcome.resolver,\n                    status: \"unknown\",\n                    values: [],\n                    detail:\n                      outcome._tag === \"TimedOut\"\n                        ? `${outcome.resolver} timed out`\n                        : outcome.message,\n                    observedAt: now,\n                  }),\n            );\n            const publicStatus = quorumStatus(\n              policy.quorum,\n              publicEvidence.map(({ status }) => status),\n            );\n            const status = combine([\n              ...providerEvidence.map((evidence) => evidence.status),\n              publicStatus,\n            ]);\n            return {\n              key: requirementKey(record),\n              operationId,\n              record,\n              status,\n              evidence: [...providerEvidence, ...publicEvidence],\n            } satisfies Requirement;\n          }),\n        { concurrency: \"unbounded\" },\n      );\n      const previous = yield* storage.readiness.get(domain);\n      const host = Option.isSome(previous)\n        ? yield* Errors.decode(StoredHost, previous.value.host, \"host\")\n        : [];\n      return yield* store({\n        domain,\n        attachment,\n        requirements: observed,\n        host,\n        previous,\n        cause: \"observe\",\n      });\n    });\n\n  const attachEvidence: Interface[\"attachEvidence\"] = (input) =>\n    Effect.gen(function* () {\n      const { domain, attachment } = yield* attachmentFor(input.domain);\n      const previous = yield* storage.readiness.get(domain);\n      const current = Option.isSome(previous)\n        ? yield* decodeRow(previous.value)\n        : {\n            requirements: [] as ReadonlyArray<Requirement>,\n            host: [] as ReadonlyArray<HostEvidence>,\n          };\n      const bySource = new Map(current.host.map((evidence) => [evidence.source, evidence]));\n      for (const evidence of input.evidence) bySource.set(evidence.source, evidence);\n      return yield* store({\n        domain,\n        attachment,\n        requirements: current.requirements,\n        host: [...bySource.values()],\n        previous,\n        cause: \"evidence\",\n      });\n    });\n\n  const latest: Interface[\"latest\"] = (domain) =>\n    Effect.gen(function* () {\n      const { domain: name } = yield* attachmentFor(domain);\n      const stored = yield* storage.readiness.get(name);\n      return Option.isSome(stored) ? yield* decodeRow(stored.value) : null;\n    });\n\n  return { observe, attachEvidence, latest };\n});\n\nexport const layer: Layer.Layer<\n  Service,\n  never,\n  Storage.Service | Connect.Service | Resolver.Service\n> = Layer.effect(Service)(make);\n\nconst accessor =\n  <Args extends ReadonlyArray<unknown>, A>(\n    pick: (service: Interface) => (...args: Args) => Fx<A>,\n  ): ((...args: Args) => Effect.Effect<A, Errors.DomainKitError, Principal.Service | Service>) =>\n  (...args) =>\n    Effect.flatMap(Service, (service) => pick(service)(...args));\n\nexport const observe = accessor((service) => service.observe);\nexport const attachEvidence = accessor((service) => service.attachEvidence);\nexport const latest = accessor((service) => service.latest);\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwBA,MAAM,SAAS,OAAO,MAAM,OAAO,MAAM,CAAC,CAAC,KAAK,OAAO,uBAAuB,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;AACjG,MAAM,SAAS,OAAO,OAAO,OAAO,MAAM,CAAC,CAAC,KAC1C,OAAO,uBAAuB,OAAO,QAAQ,IAAI,CAAC,CACpD;AAEA,IAAa,mBAAb,cAAsC,OAAO,YAC3C,8BACF,CAAC,CAAC,YAAY;CACZ,UAAU,OAAO;CACjB,QAAQA;CACR,QAAQ;CACR,QAAQ;CACR,YAAY,OAAO;AACrB,CAAC,CAAC,CAAC,CAAC;AACJ,IAAa,oBAAb,cAAuC,OAAO,YAC5C,+BACF,CAAC,CAAC,aAAa;CACb,UAAU,OAAO;CACjB,QAAQA;CACR,QAAQ;CACR,QAAQ;CACR,YAAY,OAAO;AACrB,CAAC,CAAC,CAAC,CAAC;;AAEJ,IAAa,eAAb,cAAkC,OAAO,YAA0B,0BAA0B,CAAC,CAC5F,QACA;CACE,QAAQ,OAAO;CACf,QAAQ,OAAO,SAAS;EAAC;EAAM;EAAW;CAAQ,CAAC;CACnD,OAAO,OAAO;CACd,QAAQ;CACR,YAAY,OAAO;AACrB,CACF,CAAC,CAAC,CAAC;AACH,MAAa,WAAW,OAAO,MAAM;CAAC;CAAkB;CAAmB;AAAY,CAAC;AA8CxF,IAAa,UAAb,cAA6B,QAAQ,QAA4B,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;;;;;;AAOzF,MAAa,kBAAkB,WAC7B;CAAC,OAAO;CAAM,OAAO;CAAMC,KAAe,MAAM;AAAC,CAAC,CAAC,KAAK,GAAG;;;;;AAqB7D,MAAa,WAAW,cAA4C;CAClE,MAAM,WAAW,WAAW,aAAa,KAAK,EAAE,aAAa,MAAM,KAAK,CAAC;CACzE,MAAM,SAAS,WACb,SAAS,QAAQ,cAAc,cAAc,MAAM,CAAC,CAAC;CACvD,OAAO;EACL,UAAU,cAAc;EACxB,OAAO,SAAS;EAChB,WAAW,MAAM,WAAW;EAC5B,SAAS,MAAM,SAAS;EACxB,UAAU,MAAM,UAAU;EAC1B,SAAS,MAAM,SAAS;CAC1B;AACF;AAQA,MAAa,WAAwB;CACnC,UAAU,iBACR,eAAe,MACX,OACA,eAAe,MACb,MACA,eAAe,OACb,MACA;CACV,QAAQ;AACV;AACA,IAAa,SAAb,cAA4B,QAAQ,UAAuB,4BAA4B,EACrF,oBAAoB,SACtB,CAAC,CAAC,CAAC,CAAC;;;;;;;;;;;;AAoCJ,IAAa,WAAb,cAA8B,QAAQ,UAAyB,8BAA8B,EAC3F,qBAAoC,EAAE,wBAAwB,OAAO,KAAK,GAC5E,CAAC,CAAC,CAAC,CAAC;AAMJ,MAAM,iBAAiB,OAAO,MAAM,QAAQ;AAM5C,MAAM,aAAa,OAAO,MAAM,YAAY;;AAG5C,MAAa,iBACX,QACA,aAC8B;CAC9B,IAAI,SAAS,MAAM,cAAcC,OAAiB,WAAW,MAAM,CAAC,GAAG,OAAO;CAC9E,IACE,OAAO,WAAW,eAClB,SAAS,MAAM,cAAcC,QAAkB,WAAW,MAAM,CAAC,GAEjE,OAAO;CAET,OAAO;AACT;AAQA,MAAM,UAAU,aACd,SAAS,SAAS,WAAW,KAAK,UAAU,SAAS,GAAG,IAAIF,KAAe,QAAQ;;AAGrF,MAAM,eACJ,QACA,aACgB;CAChB,MAAM,SAAS,cAAc,QAAQ,QAAQ;CAC7C,MAAM,SAAS,SAAS,QAAQ,cAAcE,QAAkB,WAAW,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM;CAO9F,OAAO;EAAE;EAAQ;EAAQ,QALvB,WAAW,cACP,OACA,OAAO,WAAW,IAChB,MAAM,OAAO,KAAK,aAAa,OAAO,SACtC,YAAYF,KAAe,MAAM,EAAE,UAAU,OAAO,KAAK,IAAI;CACrC;AAClC;AAEA,MAAM,WAAW,aAAkF;CACjG,MAAM,QAAQ,SAAS,QAAQ,WAAW,WAAW,SAAS;CAC9D,IAAI,MAAM,WAAW,GAAG,OAAO;CAC/B,IAAI,MAAM,SAAS,UAAU,GAAG,OAAO;CACvC,OAAO,MAAM,OAAO,WAAW,WAAW,WAAW,IAAI,cAAc;AACzE;AAEA,MAAM,gBACJ,QACA,aAC8B;CAC9B,MAAM,QAAQ,SAAS,QAAQ,WAAW,WAAW,SAAS;CAC9D,MAAM,YAAY,MAAM,QAAQ,WAAW,WAAW,WAAW,CAAC,CAAC;CACnE,MAAM,SACJ,WAAW,QAAQ,IAAI,WAAW,QAAQ,KAAK,IAAI,GAAG,MAAM,MAAM,IAAI,OAAO;CAC/E,IAAI,MAAM,SAAS,UAAU,GAAG,OAAO;CACvC,IAAI,MAAM,SAAS,KAAK,aAAa,QAAQ,OAAO;CACpD,OAAO,MAAM,WAAW,IAAI,YAAY;AAC1C;AAEA,MAAM,aACJ,cACA,SACoB;CACpB,IACE,aAAa,MAAM,EAAE,aAAa,WAAW,UAAU,KACvD,KAAK,MAAM,EAAE,aAAa,WAAW,QAAQ,GAE7C,OAAO;CAMT,OAHE,aAAa,SAAS,KAAK,SAAS,KACpC,aAAa,OAAO,EAAE,aAAa,WAAW,WAAW,KACzD,KAAK,OAAO,EAAE,aAAa,WAAW,IAAI,IAC7B,UAAU;AAC3B;;AAGA,MAAM,qBAAqB,iBACzB,aACG,KAAK,EAAE,aAAa,GAAG,OAAO,KAAK,GAAG,OAAO,KAAK,GAAGA,KAAe,MAAM,EAAE,GAAG,OAAO,QAAQ,CAAC,CAC/F,KAAK,CAAC,CACN,KAAK,IAAI;AAEd,MAAa,OAIT,OAAO,IAAI,aAAa;CAC1B,MAAM,UAAU,OAAOG;CACvB,MAAM,UAAU,OAAOC;CACvB,MAAM,WAAW,OAAOC;CAExB,MAAM,iBACJ,UAKA,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,OAAOC,OAAkB,KAAK;EAC7C,MAAM,aAAa,OAAO,QAAQ,YAAY,SAAS,MAAM;EAC7D,OAAO;GAAE;GAAQ,YAAY,OAAO,UAAU,UAAU;EAAE;CAC5D,CAAC;CAEH,MAAM,aAAa,QACjB,OAAO,IAAI,aAAa;EACtB,MAAM,eAAe,OAAO,OAAO,QAAQ,IAAI,eAAe,gBAC5DC,SAAc,gBAAgB,YAAY,UAAU,UAAU,CAAC,CAAC,KAC9D,OAAO,KAAK,cAA2B;GACrC,KAAK,eAAe,YAAY,MAAM;GACtC,aAAa,YAAY;GACzB,QAAQ,YAAY;GACpB,QAAQ,YAAY;GACpB;EACF,EAAE,CACJ,CACF;EACA,MAAM,OAAO,OAAOA,SAAc,YAAY,IAAI,MAAM,MAAM;EAC9D,OAAO;GACL,QAAQ,IAAI;GACZ,cAAc,IAAI;GAClB,SAAS,IAAI;GACb;GACA;GACA,WAAW,IAAI;GACf,aAAa,IAAI;EACnB;CACF,CAAC;;CAGH,MAAM,SAAS,UAQb,OAAO,IAAI,aAAa;EACtB,MAAM,YAAY,OAAOC;EACzB,MAAM,SAAS,OAAO;EACtB,MAAM,WAAW,OAAO;EACxB,MAAM,MAAM,OAAO,SAAS;EAC5B,MAAM,UAAU,UAAU,MAAM,cAAc,MAAM,IAAI;EACxD,MAAM,mBACJ,OAAO,OAAO,MAAM,QAAQ,KAC5B,kBAAkB,MAAM,SAAS,MAAM,YAAY,MACjD,kBAAkB,MAAM,YAAY;EACxC,MAAM,eACJ,YAAY,UACR,OACA,oBACE,OAAO,OAAO,MAAM,QAAQ,KAC5B,MAAM,SAAS,MAAM,iBAAiB,OACtC,MAAM,SAAS,MAAM,eACrB;EACR,MAAM,cACJ,iBAAiB,OACb,OACA,SAAS,YACP,KACA,SAAS,OACP,OAAO,QAAQ,SAAS,cAAc,GAAG,IAAI,SAAS,cAAc,YAAY,CAAC,CACnF,CACF;EACN,MAAM,MAAM,IAAIC,UAAkB;GAChC,QAAQ,MAAM;GACd,cAAc,MAAM,YAAY,MAAM;GACtC,SAAS,UAAU;GACnB;GACA,cAAc,MAAM,aAAa,KAAK,iBAAiB;IACrD,aAAa,YAAY;IACzB,QAAQ,YAAY;IACpB,QAAQ,YAAY;IACpB,UAAU,OAAO,WAAW,cAAc,CAAC,CAAC,YAAY,QAAQ;GAClE,EAAE;GACF,MAAM,OAAO,WAAW,UAAU,CAAC,CAAC,MAAM,IAAI;GAC9C;GACA,WAAW;GACX;EACF,CAAC;EACD,OAAO,QAAQ,UAAU,IAAI,GAAG;EAChC,MAAM,YAAuB;GAC3B,QAAQ,IAAI;GACZ,cAAc,IAAI;GAClB;GACA,cAAc,MAAM;GACpB,MAAM,MAAM;GACZ,WAAW;GACX;EACF;EACA,OAAO,SACJ,iBAAiB;GAAE,QAAQ,IAAI;GAAQ;GAAW,OAAO,MAAM;EAAM,CAAC,CAAC,CACvE,KACC,OAAO,YAAY,UACjB,OAAO,WAAW,8BAA8B,IAAI,UAAU,KAAK,CACrE,CACF;EACF,OAAO;CACT,CAAC;CAEH,MAAM,uBACJ,eAOA,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,OAAO,QAAQ,SAAS,OAAO,WAAW,IAAI,cAAc;EAC3E,IAAI,OAAO,OAAO,MAAM,KAAK,OAAO,MAAM,YAAY,MACpD,OAAO,OAAOC,KACZ,IAAIC,aAAoB;GACtB,SAAS,GAAG,WAAW,OAAO;GAC9B,OAAO;EACT,CAAC,CACH;EAEF,MAAM,UAAU,OAAO,MAAM;EAC7B,MAAM,UAAU,IAAI,IAClB,QAAQ,SAAS,SAAS,YACxB,QAAQ,SAAS,aAAc,QAAQ,SAAS,aAAa,QAAQ,WAAW,SAC5E,CAAC,QAAQ,WAAW,IACpB,CAAC,CACP,CACF;EACA,OAAO,OAAO,MAAM,KAAK,WACtB,QAAQ,cAAc,QAAQ,IAAI,UAAU,EAAE,CAAC,CAAC,CAChD,KAAK,eAAe;GAAE,aAAa,UAAU;GAAI,QAAQ,UAAU;EAAO,EAAE;CACjF,CAAC;CAEH,MAAM,WAAiC,UACrC,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,OAAO;EACtB,MAAM,EAAE,QAAQ,eAAe,OAAO,cAAc,MAAM,MAAM;EAChE,IAAI,MAAM,iBAAiB,KAAA,KAAa,eAAe,MACrD,OAAO,OAAOD,KACZ,IAAIC,aAAoB;GACtB,SAAS,GAAG,OAAO;GACnB,OAAO;EACT,CAAC,CACH;EAEF,MAAM,eACJ,MAAM,iBAAiB,KAAA,KAAa,eAAe,OAC/C,OAAO,oBAAoB,UAAU,KACpC,MAAM,gBAAgB,CAAC,EAAA,CAAG,KAAK,YAAY;GAAE,aAAa;GAAM;EAAO,EAAE;EAChF,IAAI,aAAa,WAAW,GAC1B,OAAO,OAAOD,KACZ,IAAIC,aAAoB;GACtB,SAAS;GACT,OAAO;EACT,CAAC,CACH;EAEF,MAAM,MAAM,OAAO,SAAS;EAG5B,MAAM,eAAe,OAAO,eAAe,OACvC,OAAO,QAAQ,OAAO,KAAmB,CAAC,IAC1C,OAAO,IAAI,aAAa;GACtB,MAAM,aAAa,OAAO,QAAQ,YAAY,IAAI,WAAW,YAAY;GACzE,MAAM,gBAAgB,OAAO,QAAQ,eAAe,IAAI,WAAW,eAAe;GAClF,MAAM,EAAE,SAAS,WAAW,OAAO,QAAQ,QAAQ,WAAW,EAAE;GAChE,MAAM,WAAW,OAAO,QAAQ,IAAI,MAAM,CAAC,CAAC,KAAK,OAAO,IAAI;GAC5D,OAAO,OAAO,KAAmB;IAC/B,UAAU,cAAc;IACxB,SAAS,SAAS,KAAK,EAAE,aAAa,MAAM;GAC9C,CAAC;EACH,CAAC,CAAC,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,OAAO,KAAmB,CAAC,CAAC,CAAC;EAC3E,MAAM,WAAW,OAAO,OAAO,QAC7B,eACC,EAAE,aAAa,aACd,OAAO,IAAI,aAAa;GACtB,MAAM,mBAAmB,OAAO,OAAO,YAAY,IAC/C,CACE,IAAI,iBAAiB;IACnB,UAAU,aAAa,MAAM;IAC7B,GAAG,YAAY,QAAQ,aAAa,MAAM,OAAO;IACjD,YAAY;GACd,CAAC,CACH,IACA,CAAC;GAEL,MAAM,kBAAiB,OADC,SAAS,QAAQ,OAAO,MAAM,OAAO,IAAI,EAAA,CACjC,KAAK,YACnC,QAAQ,SAAS,aACb,IAAI,kBAAkB;IACpB,UAAU,QAAQ,OAAO;IACzB,GAAG,YAAY,QAAQ,QAAQ,OAAO,OAAO;IAC7C,YAAY;GACd,CAAC,IACD,IAAI,kBAAkB;IACpB,UAAU,QAAQ;IAClB,QAAQ;IACR,QAAQ,CAAC;IACT,QACE,QAAQ,SAAS,aACb,GAAG,QAAQ,SAAS,cACpB,QAAQ;IACd,YAAY;GACd,CAAC,CACP;GACA,MAAM,eAAe,aACnB,OAAO,QACP,eAAe,KAAK,EAAE,aAAa,MAAM,CAC3C;GACA,MAAM,SAAS,QAAQ,CACrB,GAAG,iBAAiB,KAAK,aAAa,SAAS,MAAM,GACrD,YACF,CAAC;GACD,OAAO;IACL,KAAK,eAAe,MAAM;IAC1B;IACA;IACA;IACA,UAAU,CAAC,GAAG,kBAAkB,GAAG,cAAc;GACnD;EACF,CAAC,GACH,EAAE,aAAa,YAAY,CAC7B;EACA,MAAM,WAAW,OAAO,QAAQ,UAAU,IAAI,MAAM;EACpD,MAAM,OAAO,OAAO,OAAO,QAAQ,IAC/B,OAAOJ,SAAc,YAAY,SAAS,MAAM,MAAM,MAAM,IAC5D,CAAC;EACL,OAAO,OAAO,MAAM;GAClB;GACA;GACA,cAAc;GACd;GACA;GACA,OAAO;EACT,CAAC;CACH,CAAC;CAEH,MAAM,kBAA+C,UACnD,OAAO,IAAI,aAAa;EACtB,MAAM,EAAE,QAAQ,eAAe,OAAO,cAAc,MAAM,MAAM;EAChE,MAAM,WAAW,OAAO,QAAQ,UAAU,IAAI,MAAM;EACpD,MAAM,UAAU,OAAO,OAAO,QAAQ,IAClC,OAAO,UAAU,SAAS,KAAK,IAC/B;GACE,cAAc,CAAC;GACf,MAAM,CAAC;EACT;EACJ,MAAM,WAAW,IAAI,IAAI,QAAQ,KAAK,KAAK,aAAa,CAAC,SAAS,QAAQ,QAAQ,CAAC,CAAC;EACpF,KAAK,MAAM,YAAY,MAAM,UAAU,SAAS,IAAI,SAAS,QAAQ,QAAQ;EAC7E,OAAO,OAAO,MAAM;GAClB;GACA;GACA,cAAc,QAAQ;GACtB,MAAM,CAAC,GAAG,SAAS,OAAO,CAAC;GAC3B;GACA,OAAO;EACT,CAAC;CACH,CAAC;CAEH,MAAM,UAA+B,WACnC,OAAO,IAAI,aAAa;EACtB,MAAM,EAAE,QAAQ,SAAS,OAAO,cAAc,MAAM;EACpD,MAAM,SAAS,OAAO,QAAQ,UAAU,IAAI,IAAI;EAChD,OAAO,OAAO,OAAO,MAAM,IAAI,OAAO,UAAU,OAAO,KAAK,IAAI;CAClE,CAAC;CAEH,OAAO;EAAE;EAAS;EAAgB;CAAO;AAC3C,CAAC;AAED,MAAa,QAIT,MAAM,OAAO,OAAO,CAAC,CAAC,IAAI;AAE9B,MAAM,YAEF,UAED,GAAG,SACF,OAAO,QAAQ,UAAU,YAAY,KAAK,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;AAE/D,MAAa,UAAU,UAAU,YAAY,QAAQ,OAAO;AAC5D,MAAa,iBAAiB,UAAU,YAAY,QAAQ,cAAc;AAC1E,MAAa,SAAS,UAAU,YAAY,QAAQ,MAAM"}
+{"version":3,"file":"Verify.mjs","names":["Storage.RequirementStatus","DnsRecord.data","DnsRecord.equals","DnsRecord.sameSet","Storage.Service","Connect.Service","Resolver.Service","DomainName.decode","Errors.decode","Principal.Service","Storage.Readiness","Errors.fail","Reason.InvalidInput"],"sources":["../src/Verify.ts"],"sourcesContent":["/**\n * Observe provider and public DNS for an attachment, persist per-requirement readiness, and say\n * when to look again. The host keeps its own state machine (and any provider-side verification\n * such as SES) and feeds that in as `HostEvidence`.\n */\nimport { Context, DateTime, Duration, Effect, Layer, Option, Schema } from \"effect\";\n\nimport * as Connect from \"./Connect.ts\";\nimport * as DnsRecord from \"./DnsRecord.ts\";\nimport * as Errors from \"./internal/error.ts\";\nimport * as Reason from \"./Reason.ts\";\nimport * as DomainName from \"./DomainName.ts\";\nimport type * as Plan from \"./Plan.ts\";\nimport * as Principal from \"./Principal.ts\";\nimport * as Resolver from \"./Resolver.ts\";\nimport * as Storage from \"./Storage.ts\";\n\n/**\n * Every piece of evidence carries `values`, what the observer returned for the requirement's name\n * and type (empty when nothing was found, the lookup timed out, or the resolver failed), and\n * `detail`, `null` when the requirement is satisfied and otherwise the mismatch summary or the\n * resolver's error text, so a host can render \"found X, expected Y\".\n */\n// Rows written before these fields existed decode with the empty values.\nconst Values = Schema.Array(Schema.String).pipe(Schema.withDecodingDefaultKey(Effect.succeed([])));\nconst Detail = Schema.NullOr(Schema.String).pipe(\n  Schema.withDecodingDefaultKey(Effect.succeed(null)),\n);\n\nexport class ProviderEvidence extends Schema.TaggedClass<ProviderEvidence>(\n  \"@domainkit/Evidence/Provider\",\n)(\"Provider\", {\n  provider: Schema.String,\n  status: Storage.RequirementStatus,\n  values: Values,\n  detail: Detail,\n  observedAt: Schema.DateTimeUtcFromString,\n}) {}\nexport class PublicDnsEvidence extends Schema.TaggedClass<PublicDnsEvidence>(\n  \"@domainkit/Evidence/PublicDns\",\n)(\"PublicDns\", {\n  resolver: Schema.String,\n  status: Storage.RequirementStatus,\n  values: Values,\n  detail: Detail,\n  observedAt: Schema.DateTimeUtcFromString,\n}) {}\n/** Anything the host knows that DomainKit cannot observe: SES identity status, a CDN cert, ... */\nexport class HostEvidence extends Schema.TaggedClass<HostEvidence>(\"@domainkit/Evidence/Host\")(\n  \"Host\",\n  {\n    source: Schema.String,\n    status: Schema.Literals([\"ok\", \"pending\", \"failed\"]),\n    label: Schema.String,\n    detail: Detail,\n    observedAt: Schema.DateTimeUtcFromString,\n  },\n) {}\nexport const Evidence = Schema.Union([ProviderEvidence, PublicDnsEvidence, HostEvidence]);\nexport type Evidence = typeof Evidence.Type;\n\nexport interface Requirement {\n  /** `requirementKey(record)`: what a host pairs its own row against, by content. */\n  readonly key: string;\n  readonly operationId: Plan.OperationId | null;\n  readonly record: DnsRecord.Model;\n  readonly status: Storage.RequirementStatus;\n  readonly evidence: ReadonlyArray<Evidence>;\n}\n\nexport interface Readiness {\n  readonly domain: string;\n  /** `null` for observe-only domains that have no attachment. */\n  readonly attachmentId: string | null;\n  readonly overall: Storage.Overall;\n  readonly requirements: ReadonlyArray<Requirement>;\n  readonly host: ReadonlyArray<HostEvidence>;\n  readonly checkedAt: DateTime.Utc;\n  readonly nextCheckAt: DateTime.Utc | null;\n}\n\ntype Fx<A> = Effect.Effect<A, Errors.DomainKitError, Principal.Service>;\n\nexport interface Interface {\n  /**\n   * What to observe, in order of precedence: `requirements` when supplied (an attached domain\n   * without a provisioning receipt, or a domain with no attachment whose records the customer\n   * applies by hand), else the latest provisioning receipt of the domain's attachment (records it\n   * applied or found in place). Neither is `InvalidInput`. Provider evidence is added when the\n   * attachment's session can be built; public DNS is always observed, and readiness is stored\n   * per domain either way.\n   */\n  readonly observe: (input: {\n    readonly domain: string;\n    readonly requirements?: ReadonlyArray<DnsRecord.Model>;\n  }) => Fx<Readiness>;\n  /** Merge host evidence into stored readiness without re-observing DNS. */\n  readonly attachEvidence: (input: {\n    readonly domain: string;\n    readonly evidence: ReadonlyArray<HostEvidence>;\n  }) => Fx<Readiness>;\n  readonly latest: (domain: string) => Fx<Readiness | null>;\n}\n\nexport class Service extends Context.Service<Service, Interface>()(\"@domainkit/Verify\") {}\n\n/**\n * A requirement's identity: the record's type, name, and data, and nothing else. It is what a host\n * pairs its own rows against readiness by, instead of trusting the order of the array.\n * `@domainkit/react`'s `Records.identity` is this function.\n */\nexport const requirementKey = (record: DnsRecord.Model): string =>\n  [record._tag, record.name, DnsRecord.data(record)].join(\":\");\n\n/** Counts across a readiness's requirements. `observed` is false when there is no readiness yet. */\nexport interface Summary {\n  readonly observed: boolean;\n  readonly total: number;\n  readonly satisfied: number;\n  readonly missing: number;\n  readonly mismatch: number;\n  readonly unknown: number;\n}\n\n/**\n * How a readiness stands, as counts. Pure and total: a host renders \"3 of 4 found\" from the stored\n * fact without deciding what an absent readiness means, because `observed` says so. The parameter\n * is the least a value has to carry to be summarised, so core `Readiness` and the wire shape both\n * pass without naming a type between them.\n */\nexport const summary = (\n  readiness: {\n    readonly requirements: ReadonlyArray<{ readonly status: Storage.RequirementStatus }>;\n  } | null,\n): Summary => {\n  const statuses = readiness?.requirements.map(({ status }) => status) ?? [];\n  const count = (status: Storage.RequirementStatus): number =>\n    statuses.filter((candidate) => candidate === status).length;\n  return {\n    observed: readiness !== null,\n    total: statuses.length,\n    satisfied: count(\"satisfied\"),\n    missing: count(\"missing\"),\n    mismatch: count(\"mismatch\"),\n    unknown: count(\"unknown\"),\n  };\n};\n\nexport interface PolicyShape {\n  /** Delay before the next check, given time since the first pending observation. Default ladder: 15s, 1m, 5m, 30m. */\n  readonly backoff: (pendingForMs: number) => number;\n  /** Which resolvers must agree for `satisfied`: default `any`. */\n  readonly quorum: \"any\" | \"all\" | { readonly minimum: number };\n}\nexport const defaults: PolicyShape = {\n  backoff: (pendingForMs) =>\n    pendingForMs < 60_000\n      ? 15_000\n      : pendingForMs < 10 * 60_000\n        ? 60_000\n        : pendingForMs < 60 * 60_000\n          ? 5 * 60_000\n          : 30 * 60_000,\n  quorum: \"any\",\n};\nexport class Policy extends Context.Reference<PolicyShape>(\"@domainkit/Verify/Policy\", {\n  defaultValue: () => defaults,\n}) {}\n\n/** Why readiness was written: a DNS observation, or host evidence merged into the stored row. */\nexport type Cause = \"observe\" | \"evidence\";\n\nexport interface ReadinessChanged {\n  /** The tenant the row was written under, from the `Principal` the write ran as. */\n  readonly ownerId: string;\n  readonly domain: string;\n  readonly readiness: Readiness;\n  readonly cause: Cause;\n}\n\nexport interface ObserverShape {\n  /**\n   * Called once per stored readiness, after the write. A host that projects readiness onto its own\n   * rows, wakes a durable job at `nextCheckAt`, or notifies a customer hangs it here instead of\n   * mirroring the fact at every call site.\n   *\n   * Readiness is stored per owner and domain, and an observer provided over `DomainKit.layer` is\n   * scoped to the layer rather than to one request, so a host that serves more than one tenant\n   * keys its projection by `ownerId` and `domain`: the same domain name can be attached in two\n   * tenants at once.\n   *\n   * Events for one domain are not ordered against each other: two observations that overlap both\n   * store, last write wins in `Storage`, and their callbacks can finish in either order. A\n   * projection compares `readiness.checkedAt`, which is the moment the row was written, and keeps\n   * the later one; `latest` remains the authority.\n   */\n  readonly readinessChanged: (event: ReadinessChanged) => Effect.Effect<void, unknown>;\n}\n\n/**\n * The host seam for \"DomainKit wrote readiness\". The default does nothing; provide one with\n * `Effect.provideService(Verify.Observer, ...)` or `Layer.succeed(Verify.Observer, ...)` over\n * `DomainKit.layer`, the same way `Policy` is overridden.\n *\n * It runs after `storage.readiness.put` returns, outside any transaction, because `Storage`\n * exposes none. A failure or defect in the observer is logged and swallowed: the observation is\n * already durable, and losing it because a projection failed would make the stored fact depend on\n * the host's side effects. A host that needs the projection to be reliable enqueues durable work\n * here rather than doing the work inline.\n */\nexport class Observer extends Context.Reference<ObserverShape>(\"@domainkit/Verify/Observer\", {\n  defaultValue: (): ObserverShape => ({ readinessChanged: () => Effect.void }),\n}) {}\n\n// ---------------------------------------------------------------------------------------------\n// Implementation\n// ---------------------------------------------------------------------------------------------\n\nconst StoredEvidence = Schema.Array(Evidence);\n\ninterface ProviderSide {\n  readonly provider: string;\n  readonly records: ReadonlyArray<DnsRecord.Observed>;\n}\nconst StoredHost = Schema.Array(HostEvidence);\n\n/** A requirement is satisfied by an exact match; an exclusive one is contradicted by any same-set record. */\nexport const statusAgainst = (\n  record: DnsRecord.Model,\n  observed: ReadonlyArray<DnsRecord.Observed>,\n): Storage.RequirementStatus => {\n  if (observed.some((candidate) => DnsRecord.equals(candidate, record))) return \"satisfied\";\n  if (\n    record.policy === \"exclusive\" &&\n    observed.some((candidate) => DnsRecord.sameSet(candidate, record))\n  ) {\n    return \"mismatch\";\n  }\n  return \"missing\";\n};\n\ninterface Observation {\n  readonly status: Storage.RequirementStatus;\n  readonly values: ReadonlyArray<string>;\n  readonly detail: string | null;\n}\n\nconst render = (observed: DnsRecord.Observed): string =>\n  observed._tag === \"Opaque\" ? JSON.stringify(observed.raw) : DnsRecord.data(observed);\n\n/** Status plus what the observer holds for the requirement's name and type. */\nconst observation = (\n  record: DnsRecord.Model,\n  observed: ReadonlyArray<DnsRecord.Observed>,\n): Observation => {\n  const status = statusAgainst(record, observed);\n  const values = observed.filter((candidate) => DnsRecord.sameSet(candidate, record)).map(render);\n  const detail =\n    status === \"satisfied\"\n      ? null\n      : values.length === 0\n        ? `no ${record._tag} record at ${record.name}`\n        : `expected ${DnsRecord.data(record)}; found ${values.join(\", \")}`;\n  return { status, values, detail };\n};\n\nconst combine = (statuses: ReadonlyArray<Storage.RequirementStatus>): Storage.RequirementStatus => {\n  const known = statuses.filter((status) => status !== \"unknown\");\n  if (known.length === 0) return \"unknown\";\n  if (known.includes(\"mismatch\")) return \"mismatch\";\n  return known.every((status) => status === \"satisfied\") ? \"satisfied\" : \"missing\";\n};\n\nconst quorumStatus = (\n  quorum: PolicyShape[\"quorum\"],\n  statuses: ReadonlyArray<Storage.RequirementStatus>,\n): Storage.RequirementStatus => {\n  const known = statuses.filter((status) => status !== \"unknown\");\n  const satisfied = known.filter((status) => status === \"satisfied\").length;\n  const needed =\n    quorum === \"any\" ? 1 : quorum === \"all\" ? Math.max(1, known.length) : quorum.minimum;\n  if (known.includes(\"mismatch\")) return \"mismatch\";\n  if (known.length > 0 && satisfied >= needed) return \"satisfied\";\n  return known.length === 0 ? \"unknown\" : \"missing\";\n};\n\nconst overallOf = (\n  requirements: ReadonlyArray<{ readonly status: Storage.RequirementStatus }>,\n  host: ReadonlyArray<HostEvidence>,\n): Storage.Overall => {\n  if (\n    requirements.some(({ status }) => status === \"mismatch\") ||\n    host.some(({ status }) => status === \"failed\")\n  ) {\n    return \"failed\";\n  }\n  const ready =\n    requirements.length + host.length > 0 &&\n    requirements.every(({ status }) => status === \"satisfied\") &&\n    host.every(({ status }) => status === \"ok\");\n  return ready ? \"ready\" : \"pending\";\n};\n\n/** The identity of a requirement set: type, name, data, and policy, independent of labels and order. */\nconst requirementSetKey = (requirements: ReadonlyArray<{ readonly record: DnsRecord.Model }>) =>\n  requirements\n    .map(({ record }) => `${record._tag} ${record.name} ${DnsRecord.data(record)} ${record.policy}`)\n    .sort()\n    .join(\"\\n\");\n\nexport const make: Effect.Effect<\n  Interface,\n  never,\n  Storage.Service | Connect.Service | Resolver.Service\n> = Effect.gen(function* () {\n  const storage = yield* Storage.Service;\n  const connect = yield* Connect.Service;\n  const resolver = yield* Resolver.Service;\n\n  const attachmentFor = (\n    input: string,\n  ): Fx<{\n    readonly domain: DomainName.Model;\n    readonly attachment: Storage.Attachment | null;\n  }> =>\n    Effect.gen(function* () {\n      const domain = yield* DomainName.decode(input);\n      const attachment = yield* storage.attachments.byDomain(domain);\n      return { domain, attachment: Option.getOrNull(attachment) };\n    });\n\n  const decodeRow = (row: Storage.Readiness): Effect.Effect<Readiness, Errors.DomainKitError> =>\n    Effect.gen(function* () {\n      const requirements = yield* Effect.forEach(row.requirements, (requirement) =>\n        Errors.decode(StoredEvidence, requirement.evidence, \"evidence\").pipe(\n          Effect.map((evidence): Requirement => ({\n            key: requirementKey(requirement.record),\n            operationId: requirement.operationId,\n            record: requirement.record,\n            status: requirement.status,\n            evidence,\n          })),\n        ),\n      );\n      const host = yield* Errors.decode(StoredHost, row.host, \"host\");\n      return {\n        domain: row.domain,\n        attachmentId: row.attachmentId,\n        overall: row.overall,\n        requirements,\n        host,\n        checkedAt: row.checkedAt,\n        nextCheckAt: row.nextCheckAt,\n      };\n    });\n\n  /** Persist readiness, carrying the pending streak forward for the backoff ladder. */\n  const store = (input: {\n    readonly domain: string;\n    readonly attachment: Storage.Attachment | null;\n    readonly requirements: ReadonlyArray<Requirement>;\n    readonly host: ReadonlyArray<HostEvidence>;\n    readonly previous: Option.Option<Storage.Readiness>;\n    readonly cause: Cause;\n  }): Fx<Readiness> =>\n    Effect.gen(function* () {\n      const principal = yield* Principal.Service;\n      const policy = yield* Policy;\n      const observer = yield* Observer;\n      const now = yield* DateTime.now;\n      const overall = overallOf(input.requirements, input.host);\n      const sameRequirements =\n        Option.isSome(input.previous) &&\n        requirementSetKey(input.previous.value.requirements) ===\n          requirementSetKey(input.requirements);\n      const pendingSince =\n        overall === \"ready\"\n          ? null\n          : sameRequirements &&\n              Option.isSome(input.previous) &&\n              input.previous.value.pendingSince !== null\n            ? input.previous.value.pendingSince\n            : now;\n      const nextCheckAt =\n        pendingSince === null\n          ? null\n          : DateTime.addDuration(\n              now,\n              Duration.millis(\n                policy.backoff(DateTime.toEpochMillis(now) - DateTime.toEpochMillis(pendingSince)),\n              ),\n            );\n      const row = new Storage.Readiness({\n        domain: input.domain,\n        attachmentId: input.attachment?.id ?? null,\n        ownerId: principal.ownerId,\n        overall,\n        requirements: input.requirements.map((requirement) => ({\n          operationId: requirement.operationId,\n          record: requirement.record,\n          status: requirement.status,\n          evidence: Schema.encodeSync(StoredEvidence)(requirement.evidence),\n        })),\n        host: Schema.encodeSync(StoredHost)(input.host),\n        pendingSince,\n        checkedAt: now,\n        nextCheckAt,\n      });\n      yield* storage.readiness.put(row);\n      const readiness: Readiness = {\n        domain: row.domain,\n        attachmentId: row.attachmentId,\n        overall,\n        requirements: input.requirements,\n        host: input.host,\n        checkedAt: now,\n        nextCheckAt,\n      };\n      yield* observer\n        .readinessChanged({\n          ownerId: principal.ownerId,\n          domain: row.domain,\n          readiness,\n          cause: input.cause,\n        })\n        .pipe(\n          Effect.catchCause((cause) =>\n            Effect.logWarning(`Verify.Observer failed for ${row.domain}`, cause),\n          ),\n        );\n      return readiness;\n    });\n\n  const defaultRequirements = (\n    attachment: Storage.Attachment,\n  ): Fx<\n    ReadonlyArray<{\n      readonly operationId: Plan.OperationId | null;\n      readonly record: DnsRecord.Model;\n    }>\n  > =>\n    Effect.gen(function* () {\n      const latest = yield* storage.attempts.latest(attachment.id, \"provisioning\");\n      if (Option.isNone(latest) || latest.value.receipt === null) {\n        return yield* Errors.fail(\n          new Reason.InvalidInput({\n            message: `${attachment.domain} has no provisioning receipt; pass requirements to observe`,\n            field: \"requirements\",\n          }),\n        );\n      }\n      const receipt = latest.value.receipt;\n      const inPlace = new Set(\n        receipt.outcomes.flatMap((outcome) =>\n          outcome._tag === \"Applied\" || (outcome._tag === \"Skipped\" && outcome.reason === \"noop\")\n            ? [outcome.operationId]\n            : [],\n        ),\n      );\n      return latest.value.plan.operations\n        .filter((operation) => inPlace.has(operation.id))\n        .map((operation) => ({ operationId: operation.id, record: operation.record }));\n    });\n\n  const observe: Interface[\"observe\"] = (input) =>\n    Effect.gen(function* () {\n      const policy = yield* Policy;\n      const { domain, attachment } = yield* attachmentFor(input.domain);\n      if (input.requirements === undefined && attachment === null) {\n        return yield* Errors.fail(\n          new Reason.InvalidInput({\n            message: `${domain} is not attached; pass requirements to observe public DNS`,\n            field: \"requirements\",\n          }),\n        );\n      }\n      const requirements =\n        input.requirements === undefined && attachment !== null\n          ? yield* defaultRequirements(attachment)\n          : (input.requirements ?? []).map((record) => ({ operationId: null, record }));\n      if (requirements.length === 0) {\n        return yield* Errors.fail(\n          new Reason.InvalidInput({\n            message: \"Nothing to observe: pass at least one requirement\",\n            field: \"requirements\",\n          }),\n        );\n      }\n      const now = yield* DateTime.now;\n      // Provider readback is evidence when the attachment's session can be built; when it\n      // cannot (no attachment, revoked credential, provider outage) public DNS stands alone.\n      const providerSide = yield* attachment === null\n        ? Effect.succeed(Option.none<ProviderSide>())\n        : Effect.gen(function* () {\n            const connection = yield* storage.connections.get(attachment.connectionId);\n            const authorization = yield* storage.authorizations.get(connection.authorizationId);\n            const { session, target } = yield* connect.session(attachment.id);\n            const observed = yield* session.dns(target).list(target.zone);\n            return Option.some<ProviderSide>({\n              provider: authorization.provider,\n              records: observed.map(({ record }) => record),\n            });\n          }).pipe(Effect.catch(() => Effect.succeed(Option.none<ProviderSide>())));\n      const observed = yield* Effect.forEach(\n        requirements,\n        ({ operationId, record }) =>\n          Effect.gen(function* () {\n            const providerEvidence = Option.isSome(providerSide)\n              ? [\n                  new ProviderEvidence({\n                    provider: providerSide.value.provider,\n                    ...observation(record, providerSide.value.records),\n                    observedAt: now,\n                  }),\n                ]\n              : [];\n            const outcomes = yield* resolver.resolve(record.name, record._tag);\n            const publicEvidence = outcomes.map((outcome) =>\n              outcome._tag === \"Answered\"\n                ? new PublicDnsEvidence({\n                    resolver: outcome.answer.resolver,\n                    ...observation(record, outcome.answer.records),\n                    observedAt: now,\n                  })\n                : new PublicDnsEvidence({\n                    resolver: outcome.resolver,\n                    status: \"unknown\",\n                    values: [],\n                    detail:\n                      outcome._tag === \"TimedOut\"\n                        ? `${outcome.resolver} timed out`\n                        : outcome.message,\n                    observedAt: now,\n                  }),\n            );\n            const publicStatus = quorumStatus(\n              policy.quorum,\n              publicEvidence.map(({ status }) => status),\n            );\n            const status = combine([\n              ...providerEvidence.map((evidence) => evidence.status),\n              publicStatus,\n            ]);\n            return {\n              key: requirementKey(record),\n              operationId,\n              record,\n              status,\n              evidence: [...providerEvidence, ...publicEvidence],\n            } satisfies Requirement;\n          }),\n        { concurrency: \"unbounded\" },\n      );\n      const previous = yield* storage.readiness.get(domain);\n      const host = Option.isSome(previous)\n        ? yield* Errors.decode(StoredHost, previous.value.host, \"host\")\n        : [];\n      return yield* store({\n        domain,\n        attachment,\n        requirements: observed,\n        host,\n        previous,\n        cause: \"observe\",\n      });\n    });\n\n  const attachEvidence: Interface[\"attachEvidence\"] = (input) =>\n    Effect.gen(function* () {\n      const { domain, attachment } = yield* attachmentFor(input.domain);\n      const previous = yield* storage.readiness.get(domain);\n      const current = Option.isSome(previous)\n        ? yield* decodeRow(previous.value)\n        : {\n            requirements: [] as ReadonlyArray<Requirement>,\n            host: [] as ReadonlyArray<HostEvidence>,\n          };\n      const bySource = new Map(current.host.map((evidence) => [evidence.source, evidence]));\n      for (const evidence of input.evidence) bySource.set(evidence.source, evidence);\n      return yield* store({\n        domain,\n        attachment,\n        requirements: current.requirements,\n        host: [...bySource.values()],\n        previous,\n        cause: \"evidence\",\n      });\n    });\n\n  const latest: Interface[\"latest\"] = (domain) =>\n    Effect.gen(function* () {\n      const { domain: name } = yield* attachmentFor(domain);\n      const stored = yield* storage.readiness.get(name);\n      return Option.isSome(stored) ? yield* decodeRow(stored.value) : null;\n    });\n\n  return { observe, attachEvidence, latest };\n});\n\nexport const layer: Layer.Layer<\n  Service,\n  never,\n  Storage.Service | Connect.Service | Resolver.Service\n> = Layer.effect(Service)(make);\n\nconst accessor =\n  <Args extends ReadonlyArray<unknown>, A>(\n    pick: (service: Interface) => (...args: Args) => Fx<A>,\n  ): ((...args: Args) => Effect.Effect<A, Errors.DomainKitError, Principal.Service | Service>) =>\n  (...args) =>\n    Effect.flatMap(Service, (service) => pick(service)(...args));\n\nexport const observe = accessor((service) => service.observe);\nexport const attachEvidence = accessor((service) => service.attachEvidence);\nexport const latest = accessor((service) => service.latest);\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwBA,MAAM,SAAS,OAAO,MAAM,OAAO,MAAM,CAAC,CAAC,KAAK,OAAO,uBAAuB,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;AACjG,MAAM,SAAS,OAAO,OAAO,OAAO,MAAM,CAAC,CAAC,KAC1C,OAAO,uBAAuB,OAAO,QAAQ,IAAI,CAAC,CACpD;AAEA,IAAa,mBAAb,cAAsC,OAAO,YAC3C,8BACF,CAAC,CAAC,YAAY;CACZ,UAAU,OAAO;CACjB,QAAQA;CACR,QAAQ;CACR,QAAQ;CACR,YAAY,OAAO;AACrB,CAAC,CAAC,CAAC,CAAC;AACJ,IAAa,oBAAb,cAAuC,OAAO,YAC5C,+BACF,CAAC,CAAC,aAAa;CACb,UAAU,OAAO;CACjB,QAAQA;CACR,QAAQ;CACR,QAAQ;CACR,YAAY,OAAO;AACrB,CAAC,CAAC,CAAC,CAAC;;AAEJ,IAAa,eAAb,cAAkC,OAAO,YAA0B,0BAA0B,CAAC,CAC5F,QACA;CACE,QAAQ,OAAO;CACf,QAAQ,OAAO,SAAS;EAAC;EAAM;EAAW;CAAQ,CAAC;CACnD,OAAO,OAAO;CACd,QAAQ;CACR,YAAY,OAAO;AACrB,CACF,CAAC,CAAC,CAAC;AACH,MAAa,WAAW,OAAO,MAAM;CAAC;CAAkB;CAAmB;AAAY,CAAC;AA8CxF,IAAa,UAAb,cAA6B,QAAQ,QAA4B,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;;;;;;AAOzF,MAAa,kBAAkB,WAC7B;CAAC,OAAO;CAAM,OAAO;CAAMC,KAAe,MAAM;AAAC,CAAC,CAAC,KAAK,GAAG;;;;;;;AAkB7D,MAAa,WACX,cAGY;CACZ,MAAM,WAAW,WAAW,aAAa,KAAK,EAAE,aAAa,MAAM,KAAK,CAAC;CACzE,MAAM,SAAS,WACb,SAAS,QAAQ,cAAc,cAAc,MAAM,CAAC,CAAC;CACvD,OAAO;EACL,UAAU,cAAc;EACxB,OAAO,SAAS;EAChB,WAAW,MAAM,WAAW;EAC5B,SAAS,MAAM,SAAS;EACxB,UAAU,MAAM,UAAU;EAC1B,SAAS,MAAM,SAAS;CAC1B;AACF;AAQA,MAAa,WAAwB;CACnC,UAAU,iBACR,eAAe,MACX,OACA,eAAe,MACb,MACA,eAAe,OACb,MACA;CACV,QAAQ;AACV;AACA,IAAa,SAAb,cAA4B,QAAQ,UAAuB,4BAA4B,EACrF,oBAAoB,SACtB,CAAC,CAAC,CAAC,CAAC;;;;;;;;;;;;AA2CJ,IAAa,WAAb,cAA8B,QAAQ,UAAyB,8BAA8B,EAC3F,qBAAoC,EAAE,wBAAwB,OAAO,KAAK,GAC5E,CAAC,CAAC,CAAC,CAAC;AAMJ,MAAM,iBAAiB,OAAO,MAAM,QAAQ;AAM5C,MAAM,aAAa,OAAO,MAAM,YAAY;;AAG5C,MAAa,iBACX,QACA,aAC8B;CAC9B,IAAI,SAAS,MAAM,cAAcC,OAAiB,WAAW,MAAM,CAAC,GAAG,OAAO;CAC9E,IACE,OAAO,WAAW,eAClB,SAAS,MAAM,cAAcC,QAAkB,WAAW,MAAM,CAAC,GAEjE,OAAO;CAET,OAAO;AACT;AAQA,MAAM,UAAU,aACd,SAAS,SAAS,WAAW,KAAK,UAAU,SAAS,GAAG,IAAIF,KAAe,QAAQ;;AAGrF,MAAM,eACJ,QACA,aACgB;CAChB,MAAM,SAAS,cAAc,QAAQ,QAAQ;CAC7C,MAAM,SAAS,SAAS,QAAQ,cAAcE,QAAkB,WAAW,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM;CAO9F,OAAO;EAAE;EAAQ;EAAQ,QALvB,WAAW,cACP,OACA,OAAO,WAAW,IAChB,MAAM,OAAO,KAAK,aAAa,OAAO,SACtC,YAAYF,KAAe,MAAM,EAAE,UAAU,OAAO,KAAK,IAAI;CACrC;AAClC;AAEA,MAAM,WAAW,aAAkF;CACjG,MAAM,QAAQ,SAAS,QAAQ,WAAW,WAAW,SAAS;CAC9D,IAAI,MAAM,WAAW,GAAG,OAAO;CAC/B,IAAI,MAAM,SAAS,UAAU,GAAG,OAAO;CACvC,OAAO,MAAM,OAAO,WAAW,WAAW,WAAW,IAAI,cAAc;AACzE;AAEA,MAAM,gBACJ,QACA,aAC8B;CAC9B,MAAM,QAAQ,SAAS,QAAQ,WAAW,WAAW,SAAS;CAC9D,MAAM,YAAY,MAAM,QAAQ,WAAW,WAAW,WAAW,CAAC,CAAC;CACnE,MAAM,SACJ,WAAW,QAAQ,IAAI,WAAW,QAAQ,KAAK,IAAI,GAAG,MAAM,MAAM,IAAI,OAAO;CAC/E,IAAI,MAAM,SAAS,UAAU,GAAG,OAAO;CACvC,IAAI,MAAM,SAAS,KAAK,aAAa,QAAQ,OAAO;CACpD,OAAO,MAAM,WAAW,IAAI,YAAY;AAC1C;AAEA,MAAM,aACJ,cACA,SACoB;CACpB,IACE,aAAa,MAAM,EAAE,aAAa,WAAW,UAAU,KACvD,KAAK,MAAM,EAAE,aAAa,WAAW,QAAQ,GAE7C,OAAO;CAMT,OAHE,aAAa,SAAS,KAAK,SAAS,KACpC,aAAa,OAAO,EAAE,aAAa,WAAW,WAAW,KACzD,KAAK,OAAO,EAAE,aAAa,WAAW,IAAI,IAC7B,UAAU;AAC3B;;AAGA,MAAM,qBAAqB,iBACzB,aACG,KAAK,EAAE,aAAa,GAAG,OAAO,KAAK,GAAG,OAAO,KAAK,GAAGA,KAAe,MAAM,EAAE,GAAG,OAAO,QAAQ,CAAC,CAC/F,KAAK,CAAC,CACN,KAAK,IAAI;AAEd,MAAa,OAIT,OAAO,IAAI,aAAa;CAC1B,MAAM,UAAU,OAAOG;CACvB,MAAM,UAAU,OAAOC;CACvB,MAAM,WAAW,OAAOC;CAExB,MAAM,iBACJ,UAKA,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,OAAOC,OAAkB,KAAK;EAC7C,MAAM,aAAa,OAAO,QAAQ,YAAY,SAAS,MAAM;EAC7D,OAAO;GAAE;GAAQ,YAAY,OAAO,UAAU,UAAU;EAAE;CAC5D,CAAC;CAEH,MAAM,aAAa,QACjB,OAAO,IAAI,aAAa;EACtB,MAAM,eAAe,OAAO,OAAO,QAAQ,IAAI,eAAe,gBAC5DC,SAAc,gBAAgB,YAAY,UAAU,UAAU,CAAC,CAAC,KAC9D,OAAO,KAAK,cAA2B;GACrC,KAAK,eAAe,YAAY,MAAM;GACtC,aAAa,YAAY;GACzB,QAAQ,YAAY;GACpB,QAAQ,YAAY;GACpB;EACF,EAAE,CACJ,CACF;EACA,MAAM,OAAO,OAAOA,SAAc,YAAY,IAAI,MAAM,MAAM;EAC9D,OAAO;GACL,QAAQ,IAAI;GACZ,cAAc,IAAI;GAClB,SAAS,IAAI;GACb;GACA;GACA,WAAW,IAAI;GACf,aAAa,IAAI;EACnB;CACF,CAAC;;CAGH,MAAM,SAAS,UAQb,OAAO,IAAI,aAAa;EACtB,MAAM,YAAY,OAAOC;EACzB,MAAM,SAAS,OAAO;EACtB,MAAM,WAAW,OAAO;EACxB,MAAM,MAAM,OAAO,SAAS;EAC5B,MAAM,UAAU,UAAU,MAAM,cAAc,MAAM,IAAI;EACxD,MAAM,mBACJ,OAAO,OAAO,MAAM,QAAQ,KAC5B,kBAAkB,MAAM,SAAS,MAAM,YAAY,MACjD,kBAAkB,MAAM,YAAY;EACxC,MAAM,eACJ,YAAY,UACR,OACA,oBACE,OAAO,OAAO,MAAM,QAAQ,KAC5B,MAAM,SAAS,MAAM,iBAAiB,OACtC,MAAM,SAAS,MAAM,eACrB;EACR,MAAM,cACJ,iBAAiB,OACb,OACA,SAAS,YACP,KACA,SAAS,OACP,OAAO,QAAQ,SAAS,cAAc,GAAG,IAAI,SAAS,cAAc,YAAY,CAAC,CACnF,CACF;EACN,MAAM,MAAM,IAAIC,UAAkB;GAChC,QAAQ,MAAM;GACd,cAAc,MAAM,YAAY,MAAM;GACtC,SAAS,UAAU;GACnB;GACA,cAAc,MAAM,aAAa,KAAK,iBAAiB;IACrD,aAAa,YAAY;IACzB,QAAQ,YAAY;IACpB,QAAQ,YAAY;IACpB,UAAU,OAAO,WAAW,cAAc,CAAC,CAAC,YAAY,QAAQ;GAClE,EAAE;GACF,MAAM,OAAO,WAAW,UAAU,CAAC,CAAC,MAAM,IAAI;GAC9C;GACA,WAAW;GACX;EACF,CAAC;EACD,OAAO,QAAQ,UAAU,IAAI,GAAG;EAChC,MAAM,YAAuB;GAC3B,QAAQ,IAAI;GACZ,cAAc,IAAI;GAClB;GACA,cAAc,MAAM;GACpB,MAAM,MAAM;GACZ,WAAW;GACX;EACF;EACA,OAAO,SACJ,iBAAiB;GAChB,SAAS,UAAU;GACnB,QAAQ,IAAI;GACZ;GACA,OAAO,MAAM;EACf,CAAC,CAAC,CACD,KACC,OAAO,YAAY,UACjB,OAAO,WAAW,8BAA8B,IAAI,UAAU,KAAK,CACrE,CACF;EACF,OAAO;CACT,CAAC;CAEH,MAAM,uBACJ,eAOA,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,OAAO,QAAQ,SAAS,OAAO,WAAW,IAAI,cAAc;EAC3E,IAAI,OAAO,OAAO,MAAM,KAAK,OAAO,MAAM,YAAY,MACpD,OAAO,OAAOC,KACZ,IAAIC,aAAoB;GACtB,SAAS,GAAG,WAAW,OAAO;GAC9B,OAAO;EACT,CAAC,CACH;EAEF,MAAM,UAAU,OAAO,MAAM;EAC7B,MAAM,UAAU,IAAI,IAClB,QAAQ,SAAS,SAAS,YACxB,QAAQ,SAAS,aAAc,QAAQ,SAAS,aAAa,QAAQ,WAAW,SAC5E,CAAC,QAAQ,WAAW,IACpB,CAAC,CACP,CACF;EACA,OAAO,OAAO,MAAM,KAAK,WACtB,QAAQ,cAAc,QAAQ,IAAI,UAAU,EAAE,CAAC,CAAC,CAChD,KAAK,eAAe;GAAE,aAAa,UAAU;GAAI,QAAQ,UAAU;EAAO,EAAE;CACjF,CAAC;CAEH,MAAM,WAAiC,UACrC,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,OAAO;EACtB,MAAM,EAAE,QAAQ,eAAe,OAAO,cAAc,MAAM,MAAM;EAChE,IAAI,MAAM,iBAAiB,KAAA,KAAa,eAAe,MACrD,OAAO,OAAOD,KACZ,IAAIC,aAAoB;GACtB,SAAS,GAAG,OAAO;GACnB,OAAO;EACT,CAAC,CACH;EAEF,MAAM,eACJ,MAAM,iBAAiB,KAAA,KAAa,eAAe,OAC/C,OAAO,oBAAoB,UAAU,KACpC,MAAM,gBAAgB,CAAC,EAAA,CAAG,KAAK,YAAY;GAAE,aAAa;GAAM;EAAO,EAAE;EAChF,IAAI,aAAa,WAAW,GAC1B,OAAO,OAAOD,KACZ,IAAIC,aAAoB;GACtB,SAAS;GACT,OAAO;EACT,CAAC,CACH;EAEF,MAAM,MAAM,OAAO,SAAS;EAG5B,MAAM,eAAe,OAAO,eAAe,OACvC,OAAO,QAAQ,OAAO,KAAmB,CAAC,IAC1C,OAAO,IAAI,aAAa;GACtB,MAAM,aAAa,OAAO,QAAQ,YAAY,IAAI,WAAW,YAAY;GACzE,MAAM,gBAAgB,OAAO,QAAQ,eAAe,IAAI,WAAW,eAAe;GAClF,MAAM,EAAE,SAAS,WAAW,OAAO,QAAQ,QAAQ,WAAW,EAAE;GAChE,MAAM,WAAW,OAAO,QAAQ,IAAI,MAAM,CAAC,CAAC,KAAK,OAAO,IAAI;GAC5D,OAAO,OAAO,KAAmB;IAC/B,UAAU,cAAc;IACxB,SAAS,SAAS,KAAK,EAAE,aAAa,MAAM;GAC9C,CAAC;EACH,CAAC,CAAC,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,OAAO,KAAmB,CAAC,CAAC,CAAC;EAC3E,MAAM,WAAW,OAAO,OAAO,QAC7B,eACC,EAAE,aAAa,aACd,OAAO,IAAI,aAAa;GACtB,MAAM,mBAAmB,OAAO,OAAO,YAAY,IAC/C,CACE,IAAI,iBAAiB;IACnB,UAAU,aAAa,MAAM;IAC7B,GAAG,YAAY,QAAQ,aAAa,MAAM,OAAO;IACjD,YAAY;GACd,CAAC,CACH,IACA,CAAC;GAEL,MAAM,kBAAiB,OADC,SAAS,QAAQ,OAAO,MAAM,OAAO,IAAI,EAAA,CACjC,KAAK,YACnC,QAAQ,SAAS,aACb,IAAI,kBAAkB;IACpB,UAAU,QAAQ,OAAO;IACzB,GAAG,YAAY,QAAQ,QAAQ,OAAO,OAAO;IAC7C,YAAY;GACd,CAAC,IACD,IAAI,kBAAkB;IACpB,UAAU,QAAQ;IAClB,QAAQ;IACR,QAAQ,CAAC;IACT,QACE,QAAQ,SAAS,aACb,GAAG,QAAQ,SAAS,cACpB,QAAQ;IACd,YAAY;GACd,CAAC,CACP;GACA,MAAM,eAAe,aACnB,OAAO,QACP,eAAe,KAAK,EAAE,aAAa,MAAM,CAC3C;GACA,MAAM,SAAS,QAAQ,CACrB,GAAG,iBAAiB,KAAK,aAAa,SAAS,MAAM,GACrD,YACF,CAAC;GACD,OAAO;IACL,KAAK,eAAe,MAAM;IAC1B;IACA;IACA;IACA,UAAU,CAAC,GAAG,kBAAkB,GAAG,cAAc;GACnD;EACF,CAAC,GACH,EAAE,aAAa,YAAY,CAC7B;EACA,MAAM,WAAW,OAAO,QAAQ,UAAU,IAAI,MAAM;EACpD,MAAM,OAAO,OAAO,OAAO,QAAQ,IAC/B,OAAOJ,SAAc,YAAY,SAAS,MAAM,MAAM,MAAM,IAC5D,CAAC;EACL,OAAO,OAAO,MAAM;GAClB;GACA;GACA,cAAc;GACd;GACA;GACA,OAAO;EACT,CAAC;CACH,CAAC;CAEH,MAAM,kBAA+C,UACnD,OAAO,IAAI,aAAa;EACtB,MAAM,EAAE,QAAQ,eAAe,OAAO,cAAc,MAAM,MAAM;EAChE,MAAM,WAAW,OAAO,QAAQ,UAAU,IAAI,MAAM;EACpD,MAAM,UAAU,OAAO,OAAO,QAAQ,IAClC,OAAO,UAAU,SAAS,KAAK,IAC/B;GACE,cAAc,CAAC;GACf,MAAM,CAAC;EACT;EACJ,MAAM,WAAW,IAAI,IAAI,QAAQ,KAAK,KAAK,aAAa,CAAC,SAAS,QAAQ,QAAQ,CAAC,CAAC;EACpF,KAAK,MAAM,YAAY,MAAM,UAAU,SAAS,IAAI,SAAS,QAAQ,QAAQ;EAC7E,OAAO,OAAO,MAAM;GAClB;GACA;GACA,cAAc,QAAQ;GACtB,MAAM,CAAC,GAAG,SAAS,OAAO,CAAC;GAC3B;GACA,OAAO;EACT,CAAC;CACH,CAAC;CAEH,MAAM,UAA+B,WACnC,OAAO,IAAI,aAAa;EACtB,MAAM,EAAE,QAAQ,SAAS,OAAO,cAAc,MAAM;EACpD,MAAM,SAAS,OAAO,QAAQ,UAAU,IAAI,IAAI;EAChD,OAAO,OAAO,OAAO,MAAM,IAAI,OAAO,UAAU,OAAO,KAAK,IAAI;CAClE,CAAC;CAEH,OAAO;EAAE;EAAS;EAAgB;CAAO;AAC3C,CAAC;AAED,MAAa,QAIT,MAAM,OAAO,OAAO,CAAC,CAAC,IAAI;AAE9B,MAAM,YAEF,UAED,GAAG,SACF,OAAO,QAAQ,UAAU,YAAY,KAAK,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;AAE/D,MAAa,UAAU,UAAU,YAAY,QAAQ,OAAO;AAC5D,MAAa,iBAAiB,UAAU,YAAY,QAAQ,cAAc;AAC1E,MAAa,SAAS,UAAU,YAAY,QAAQ,MAAM"}

package/dist/internal/conformance/provider.mjs

@@ -35,6 +35,7 @@ const attachZone = (definition, credential, zone) => Effect.gen(function* () {
 		method: "token",
 		capabilities: ["dns:read", "dns:write"],
 		context: yield* encodeContext(definition, credential.context),
+		label: null,
 		revocation: "active",
 		createdBy: principal.actorId,
 		createdAt: now

package/dist/internal/conformance/provider.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"provider.mjs","names":["Principal.make","Errors.DomainKitError","Reason.InvalidInput","Storage.Service","Custody.Service","Storage.Authorization","Provider.encodeContext","Storage.Credential","Connect.attach","Storage.Attachment","DnsRecord.cname","DnsRecord.txt","Receipt.applied","Connect.session","session","Principal.Service","DomainKit.layerMemory","Resolver.Service","plan","Provision.plan","Provision.apply","Provision.approve","DnsRecord.equals","Cleanup.plan","Cleanup.apply","Cleanup.approve","Errors.fail","Reason.ProviderUnavailable","Provider.tokenFields"],"sources":["../../../src/internal/conformance/provider.ts"],"sourcesContent":["import { DateTime, Effect, Layer, Redacted } from \"effect\";\n\nimport * as Cleanup from \"../../Cleanup.ts\";\nimport * as Connect from \"../../Connect.ts\";\nimport * as Custody from \"../../Custody.ts\";\nimport * as DnsRecord from \"../../DnsRecord.ts\";\nimport * as Errors from \"../error.ts\";\nimport * as Reason from \"../../Reason.ts\";\nimport * as DomainKit from \"../../DomainKit.ts\";\nimport * as Principal from \"../../Principal.ts\";\nimport * as Provider from \"../../Provider.ts\";\nimport * as Provision from \"../../Provision.ts\";\nimport * as Receipt from \"../../Receipt.ts\";\nimport * as Resolver from \"../../Resolver.ts\";\nimport * as Storage from \"../../Storage.ts\";\nimport { fresh } from \"../ids.ts\";\n\nexport const cases = [\n  \"create-readback-cleanup\",\n  \"exact-noop\",\n  \"conflict\",\n  \"stale-plan\",\n  \"partial-apply-cleanup\",\n  \"rejected-token\",\n] as const;\nexport type Case = (typeof cases)[number];\n\nconst principal = Principal.make({ ownerId: \"conformance\", actorId: \"conformance\" });\n\nconst failure = (name: Case, message: string) =>\n  new Errors.DomainKitError({\n    reason: new Reason.InvalidInput({\n      message: `provider conformance ${name}: ${message}`,\n      field: \"conformance\",\n    }),\n  });\n\nconst expect = (name: Case, condition: boolean, message: string) =>\n  condition ? Effect.void : Effect.fail(failure(name, message));\n\ntype Env = Storage.Service | Connect.Service | Provision.Service | Cleanup.Service;\n\n/** Attach `zone` to a connection built straight from `credential`, bypassing `authenticate`. */\nconst attachZone = (\n  definition: Provider.Definition,\n  credential: Provider.Credential,\n  zone: string,\n) =>\n  Effect.gen(function* () {\n    const storage = yield* Storage.Service;\n    const custody = yield* Custody.Service;\n    const now = yield* DateTime.now;\n    const authorization = new Storage.Authorization({\n      id: yield* fresh(\"auth\"),\n      ownerId: principal.ownerId,\n      provider: definition.id,\n      method: \"token\",\n      capabilities: [\"dns:read\", \"dns:write\"],\n      context: yield* Provider.encodeContext(definition, credential.context),\n      revocation: \"active\",\n      createdBy: principal.actorId,\n      createdAt: now,\n    });\n    yield* storage.authorizations.upsert({\n      authorization,\n      credential: new Storage.Credential({\n        ciphertext: yield* custody.seal(credential.secret),\n        expiresAt: null,\n        rotatedAt: now,\n      }),\n    });\n    const connection = yield* storage.connections.create(authorization.id);\n    const attached = yield* Connect.attach({ connectionId: connection.id, domain: zone });\n    if (!(attached instanceof Storage.Attachment)) {\n      return yield* Effect.fail(\n        failure(\"create-readback-cleanup\", `zone ${zone} needs a selection; pass an exact zone`),\n      );\n    }\n    return attached;\n  });\n\nconst cname = (zone: string, label: string) =>\n  DnsRecord.cname({ name: `${label}.${zone}`, target: \"target.example.net\", ttl: 300 });\nconst txt = (zone: string, label: string, value: string) =>\n  DnsRecord.txt({ name: `${label}.${zone}`, value, ttl: 300 });\n\nconst recordIds = (receipt: Receipt.Model) =>\n  Receipt.applied(receipt).map(({ providerRecordId }) => providerRecordId);\n\n/**\n * Runs create/readback/cleanup, exact-noop, conflict, stale-plan, partial-apply, and\n * rejected-token against a real provider definition, through the same Provision and Cleanup\n * services hosts use.\n */\nexport const provider = (\n  definition: Provider.Definition,\n  credential: Provider.Credential,\n  zone: string,\n  options: {\n    readonly prefix?: string;\n    /**\n     * Token values the provider rejects, for the `rejected-token` case. Default: every required\n     * field set to an empty secret, which needs a token method whose required fields are all\n     * secrets.\n     */\n    readonly rejectedToken?: Provider.TokenValues;\n  } = {},\n): Effect.Effect<void, Errors.DomainKitError> => {\n  const prefix = options.prefix ?? \"domainkit-conformance\";\n  const run = <A>(\n    target: Provider.Definition,\n    body: (\n      dns: Provider.Dns,\n      attachment: Storage.Attachment,\n    ) => Effect.Effect<A, Errors.DomainKitError, Env | Principal.Service>,\n  ) =>\n    Effect.gen(function* () {\n      const attachment = yield* attachZone(target, credential, zone);\n      const { session, target: resolved } = yield* Connect.session(attachment.id);\n      return yield* body(session.dns(resolved), attachment);\n    }).pipe(\n      Effect.provideService(Principal.Service, principal),\n      Effect.provide(\n        DomainKit.layerMemory({\n          providers: [target],\n          resolver: Layer.succeed(Resolver.Service)(silentResolver),\n        }),\n      ),\n    );\n\n  const cleanup = (dns: Provider.Dns, ids: () => ReadonlyArray<string>) =>\n    Effect.suspend(() =>\n      Effect.forEach(ids(), (id) => dns.delete(zone, id).pipe(Effect.ignore), { discard: true }),\n    );\n\n  const createReadbackCleanup = run(definition, (dns, attachment) => {\n    let created: ReadonlyArray<string> = [];\n    const name: Case = \"create-readback-cleanup\";\n    return Effect.gen(function* () {\n      const requirements = [\n        cname(zone, `${prefix}-create`),\n        txt(zone, `${prefix}-page`, \"domainkit\"),\n      ];\n      const plan = yield* Provision.plan({ domain: attachment.domain, requirements });\n      yield* expect(\n        name,\n        plan.operations.every(({ _tag }) => _tag === \"Create\"),\n        \"expected two Create operations\",\n      );\n      const receipt = yield* Provision.apply(yield* Provision.approve(plan));\n      created = recordIds(receipt);\n      yield* expect(\n        name,\n        receipt.status === \"complete\" && created.length === 2,\n        \"apply must return a complete receipt with provider record ids\",\n      );\n      const observed = yield* dns.list(zone);\n      yield* expect(\n        name,\n        requirements.every((requirement) =>\n          observed.some(({ record }) => DnsRecord.equals(record, requirement)),\n        ),\n        \"list must return every created record, including across provider pages\",\n      );\n      const cleanupPlan = yield* Cleanup.plan({ receiptId: receipt.id });\n      yield* expect(\n        name,\n        cleanupPlan.operations.every(({ _tag }) => _tag === \"Delete\"),\n        \"cleanup plan must delete both records\",\n      );\n      const cleaned = yield* Cleanup.apply(yield* Cleanup.approve(cleanupPlan));\n      const remaining = yield* Effect.forEach(created, (id) => dns.get(zone, id));\n      yield* expect(\n        name,\n        cleaned.status === \"complete\" && remaining.every((record) => record === null),\n        \"receipt-bound cleanup must remove every created record\",\n      );\n      created = [];\n    }).pipe(Effect.ensuring(cleanup(dns, () => created)));\n  });\n\n  const exactNoop = run(definition, (dns, attachment) => {\n    let created: ReadonlyArray<string> = [];\n    const name: Case = \"exact-noop\";\n    return Effect.gen(function* () {\n      const requirement = cname(zone, `${prefix}-exact`);\n      const { providerRecordId } = yield* dns.create(zone, requirement);\n      created = [providerRecordId];\n      const plan = yield* Provision.plan({\n        domain: attachment.domain,\n        requirements: [requirement],\n      });\n      yield* expect(name, plan.operations[0]?._tag === \"Noop\", \"an exact record must plan as Noop\");\n      const receipt = yield* Provision.apply(yield* Provision.approve(plan));\n      yield* expect(\n        name,\n        Receipt.applied(receipt).length === 0,\n        \"an exact plan must not create another record\",\n      );\n    }).pipe(Effect.ensuring(cleanup(dns, () => created)));\n  });\n\n  const conflict = run(definition, (dns, attachment) => {\n    let created: ReadonlyArray<string> = [];\n    const name: Case = \"conflict\";\n    return Effect.gen(function* () {\n      const { providerRecordId } = yield* dns.create(\n        zone,\n        txt(zone, `${prefix}-conflict`, \"occupied\"),\n      );\n      created = [providerRecordId];\n      const plan = yield* Provision.plan({\n        domain: attachment.domain,\n        requirements: [cname(zone, `${prefix}-conflict`)],\n      });\n      yield* expect(\n        name,\n        plan.operations[0]?._tag === \"Conflict\",\n        \"a CNAME over an occupied name must plan as Conflict\",\n      );\n      const rejected = yield* Provision.approve(plan).pipe(Effect.result);\n      yield* expect(\n        name,\n        rejected._tag === \"Failure\" && rejected.failure.reason._tag === \"Conflict\",\n        \"approve must fail closed on conflicts\",\n      );\n    }).pipe(Effect.ensuring(cleanup(dns, () => created)));\n  });\n\n  const stalePlan = run(definition, (dns, attachment) => {\n    let created: ReadonlyArray<string> = [];\n    const name: Case = \"stale-plan\";\n    return Effect.gen(function* () {\n      const requirement = cname(zone, `${prefix}-stale`);\n      const plan = yield* Provision.plan({\n        domain: attachment.domain,\n        requirements: [requirement],\n      });\n      const approval = yield* Provision.approve(plan);\n      const { providerRecordId } = yield* dns.create(zone, requirement);\n      created = [providerRecordId];\n      const stale = yield* Provision.apply(approval).pipe(Effect.result);\n      yield* expect(\n        name,\n        stale._tag === \"Failure\" && stale.failure.reason._tag === \"Stale\",\n        \"apply must reject provider state that changed after approval\",\n      );\n    }).pipe(Effect.ensuring(cleanup(dns, () => created)));\n  });\n\n  const flaky: Provider.Definition = {\n    ...definition,\n    session: (input) => {\n      const session = definition.session(input);\n      return {\n        ...session,\n        dns: (target) => {\n          const dns = session.dns(target);\n          let writes = 0;\n          return {\n            ...dns,\n            create: (targetZone, record) => {\n              writes += 1;\n              return writes === 2\n                ? Errors.fail(\n                    new Reason.ProviderUnavailable({\n                      provider: definition.id,\n                      message: \"injected conformance failure\",\n                    }),\n                  )\n                : dns.create(targetZone, record);\n            },\n          };\n        },\n      };\n    },\n  };\n\n  const partialApplyCleanup = run(flaky, (dns, attachment) => {\n    let created: ReadonlyArray<string> = [];\n    const name: Case = \"partial-apply-cleanup\";\n    return Effect.gen(function* () {\n      const plan = yield* Provision.plan({\n        domain: attachment.domain,\n        requirements: [\n          cname(zone, `${prefix}-partial-one`),\n          txt(zone, `${prefix}-partial-two`, \"domainkit\"),\n        ],\n      });\n      const receipt = yield* Provision.apply(yield* Provision.approve(plan));\n      created = recordIds(receipt);\n      yield* expect(\n        name,\n        receipt.status === \"partial\" && created.length === 1,\n        \"a later write failure must preserve the first confirmed write in a partial receipt\",\n      );\n      const cleanupPlan = yield* Cleanup.plan({ receiptId: receipt.id });\n      yield* Cleanup.apply(yield* Cleanup.approve(cleanupPlan));\n      const remaining = yield* Effect.forEach(created, (id) => dns.get(zone, id));\n      yield* expect(\n        name,\n        remaining.every((record) => record === null),\n        \"partial receipt cleanup must remove the confirmed write\",\n      );\n      created = [];\n    }).pipe(Effect.ensuring(cleanup(dns, () => created)));\n  });\n\n  /** A token the provider rejects must read as `Unauthenticated`, so a host tells the customer the provider refused it. */\n  const rejectedToken = Effect.gen(function* () {\n    const name: Case = \"rejected-token\";\n    const auth = definition.auth.token;\n    if (auth === undefined) return;\n    const required = Provider.tokenFields(auth).filter((field) => field.required);\n    if (options.rejectedToken === undefined && required.some((field) => !field.secret)) {\n      return yield* Effect.fail(\n        failure(\n          name,\n          `the token method requires ${required\n            .filter((field) => !field.secret)\n            .map((field) => field.name)\n            .join(\", \")}; pass options.rejectedToken with values the provider rejects`,\n        ),\n      );\n    }\n    const values =\n      options.rejectedToken ??\n      Object.fromEntries(required.map((field) => [field.name, Redacted.make(\"\")]));\n    const outcome = yield* auth.authenticate(values).pipe(Effect.result);\n    yield* expect(\n      name,\n      outcome._tag === \"Failure\" && outcome.failure.reason._tag === \"Unauthenticated\",\n      \"authenticating a rejected token must fail Unauthenticated\",\n    );\n  });\n\n  return Effect.all(\n    [createReadbackCleanup, exactNoop, conflict, stalePlan, partialApplyCleanup, rejectedToken],\n    { discard: true },\n  );\n};\n\n/** Verification is out of scope for the provider contract; keep the pool quiet. */\nconst silentResolver: Resolver.Interface = {\n  resolve: () => Effect.succeed([]),\n};\n"],"mappings":";;;;;;;;;;;;;;;;AA2BA,MAAM,YAAYA,KAAe;CAAE,SAAS;CAAe,SAAS;AAAc,CAAC;AAEnF,MAAM,WAAW,MAAY,YAC3B,IAAIC,eAAsB,EACxB,QAAQ,IAAIC,aAAoB;CAC9B,SAAS,wBAAwB,KAAK,IAAI;CAC1C,OAAO;AACT,CAAC,EACH,CAAC;AAEH,MAAM,UAAU,MAAY,WAAoB,YAC9C,YAAY,OAAO,OAAO,OAAO,KAAK,QAAQ,MAAM,OAAO,CAAC;;AAK9D,MAAM,cACJ,YACA,YACA,SAEA,OAAO,IAAI,aAAa;CACtB,MAAM,UAAU,OAAOC;CACvB,MAAM,UAAU,OAAOC;CACvB,MAAM,MAAM,OAAO,SAAS;CAC5B,MAAM,gBAAgB,IAAIC,cAAsB;EAC9C,IAAI,OAAO,MAAM,MAAM;EACvB,SAAS,UAAU;EACnB,UAAU,WAAW;EACrB,QAAQ;EACR,cAAc,CAAC,YAAY,WAAW;EACtC,SAAS,OAAOC,cAAuB,YAAY,WAAW,OAAO;EACrE,YAAY;EACZ,WAAW,UAAU;EACrB,WAAW;CACb,CAAC;CACD,OAAO,QAAQ,eAAe,OAAO;EACnC;EACA,YAAY,IAAIC,WAAmB;GACjC,YAAY,OAAO,QAAQ,KAAK,WAAW,MAAM;GACjD,WAAW;GACX,WAAW;EACb,CAAC;CACH,CAAC;CACD,MAAM,aAAa,OAAO,QAAQ,YAAY,OAAO,cAAc,EAAE;CACrE,MAAM,WAAW,OAAOC,OAAe;EAAE,cAAc,WAAW;EAAI,QAAQ;CAAK,CAAC;CACpF,IAAI,EAAE,oBAAoBC,aACxB,OAAO,OAAO,OAAO,KACnB,QAAQ,2BAA2B,QAAQ,KAAK,uCAAuC,CACzF;CAEF,OAAO;AACT,CAAC;AAEH,MAAM,SAAS,MAAc,UAC3BC,QAAgB;CAAE,MAAM,GAAG,MAAM,GAAG;CAAQ,QAAQ;CAAsB,KAAK;AAAI,CAAC;AACtF,MAAM,OAAO,MAAc,OAAe,UACxCC,MAAc;CAAE,MAAM,GAAG,MAAM,GAAG;CAAQ;CAAO,KAAK;AAAI,CAAC;AAE7D,MAAM,aAAa,YACjBC,QAAgB,OAAO,CAAC,CAAC,KAAK,EAAE,uBAAuB,gBAAgB;;;;;;AAOzE,MAAa,YACX,YACA,YACA,MACA,UAQI,CAAC,MAC0C;CAC/C,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,OACJ,QACA,SAKA,OAAO,IAAI,aAAa;EACtB,MAAM,aAAa,OAAO,WAAW,QAAQ,YAAY,IAAI;EAC7D,MAAM,EAAE,SAAA,WAAS,QAAQ,aAAa,OAAOC,QAAgB,WAAW,EAAE;EAC1E,OAAO,OAAO,KAAKC,UAAQ,IAAI,QAAQ,GAAG,UAAU;CACtD,CAAC,CAAC,CAAC,KACD,OAAO,eAAeC,WAAmB,SAAS,GAClD,OAAO,QACLC,YAAsB;EACpB,WAAW,CAAC,MAAM;EAClB,UAAU,MAAM,QAAQC,SAAgB,CAAC,CAAC,cAAc;CAC1D,CAAC,CACH,CACF;CAEF,MAAM,WAAW,KAAmB,QAClC,OAAO,cACL,OAAO,QAAQ,IAAI,IAAI,OAAO,IAAI,OAAO,MAAM,EAAE,CAAC,CAAC,KAAK,OAAO,MAAM,GAAG,EAAE,SAAS,KAAK,CAAC,CAC3F;CAEF,MAAM,wBAAwB,IAAI,aAAa,KAAK,eAAe;EACjE,IAAI,UAAiC,CAAC;EACtC,MAAM,OAAa;EACnB,OAAO,OAAO,IAAI,aAAa;GAC7B,MAAM,eAAe,CACnB,MAAM,MAAM,GAAG,OAAO,QAAQ,GAC9B,IAAI,MAAM,GAAG,OAAO,QAAQ,WAAW,CACzC;GACA,MAAMC,SAAO,OAAOC,KAAe;IAAE,QAAQ,WAAW;IAAQ;GAAa,CAAC;GAC9E,OAAO,OACL,MACAD,OAAK,WAAW,OAAO,EAAE,WAAW,SAAS,QAAQ,GACrD,gCACF;GACA,MAAM,UAAU,OAAOE,MAAgB,OAAOC,QAAkBH,MAAI,CAAC;GACrE,UAAU,UAAU,OAAO;GAC3B,OAAO,OACL,MACA,QAAQ,WAAW,cAAc,QAAQ,WAAW,GACpD,+DACF;GACA,MAAM,WAAW,OAAO,IAAI,KAAK,IAAI;GACrC,OAAO,OACL,MACA,aAAa,OAAO,gBAClB,SAAS,MAAM,EAAE,aAAaI,OAAiB,QAAQ,WAAW,CAAC,CACrE,GACA,wEACF;GACA,MAAM,cAAc,OAAOC,OAAa,EAAE,WAAW,QAAQ,GAAG,CAAC;GACjE,OAAO,OACL,MACA,YAAY,WAAW,OAAO,EAAE,WAAW,SAAS,QAAQ,GAC5D,uCACF;GACA,MAAM,UAAU,OAAOC,QAAc,OAAOC,UAAgB,WAAW,CAAC;GACxE,MAAM,YAAY,OAAO,OAAO,QAAQ,UAAU,OAAO,IAAI,IAAI,MAAM,EAAE,CAAC;GAC1E,OAAO,OACL,MACA,QAAQ,WAAW,cAAc,UAAU,OAAO,WAAW,WAAW,IAAI,GAC5E,wDACF;GACA,UAAU,CAAC;EACb,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,QAAQ,WAAW,OAAO,CAAC,CAAC;CACtD,CAAC;CAED,MAAM,YAAY,IAAI,aAAa,KAAK,eAAe;EACrD,IAAI,UAAiC,CAAC;EACtC,MAAM,OAAa;EACnB,OAAO,OAAO,IAAI,aAAa;GAC7B,MAAM,cAAc,MAAM,MAAM,GAAG,OAAO,OAAO;GACjD,MAAM,EAAE,qBAAqB,OAAO,IAAI,OAAO,MAAM,WAAW;GAChE,UAAU,CAAC,gBAAgB;GAC3B,MAAMP,SAAO,OAAOC,KAAe;IACjC,QAAQ,WAAW;IACnB,cAAc,CAAC,WAAW;GAC5B,CAAC;GACD,OAAO,OAAO,MAAMD,OAAK,WAAW,EAAE,EAAE,SAAS,QAAQ,mCAAmC;GAC5F,MAAM,UAAU,OAAOE,MAAgB,OAAOC,QAAkBH,MAAI,CAAC;GACrE,OAAO,OACL,MACAN,QAAgB,OAAO,CAAC,CAAC,WAAW,GACpC,8CACF;EACF,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,QAAQ,WAAW,OAAO,CAAC,CAAC;CACtD,CAAC;CAED,MAAM,WAAW,IAAI,aAAa,KAAK,eAAe;EACpD,IAAI,UAAiC,CAAC;EACtC,MAAM,OAAa;EACnB,OAAO,OAAO,IAAI,aAAa;GAC7B,MAAM,EAAE,qBAAqB,OAAO,IAAI,OACtC,MACA,IAAI,MAAM,GAAG,OAAO,YAAY,UAAU,CAC5C;GACA,UAAU,CAAC,gBAAgB;GAC3B,MAAMM,SAAO,OAAOC,KAAe;IACjC,QAAQ,WAAW;IACnB,cAAc,CAAC,MAAM,MAAM,GAAG,OAAO,UAAU,CAAC;GAClD,CAAC;GACD,OAAO,OACL,MACAD,OAAK,WAAW,EAAE,EAAE,SAAS,YAC7B,qDACF;GACA,MAAM,WAAW,OAAOG,QAAkBH,MAAI,CAAC,CAAC,KAAK,OAAO,MAAM;GAClE,OAAO,OACL,MACA,SAAS,SAAS,aAAa,SAAS,QAAQ,OAAO,SAAS,YAChE,uCACF;EACF,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,QAAQ,WAAW,OAAO,CAAC,CAAC;CACtD,CAAC;CAED,MAAM,YAAY,IAAI,aAAa,KAAK,eAAe;EACrD,IAAI,UAAiC,CAAC;EACtC,MAAM,OAAa;EACnB,OAAO,OAAO,IAAI,aAAa;GAC7B,MAAM,cAAc,MAAM,MAAM,GAAG,OAAO,OAAO;GACjD,MAAMA,SAAO,OAAOC,KAAe;IACjC,QAAQ,WAAW;IACnB,cAAc,CAAC,WAAW;GAC5B,CAAC;GACD,MAAM,WAAW,OAAOE,QAAkBH,MAAI;GAC9C,MAAM,EAAE,qBAAqB,OAAO,IAAI,OAAO,MAAM,WAAW;GAChE,UAAU,CAAC,gBAAgB;GAC3B,MAAM,QAAQ,OAAOE,MAAgB,QAAQ,CAAC,CAAC,KAAK,OAAO,MAAM;GACjE,OAAO,OACL,MACA,MAAM,SAAS,aAAa,MAAM,QAAQ,OAAO,SAAS,SAC1D,8DACF;EACF,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,QAAQ,WAAW,OAAO,CAAC,CAAC;CACtD,CAAC;CA8BD,MAAM,sBAAsB,IAAI;EA3B9B,GAAG;EACH,UAAU,UAAU;GAClB,MAAM,UAAU,WAAW,QAAQ,KAAK;GACxC,OAAO;IACL,GAAG;IACH,MAAM,WAAW;KACf,MAAM,MAAM,QAAQ,IAAI,MAAM;KAC9B,IAAI,SAAS;KACb,OAAO;MACL,GAAG;MACH,SAAS,YAAY,WAAW;OAC9B,UAAU;OACV,OAAO,WAAW,IACdM,KACE,IAAIC,oBAA2B;QAC7B,UAAU,WAAW;QACrB,SAAS;OACX,CAAC,CACH,IACA,IAAI,OAAO,YAAY,MAAM;MACnC;KACF;IACF;GACF;EACF;CAGkC,IAAI,KAAK,eAAe;EAC1D,IAAI,UAAiC,CAAC;EACtC,MAAM,OAAa;EACnB,OAAO,OAAO,IAAI,aAAa;GAC7B,MAAMT,SAAO,OAAOC,KAAe;IACjC,QAAQ,WAAW;IACnB,cAAc,CACZ,MAAM,MAAM,GAAG,OAAO,aAAa,GACnC,IAAI,MAAM,GAAG,OAAO,eAAe,WAAW,CAChD;GACF,CAAC;GACD,MAAM,UAAU,OAAOC,MAAgB,OAAOC,QAAkBH,MAAI,CAAC;GACrE,UAAU,UAAU,OAAO;GAC3B,OAAO,OACL,MACA,QAAQ,WAAW,aAAa,QAAQ,WAAW,GACnD,oFACF;GACA,MAAM,cAAc,OAAOK,OAAa,EAAE,WAAW,QAAQ,GAAG,CAAC;GACjE,OAAOC,QAAc,OAAOC,UAAgB,WAAW,CAAC;GACxD,MAAM,YAAY,OAAO,OAAO,QAAQ,UAAU,OAAO,IAAI,IAAI,MAAM,EAAE,CAAC;GAC1E,OAAO,OACL,MACA,UAAU,OAAO,WAAW,WAAW,IAAI,GAC3C,yDACF;GACA,UAAU,CAAC;EACb,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,QAAQ,WAAW,OAAO,CAAC,CAAC;CACtD,CAAC;;CAGD,MAAM,gBAAgB,OAAO,IAAI,aAAa;EAC5C,MAAM,OAAa;EACnB,MAAM,OAAO,WAAW,KAAK;EAC7B,IAAI,SAAS,KAAA,GAAW;EACxB,MAAM,WAAWG,YAAqB,IAAI,CAAC,CAAC,QAAQ,UAAU,MAAM,QAAQ;EAC5E,IAAI,QAAQ,kBAAkB,KAAA,KAAa,SAAS,MAAM,UAAU,CAAC,MAAM,MAAM,GAC/E,OAAO,OAAO,OAAO,KACnB,QACE,MACA,6BAA6B,SAC1B,QAAQ,UAAU,CAAC,MAAM,MAAM,CAAC,CAChC,KAAK,UAAU,MAAM,IAAI,CAAC,CAC1B,KAAK,IAAI,EAAE,8DAChB,CACF;EAEF,MAAM,SACJ,QAAQ,iBACR,OAAO,YAAY,SAAS,KAAK,UAAU,CAAC,MAAM,MAAM,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC;EAC7E,MAAM,UAAU,OAAO,KAAK,aAAa,MAAM,CAAC,CAAC,KAAK,OAAO,MAAM;EACnE,OAAO,OACL,MACA,QAAQ,SAAS,aAAa,QAAQ,QAAQ,OAAO,SAAS,mBAC9D,2DACF;CACF,CAAC;CAED,OAAO,OAAO,IACZ;EAAC;EAAuB;EAAW;EAAU;EAAW;EAAqB;CAAa,GAC1F,EAAE,SAAS,KAAK,CAClB;AACF;;AAGA,MAAM,iBAAqC,EACzC,eAAe,OAAO,QAAQ,CAAC,CAAC,EAClC"}
+{"version":3,"file":"provider.mjs","names":["Principal.make","Errors.DomainKitError","Reason.InvalidInput","Storage.Service","Custody.Service","Storage.Authorization","Provider.encodeContext","Storage.Credential","Connect.attach","Storage.Attachment","DnsRecord.cname","DnsRecord.txt","Receipt.applied","Connect.session","session","Principal.Service","DomainKit.layerMemory","Resolver.Service","plan","Provision.plan","Provision.apply","Provision.approve","DnsRecord.equals","Cleanup.plan","Cleanup.apply","Cleanup.approve","Errors.fail","Reason.ProviderUnavailable","Provider.tokenFields"],"sources":["../../../src/internal/conformance/provider.ts"],"sourcesContent":["import { DateTime, Effect, Layer, Redacted } from \"effect\";\n\nimport * as Cleanup from \"../../Cleanup.ts\";\nimport * as Connect from \"../../Connect.ts\";\nimport * as Custody from \"../../Custody.ts\";\nimport * as DnsRecord from \"../../DnsRecord.ts\";\nimport * as Errors from \"../error.ts\";\nimport * as Reason from \"../../Reason.ts\";\nimport * as DomainKit from \"../../DomainKit.ts\";\nimport * as Principal from \"../../Principal.ts\";\nimport * as Provider from \"../../Provider.ts\";\nimport * as Provision from \"../../Provision.ts\";\nimport * as Receipt from \"../../Receipt.ts\";\nimport * as Resolver from \"../../Resolver.ts\";\nimport * as Storage from \"../../Storage.ts\";\nimport { fresh } from \"../ids.ts\";\n\nexport const cases = [\n  \"create-readback-cleanup\",\n  \"exact-noop\",\n  \"conflict\",\n  \"stale-plan\",\n  \"partial-apply-cleanup\",\n  \"rejected-token\",\n] as const;\nexport type Case = (typeof cases)[number];\n\nconst principal = Principal.make({ ownerId: \"conformance\", actorId: \"conformance\" });\n\nconst failure = (name: Case, message: string) =>\n  new Errors.DomainKitError({\n    reason: new Reason.InvalidInput({\n      message: `provider conformance ${name}: ${message}`,\n      field: \"conformance\",\n    }),\n  });\n\nconst expect = (name: Case, condition: boolean, message: string) =>\n  condition ? Effect.void : Effect.fail(failure(name, message));\n\ntype Env = Storage.Service | Connect.Service | Provision.Service | Cleanup.Service;\n\n/** Attach `zone` to a connection built straight from `credential`, bypassing `authenticate`. */\nconst attachZone = (\n  definition: Provider.Definition,\n  credential: Provider.Credential,\n  zone: string,\n) =>\n  Effect.gen(function* () {\n    const storage = yield* Storage.Service;\n    const custody = yield* Custody.Service;\n    const now = yield* DateTime.now;\n    const authorization = new Storage.Authorization({\n      id: yield* fresh(\"auth\"),\n      ownerId: principal.ownerId,\n      provider: definition.id,\n      method: \"token\",\n      capabilities: [\"dns:read\", \"dns:write\"],\n      context: yield* Provider.encodeContext(definition, credential.context),\n      label: null,\n      revocation: \"active\",\n      createdBy: principal.actorId,\n      createdAt: now,\n    });\n    yield* storage.authorizations.upsert({\n      authorization,\n      credential: new Storage.Credential({\n        ciphertext: yield* custody.seal(credential.secret),\n        expiresAt: null,\n        rotatedAt: now,\n      }),\n    });\n    const connection = yield* storage.connections.create(authorization.id);\n    const attached = yield* Connect.attach({ connectionId: connection.id, domain: zone });\n    if (!(attached instanceof Storage.Attachment)) {\n      return yield* Effect.fail(\n        failure(\"create-readback-cleanup\", `zone ${zone} needs a selection; pass an exact zone`),\n      );\n    }\n    return attached;\n  });\n\nconst cname = (zone: string, label: string) =>\n  DnsRecord.cname({ name: `${label}.${zone}`, target: \"target.example.net\", ttl: 300 });\nconst txt = (zone: string, label: string, value: string) =>\n  DnsRecord.txt({ name: `${label}.${zone}`, value, ttl: 300 });\n\nconst recordIds = (receipt: Receipt.Model) =>\n  Receipt.applied(receipt).map(({ providerRecordId }) => providerRecordId);\n\n/**\n * Runs create/readback/cleanup, exact-noop, conflict, stale-plan, partial-apply, and\n * rejected-token against a real provider definition, through the same Provision and Cleanup\n * services hosts use.\n */\nexport const provider = (\n  definition: Provider.Definition,\n  credential: Provider.Credential,\n  zone: string,\n  options: {\n    readonly prefix?: string;\n    /**\n     * Token values the provider rejects, for the `rejected-token` case. Default: every required\n     * field set to an empty secret, which needs a token method whose required fields are all\n     * secrets.\n     */\n    readonly rejectedToken?: Provider.TokenValues;\n  } = {},\n): Effect.Effect<void, Errors.DomainKitError> => {\n  const prefix = options.prefix ?? \"domainkit-conformance\";\n  const run = <A>(\n    target: Provider.Definition,\n    body: (\n      dns: Provider.Dns,\n      attachment: Storage.Attachment,\n    ) => Effect.Effect<A, Errors.DomainKitError, Env | Principal.Service>,\n  ) =>\n    Effect.gen(function* () {\n      const attachment = yield* attachZone(target, credential, zone);\n      const { session, target: resolved } = yield* Connect.session(attachment.id);\n      return yield* body(session.dns(resolved), attachment);\n    }).pipe(\n      Effect.provideService(Principal.Service, principal),\n      Effect.provide(\n        DomainKit.layerMemory({\n          providers: [target],\n          resolver: Layer.succeed(Resolver.Service)(silentResolver),\n        }),\n      ),\n    );\n\n  const cleanup = (dns: Provider.Dns, ids: () => ReadonlyArray<string>) =>\n    Effect.suspend(() =>\n      Effect.forEach(ids(), (id) => dns.delete(zone, id).pipe(Effect.ignore), { discard: true }),\n    );\n\n  const createReadbackCleanup = run(definition, (dns, attachment) => {\n    let created: ReadonlyArray<string> = [];\n    const name: Case = \"create-readback-cleanup\";\n    return Effect.gen(function* () {\n      const requirements = [\n        cname(zone, `${prefix}-create`),\n        txt(zone, `${prefix}-page`, \"domainkit\"),\n      ];\n      const plan = yield* Provision.plan({ domain: attachment.domain, requirements });\n      yield* expect(\n        name,\n        plan.operations.every(({ _tag }) => _tag === \"Create\"),\n        \"expected two Create operations\",\n      );\n      const receipt = yield* Provision.apply(yield* Provision.approve(plan));\n      created = recordIds(receipt);\n      yield* expect(\n        name,\n        receipt.status === \"complete\" && created.length === 2,\n        \"apply must return a complete receipt with provider record ids\",\n      );\n      const observed = yield* dns.list(zone);\n      yield* expect(\n        name,\n        requirements.every((requirement) =>\n          observed.some(({ record }) => DnsRecord.equals(record, requirement)),\n        ),\n        \"list must return every created record, including across provider pages\",\n      );\n      const cleanupPlan = yield* Cleanup.plan({ receiptId: receipt.id });\n      yield* expect(\n        name,\n        cleanupPlan.operations.every(({ _tag }) => _tag === \"Delete\"),\n        \"cleanup plan must delete both records\",\n      );\n      const cleaned = yield* Cleanup.apply(yield* Cleanup.approve(cleanupPlan));\n      const remaining = yield* Effect.forEach(created, (id) => dns.get(zone, id));\n      yield* expect(\n        name,\n        cleaned.status === \"complete\" && remaining.every((record) => record === null),\n        \"receipt-bound cleanup must remove every created record\",\n      );\n      created = [];\n    }).pipe(Effect.ensuring(cleanup(dns, () => created)));\n  });\n\n  const exactNoop = run(definition, (dns, attachment) => {\n    let created: ReadonlyArray<string> = [];\n    const name: Case = \"exact-noop\";\n    return Effect.gen(function* () {\n      const requirement = cname(zone, `${prefix}-exact`);\n      const { providerRecordId } = yield* dns.create(zone, requirement);\n      created = [providerRecordId];\n      const plan = yield* Provision.plan({\n        domain: attachment.domain,\n        requirements: [requirement],\n      });\n      yield* expect(name, plan.operations[0]?._tag === \"Noop\", \"an exact record must plan as Noop\");\n      const receipt = yield* Provision.apply(yield* Provision.approve(plan));\n      yield* expect(\n        name,\n        Receipt.applied(receipt).length === 0,\n        \"an exact plan must not create another record\",\n      );\n    }).pipe(Effect.ensuring(cleanup(dns, () => created)));\n  });\n\n  const conflict = run(definition, (dns, attachment) => {\n    let created: ReadonlyArray<string> = [];\n    const name: Case = \"conflict\";\n    return Effect.gen(function* () {\n      const { providerRecordId } = yield* dns.create(\n        zone,\n        txt(zone, `${prefix}-conflict`, \"occupied\"),\n      );\n      created = [providerRecordId];\n      const plan = yield* Provision.plan({\n        domain: attachment.domain,\n        requirements: [cname(zone, `${prefix}-conflict`)],\n      });\n      yield* expect(\n        name,\n        plan.operations[0]?._tag === \"Conflict\",\n        \"a CNAME over an occupied name must plan as Conflict\",\n      );\n      const rejected = yield* Provision.approve(plan).pipe(Effect.result);\n      yield* expect(\n        name,\n        rejected._tag === \"Failure\" && rejected.failure.reason._tag === \"Conflict\",\n        \"approve must fail closed on conflicts\",\n      );\n    }).pipe(Effect.ensuring(cleanup(dns, () => created)));\n  });\n\n  const stalePlan = run(definition, (dns, attachment) => {\n    let created: ReadonlyArray<string> = [];\n    const name: Case = \"stale-plan\";\n    return Effect.gen(function* () {\n      const requirement = cname(zone, `${prefix}-stale`);\n      const plan = yield* Provision.plan({\n        domain: attachment.domain,\n        requirements: [requirement],\n      });\n      const approval = yield* Provision.approve(plan);\n      const { providerRecordId } = yield* dns.create(zone, requirement);\n      created = [providerRecordId];\n      const stale = yield* Provision.apply(approval).pipe(Effect.result);\n      yield* expect(\n        name,\n        stale._tag === \"Failure\" && stale.failure.reason._tag === \"Stale\",\n        \"apply must reject provider state that changed after approval\",\n      );\n    }).pipe(Effect.ensuring(cleanup(dns, () => created)));\n  });\n\n  const flaky: Provider.Definition = {\n    ...definition,\n    session: (input) => {\n      const session = definition.session(input);\n      return {\n        ...session,\n        dns: (target) => {\n          const dns = session.dns(target);\n          let writes = 0;\n          return {\n            ...dns,\n            create: (targetZone, record) => {\n              writes += 1;\n              return writes === 2\n                ? Errors.fail(\n                    new Reason.ProviderUnavailable({\n                      provider: definition.id,\n                      message: \"injected conformance failure\",\n                    }),\n                  )\n                : dns.create(targetZone, record);\n            },\n          };\n        },\n      };\n    },\n  };\n\n  const partialApplyCleanup = run(flaky, (dns, attachment) => {\n    let created: ReadonlyArray<string> = [];\n    const name: Case = \"partial-apply-cleanup\";\n    return Effect.gen(function* () {\n      const plan = yield* Provision.plan({\n        domain: attachment.domain,\n        requirements: [\n          cname(zone, `${prefix}-partial-one`),\n          txt(zone, `${prefix}-partial-two`, \"domainkit\"),\n        ],\n      });\n      const receipt = yield* Provision.apply(yield* Provision.approve(plan));\n      created = recordIds(receipt);\n      yield* expect(\n        name,\n        receipt.status === \"partial\" && created.length === 1,\n        \"a later write failure must preserve the first confirmed write in a partial receipt\",\n      );\n      const cleanupPlan = yield* Cleanup.plan({ receiptId: receipt.id });\n      yield* Cleanup.apply(yield* Cleanup.approve(cleanupPlan));\n      const remaining = yield* Effect.forEach(created, (id) => dns.get(zone, id));\n      yield* expect(\n        name,\n        remaining.every((record) => record === null),\n        \"partial receipt cleanup must remove the confirmed write\",\n      );\n      created = [];\n    }).pipe(Effect.ensuring(cleanup(dns, () => created)));\n  });\n\n  /** A token the provider rejects must read as `Unauthenticated`, so a host tells the customer the provider refused it. */\n  const rejectedToken = Effect.gen(function* () {\n    const name: Case = \"rejected-token\";\n    const auth = definition.auth.token;\n    if (auth === undefined) return;\n    const required = Provider.tokenFields(auth).filter((field) => field.required);\n    if (options.rejectedToken === undefined && required.some((field) => !field.secret)) {\n      return yield* Effect.fail(\n        failure(\n          name,\n          `the token method requires ${required\n            .filter((field) => !field.secret)\n            .map((field) => field.name)\n            .join(\", \")}; pass options.rejectedToken with values the provider rejects`,\n        ),\n      );\n    }\n    const values =\n      options.rejectedToken ??\n      Object.fromEntries(required.map((field) => [field.name, Redacted.make(\"\")]));\n    const outcome = yield* auth.authenticate(values).pipe(Effect.result);\n    yield* expect(\n      name,\n      outcome._tag === \"Failure\" && outcome.failure.reason._tag === \"Unauthenticated\",\n      \"authenticating a rejected token must fail Unauthenticated\",\n    );\n  });\n\n  return Effect.all(\n    [createReadbackCleanup, exactNoop, conflict, stalePlan, partialApplyCleanup, rejectedToken],\n    { discard: true },\n  );\n};\n\n/** Verification is out of scope for the provider contract; keep the pool quiet. */\nconst silentResolver: Resolver.Interface = {\n  resolve: () => Effect.succeed([]),\n};\n"],"mappings":";;;;;;;;;;;;;;;;AA2BA,MAAM,YAAYA,KAAe;CAAE,SAAS;CAAe,SAAS;AAAc,CAAC;AAEnF,MAAM,WAAW,MAAY,YAC3B,IAAIC,eAAsB,EACxB,QAAQ,IAAIC,aAAoB;CAC9B,SAAS,wBAAwB,KAAK,IAAI;CAC1C,OAAO;AACT,CAAC,EACH,CAAC;AAEH,MAAM,UAAU,MAAY,WAAoB,YAC9C,YAAY,OAAO,OAAO,OAAO,KAAK,QAAQ,MAAM,OAAO,CAAC;;AAK9D,MAAM,cACJ,YACA,YACA,SAEA,OAAO,IAAI,aAAa;CACtB,MAAM,UAAU,OAAOC;CACvB,MAAM,UAAU,OAAOC;CACvB,MAAM,MAAM,OAAO,SAAS;CAC5B,MAAM,gBAAgB,IAAIC,cAAsB;EAC9C,IAAI,OAAO,MAAM,MAAM;EACvB,SAAS,UAAU;EACnB,UAAU,WAAW;EACrB,QAAQ;EACR,cAAc,CAAC,YAAY,WAAW;EACtC,SAAS,OAAOC,cAAuB,YAAY,WAAW,OAAO;EACrE,OAAO;EACP,YAAY;EACZ,WAAW,UAAU;EACrB,WAAW;CACb,CAAC;CACD,OAAO,QAAQ,eAAe,OAAO;EACnC;EACA,YAAY,IAAIC,WAAmB;GACjC,YAAY,OAAO,QAAQ,KAAK,WAAW,MAAM;GACjD,WAAW;GACX,WAAW;EACb,CAAC;CACH,CAAC;CACD,MAAM,aAAa,OAAO,QAAQ,YAAY,OAAO,cAAc,EAAE;CACrE,MAAM,WAAW,OAAOC,OAAe;EAAE,cAAc,WAAW;EAAI,QAAQ;CAAK,CAAC;CACpF,IAAI,EAAE,oBAAoBC,aACxB,OAAO,OAAO,OAAO,KACnB,QAAQ,2BAA2B,QAAQ,KAAK,uCAAuC,CACzF;CAEF,OAAO;AACT,CAAC;AAEH,MAAM,SAAS,MAAc,UAC3BC,QAAgB;CAAE,MAAM,GAAG,MAAM,GAAG;CAAQ,QAAQ;CAAsB,KAAK;AAAI,CAAC;AACtF,MAAM,OAAO,MAAc,OAAe,UACxCC,MAAc;CAAE,MAAM,GAAG,MAAM,GAAG;CAAQ;CAAO,KAAK;AAAI,CAAC;AAE7D,MAAM,aAAa,YACjBC,QAAgB,OAAO,CAAC,CAAC,KAAK,EAAE,uBAAuB,gBAAgB;;;;;;AAOzE,MAAa,YACX,YACA,YACA,MACA,UAQI,CAAC,MAC0C;CAC/C,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,OACJ,QACA,SAKA,OAAO,IAAI,aAAa;EACtB,MAAM,aAAa,OAAO,WAAW,QAAQ,YAAY,IAAI;EAC7D,MAAM,EAAE,SAAA,WAAS,QAAQ,aAAa,OAAOC,QAAgB,WAAW,EAAE;EAC1E,OAAO,OAAO,KAAKC,UAAQ,IAAI,QAAQ,GAAG,UAAU;CACtD,CAAC,CAAC,CAAC,KACD,OAAO,eAAeC,WAAmB,SAAS,GAClD,OAAO,QACLC,YAAsB;EACpB,WAAW,CAAC,MAAM;EAClB,UAAU,MAAM,QAAQC,SAAgB,CAAC,CAAC,cAAc;CAC1D,CAAC,CACH,CACF;CAEF,MAAM,WAAW,KAAmB,QAClC,OAAO,cACL,OAAO,QAAQ,IAAI,IAAI,OAAO,IAAI,OAAO,MAAM,EAAE,CAAC,CAAC,KAAK,OAAO,MAAM,GAAG,EAAE,SAAS,KAAK,CAAC,CAC3F;CAEF,MAAM,wBAAwB,IAAI,aAAa,KAAK,eAAe;EACjE,IAAI,UAAiC,CAAC;EACtC,MAAM,OAAa;EACnB,OAAO,OAAO,IAAI,aAAa;GAC7B,MAAM,eAAe,CACnB,MAAM,MAAM,GAAG,OAAO,QAAQ,GAC9B,IAAI,MAAM,GAAG,OAAO,QAAQ,WAAW,CACzC;GACA,MAAMC,SAAO,OAAOC,KAAe;IAAE,QAAQ,WAAW;IAAQ;GAAa,CAAC;GAC9E,OAAO,OACL,MACAD,OAAK,WAAW,OAAO,EAAE,WAAW,SAAS,QAAQ,GACrD,gCACF;GACA,MAAM,UAAU,OAAOE,MAAgB,OAAOC,QAAkBH,MAAI,CAAC;GACrE,UAAU,UAAU,OAAO;GAC3B,OAAO,OACL,MACA,QAAQ,WAAW,cAAc,QAAQ,WAAW,GACpD,+DACF;GACA,MAAM,WAAW,OAAO,IAAI,KAAK,IAAI;GACrC,OAAO,OACL,MACA,aAAa,OAAO,gBAClB,SAAS,MAAM,EAAE,aAAaI,OAAiB,QAAQ,WAAW,CAAC,CACrE,GACA,wEACF;GACA,MAAM,cAAc,OAAOC,OAAa,EAAE,WAAW,QAAQ,GAAG,CAAC;GACjE,OAAO,OACL,MACA,YAAY,WAAW,OAAO,EAAE,WAAW,SAAS,QAAQ,GAC5D,uCACF;GACA,MAAM,UAAU,OAAOC,QAAc,OAAOC,UAAgB,WAAW,CAAC;GACxE,MAAM,YAAY,OAAO,OAAO,QAAQ,UAAU,OAAO,IAAI,IAAI,MAAM,EAAE,CAAC;GAC1E,OAAO,OACL,MACA,QAAQ,WAAW,cAAc,UAAU,OAAO,WAAW,WAAW,IAAI,GAC5E,wDACF;GACA,UAAU,CAAC;EACb,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,QAAQ,WAAW,OAAO,CAAC,CAAC;CACtD,CAAC;CAED,MAAM,YAAY,IAAI,aAAa,KAAK,eAAe;EACrD,IAAI,UAAiC,CAAC;EACtC,MAAM,OAAa;EACnB,OAAO,OAAO,IAAI,aAAa;GAC7B,MAAM,cAAc,MAAM,MAAM,GAAG,OAAO,OAAO;GACjD,MAAM,EAAE,qBAAqB,OAAO,IAAI,OAAO,MAAM,WAAW;GAChE,UAAU,CAAC,gBAAgB;GAC3B,MAAMP,SAAO,OAAOC,KAAe;IACjC,QAAQ,WAAW;IACnB,cAAc,CAAC,WAAW;GAC5B,CAAC;GACD,OAAO,OAAO,MAAMD,OAAK,WAAW,EAAE,EAAE,SAAS,QAAQ,mCAAmC;GAC5F,MAAM,UAAU,OAAOE,MAAgB,OAAOC,QAAkBH,MAAI,CAAC;GACrE,OAAO,OACL,MACAN,QAAgB,OAAO,CAAC,CAAC,WAAW,GACpC,8CACF;EACF,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,QAAQ,WAAW,OAAO,CAAC,CAAC;CACtD,CAAC;CAED,MAAM,WAAW,IAAI,aAAa,KAAK,eAAe;EACpD,IAAI,UAAiC,CAAC;EACtC,MAAM,OAAa;EACnB,OAAO,OAAO,IAAI,aAAa;GAC7B,MAAM,EAAE,qBAAqB,OAAO,IAAI,OACtC,MACA,IAAI,MAAM,GAAG,OAAO,YAAY,UAAU,CAC5C;GACA,UAAU,CAAC,gBAAgB;GAC3B,MAAMM,SAAO,OAAOC,KAAe;IACjC,QAAQ,WAAW;IACnB,cAAc,CAAC,MAAM,MAAM,GAAG,OAAO,UAAU,CAAC;GAClD,CAAC;GACD,OAAO,OACL,MACAD,OAAK,WAAW,EAAE,EAAE,SAAS,YAC7B,qDACF;GACA,MAAM,WAAW,OAAOG,QAAkBH,MAAI,CAAC,CAAC,KAAK,OAAO,MAAM;GAClE,OAAO,OACL,MACA,SAAS,SAAS,aAAa,SAAS,QAAQ,OAAO,SAAS,YAChE,uCACF;EACF,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,QAAQ,WAAW,OAAO,CAAC,CAAC;CACtD,CAAC;CAED,MAAM,YAAY,IAAI,aAAa,KAAK,eAAe;EACrD,IAAI,UAAiC,CAAC;EACtC,MAAM,OAAa;EACnB,OAAO,OAAO,IAAI,aAAa;GAC7B,MAAM,cAAc,MAAM,MAAM,GAAG,OAAO,OAAO;GACjD,MAAMA,SAAO,OAAOC,KAAe;IACjC,QAAQ,WAAW;IACnB,cAAc,CAAC,WAAW;GAC5B,CAAC;GACD,MAAM,WAAW,OAAOE,QAAkBH,MAAI;GAC9C,MAAM,EAAE,qBAAqB,OAAO,IAAI,OAAO,MAAM,WAAW;GAChE,UAAU,CAAC,gBAAgB;GAC3B,MAAM,QAAQ,OAAOE,MAAgB,QAAQ,CAAC,CAAC,KAAK,OAAO,MAAM;GACjE,OAAO,OACL,MACA,MAAM,SAAS,aAAa,MAAM,QAAQ,OAAO,SAAS,SAC1D,8DACF;EACF,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,QAAQ,WAAW,OAAO,CAAC,CAAC;CACtD,CAAC;CA8BD,MAAM,sBAAsB,IAAI;EA3B9B,GAAG;EACH,UAAU,UAAU;GAClB,MAAM,UAAU,WAAW,QAAQ,KAAK;GACxC,OAAO;IACL,GAAG;IACH,MAAM,WAAW;KACf,MAAM,MAAM,QAAQ,IAAI,MAAM;KAC9B,IAAI,SAAS;KACb,OAAO;MACL,GAAG;MACH,SAAS,YAAY,WAAW;OAC9B,UAAU;OACV,OAAO,WAAW,IACdM,KACE,IAAIC,oBAA2B;QAC7B,UAAU,WAAW;QACrB,SAAS;OACX,CAAC,CACH,IACA,IAAI,OAAO,YAAY,MAAM;MACnC;KACF;IACF;GACF;EACF;CAGkC,IAAI,KAAK,eAAe;EAC1D,IAAI,UAAiC,CAAC;EACtC,MAAM,OAAa;EACnB,OAAO,OAAO,IAAI,aAAa;GAC7B,MAAMT,SAAO,OAAOC,KAAe;IACjC,QAAQ,WAAW;IACnB,cAAc,CACZ,MAAM,MAAM,GAAG,OAAO,aAAa,GACnC,IAAI,MAAM,GAAG,OAAO,eAAe,WAAW,CAChD;GACF,CAAC;GACD,MAAM,UAAU,OAAOC,MAAgB,OAAOC,QAAkBH,MAAI,CAAC;GACrE,UAAU,UAAU,OAAO;GAC3B,OAAO,OACL,MACA,QAAQ,WAAW,aAAa,QAAQ,WAAW,GACnD,oFACF;GACA,MAAM,cAAc,OAAOK,OAAa,EAAE,WAAW,QAAQ,GAAG,CAAC;GACjE,OAAOC,QAAc,OAAOC,UAAgB,WAAW,CAAC;GACxD,MAAM,YAAY,OAAO,OAAO,QAAQ,UAAU,OAAO,IAAI,IAAI,MAAM,EAAE,CAAC;GAC1E,OAAO,OACL,MACA,UAAU,OAAO,WAAW,WAAW,IAAI,GAC3C,yDACF;GACA,UAAU,CAAC;EACb,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,QAAQ,WAAW,OAAO,CAAC,CAAC;CACtD,CAAC;;CAGD,MAAM,gBAAgB,OAAO,IAAI,aAAa;EAC5C,MAAM,OAAa;EACnB,MAAM,OAAO,WAAW,KAAK;EAC7B,IAAI,SAAS,KAAA,GAAW;EACxB,MAAM,WAAWG,YAAqB,IAAI,CAAC,CAAC,QAAQ,UAAU,MAAM,QAAQ;EAC5E,IAAI,QAAQ,kBAAkB,KAAA,KAAa,SAAS,MAAM,UAAU,CAAC,MAAM,MAAM,GAC/E,OAAO,OAAO,OAAO,KACnB,QACE,MACA,6BAA6B,SAC1B,QAAQ,UAAU,CAAC,MAAM,MAAM,CAAC,CAChC,KAAK,UAAU,MAAM,IAAI,CAAC,CAC1B,KAAK,IAAI,EAAE,8DAChB,CACF;EAEF,MAAM,SACJ,QAAQ,iBACR,OAAO,YAAY,SAAS,KAAK,UAAU,CAAC,MAAM,MAAM,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC;EAC7E,MAAM,UAAU,OAAO,KAAK,aAAa,MAAM,CAAC,CAAC,KAAK,OAAO,MAAM;EACnE,OAAO,OACL,MACA,QAAQ,SAAS,aAAa,QAAQ,QAAQ,OAAO,SAAS,mBAC9D,2DACF;CACF,CAAC;CAED,OAAO,OAAO,IACZ;EAAC;EAAuB;EAAW;EAAU;EAAW;EAAqB;CAAa,GAC1F,EAAE,SAAS,KAAK,CAClB;AACF;;AAGA,MAAM,iBAAqC,EACzC,eAAe,OAAO,QAAQ,CAAC,CAAC,EAClC"}

package/dist/internal/conformance/storage.mjs

@@ -30,6 +30,7 @@ const authorizationRow = (principal, id, now) => new Authorization({
 	method: "token",
 	capabilities: ["dns:read"],
 	context: { account: "acc" },
+	label: "Acme",
 	revocation: "active",
 	createdBy: principal.actorId,
 	createdAt: now
@@ -158,6 +159,7 @@ const cases = (layer) => {
 				yield* storage.authorizations.promoteCapabilities("auth-cred", ["dns:write", "dns:read"]);
 				const promoted = yield* storage.authorizations.get("auth-cred");
 				yield* expect([...promoted.capabilities].sort().join(",") === "dns:read,dns:write", "promoteCapabilities did not merge capabilities");
+				yield* expect(promoted.label === "Acme", "authorization label was not stored");
 			}).pipe(Effect.provideService(Service, owner)))
 		},
 		{

package/dist/internal/conformance/storage.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"storage.mjs","names":["Principal.make","Errors.isDomainKitError","Storage.Authorization","Storage.Credential","Storage.Service","Principal.Service","Plan.Model","Plan.Create","DnsRecord.txt","Storage.Attempt","Approval.Model","Receipt.Model","Receipt.Applied","Storage.Continuation","Storage.Readiness"],"sources":["../../../src/internal/conformance/storage.ts"],"sourcesContent":["import { DateTime, Deferred, Effect, Fiber, Layer, Option } from \"effect\";\n\nimport * as Approval from \"../../Approval.ts\";\nimport * as DnsRecord from \"../../DnsRecord.ts\";\nimport * as Errors from \"../error.ts\";\nimport * as Reason from \"../../Reason.ts\";\nimport * as Plan from \"../../Plan.ts\";\nimport * as Principal from \"../../Principal.ts\";\nimport * as Receipt from \"../../Receipt.ts\";\nimport * as Storage from \"../../Storage.ts\";\n\nexport interface Case {\n  readonly name: string;\n  readonly run: Effect.Effect<void, unknown>;\n}\n\nexport interface Options {\n  /** Register each case with a test runner, e.g. vitest's `it`. */\n  readonly it?: (name: string, run: () => Promise<void>) => void;\n}\n\nconst owner = Principal.make({ ownerId: \"conformance-owner-a\", actorId: \"actor-a\" });\nconst other = Principal.make({ ownerId: \"conformance-owner-b\", actorId: \"actor-b\" });\n\nclass Failure extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"StorageConformanceFailure\";\n  }\n}\n\nconst expect = (condition: boolean, message: string) =>\n  condition ? Effect.void : Effect.fail(new Failure(message));\n\nconst expectReason = <A, R>(\n  effect: Effect.Effect<A, unknown, R>,\n  tag: Reason.Model[\"_tag\"],\n  label: string,\n): Effect.Effect<void, Failure, R> =>\n  effect.pipe(\n    Effect.flip,\n    Effect.mapError(() => new Failure(`${label}: expected failure ${tag}, effect succeeded`)),\n    Effect.flatMap((cause) =>\n      expect(\n        Errors.isDomainKitError(cause) && cause.reason._tag === tag,\n        `${label}: expected reason ${tag}, received ${Errors.isDomainKitError(cause) ? cause.reason._tag : String(cause)}`,\n      ),\n    ),\n  );\n\nconst authorizationRow = (principal: Principal.Interface, id: string, now: DateTime.Utc) =>\n  new Storage.Authorization({\n    id,\n    ownerId: principal.ownerId,\n    provider: \"fake\",\n    method: \"token\",\n    capabilities: [\"dns:read\"],\n    context: { account: \"acc\" },\n    revocation: \"active\",\n    createdBy: principal.actorId,\n    createdAt: now,\n  });\n\nconst credentialRow = (now: DateTime.Utc, ciphertext = \"sealed-1\") =>\n  new Storage.Credential({ ciphertext, expiresAt: null, rotatedAt: now });\n\nconst connect = (principal: Principal.Interface, id: string) =>\n  Effect.gen(function* () {\n    const storage = yield* Storage.Service;\n    const now = yield* DateTime.now;\n    yield* storage.authorizations.upsert({\n      authorization: authorizationRow(principal, id, now),\n      credential: credentialRow(now),\n    });\n    const connection = yield* storage.connections.create(id);\n    const attachment = yield* storage.attachments.create({\n      connectionId: connection.id,\n      domain: `app.${id}.example.com`,\n      zone: `${id}.example.com`,\n      label: `${id}.example.com (${id})`,\n      target: { zoneId: `zone-${id}` },\n    });\n    return { storage, connection, attachment };\n  }).pipe(Effect.provideService(Principal.Service, principal));\n\nconst planRow = (attachmentId: string, now: DateTime.Utc, suffix: string) =>\n  new Plan.Model({\n    id: Plan.PlanId.make(`plan-${suffix}`),\n    version: \"domainkit.plan.v2\",\n    kind: \"provisioning\",\n    digest: Plan.Digest.make(`digest-${suffix}`),\n    domain: \"app.example.com\",\n    zone: \"example.com\",\n    provider: \"fake\",\n    attachmentId,\n    operations: [\n      new Plan.Create({\n        id: Plan.OperationId.make(`op-${suffix}`),\n        record: DnsRecord.txt({ name: \"app.example.com\", value: suffix }),\n      }),\n    ],\n    createdAt: now,\n    expiresAt: DateTime.add(now, { hours: 1 }),\n  });\n\nconst attemptRow = (principal: Principal.Interface, plan: Plan.Model) =>\n  new Storage.Attempt({\n    id: plan.id,\n    ownerId: principal.ownerId,\n    attachmentId: plan.attachmentId,\n    kind: plan.kind,\n    status: \"planned\",\n    plan,\n    approval: null,\n    receipt: null,\n    rejection: null,\n    sourceReceiptId: null,\n    leaseExpiresAt: null,\n    failure: null,\n    updatedAt: plan.createdAt,\n  });\n\nconst approvalRow = (plan: Plan.Model, suffix: string) =>\n  new Approval.Model({\n    id: Approval.ApprovalId.make(`approval-${suffix}`),\n    version: \"domainkit.approval.v2\",\n    kind: plan.kind,\n    planId: plan.id,\n    digest: plan.digest,\n    operationIds: plan.operations.map(({ id }) => id),\n    approvedBy: \"actor\",\n    approvedAt: plan.createdAt,\n    expiresAt: plan.expiresAt,\n  });\n\nconst receiptRow = (plan: Plan.Model, approval: Approval.Model, suffix: string) =>\n  new Receipt.Model({\n    id: Receipt.ReceiptId.make(`receipt-${suffix}`),\n    version: \"domainkit.receipt.v2\",\n    kind: plan.kind,\n    planId: plan.id,\n    approvalId: approval.id,\n    digest: plan.digest,\n    provider: plan.provider,\n    zone: plan.zone,\n    status: \"complete\",\n    outcomes: plan.operations.map(\n      (operation) => new Receipt.Applied({ operationId: operation.id, providerRecordId: \"r1\" }),\n    ),\n    appliedAt: plan.createdAt,\n  });\n\n/** Every invariant a `Storage` implementation must hold. Each case runs against a fresh layer. */\nexport const cases = (layer: Layer.Layer<Storage.Service, unknown>): ReadonlyArray<Case> => {\n  const run = <E>(effect: Effect.Effect<void, E, Storage.Service>): Effect.Effect<void, unknown> =>\n    effect.pipe(Effect.provide(layer));\n  return [\n    {\n      name: \"scopes every row by the principal's owner\",\n      run: run(\n        Effect.gen(function* () {\n          const { storage, connection, attachment } = yield* connect(owner, \"auth-a\");\n          const asOther = <A, E>(effect: Effect.Effect<A, E, Principal.Service>) =>\n            effect.pipe(Effect.provideService(Principal.Service, other));\n          yield* expectReason(\n            asOther(storage.authorizations.get(\"auth-a\")),\n            \"NotFound\",\n            \"authorizations.get\",\n          );\n          yield* expectReason(\n            asOther(storage.authorizations.credential(\"auth-a\")),\n            \"NotFound\",\n            \"authorizations.credential\",\n          );\n          yield* expectReason(\n            asOther(storage.connections.get(connection.id)),\n            \"NotFound\",\n            \"connections.get\",\n          );\n          yield* expectReason(\n            asOther(storage.attachments.get(attachment.id)),\n            \"NotFound\",\n            \"attachments.get\",\n          );\n          yield* expectReason(\n            asOther(storage.attachments.list(connection.id)),\n            \"NotFound\",\n            \"attachments.list\",\n          );\n          const connections = yield* asOther(storage.connections.list());\n          yield* expect(connections.length === 0, \"connections.list leaked across owners\");\n          const byDomain = yield* asOther(storage.attachments.byDomain(attachment.domain));\n          yield* expect(Option.isNone(byDomain), \"attachments.byDomain leaked across owners\");\n          const now = yield* DateTime.now;\n          yield* expectReason(\n            asOther(\n              storage.authorizations.upsert({\n                authorization: authorizationRow(owner, \"auth-b\", now),\n                credential: credentialRow(now),\n              }),\n            ),\n            \"InvalidInput\",\n            \"authorizations.upsert with a foreign ownerId\",\n          );\n        }),\n      ),\n    },\n    {\n      name: \"stores, rotates, and promotes credentials without exposing plaintext\",\n      run: run(\n        Effect.gen(function* () {\n          const { storage } = yield* connect(owner, \"auth-cred\");\n          const first = yield* storage.authorizations.credential(\"auth-cred\");\n          yield* expect(first.ciphertext === \"sealed-1\", \"credential ciphertext was not stored\");\n          const now = yield* DateTime.now;\n          yield* storage.authorizations.rotate(\"auth-cred\", credentialRow(now, \"sealed-2\"));\n          const rotated = yield* storage.authorizations.credential(\"auth-cred\");\n          yield* expect(rotated.ciphertext === \"sealed-2\", \"rotate did not replace the credential\");\n          yield* storage.authorizations.promoteCapabilities(\"auth-cred\", [\"dns:write\", \"dns:read\"]);\n          const promoted = yield* storage.authorizations.get(\"auth-cred\");\n          yield* expect(\n            [...promoted.capabilities].sort().join(\",\") === \"dns:read,dns:write\",\n            \"promoteCapabilities did not merge capabilities\",\n          );\n        }).pipe(Effect.provideService(Principal.Service, owner)),\n      ),\n    },\n    {\n      name: \"replaces an authorization only through the expected id\",\n      run: run(\n        Effect.gen(function* () {\n          const { storage } = yield* connect(owner, \"auth-cas\");\n          const now = yield* DateTime.now;\n          const replaced = yield* storage.authorizations.upsert({\n            authorization: new Storage.Authorization({\n              ...authorizationRow(owner, \"auth-cas\", now),\n              method: \"oauth\",\n            }),\n            credential: credentialRow(now, \"sealed-oauth\"),\n            expectedId: \"auth-cas\",\n          });\n          yield* expect(\n            replaced.method === \"oauth\",\n            \"upsert with expectedId did not replace the row\",\n          );\n          const credential = yield* storage.authorizations.credential(\"auth-cas\");\n          yield* expect(\n            credential.ciphertext === \"sealed-oauth\",\n            \"upsert with expectedId did not replace the credential\",\n          );\n          yield* expectReason(\n            storage.authorizations.upsert({\n              authorization: authorizationRow(owner, \"auth-missing\", now),\n              credential: credentialRow(now),\n              expectedId: \"auth-missing\",\n            }),\n            \"NotFound\",\n            \"upsert with an unknown expectedId\",\n          );\n          yield* expectReason(\n            storage.authorizations.upsert({\n              authorization: authorizationRow(owner, \"auth-cas\", now),\n              credential: credentialRow(now),\n            }),\n            \"InvalidInput\",\n            \"insert of an existing id\",\n          );\n        }).pipe(Effect.provideService(Principal.Service, owner)),\n      ),\n    },\n    {\n      name: \"consumes continuations exactly once and rejects expired ones\",\n      run: run(\n        Effect.gen(function* () {\n          const storage = yield* Storage.Service;\n          const now = yield* DateTime.now;\n          const continuation = new Storage.Continuation({\n            id: \"cont-1\",\n            ownerId: owner.ownerId,\n            actorId: owner.actorId,\n            provider: \"fake\",\n            payload: { codeVerifier: \"v\" },\n            returnTo: null,\n            expiresAt: DateTime.add(now, { minutes: 15 }),\n          });\n          yield* storage.continuations.put(continuation);\n          yield* expectReason(\n            storage.continuations\n              .consume(\"cont-1\")\n              .pipe(Effect.provideService(Principal.Service, other)),\n            \"NotFound\",\n            \"consume by another owner\",\n          );\n          const peeked = yield* storage.continuations.get(\"cont-1\");\n          yield* expect(peeked.id === \"cont-1\", \"get did not return the continuation\");\n          const consumed = yield* storage.continuations.consume(\"cont-1\");\n          yield* expect(consumed.id === \"cont-1\", \"consume did not return the continuation\");\n          yield* expectReason(storage.continuations.get(\"cont-1\"), \"NotFound\", \"get after consume\");\n          yield* expectReason(\n            storage.continuations.consume(\"cont-1\"),\n            \"NotFound\",\n            \"second consume\",\n          );\n          yield* storage.continuations.put(\n            new Storage.Continuation({\n              ...continuation,\n              id: \"cont-2\",\n              expiresAt: DateTime.subtract(now, { minutes: 1 }),\n            }),\n          );\n          yield* expectReason(storage.continuations.get(\"cont-2\"), \"Expired\", \"expired get\");\n          yield* expectReason(\n            storage.continuations.consume(\"cont-2\"),\n            \"Expired\",\n            \"expired consume\",\n          );\n          yield* expectReason(\n            storage.continuations.consume(\"cont-2\"),\n            \"NotFound\",\n            \"expired consume is also spent\",\n          );\n        }).pipe(Effect.provideService(Principal.Service, owner)),\n      ),\n    },\n    {\n      name: \"reads a continuation header under any principal and still refuses an expired one\",\n      run: run(\n        Effect.gen(function* () {\n          const storage = yield* Storage.Service;\n          const now = yield* DateTime.now;\n          const continuation = new Storage.Continuation({\n            id: \"cont-header-1\",\n            ownerId: owner.ownerId,\n            actorId: owner.actorId,\n            provider: \"fake\",\n            payload: { codeVerifier: \"v\" },\n            returnTo: null,\n            expiresAt: DateTime.add(now, { minutes: 15 }),\n          });\n          yield* storage.continuations.put(continuation);\n          // The deliberate exception to the tenant isolation every other case here enforces, and\n          // not a bug. A provider callback is a top-level navigation carrying a continuation id\n          // and a session cookie, so the route has to learn whose flow it is before it can name a\n          // principal to scope by. The read therefore takes no principal at all — that is a type\n          // constraint, and providing a foreign one below changes nothing — and it answers with\n          // header fields only. `payload` holds the PKCE verifier and stays behind the\n          // owner-scoped `get`. Binding the caller to the flow is the reader's job, and\n          // `domainkit/server` does it on the callback route.\n          const foreign = yield* storage.continuations\n            .header(\"cont-header-1\")\n            .pipe(Effect.provideService(Principal.Service, other));\n          yield* expect(\n            foreign.ownerId === owner.ownerId && foreign.actorId === owner.actorId,\n            \"header did not report the recorded owner and actor\",\n          );\n          yield* expect(foreign.provider === \"fake\", \"header did not report the provider\");\n          yield* expect(!(\"payload\" in foreign), \"header exposed the continuation payload\");\n          // A read, never a claim: the flow is still there to be spent.\n          const still = yield* storage.continuations.get(\"cont-header-1\");\n          yield* expect(still.id === \"cont-header-1\", \"the header read spent the continuation\");\n          yield* expectReason(\n            storage.continuations.header(\"cont-header-missing\"),\n            \"NotFound\",\n            \"header of an unknown continuation\",\n          );\n          yield* storage.continuations.put(\n            new Storage.Continuation({\n              ...continuation,\n              id: \"cont-header-2\",\n              expiresAt: DateTime.subtract(now, { minutes: 1 }),\n            }),\n          );\n          yield* expectReason(\n            storage.continuations.header(\"cont-header-2\"),\n            \"Expired\",\n            \"header of an expired continuation\",\n          );\n        }).pipe(Effect.provideService(Principal.Service, owner)),\n      ),\n    },\n    {\n      name: \"moves attempts through planned, approved, applying, and complete with leases\",\n      run: run(\n        Effect.gen(function* () {\n          const { storage, attachment } = yield* connect(owner, \"auth-attempt\");\n          const now = yield* DateTime.now;\n          const plan = planRow(attachment.id, now, \"1\");\n          yield* storage.attempts.create(attemptRow(owner, plan));\n          yield* expectReason(\n            storage.attempts.create(attemptRow(owner, plan)),\n            \"InvalidInput\",\n            \"duplicate attempt\",\n          );\n          yield* expectReason(\n            storage.attempts.claim(plan.id, DateTime.add(now, { minutes: 2 })),\n            \"Stale\",\n            \"claim before approval\",\n          );\n          const approval = approvalRow(plan, \"1\");\n          const approved = yield* storage.attempts.approve(plan.id, approval);\n          yield* expect(approved.status === \"approved\", \"approve did not move the status\");\n          const again = yield* storage.attempts.approve(plan.id, approval);\n          yield* expect(\n            again.approval?.id === approval.id,\n            \"re-approving with the same approval must be idempotent\",\n          );\n          yield* expectReason(\n            storage.attempts.approve(plan.id, approvalRow(plan, \"other\")),\n            \"Stale\",\n            \"second approval\",\n          );\n          const byApproval = yield* storage.attempts.byApproval(approval.id);\n          yield* expect(byApproval.id === plan.id, \"byApproval did not find the attempt\");\n          const claimed = yield* storage.attempts.claim(plan.id, DateTime.add(now, { minutes: 2 }));\n          yield* expect(\n            claimed.status === \"applying\" && claimed.leaseExpiresAt !== null,\n            \"claim did not lease\",\n          );\n          yield* expectReason(\n            storage.attempts.claim(plan.id, DateTime.add(now, { minutes: 2 })),\n            \"Busy\",\n            \"claim while leased\",\n          );\n          yield* storage.attempts.fail(plan.id, \"provider down\");\n          const failed = yield* storage.attempts.get(plan.id);\n          yield* expect(\n            failed.status === \"failed\" && failed.failure === \"provider down\",\n            \"fail did not record the message\",\n          );\n          const reclaimed = yield* storage.attempts.claim(\n            plan.id,\n            DateTime.subtract(now, { minutes: 1 }),\n          );\n          yield* expect(reclaimed.failure === null, \"claim did not clear the failure\");\n          const expiredLease = yield* storage.attempts.claim(\n            plan.id,\n            DateTime.add(now, { minutes: 2 }),\n          );\n          yield* expect(expiredLease.status === \"applying\", \"an expired lease must be reclaimable\");\n          const receipt = receiptRow(plan, approval, \"1\");\n          const completed = yield* storage.attempts.complete(plan.id, receipt);\n          yield* expect(\n            completed.status === \"complete\" && completed.leaseExpiresAt === null,\n            \"complete did not clear the lease\",\n          );\n          yield* expectReason(\n            storage.attempts.claim(plan.id, DateTime.add(now, { minutes: 2 })),\n            \"Stale\",\n            \"claim after completion\",\n          );\n          const byReceipt = yield* storage.attempts.byReceipt(receipt.id);\n          yield* expect(byReceipt.receipt?.id === receipt.id, \"byReceipt did not find the attempt\");\n          const later = planRow(attachment.id, DateTime.add(now, { seconds: 1 }), \"2\");\n          yield* storage.attempts.create(attemptRow(owner, later));\n          const latest = yield* storage.attempts.latest(attachment.id, \"provisioning\");\n          yield* expect(\n            Option.isSome(latest) && latest.value.id === later.id,\n            \"latest did not return the newest attempt\",\n          );\n          const cleanup = yield* storage.attempts.latest(attachment.id, \"cleanup\");\n          yield* expect(Option.isNone(cleanup), \"latest must filter by kind\");\n          yield* expectReason(\n            storage.attempts.get(plan.id).pipe(Effect.provideService(Principal.Service, other)),\n            \"NotFound\",\n            \"attempts.get across owners\",\n          );\n        }).pipe(Effect.provideService(Principal.Service, owner)),\n      ),\n    },\n    {\n      name: \"rejects a planned attempt once and terminally\",\n      run: run(\n        Effect.gen(function* () {\n          const { storage, attachment } = yield* connect(owner, \"auth-reject\");\n          const now = yield* DateTime.now;\n          const plan = planRow(attachment.id, now, \"r1\");\n          yield* storage.attempts.create(attemptRow(owner, plan));\n          yield* expectReason(\n            storage.attempts.reject(plan.id, {\n              digest: Plan.Digest.make(\"other\"),\n              actorId: \"a\",\n              reason: null,\n            }),\n            \"Stale\",\n            \"reject with a digest mismatch\",\n          );\n          yield* expectReason(\n            storage.attempts\n              .reject(plan.id, { digest: plan.digest, actorId: other.actorId, reason: null })\n              .pipe(Effect.provideService(Principal.Service, other)),\n            \"NotFound\",\n            \"reject by another owner\",\n          );\n          const rejected = yield* storage.attempts.reject(plan.id, {\n            digest: plan.digest,\n            actorId: owner.actorId,\n            reason: \"wrong zone\",\n          });\n          yield* expect(\n            rejected.status === \"rejected\" &&\n              rejected.rejection?.actorId === owner.actorId &&\n              rejected.rejection.reason === \"wrong zone\" &&\n              DateTime.toEpochMillis(rejected.rejection.at) >= DateTime.toEpochMillis(now),\n            \"reject did not record the actor, reason, and time\",\n          );\n          const again = yield* storage.attempts.reject(plan.id, {\n            digest: plan.digest,\n            actorId: \"someone-else\",\n            reason: \"later\",\n          });\n          yield* expect(\n            again.rejection?.reason === \"wrong zone\",\n            \"rejecting a rejected attempt must return it unchanged\",\n          );\n          yield* expectReason(\n            storage.attempts.approve(plan.id, approvalRow(plan, \"r1\")),\n            \"Stale\",\n            \"approve after reject\",\n          );\n          yield* expectReason(\n            storage.attempts.claim(plan.id, DateTime.add(now, { minutes: 2 })),\n            \"Stale\",\n            \"claim after reject\",\n          );\n          const approvedPlan = planRow(attachment.id, now, \"r2\");\n          yield* storage.attempts.create(attemptRow(owner, approvedPlan));\n          yield* storage.attempts.approve(approvedPlan.id, approvalRow(approvedPlan, \"r2\"));\n          yield* expectReason(\n            storage.attempts.reject(approvedPlan.id, {\n              digest: approvedPlan.digest,\n              actorId: \"a\",\n              reason: null,\n            }),\n            \"Stale\",\n            \"reject after approve\",\n          );\n          const expiredPlan = planRow(attachment.id, now, \"r3\");\n          yield* storage.attempts.create(\n            new Storage.Attempt({ ...attemptRow(owner, expiredPlan), status: \"expired\" }),\n          );\n          yield* expectReason(\n            storage.attempts.reject(expiredPlan.id, {\n              digest: expiredPlan.digest,\n              actorId: \"a\",\n              reason: null,\n            }),\n            \"Expired\",\n            \"reject an expired plan\",\n          );\n        }).pipe(Effect.provideService(Principal.Service, owner)),\n      ),\n    },\n    {\n      name: \"keeps a failed revocation pending and finishes it on recovery\",\n      run: run(\n        Effect.gen(function* () {\n          const { storage, connection, attachment } = yield* connect(owner, \"auth-revoke\");\n          yield* storage.attachments.remove(attachment.id);\n          yield* storage.connections.remove(connection.id);\n          const revokeFailure = yield* storage.authorizations\n            .revoke(\"auth-revoke\", Effect.fail(new Failure(\"provider unavailable\")))\n            .pipe(Effect.flip);\n          yield* expect(\n            revokeFailure instanceof Failure,\n            \"revoke must surface the provider failure\",\n          );\n          const pending = yield* storage.authorizations.get(\"auth-revoke\");\n          yield* expect(\n            pending.revocation === \"pending\",\n            \"a failed revoke must leave the row pending\",\n          );\n          const now = yield* DateTime.now;\n          yield* expectReason(\n            storage.authorizations.upsert({\n              authorization: authorizationRow(owner, \"auth-revoke\", now),\n              credential: credentialRow(now),\n              expectedId: \"auth-revoke\",\n            }),\n            \"Busy\",\n            \"reconnect while revocation is pending\",\n          );\n          const recoveredByOther = yield* storage.authorizations\n            .recoverRevocations(() => Effect.void)\n            .pipe(Effect.provideService(Principal.Service, other));\n          yield* expect(recoveredByOther === 0, \"recovery must not cross owners\");\n          let calls = 0;\n          const recovered = yield* storage.authorizations.recoverRevocations(() =>\n            Effect.sync(() => void (calls += 1)),\n          );\n          yield* expect(\n            recovered === 1 && calls === 1,\n            \"recovery must revoke exactly the pending authorization\",\n          );\n          yield* expectReason(\n            storage.authorizations.get(\"auth-revoke\"),\n            \"NotFound\",\n            \"authorization after recovery\",\n          );\n          const again = yield* storage.authorizations.recoverRevocations(() => Effect.void);\n          yield* expect(again === 0, \"recovery must be idempotent\");\n        }).pipe(Effect.provideService(Principal.Service, owner)),\n      ),\n    },\n    {\n      name: \"returns an attachment's label from every read\",\n      run: run(\n        Effect.gen(function* () {\n          const { storage, connection, attachment } = yield* connect(owner, \"auth-label\");\n          const label = `${attachment.zone} (auth-label)`;\n          yield* expect(attachment.label === label, \"create must return the label it was given\");\n          const read = yield* storage.attachments.get(attachment.id);\n          yield* expect(read.label === label, \"get must return the stored label\");\n          const byDomain = yield* storage.attachments.byDomain(attachment.domain);\n          yield* expect(\n            Option.isSome(byDomain) && byDomain.value.label === label,\n            \"byDomain must return the stored label\",\n          );\n          const listed = yield* storage.attachments.list(connection.id);\n          yield* expect(\n            listed.every((row) => row.label === label),\n            \"list must return the stored label\",\n          );\n        }).pipe(Effect.provideService(Principal.Service, owner)),\n      ),\n    },\n    {\n      name: \"blocks connection removal while attachments exist\",\n      run: run(\n        Effect.gen(function* () {\n          const { storage, connection, attachment } = yield* connect(owner, \"auth-remove\");\n          yield* expectReason(\n            storage.connections.remove(connection.id),\n            \"InvalidInput\",\n            \"remove with attachments\",\n          );\n          yield* expectReason(\n            storage.attachments.create({\n              connectionId: connection.id,\n              domain: attachment.domain,\n              zone: attachment.zone,\n              label: attachment.label,\n              target: {},\n            }),\n            \"InvalidInput\",\n            \"duplicate domain attachment\",\n          );\n          yield* storage.attachments.remove(attachment.id);\n          yield* storage.connections.remove(connection.id);\n          yield* expectReason(\n            storage.connections.get(connection.id),\n            \"NotFound\",\n            \"connection after remove\",\n          );\n        }).pipe(Effect.provideService(Principal.Service, owner)),\n      ),\n    },\n    {\n      name: \"fails Busy while a lock is held and releases it afterwards\",\n      run: run(\n        Effect.gen(function* () {\n          const storage = yield* Storage.Service;\n          const gate = yield* Deferred.make<void>();\n          const holder = yield* Effect.forkChild(\n            storage.withLock(\"refresh:auth-1\", Deferred.await(gate)),\n          );\n          yield* Effect.yieldNow;\n          yield* expectReason(\n            storage.withLock(\"refresh:auth-1\", Effect.void),\n            \"Busy\",\n            \"second holder\",\n          );\n          const otherOwner = yield* storage\n            .withLock(\"refresh:auth-1\", Effect.succeed(\"ok\"))\n            .pipe(Effect.provideService(Principal.Service, other));\n          yield* expect(otherOwner === \"ok\", \"locks must be scoped by owner\");\n          yield* Deferred.succeed(gate, undefined);\n          yield* Fiber.join(holder);\n          const after = yield* storage.withLock(\"refresh:auth-1\", Effect.succeed(\"free\"));\n          yield* expect(after === \"free\", \"lock was not released\");\n          yield* storage\n            .withLock(\"refresh:auth-1\", Effect.fail(new Failure(\"inside\")))\n            .pipe(Effect.ignore);\n          const afterFailure = yield* storage.withLock(\"refresh:auth-1\", Effect.succeed(\"free\"));\n          yield* expect(afterFailure === \"free\", \"lock was not released after a failure\");\n        }).pipe(Effect.provideService(Principal.Service, owner)),\n      ),\n    },\n    {\n      name: \"stores readiness per domain, with or without an attachment\",\n      run: run(\n        Effect.gen(function* () {\n          const { storage, attachment } = yield* connect(owner, \"auth-ready\");\n          const now = yield* DateTime.now;\n          const readiness = new Storage.Readiness({\n            domain: attachment.domain,\n            attachmentId: attachment.id,\n            ownerId: owner.ownerId,\n            overall: \"pending\",\n            requirements: [\n              {\n                operationId: null,\n                record: DnsRecord.txt({ name: \"app.example.com\", value: \"v\" }),\n                status: \"missing\",\n                evidence: [],\n              },\n            ],\n            host: [],\n            pendingSince: now,\n            checkedAt: now,\n            nextCheckAt: DateTime.add(now, { seconds: 15 }),\n          });\n          yield* storage.readiness.put(readiness);\n          const stored = yield* storage.readiness.get(attachment.domain);\n          yield* expect(\n            Option.isSome(stored) && stored.value.overall === \"pending\",\n            \"readiness was not stored\",\n          );\n          const foreign = yield* storage.readiness\n            .get(attachment.domain)\n            .pipe(Effect.provideService(Principal.Service, other));\n          yield* expect(Option.isNone(foreign), \"readiness leaked across owners\");\n          yield* storage.readiness.put(\n            new Storage.Readiness({\n              ...readiness,\n              domain: \"observe-only.example.com\",\n              attachmentId: null,\n            }),\n          );\n          const observeOnly = yield* storage.readiness.get(\"observe-only.example.com\");\n          yield* expect(\n            Option.isSome(observeOnly) && observeOnly.value.attachmentId === null,\n            \"readiness without an attachment was not stored\",\n          );\n          yield* expectReason(\n            storage.readiness.put(\n              new Storage.Readiness({ ...readiness, attachmentId: \"att-missing\" }),\n            ),\n            \"NotFound\",\n            \"readiness with an unknown attachment\",\n          );\n        }).pipe(Effect.provideService(Principal.Service, owner)),\n      ),\n    },\n  ];\n};\n\n/** Registers every case with `options.it` when given; always returns the cases. */\nexport const storage = (\n  layer: Layer.Layer<Storage.Service, unknown>,\n  options: Options = {},\n): ReadonlyArray<Case> => {\n  const all = cases(layer);\n  if (options.it !== undefined) {\n    for (const item of all) options.it(item.name, () => Effect.runPromise(item.run));\n  }\n  return all;\n};\n"],"mappings":";;;;;;;;;AAqBA,MAAM,QAAQA,KAAe;CAAE,SAAS;CAAuB,SAAS;AAAU,CAAC;AACnF,MAAM,QAAQA,KAAe;CAAE,SAAS;CAAuB,SAAS;AAAU,CAAC;AAEnF,IAAM,UAAN,cAAsB,MAAM;CAC1B,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF;AAEA,MAAM,UAAU,WAAoB,YAClC,YAAY,OAAO,OAAO,OAAO,KAAK,IAAI,QAAQ,OAAO,CAAC;AAE5D,MAAM,gBACJ,QACA,KACA,UAEA,OAAO,KACL,OAAO,MACP,OAAO,eAAe,IAAI,QAAQ,GAAG,MAAM,qBAAqB,IAAI,mBAAmB,CAAC,GACxF,OAAO,SAAS,UACd,OACEC,iBAAwB,KAAK,KAAK,MAAM,OAAO,SAAS,KACxD,GAAG,MAAM,oBAAoB,IAAI,aAAaA,iBAAwB,KAAK,IAAI,MAAM,OAAO,OAAO,OAAO,KAAK,GACjH,CACF,CACF;AAEF,MAAM,oBAAoB,WAAgC,IAAY,QACpE,IAAIC,cAAsB;CACxB;CACA,SAAS,UAAU;CACnB,UAAU;CACV,QAAQ;CACR,cAAc,CAAC,UAAU;CACzB,SAAS,EAAE,SAAS,MAAM;CAC1B,YAAY;CACZ,WAAW,UAAU;CACrB,WAAW;AACb,CAAC;AAEH,MAAM,iBAAiB,KAAmB,aAAa,eACrD,IAAIC,WAAmB;CAAE;CAAY,WAAW;CAAM,WAAW;AAAI,CAAC;AAExE,MAAM,WAAW,WAAgC,OAC/C,OAAO,IAAI,aAAa;CACtB,MAAM,UAAU,OAAOC;CACvB,MAAM,MAAM,OAAO,SAAS;CAC5B,OAAO,QAAQ,eAAe,OAAO;EACnC,eAAe,iBAAiB,WAAW,IAAI,GAAG;EAClD,YAAY,cAAc,GAAG;CAC/B,CAAC;CACD,MAAM,aAAa,OAAO,QAAQ,YAAY,OAAO,EAAE;CAQvD,OAAO;EAAE;EAAS;EAAY,YAAA,OAPJ,QAAQ,YAAY,OAAO;GACnD,cAAc,WAAW;GACzB,QAAQ,OAAO,GAAG;GAClB,MAAM,GAAG,GAAG;GACZ,OAAO,GAAG,GAAG,gBAAgB,GAAG;GAChC,QAAQ,EAAE,QAAQ,QAAQ,KAAK;EACjC,CAAC;CACwC;AAC3C,CAAC,CAAC,CAAC,KAAK,OAAO,eAAeC,SAAmB,SAAS,CAAC;AAE7D,MAAM,WAAW,cAAsB,KAAmB,WACxD,IAAIC,MAAW;CACb,IAAA,OAAgB,KAAK,QAAQ,QAAQ;CACrC,SAAS;CACT,MAAM;CACN,QAAA,OAAoB,KAAK,UAAU,QAAQ;CAC3C,QAAQ;CACR,MAAM;CACN,UAAU;CACV;CACA,YAAY,CACV,IAAIC,OAAY;EACd,IAAA,YAAqB,KAAK,MAAM,QAAQ;EACxC,QAAQC,IAAc;GAAE,MAAM;GAAmB,OAAO;EAAO,CAAC;CAClE,CAAC,CACH;CACA,WAAW;CACX,WAAW,SAAS,IAAI,KAAK,EAAE,OAAO,EAAE,CAAC;AAC3C,CAAC;AAEH,MAAM,cAAc,WAAgC,SAClD,IAAIC,QAAgB;CAClB,IAAI,KAAK;CACT,SAAS,UAAU;CACnB,cAAc,KAAK;CACnB,MAAM,KAAK;CACX,QAAQ;CACR;CACA,UAAU;CACV,SAAS;CACT,WAAW;CACX,iBAAiB;CACjB,gBAAgB;CAChB,SAAS;CACT,WAAW,KAAK;AAClB,CAAC;AAEH,MAAM,eAAe,MAAkB,WACrC,IAAIC,QAAe;CACjB,IAAA,WAAwB,KAAK,YAAY,QAAQ;CACjD,SAAS;CACT,MAAM,KAAK;CACX,QAAQ,KAAK;CACb,QAAQ,KAAK;CACb,cAAc,KAAK,WAAW,KAAK,EAAE,SAAS,EAAE;CAChD,YAAY;CACZ,YAAY,KAAK;CACjB,WAAW,KAAK;AAClB,CAAC;AAEH,MAAM,cAAc,MAAkB,UAA0B,WAC9D,IAAIC,QAAc;CAChB,IAAA,UAAsB,KAAK,WAAW,QAAQ;CAC9C,SAAS;CACT,MAAM,KAAK;CACX,QAAQ,KAAK;CACb,YAAY,SAAS;CACrB,QAAQ,KAAK;CACb,UAAU,KAAK;CACf,MAAM,KAAK;CACX,QAAQ;CACR,UAAU,KAAK,WAAW,KACvB,cAAc,IAAIC,QAAgB;EAAE,aAAa,UAAU;EAAI,kBAAkB;CAAK,CAAC,CAC1F;CACA,WAAW,KAAK;AAClB,CAAC;;AAGH,MAAa,SAAS,UAAsE;CAC1F,MAAM,OAAU,WACd,OAAO,KAAK,OAAO,QAAQ,KAAK,CAAC;CACnC,OAAO;EACL;GACE,MAAM;GACN,KAAK,IACH,OAAO,IAAI,aAAa;IACtB,MAAM,EAAE,SAAS,YAAY,eAAe,OAAO,QAAQ,OAAO,QAAQ;IAC1E,MAAM,WAAiB,WACrB,OAAO,KAAK,OAAO,eAAeP,SAAmB,KAAK,CAAC;IAC7D,OAAO,aACL,QAAQ,QAAQ,eAAe,IAAI,QAAQ,CAAC,GAC5C,YACA,oBACF;IACA,OAAO,aACL,QAAQ,QAAQ,eAAe,WAAW,QAAQ,CAAC,GACnD,YACA,2BACF;IACA,OAAO,aACL,QAAQ,QAAQ,YAAY,IAAI,WAAW,EAAE,CAAC,GAC9C,YACA,iBACF;IACA,OAAO,aACL,QAAQ,QAAQ,YAAY,IAAI,WAAW,EAAE,CAAC,GAC9C,YACA,iBACF;IACA,OAAO,aACL,QAAQ,QAAQ,YAAY,KAAK,WAAW,EAAE,CAAC,GAC/C,YACA,kBACF;IACA,MAAM,cAAc,OAAO,QAAQ,QAAQ,YAAY,KAAK,CAAC;IAC7D,OAAO,OAAO,YAAY,WAAW,GAAG,uCAAuC;IAC/E,MAAM,WAAW,OAAO,QAAQ,QAAQ,YAAY,SAAS,WAAW,MAAM,CAAC;IAC/E,OAAO,OAAO,OAAO,OAAO,QAAQ,GAAG,2CAA2C;IAClF,MAAM,MAAM,OAAO,SAAS;IAC5B,OAAO,aACL,QACE,QAAQ,eAAe,OAAO;KAC5B,eAAe,iBAAiB,OAAO,UAAU,GAAG;KACpD,YAAY,cAAc,GAAG;IAC/B,CAAC,CACH,GACA,gBACA,8CACF;GACF,CAAC,CACH;EACF;EACA;GACE,MAAM;GACN,KAAK,IACH,OAAO,IAAI,aAAa;IACtB,MAAM,EAAE,YAAY,OAAO,QAAQ,OAAO,WAAW;IACrD,MAAM,QAAQ,OAAO,QAAQ,eAAe,WAAW,WAAW;IAClE,OAAO,OAAO,MAAM,eAAe,YAAY,sCAAsC;IACrF,MAAM,MAAM,OAAO,SAAS;IAC5B,OAAO,QAAQ,eAAe,OAAO,aAAa,cAAc,KAAK,UAAU,CAAC;IAChF,MAAM,UAAU,OAAO,QAAQ,eAAe,WAAW,WAAW;IACpE,OAAO,OAAO,QAAQ,eAAe,YAAY,uCAAuC;IACxF,OAAO,QAAQ,eAAe,oBAAoB,aAAa,CAAC,aAAa,UAAU,CAAC;IACxF,MAAM,WAAW,OAAO,QAAQ,eAAe,IAAI,WAAW;IAC9D,OAAO,OACL,CAAC,GAAG,SAAS,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,MAAM,sBAChD,gDACF;GACF,CAAC,CAAC,CAAC,KAAK,OAAO,eAAeA,SAAmB,KAAK,CAAC,CACzD;EACF;EACA;GACE,MAAM;GACN,KAAK,IACH,OAAO,IAAI,aAAa;IACtB,MAAM,EAAE,YAAY,OAAO,QAAQ,OAAO,UAAU;IACpD,MAAM,MAAM,OAAO,SAAS;IAC5B,MAAM,WAAW,OAAO,QAAQ,eAAe,OAAO;KACpD,eAAe,IAAIH,cAAsB;MACvC,GAAG,iBAAiB,OAAO,YAAY,GAAG;MAC1C,QAAQ;KACV,CAAC;KACD,YAAY,cAAc,KAAK,cAAc;KAC7C,YAAY;IACd,CAAC;IACD,OAAO,OACL,SAAS,WAAW,SACpB,gDACF;IACA,MAAM,aAAa,OAAO,QAAQ,eAAe,WAAW,UAAU;IACtE,OAAO,OACL,WAAW,eAAe,gBAC1B,uDACF;IACA,OAAO,aACL,QAAQ,eAAe,OAAO;KAC5B,eAAe,iBAAiB,OAAO,gBAAgB,GAAG;KAC1D,YAAY,cAAc,GAAG;KAC7B,YAAY;IACd,CAAC,GACD,YACA,mCACF;IACA,OAAO,aACL,QAAQ,eAAe,OAAO;KAC5B,eAAe,iBAAiB,OAAO,YAAY,GAAG;KACtD,YAAY,cAAc,GAAG;IAC/B,CAAC,GACD,gBACA,0BACF;GACF,CAAC,CAAC,CAAC,KAAK,OAAO,eAAeG,SAAmB,KAAK,CAAC,CACzD;EACF;EACA;GACE,MAAM;GACN,KAAK,IACH,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAOD;IACvB,MAAM,MAAM,OAAO,SAAS;IAC5B,MAAM,eAAe,IAAIS,aAAqB;KAC5C,IAAI;KACJ,SAAS,MAAM;KACf,SAAS,MAAM;KACf,UAAU;KACV,SAAS,EAAE,cAAc,IAAI;KAC7B,UAAU;KACV,WAAW,SAAS,IAAI,KAAK,EAAE,SAAS,GAAG,CAAC;IAC9C,CAAC;IACD,OAAO,QAAQ,cAAc,IAAI,YAAY;IAC7C,OAAO,aACL,QAAQ,cACL,QAAQ,QAAQ,CAAC,CACjB,KAAK,OAAO,eAAeR,SAAmB,KAAK,CAAC,GACvD,YACA,0BACF;IACA,MAAM,SAAS,OAAO,QAAQ,cAAc,IAAI,QAAQ;IACxD,OAAO,OAAO,OAAO,OAAO,UAAU,qCAAqC;IAC3E,MAAM,WAAW,OAAO,QAAQ,cAAc,QAAQ,QAAQ;IAC9D,OAAO,OAAO,SAAS,OAAO,UAAU,yCAAyC;IACjF,OAAO,aAAa,QAAQ,cAAc,IAAI,QAAQ,GAAG,YAAY,mBAAmB;IACxF,OAAO,aACL,QAAQ,cAAc,QAAQ,QAAQ,GACtC,YACA,gBACF;IACA,OAAO,QAAQ,cAAc,IAC3B,IAAIQ,aAAqB;KACvB,GAAG;KACH,IAAI;KACJ,WAAW,SAAS,SAAS,KAAK,EAAE,SAAS,EAAE,CAAC;IAClD,CAAC,CACH;IACA,OAAO,aAAa,QAAQ,cAAc,IAAI,QAAQ,GAAG,WAAW,aAAa;IACjF,OAAO,aACL,QAAQ,cAAc,QAAQ,QAAQ,GACtC,WACA,iBACF;IACA,OAAO,aACL,QAAQ,cAAc,QAAQ,QAAQ,GACtC,YACA,+BACF;GACF,CAAC,CAAC,CAAC,KAAK,OAAO,eAAeR,SAAmB,KAAK,CAAC,CACzD;EACF;EACA;GACE,MAAM;GACN,KAAK,IACH,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAOD;IACvB,MAAM,MAAM,OAAO,SAAS;IAC5B,MAAM,eAAe,IAAIS,aAAqB;KAC5C,IAAI;KACJ,SAAS,MAAM;KACf,SAAS,MAAM;KACf,UAAU;KACV,SAAS,EAAE,cAAc,IAAI;KAC7B,UAAU;KACV,WAAW,SAAS,IAAI,KAAK,EAAE,SAAS,GAAG,CAAC;IAC9C,CAAC;IACD,OAAO,QAAQ,cAAc,IAAI,YAAY;IAS7C,MAAM,UAAU,OAAO,QAAQ,cAC5B,OAAO,eAAe,CAAC,CACvB,KAAK,OAAO,eAAeR,SAAmB,KAAK,CAAC;IACvD,OAAO,OACL,QAAQ,YAAY,MAAM,WAAW,QAAQ,YAAY,MAAM,SAC/D,oDACF;IACA,OAAO,OAAO,QAAQ,aAAa,QAAQ,oCAAoC;IAC/E,OAAO,OAAO,EAAE,aAAa,UAAU,yCAAyC;IAEhF,MAAM,QAAQ,OAAO,QAAQ,cAAc,IAAI,eAAe;IAC9D,OAAO,OAAO,MAAM,OAAO,iBAAiB,wCAAwC;IACpF,OAAO,aACL,QAAQ,cAAc,OAAO,qBAAqB,GAClD,YACA,mCACF;IACA,OAAO,QAAQ,cAAc,IAC3B,IAAIQ,aAAqB;KACvB,GAAG;KACH,IAAI;KACJ,WAAW,SAAS,SAAS,KAAK,EAAE,SAAS,EAAE,CAAC;IAClD,CAAC,CACH;IACA,OAAO,aACL,QAAQ,cAAc,OAAO,eAAe,GAC5C,WACA,mCACF;GACF,CAAC,CAAC,CAAC,KAAK,OAAO,eAAeR,SAAmB,KAAK,CAAC,CACzD;EACF;EACA;GACE,MAAM;GACN,KAAK,IACH,OAAO,IAAI,aAAa;IACtB,MAAM,EAAE,SAAS,eAAe,OAAO,QAAQ,OAAO,cAAc;IACpE,MAAM,MAAM,OAAO,SAAS;IAC5B,MAAM,OAAO,QAAQ,WAAW,IAAI,KAAK,GAAG;IAC5C,OAAO,QAAQ,SAAS,OAAO,WAAW,OAAO,IAAI,CAAC;IACtD,OAAO,aACL,QAAQ,SAAS,OAAO,WAAW,OAAO,IAAI,CAAC,GAC/C,gBACA,mBACF;IACA,OAAO,aACL,QAAQ,SAAS,MAAM,KAAK,IAAI,SAAS,IAAI,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,GACjE,SACA,uBACF;IACA,MAAM,WAAW,YAAY,MAAM,GAAG;IACtC,MAAM,WAAW,OAAO,QAAQ,SAAS,QAAQ,KAAK,IAAI,QAAQ;IAClE,OAAO,OAAO,SAAS,WAAW,YAAY,iCAAiC;IAC/E,MAAM,QAAQ,OAAO,QAAQ,SAAS,QAAQ,KAAK,IAAI,QAAQ;IAC/D,OAAO,OACL,MAAM,UAAU,OAAO,SAAS,IAChC,wDACF;IACA,OAAO,aACL,QAAQ,SAAS,QAAQ,KAAK,IAAI,YAAY,MAAM,OAAO,CAAC,GAC5D,SACA,iBACF;IACA,MAAM,aAAa,OAAO,QAAQ,SAAS,WAAW,SAAS,EAAE;IACjE,OAAO,OAAO,WAAW,OAAO,KAAK,IAAI,qCAAqC;IAC9E,MAAM,UAAU,OAAO,QAAQ,SAAS,MAAM,KAAK,IAAI,SAAS,IAAI,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACxF,OAAO,OACL,QAAQ,WAAW,cAAc,QAAQ,mBAAmB,MAC5D,qBACF;IACA,OAAO,aACL,QAAQ,SAAS,MAAM,KAAK,IAAI,SAAS,IAAI,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,GACjE,QACA,oBACF;IACA,OAAO,QAAQ,SAAS,KAAK,KAAK,IAAI,eAAe;IACrD,MAAM,SAAS,OAAO,QAAQ,SAAS,IAAI,KAAK,EAAE;IAClD,OAAO,OACL,OAAO,WAAW,YAAY,OAAO,YAAY,iBACjD,iCACF;IACA,MAAM,YAAY,OAAO,QAAQ,SAAS,MACxC,KAAK,IACL,SAAS,SAAS,KAAK,EAAE,SAAS,EAAE,CAAC,CACvC;IACA,OAAO,OAAO,UAAU,YAAY,MAAM,iCAAiC;IAC3E,MAAM,eAAe,OAAO,QAAQ,SAAS,MAC3C,KAAK,IACL,SAAS,IAAI,KAAK,EAAE,SAAS,EAAE,CAAC,CAClC;IACA,OAAO,OAAO,aAAa,WAAW,YAAY,sCAAsC;IACxF,MAAM,UAAU,WAAW,MAAM,UAAU,GAAG;IAC9C,MAAM,YAAY,OAAO,QAAQ,SAAS,SAAS,KAAK,IAAI,OAAO;IACnE,OAAO,OACL,UAAU,WAAW,cAAc,UAAU,mBAAmB,MAChE,kCACF;IACA,OAAO,aACL,QAAQ,SAAS,MAAM,KAAK,IAAI,SAAS,IAAI,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,GACjE,SACA,wBACF;IACA,MAAM,YAAY,OAAO,QAAQ,SAAS,UAAU,QAAQ,EAAE;IAC9D,OAAO,OAAO,UAAU,SAAS,OAAO,QAAQ,IAAI,oCAAoC;IACxF,MAAM,QAAQ,QAAQ,WAAW,IAAI,SAAS,IAAI,KAAK,EAAE,SAAS,EAAE,CAAC,GAAG,GAAG;IAC3E,OAAO,QAAQ,SAAS,OAAO,WAAW,OAAO,KAAK,CAAC;IACvD,MAAM,SAAS,OAAO,QAAQ,SAAS,OAAO,WAAW,IAAI,cAAc;IAC3E,OAAO,OACL,OAAO,OAAO,MAAM,KAAK,OAAO,MAAM,OAAO,MAAM,IACnD,0CACF;IACA,MAAM,UAAU,OAAO,QAAQ,SAAS,OAAO,WAAW,IAAI,SAAS;IACvE,OAAO,OAAO,OAAO,OAAO,OAAO,GAAG,4BAA4B;IAClE,OAAO,aACL,QAAQ,SAAS,IAAI,KAAK,EAAE,CAAC,CAAC,KAAK,OAAO,eAAeA,SAAmB,KAAK,CAAC,GAClF,YACA,4BACF;GACF,CAAC,CAAC,CAAC,KAAK,OAAO,eAAeA,SAAmB,KAAK,CAAC,CACzD;EACF;EACA;GACE,MAAM;GACN,KAAK,IACH,OAAO,IAAI,aAAa;IACtB,MAAM,EAAE,SAAS,eAAe,OAAO,QAAQ,OAAO,aAAa;IACnE,MAAM,MAAM,OAAO,SAAS;IAC5B,MAAM,OAAO,QAAQ,WAAW,IAAI,KAAK,IAAI;IAC7C,OAAO,QAAQ,SAAS,OAAO,WAAW,OAAO,IAAI,CAAC;IACtD,OAAO,aACL,QAAQ,SAAS,OAAO,KAAK,IAAI;KAC/B,QAAA,OAAoB,KAAK,OAAO;KAChC,SAAS;KACT,QAAQ;IACV,CAAC,GACD,SACA,+BACF;IACA,OAAO,aACL,QAAQ,SACL,OAAO,KAAK,IAAI;KAAE,QAAQ,KAAK;KAAQ,SAAS,MAAM;KAAS,QAAQ;IAAK,CAAC,CAAC,CAC9E,KAAK,OAAO,eAAeA,SAAmB,KAAK,CAAC,GACvD,YACA,yBACF;IACA,MAAM,WAAW,OAAO,QAAQ,SAAS,OAAO,KAAK,IAAI;KACvD,QAAQ,KAAK;KACb,SAAS,MAAM;KACf,QAAQ;IACV,CAAC;IACD,OAAO,OACL,SAAS,WAAW,cAClB,SAAS,WAAW,YAAY,MAAM,WACtC,SAAS,UAAU,WAAW,gBAC9B,SAAS,cAAc,SAAS,UAAU,EAAE,KAAK,SAAS,cAAc,GAAG,GAC7E,mDACF;IACA,MAAM,QAAQ,OAAO,QAAQ,SAAS,OAAO,KAAK,IAAI;KACpD,QAAQ,KAAK;KACb,SAAS;KACT,QAAQ;IACV,CAAC;IACD,OAAO,OACL,MAAM,WAAW,WAAW,cAC5B,uDACF;IACA,OAAO,aACL,QAAQ,SAAS,QAAQ,KAAK,IAAI,YAAY,MAAM,IAAI,CAAC,GACzD,SACA,sBACF;IACA,OAAO,aACL,QAAQ,SAAS,MAAM,KAAK,IAAI,SAAS,IAAI,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,GACjE,SACA,oBACF;IACA,MAAM,eAAe,QAAQ,WAAW,IAAI,KAAK,IAAI;IACrD,OAAO,QAAQ,SAAS,OAAO,WAAW,OAAO,YAAY,CAAC;IAC9D,OAAO,QAAQ,SAAS,QAAQ,aAAa,IAAI,YAAY,cAAc,IAAI,CAAC;IAChF,OAAO,aACL,QAAQ,SAAS,OAAO,aAAa,IAAI;KACvC,QAAQ,aAAa;KACrB,SAAS;KACT,QAAQ;IACV,CAAC,GACD,SACA,sBACF;IACA,MAAM,cAAc,QAAQ,WAAW,IAAI,KAAK,IAAI;IACpD,OAAO,QAAQ,SAAS,OACtB,IAAII,QAAgB;KAAE,GAAG,WAAW,OAAO,WAAW;KAAG,QAAQ;IAAU,CAAC,CAC9E;IACA,OAAO,aACL,QAAQ,SAAS,OAAO,YAAY,IAAI;KACtC,QAAQ,YAAY;KACpB,SAAS;KACT,QAAQ;IACV,CAAC,GACD,WACA,wBACF;GACF,CAAC,CAAC,CAAC,KAAK,OAAO,eAAeJ,SAAmB,KAAK,CAAC,CACzD;EACF;EACA;GACE,MAAM;GACN,KAAK,IACH,OAAO,IAAI,aAAa;IACtB,MAAM,EAAE,SAAS,YAAY,eAAe,OAAO,QAAQ,OAAO,aAAa;IAC/E,OAAO,QAAQ,YAAY,OAAO,WAAW,EAAE;IAC/C,OAAO,QAAQ,YAAY,OAAO,WAAW,EAAE;IAC/C,MAAM,gBAAgB,OAAO,QAAQ,eAClC,OAAO,eAAe,OAAO,KAAK,IAAI,QAAQ,sBAAsB,CAAC,CAAC,CAAC,CACvE,KAAK,OAAO,IAAI;IACnB,OAAO,OACL,yBAAyB,SACzB,0CACF;IACA,MAAM,UAAU,OAAO,QAAQ,eAAe,IAAI,aAAa;IAC/D,OAAO,OACL,QAAQ,eAAe,WACvB,4CACF;IACA,MAAM,MAAM,OAAO,SAAS;IAC5B,OAAO,aACL,QAAQ,eAAe,OAAO;KAC5B,eAAe,iBAAiB,OAAO,eAAe,GAAG;KACzD,YAAY,cAAc,GAAG;KAC7B,YAAY;IACd,CAAC,GACD,QACA,uCACF;IACA,MAAM,mBAAmB,OAAO,QAAQ,eACrC,yBAAyB,OAAO,IAAI,CAAC,CACrC,KAAK,OAAO,eAAeA,SAAmB,KAAK,CAAC;IACvD,OAAO,OAAO,qBAAqB,GAAG,gCAAgC;IACtE,IAAI,QAAQ;IACZ,MAAM,YAAY,OAAO,QAAQ,eAAe,yBAC9C,OAAO,WAAW,MAAM,SAAS,EAAE,CACrC;IACA,OAAO,OACL,cAAc,KAAK,UAAU,GAC7B,wDACF;IACA,OAAO,aACL,QAAQ,eAAe,IAAI,aAAa,GACxC,YACA,8BACF;IACA,MAAM,QAAQ,OAAO,QAAQ,eAAe,yBAAyB,OAAO,IAAI;IAChF,OAAO,OAAO,UAAU,GAAG,6BAA6B;GAC1D,CAAC,CAAC,CAAC,KAAK,OAAO,eAAeA,SAAmB,KAAK,CAAC,CACzD;EACF;EACA;GACE,MAAM;GACN,KAAK,IACH,OAAO,IAAI,aAAa;IACtB,MAAM,EAAE,SAAS,YAAY,eAAe,OAAO,QAAQ,OAAO,YAAY;IAC9E,MAAM,QAAQ,GAAG,WAAW,KAAK;IACjC,OAAO,OAAO,WAAW,UAAU,OAAO,2CAA2C;IACrF,MAAM,OAAO,OAAO,QAAQ,YAAY,IAAI,WAAW,EAAE;IACzD,OAAO,OAAO,KAAK,UAAU,OAAO,kCAAkC;IACtE,MAAM,WAAW,OAAO,QAAQ,YAAY,SAAS,WAAW,MAAM;IACtE,OAAO,OACL,OAAO,OAAO,QAAQ,KAAK,SAAS,MAAM,UAAU,OACpD,uCACF;IACA,MAAM,SAAS,OAAO,QAAQ,YAAY,KAAK,WAAW,EAAE;IAC5D,OAAO,OACL,OAAO,OAAO,QAAQ,IAAI,UAAU,KAAK,GACzC,mCACF;GACF,CAAC,CAAC,CAAC,KAAK,OAAO,eAAeA,SAAmB,KAAK,CAAC,CACzD;EACF;EACA;GACE,MAAM;GACN,KAAK,IACH,OAAO,IAAI,aAAa;IACtB,MAAM,EAAE,SAAS,YAAY,eAAe,OAAO,QAAQ,OAAO,aAAa;IAC/E,OAAO,aACL,QAAQ,YAAY,OAAO,WAAW,EAAE,GACxC,gBACA,yBACF;IACA,OAAO,aACL,QAAQ,YAAY,OAAO;KACzB,cAAc,WAAW;KACzB,QAAQ,WAAW;KACnB,MAAM,WAAW;KACjB,OAAO,WAAW;KAClB,QAAQ,CAAC;IACX,CAAC,GACD,gBACA,6BACF;IACA,OAAO,QAAQ,YAAY,OAAO,WAAW,EAAE;IAC/C,OAAO,QAAQ,YAAY,OAAO,WAAW,EAAE;IAC/C,OAAO,aACL,QAAQ,YAAY,IAAI,WAAW,EAAE,GACrC,YACA,yBACF;GACF,CAAC,CAAC,CAAC,KAAK,OAAO,eAAeA,SAAmB,KAAK,CAAC,CACzD;EACF;EACA;GACE,MAAM;GACN,KAAK,IACH,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAOD;IACvB,MAAM,OAAO,OAAO,SAAS,KAAW;IACxC,MAAM,SAAS,OAAO,OAAO,UAC3B,QAAQ,SAAS,kBAAkB,SAAS,MAAM,IAAI,CAAC,CACzD;IACA,OAAO,OAAO;IACd,OAAO,aACL,QAAQ,SAAS,kBAAkB,OAAO,IAAI,GAC9C,QACA,eACF;IACA,MAAM,aAAa,OAAO,QACvB,SAAS,kBAAkB,OAAO,QAAQ,IAAI,CAAC,CAAC,CAChD,KAAK,OAAO,eAAeC,SAAmB,KAAK,CAAC;IACvD,OAAO,OAAO,eAAe,MAAM,+BAA+B;IAClE,OAAO,SAAS,QAAQ,MAAM,KAAA,CAAS;IACvC,OAAO,MAAM,KAAK,MAAM;IACxB,MAAM,QAAQ,OAAO,QAAQ,SAAS,kBAAkB,OAAO,QAAQ,MAAM,CAAC;IAC9E,OAAO,OAAO,UAAU,QAAQ,uBAAuB;IACvD,OAAO,QACJ,SAAS,kBAAkB,OAAO,KAAK,IAAI,QAAQ,QAAQ,CAAC,CAAC,CAAC,CAC9D,KAAK,OAAO,MAAM;IACrB,MAAM,eAAe,OAAO,QAAQ,SAAS,kBAAkB,OAAO,QAAQ,MAAM,CAAC;IACrF,OAAO,OAAO,iBAAiB,QAAQ,uCAAuC;GAChF,CAAC,CAAC,CAAC,KAAK,OAAO,eAAeA,SAAmB,KAAK,CAAC,CACzD;EACF;EACA;GACE,MAAM;GACN,KAAK,IACH,OAAO,IAAI,aAAa;IACtB,MAAM,EAAE,SAAS,eAAe,OAAO,QAAQ,OAAO,YAAY;IAClE,MAAM,MAAM,OAAO,SAAS;IAC5B,MAAM,YAAY,IAAIS,UAAkB;KACtC,QAAQ,WAAW;KACnB,cAAc,WAAW;KACzB,SAAS,MAAM;KACf,SAAS;KACT,cAAc,CACZ;MACE,aAAa;MACb,QAAQN,IAAc;OAAE,MAAM;OAAmB,OAAO;MAAI,CAAC;MAC7D,QAAQ;MACR,UAAU,CAAC;KACb,CACF;KACA,MAAM,CAAC;KACP,cAAc;KACd,WAAW;KACX,aAAa,SAAS,IAAI,KAAK,EAAE,SAAS,GAAG,CAAC;IAChD,CAAC;IACD,OAAO,QAAQ,UAAU,IAAI,SAAS;IACtC,MAAM,SAAS,OAAO,QAAQ,UAAU,IAAI,WAAW,MAAM;IAC7D,OAAO,OACL,OAAO,OAAO,MAAM,KAAK,OAAO,MAAM,YAAY,WAClD,0BACF;IACA,MAAM,UAAU,OAAO,QAAQ,UAC5B,IAAI,WAAW,MAAM,CAAC,CACtB,KAAK,OAAO,eAAeH,SAAmB,KAAK,CAAC;IACvD,OAAO,OAAO,OAAO,OAAO,OAAO,GAAG,gCAAgC;IACtE,OAAO,QAAQ,UAAU,IACvB,IAAIS,UAAkB;KACpB,GAAG;KACH,QAAQ;KACR,cAAc;IAChB,CAAC,CACH;IACA,MAAM,cAAc,OAAO,QAAQ,UAAU,IAAI,0BAA0B;IAC3E,OAAO,OACL,OAAO,OAAO,WAAW,KAAK,YAAY,MAAM,iBAAiB,MACjE,gDACF;IACA,OAAO,aACL,QAAQ,UAAU,IAChB,IAAIA,UAAkB;KAAE,GAAG;KAAW,cAAc;IAAc,CAAC,CACrE,GACA,YACA,sCACF;GACF,CAAC,CAAC,CAAC,KAAK,OAAO,eAAeT,SAAmB,KAAK,CAAC,CACzD;EACF;CACF;AACF;;AAGA,MAAa,WACX,OACA,UAAmB,CAAC,MACI;CACxB,MAAM,MAAM,MAAM,KAAK;CACvB,IAAI,QAAQ,OAAO,KAAA,GACjB,KAAK,MAAM,QAAQ,KAAK,QAAQ,GAAG,KAAK,YAAY,OAAO,WAAW,KAAK,GAAG,CAAC;CAEjF,OAAO;AACT"}
+{"version":3,"file":"storage.mjs","names":["Principal.make","Errors.isDomainKitError","Storage.Authorization","Storage.Credential","Storage.Service","Principal.Service","Plan.Model","Plan.Create","DnsRecord.txt","Storage.Attempt","Approval.Model","Receipt.Model","Receipt.Applied","Storage.Continuation","Storage.Readiness"],"sources":["../../../src/internal/conformance/storage.ts"],"sourcesContent":["import { DateTime, Deferred, Effect, Fiber, Layer, Option } from \"effect\";\n\nimport * as Approval from \"../../Approval.ts\";\nimport * as DnsRecord from \"../../DnsRecord.ts\";\nimport * as Errors from \"../error.ts\";\nimport * as Reason from \"../../Reason.ts\";\nimport * as Plan from \"../../Plan.ts\";\nimport * as Principal from \"../../Principal.ts\";\nimport * as Receipt from \"../../Receipt.ts\";\nimport * as Storage from \"../../Storage.ts\";\n\nexport interface Case {\n  readonly name: string;\n  readonly run: Effect.Effect<void, unknown>;\n}\n\nexport interface Options {\n  /** Register each case with a test runner, e.g. vitest's `it`. */\n  readonly it?: (name: string, run: () => Promise<void>) => void;\n}\n\nconst owner = Principal.make({ ownerId: \"conformance-owner-a\", actorId: \"actor-a\" });\nconst other = Principal.make({ ownerId: \"conformance-owner-b\", actorId: \"actor-b\" });\n\nclass Failure extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"StorageConformanceFailure\";\n  }\n}\n\nconst expect = (condition: boolean, message: string) =>\n  condition ? Effect.void : Effect.fail(new Failure(message));\n\nconst expectReason = <A, R>(\n  effect: Effect.Effect<A, unknown, R>,\n  tag: Reason.Model[\"_tag\"],\n  label: string,\n): Effect.Effect<void, Failure, R> =>\n  effect.pipe(\n    Effect.flip,\n    Effect.mapError(() => new Failure(`${label}: expected failure ${tag}, effect succeeded`)),\n    Effect.flatMap((cause) =>\n      expect(\n        Errors.isDomainKitError(cause) && cause.reason._tag === tag,\n        `${label}: expected reason ${tag}, received ${Errors.isDomainKitError(cause) ? cause.reason._tag : String(cause)}`,\n      ),\n    ),\n  );\n\nconst authorizationRow = (principal: Principal.Interface, id: string, now: DateTime.Utc) =>\n  new Storage.Authorization({\n    id,\n    ownerId: principal.ownerId,\n    provider: \"fake\",\n    method: \"token\",\n    capabilities: [\"dns:read\"],\n    context: { account: \"acc\" },\n    label: \"Acme\",\n    revocation: \"active\",\n    createdBy: principal.actorId,\n    createdAt: now,\n  });\n\nconst credentialRow = (now: DateTime.Utc, ciphertext = \"sealed-1\") =>\n  new Storage.Credential({ ciphertext, expiresAt: null, rotatedAt: now });\n\nconst connect = (principal: Principal.Interface, id: string) =>\n  Effect.gen(function* () {\n    const storage = yield* Storage.Service;\n    const now = yield* DateTime.now;\n    yield* storage.authorizations.upsert({\n      authorization: authorizationRow(principal, id, now),\n      credential: credentialRow(now),\n    });\n    const connection = yield* storage.connections.create(id);\n    const attachment = yield* storage.attachments.create({\n      connectionId: connection.id,\n      domain: `app.${id}.example.com`,\n      zone: `${id}.example.com`,\n      label: `${id}.example.com (${id})`,\n      target: { zoneId: `zone-${id}` },\n    });\n    return { storage, connection, attachment };\n  }).pipe(Effect.provideService(Principal.Service, principal));\n\nconst planRow = (attachmentId: string, now: DateTime.Utc, suffix: string) =>\n  new Plan.Model({\n    id: Plan.PlanId.make(`plan-${suffix}`),\n    version: \"domainkit.plan.v2\",\n    kind: \"provisioning\",\n    digest: Plan.Digest.make(`digest-${suffix}`),\n    domain: \"app.example.com\",\n    zone: \"example.com\",\n    provider: \"fake\",\n    attachmentId,\n    operations: [\n      new Plan.Create({\n        id: Plan.OperationId.make(`op-${suffix}`),\n        record: DnsRecord.txt({ name: \"app.example.com\", value: suffix }),\n      }),\n    ],\n    createdAt: now,\n    expiresAt: DateTime.add(now, { hours: 1 }),\n  });\n\nconst attemptRow = (principal: Principal.Interface, plan: Plan.Model) =>\n  new Storage.Attempt({\n    id: plan.id,\n    ownerId: principal.ownerId,\n    attachmentId: plan.attachmentId,\n    kind: plan.kind,\n    status: \"planned\",\n    plan,\n    approval: null,\n    receipt: null,\n    rejection: null,\n    sourceReceiptId: null,\n    leaseExpiresAt: null,\n    failure: null,\n    updatedAt: plan.createdAt,\n  });\n\nconst approvalRow = (plan: Plan.Model, suffix: string) =>\n  new Approval.Model({\n    id: Approval.ApprovalId.make(`approval-${suffix}`),\n    version: \"domainkit.approval.v2\",\n    kind: plan.kind,\n    planId: plan.id,\n    digest: plan.digest,\n    operationIds: plan.operations.map(({ id }) => id),\n    approvedBy: \"actor\",\n    approvedAt: plan.createdAt,\n    expiresAt: plan.expiresAt,\n  });\n\nconst receiptRow = (plan: Plan.Model, approval: Approval.Model, suffix: string) =>\n  new Receipt.Model({\n    id: Receipt.ReceiptId.make(`receipt-${suffix}`),\n    version: \"domainkit.receipt.v2\",\n    kind: plan.kind,\n    planId: plan.id,\n    approvalId: approval.id,\n    digest: plan.digest,\n    provider: plan.provider,\n    zone: plan.zone,\n    status: \"complete\",\n    outcomes: plan.operations.map(\n      (operation) => new Receipt.Applied({ operationId: operation.id, providerRecordId: \"r1\" }),\n    ),\n    appliedAt: plan.createdAt,\n  });\n\n/** Every invariant a `Storage` implementation must hold. Each case runs against a fresh layer. */\nexport const cases = (layer: Layer.Layer<Storage.Service, unknown>): ReadonlyArray<Case> => {\n  const run = <E>(effect: Effect.Effect<void, E, Storage.Service>): Effect.Effect<void, unknown> =>\n    effect.pipe(Effect.provide(layer));\n  return [\n    {\n      name: \"scopes every row by the principal's owner\",\n      run: run(\n        Effect.gen(function* () {\n          const { storage, connection, attachment } = yield* connect(owner, \"auth-a\");\n          const asOther = <A, E>(effect: Effect.Effect<A, E, Principal.Service>) =>\n            effect.pipe(Effect.provideService(Principal.Service, other));\n          yield* expectReason(\n            asOther(storage.authorizations.get(\"auth-a\")),\n            \"NotFound\",\n            \"authorizations.get\",\n          );\n          yield* expectReason(\n            asOther(storage.authorizations.credential(\"auth-a\")),\n            \"NotFound\",\n            \"authorizations.credential\",\n          );\n          yield* expectReason(\n            asOther(storage.connections.get(connection.id)),\n            \"NotFound\",\n            \"connections.get\",\n          );\n          yield* expectReason(\n            asOther(storage.attachments.get(attachment.id)),\n            \"NotFound\",\n            \"attachments.get\",\n          );\n          yield* expectReason(\n            asOther(storage.attachments.list(connection.id)),\n            \"NotFound\",\n            \"attachments.list\",\n          );\n          const connections = yield* asOther(storage.connections.list());\n          yield* expect(connections.length === 0, \"connections.list leaked across owners\");\n          const byDomain = yield* asOther(storage.attachments.byDomain(attachment.domain));\n          yield* expect(Option.isNone(byDomain), \"attachments.byDomain leaked across owners\");\n          const now = yield* DateTime.now;\n          yield* expectReason(\n            asOther(\n              storage.authorizations.upsert({\n                authorization: authorizationRow(owner, \"auth-b\", now),\n                credential: credentialRow(now),\n              }),\n            ),\n            \"InvalidInput\",\n            \"authorizations.upsert with a foreign ownerId\",\n          );\n        }),\n      ),\n    },\n    {\n      name: \"stores, rotates, and promotes credentials without exposing plaintext\",\n      run: run(\n        Effect.gen(function* () {\n          const { storage } = yield* connect(owner, \"auth-cred\");\n          const first = yield* storage.authorizations.credential(\"auth-cred\");\n          yield* expect(first.ciphertext === \"sealed-1\", \"credential ciphertext was not stored\");\n          const now = yield* DateTime.now;\n          yield* storage.authorizations.rotate(\"auth-cred\", credentialRow(now, \"sealed-2\"));\n          const rotated = yield* storage.authorizations.credential(\"auth-cred\");\n          yield* expect(rotated.ciphertext === \"sealed-2\", \"rotate did not replace the credential\");\n          yield* storage.authorizations.promoteCapabilities(\"auth-cred\", [\"dns:write\", \"dns:read\"]);\n          const promoted = yield* storage.authorizations.get(\"auth-cred\");\n          yield* expect(\n            [...promoted.capabilities].sort().join(\",\") === \"dns:read,dns:write\",\n            \"promoteCapabilities did not merge capabilities\",\n          );\n          // The account label names the connection without a provider call, so it has to survive\n          // the round trip as written.\n          yield* expect(promoted.label === \"Acme\", \"authorization label was not stored\");\n        }).pipe(Effect.provideService(Principal.Service, owner)),\n      ),\n    },\n    {\n      name: \"replaces an authorization only through the expected id\",\n      run: run(\n        Effect.gen(function* () {\n          const { storage } = yield* connect(owner, \"auth-cas\");\n          const now = yield* DateTime.now;\n          const replaced = yield* storage.authorizations.upsert({\n            authorization: new Storage.Authorization({\n              ...authorizationRow(owner, \"auth-cas\", now),\n              method: \"oauth\",\n            }),\n            credential: credentialRow(now, \"sealed-oauth\"),\n            expectedId: \"auth-cas\",\n          });\n          yield* expect(\n            replaced.method === \"oauth\",\n            \"upsert with expectedId did not replace the row\",\n          );\n          const credential = yield* storage.authorizations.credential(\"auth-cas\");\n          yield* expect(\n            credential.ciphertext === \"sealed-oauth\",\n            \"upsert with expectedId did not replace the credential\",\n          );\n          yield* expectReason(\n            storage.authorizations.upsert({\n              authorization: authorizationRow(owner, \"auth-missing\", now),\n              credential: credentialRow(now),\n              expectedId: \"auth-missing\",\n            }),\n            \"NotFound\",\n            \"upsert with an unknown expectedId\",\n          );\n          yield* expectReason(\n            storage.authorizations.upsert({\n              authorization: authorizationRow(owner, \"auth-cas\", now),\n              credential: credentialRow(now),\n            }),\n            \"InvalidInput\",\n            \"insert of an existing id\",\n          );\n        }).pipe(Effect.provideService(Principal.Service, owner)),\n      ),\n    },\n    {\n      name: \"consumes continuations exactly once and rejects expired ones\",\n      run: run(\n        Effect.gen(function* () {\n          const storage = yield* Storage.Service;\n          const now = yield* DateTime.now;\n          const continuation = new Storage.Continuation({\n            id: \"cont-1\",\n            ownerId: owner.ownerId,\n            actorId: owner.actorId,\n            provider: \"fake\",\n            payload: { codeVerifier: \"v\" },\n            returnTo: null,\n            expiresAt: DateTime.add(now, { minutes: 15 }),\n          });\n          yield* storage.continuations.put(continuation);\n          yield* expectReason(\n            storage.continuations\n              .consume(\"cont-1\")\n              .pipe(Effect.provideService(Principal.Service, other)),\n            \"NotFound\",\n            \"consume by another owner\",\n          );\n          const peeked = yield* storage.continuations.get(\"cont-1\");\n          yield* expect(peeked.id === \"cont-1\", \"get did not return the continuation\");\n          const consumed = yield* storage.continuations.consume(\"cont-1\");\n          yield* expect(consumed.id === \"cont-1\", \"consume did not return the continuation\");\n          yield* expectReason(storage.continuations.get(\"cont-1\"), \"NotFound\", \"get after consume\");\n          yield* expectReason(\n            storage.continuations.consume(\"cont-1\"),\n            \"NotFound\",\n            \"second consume\",\n          );\n          yield* storage.continuations.put(\n            new Storage.Continuation({\n              ...continuation,\n              id: \"cont-2\",\n              expiresAt: DateTime.subtract(now, { minutes: 1 }),\n            }),\n          );\n          yield* expectReason(storage.continuations.get(\"cont-2\"), \"Expired\", \"expired get\");\n          yield* expectReason(\n            storage.continuations.consume(\"cont-2\"),\n            \"Expired\",\n            \"expired consume\",\n          );\n          yield* expectReason(\n            storage.continuations.consume(\"cont-2\"),\n            \"NotFound\",\n            \"expired consume is also spent\",\n          );\n        }).pipe(Effect.provideService(Principal.Service, owner)),\n      ),\n    },\n    {\n      name: \"reads a continuation header under any principal and still refuses an expired one\",\n      run: run(\n        Effect.gen(function* () {\n          const storage = yield* Storage.Service;\n          const now = yield* DateTime.now;\n          const continuation = new Storage.Continuation({\n            id: \"cont-header-1\",\n            ownerId: owner.ownerId,\n            actorId: owner.actorId,\n            provider: \"fake\",\n            payload: { codeVerifier: \"v\" },\n            returnTo: null,\n            expiresAt: DateTime.add(now, { minutes: 15 }),\n          });\n          yield* storage.continuations.put(continuation);\n          // The deliberate exception to the tenant isolation every other case here enforces, and\n          // not a bug. A provider callback is a top-level navigation carrying a continuation id\n          // and a session cookie, so the route has to learn whose flow it is before it can name a\n          // principal to scope by. The read therefore takes no principal at all — that is a type\n          // constraint, and providing a foreign one below changes nothing — and it answers with\n          // header fields only. `payload` holds the PKCE verifier and stays behind the\n          // owner-scoped `get`. Binding the caller to the flow is the reader's job, and\n          // `domainkit/server` does it on the callback route.\n          const foreign = yield* storage.continuations\n            .header(\"cont-header-1\")\n            .pipe(Effect.provideService(Principal.Service, other));\n          yield* expect(\n            foreign.ownerId === owner.ownerId && foreign.actorId === owner.actorId,\n            \"header did not report the recorded owner and actor\",\n          );\n          yield* expect(foreign.provider === \"fake\", \"header did not report the provider\");\n          yield* expect(!(\"payload\" in foreign), \"header exposed the continuation payload\");\n          // A read, never a claim: the flow is still there to be spent.\n          const still = yield* storage.continuations.get(\"cont-header-1\");\n          yield* expect(still.id === \"cont-header-1\", \"the header read spent the continuation\");\n          yield* expectReason(\n            storage.continuations.header(\"cont-header-missing\"),\n            \"NotFound\",\n            \"header of an unknown continuation\",\n          );\n          yield* storage.continuations.put(\n            new Storage.Continuation({\n              ...continuation,\n              id: \"cont-header-2\",\n              expiresAt: DateTime.subtract(now, { minutes: 1 }),\n            }),\n          );\n          yield* expectReason(\n            storage.continuations.header(\"cont-header-2\"),\n            \"Expired\",\n            \"header of an expired continuation\",\n          );\n        }).pipe(Effect.provideService(Principal.Service, owner)),\n      ),\n    },\n    {\n      name: \"moves attempts through planned, approved, applying, and complete with leases\",\n      run: run(\n        Effect.gen(function* () {\n          const { storage, attachment } = yield* connect(owner, \"auth-attempt\");\n          const now = yield* DateTime.now;\n          const plan = planRow(attachment.id, now, \"1\");\n          yield* storage.attempts.create(attemptRow(owner, plan));\n          yield* expectReason(\n            storage.attempts.create(attemptRow(owner, plan)),\n            \"InvalidInput\",\n            \"duplicate attempt\",\n          );\n          yield* expectReason(\n            storage.attempts.claim(plan.id, DateTime.add(now, { minutes: 2 })),\n            \"Stale\",\n            \"claim before approval\",\n          );\n          const approval = approvalRow(plan, \"1\");\n          const approved = yield* storage.attempts.approve(plan.id, approval);\n          yield* expect(approved.status === \"approved\", \"approve did not move the status\");\n          const again = yield* storage.attempts.approve(plan.id, approval);\n          yield* expect(\n            again.approval?.id === approval.id,\n            \"re-approving with the same approval must be idempotent\",\n          );\n          yield* expectReason(\n            storage.attempts.approve(plan.id, approvalRow(plan, \"other\")),\n            \"Stale\",\n            \"second approval\",\n          );\n          const byApproval = yield* storage.attempts.byApproval(approval.id);\n          yield* expect(byApproval.id === plan.id, \"byApproval did not find the attempt\");\n          const claimed = yield* storage.attempts.claim(plan.id, DateTime.add(now, { minutes: 2 }));\n          yield* expect(\n            claimed.status === \"applying\" && claimed.leaseExpiresAt !== null,\n            \"claim did not lease\",\n          );\n          yield* expectReason(\n            storage.attempts.claim(plan.id, DateTime.add(now, { minutes: 2 })),\n            \"Busy\",\n            \"claim while leased\",\n          );\n          yield* storage.attempts.fail(plan.id, \"provider down\");\n          const failed = yield* storage.attempts.get(plan.id);\n          yield* expect(\n            failed.status === \"failed\" && failed.failure === \"provider down\",\n            \"fail did not record the message\",\n          );\n          const reclaimed = yield* storage.attempts.claim(\n            plan.id,\n            DateTime.subtract(now, { minutes: 1 }),\n          );\n          yield* expect(reclaimed.failure === null, \"claim did not clear the failure\");\n          const expiredLease = yield* storage.attempts.claim(\n            plan.id,\n            DateTime.add(now, { minutes: 2 }),\n          );\n          yield* expect(expiredLease.status === \"applying\", \"an expired lease must be reclaimable\");\n          const receipt = receiptRow(plan, approval, \"1\");\n          const completed = yield* storage.attempts.complete(plan.id, receipt);\n          yield* expect(\n            completed.status === \"complete\" && completed.leaseExpiresAt === null,\n            \"complete did not clear the lease\",\n          );\n          yield* expectReason(\n            storage.attempts.claim(plan.id, DateTime.add(now, { minutes: 2 })),\n            \"Stale\",\n            \"claim after completion\",\n          );\n          const byReceipt = yield* storage.attempts.byReceipt(receipt.id);\n          yield* expect(byReceipt.receipt?.id === receipt.id, \"byReceipt did not find the attempt\");\n          const later = planRow(attachment.id, DateTime.add(now, { seconds: 1 }), \"2\");\n          yield* storage.attempts.create(attemptRow(owner, later));\n          const latest = yield* storage.attempts.latest(attachment.id, \"provisioning\");\n          yield* expect(\n            Option.isSome(latest) && latest.value.id === later.id,\n            \"latest did not return the newest attempt\",\n          );\n          const cleanup = yield* storage.attempts.latest(attachment.id, \"cleanup\");\n          yield* expect(Option.isNone(cleanup), \"latest must filter by kind\");\n          yield* expectReason(\n            storage.attempts.get(plan.id).pipe(Effect.provideService(Principal.Service, other)),\n            \"NotFound\",\n            \"attempts.get across owners\",\n          );\n        }).pipe(Effect.provideService(Principal.Service, owner)),\n      ),\n    },\n    {\n      name: \"rejects a planned attempt once and terminally\",\n      run: run(\n        Effect.gen(function* () {\n          const { storage, attachment } = yield* connect(owner, \"auth-reject\");\n          const now = yield* DateTime.now;\n          const plan = planRow(attachment.id, now, \"r1\");\n          yield* storage.attempts.create(attemptRow(owner, plan));\n          yield* expectReason(\n            storage.attempts.reject(plan.id, {\n              digest: Plan.Digest.make(\"other\"),\n              actorId: \"a\",\n              reason: null,\n            }),\n            \"Stale\",\n            \"reject with a digest mismatch\",\n          );\n          yield* expectReason(\n            storage.attempts\n              .reject(plan.id, { digest: plan.digest, actorId: other.actorId, reason: null })\n              .pipe(Effect.provideService(Principal.Service, other)),\n            \"NotFound\",\n            \"reject by another owner\",\n          );\n          const rejected = yield* storage.attempts.reject(plan.id, {\n            digest: plan.digest,\n            actorId: owner.actorId,\n            reason: \"wrong zone\",\n          });\n          yield* expect(\n            rejected.status === \"rejected\" &&\n              rejected.rejection?.actorId === owner.actorId &&\n              rejected.rejection.reason === \"wrong zone\" &&\n              DateTime.toEpochMillis(rejected.rejection.at) >= DateTime.toEpochMillis(now),\n            \"reject did not record the actor, reason, and time\",\n          );\n          const again = yield* storage.attempts.reject(plan.id, {\n            digest: plan.digest,\n            actorId: \"someone-else\",\n            reason: \"later\",\n          });\n          yield* expect(\n            again.rejection?.reason === \"wrong zone\",\n            \"rejecting a rejected attempt must return it unchanged\",\n          );\n          yield* expectReason(\n            storage.attempts.approve(plan.id, approvalRow(plan, \"r1\")),\n            \"Stale\",\n            \"approve after reject\",\n          );\n          yield* expectReason(\n            storage.attempts.claim(plan.id, DateTime.add(now, { minutes: 2 })),\n            \"Stale\",\n            \"claim after reject\",\n          );\n          const approvedPlan = planRow(attachment.id, now, \"r2\");\n          yield* storage.attempts.create(attemptRow(owner, approvedPlan));\n          yield* storage.attempts.approve(approvedPlan.id, approvalRow(approvedPlan, \"r2\"));\n          yield* expectReason(\n            storage.attempts.reject(approvedPlan.id, {\n              digest: approvedPlan.digest,\n              actorId: \"a\",\n              reason: null,\n            }),\n            \"Stale\",\n            \"reject after approve\",\n          );\n          const expiredPlan = planRow(attachment.id, now, \"r3\");\n          yield* storage.attempts.create(\n            new Storage.Attempt({ ...attemptRow(owner, expiredPlan), status: \"expired\" }),\n          );\n          yield* expectReason(\n            storage.attempts.reject(expiredPlan.id, {\n              digest: expiredPlan.digest,\n              actorId: \"a\",\n              reason: null,\n            }),\n            \"Expired\",\n            \"reject an expired plan\",\n          );\n        }).pipe(Effect.provideService(Principal.Service, owner)),\n      ),\n    },\n    {\n      name: \"keeps a failed revocation pending and finishes it on recovery\",\n      run: run(\n        Effect.gen(function* () {\n          const { storage, connection, attachment } = yield* connect(owner, \"auth-revoke\");\n          yield* storage.attachments.remove(attachment.id);\n          yield* storage.connections.remove(connection.id);\n          const revokeFailure = yield* storage.authorizations\n            .revoke(\"auth-revoke\", Effect.fail(new Failure(\"provider unavailable\")))\n            .pipe(Effect.flip);\n          yield* expect(\n            revokeFailure instanceof Failure,\n            \"revoke must surface the provider failure\",\n          );\n          const pending = yield* storage.authorizations.get(\"auth-revoke\");\n          yield* expect(\n            pending.revocation === \"pending\",\n            \"a failed revoke must leave the row pending\",\n          );\n          const now = yield* DateTime.now;\n          yield* expectReason(\n            storage.authorizations.upsert({\n              authorization: authorizationRow(owner, \"auth-revoke\", now),\n              credential: credentialRow(now),\n              expectedId: \"auth-revoke\",\n            }),\n            \"Busy\",\n            \"reconnect while revocation is pending\",\n          );\n          const recoveredByOther = yield* storage.authorizations\n            .recoverRevocations(() => Effect.void)\n            .pipe(Effect.provideService(Principal.Service, other));\n          yield* expect(recoveredByOther === 0, \"recovery must not cross owners\");\n          let calls = 0;\n          const recovered = yield* storage.authorizations.recoverRevocations(() =>\n            Effect.sync(() => void (calls += 1)),\n          );\n          yield* expect(\n            recovered === 1 && calls === 1,\n            \"recovery must revoke exactly the pending authorization\",\n          );\n          yield* expectReason(\n            storage.authorizations.get(\"auth-revoke\"),\n            \"NotFound\",\n            \"authorization after recovery\",\n          );\n          const again = yield* storage.authorizations.recoverRevocations(() => Effect.void);\n          yield* expect(again === 0, \"recovery must be idempotent\");\n        }).pipe(Effect.provideService(Principal.Service, owner)),\n      ),\n    },\n    {\n      name: \"returns an attachment's label from every read\",\n      run: run(\n        Effect.gen(function* () {\n          const { storage, connection, attachment } = yield* connect(owner, \"auth-label\");\n          const label = `${attachment.zone} (auth-label)`;\n          yield* expect(attachment.label === label, \"create must return the label it was given\");\n          const read = yield* storage.attachments.get(attachment.id);\n          yield* expect(read.label === label, \"get must return the stored label\");\n          const byDomain = yield* storage.attachments.byDomain(attachment.domain);\n          yield* expect(\n            Option.isSome(byDomain) && byDomain.value.label === label,\n            \"byDomain must return the stored label\",\n          );\n          const listed = yield* storage.attachments.list(connection.id);\n          yield* expect(\n            listed.every((row) => row.label === label),\n            \"list must return the stored label\",\n          );\n        }).pipe(Effect.provideService(Principal.Service, owner)),\n      ),\n    },\n    {\n      name: \"blocks connection removal while attachments exist\",\n      run: run(\n        Effect.gen(function* () {\n          const { storage, connection, attachment } = yield* connect(owner, \"auth-remove\");\n          yield* expectReason(\n            storage.connections.remove(connection.id),\n            \"InvalidInput\",\n            \"remove with attachments\",\n          );\n          yield* expectReason(\n            storage.attachments.create({\n              connectionId: connection.id,\n              domain: attachment.domain,\n              zone: attachment.zone,\n              label: attachment.label,\n              target: {},\n            }),\n            \"InvalidInput\",\n            \"duplicate domain attachment\",\n          );\n          yield* storage.attachments.remove(attachment.id);\n          yield* storage.connections.remove(connection.id);\n          yield* expectReason(\n            storage.connections.get(connection.id),\n            \"NotFound\",\n            \"connection after remove\",\n          );\n        }).pipe(Effect.provideService(Principal.Service, owner)),\n      ),\n    },\n    {\n      name: \"fails Busy while a lock is held and releases it afterwards\",\n      run: run(\n        Effect.gen(function* () {\n          const storage = yield* Storage.Service;\n          const gate = yield* Deferred.make<void>();\n          const holder = yield* Effect.forkChild(\n            storage.withLock(\"refresh:auth-1\", Deferred.await(gate)),\n          );\n          yield* Effect.yieldNow;\n          yield* expectReason(\n            storage.withLock(\"refresh:auth-1\", Effect.void),\n            \"Busy\",\n            \"second holder\",\n          );\n          const otherOwner = yield* storage\n            .withLock(\"refresh:auth-1\", Effect.succeed(\"ok\"))\n            .pipe(Effect.provideService(Principal.Service, other));\n          yield* expect(otherOwner === \"ok\", \"locks must be scoped by owner\");\n          yield* Deferred.succeed(gate, undefined);\n          yield* Fiber.join(holder);\n          const after = yield* storage.withLock(\"refresh:auth-1\", Effect.succeed(\"free\"));\n          yield* expect(after === \"free\", \"lock was not released\");\n          yield* storage\n            .withLock(\"refresh:auth-1\", Effect.fail(new Failure(\"inside\")))\n            .pipe(Effect.ignore);\n          const afterFailure = yield* storage.withLock(\"refresh:auth-1\", Effect.succeed(\"free\"));\n          yield* expect(afterFailure === \"free\", \"lock was not released after a failure\");\n        }).pipe(Effect.provideService(Principal.Service, owner)),\n      ),\n    },\n    {\n      name: \"stores readiness per domain, with or without an attachment\",\n      run: run(\n        Effect.gen(function* () {\n          const { storage, attachment } = yield* connect(owner, \"auth-ready\");\n          const now = yield* DateTime.now;\n          const readiness = new Storage.Readiness({\n            domain: attachment.domain,\n            attachmentId: attachment.id,\n            ownerId: owner.ownerId,\n            overall: \"pending\",\n            requirements: [\n              {\n                operationId: null,\n                record: DnsRecord.txt({ name: \"app.example.com\", value: \"v\" }),\n                status: \"missing\",\n                evidence: [],\n              },\n            ],\n            host: [],\n            pendingSince: now,\n            checkedAt: now,\n            nextCheckAt: DateTime.add(now, { seconds: 15 }),\n          });\n          yield* storage.readiness.put(readiness);\n          const stored = yield* storage.readiness.get(attachment.domain);\n          yield* expect(\n            Option.isSome(stored) && stored.value.overall === \"pending\",\n            \"readiness was not stored\",\n          );\n          const foreign = yield* storage.readiness\n            .get(attachment.domain)\n            .pipe(Effect.provideService(Principal.Service, other));\n          yield* expect(Option.isNone(foreign), \"readiness leaked across owners\");\n          yield* storage.readiness.put(\n            new Storage.Readiness({\n              ...readiness,\n              domain: \"observe-only.example.com\",\n              attachmentId: null,\n            }),\n          );\n          const observeOnly = yield* storage.readiness.get(\"observe-only.example.com\");\n          yield* expect(\n            Option.isSome(observeOnly) && observeOnly.value.attachmentId === null,\n            \"readiness without an attachment was not stored\",\n          );\n          yield* expectReason(\n            storage.readiness.put(\n              new Storage.Readiness({ ...readiness, attachmentId: \"att-missing\" }),\n            ),\n            \"NotFound\",\n            \"readiness with an unknown attachment\",\n          );\n        }).pipe(Effect.provideService(Principal.Service, owner)),\n      ),\n    },\n  ];\n};\n\n/** Registers every case with `options.it` when given; always returns the cases. */\nexport const storage = (\n  layer: Layer.Layer<Storage.Service, unknown>,\n  options: Options = {},\n): ReadonlyArray<Case> => {\n  const all = cases(layer);\n  if (options.it !== undefined) {\n    for (const item of all) options.it(item.name, () => Effect.runPromise(item.run));\n  }\n  return all;\n};\n"],"mappings":";;;;;;;;;AAqBA,MAAM,QAAQA,KAAe;CAAE,SAAS;CAAuB,SAAS;AAAU,CAAC;AACnF,MAAM,QAAQA,KAAe;CAAE,SAAS;CAAuB,SAAS;AAAU,CAAC;AAEnF,IAAM,UAAN,cAAsB,MAAM;CAC1B,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF;AAEA,MAAM,UAAU,WAAoB,YAClC,YAAY,OAAO,OAAO,OAAO,KAAK,IAAI,QAAQ,OAAO,CAAC;AAE5D,MAAM,gBACJ,QACA,KACA,UAEA,OAAO,KACL,OAAO,MACP,OAAO,eAAe,IAAI,QAAQ,GAAG,MAAM,qBAAqB,IAAI,mBAAmB,CAAC,GACxF,OAAO,SAAS,UACd,OACEC,iBAAwB,KAAK,KAAK,MAAM,OAAO,SAAS,KACxD,GAAG,MAAM,oBAAoB,IAAI,aAAaA,iBAAwB,KAAK,IAAI,MAAM,OAAO,OAAO,OAAO,KAAK,GACjH,CACF,CACF;AAEF,MAAM,oBAAoB,WAAgC,IAAY,QACpE,IAAIC,cAAsB;CACxB;CACA,SAAS,UAAU;CACnB,UAAU;CACV,QAAQ;CACR,cAAc,CAAC,UAAU;CACzB,SAAS,EAAE,SAAS,MAAM;CAC1B,OAAO;CACP,YAAY;CACZ,WAAW,UAAU;CACrB,WAAW;AACb,CAAC;AAEH,MAAM,iBAAiB,KAAmB,aAAa,eACrD,IAAIC,WAAmB;CAAE;CAAY,WAAW;CAAM,WAAW;AAAI,CAAC;AAExE,MAAM,WAAW,WAAgC,OAC/C,OAAO,IAAI,aAAa;CACtB,MAAM,UAAU,OAAOC;CACvB,MAAM,MAAM,OAAO,SAAS;CAC5B,OAAO,QAAQ,eAAe,OAAO;EACnC,eAAe,iBAAiB,WAAW,IAAI,GAAG;EAClD,YAAY,cAAc,GAAG;CAC/B,CAAC;CACD,MAAM,aAAa,OAAO,QAAQ,YAAY,OAAO,EAAE;CAQvD,OAAO;EAAE;EAAS;EAAY,YAAA,OAPJ,QAAQ,YAAY,OAAO;GACnD,cAAc,WAAW;GACzB,QAAQ,OAAO,GAAG;GAClB,MAAM,GAAG,GAAG;GACZ,OAAO,GAAG,GAAG,gBAAgB,GAAG;GAChC,QAAQ,EAAE,QAAQ,QAAQ,KAAK;EACjC,CAAC;CACwC;AAC3C,CAAC,CAAC,CAAC,KAAK,OAAO,eAAeC,SAAmB,SAAS,CAAC;AAE7D,MAAM,WAAW,cAAsB,KAAmB,WACxD,IAAIC,MAAW;CACb,IAAA,OAAgB,KAAK,QAAQ,QAAQ;CACrC,SAAS;CACT,MAAM;CACN,QAAA,OAAoB,KAAK,UAAU,QAAQ;CAC3C,QAAQ;CACR,MAAM;CACN,UAAU;CACV;CACA,YAAY,CACV,IAAIC,OAAY;EACd,IAAA,YAAqB,KAAK,MAAM,QAAQ;EACxC,QAAQC,IAAc;GAAE,MAAM;GAAmB,OAAO;EAAO,CAAC;CAClE,CAAC,CACH;CACA,WAAW;CACX,WAAW,SAAS,IAAI,KAAK,EAAE,OAAO,EAAE,CAAC;AAC3C,CAAC;AAEH,MAAM,cAAc,WAAgC,SAClD,IAAIC,QAAgB;CAClB,IAAI,KAAK;CACT,SAAS,UAAU;CACnB,cAAc,KAAK;CACnB,MAAM,KAAK;CACX,QAAQ;CACR;CACA,UAAU;CACV,SAAS;CACT,WAAW;CACX,iBAAiB;CACjB,gBAAgB;CAChB,SAAS;CACT,WAAW,KAAK;AAClB,CAAC;AAEH,MAAM,eAAe,MAAkB,WACrC,IAAIC,QAAe;CACjB,IAAA,WAAwB,KAAK,YAAY,QAAQ;CACjD,SAAS;CACT,MAAM,KAAK;CACX,QAAQ,KAAK;CACb,QAAQ,KAAK;CACb,cAAc,KAAK,WAAW,KAAK,EAAE,SAAS,EAAE;CAChD,YAAY;CACZ,YAAY,KAAK;CACjB,WAAW,KAAK;AAClB,CAAC;AAEH,MAAM,cAAc,MAAkB,UAA0B,WAC9D,IAAIC,QAAc;CAChB,IAAA,UAAsB,KAAK,WAAW,QAAQ;CAC9C,SAAS;CACT,MAAM,KAAK;CACX,QAAQ,KAAK;CACb,YAAY,SAAS;CACrB,QAAQ,KAAK;CACb,UAAU,KAAK;CACf,MAAM,KAAK;CACX,QAAQ;CACR,UAAU,KAAK,WAAW,KACvB,cAAc,IAAIC,QAAgB;EAAE,aAAa,UAAU;EAAI,kBAAkB;CAAK,CAAC,CAC1F;CACA,WAAW,KAAK;AAClB,CAAC;;AAGH,MAAa,SAAS,UAAsE;CAC1F,MAAM,OAAU,WACd,OAAO,KAAK,OAAO,QAAQ,KAAK,CAAC;CACnC,OAAO;EACL;GACE,MAAM;GACN,KAAK,IACH,OAAO,IAAI,aAAa;IACtB,MAAM,EAAE,SAAS,YAAY,eAAe,OAAO,QAAQ,OAAO,QAAQ;IAC1E,MAAM,WAAiB,WACrB,OAAO,KAAK,OAAO,eAAeP,SAAmB,KAAK,CAAC;IAC7D,OAAO,aACL,QAAQ,QAAQ,eAAe,IAAI,QAAQ,CAAC,GAC5C,YACA,oBACF;IACA,OAAO,aACL,QAAQ,QAAQ,eAAe,WAAW,QAAQ,CAAC,GACnD,YACA,2BACF;IACA,OAAO,aACL,QAAQ,QAAQ,YAAY,IAAI,WAAW,EAAE,CAAC,GAC9C,YACA,iBACF;IACA,OAAO,aACL,QAAQ,QAAQ,YAAY,IAAI,WAAW,EAAE,CAAC,GAC9C,YACA,iBACF;IACA,OAAO,aACL,QAAQ,QAAQ,YAAY,KAAK,WAAW,EAAE,CAAC,GAC/C,YACA,kBACF;IACA,MAAM,cAAc,OAAO,QAAQ,QAAQ,YAAY,KAAK,CAAC;IAC7D,OAAO,OAAO,YAAY,WAAW,GAAG,uCAAuC;IAC/E,MAAM,WAAW,OAAO,QAAQ,QAAQ,YAAY,SAAS,WAAW,MAAM,CAAC;IAC/E,OAAO,OAAO,OAAO,OAAO,QAAQ,GAAG,2CAA2C;IAClF,MAAM,MAAM,OAAO,SAAS;IAC5B,OAAO,aACL,QACE,QAAQ,eAAe,OAAO;KAC5B,eAAe,iBAAiB,OAAO,UAAU,GAAG;KACpD,YAAY,cAAc,GAAG;IAC/B,CAAC,CACH,GACA,gBACA,8CACF;GACF,CAAC,CACH;EACF;EACA;GACE,MAAM;GACN,KAAK,IACH,OAAO,IAAI,aAAa;IACtB,MAAM,EAAE,YAAY,OAAO,QAAQ,OAAO,WAAW;IACrD,MAAM,QAAQ,OAAO,QAAQ,eAAe,WAAW,WAAW;IAClE,OAAO,OAAO,MAAM,eAAe,YAAY,sCAAsC;IACrF,MAAM,MAAM,OAAO,SAAS;IAC5B,OAAO,QAAQ,eAAe,OAAO,aAAa,cAAc,KAAK,UAAU,CAAC;IAChF,MAAM,UAAU,OAAO,QAAQ,eAAe,WAAW,WAAW;IACpE,OAAO,OAAO,QAAQ,eAAe,YAAY,uCAAuC;IACxF,OAAO,QAAQ,eAAe,oBAAoB,aAAa,CAAC,aAAa,UAAU,CAAC;IACxF,MAAM,WAAW,OAAO,QAAQ,eAAe,IAAI,WAAW;IAC9D,OAAO,OACL,CAAC,GAAG,SAAS,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,MAAM,sBAChD,gDACF;IAGA,OAAO,OAAO,SAAS,UAAU,QAAQ,oCAAoC;GAC/E,CAAC,CAAC,CAAC,KAAK,OAAO,eAAeA,SAAmB,KAAK,CAAC,CACzD;EACF;EACA;GACE,MAAM;GACN,KAAK,IACH,OAAO,IAAI,aAAa;IACtB,MAAM,EAAE,YAAY,OAAO,QAAQ,OAAO,UAAU;IACpD,MAAM,MAAM,OAAO,SAAS;IAC5B,MAAM,WAAW,OAAO,QAAQ,eAAe,OAAO;KACpD,eAAe,IAAIH,cAAsB;MACvC,GAAG,iBAAiB,OAAO,YAAY,GAAG;MAC1C,QAAQ;KACV,CAAC;KACD,YAAY,cAAc,KAAK,cAAc;KAC7C,YAAY;IACd,CAAC;IACD,OAAO,OACL,SAAS,WAAW,SACpB,gDACF;IACA,MAAM,aAAa,OAAO,QAAQ,eAAe,WAAW,UAAU;IACtE,OAAO,OACL,WAAW,eAAe,gBAC1B,uDACF;IACA,OAAO,aACL,QAAQ,eAAe,OAAO;KAC5B,eAAe,iBAAiB,OAAO,gBAAgB,GAAG;KAC1D,YAAY,cAAc,GAAG;KAC7B,YAAY;IACd,CAAC,GACD,YACA,mCACF;IACA,OAAO,aACL,QAAQ,eAAe,OAAO;KAC5B,eAAe,iBAAiB,OAAO,YAAY,GAAG;KACtD,YAAY,cAAc,GAAG;IAC/B,CAAC,GACD,gBACA,0BACF;GACF,CAAC,CAAC,CAAC,KAAK,OAAO,eAAeG,SAAmB,KAAK,CAAC,CACzD;EACF;EACA;GACE,MAAM;GACN,KAAK,IACH,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAOD;IACvB,MAAM,MAAM,OAAO,SAAS;IAC5B,MAAM,eAAe,IAAIS,aAAqB;KAC5C,IAAI;KACJ,SAAS,MAAM;KACf,SAAS,MAAM;KACf,UAAU;KACV,SAAS,EAAE,cAAc,IAAI;KAC7B,UAAU;KACV,WAAW,SAAS,IAAI,KAAK,EAAE,SAAS,GAAG,CAAC;IAC9C,CAAC;IACD,OAAO,QAAQ,cAAc,IAAI,YAAY;IAC7C,OAAO,aACL,QAAQ,cACL,QAAQ,QAAQ,CAAC,CACjB,KAAK,OAAO,eAAeR,SAAmB,KAAK,CAAC,GACvD,YACA,0BACF;IACA,MAAM,SAAS,OAAO,QAAQ,cAAc,IAAI,QAAQ;IACxD,OAAO,OAAO,OAAO,OAAO,UAAU,qCAAqC;IAC3E,MAAM,WAAW,OAAO,QAAQ,cAAc,QAAQ,QAAQ;IAC9D,OAAO,OAAO,SAAS,OAAO,UAAU,yCAAyC;IACjF,OAAO,aAAa,QAAQ,cAAc,IAAI,QAAQ,GAAG,YAAY,mBAAmB;IACxF,OAAO,aACL,QAAQ,cAAc,QAAQ,QAAQ,GACtC,YACA,gBACF;IACA,OAAO,QAAQ,cAAc,IAC3B,IAAIQ,aAAqB;KACvB,GAAG;KACH,IAAI;KACJ,WAAW,SAAS,SAAS,KAAK,EAAE,SAAS,EAAE,CAAC;IAClD,CAAC,CACH;IACA,OAAO,aAAa,QAAQ,cAAc,IAAI,QAAQ,GAAG,WAAW,aAAa;IACjF,OAAO,aACL,QAAQ,cAAc,QAAQ,QAAQ,GACtC,WACA,iBACF;IACA,OAAO,aACL,QAAQ,cAAc,QAAQ,QAAQ,GACtC,YACA,+BACF;GACF,CAAC,CAAC,CAAC,KAAK,OAAO,eAAeR,SAAmB,KAAK,CAAC,CACzD;EACF;EACA;GACE,MAAM;GACN,KAAK,IACH,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAOD;IACvB,MAAM,MAAM,OAAO,SAAS;IAC5B,MAAM,eAAe,IAAIS,aAAqB;KAC5C,IAAI;KACJ,SAAS,MAAM;KACf,SAAS,MAAM;KACf,UAAU;KACV,SAAS,EAAE,cAAc,IAAI;KAC7B,UAAU;KACV,WAAW,SAAS,IAAI,KAAK,EAAE,SAAS,GAAG,CAAC;IAC9C,CAAC;IACD,OAAO,QAAQ,cAAc,IAAI,YAAY;IAS7C,MAAM,UAAU,OAAO,QAAQ,cAC5B,OAAO,eAAe,CAAC,CACvB,KAAK,OAAO,eAAeR,SAAmB,KAAK,CAAC;IACvD,OAAO,OACL,QAAQ,YAAY,MAAM,WAAW,QAAQ,YAAY,MAAM,SAC/D,oDACF;IACA,OAAO,OAAO,QAAQ,aAAa,QAAQ,oCAAoC;IAC/E,OAAO,OAAO,EAAE,aAAa,UAAU,yCAAyC;IAEhF,MAAM,QAAQ,OAAO,QAAQ,cAAc,IAAI,eAAe;IAC9D,OAAO,OAAO,MAAM,OAAO,iBAAiB,wCAAwC;IACpF,OAAO,aACL,QAAQ,cAAc,OAAO,qBAAqB,GAClD,YACA,mCACF;IACA,OAAO,QAAQ,cAAc,IAC3B,IAAIQ,aAAqB;KACvB,GAAG;KACH,IAAI;KACJ,WAAW,SAAS,SAAS,KAAK,EAAE,SAAS,EAAE,CAAC;IAClD,CAAC,CACH;IACA,OAAO,aACL,QAAQ,cAAc,OAAO,eAAe,GAC5C,WACA,mCACF;GACF,CAAC,CAAC,CAAC,KAAK,OAAO,eAAeR,SAAmB,KAAK,CAAC,CACzD;EACF;EACA;GACE,MAAM;GACN,KAAK,IACH,OAAO,IAAI,aAAa;IACtB,MAAM,EAAE,SAAS,eAAe,OAAO,QAAQ,OAAO,cAAc;IACpE,MAAM,MAAM,OAAO,SAAS;IAC5B,MAAM,OAAO,QAAQ,WAAW,IAAI,KAAK,GAAG;IAC5C,OAAO,QAAQ,SAAS,OAAO,WAAW,OAAO,IAAI,CAAC;IACtD,OAAO,aACL,QAAQ,SAAS,OAAO,WAAW,OAAO,IAAI,CAAC,GAC/C,gBACA,mBACF;IACA,OAAO,aACL,QAAQ,SAAS,MAAM,KAAK,IAAI,SAAS,IAAI,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,GACjE,SACA,uBACF;IACA,MAAM,WAAW,YAAY,MAAM,GAAG;IACtC,MAAM,WAAW,OAAO,QAAQ,SAAS,QAAQ,KAAK,IAAI,QAAQ;IAClE,OAAO,OAAO,SAAS,WAAW,YAAY,iCAAiC;IAC/E,MAAM,QAAQ,OAAO,QAAQ,SAAS,QAAQ,KAAK,IAAI,QAAQ;IAC/D,OAAO,OACL,MAAM,UAAU,OAAO,SAAS,IAChC,wDACF;IACA,OAAO,aACL,QAAQ,SAAS,QAAQ,KAAK,IAAI,YAAY,MAAM,OAAO,CAAC,GAC5D,SACA,iBACF;IACA,MAAM,aAAa,OAAO,QAAQ,SAAS,WAAW,SAAS,EAAE;IACjE,OAAO,OAAO,WAAW,OAAO,KAAK,IAAI,qCAAqC;IAC9E,MAAM,UAAU,OAAO,QAAQ,SAAS,MAAM,KAAK,IAAI,SAAS,IAAI,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACxF,OAAO,OACL,QAAQ,WAAW,cAAc,QAAQ,mBAAmB,MAC5D,qBACF;IACA,OAAO,aACL,QAAQ,SAAS,MAAM,KAAK,IAAI,SAAS,IAAI,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,GACjE,QACA,oBACF;IACA,OAAO,QAAQ,SAAS,KAAK,KAAK,IAAI,eAAe;IACrD,MAAM,SAAS,OAAO,QAAQ,SAAS,IAAI,KAAK,EAAE;IAClD,OAAO,OACL,OAAO,WAAW,YAAY,OAAO,YAAY,iBACjD,iCACF;IACA,MAAM,YAAY,OAAO,QAAQ,SAAS,MACxC,KAAK,IACL,SAAS,SAAS,KAAK,EAAE,SAAS,EAAE,CAAC,CACvC;IACA,OAAO,OAAO,UAAU,YAAY,MAAM,iCAAiC;IAC3E,MAAM,eAAe,OAAO,QAAQ,SAAS,MAC3C,KAAK,IACL,SAAS,IAAI,KAAK,EAAE,SAAS,EAAE,CAAC,CAClC;IACA,OAAO,OAAO,aAAa,WAAW,YAAY,sCAAsC;IACxF,MAAM,UAAU,WAAW,MAAM,UAAU,GAAG;IAC9C,MAAM,YAAY,OAAO,QAAQ,SAAS,SAAS,KAAK,IAAI,OAAO;IACnE,OAAO,OACL,UAAU,WAAW,cAAc,UAAU,mBAAmB,MAChE,kCACF;IACA,OAAO,aACL,QAAQ,SAAS,MAAM,KAAK,IAAI,SAAS,IAAI,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,GACjE,SACA,wBACF;IACA,MAAM,YAAY,OAAO,QAAQ,SAAS,UAAU,QAAQ,EAAE;IAC9D,OAAO,OAAO,UAAU,SAAS,OAAO,QAAQ,IAAI,oCAAoC;IACxF,MAAM,QAAQ,QAAQ,WAAW,IAAI,SAAS,IAAI,KAAK,EAAE,SAAS,EAAE,CAAC,GAAG,GAAG;IAC3E,OAAO,QAAQ,SAAS,OAAO,WAAW,OAAO,KAAK,CAAC;IACvD,MAAM,SAAS,OAAO,QAAQ,SAAS,OAAO,WAAW,IAAI,cAAc;IAC3E,OAAO,OACL,OAAO,OAAO,MAAM,KAAK,OAAO,MAAM,OAAO,MAAM,IACnD,0CACF;IACA,MAAM,UAAU,OAAO,QAAQ,SAAS,OAAO,WAAW,IAAI,SAAS;IACvE,OAAO,OAAO,OAAO,OAAO,OAAO,GAAG,4BAA4B;IAClE,OAAO,aACL,QAAQ,SAAS,IAAI,KAAK,EAAE,CAAC,CAAC,KAAK,OAAO,eAAeA,SAAmB,KAAK,CAAC,GAClF,YACA,4BACF;GACF,CAAC,CAAC,CAAC,KAAK,OAAO,eAAeA,SAAmB,KAAK,CAAC,CACzD;EACF;EACA;GACE,MAAM;GACN,KAAK,IACH,OAAO,IAAI,aAAa;IACtB,MAAM,EAAE,SAAS,eAAe,OAAO,QAAQ,OAAO,aAAa;IACnE,MAAM,MAAM,OAAO,SAAS;IAC5B,MAAM,OAAO,QAAQ,WAAW,IAAI,KAAK,IAAI;IAC7C,OAAO,QAAQ,SAAS,OAAO,WAAW,OAAO,IAAI,CAAC;IACtD,OAAO,aACL,QAAQ,SAAS,OAAO,KAAK,IAAI;KAC/B,QAAA,OAAoB,KAAK,OAAO;KAChC,SAAS;KACT,QAAQ;IACV,CAAC,GACD,SACA,+BACF;IACA,OAAO,aACL,QAAQ,SACL,OAAO,KAAK,IAAI;KAAE,QAAQ,KAAK;KAAQ,SAAS,MAAM;KAAS,QAAQ;IAAK,CAAC,CAAC,CAC9E,KAAK,OAAO,eAAeA,SAAmB,KAAK,CAAC,GACvD,YACA,yBACF;IACA,MAAM,WAAW,OAAO,QAAQ,SAAS,OAAO,KAAK,IAAI;KACvD,QAAQ,KAAK;KACb,SAAS,MAAM;KACf,QAAQ;IACV,CAAC;IACD,OAAO,OACL,SAAS,WAAW,cAClB,SAAS,WAAW,YAAY,MAAM,WACtC,SAAS,UAAU,WAAW,gBAC9B,SAAS,cAAc,SAAS,UAAU,EAAE,KAAK,SAAS,cAAc,GAAG,GAC7E,mDACF;IACA,MAAM,QAAQ,OAAO,QAAQ,SAAS,OAAO,KAAK,IAAI;KACpD,QAAQ,KAAK;KACb,SAAS;KACT,QAAQ;IACV,CAAC;IACD,OAAO,OACL,MAAM,WAAW,WAAW,cAC5B,uDACF;IACA,OAAO,aACL,QAAQ,SAAS,QAAQ,KAAK,IAAI,YAAY,MAAM,IAAI,CAAC,GACzD,SACA,sBACF;IACA,OAAO,aACL,QAAQ,SAAS,MAAM,KAAK,IAAI,SAAS,IAAI,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,GACjE,SACA,oBACF;IACA,MAAM,eAAe,QAAQ,WAAW,IAAI,KAAK,IAAI;IACrD,OAAO,QAAQ,SAAS,OAAO,WAAW,OAAO,YAAY,CAAC;IAC9D,OAAO,QAAQ,SAAS,QAAQ,aAAa,IAAI,YAAY,cAAc,IAAI,CAAC;IAChF,OAAO,aACL,QAAQ,SAAS,OAAO,aAAa,IAAI;KACvC,QAAQ,aAAa;KACrB,SAAS;KACT,QAAQ;IACV,CAAC,GACD,SACA,sBACF;IACA,MAAM,cAAc,QAAQ,WAAW,IAAI,KAAK,IAAI;IACpD,OAAO,QAAQ,SAAS,OACtB,IAAII,QAAgB;KAAE,GAAG,WAAW,OAAO,WAAW;KAAG,QAAQ;IAAU,CAAC,CAC9E;IACA,OAAO,aACL,QAAQ,SAAS,OAAO,YAAY,IAAI;KACtC,QAAQ,YAAY;KACpB,SAAS;KACT,QAAQ;IACV,CAAC,GACD,WACA,wBACF;GACF,CAAC,CAAC,CAAC,KAAK,OAAO,eAAeJ,SAAmB,KAAK,CAAC,CACzD;EACF;EACA;GACE,MAAM;GACN,KAAK,IACH,OAAO,IAAI,aAAa;IACtB,MAAM,EAAE,SAAS,YAAY,eAAe,OAAO,QAAQ,OAAO,aAAa;IAC/E,OAAO,QAAQ,YAAY,OAAO,WAAW,EAAE;IAC/C,OAAO,QAAQ,YAAY,OAAO,WAAW,EAAE;IAC/C,MAAM,gBAAgB,OAAO,QAAQ,eAClC,OAAO,eAAe,OAAO,KAAK,IAAI,QAAQ,sBAAsB,CAAC,CAAC,CAAC,CACvE,KAAK,OAAO,IAAI;IACnB,OAAO,OACL,yBAAyB,SACzB,0CACF;IACA,MAAM,UAAU,OAAO,QAAQ,eAAe,IAAI,aAAa;IAC/D,OAAO,OACL,QAAQ,eAAe,WACvB,4CACF;IACA,MAAM,MAAM,OAAO,SAAS;IAC5B,OAAO,aACL,QAAQ,eAAe,OAAO;KAC5B,eAAe,iBAAiB,OAAO,eAAe,GAAG;KACzD,YAAY,cAAc,GAAG;KAC7B,YAAY;IACd,CAAC,GACD,QACA,uCACF;IACA,MAAM,mBAAmB,OAAO,QAAQ,eACrC,yBAAyB,OAAO,IAAI,CAAC,CACrC,KAAK,OAAO,eAAeA,SAAmB,KAAK,CAAC;IACvD,OAAO,OAAO,qBAAqB,GAAG,gCAAgC;IACtE,IAAI,QAAQ;IACZ,MAAM,YAAY,OAAO,QAAQ,eAAe,yBAC9C,OAAO,WAAW,MAAM,SAAS,EAAE,CACrC;IACA,OAAO,OACL,cAAc,KAAK,UAAU,GAC7B,wDACF;IACA,OAAO,aACL,QAAQ,eAAe,IAAI,aAAa,GACxC,YACA,8BACF;IACA,MAAM,QAAQ,OAAO,QAAQ,eAAe,yBAAyB,OAAO,IAAI;IAChF,OAAO,OAAO,UAAU,GAAG,6BAA6B;GAC1D,CAAC,CAAC,CAAC,KAAK,OAAO,eAAeA,SAAmB,KAAK,CAAC,CACzD;EACF;EACA;GACE,MAAM;GACN,KAAK,IACH,OAAO,IAAI,aAAa;IACtB,MAAM,EAAE,SAAS,YAAY,eAAe,OAAO,QAAQ,OAAO,YAAY;IAC9E,MAAM,QAAQ,GAAG,WAAW,KAAK;IACjC,OAAO,OAAO,WAAW,UAAU,OAAO,2CAA2C;IACrF,MAAM,OAAO,OAAO,QAAQ,YAAY,IAAI,WAAW,EAAE;IACzD,OAAO,OAAO,KAAK,UAAU,OAAO,kCAAkC;IACtE,MAAM,WAAW,OAAO,QAAQ,YAAY,SAAS,WAAW,MAAM;IACtE,OAAO,OACL,OAAO,OAAO,QAAQ,KAAK,SAAS,MAAM,UAAU,OACpD,uCACF;IACA,MAAM,SAAS,OAAO,QAAQ,YAAY,KAAK,WAAW,EAAE;IAC5D,OAAO,OACL,OAAO,OAAO,QAAQ,IAAI,UAAU,KAAK,GACzC,mCACF;GACF,CAAC,CAAC,CAAC,KAAK,OAAO,eAAeA,SAAmB,KAAK,CAAC,CACzD;EACF;EACA;GACE,MAAM;GACN,KAAK,IACH,OAAO,IAAI,aAAa;IACtB,MAAM,EAAE,SAAS,YAAY,eAAe,OAAO,QAAQ,OAAO,aAAa;IAC/E,OAAO,aACL,QAAQ,YAAY,OAAO,WAAW,EAAE,GACxC,gBACA,yBACF;IACA,OAAO,aACL,QAAQ,YAAY,OAAO;KACzB,cAAc,WAAW;KACzB,QAAQ,WAAW;KACnB,MAAM,WAAW;KACjB,OAAO,WAAW;KAClB,QAAQ,CAAC;IACX,CAAC,GACD,gBACA,6BACF;IACA,OAAO,QAAQ,YAAY,OAAO,WAAW,EAAE;IAC/C,OAAO,QAAQ,YAAY,OAAO,WAAW,EAAE;IAC/C,OAAO,aACL,QAAQ,YAAY,IAAI,WAAW,EAAE,GACrC,YACA,yBACF;GACF,CAAC,CAAC,CAAC,KAAK,OAAO,eAAeA,SAAmB,KAAK,CAAC,CACzD;EACF;EACA;GACE,MAAM;GACN,KAAK,IACH,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAOD;IACvB,MAAM,OAAO,OAAO,SAAS,KAAW;IACxC,MAAM,SAAS,OAAO,OAAO,UAC3B,QAAQ,SAAS,kBAAkB,SAAS,MAAM,IAAI,CAAC,CACzD;IACA,OAAO,OAAO;IACd,OAAO,aACL,QAAQ,SAAS,kBAAkB,OAAO,IAAI,GAC9C,QACA,eACF;IACA,MAAM,aAAa,OAAO,QACvB,SAAS,kBAAkB,OAAO,QAAQ,IAAI,CAAC,CAAC,CAChD,KAAK,OAAO,eAAeC,SAAmB,KAAK,CAAC;IACvD,OAAO,OAAO,eAAe,MAAM,+BAA+B;IAClE,OAAO,SAAS,QAAQ,MAAM,KAAA,CAAS;IACvC,OAAO,MAAM,KAAK,MAAM;IACxB,MAAM,QAAQ,OAAO,QAAQ,SAAS,kBAAkB,OAAO,QAAQ,MAAM,CAAC;IAC9E,OAAO,OAAO,UAAU,QAAQ,uBAAuB;IACvD,OAAO,QACJ,SAAS,kBAAkB,OAAO,KAAK,IAAI,QAAQ,QAAQ,CAAC,CAAC,CAAC,CAC9D,KAAK,OAAO,MAAM;IACrB,MAAM,eAAe,OAAO,QAAQ,SAAS,kBAAkB,OAAO,QAAQ,MAAM,CAAC;IACrF,OAAO,OAAO,iBAAiB,QAAQ,uCAAuC;GAChF,CAAC,CAAC,CAAC,KAAK,OAAO,eAAeA,SAAmB,KAAK,CAAC,CACzD;EACF;EACA;GACE,MAAM;GACN,KAAK,IACH,OAAO,IAAI,aAAa;IACtB,MAAM,EAAE,SAAS,eAAe,OAAO,QAAQ,OAAO,YAAY;IAClE,MAAM,MAAM,OAAO,SAAS;IAC5B,MAAM,YAAY,IAAIS,UAAkB;KACtC,QAAQ,WAAW;KACnB,cAAc,WAAW;KACzB,SAAS,MAAM;KACf,SAAS;KACT,cAAc,CACZ;MACE,aAAa;MACb,QAAQN,IAAc;OAAE,MAAM;OAAmB,OAAO;MAAI,CAAC;MAC7D,QAAQ;MACR,UAAU,CAAC;KACb,CACF;KACA,MAAM,CAAC;KACP,cAAc;KACd,WAAW;KACX,aAAa,SAAS,IAAI,KAAK,EAAE,SAAS,GAAG,CAAC;IAChD,CAAC;IACD,OAAO,QAAQ,UAAU,IAAI,SAAS;IACtC,MAAM,SAAS,OAAO,QAAQ,UAAU,IAAI,WAAW,MAAM;IAC7D,OAAO,OACL,OAAO,OAAO,MAAM,KAAK,OAAO,MAAM,YAAY,WAClD,0BACF;IACA,MAAM,UAAU,OAAO,QAAQ,UAC5B,IAAI,WAAW,MAAM,CAAC,CACtB,KAAK,OAAO,eAAeH,SAAmB,KAAK,CAAC;IACvD,OAAO,OAAO,OAAO,OAAO,OAAO,GAAG,gCAAgC;IACtE,OAAO,QAAQ,UAAU,IACvB,IAAIS,UAAkB;KACpB,GAAG;KACH,QAAQ;KACR,cAAc;IAChB,CAAC,CACH;IACA,MAAM,cAAc,OAAO,QAAQ,UAAU,IAAI,0BAA0B;IAC3E,OAAO,OACL,OAAO,OAAO,WAAW,KAAK,YAAY,MAAM,iBAAiB,MACjE,gDACF;IACA,OAAO,aACL,QAAQ,UAAU,IAChB,IAAIA,UAAkB;KAAE,GAAG;KAAW,cAAc;IAAc,CAAC,CACrE,GACA,YACA,sCACF;GACF,CAAC,CAAC,CAAC,KAAK,OAAO,eAAeT,SAAmB,KAAK,CAAC,CACzD;EACF;CACF;AACF;;AAGA,MAAa,WACX,OACA,UAAmB,CAAC,MACI;CACxB,MAAM,MAAM,MAAM,KAAK;CACvB,IAAI,QAAQ,OAAO,KAAA,GACjB,KAAK,MAAM,QAAQ,KAAK,QAAQ,GAAG,KAAK,YAAY,OAAO,WAAW,KAAK,GAAG,CAAC;CAEjF,OAAO;AACT"}

package/dist/package.mjs

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "0.14.0";
+var version = "0.15.0";
 //#endregion
 export { version };
 

package/dist/types/Connect.d.ts

@@ -111,7 +111,7 @@ export interface Snapshot {
     readonly domain: string;
     readonly attachment: Storage.Attachment | null;
     readonly connection: Storage.Connection | null;
-    readonly authorization: Pick<Storage.Authorization, "id" | "provider" | "method" | "capabilities" | "revocation"> | null;
+    readonly authorization: Pick<Storage.Authorization, "id" | "provider" | "method" | "capabilities" | "revocation" | "label"> | null;
     readonly lastReceiptId: string | null;
     /** How many domains this domain's connection serves, including this one; `0` without one. */
     readonly connectionDomains: number;
@@ -425,6 +425,8 @@ export interface Zone {
 export interface ZoneConnection {
     readonly connectionId: string;
     readonly provider: string;
+    /** What the provider called the account at connect time; `null` when it named none. */
+    readonly label: string | null;
     readonly status: "connected" | "reconnect";
 }
 /** Every zone the principal's connections reach, and how each connection is standing. */

package/dist/types/Provider.d.ts

@@ -128,6 +128,12 @@ export interface Credential {
 /** A credential the provider just issued or refreshed; `null` expiry means it does not expire. */
 export interface IssuedCredential extends Credential {
     readonly expiresAt: DateTime.Utc | null;
+    /**
+     * What the provider calls the account this credential reaches, so a UI names the connection
+     * without a provider call. Omit it, or answer `null`, when the provider cannot name one: a
+     * credential that spans several accounts has no single name.
+     */
+    readonly label?: string | null;
 }
 /** Raw token-method input keyed by the provider's declared field names. */
 export type TokenValues = Readonly<Record<string, Redacted.Redacted<string> | undefined>>;