domainkit 0.2.1 → 0.2.2

package/dist/{auth-6-KRy1gN.mjs.map → auth-g-waCHcz.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"auth-6-KRy1gN.mjs","names":["S","decode","DomainName.decode","DnsRecord.decode","failure","S","DnsRecord.Opaque","DnsProvider.Error","failure","Protocol.TeamListEnvelope","Protocol.DomainListEnvelope","Protocol.DomainConfig","Protocol.DomainEnvelope","DomainName.decode","Protocol.RecordListEnvelope","Records.decode","Records.encode","DnsProvider.Error","Protocol.CreateRecordEnvelope","Protocol.UserEnvelope","S","Protocol.ErrorEnvelope","Context","S","ProviderContext.codec","Protocol.ErrorEnvelope","Protocol.IntegrationToken","Secret.make","Client.make","Connection.Error","DnsProvider.Error"],"sources":["../src/providers/vercel/protocol.ts","../src/providers/vercel/records.ts","../src/providers/vercel/client.ts","../src/providers/vercel/auth.ts"],"sourcesContent":["import { Schema as S } from \"effect\";\n\nexport const Pagination = S.Struct({\n  count: S.Number,\n  next: S.NullOr(S.Number),\n  prev: S.NullOr(S.Number),\n});\nexport interface Pagination extends S.Schema.Type<typeof Pagination> {}\n\nexport const ErrorDetail = S.Struct({\n  code: S.String,\n  message: S.String,\n  limit: S.optionalKey(\n    S.Struct({\n      remaining: S.Number,\n      reset: S.optionalKey(S.Number),\n      resetMs: S.optionalKey(S.Number),\n      total: S.Number,\n    }),\n  ),\n});\nexport interface ErrorDetail extends S.Schema.Type<typeof ErrorDetail> {}\n\nexport const ErrorEnvelope = S.Struct({ error: ErrorDetail });\n\nexport const User = S.Struct({\n  id: S.String,\n  name: S.NullOr(S.String),\n  username: S.String,\n});\nexport interface User extends S.Schema.Type<typeof User> {}\n\nexport const UserEnvelope = S.Struct({ user: User });\n\nexport const Team = S.Struct({\n  id: S.String,\n  name: S.NullOr(S.String),\n  slug: S.String,\n});\nexport interface Team extends S.Schema.Type<typeof Team> {}\n\nexport const TeamListEnvelope = S.Struct({\n  pagination: Pagination,\n  teams: S.Array(Team),\n});\n\nexport const Domain = S.Struct({\n  id: S.String,\n  intendedNameservers: S.Array(S.String),\n  name: S.String,\n  nameservers: S.Array(S.String),\n  serviceType: S.Literals([\"zeit.world\", \"external\", \"na\"]),\n  teamId: S.NullOr(S.String),\n  userId: S.String,\n  verified: S.Boolean,\n  zone: S.optionalKey(S.Boolean),\n});\nexport interface Domain extends S.Schema.Type<typeof Domain> {}\n\nexport const DomainConfig = S.Struct({\n  misconfigured: S.Boolean,\n  serviceType: S.Literals([\"zeit.world\", \"external\", \"na\"]),\n});\nexport interface DomainConfig extends S.Schema.Type<typeof DomainConfig> {}\n\nexport const DomainEnvelope = S.Struct({ domain: Domain });\n\nexport const DomainListEnvelope = S.Struct({\n  domains: S.Array(Domain),\n  pagination: Pagination,\n});\n\nexport const Record = S.Struct({\n  id: S.String,\n  mxPriority: S.optionalKey(S.Number),\n  name: S.String,\n  priority: S.optionalKey(S.Number),\n  ttl: S.optionalKey(S.Number),\n  type: S.String,\n  value: S.String,\n});\nexport interface Record extends S.Schema.Type<typeof Record> {}\n\nexport const RecordListEnvelope = S.Struct({\n  pagination: S.optionalKey(Pagination),\n  records: S.Array(Record),\n});\n\nexport const CreateRecordEnvelope = S.Struct({\n  uid: S.String,\n  updated: S.optionalKey(S.Number),\n});\n\nexport const IntegrationToken = S.Struct({\n  access_token: S.String,\n  installation_id: S.optionalKey(S.String),\n  team_id: S.NullOr(S.String),\n  token_type: S.optionalKey(S.String),\n  user_id: S.String,\n});\nexport interface IntegrationToken extends S.Schema.Type<typeof IntegrationToken> {}\n","import { Effect, Schema as S } from \"effect\";\n\nimport * as DomainName from \"../../domain/domain-name.ts\";\nimport * as DnsRecord from \"../../domain/dns-record.ts\";\nimport * as DnsProvider from \"../../provider/provider.ts\";\nimport type * as Protocol from \"./protocol.ts\";\n\nexport type CreateBody = Readonly<Record<string, unknown>>;\n\nexport const decode = Effect.fn(\"VercelRecords.decode\")(\n  (zone: DomainName.DomainName, record: Protocol.Record) =>\n    Effect.gen(function* () {\n      const absolute = absoluteNameCandidate(zone, record.name);\n      const name = yield* DomainName.decode(absolute).pipe(\n        Effect.match({ onFailure: () => null, onSuccess: (value) => value }),\n      );\n      if (name === null) return yield* decodeOpaque(record, absolute);\n      const common = {\n        metadata: {\n          ownership: \"provider\",\n          provenance: \"vercel\",\n          purpose: \"existing DNS record\",\n        },\n        name,\n        policy: record.type === \"CNAME\" ? \"exclusive\" : \"append\",\n        ttl: record.ttl ?? 60,\n      } as const;\n      const fromRecord = (input: unknown) =>\n        DnsRecord.decode(input).pipe(\n          Effect.mapError((cause) => failure(\"decodeRecord\", cause.message)),\n        );\n\n      switch (record.type) {\n        case \"A\":\n        case \"AAAA\":\n          return yield* fromRecord({ ...common, _tag: record.type, address: record.value });\n        case \"CNAME\":\n        case \"NS\":\n          return yield* fromRecord({ ...common, _tag: record.type, target: record.value });\n        case \"TXT\":\n          return yield* fromRecord({ ...common, _tag: \"TXT\", value: record.value });\n        case \"MX\":\n          return yield* fromRecord({\n            ...common,\n            _tag: \"MX\",\n            exchange: record.value,\n            priority: record.mxPriority ?? record.priority,\n          });\n        case \"CAA\": {\n          const match = record.value.match(\n            /^(\\d{1,3})\\s+(issue|issuewild|iodef)\\s+(?:\"((?:\\\\.|[^\"])*)\"|(\\S.*))$/,\n          );\n          if (match === null) {\n            return yield* Effect.fail(\n              failure(\"decodeRecord\", \"Vercel CAA record has an invalid value\"),\n            );\n          }\n          return yield* fromRecord({\n            ...common,\n            _tag: \"CAA\",\n            flags: Number(match[1]),\n            tag: match[2],\n            value: unescapeQuoted(match[3] ?? match[4] ?? \"\"),\n          });\n        }\n        case \"SRV\": {\n          const parts = record.value.trim().split(/\\s+/);\n          const [priority, weight, port, target] =\n            parts.length === 4\n              ? parts\n              : [String(record.priority ?? \"\"), parts[0], parts[1], parts[2]];\n          return yield* fromRecord({\n            ...common,\n            _tag: \"SRV\",\n            port: Number(port),\n            priority: Number(priority),\n            target,\n            weight: Number(weight),\n          });\n        }\n        default:\n          return yield* decodeOpaque(record, name);\n      }\n    }),\n);\n\nconst decodeOpaque = Effect.fn(\"VercelRecords.decodeOpaque\")(\n  (record: Protocol.Record, name: string) =>\n    S.decodeUnknownEffect(DnsRecord.Opaque)({\n      _tag: \"Opaque\",\n      name,\n      providerRecordId: record.id,\n      providerType: record.type,\n    }).pipe(Effect.mapError((cause) => failure(\"decodeRecord\", cause.message))),\n);\n\nexport function encode(zone: DomainName.DomainName, record: DnsRecord.DnsRecord): CreateBody {\n  const common = {\n    name: relativeName(zone, record.name),\n    ...(record.ttl === null ? {} : { ttl: record.ttl }),\n    type: record._tag,\n  };\n  switch (record._tag) {\n    case \"A\":\n    case \"AAAA\":\n      return { ...common, value: record.address };\n    case \"CNAME\":\n    case \"NS\":\n      return { ...common, value: record.target };\n    case \"TXT\":\n      return { ...common, value: record.value };\n    case \"MX\":\n      return { ...common, mxPriority: record.priority, value: record.exchange };\n    case \"CAA\":\n      return {\n        ...common,\n        value: `${record.flags} ${record.tag} \"${escapeQuoted(record.value)}\"`,\n      };\n    case \"SRV\":\n      return {\n        ...common,\n        srv: {\n          port: record.port,\n          priority: record.priority,\n          target: record.target,\n          weight: record.weight,\n        },\n      };\n  }\n}\n\nfunction absoluteNameCandidate(zone: DomainName.DomainName, name: string): string {\n  return name === \"\" || name === \"@\"\n    ? zone\n    : name === zone || name.endsWith(`.${zone}`)\n      ? name\n      : `${name}.${zone}`;\n}\n\nfunction relativeName(zone: DomainName.DomainName, name: DomainName.DomainName): string {\n  if (name === zone) return \"\";\n  const suffix = `.${zone}`;\n  if (!name.endsWith(suffix)) {\n    throw failure(\"encodeRecord\", `DNS record ${name} is outside Vercel zone ${zone}`, {\n      reason: \"request\",\n    });\n  }\n  return name.slice(0, -suffix.length);\n}\n\nfunction escapeQuoted(value: string): string {\n  return value.replaceAll(\"\\\\\", \"\\\\\\\\\").replaceAll('\"', '\\\\\"');\n}\n\nfunction unescapeQuoted(value: string): string {\n  return value.replace(/\\\\([\\\\\"])/g, \"$1\");\n}\n\nfunction failure(\n  operation: string,\n  message: string,\n  fields: Partial<Pick<DnsProvider.Error, \"reason\">> = {},\n): DnsProvider.Error {\n  return new DnsProvider.Error({\n    message,\n    operation,\n    providerId: \"vercel\",\n    reason: fields.reason ?? \"response\",\n  });\n}\n","import { Effect, Schema as S } from \"effect\";\n\nimport type * as ProviderAuth from \"../../auth/manifest.ts\";\nimport type * as Secret from \"../../auth/secret.ts\";\nimport * as DomainName from \"../../domain/domain-name.ts\";\nimport type * as DnsRecord from \"../../domain/dns-record.ts\";\nimport type * as ZoneDiscovery from \"../../discovery/zone-discovery.ts\";\nimport * as DnsProvider from \"../../provider/provider.ts\";\nimport * as Protocol from \"./protocol.ts\";\nimport * as Records from \"./records.ts\";\n\nexport type Fetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;\n\n/** Selects whether Vercel requests operate on a personal account or a team. */\nexport type AccountContext =\n  | { readonly _tag: \"personal\" }\n  | { readonly _tag: \"team\"; readonly teamId: string };\n\n/** Configuration for an Effect-native Vercel authoritative-DNS client. */\nexport interface Options {\n  readonly baseUrl?: string;\n  /** Capabilities the host required when issuing or authorizing this credential. */\n  readonly capabilities: ProviderAuth.TokenValidation[\"capabilities\"];\n  readonly context: AccountContext;\n  readonly fetch?: Fetch;\n  readonly token: Secret.Value;\n}\n\nexport interface ListZonesInput {\n  readonly name?: DomainName.DomainName;\n}\n\n/** A Vercel account visible to the supplied credential. */\nexport interface Account {\n  readonly id: string;\n  readonly name: string;\n  readonly type: \"personal\" | \"team\";\n}\n\n/** A Vercel-managed authoritative zone with normalized nameserver evidence. */\nexport interface Zone {\n  readonly accountId: string;\n  readonly id: string;\n  readonly name: DomainName.DomainName;\n  readonly nameservers: ReadonlyArray<DomainName.DomainName>;\n  readonly status: \"active\" | \"pending\";\n}\n\nexport interface Interface extends DnsProvider.Interface {\n  readonly listAccounts: () => Effect.Effect<ReadonlyArray<Account>, DnsProvider.Error>;\n  readonly listZones: (\n    input?: ListZonesInput,\n  ) => Effect.Effect<ReadonlyArray<Zone>, DnsProvider.Error>;\n  readonly validateToken: () => Effect.Effect<ProviderAuth.TokenValidation, DnsProvider.Error>;\n}\n\n/** Exposes Vercel zone lookup as the optional provider discovery capability. */\nexport function discovery(client: Interface): ZoneDiscovery.Source {\n  return {\n    listZones: (name) => client.listZones({ name }),\n    provider: client,\n  };\n}\n\n/** Creates an Effect-native Vercel client without owning the credential lifecycle. */\nexport function make(options: Options): Interface {\n  const fetch = options.fetch ?? globalThis.fetch;\n  const baseUrl = (options.baseUrl ?? \"https://api.vercel.com\").replace(/\\/$/, \"\");\n\n  const withContext = (path: string, values: Readonly<Record<string, string>> = {}) => {\n    const url = new URL(`${baseUrl}${path}`);\n    for (const [key, value] of Object.entries(values)) url.searchParams.set(key, value);\n    if (options.context._tag === \"team\") url.searchParams.set(\"teamId\", options.context.teamId);\n    return url;\n  };\n\n  const request = Effect.fn(\"VercelClient.request\")(\n    (url: URL, operation: string, init?: RequestInit) =>\n      Effect.gen(function* () {\n        const response = yield* Effect.tryPromise({\n          try: () =>\n            fetch(url, {\n              ...init,\n              headers: {\n                Accept: \"application/json\",\n                Authorization: `Bearer ${options.token.expose()}`,\n                ...(init?.body === undefined ? {} : { \"Content-Type\": \"application/json\" }),\n                ...init?.headers,\n              },\n            }),\n          catch: () => failure(operation, \"Vercel request failed\", { reason: \"transport\" }),\n        });\n        const body = yield* Effect.tryPromise({\n          try: () => response.json() as Promise<unknown>,\n          catch: () =>\n            failure(\n              operation,\n              response.ok\n                ? \"Vercel returned a non-JSON response\"\n                : `Vercel request failed with HTTP ${response.status}`,\n              {\n                reason: response.ok ? \"response\" : reason(response.status),\n                ...rateLimit(response),\n                status: response.status,\n              },\n            ),\n        });\n        if (!response.ok) return yield* Effect.fail(apiFailure(body, operation, response));\n        return { body, response } as const;\n      }),\n  );\n\n  const allTeams = Effect.fn(\"VercelClient.allTeams\")(() =>\n    Effect.gen(function* () {\n      const teams: Array<Protocol.Team> = [];\n      let until: number | null = null;\n      while (true) {\n        const url = new URL(`${baseUrl}/v2/teams`);\n        url.searchParams.set(\"limit\", \"100\");\n        if (until !== null) url.searchParams.set(\"until\", String(until));\n        const { body, response } = yield* request(url, \"listAccounts\");\n        const envelope = yield* decode(Protocol.TeamListEnvelope, body, \"listAccounts\", response);\n        teams.push(...envelope.teams);\n        if (envelope.pagination.next === null) return teams;\n        until = envelope.pagination.next;\n      }\n    }),\n  );\n\n  const allDomains = Effect.fn(\"VercelClient.allDomains\")(() =>\n    Effect.gen(function* () {\n      const domains: Array<Protocol.Domain> = [];\n      let until: number | null = null;\n      while (true) {\n        const values: Record<string, string> = { limit: \"100\" };\n        if (until !== null) values.until = String(until);\n        const { body, response } = yield* request(withContext(\"/v5/domains\", values), \"listZones\");\n        const envelope = yield* decode(Protocol.DomainListEnvelope, body, \"listZones\", response);\n        domains.push(...envelope.domains);\n        if (envelope.pagination.next === null) return domains;\n        until = envelope.pagination.next;\n      }\n    }),\n  );\n\n  const discoverZone = Effect.fn(\"VercelClient.discoverZone\")((name: DomainName.DomainName) =>\n    Effect.gen(function* () {\n      const configResult = yield* request(\n        withContext(`/v6/domains/${encodeURIComponent(name)}/config`),\n        \"resolveZone\",\n      );\n      const config = yield* decode(\n        Protocol.DomainConfig,\n        configResult.body,\n        \"resolveZone\",\n        configResult.response,\n      );\n      const domainResult = yield* request(\n        withContext(`/v5/domains/${encodeURIComponent(name)}`),\n        \"resolveZone\",\n      );\n      const envelope = yield* decode(\n        Protocol.DomainEnvelope,\n        domainResult.body,\n        \"resolveZone\",\n        domainResult.response,\n      );\n      if (!hasDnsStorage(envelope.domain, config.serviceType)) {\n        return null;\n      }\n      return envelope.domain;\n    }).pipe(\n      Effect.catchTag(\"ProviderError\", (cause) =>\n        cause.reason === \"not_found\" ? Effect.succeed(null) : Effect.fail(cause),\n      ),\n    ),\n  );\n\n  const resolveZone = Effect.fn(\"VercelClient.resolveZone\")((name: DomainName.DomainName) =>\n    Effect.gen(function* () {\n      const domain = yield* discoverZone(name);\n      if (domain === null) {\n        return yield* Effect.fail(\n          failure(\n            \"resolveZone\",\n            `Vercel zone ${name} is not configured for authoritative DNS in the selected account`,\n            { reason: \"not_found\" },\n          ),\n        );\n      }\n      return yield* DomainName.decode(domain.name).pipe(\n        Effect.mapError((cause) =>\n          failure(\"resolveZone\", `Vercel returned an invalid storage zone: ${cause.message}`),\n        ),\n      );\n    }),\n  );\n\n  const listRecords = Effect.fn(\"VercelClient.listRecords\")((zoneName: DomainName.DomainName) =>\n    Effect.gen(function* () {\n      const storageZone = yield* resolveZone(zoneName);\n      const records: Array<DnsRecord.Observed> = [];\n      let until: number | null = null;\n      while (true) {\n        const values: Record<string, string> = { limit: \"100\" };\n        if (until !== null) values.until = String(until);\n        const { body, response } = yield* request(\n          withContext(`/v5/domains/${encodeURIComponent(storageZone)}/records`, values),\n          \"listRecords\",\n        );\n        const envelope = yield* decode(Protocol.RecordListEnvelope, body, \"listRecords\", response);\n        records.push(\n          ...(yield* Effect.forEach(envelope.records, (record) =>\n            Records.decode(storageZone, record),\n          )),\n        );\n        const next = envelope.pagination?.next ?? null;\n        if (next === null) {\n          return records.filter(\n            (record) => record.name === zoneName || record.name.endsWith(`.${zoneName}`),\n          );\n        }\n        until = next;\n      }\n    }),\n  );\n\n  const createRecord = Effect.fn(\"VercelClient.createRecord\")(\n    (zoneName: DomainName.DomainName, record: DnsRecord.DnsRecord) =>\n      Effect.gen(function* () {\n        const storageZone = yield* resolveZone(zoneName);\n        const body = yield* Effect.try({\n          try: () => Records.encode(storageZone, record),\n          catch: (cause) =>\n            cause instanceof DnsProvider.Error\n              ? cause\n              : failure(\"createRecord\", \"Vercel record could not be encoded\", {\n                  reason: \"request\",\n                }),\n        });\n        const result = yield* request(\n          withContext(`/v2/domains/${encodeURIComponent(storageZone)}/records`),\n          \"createRecord\",\n          { body: JSON.stringify(body), method: \"POST\" },\n        );\n        const envelope = yield* decode(\n          Protocol.CreateRecordEnvelope,\n          result.body,\n          \"createRecord\",\n          result.response,\n        );\n        return { providerRecordId: envelope.uid };\n      }),\n  );\n\n  const getRecord = Effect.fn(\"VercelClient.getRecord\")(\n    (zoneName: DomainName.DomainName, providerRecordId: string) =>\n      Effect.gen(function* () {\n        const storageZone = yield* resolveZone(zoneName);\n        let until: number | null = null;\n        while (true) {\n          const values: Record<string, string> = { limit: \"100\" };\n          if (until !== null) values.until = String(until);\n          const { body, response } = yield* request(\n            withContext(`/v5/domains/${encodeURIComponent(storageZone)}/records`, values),\n            \"getRecord\",\n          );\n          const envelope = yield* decode(Protocol.RecordListEnvelope, body, \"getRecord\", response);\n          const record = envelope.records.find(({ id }) => id === providerRecordId);\n          if (record !== undefined) return yield* Records.decode(storageZone, record);\n          const next = envelope.pagination?.next ?? null;\n          if (next === null) return null;\n          until = next;\n        }\n      }),\n  );\n\n  const deleteRecord = Effect.fn(\"VercelClient.deleteRecord\")(\n    (zoneName: DomainName.DomainName, providerRecordId: string) =>\n      Effect.gen(function* () {\n        const storageZone = yield* resolveZone(zoneName);\n        yield* request(\n          withContext(\n            `/v2/domains/${encodeURIComponent(storageZone)}/records/${encodeURIComponent(providerRecordId)}`,\n          ),\n          \"deleteRecord\",\n          { method: \"DELETE\" },\n        );\n      }),\n  );\n\n  const listAccounts = Effect.fn(\"VercelClient.listAccounts\")(() =>\n    Effect.gen(function* () {\n      const userResult = yield* request(new URL(`${baseUrl}/v2/user`), \"listAccounts\");\n      const { user } = yield* decode(\n        Protocol.UserEnvelope,\n        userResult.body,\n        \"listAccounts\",\n        userResult.response,\n      );\n      const teams = yield* allTeams();\n      return [\n        { id: user.id, name: user.name ?? user.username, type: \"personal\" as const },\n        ...teams.map((team) => ({\n          id: team.id,\n          name: team.name ?? team.slug,\n          type: \"team\" as const,\n        })),\n      ];\n    }),\n  );\n\n  const listZones = Effect.fn(\"VercelClient.listZones\")((input: ListZonesInput = {}) =>\n    Effect.gen(function* () {\n      const domains = (yield* allDomains()).filter(\n        (domain) =>\n          hasDnsStorage(domain) && (input.name === undefined || domain.name === input.name),\n      );\n      if (domains.length > 0 || input.name === undefined) {\n        return yield* Effect.forEach(domains, projectZone);\n      }\n      const discovered = yield* discoverZone(input.name);\n      return discovered === null ? [] : [yield* projectZone(discovered)];\n    }),\n  );\n\n  const validateToken = Effect.fn(\"VercelClient.validateToken\")(() =>\n    Effect.gen(function* () {\n      let accountId: string;\n      if (options.context._tag === \"team\") {\n        yield* allDomains();\n        accountId = options.context.teamId;\n      } else {\n        const result = yield* request(new URL(`${baseUrl}/v2/user`), \"validateToken\");\n        const { user } = yield* decode(\n          Protocol.UserEnvelope,\n          result.body,\n          \"validateToken\",\n          result.response,\n        );\n        accountId = user.id;\n      }\n      return {\n        accountId,\n        capabilities: options.capabilities,\n        expiresAt: null,\n        scopes: [],\n      };\n    }),\n  );\n\n  return {\n    id: \"vercel\",\n    createRecord,\n    deleteRecord,\n    getRecord,\n    listAccounts,\n    listRecords,\n    listZones,\n    validateToken,\n  };\n}\n\nfunction hasDnsStorage(\n  domain: Protocol.Domain,\n  configuredServiceType: Protocol.DomainConfig[\"serviceType\"] = domain.serviceType,\n): boolean {\n  return (\n    configuredServiceType === \"zeit.world\" ||\n    domain.zone === true ||\n    domain.intendedNameservers.length > 0\n  );\n}\n\nconst projectZone = Effect.fn(\"VercelClient.projectZone\")((domain: Protocol.Domain) =>\n  Effect.gen(function* () {\n    const name = yield* DomainName.decode(domain.name).pipe(\n      Effect.mapError((cause) => failure(\"listZones\", cause.message, { reason: \"response\" })),\n    );\n    const nameservers = yield* Effect.forEach(domain.intendedNameservers, (nameserver) =>\n      DomainName.decode(nameserver).pipe(\n        Effect.mapError((cause) => failure(\"listZones\", cause.message, { reason: \"response\" })),\n      ),\n    );\n    return {\n      accountId: domain.teamId ?? domain.userId,\n      id: domain.id,\n      name,\n      nameservers,\n      status: domain.verified ? \"active\" : \"pending\",\n    } as const;\n  }),\n);\n\nfunction decode<A>(\n  schema: S.ConstraintCodec<A, unknown, never, unknown>,\n  input: unknown,\n  operation: string,\n  response: Response,\n): Effect.Effect<A, DnsProvider.Error> {\n  return S.decodeUnknownEffect(schema)(input).pipe(\n    Effect.mapError((cause) =>\n      failure(operation, `Vercel response did not match its API contract: ${cause.message}`, {\n        reason: \"response\",\n        status: response.status,\n      }),\n    ),\n  );\n}\n\nfunction apiFailure(input: unknown, operation: string, response: Response): DnsProvider.Error {\n  const detail = S.decodeUnknownOption(Protocol.ErrorEnvelope)(input);\n  return failure(\n    operation,\n    detail._tag === \"Some\"\n      ? detail.value.error.message\n      : `Vercel request failed with HTTP ${response.status}`,\n    {\n      ...(detail._tag === \"Some\" ? { code: detail.value.error.code } : {}),\n      reason: reason(response.status, detail._tag === \"Some\" ? detail.value.error.code : undefined),\n      ...rateLimit(response, detail._tag === \"Some\" ? detail.value.error : undefined),\n      status: response.status,\n    },\n  );\n}\n\nfunction reason(status: number, code?: string): DnsProvider.ErrorReason {\n  if (status === 401 || code === \"invalid_token\") return \"authentication\";\n  if (status === 403) return \"authorization\";\n  if (status === 404 || code === \"not_found\") return \"not_found\";\n  if (status === 409 || code === \"conflict\") return \"conflict\";\n  if (status === 429 || code === \"rate_limited\") return \"rate_limit\";\n  if (status >= 500) return \"response\";\n  return \"request\";\n}\n\nfunction rateLimit(\n  response: Response,\n  detail?: Protocol.ErrorDetail,\n): Partial<Pick<DnsProvider.Error, \"retryAfterMs\">> {\n  const resetMs = detail?.limit?.resetMs;\n  const header = response.headers.get(\"x-ratelimit-reset\");\n  const reset = resetMs ?? (header === null ? undefined : Number(header) * 1_000);\n  return reset === undefined || !Number.isFinite(reset)\n    ? {}\n    : { retryAfterMs: Math.max(0, reset - Date.now()) };\n}\n\nfunction failure(\n  operation: string,\n  message: string,\n  fields: Partial<Pick<DnsProvider.Error, \"code\" | \"reason\" | \"retryAfterMs\" | \"status\">> = {},\n): DnsProvider.Error {\n  return new DnsProvider.Error({ ...fields, message, operation, providerId: \"vercel\" });\n}\n","import { Clock, Effect, Schema as S } from \"effect\";\n\nimport * as Connection from \"../../auth/connect.ts\";\nimport * as ProviderAuthorization from \"../../auth/authorization.ts\";\nimport type * as ProviderAuth from \"../../auth/manifest.ts\";\nimport * as ProviderContext from \"../../auth/provider-context.ts\";\nimport * as Secret from \"../../auth/secret.ts\";\nimport * as DnsProvider from \"../../provider/provider.ts\";\nimport * as Client from \"./client.ts\";\nimport * as Protocol from \"./protocol.ts\";\n\nconst Context = S.TaggedUnion({\n  personal: { installationId: S.NullOr(S.String) },\n  team: { installationId: S.NullOr(S.String), teamId: S.String },\n});\nexport type Context = typeof Context.Type;\nexport const contextCodec = ProviderContext.codec(\"vercel.v1\", Context);\n\n/** Describes Vercel's caller-created personal access-token method. */\nexport function tokenMethod(\n  capabilities: ProviderAuth.TokenValidation[\"capabilities\"],\n): Extract<ProviderAuth.Manifest[\"methods\"][number], { readonly _tag: \"token\" }> {\n  return {\n    _tag: \"token\",\n    capabilities: [...capabilities],\n    instructionsUrl: \"https://vercel.com/account/settings/tokens\",\n  };\n}\n\nexport interface IntegrationMethodOptions {\n  readonly capabilities: ProviderAuth.TokenValidation[\"capabilities\"];\n  readonly slug: string;\n}\n\n/** Describes Vercel's provider-specific integration installation flow. */\nexport function integrationMethod(\n  options: IntegrationMethodOptions,\n): ProviderAuth.IntegrationMethod {\n  return {\n    _tag: \"integration\",\n    capabilities: [...options.capabilities],\n    installUrl: `https://vercel.com/integrations/${encodeURIComponent(options.slug)}/new`,\n    tokenEndpoint: \"https://api.vercel.com/oauth/access_token\",\n  };\n}\n\n/** Creates the Vercel token and integration authorization manifest. */\nexport function manifest(options: IntegrationMethodOptions): ProviderAuth.Manifest {\n  return {\n    methods: [tokenMethod(options.capabilities), integrationMethod(options)],\n    providerId: \"vercel\",\n  };\n}\n\nexport interface ExchangeCodeOptions {\n  readonly baseUrl?: string;\n  readonly clientId: string;\n  readonly clientSecret: Secret.Value;\n  readonly code: Secret.Value;\n  readonly fetch?: Client.Fetch;\n  readonly redirectUri: string;\n}\n\nexport interface IntegrationCredential {\n  readonly accessToken: Secret.Value;\n  readonly context: Client.AccountContext;\n  readonly installationId: string | null;\n  readonly userId: string;\n}\n\n/** Exchanges Vercel's one-time integration code and preserves its account context. */\nexport const exchangeCode = Effect.fn(\"VercelAuth.exchangeCode\")((options: ExchangeCodeOptions) =>\n  Effect.gen(function* () {\n    const fetch = options.fetch ?? globalThis.fetch;\n    const baseUrl = (options.baseUrl ?? \"https://api.vercel.com\").replace(/\\/$/, \"\");\n    const body = new URLSearchParams({\n      client_id: options.clientId,\n      client_secret: options.clientSecret.expose(),\n      code: options.code.expose(),\n      redirect_uri: options.redirectUri,\n    });\n    const response = yield* Effect.tryPromise({\n      try: () =>\n        fetch(`${baseUrl}/oauth/access_token`, {\n          body,\n          headers: {\n            Accept: \"application/json\",\n            \"Content-Type\": \"application/x-www-form-urlencoded\",\n          },\n          method: \"POST\",\n        }),\n      catch: () => failure(\"exchangeCode\", \"Vercel token exchange failed\", \"transport\"),\n    });\n    const input = yield* Effect.tryPromise({\n      try: () => response.json() as Promise<unknown>,\n      catch: () =>\n        failure(\n          \"exchangeCode\",\n          response.ok\n            ? \"Vercel returned a non-JSON token response\"\n            : `Vercel token exchange failed with HTTP ${response.status}`,\n          response.ok ? \"response\" : response.status === 401 ? \"authentication\" : \"request\",\n          response.status,\n        ),\n    });\n    if (!response.ok) {\n      const detail = S.decodeUnknownOption(Protocol.ErrorEnvelope)(input);\n      return yield* Effect.fail(\n        failure(\n          \"exchangeCode\",\n          detail._tag === \"Some\"\n            ? detail.value.error.message\n            : `Vercel token exchange failed with HTTP ${response.status}`,\n          response.status === 401 ? \"authentication\" : \"request\",\n          response.status,\n          detail._tag === \"Some\" ? detail.value.error.code : undefined,\n        ),\n      );\n    }\n    const token = yield* S.decodeUnknownEffect(Protocol.IntegrationToken)(input).pipe(\n      Effect.mapError((cause) =>\n        failure(\n          \"exchangeCode\",\n          `Vercel token response did not match its API contract: ${cause.message}`,\n          \"response\",\n          response.status,\n        ),\n      ),\n    );\n    return {\n      accessToken: Secret.make(token.access_token),\n      context:\n        token.team_id === null\n          ? ({ _tag: \"personal\" } as const)\n          : ({ _tag: \"team\", teamId: token.team_id } as const),\n      installationId: token.installation_id ?? null,\n      userId: token.user_id,\n    };\n  }),\n);\n\nexport interface TokenConnectionOptions extends Omit<Client.Options, \"token\"> {\n  readonly token: Secret.Value;\n}\n\n/** Creates a provider-independent token connection method backed by Vercel validation. */\nexport function tokenConnectionMethod(\n  options: TokenConnectionOptions,\n): Extract<Connection.Method, { readonly _tag: \"Token\" }> {\n  const requiredCapabilities = [...options.capabilities];\n  return Connection.Method.Token({\n    authenticate: Effect.fn(\"VercelAuth.authenticateToken\")(function* (token) {\n      const validated = yield* Client.make({ ...options, token }).validateToken();\n      const observedAt = new Date(yield* Clock.currentTimeMillis);\n      return {\n        capabilityEvidence: validated.capabilities.map((capability) => ({\n          capability,\n          evidence: ProviderAuthorization.Evidence.Introspected({ observedAt }),\n        })),\n        credential: { accessToken: token, refreshToken: null, tokenType: \"bearer\" },\n        expiresAt: validated.expiresAt,\n        providerAccountId: validated.accountId,\n        providerContext: yield* contextCodec.encode(\n          options.context._tag === \"team\"\n            ? { _tag: \"team\", installationId: null, teamId: options.context.teamId }\n            : { _tag: \"personal\", installationId: null },\n        ),\n        scopes: [...validated.scopes],\n      } satisfies Connection.Authentication;\n    }),\n    providerId: \"vercel\",\n    requiredCapabilities,\n    token: options.token,\n  });\n}\n\n/** Converts a completed Vercel Integration exchange into canonical connection authentication. */\nexport const integrationAuthentication = Effect.fn(\"VercelAuth.integrationAuthentication\")(\n  function* (\n    options: ExchangeCodeOptions & {\n      readonly capabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n    },\n  ) {\n    const exchanged = yield* exchangeCode(options);\n    const observedAt = new Date(yield* Clock.currentTimeMillis);\n    return {\n      capabilityEvidence: options.capabilities.map((capability) => ({\n        capability,\n        evidence: ProviderAuthorization.Evidence.Introspected({ observedAt }),\n      })),\n      credential: {\n        accessToken: exchanged.accessToken,\n        refreshToken: null,\n        tokenType: \"bearer\",\n      },\n      expiresAt: null,\n      providerAccountId:\n        exchanged.context._tag === \"team\" ? exchanged.context.teamId : exchanged.userId,\n      providerContext: yield* contextCodec.encode(\n        exchanged.context._tag === \"team\"\n          ? {\n              _tag: \"team\",\n              installationId: exchanged.installationId,\n              teamId: exchanged.context.teamId,\n            }\n          : { _tag: \"personal\", installationId: exchanged.installationId },\n      ),\n      scopes: [],\n    } satisfies Connection.Authentication;\n  },\n);\n\nexport interface IntegrationFlowOptions\n  extends Omit<ExchangeCodeOptions, \"code\">, IntegrationMethodOptions {}\n\n/** Creates Vercel Integration's implementation of the common interactive connection capability. */\nexport function integrationFlow(options: IntegrationFlowOptions): Connection.InteractiveFlow {\n  const method = integrationMethod(options);\n  const Payload = S.fromJsonString(S.Struct({ state: S.String }));\n  return {\n    complete: Effect.fn(\"VercelAuth.integrationFlow.complete\")(function* (payload, callbackUrl) {\n      const continuation = yield* S.decodeUnknownEffect(Payload)(payload.expose()).pipe(\n        Effect.mapError(\n          () =>\n            new Connection.Error({\n              category: \"authorization\",\n              message: \"Vercel Integration continuation payload is invalid\",\n              operation: \"VercelAuth.integrationFlow.complete\",\n              retry: \"after-user-action\",\n            }),\n        ),\n      );\n      const code = callbackUrl.searchParams.get(\"code\");\n      if (callbackUrl.searchParams.get(\"state\") !== continuation.state || code === null) {\n        return yield* new Connection.Error({\n          category: \"authorization\",\n          message: \"Vercel Integration callback does not match its continuation\",\n          operation: \"VercelAuth.integrationFlow.complete\",\n          retry: \"after-user-action\",\n        });\n      }\n      return yield* integrationAuthentication({\n        ...(options.baseUrl === undefined ? {} : { baseUrl: options.baseUrl }),\n        capabilities: options.capabilities,\n        clientId: options.clientId,\n        clientSecret: options.clientSecret,\n        code: Secret.make(code),\n        ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n        redirectUri: options.redirectUri,\n      });\n    }),\n    method: \"integration\",\n    providerId: \"vercel\",\n    requiredCapabilities: [...options.capabilities],\n    start: (continuationId) => {\n      const authorizationUrl = new URL(method.installUrl);\n      authorizationUrl.searchParams.set(\"source\", \"external\");\n      authorizationUrl.searchParams.set(\"state\", continuationId);\n      return Effect.succeed({\n        authorizationUrl,\n        payload: Secret.make(JSON.stringify({ state: continuationId })),\n      });\n    },\n  };\n}\n\nfunction failure(\n  operation: string,\n  message: string,\n  reason: DnsProvider.ErrorReason,\n  status?: number,\n  code?: string,\n): DnsProvider.Error {\n  return new DnsProvider.Error({\n    ...(code === undefined ? {} : { code }),\n    message,\n    operation,\n    providerId: \"vercel\",\n    reason,\n    ...(status === undefined ? {} : { status }),\n  });\n}\n"],"mappings":";;;;;AAEA,MAAa,aAAaA,OAAE,OAAO;CACjC,OAAOA,OAAE;CACT,MAAMA,OAAE,OAAOA,OAAE,MAAM;CACvB,MAAMA,OAAE,OAAOA,OAAE,MAAM;AACzB,CAAC;AAGD,MAAa,cAAcA,OAAE,OAAO;CAClC,MAAMA,OAAE;CACR,SAASA,OAAE;CACX,OAAOA,OAAE,YACPA,OAAE,OAAO;EACP,WAAWA,OAAE;EACb,OAAOA,OAAE,YAAYA,OAAE,MAAM;EAC7B,SAASA,OAAE,YAAYA,OAAE,MAAM;EAC/B,OAAOA,OAAE;CACX,CAAC,CACH;AACF,CAAC;AAGD,MAAa,gBAAgBA,OAAE,OAAO,EAAE,OAAO,YAAY,CAAC;AAE5D,MAAa,OAAOA,OAAE,OAAO;CAC3B,IAAIA,OAAE;CACN,MAAMA,OAAE,OAAOA,OAAE,MAAM;CACvB,UAAUA,OAAE;AACd,CAAC;AAGD,MAAa,eAAeA,OAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AAEnD,MAAa,OAAOA,OAAE,OAAO;CAC3B,IAAIA,OAAE;CACN,MAAMA,OAAE,OAAOA,OAAE,MAAM;CACvB,MAAMA,OAAE;AACV,CAAC;AAGD,MAAa,mBAAmBA,OAAE,OAAO;CACvC,YAAY;CACZ,OAAOA,OAAE,MAAM,IAAI;AACrB,CAAC;AAED,MAAa,SAASA,OAAE,OAAO;CAC7B,IAAIA,OAAE;CACN,qBAAqBA,OAAE,MAAMA,OAAE,MAAM;CACrC,MAAMA,OAAE;CACR,aAAaA,OAAE,MAAMA,OAAE,MAAM;CAC7B,aAAaA,OAAE,SAAS;EAAC;EAAc;EAAY;CAAI,CAAC;CACxD,QAAQA,OAAE,OAAOA,OAAE,MAAM;CACzB,QAAQA,OAAE;CACV,UAAUA,OAAE;CACZ,MAAMA,OAAE,YAAYA,OAAE,OAAO;AAC/B,CAAC;AAGD,MAAa,eAAeA,OAAE,OAAO;CACnC,eAAeA,OAAE;CACjB,aAAaA,OAAE,SAAS;EAAC;EAAc;EAAY;CAAI,CAAC;AAC1D,CAAC;AAGD,MAAa,iBAAiBA,OAAE,OAAO,EAAE,QAAQ,OAAO,CAAC;AAEzD,MAAa,qBAAqBA,OAAE,OAAO;CACzC,SAASA,OAAE,MAAM,MAAM;CACvB,YAAY;AACd,CAAC;AAED,MAAa,SAASA,OAAE,OAAO;CAC7B,IAAIA,OAAE;CACN,YAAYA,OAAE,YAAYA,OAAE,MAAM;CAClC,MAAMA,OAAE;CACR,UAAUA,OAAE,YAAYA,OAAE,MAAM;CAChC,KAAKA,OAAE,YAAYA,OAAE,MAAM;CAC3B,MAAMA,OAAE;CACR,OAAOA,OAAE;AACX,CAAC;AAGD,MAAa,qBAAqBA,OAAE,OAAO;CACzC,YAAYA,OAAE,YAAY,UAAU;CACpC,SAASA,OAAE,MAAM,MAAM;AACzB,CAAC;AAED,MAAa,uBAAuBA,OAAE,OAAO;CAC3C,KAAKA,OAAE;CACP,SAASA,OAAE,YAAYA,OAAE,MAAM;AACjC,CAAC;AAED,MAAa,mBAAmBA,OAAE,OAAO;CACvC,cAAcA,OAAE;CAChB,iBAAiBA,OAAE,YAAYA,OAAE,MAAM;CACvC,SAASA,OAAE,OAAOA,OAAE,MAAM;CAC1B,YAAYA,OAAE,YAAYA,OAAE,MAAM;CAClC,SAASA,OAAE;AACb,CAAC;;;AC1FD,MAAaC,WAAS,OAAO,GAAG,sBAAsB,CAAC,EACpD,MAA6B,WAC5B,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,sBAAsB,MAAM,OAAO,IAAI;CACxD,MAAM,OAAO,OAAOC,SAAkB,QAAQ,CAAC,CAAC,KAC9C,OAAO,MAAM;EAAE,iBAAiB;EAAM,YAAY,UAAU;CAAM,CAAC,CACrE;CACA,IAAI,SAAS,MAAM,OAAO,OAAO,aAAa,QAAQ,QAAQ;CAC9D,MAAM,SAAS;EACb,UAAU;GACR,WAAW;GACX,YAAY;GACZ,SAAS;EACX;EACA;EACA,QAAQ,OAAO,SAAS,UAAU,cAAc;EAChD,KAAK,OAAO,OAAO;CACrB;CACA,MAAM,cAAc,UAClBC,SAAiB,KAAK,CAAC,CAAC,KACtB,OAAO,UAAU,UAAUC,UAAQ,gBAAgB,MAAM,OAAO,CAAC,CACnE;CAEF,QAAQ,OAAO,MAAf;EACE,KAAK;EACL,KAAK,QACH,OAAO,OAAO,WAAW;GAAE,GAAG;GAAQ,MAAM,OAAO;GAAM,SAAS,OAAO;EAAM,CAAC;EAClF,KAAK;EACL,KAAK,MACH,OAAO,OAAO,WAAW;GAAE,GAAG;GAAQ,MAAM,OAAO;GAAM,QAAQ,OAAO;EAAM,CAAC;EACjF,KAAK,OACH,OAAO,OAAO,WAAW;GAAE,GAAG;GAAQ,MAAM;GAAO,OAAO,OAAO;EAAM,CAAC;EAC1E,KAAK,MACH,OAAO,OAAO,WAAW;GACvB,GAAG;GACH,MAAM;GACN,UAAU,OAAO;GACjB,UAAU,OAAO,cAAc,OAAO;EACxC,CAAC;EACH,KAAK,OAAO;GACV,MAAM,QAAQ,OAAO,MAAM,MACzB,sEACF;GACA,IAAI,UAAU,MACZ,OAAO,OAAO,OAAO,KACnBA,UAAQ,gBAAgB,wCAAwC,CAClE;GAEF,OAAO,OAAO,WAAW;IACvB,GAAG;IACH,MAAM;IACN,OAAO,OAAO,MAAM,EAAE;IACtB,KAAK,MAAM;IACX,OAAO,eAAe,MAAM,MAAM,MAAM,MAAM,EAAE;GAClD,CAAC;EACH;EACA,KAAK,OAAO;GACV,MAAM,QAAQ,OAAO,MAAM,KAAK,CAAC,CAAC,MAAM,KAAK;GAC7C,MAAM,CAAC,UAAU,QAAQ,MAAM,UAC7B,MAAM,WAAW,IACb,QACA;IAAC,OAAO,OAAO,YAAY,EAAE;IAAG,MAAM;IAAI,MAAM;IAAI,MAAM;GAAE;GAClE,OAAO,OAAO,WAAW;IACvB,GAAG;IACH,MAAM;IACN,MAAM,OAAO,IAAI;IACjB,UAAU,OAAO,QAAQ;IACzB;IACA,QAAQ,OAAO,MAAM;GACvB,CAAC;EACH;EACA,SACE,OAAO,OAAO,aAAa,QAAQ,IAAI;CAC3C;AACF,CAAC,CACL;AAEA,MAAM,eAAe,OAAO,GAAG,4BAA4B,CAAC,EACzD,QAAyB,SACxBC,OAAE,oBAAoBC,MAAgB,CAAC,CAAC;CACtC,MAAM;CACN;CACA,kBAAkB,OAAO;CACzB,cAAc,OAAO;AACvB,CAAC,CAAC,CAAC,KAAK,OAAO,UAAU,UAAUF,UAAQ,gBAAgB,MAAM,OAAO,CAAC,CAAC,CAC9E;AAEA,SAAgB,OAAO,MAA6B,QAAyC;CAC3F,MAAM,SAAS;EACb,MAAM,aAAa,MAAM,OAAO,IAAI;EACpC,GAAI,OAAO,QAAQ,OAAO,CAAC,IAAI,EAAE,KAAK,OAAO,IAAI;EACjD,MAAM,OAAO;CACf;CACA,QAAQ,OAAO,MAAf;EACE,KAAK;EACL,KAAK,QACH,OAAO;GAAE,GAAG;GAAQ,OAAO,OAAO;EAAQ;EAC5C,KAAK;EACL,KAAK,MACH,OAAO;GAAE,GAAG;GAAQ,OAAO,OAAO;EAAO;EAC3C,KAAK,OACH,OAAO;GAAE,GAAG;GAAQ,OAAO,OAAO;EAAM;EAC1C,KAAK,MACH,OAAO;GAAE,GAAG;GAAQ,YAAY,OAAO;GAAU,OAAO,OAAO;EAAS;EAC1E,KAAK,OACH,OAAO;GACL,GAAG;GACH,OAAO,GAAG,OAAO,MAAM,GAAG,OAAO,IAAI,IAAI,aAAa,OAAO,KAAK,EAAE;EACtE;EACF,KAAK,OACH,OAAO;GACL,GAAG;GACH,KAAK;IACH,MAAM,OAAO;IACb,UAAU,OAAO;IACjB,QAAQ,OAAO;IACf,QAAQ,OAAO;GACjB;EACF;CACJ;AACF;AAEA,SAAS,sBAAsB,MAA6B,MAAsB;CAChF,OAAO,SAAS,MAAM,SAAS,MAC3B,OACA,SAAS,QAAQ,KAAK,SAAS,IAAI,MAAM,IACvC,OACA,GAAG,KAAK,GAAG;AACnB;AAEA,SAAS,aAAa,MAA6B,MAAqC;CACtF,IAAI,SAAS,MAAM,OAAO;CAC1B,MAAM,SAAS,IAAI;CACnB,IAAI,CAAC,KAAK,SAAS,MAAM,GACvB,MAAMA,UAAQ,gBAAgB,cAAc,KAAK,0BAA0B,QAAQ,EACjF,QAAQ,UACV,CAAC;CAEH,OAAO,KAAK,MAAM,GAAG,CAAC,OAAO,MAAM;AACrC;AAEA,SAAS,aAAa,OAAuB;CAC3C,OAAO,MAAM,WAAW,MAAM,MAAM,CAAC,CAAC,WAAW,MAAK,MAAK;AAC7D;AAEA,SAAS,eAAe,OAAuB;CAC7C,OAAO,MAAM,QAAQ,cAAc,IAAI;AACzC;AAEA,SAASA,UACP,WACA,SACA,SAAqD,CAAC,GACnC;CACnB,OAAO,IAAIG,MAAkB;EAC3B;EACA;EACA,YAAY;EACZ,QAAQ,OAAO,UAAU;CAC3B,CAAC;AACH;;;;;;;;AChHA,SAAgB,UAAU,QAAyC;CACjE,OAAO;EACL,YAAY,SAAS,OAAO,UAAU,EAAE,KAAK,CAAC;EAC9C,UAAU;CACZ;AACF;;AAGA,SAAgB,KAAK,SAA6B;CAChD,MAAM,QAAQ,QAAQ,SAAS,WAAW;CAC1C,MAAM,WAAW,QAAQ,WAAW,yBAAA,CAA0B,QAAQ,OAAO,EAAE;CAE/E,MAAM,eAAe,MAAc,SAA2C,CAAC,MAAM;EACnF,MAAM,MAAM,IAAI,IAAI,GAAG,UAAU,MAAM;EACvC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,GAAG,IAAI,aAAa,IAAI,KAAK,KAAK;EAClF,IAAI,QAAQ,QAAQ,SAAS,QAAQ,IAAI,aAAa,IAAI,UAAU,QAAQ,QAAQ,MAAM;EAC1F,OAAO;CACT;CAEA,MAAM,UAAU,OAAO,GAAG,sBAAsB,CAAC,EAC9C,KAAU,WAAmB,SAC5B,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,OAAO,OAAO,WAAW;GACxC,WACE,MAAM,KAAK;IACT,GAAG;IACH,SAAS;KACP,QAAQ;KACR,eAAe,UAAU,QAAQ,MAAM,OAAO;KAC9C,GAAI,MAAM,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;KACzE,GAAG,MAAM;IACX;GACF,CAAC;GACH,aAAaC,UAAQ,WAAW,yBAAyB,EAAE,QAAQ,YAAY,CAAC;EAClF,CAAC;EACD,MAAM,OAAO,OAAO,OAAO,WAAW;GACpC,WAAW,SAAS,KAAK;GACzB,aACEA,UACE,WACA,SAAS,KACL,wCACA,mCAAmC,SAAS,UAChD;IACE,QAAQ,SAAS,KAAK,aAAa,OAAO,SAAS,MAAM;IACzD,GAAG,UAAU,QAAQ;IACrB,QAAQ,SAAS;GACnB,CACF;EACJ,CAAC;EACD,IAAI,CAAC,SAAS,IAAI,OAAO,OAAO,OAAO,KAAK,WAAW,MAAM,WAAW,QAAQ,CAAC;EACjF,OAAO;GAAE;GAAM;EAAS;CAC1B,CAAC,CACL;CAEA,MAAM,WAAW,OAAO,GAAG,uBAAuB,CAAC,OACjD,OAAO,IAAI,aAAa;EACtB,MAAM,QAA8B,CAAC;EACrC,IAAI,QAAuB;EAC3B,OAAO,MAAM;GACX,MAAM,MAAM,IAAI,IAAI,GAAG,QAAQ,UAAU;GACzC,IAAI,aAAa,IAAI,SAAS,KAAK;GACnC,IAAI,UAAU,MAAM,IAAI,aAAa,IAAI,SAAS,OAAO,KAAK,CAAC;GAC/D,MAAM,EAAE,MAAM,aAAa,OAAO,QAAQ,KAAK,cAAc;GAC7D,MAAM,WAAW,OAAO,OAAOC,kBAA2B,MAAM,gBAAgB,QAAQ;GACxF,MAAM,KAAK,GAAG,SAAS,KAAK;GAC5B,IAAI,SAAS,WAAW,SAAS,MAAM,OAAO;GAC9C,QAAQ,SAAS,WAAW;EAC9B;CACF,CAAC,CACH;CAEA,MAAM,aAAa,OAAO,GAAG,yBAAyB,CAAC,OACrD,OAAO,IAAI,aAAa;EACtB,MAAM,UAAkC,CAAC;EACzC,IAAI,QAAuB;EAC3B,OAAO,MAAM;GACX,MAAM,SAAiC,EAAE,OAAO,MAAM;GACtD,IAAI,UAAU,MAAM,OAAO,QAAQ,OAAO,KAAK;GAC/C,MAAM,EAAE,MAAM,aAAa,OAAO,QAAQ,YAAY,eAAe,MAAM,GAAG,WAAW;GACzF,MAAM,WAAW,OAAO,OAAOC,oBAA6B,MAAM,aAAa,QAAQ;GACvF,QAAQ,KAAK,GAAG,SAAS,OAAO;GAChC,IAAI,SAAS,WAAW,SAAS,MAAM,OAAO;GAC9C,QAAQ,SAAS,WAAW;EAC9B;CACF,CAAC,CACH;CAEA,MAAM,eAAe,OAAO,GAAG,2BAA2B,CAAC,EAAE,SAC3D,OAAO,IAAI,aAAa;EACtB,MAAM,eAAe,OAAO,QAC1B,YAAY,eAAe,mBAAmB,IAAI,EAAE,QAAQ,GAC5D,aACF;EACA,MAAM,SAAS,OAAO,OACpBC,cACA,aAAa,MACb,eACA,aAAa,QACf;EACA,MAAM,eAAe,OAAO,QAC1B,YAAY,eAAe,mBAAmB,IAAI,GAAG,GACrD,aACF;EACA,MAAM,WAAW,OAAO,OACtBC,gBACA,aAAa,MACb,eACA,aAAa,QACf;EACA,IAAI,CAAC,cAAc,SAAS,QAAQ,OAAO,WAAW,GACpD,OAAO;EAET,OAAO,SAAS;CAClB,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,kBAAkB,UAChC,MAAM,WAAW,cAAc,OAAO,QAAQ,IAAI,IAAI,OAAO,KAAK,KAAK,CACzE,CACF,CACF;CAEA,MAAM,cAAc,OAAO,GAAG,0BAA0B,CAAC,EAAE,SACzD,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,OAAO,aAAa,IAAI;EACvC,IAAI,WAAW,MACb,OAAO,OAAO,OAAO,KACnBJ,UACE,eACA,eAAe,KAAK,mEACpB,EAAE,QAAQ,YAAY,CACxB,CACF;EAEF,OAAO,OAAOK,SAAkB,OAAO,IAAI,CAAC,CAAC,KAC3C,OAAO,UAAU,UACfL,UAAQ,eAAe,4CAA4C,MAAM,SAAS,CACpF,CACF;CACF,CAAC,CACH;CAEA,MAAM,cAAc,OAAO,GAAG,0BAA0B,CAAC,EAAE,aACzD,OAAO,IAAI,aAAa;EACtB,MAAM,cAAc,OAAO,YAAY,QAAQ;EAC/C,MAAM,UAAqC,CAAC;EAC5C,IAAI,QAAuB;EAC3B,OAAO,MAAM;GACX,MAAM,SAAiC,EAAE,OAAO,MAAM;GACtD,IAAI,UAAU,MAAM,OAAO,QAAQ,OAAO,KAAK;GAC/C,MAAM,EAAE,MAAM,aAAa,OAAO,QAChC,YAAY,eAAe,mBAAmB,WAAW,EAAE,WAAW,MAAM,GAC5E,aACF;GACA,MAAM,WAAW,OAAO,OAAOM,oBAA6B,MAAM,eAAe,QAAQ;GACzF,QAAQ,KACN,GAAI,OAAO,OAAO,QAAQ,SAAS,UAAU,WAC3CC,SAAe,aAAa,MAAM,CACpC,CACF;GACA,MAAM,OAAO,SAAS,YAAY,QAAQ;GAC1C,IAAI,SAAS,MACX,OAAO,QAAQ,QACZ,WAAW,OAAO,SAAS,YAAY,OAAO,KAAK,SAAS,IAAI,UAAU,CAC7E;GAEF,QAAQ;EACV;CACF,CAAC,CACH;CAEA,MAAM,eAAe,OAAO,GAAG,2BAA2B,CAAC,EACxD,UAAiC,WAChC,OAAO,IAAI,aAAa;EACtB,MAAM,cAAc,OAAO,YAAY,QAAQ;EAC/C,MAAM,OAAO,OAAO,OAAO,IAAI;GAC7B,WAAWC,OAAe,aAAa,MAAM;GAC7C,QAAQ,UACN,iBAAiBC,QACb,QACAT,UAAQ,gBAAgB,sCAAsC,EAC5D,QAAQ,UACV,CAAC;EACT,CAAC;EACD,MAAM,SAAS,OAAO,QACpB,YAAY,eAAe,mBAAmB,WAAW,EAAE,SAAS,GACpE,gBACA;GAAE,MAAM,KAAK,UAAU,IAAI;GAAG,QAAQ;EAAO,CAC/C;EAOA,OAAO,EAAE,mBAAkB,OANH,OACtBU,sBACA,OAAO,MACP,gBACA,OAAO,QACT,EAAA,CACoC,IAAI;CAC1C,CAAC,CACL;CAEA,MAAM,YAAY,OAAO,GAAG,wBAAwB,CAAC,EAClD,UAAiC,qBAChC,OAAO,IAAI,aAAa;EACtB,MAAM,cAAc,OAAO,YAAY,QAAQ;EAC/C,IAAI,QAAuB;EAC3B,OAAO,MAAM;GACX,MAAM,SAAiC,EAAE,OAAO,MAAM;GACtD,IAAI,UAAU,MAAM,OAAO,QAAQ,OAAO,KAAK;GAC/C,MAAM,EAAE,MAAM,aAAa,OAAO,QAChC,YAAY,eAAe,mBAAmB,WAAW,EAAE,WAAW,MAAM,GAC5E,WACF;GACA,MAAM,WAAW,OAAO,OAAOJ,oBAA6B,MAAM,aAAa,QAAQ;GACvF,MAAM,SAAS,SAAS,QAAQ,MAAM,EAAE,SAAS,OAAO,gBAAgB;GACxE,IAAI,WAAW,KAAA,GAAW,OAAO,OAAOC,SAAe,aAAa,MAAM;GAC1E,MAAM,OAAO,SAAS,YAAY,QAAQ;GAC1C,IAAI,SAAS,MAAM,OAAO;GAC1B,QAAQ;EACV;CACF,CAAC,CACL;CA4EA,OAAO;EACL,IAAI;EACJ;EACA,cA7EmB,OAAO,GAAG,2BAA2B,CAAC,EACxD,UAAiC,qBAChC,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO,YAAY,QAAQ;GAC/C,OAAO,QACL,YACE,eAAe,mBAAmB,WAAW,EAAE,WAAW,mBAAmB,gBAAgB,GAC/F,GACA,gBACA,EAAE,QAAQ,SAAS,CACrB;EACF,CAAC,CAkEQ;EACX;EACA,cAjEmB,OAAO,GAAG,2BAA2B,CAAC,OACzD,OAAO,IAAI,aAAa;GACtB,MAAM,aAAa,OAAO,QAAQ,IAAI,IAAI,GAAG,QAAQ,SAAS,GAAG,cAAc;GAC/E,MAAM,EAAE,SAAS,OAAO,OACtBI,cACA,WAAW,MACX,gBACA,WAAW,QACb;GACA,MAAM,QAAQ,OAAO,SAAS;GAC9B,OAAO,CACL;IAAE,IAAI,KAAK;IAAI,MAAM,KAAK,QAAQ,KAAK;IAAU,MAAM;GAAoB,GAC3E,GAAG,MAAM,KAAK,UAAU;IACtB,IAAI,KAAK;IACT,MAAM,KAAK,QAAQ,KAAK;IACxB,MAAM;GACR,EAAE,CACJ;EACF,CAAC,CA+CU;EACX;EACA,WA9CgB,OAAO,GAAG,wBAAwB,CAAC,EAAE,QAAwB,CAAC,MAC9E,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,OAAO,WAAW,EAAA,CAAG,QACnC,WACC,cAAc,MAAM,MAAM,MAAM,SAAS,KAAA,KAAa,OAAO,SAAS,MAAM,KAChF;GACA,IAAI,QAAQ,SAAS,KAAK,MAAM,SAAS,KAAA,GACvC,OAAO,OAAO,OAAO,QAAQ,SAAS,WAAW;GAEnD,MAAM,aAAa,OAAO,aAAa,MAAM,IAAI;GACjD,OAAO,eAAe,OAAO,CAAC,IAAI,CAAC,OAAO,YAAY,UAAU,CAAC;EACnE,CAAC,CAmCO;EACR,eAjCoB,OAAO,GAAG,4BAA4B,CAAC,OAC3D,OAAO,IAAI,aAAa;GACtB,IAAI;GACJ,IAAI,QAAQ,QAAQ,SAAS,QAAQ;IACnC,OAAO,WAAW;IAClB,YAAY,QAAQ,QAAQ;GAC9B,OAAO;IACL,MAAM,SAAS,OAAO,QAAQ,IAAI,IAAI,GAAG,QAAQ,SAAS,GAAG,eAAe;IAC5E,MAAM,EAAE,SAAS,OAAO,OACtBA,cACA,OAAO,MACP,iBACA,OAAO,QACT;IACA,YAAY,KAAK;GACnB;GACA,OAAO;IACL;IACA,cAAc,QAAQ;IACtB,WAAW;IACX,QAAQ,CAAC;GACX;EACF,CAAC,CAWW;CACd;AACF;AAEA,SAAS,cACP,QACA,wBAA8D,OAAO,aAC5D;CACT,OACE,0BAA0B,gBAC1B,OAAO,SAAS,QAChB,OAAO,oBAAoB,SAAS;AAExC;AAEA,MAAM,cAAc,OAAO,GAAG,0BAA0B,CAAC,EAAE,WACzD,OAAO,IAAI,aAAa;CACtB,MAAM,OAAO,OAAON,SAAkB,OAAO,IAAI,CAAC,CAAC,KACjD,OAAO,UAAU,UAAUL,UAAQ,aAAa,MAAM,SAAS,EAAE,QAAQ,WAAW,CAAC,CAAC,CACxF;CACA,MAAM,cAAc,OAAO,OAAO,QAAQ,OAAO,sBAAsB,eACrEK,SAAkB,UAAU,CAAC,CAAC,KAC5B,OAAO,UAAU,UAAUL,UAAQ,aAAa,MAAM,SAAS,EAAE,QAAQ,WAAW,CAAC,CAAC,CACxF,CACF;CACA,OAAO;EACL,WAAW,OAAO,UAAU,OAAO;EACnC,IAAI,OAAO;EACX;EACA;EACA,QAAQ,OAAO,WAAW,WAAW;CACvC;AACF,CAAC,CACH;AAEA,SAAS,OACP,QACA,OACA,WACA,UACqC;CACrC,OAAOY,OAAE,oBAAoB,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAC1C,OAAO,UAAU,UACfZ,UAAQ,WAAW,mDAAmD,MAAM,WAAW;EACrF,QAAQ;EACR,QAAQ,SAAS;CACnB,CAAC,CACH,CACF;AACF;AAEA,SAAS,WAAW,OAAgB,WAAmB,UAAuC;CAC5F,MAAM,SAASY,OAAE,oBAAoBC,aAAsB,CAAC,CAAC,KAAK;CAClE,OAAOb,UACL,WACA,OAAO,SAAS,SACZ,OAAO,MAAM,MAAM,UACnB,mCAAmC,SAAS,UAChD;EACE,GAAI,OAAO,SAAS,SAAS,EAAE,MAAM,OAAO,MAAM,MAAM,KAAK,IAAI,CAAC;EAClE,QAAQ,OAAO,SAAS,QAAQ,OAAO,SAAS,SAAS,OAAO,MAAM,MAAM,OAAO,KAAA,CAAS;EAC5F,GAAG,UAAU,UAAU,OAAO,SAAS,SAAS,OAAO,MAAM,QAAQ,KAAA,CAAS;EAC9E,QAAQ,SAAS;CACnB,CACF;AACF;AAEA,SAAS,OAAO,QAAgB,MAAwC;CACtE,IAAI,WAAW,OAAO,SAAS,iBAAiB,OAAO;CACvD,IAAI,WAAW,KAAK,OAAO;CAC3B,IAAI,WAAW,OAAO,SAAS,aAAa,OAAO;CACnD,IAAI,WAAW,OAAO,SAAS,YAAY,OAAO;CAClD,IAAI,WAAW,OAAO,SAAS,gBAAgB,OAAO;CACtD,IAAI,UAAU,KAAK,OAAO;CAC1B,OAAO;AACT;AAEA,SAAS,UACP,UACA,QACkD;CAClD,MAAM,UAAU,QAAQ,OAAO;CAC/B,MAAM,SAAS,SAAS,QAAQ,IAAI,mBAAmB;CACvD,MAAM,QAAQ,YAAY,WAAW,OAAO,KAAA,IAAY,OAAO,MAAM,IAAI;CACzE,OAAO,UAAU,KAAA,KAAa,CAAC,OAAO,SAAS,KAAK,IAChD,CAAC,IACD,EAAE,cAAc,KAAK,IAAI,GAAG,QAAQ,KAAK,IAAI,CAAC,EAAE;AACtD;AAEA,SAASA,UACP,WACA,SACA,SAA0F,CAAC,GACxE;CACnB,OAAO,IAAIS,MAAkB;EAAE,GAAG;EAAQ;EAAS;EAAW,YAAY;CAAS,CAAC;AACtF;;;;;;;;;;;;;AC3bA,MAAMK,YAAUC,OAAE,YAAY;CAC5B,UAAU,EAAE,gBAAgBA,OAAE,OAAOA,OAAE,MAAM,EAAE;CAC/C,MAAM;EAAE,gBAAgBA,OAAE,OAAOA,OAAE,MAAM;EAAG,QAAQA,OAAE;CAAO;AAC/D,CAAC;AAED,MAAa,eAAeC,MAAsB,aAAaF,SAAO;;AAGtE,SAAgB,YACd,cAC+E;CAC/E,OAAO;EACL,MAAM;EACN,cAAc,CAAC,GAAG,YAAY;EAC9B,iBAAiB;CACnB;AACF;;AAQA,SAAgB,kBACd,SACgC;CAChC,OAAO;EACL,MAAM;EACN,cAAc,CAAC,GAAG,QAAQ,YAAY;EACtC,YAAY,mCAAmC,mBAAmB,QAAQ,IAAI,EAAE;EAChF,eAAe;CACjB;AACF;;AAGA,SAAgB,SAAS,SAA0D;CACjF,OAAO;EACL,SAAS,CAAC,YAAY,QAAQ,YAAY,GAAG,kBAAkB,OAAO,CAAC;EACvE,YAAY;CACd;AACF;;AAmBA,MAAa,eAAe,OAAO,GAAG,yBAAyB,CAAC,EAAE,YAChE,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,QAAQ,SAAS,WAAW;CAC1C,MAAM,WAAW,QAAQ,WAAW,yBAAA,CAA0B,QAAQ,OAAO,EAAE;CAC/E,MAAM,OAAO,IAAI,gBAAgB;EAC/B,WAAW,QAAQ;EACnB,eAAe,QAAQ,aAAa,OAAO;EAC3C,MAAM,QAAQ,KAAK,OAAO;EAC1B,cAAc,QAAQ;CACxB,CAAC;CACD,MAAM,WAAW,OAAO,OAAO,WAAW;EACxC,WACE,MAAM,GAAG,QAAQ,sBAAsB;GACrC;GACA,SAAS;IACP,QAAQ;IACR,gBAAgB;GAClB;GACA,QAAQ;EACV,CAAC;EACH,aAAa,QAAQ,gBAAgB,gCAAgC,WAAW;CAClF,CAAC;CACD,MAAM,QAAQ,OAAO,OAAO,WAAW;EACrC,WAAW,SAAS,KAAK;EACzB,aACE,QACE,gBACA,SAAS,KACL,8CACA,0CAA0C,SAAS,UACvD,SAAS,KAAK,aAAa,SAAS,WAAW,MAAM,mBAAmB,WACxE,SAAS,MACX;CACJ,CAAC;CACD,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,SAASC,OAAE,oBAAoBE,aAAsB,CAAC,CAAC,KAAK;EAClE,OAAO,OAAO,OAAO,KACnB,QACE,gBACA,OAAO,SAAS,SACZ,OAAO,MAAM,MAAM,UACnB,0CAA0C,SAAS,UACvD,SAAS,WAAW,MAAM,mBAAmB,WAC7C,SAAS,QACT,OAAO,SAAS,SAAS,OAAO,MAAM,MAAM,OAAO,KAAA,CACrD,CACF;CACF;CACA,MAAM,QAAQ,OAAOF,OAAE,oBAAoBG,gBAAyB,CAAC,CAAC,KAAK,CAAC,CAAC,KAC3E,OAAO,UAAU,UACf,QACE,gBACA,yDAAyD,MAAM,WAC/D,YACA,SAAS,MACX,CACF,CACF;CACA,OAAO;EACL,aAAaC,OAAY,MAAM,YAAY;EAC3C,SACE,MAAM,YAAY,OACb,EAAE,MAAM,WAAW,IACnB;GAAE,MAAM;GAAQ,QAAQ,MAAM;EAAQ;EAC7C,gBAAgB,MAAM,mBAAmB;EACzC,QAAQ,MAAM;CAChB;AACF,CAAC,CACH;;AAOA,SAAgB,sBACd,SACwD;CACxD,MAAM,uBAAuB,CAAC,GAAG,QAAQ,YAAY;CACrD,OAAA,OAAyB,MAAM;EAC7B,cAAc,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAAW,OAAO;GACxE,MAAM,YAAY,OAAOC,KAAY;IAAE,GAAG;IAAS;GAAM,CAAC,CAAC,CAAC,cAAc;GAC1E,MAAM,aAAa,IAAI,KAAK,OAAO,MAAM,iBAAiB;GAC1D,OAAO;IACL,oBAAoB,UAAU,aAAa,KAAK,gBAAgB;KAC9D;KACA,UAAA,SAAyC,aAAa,EAAE,WAAW,CAAC;IACtE,EAAE;IACF,YAAY;KAAE,aAAa;KAAO,cAAc;KAAM,WAAW;IAAS;IAC1E,WAAW,UAAU;IACrB,mBAAmB,UAAU;IAC7B,iBAAiB,OAAO,aAAa,OACnC,QAAQ,QAAQ,SAAS,SACrB;KAAE,MAAM;KAAQ,gBAAgB;KAAM,QAAQ,QAAQ,QAAQ;IAAO,IACrE;KAAE,MAAM;KAAY,gBAAgB;IAAK,CAC/C;IACA,QAAQ,CAAC,GAAG,UAAU,MAAM;GAC9B;EACF,CAAC;EACD,YAAY;EACZ;EACA,OAAO,QAAQ;CACjB,CAAC;AACH;;AAGA,MAAa,4BAA4B,OAAO,GAAG,sCAAsC,CAAC,CACxF,WACE,SAGA;CACA,MAAM,YAAY,OAAO,aAAa,OAAO;CAC7C,MAAM,aAAa,IAAI,KAAK,OAAO,MAAM,iBAAiB;CAC1D,OAAO;EACL,oBAAoB,QAAQ,aAAa,KAAK,gBAAgB;GAC5D;GACA,UAAA,SAAyC,aAAa,EAAE,WAAW,CAAC;EACtE,EAAE;EACF,YAAY;GACV,aAAa,UAAU;GACvB,cAAc;GACd,WAAW;EACb;EACA,WAAW;EACX,mBACE,UAAU,QAAQ,SAAS,SAAS,UAAU,QAAQ,SAAS,UAAU;EAC3E,iBAAiB,OAAO,aAAa,OACnC,UAAU,QAAQ,SAAS,SACvB;GACE,MAAM;GACN,gBAAgB,UAAU;GAC1B,QAAQ,UAAU,QAAQ;EAC5B,IACA;GAAE,MAAM;GAAY,gBAAgB,UAAU;EAAe,CACnE;EACA,QAAQ,CAAC;CACX;AACF,CACF;;AAMA,SAAgB,gBAAgB,SAA6D;CAC3F,MAAM,SAAS,kBAAkB,OAAO;CACxC,MAAM,UAAUL,OAAE,eAAeA,OAAE,OAAO,EAAE,OAAOA,OAAE,OAAO,CAAC,CAAC;CAC9D,OAAO;EACL,UAAU,OAAO,GAAG,qCAAqC,CAAC,CAAC,WAAW,SAAS,aAAa;GAC1F,MAAM,eAAe,OAAOA,OAAE,oBAAoB,OAAO,CAAC,CAAC,QAAQ,OAAO,CAAC,CAAC,CAAC,KAC3E,OAAO,eAEH,IAAIM,QAAiB;IACnB,UAAU;IACV,SAAS;IACT,WAAW;IACX,OAAO;GACT,CAAC,CACL,CACF;GACA,MAAM,OAAO,YAAY,aAAa,IAAI,MAAM;GAChD,IAAI,YAAY,aAAa,IAAI,OAAO,MAAM,aAAa,SAAS,SAAS,MAC3E,OAAO,OAAO,IAAIA,QAAiB;IACjC,UAAU;IACV,SAAS;IACT,WAAW;IACX,OAAO;GACT,CAAC;GAEH,OAAO,OAAO,0BAA0B;IACtC,GAAI,QAAQ,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;IACpE,cAAc,QAAQ;IACtB,UAAU,QAAQ;IAClB,cAAc,QAAQ;IACtB,MAAMF,OAAY,IAAI;IACtB,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;IAC9D,aAAa,QAAQ;GACvB,CAAC;EACH,CAAC;EACD,QAAQ;EACR,YAAY;EACZ,sBAAsB,CAAC,GAAG,QAAQ,YAAY;EAC9C,QAAQ,mBAAmB;GACzB,MAAM,mBAAmB,IAAI,IAAI,OAAO,UAAU;GAClD,iBAAiB,aAAa,IAAI,UAAU,UAAU;GACtD,iBAAiB,aAAa,IAAI,SAAS,cAAc;GACzD,OAAO,OAAO,QAAQ;IACpB;IACA,SAASA,OAAY,KAAK,UAAU,EAAE,OAAO,eAAe,CAAC,CAAC;GAChE,CAAC;EACH;CACF;AACF;AAEA,SAAS,QACP,WACA,SACA,QACA,QACA,MACmB;CACnB,OAAO,IAAIG,MAAkB;EAC3B,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK;EACrC;EACA;EACA,YAAY;EACZ;EACA,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;CAC3C,CAAC;AACH"}
+{"version":3,"file":"auth-g-waCHcz.mjs","names":["S","decode","DomainName.decode","DnsRecord.decode","failure","S","DnsRecord.Opaque","DnsProvider.Error","failure","Protocol.TeamListEnvelope","Protocol.DomainListEnvelope","Protocol.DomainConfig","Protocol.DomainEnvelope","DomainName.decode","Protocol.RecordListEnvelope","Records.decode","Records.encode","DnsProvider.Error","Protocol.CreateRecordEnvelope","Protocol.UserEnvelope","S","Protocol.ErrorEnvelope","Context","S","ProviderContext.codec","Protocol.ErrorEnvelope","Protocol.IntegrationToken","Secret.make","Client.make","Connection.Error","DnsProvider.Error"],"sources":["../src/providers/vercel/protocol.ts","../src/providers/vercel/records.ts","../src/providers/vercel/client.ts","../src/providers/vercel/auth.ts"],"sourcesContent":["import { Schema as S } from \"effect\";\n\nexport const Pagination = S.Struct({\n  count: S.Number,\n  next: S.NullOr(S.Number),\n  prev: S.NullOr(S.Number),\n});\nexport interface Pagination extends S.Schema.Type<typeof Pagination> {}\n\nexport const ErrorDetail = S.Struct({\n  code: S.String,\n  message: S.String,\n  limit: S.optionalKey(\n    S.Struct({\n      remaining: S.Number,\n      reset: S.optionalKey(S.Number),\n      resetMs: S.optionalKey(S.Number),\n      total: S.Number,\n    }),\n  ),\n});\nexport interface ErrorDetail extends S.Schema.Type<typeof ErrorDetail> {}\n\nexport const ErrorEnvelope = S.Struct({ error: ErrorDetail });\n\nexport const User = S.Struct({\n  id: S.String,\n  name: S.NullOr(S.String),\n  username: S.String,\n});\nexport interface User extends S.Schema.Type<typeof User> {}\n\nexport const UserEnvelope = S.Struct({ user: User });\n\nexport const Team = S.Struct({\n  id: S.String,\n  name: S.NullOr(S.String),\n  slug: S.String,\n});\nexport interface Team extends S.Schema.Type<typeof Team> {}\n\nexport const TeamListEnvelope = S.Struct({\n  pagination: Pagination,\n  teams: S.Array(Team),\n});\n\nexport const Domain = S.Struct({\n  id: S.String,\n  intendedNameservers: S.Array(S.String),\n  name: S.String,\n  nameservers: S.Array(S.String),\n  serviceType: S.Literals([\"zeit.world\", \"external\", \"na\"]),\n  teamId: S.NullOr(S.String),\n  userId: S.String,\n  verified: S.Boolean,\n  zone: S.optionalKey(S.Boolean),\n});\nexport interface Domain extends S.Schema.Type<typeof Domain> {}\n\nexport const DomainConfig = S.Struct({\n  misconfigured: S.Boolean,\n  serviceType: S.Literals([\"zeit.world\", \"external\", \"na\"]),\n});\nexport interface DomainConfig extends S.Schema.Type<typeof DomainConfig> {}\n\nexport const DomainEnvelope = S.Struct({ domain: Domain });\n\nexport const DomainListEnvelope = S.Struct({\n  domains: S.Array(Domain),\n  pagination: Pagination,\n});\n\nexport const Record = S.Struct({\n  id: S.String,\n  mxPriority: S.optionalKey(S.Number),\n  name: S.String,\n  priority: S.optionalKey(S.Number),\n  ttl: S.optionalKey(S.Number),\n  type: S.String,\n  value: S.String,\n});\nexport interface Record extends S.Schema.Type<typeof Record> {}\n\nexport const RecordListEnvelope = S.Struct({\n  pagination: S.optionalKey(Pagination),\n  records: S.Array(Record),\n});\n\nexport const CreateRecordEnvelope = S.Struct({\n  uid: S.String,\n  updated: S.optionalKey(S.Number),\n});\n\nexport const IntegrationToken = S.Struct({\n  access_token: S.String,\n  installation_id: S.optionalKey(S.String),\n  team_id: S.NullOr(S.String),\n  token_type: S.optionalKey(S.String),\n  user_id: S.String,\n});\nexport interface IntegrationToken extends S.Schema.Type<typeof IntegrationToken> {}\n","import { Effect, Schema as S } from \"effect\";\n\nimport * as DomainName from \"../../domain/domain-name.ts\";\nimport * as DnsRecord from \"../../domain/dns-record.ts\";\nimport * as DnsProvider from \"../../provider/provider.ts\";\nimport type * as Protocol from \"./protocol.ts\";\n\nexport type CreateBody = Readonly<Record<string, unknown>>;\n\nexport const decode = Effect.fn(\"VercelRecords.decode\")(\n  (zone: DomainName.DomainName, record: Protocol.Record) =>\n    Effect.gen(function* () {\n      const absolute = absoluteNameCandidate(zone, record.name);\n      const name = yield* DomainName.decode(absolute).pipe(\n        Effect.match({ onFailure: () => null, onSuccess: (value) => value }),\n      );\n      if (name === null) return yield* decodeOpaque(record, absolute);\n      const common = {\n        metadata: {\n          ownership: \"provider\",\n          provenance: \"vercel\",\n          purpose: \"existing DNS record\",\n        },\n        name,\n        policy: record.type === \"CNAME\" ? \"exclusive\" : \"append\",\n        ttl: record.ttl ?? 60,\n      } as const;\n      const fromRecord = (input: unknown) =>\n        DnsRecord.decode(input).pipe(\n          Effect.mapError((cause) => failure(\"decodeRecord\", cause.message)),\n        );\n\n      switch (record.type) {\n        case \"A\":\n        case \"AAAA\":\n          return yield* fromRecord({ ...common, _tag: record.type, address: record.value });\n        case \"CNAME\":\n        case \"NS\":\n          return yield* fromRecord({ ...common, _tag: record.type, target: record.value });\n        case \"TXT\":\n          return yield* fromRecord({ ...common, _tag: \"TXT\", value: record.value });\n        case \"MX\":\n          return yield* fromRecord({\n            ...common,\n            _tag: \"MX\",\n            exchange: record.value,\n            priority: record.mxPriority ?? record.priority,\n          });\n        case \"CAA\": {\n          const match = record.value.match(\n            /^(\\d{1,3})\\s+(issue|issuewild|iodef)\\s+(?:\"((?:\\\\.|[^\"])*)\"|(\\S.*))$/,\n          );\n          if (match === null) {\n            return yield* Effect.fail(\n              failure(\"decodeRecord\", \"Vercel CAA record has an invalid value\"),\n            );\n          }\n          return yield* fromRecord({\n            ...common,\n            _tag: \"CAA\",\n            flags: Number(match[1]),\n            tag: match[2],\n            value: unescapeQuoted(match[3] ?? match[4] ?? \"\"),\n          });\n        }\n        case \"SRV\": {\n          const parts = record.value.trim().split(/\\s+/);\n          const [priority, weight, port, target] =\n            parts.length === 4\n              ? parts\n              : [String(record.priority ?? \"\"), parts[0], parts[1], parts[2]];\n          return yield* fromRecord({\n            ...common,\n            _tag: \"SRV\",\n            port: Number(port),\n            priority: Number(priority),\n            target,\n            weight: Number(weight),\n          });\n        }\n        default:\n          return yield* decodeOpaque(record, name);\n      }\n    }),\n);\n\nconst decodeOpaque = Effect.fn(\"VercelRecords.decodeOpaque\")(\n  (record: Protocol.Record, name: string) =>\n    S.decodeUnknownEffect(DnsRecord.Opaque)({\n      _tag: \"Opaque\",\n      name,\n      providerRecordId: record.id,\n      providerType: record.type,\n    }).pipe(Effect.mapError((cause) => failure(\"decodeRecord\", cause.message))),\n);\n\nexport function encode(zone: DomainName.DomainName, record: DnsRecord.DnsRecord): CreateBody {\n  const common = {\n    name: relativeName(zone, record.name),\n    ...(record.ttl === null ? {} : { ttl: record.ttl }),\n    type: record._tag,\n  };\n  switch (record._tag) {\n    case \"A\":\n    case \"AAAA\":\n      return { ...common, value: record.address };\n    case \"CNAME\":\n    case \"NS\":\n      return { ...common, value: record.target };\n    case \"TXT\":\n      return { ...common, value: record.value };\n    case \"MX\":\n      return { ...common, mxPriority: record.priority, value: record.exchange };\n    case \"CAA\":\n      return {\n        ...common,\n        value: `${record.flags} ${record.tag} \"${escapeQuoted(record.value)}\"`,\n      };\n    case \"SRV\":\n      return {\n        ...common,\n        srv: {\n          port: record.port,\n          priority: record.priority,\n          target: record.target,\n          weight: record.weight,\n        },\n      };\n  }\n}\n\nfunction absoluteNameCandidate(zone: DomainName.DomainName, name: string): string {\n  return name === \"\" || name === \"@\"\n    ? zone\n    : name === zone || name.endsWith(`.${zone}`)\n      ? name\n      : `${name}.${zone}`;\n}\n\nfunction relativeName(zone: DomainName.DomainName, name: DomainName.DomainName): string {\n  if (name === zone) return \"\";\n  const suffix = `.${zone}`;\n  if (!name.endsWith(suffix)) {\n    throw failure(\"encodeRecord\", `DNS record ${name} is outside Vercel zone ${zone}`, {\n      reason: \"request\",\n    });\n  }\n  return name.slice(0, -suffix.length);\n}\n\nfunction escapeQuoted(value: string): string {\n  return value.replaceAll(\"\\\\\", \"\\\\\\\\\").replaceAll('\"', '\\\\\"');\n}\n\nfunction unescapeQuoted(value: string): string {\n  return value.replace(/\\\\([\\\\\"])/g, \"$1\");\n}\n\nfunction failure(\n  operation: string,\n  message: string,\n  fields: Partial<Pick<DnsProvider.Error, \"reason\">> = {},\n): DnsProvider.Error {\n  return new DnsProvider.Error({\n    message,\n    operation,\n    providerId: \"vercel\",\n    reason: fields.reason ?? \"response\",\n  });\n}\n","import { Effect, Schema as S } from \"effect\";\n\nimport type * as ProviderAuth from \"../../auth/manifest.ts\";\nimport type * as Secret from \"../../auth/secret.ts\";\nimport * as DomainName from \"../../domain/domain-name.ts\";\nimport type * as DnsRecord from \"../../domain/dns-record.ts\";\nimport type * as ZoneDiscovery from \"../../discovery/zone-discovery.ts\";\nimport * as DnsProvider from \"../../provider/provider.ts\";\nimport * as Protocol from \"./protocol.ts\";\nimport * as Records from \"./records.ts\";\n\nexport type Fetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;\n\n/** Selects whether Vercel requests operate on a personal account or a team. */\nexport type AccountContext =\n  | { readonly _tag: \"personal\" }\n  | { readonly _tag: \"team\"; readonly teamId: string };\n\n/** Configuration for an Effect-native Vercel authoritative-DNS client. */\nexport interface Options {\n  readonly baseUrl?: string;\n  /** Capabilities the host required when issuing or authorizing this credential. */\n  readonly capabilities: ProviderAuth.TokenValidation[\"capabilities\"];\n  readonly context: AccountContext;\n  readonly fetch?: Fetch;\n  readonly token: Secret.Value;\n}\n\nexport interface ListZonesInput {\n  readonly name?: DomainName.DomainName;\n}\n\n/** A Vercel account visible to the supplied credential. */\nexport interface Account {\n  readonly id: string;\n  readonly name: string;\n  readonly type: \"personal\" | \"team\";\n}\n\n/** A Vercel-managed authoritative zone with normalized nameserver evidence. */\nexport interface Zone {\n  readonly accountId: string;\n  readonly id: string;\n  readonly name: DomainName.DomainName;\n  readonly nameservers: ReadonlyArray<DomainName.DomainName>;\n  readonly status: \"active\" | \"pending\";\n}\n\nexport interface Interface extends DnsProvider.Interface {\n  readonly listAccounts: () => Effect.Effect<ReadonlyArray<Account>, DnsProvider.Error>;\n  readonly listZones: (\n    input?: ListZonesInput,\n  ) => Effect.Effect<ReadonlyArray<Zone>, DnsProvider.Error>;\n  readonly validateToken: () => Effect.Effect<ProviderAuth.TokenValidation, DnsProvider.Error>;\n}\n\n/** Exposes Vercel zone lookup as the optional provider discovery capability. */\nexport function discovery(client: Interface): ZoneDiscovery.Source {\n  return {\n    listZones: (name) => client.listZones({ name }),\n    provider: client,\n  };\n}\n\n/** Creates an Effect-native Vercel client without owning the credential lifecycle. */\nexport function make(options: Options): Interface {\n  const fetch = options.fetch ?? globalThis.fetch;\n  const baseUrl = (options.baseUrl ?? \"https://api.vercel.com\").replace(/\\/$/, \"\");\n\n  const withContext = (path: string, values: Readonly<Record<string, string>> = {}) => {\n    const url = new URL(`${baseUrl}${path}`);\n    for (const [key, value] of Object.entries(values)) url.searchParams.set(key, value);\n    if (options.context._tag === \"team\") url.searchParams.set(\"teamId\", options.context.teamId);\n    return url;\n  };\n\n  const request = Effect.fn(\"VercelClient.request\")(\n    (url: URL, operation: string, init?: RequestInit) =>\n      Effect.gen(function* () {\n        const response = yield* Effect.tryPromise({\n          try: () =>\n            fetch(url, {\n              ...init,\n              headers: {\n                Accept: \"application/json\",\n                Authorization: `Bearer ${options.token.expose()}`,\n                ...(init?.body === undefined ? {} : { \"Content-Type\": \"application/json\" }),\n                ...init?.headers,\n              },\n            }),\n          catch: () => failure(operation, \"Vercel request failed\", { reason: \"transport\" }),\n        });\n        const body = yield* Effect.tryPromise({\n          try: () => response.json() as Promise<unknown>,\n          catch: () =>\n            failure(\n              operation,\n              response.ok\n                ? \"Vercel returned a non-JSON response\"\n                : `Vercel request failed with HTTP ${response.status}`,\n              {\n                reason: response.ok ? \"response\" : reason(response.status),\n                ...rateLimit(response),\n                status: response.status,\n              },\n            ),\n        });\n        if (!response.ok) return yield* Effect.fail(apiFailure(body, operation, response));\n        return { body, response } as const;\n      }),\n  );\n\n  const allTeams = Effect.fn(\"VercelClient.allTeams\")(() =>\n    Effect.gen(function* () {\n      const teams: Array<Protocol.Team> = [];\n      let until: number | null = null;\n      while (true) {\n        const url = new URL(`${baseUrl}/v2/teams`);\n        url.searchParams.set(\"limit\", \"100\");\n        if (until !== null) url.searchParams.set(\"until\", String(until));\n        const { body, response } = yield* request(url, \"listAccounts\");\n        const envelope = yield* decode(Protocol.TeamListEnvelope, body, \"listAccounts\", response);\n        teams.push(...envelope.teams);\n        if (envelope.pagination.next === null) return teams;\n        until = envelope.pagination.next;\n      }\n    }),\n  );\n\n  const allDomains = Effect.fn(\"VercelClient.allDomains\")(() =>\n    Effect.gen(function* () {\n      const domains: Array<Protocol.Domain> = [];\n      let until: number | null = null;\n      while (true) {\n        const values: Record<string, string> = { limit: \"100\" };\n        if (until !== null) values.until = String(until);\n        const { body, response } = yield* request(withContext(\"/v5/domains\", values), \"listZones\");\n        const envelope = yield* decode(Protocol.DomainListEnvelope, body, \"listZones\", response);\n        domains.push(...envelope.domains);\n        if (envelope.pagination.next === null) return domains;\n        until = envelope.pagination.next;\n      }\n    }),\n  );\n\n  const discoverZone = Effect.fn(\"VercelClient.discoverZone\")((name: DomainName.DomainName) =>\n    Effect.gen(function* () {\n      const configResult = yield* request(\n        withContext(`/v6/domains/${encodeURIComponent(name)}/config`),\n        \"resolveZone\",\n      );\n      const config = yield* decode(\n        Protocol.DomainConfig,\n        configResult.body,\n        \"resolveZone\",\n        configResult.response,\n      );\n      const domainResult = yield* request(\n        withContext(`/v5/domains/${encodeURIComponent(name)}`),\n        \"resolveZone\",\n      );\n      const envelope = yield* decode(\n        Protocol.DomainEnvelope,\n        domainResult.body,\n        \"resolveZone\",\n        domainResult.response,\n      );\n      if (!hasDnsStorage(envelope.domain, config.serviceType)) {\n        return null;\n      }\n      return envelope.domain;\n    }).pipe(\n      Effect.catchTag(\"ProviderError\", (cause) =>\n        cause.reason === \"not_found\" ? Effect.succeed(null) : Effect.fail(cause),\n      ),\n    ),\n  );\n\n  const resolveZone = Effect.fn(\"VercelClient.resolveZone\")((name: DomainName.DomainName) =>\n    Effect.gen(function* () {\n      const domain = yield* discoverZone(name);\n      if (domain === null) {\n        return yield* Effect.fail(\n          failure(\n            \"resolveZone\",\n            `Vercel zone ${name} is not configured for authoritative DNS in the selected account`,\n            { reason: \"not_found\" },\n          ),\n        );\n      }\n      return yield* DomainName.decode(domain.name).pipe(\n        Effect.mapError((cause) =>\n          failure(\"resolveZone\", `Vercel returned an invalid storage zone: ${cause.message}`),\n        ),\n      );\n    }),\n  );\n\n  const listRecords = Effect.fn(\"VercelClient.listRecords\")((zoneName: DomainName.DomainName) =>\n    Effect.gen(function* () {\n      const storageZone = yield* resolveZone(zoneName);\n      const records: Array<DnsRecord.Observed> = [];\n      let until: number | null = null;\n      while (true) {\n        const values: Record<string, string> = { limit: \"100\" };\n        if (until !== null) values.until = String(until);\n        const { body, response } = yield* request(\n          withContext(`/v5/domains/${encodeURIComponent(storageZone)}/records`, values),\n          \"listRecords\",\n        );\n        const envelope = yield* decode(Protocol.RecordListEnvelope, body, \"listRecords\", response);\n        records.push(\n          ...(yield* Effect.forEach(envelope.records, (record) =>\n            Records.decode(storageZone, record),\n          )),\n        );\n        const next = envelope.pagination?.next ?? null;\n        if (next === null) {\n          return records.filter(\n            (record) => record.name === zoneName || record.name.endsWith(`.${zoneName}`),\n          );\n        }\n        until = next;\n      }\n    }),\n  );\n\n  const createRecord = Effect.fn(\"VercelClient.createRecord\")(\n    (zoneName: DomainName.DomainName, record: DnsRecord.DnsRecord) =>\n      Effect.gen(function* () {\n        const storageZone = yield* resolveZone(zoneName);\n        const body = yield* Effect.try({\n          try: () => Records.encode(storageZone, record),\n          catch: (cause) =>\n            cause instanceof DnsProvider.Error\n              ? cause\n              : failure(\"createRecord\", \"Vercel record could not be encoded\", {\n                  reason: \"request\",\n                }),\n        });\n        const result = yield* request(\n          withContext(`/v2/domains/${encodeURIComponent(storageZone)}/records`),\n          \"createRecord\",\n          { body: JSON.stringify(body), method: \"POST\" },\n        );\n        const envelope = yield* decode(\n          Protocol.CreateRecordEnvelope,\n          result.body,\n          \"createRecord\",\n          result.response,\n        );\n        return { providerRecordId: envelope.uid };\n      }),\n  );\n\n  const getRecord = Effect.fn(\"VercelClient.getRecord\")(\n    (zoneName: DomainName.DomainName, providerRecordId: string) =>\n      Effect.gen(function* () {\n        const storageZone = yield* resolveZone(zoneName);\n        let until: number | null = null;\n        while (true) {\n          const values: Record<string, string> = { limit: \"100\" };\n          if (until !== null) values.until = String(until);\n          const { body, response } = yield* request(\n            withContext(`/v5/domains/${encodeURIComponent(storageZone)}/records`, values),\n            \"getRecord\",\n          );\n          const envelope = yield* decode(Protocol.RecordListEnvelope, body, \"getRecord\", response);\n          const record = envelope.records.find(({ id }) => id === providerRecordId);\n          if (record !== undefined) return yield* Records.decode(storageZone, record);\n          const next = envelope.pagination?.next ?? null;\n          if (next === null) return null;\n          until = next;\n        }\n      }),\n  );\n\n  const deleteRecord = Effect.fn(\"VercelClient.deleteRecord\")(\n    (zoneName: DomainName.DomainName, providerRecordId: string) =>\n      Effect.gen(function* () {\n        const storageZone = yield* resolveZone(zoneName);\n        yield* request(\n          withContext(\n            `/v2/domains/${encodeURIComponent(storageZone)}/records/${encodeURIComponent(providerRecordId)}`,\n          ),\n          \"deleteRecord\",\n          { method: \"DELETE\" },\n        );\n      }),\n  );\n\n  const listAccounts = Effect.fn(\"VercelClient.listAccounts\")(() =>\n    Effect.gen(function* () {\n      const userResult = yield* request(new URL(`${baseUrl}/v2/user`), \"listAccounts\");\n      const { user } = yield* decode(\n        Protocol.UserEnvelope,\n        userResult.body,\n        \"listAccounts\",\n        userResult.response,\n      );\n      const teams = yield* allTeams();\n      return [\n        { id: user.id, name: user.name ?? user.username, type: \"personal\" as const },\n        ...teams.map((team) => ({\n          id: team.id,\n          name: team.name ?? team.slug,\n          type: \"team\" as const,\n        })),\n      ];\n    }),\n  );\n\n  const listZones = Effect.fn(\"VercelClient.listZones\")((input: ListZonesInput = {}) =>\n    Effect.gen(function* () {\n      const domains = (yield* allDomains()).filter(\n        (domain) =>\n          hasDnsStorage(domain) && (input.name === undefined || domain.name === input.name),\n      );\n      if (domains.length > 0 || input.name === undefined) {\n        return yield* Effect.forEach(domains, projectZone);\n      }\n      const discovered = yield* discoverZone(input.name);\n      return discovered === null ? [] : [yield* projectZone(discovered)];\n    }),\n  );\n\n  const validateToken = Effect.fn(\"VercelClient.validateToken\")(() =>\n    Effect.gen(function* () {\n      let accountId: string;\n      if (options.context._tag === \"team\") {\n        yield* allDomains();\n        accountId = options.context.teamId;\n      } else {\n        const result = yield* request(new URL(`${baseUrl}/v2/user`), \"validateToken\");\n        const { user } = yield* decode(\n          Protocol.UserEnvelope,\n          result.body,\n          \"validateToken\",\n          result.response,\n        );\n        accountId = user.id;\n      }\n      return {\n        accountId,\n        capabilities: options.capabilities,\n        expiresAt: null,\n        scopes: [],\n      };\n    }),\n  );\n\n  return {\n    id: \"vercel\",\n    createRecord,\n    deleteRecord,\n    getRecord,\n    listAccounts,\n    listRecords,\n    listZones,\n    validateToken,\n  };\n}\n\nfunction hasDnsStorage(\n  domain: Protocol.Domain,\n  configuredServiceType: Protocol.DomainConfig[\"serviceType\"] = domain.serviceType,\n): boolean {\n  return (\n    configuredServiceType === \"zeit.world\" ||\n    domain.zone === true ||\n    domain.intendedNameservers.length > 0\n  );\n}\n\nconst projectZone = Effect.fn(\"VercelClient.projectZone\")((domain: Protocol.Domain) =>\n  Effect.gen(function* () {\n    const name = yield* DomainName.decode(domain.name).pipe(\n      Effect.mapError((cause) => failure(\"listZones\", cause.message, { reason: \"response\" })),\n    );\n    const nameservers = yield* Effect.forEach(domain.intendedNameservers, (nameserver) =>\n      DomainName.decode(nameserver).pipe(\n        Effect.mapError((cause) => failure(\"listZones\", cause.message, { reason: \"response\" })),\n      ),\n    );\n    return {\n      accountId: domain.teamId ?? domain.userId,\n      id: domain.id,\n      name,\n      nameservers,\n      status: domain.verified ? \"active\" : \"pending\",\n    } as const;\n  }),\n);\n\nfunction decode<A>(\n  schema: S.ConstraintCodec<A, unknown, never, unknown>,\n  input: unknown,\n  operation: string,\n  response: Response,\n): Effect.Effect<A, DnsProvider.Error> {\n  return S.decodeUnknownEffect(schema)(input).pipe(\n    Effect.mapError((cause) =>\n      failure(operation, `Vercel response did not match its API contract: ${cause.message}`, {\n        reason: \"response\",\n        status: response.status,\n      }),\n    ),\n  );\n}\n\nfunction apiFailure(input: unknown, operation: string, response: Response): DnsProvider.Error {\n  const detail = S.decodeUnknownOption(Protocol.ErrorEnvelope)(input);\n  return failure(\n    operation,\n    detail._tag === \"Some\"\n      ? detail.value.error.message\n      : `Vercel request failed with HTTP ${response.status}`,\n    {\n      ...(detail._tag === \"Some\" ? { code: detail.value.error.code } : {}),\n      reason: reason(response.status, detail._tag === \"Some\" ? detail.value.error.code : undefined),\n      ...rateLimit(response, detail._tag === \"Some\" ? detail.value.error : undefined),\n      status: response.status,\n    },\n  );\n}\n\nfunction reason(status: number, code?: string): DnsProvider.ErrorReason {\n  if (status === 401 || code === \"invalid_token\") return \"authentication\";\n  if (status === 403) return \"authorization\";\n  if (status === 404 || code === \"not_found\") return \"not_found\";\n  if (status === 409 || code === \"conflict\") return \"conflict\";\n  if (status === 429 || code === \"rate_limited\") return \"rate_limit\";\n  if (status >= 500) return \"response\";\n  return \"request\";\n}\n\nfunction rateLimit(\n  response: Response,\n  detail?: Protocol.ErrorDetail,\n): Partial<Pick<DnsProvider.Error, \"retryAfterMs\">> {\n  const resetMs = detail?.limit?.resetMs;\n  const header = response.headers.get(\"x-ratelimit-reset\");\n  const reset = resetMs ?? (header === null ? undefined : Number(header) * 1_000);\n  return reset === undefined || !Number.isFinite(reset)\n    ? {}\n    : { retryAfterMs: Math.max(0, reset - Date.now()) };\n}\n\nfunction failure(\n  operation: string,\n  message: string,\n  fields: Partial<Pick<DnsProvider.Error, \"code\" | \"reason\" | \"retryAfterMs\" | \"status\">> = {},\n): DnsProvider.Error {\n  return new DnsProvider.Error({ ...fields, message, operation, providerId: \"vercel\" });\n}\n","import { Clock, Effect, Schema as S } from \"effect\";\n\nimport * as Connection from \"../../auth/connect.ts\";\nimport * as ProviderAuthorization from \"../../auth/authorization.ts\";\nimport type * as ProviderAuth from \"../../auth/manifest.ts\";\nimport * as ProviderContext from \"../../auth/provider-context.ts\";\nimport * as Secret from \"../../auth/secret.ts\";\nimport * as DnsProvider from \"../../provider/provider.ts\";\nimport * as Client from \"./client.ts\";\nimport * as Protocol from \"./protocol.ts\";\n\nconst Context = S.TaggedUnion({\n  personal: { installationId: S.NullOr(S.String) },\n  team: { installationId: S.NullOr(S.String), teamId: S.String },\n});\nexport type Context = typeof Context.Type;\nexport const contextCodec = ProviderContext.codec(\"vercel.v1\", Context);\n\n/** Describes Vercel's caller-created personal access-token method. */\nexport function tokenMethod(\n  capabilities: ProviderAuth.TokenValidation[\"capabilities\"],\n): Extract<ProviderAuth.Manifest[\"methods\"][number], { readonly _tag: \"token\" }> {\n  return {\n    _tag: \"token\",\n    capabilities: [...capabilities],\n    instructionsUrl: \"https://vercel.com/account/settings/tokens\",\n  };\n}\n\nexport interface IntegrationMethodOptions {\n  readonly capabilities: ProviderAuth.TokenValidation[\"capabilities\"];\n  readonly slug: string;\n}\n\n/** Describes Vercel's provider-specific integration installation flow. */\nexport function integrationMethod(\n  options: IntegrationMethodOptions,\n): ProviderAuth.IntegrationMethod {\n  return {\n    _tag: \"integration\",\n    capabilities: [...options.capabilities],\n    installUrl: `https://vercel.com/integrations/${encodeURIComponent(options.slug)}/new`,\n    tokenEndpoint: \"https://api.vercel.com/oauth/access_token\",\n  };\n}\n\n/** Creates the Vercel token and integration authorization manifest. */\nexport function manifest(options: IntegrationMethodOptions): ProviderAuth.Manifest {\n  return {\n    methods: [tokenMethod(options.capabilities), integrationMethod(options)],\n    providerId: \"vercel\",\n  };\n}\n\nexport interface ExchangeCodeOptions {\n  readonly baseUrl?: string;\n  readonly clientId: string;\n  readonly clientSecret: Secret.Value;\n  readonly code: Secret.Value;\n  readonly fetch?: Client.Fetch;\n  readonly redirectUri: string;\n}\n\nexport interface IntegrationCredential {\n  readonly accessToken: Secret.Value;\n  readonly context: Client.AccountContext;\n  readonly installationId: string | null;\n  readonly userId: string;\n}\n\n/** Exchanges Vercel's one-time integration code and preserves its account context. */\nexport const exchangeCode = Effect.fn(\"VercelAuth.exchangeCode\")((options: ExchangeCodeOptions) =>\n  Effect.gen(function* () {\n    const fetch = options.fetch ?? globalThis.fetch;\n    const baseUrl = (options.baseUrl ?? \"https://api.vercel.com\").replace(/\\/$/, \"\");\n    const body = new URLSearchParams({\n      client_id: options.clientId,\n      client_secret: options.clientSecret.expose(),\n      code: options.code.expose(),\n      redirect_uri: options.redirectUri,\n    });\n    const response = yield* Effect.tryPromise({\n      try: () =>\n        fetch(`${baseUrl}/oauth/access_token`, {\n          body,\n          headers: {\n            Accept: \"application/json\",\n            \"Content-Type\": \"application/x-www-form-urlencoded\",\n          },\n          method: \"POST\",\n        }),\n      catch: () => failure(\"exchangeCode\", \"Vercel token exchange failed\", \"transport\"),\n    });\n    const input = yield* Effect.tryPromise({\n      try: () => response.json() as Promise<unknown>,\n      catch: () =>\n        failure(\n          \"exchangeCode\",\n          response.ok\n            ? \"Vercel returned a non-JSON token response\"\n            : `Vercel token exchange failed with HTTP ${response.status}`,\n          response.ok ? \"response\" : response.status === 401 ? \"authentication\" : \"request\",\n          response.status,\n        ),\n    });\n    if (!response.ok) {\n      const detail = S.decodeUnknownOption(Protocol.ErrorEnvelope)(input);\n      return yield* Effect.fail(\n        failure(\n          \"exchangeCode\",\n          detail._tag === \"Some\"\n            ? detail.value.error.message\n            : `Vercel token exchange failed with HTTP ${response.status}`,\n          response.status === 401 ? \"authentication\" : \"request\",\n          response.status,\n          detail._tag === \"Some\" ? detail.value.error.code : undefined,\n        ),\n      );\n    }\n    const token = yield* S.decodeUnknownEffect(Protocol.IntegrationToken)(input).pipe(\n      Effect.mapError((cause) =>\n        failure(\n          \"exchangeCode\",\n          `Vercel token response did not match its API contract: ${cause.message}`,\n          \"response\",\n          response.status,\n        ),\n      ),\n    );\n    return {\n      accessToken: Secret.make(token.access_token),\n      context:\n        token.team_id === null\n          ? ({ _tag: \"personal\" } as const)\n          : ({ _tag: \"team\", teamId: token.team_id } as const),\n      installationId: token.installation_id ?? null,\n      userId: token.user_id,\n    };\n  }),\n);\n\nexport interface TokenConnectionOptions extends Omit<Client.Options, \"token\"> {\n  readonly token: Secret.Value;\n}\n\n/** Creates a provider-independent token connection method backed by Vercel validation. */\nexport function tokenConnectionMethod(\n  options: TokenConnectionOptions,\n): Extract<Connection.Method, { readonly _tag: \"Token\" }> {\n  const requiredCapabilities = [...options.capabilities];\n  return Connection.Method.Token({\n    authenticate: Effect.fn(\"VercelAuth.authenticateToken\")(function* (token) {\n      const validated = yield* Client.make({ ...options, token }).validateToken();\n      const observedAt = new Date(yield* Clock.currentTimeMillis);\n      return {\n        capabilityEvidence: validated.capabilities.map((capability) => ({\n          capability,\n          evidence: ProviderAuthorization.Evidence.Introspected({ observedAt }),\n        })),\n        credential: { accessToken: token, refreshToken: null, tokenType: \"bearer\" },\n        expiresAt: validated.expiresAt,\n        providerAccountId: validated.accountId,\n        providerContext: yield* contextCodec.encode(\n          options.context._tag === \"team\"\n            ? { _tag: \"team\", installationId: null, teamId: options.context.teamId }\n            : { _tag: \"personal\", installationId: null },\n        ),\n        scopes: [...validated.scopes],\n      } satisfies Connection.Authentication;\n    }),\n    providerId: \"vercel\",\n    requiredCapabilities,\n    token: options.token,\n  });\n}\n\n/** Converts a completed Vercel Integration exchange into canonical connection authentication. */\nexport const integrationAuthentication = Effect.fn(\"VercelAuth.integrationAuthentication\")(\n  function* (\n    options: ExchangeCodeOptions & {\n      readonly capabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n    },\n  ) {\n    const exchanged = yield* exchangeCode(options);\n    const observedAt = new Date(yield* Clock.currentTimeMillis);\n    return {\n      capabilityEvidence: options.capabilities.map((capability) => ({\n        capability,\n        evidence: ProviderAuthorization.Evidence.Introspected({ observedAt }),\n      })),\n      credential: {\n        accessToken: exchanged.accessToken,\n        refreshToken: null,\n        tokenType: \"bearer\",\n      },\n      expiresAt: null,\n      providerAccountId:\n        exchanged.context._tag === \"team\" ? exchanged.context.teamId : exchanged.userId,\n      providerContext: yield* contextCodec.encode(\n        exchanged.context._tag === \"team\"\n          ? {\n              _tag: \"team\",\n              installationId: exchanged.installationId,\n              teamId: exchanged.context.teamId,\n            }\n          : { _tag: \"personal\", installationId: exchanged.installationId },\n      ),\n      scopes: [],\n    } satisfies Connection.Authentication;\n  },\n);\n\nexport interface IntegrationFlowOptions\n  extends Omit<ExchangeCodeOptions, \"code\">, IntegrationMethodOptions {}\n\n/** Creates Vercel Integration's implementation of the common interactive connection capability. */\nexport function integrationFlow(options: IntegrationFlowOptions): Connection.InteractiveFlow {\n  const method = integrationMethod(options);\n  const Payload = S.fromJsonString(S.Struct({ state: S.String }));\n  return {\n    complete: Effect.fn(\"VercelAuth.integrationFlow.complete\")(function* (payload, callbackUrl) {\n      const continuation = yield* S.decodeUnknownEffect(Payload)(payload.expose()).pipe(\n        Effect.mapError(\n          () =>\n            new Connection.Error({\n              category: \"authorization\",\n              message: \"Vercel Integration continuation payload is invalid\",\n              operation: \"VercelAuth.integrationFlow.complete\",\n              retry: \"after-user-action\",\n            }),\n        ),\n      );\n      const code = callbackUrl.searchParams.get(\"code\");\n      if (callbackUrl.searchParams.get(\"state\") !== continuation.state || code === null) {\n        return yield* new Connection.Error({\n          category: \"authorization\",\n          message: \"Vercel Integration callback does not match its continuation\",\n          operation: \"VercelAuth.integrationFlow.complete\",\n          retry: \"after-user-action\",\n        });\n      }\n      return yield* integrationAuthentication({\n        ...(options.baseUrl === undefined ? {} : { baseUrl: options.baseUrl }),\n        capabilities: options.capabilities,\n        clientId: options.clientId,\n        clientSecret: options.clientSecret,\n        code: Secret.make(code),\n        ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n        redirectUri: options.redirectUri,\n      });\n    }),\n    method: \"integration\",\n    providerId: \"vercel\",\n    requiredCapabilities: [...options.capabilities],\n    start: (continuationId) => {\n      const authorizationUrl = new URL(method.installUrl);\n      authorizationUrl.searchParams.set(\"source\", \"external\");\n      authorizationUrl.searchParams.set(\"state\", continuationId);\n      return Effect.succeed({\n        authorizationUrl,\n        payload: Secret.make(JSON.stringify({ state: continuationId })),\n      });\n    },\n  };\n}\n\nfunction failure(\n  operation: string,\n  message: string,\n  reason: DnsProvider.ErrorReason,\n  status?: number,\n  code?: string,\n): DnsProvider.Error {\n  return new DnsProvider.Error({\n    ...(code === undefined ? {} : { code }),\n    message,\n    operation,\n    providerId: \"vercel\",\n    reason,\n    ...(status === undefined ? {} : { status }),\n  });\n}\n"],"mappings":";;;;;AAEA,MAAa,aAAaA,OAAE,OAAO;CACjC,OAAOA,OAAE;CACT,MAAMA,OAAE,OAAOA,OAAE,MAAM;CACvB,MAAMA,OAAE,OAAOA,OAAE,MAAM;AACzB,CAAC;AAGD,MAAa,cAAcA,OAAE,OAAO;CAClC,MAAMA,OAAE;CACR,SAASA,OAAE;CACX,OAAOA,OAAE,YACPA,OAAE,OAAO;EACP,WAAWA,OAAE;EACb,OAAOA,OAAE,YAAYA,OAAE,MAAM;EAC7B,SAASA,OAAE,YAAYA,OAAE,MAAM;EAC/B,OAAOA,OAAE;CACX,CAAC,CACH;AACF,CAAC;AAGD,MAAa,gBAAgBA,OAAE,OAAO,EAAE,OAAO,YAAY,CAAC;AAE5D,MAAa,OAAOA,OAAE,OAAO;CAC3B,IAAIA,OAAE;CACN,MAAMA,OAAE,OAAOA,OAAE,MAAM;CACvB,UAAUA,OAAE;AACd,CAAC;AAGD,MAAa,eAAeA,OAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AAEnD,MAAa,OAAOA,OAAE,OAAO;CAC3B,IAAIA,OAAE;CACN,MAAMA,OAAE,OAAOA,OAAE,MAAM;CACvB,MAAMA,OAAE;AACV,CAAC;AAGD,MAAa,mBAAmBA,OAAE,OAAO;CACvC,YAAY;CACZ,OAAOA,OAAE,MAAM,IAAI;AACrB,CAAC;AAED,MAAa,SAASA,OAAE,OAAO;CAC7B,IAAIA,OAAE;CACN,qBAAqBA,OAAE,MAAMA,OAAE,MAAM;CACrC,MAAMA,OAAE;CACR,aAAaA,OAAE,MAAMA,OAAE,MAAM;CAC7B,aAAaA,OAAE,SAAS;EAAC;EAAc;EAAY;CAAI,CAAC;CACxD,QAAQA,OAAE,OAAOA,OAAE,MAAM;CACzB,QAAQA,OAAE;CACV,UAAUA,OAAE;CACZ,MAAMA,OAAE,YAAYA,OAAE,OAAO;AAC/B,CAAC;AAGD,MAAa,eAAeA,OAAE,OAAO;CACnC,eAAeA,OAAE;CACjB,aAAaA,OAAE,SAAS;EAAC;EAAc;EAAY;CAAI,CAAC;AAC1D,CAAC;AAGD,MAAa,iBAAiBA,OAAE,OAAO,EAAE,QAAQ,OAAO,CAAC;AAEzD,MAAa,qBAAqBA,OAAE,OAAO;CACzC,SAASA,OAAE,MAAM,MAAM;CACvB,YAAY;AACd,CAAC;AAED,MAAa,SAASA,OAAE,OAAO;CAC7B,IAAIA,OAAE;CACN,YAAYA,OAAE,YAAYA,OAAE,MAAM;CAClC,MAAMA,OAAE;CACR,UAAUA,OAAE,YAAYA,OAAE,MAAM;CAChC,KAAKA,OAAE,YAAYA,OAAE,MAAM;CAC3B,MAAMA,OAAE;CACR,OAAOA,OAAE;AACX,CAAC;AAGD,MAAa,qBAAqBA,OAAE,OAAO;CACzC,YAAYA,OAAE,YAAY,UAAU;CACpC,SAASA,OAAE,MAAM,MAAM;AACzB,CAAC;AAED,MAAa,uBAAuBA,OAAE,OAAO;CAC3C,KAAKA,OAAE;CACP,SAASA,OAAE,YAAYA,OAAE,MAAM;AACjC,CAAC;AAED,MAAa,mBAAmBA,OAAE,OAAO;CACvC,cAAcA,OAAE;CAChB,iBAAiBA,OAAE,YAAYA,OAAE,MAAM;CACvC,SAASA,OAAE,OAAOA,OAAE,MAAM;CAC1B,YAAYA,OAAE,YAAYA,OAAE,MAAM;CAClC,SAASA,OAAE;AACb,CAAC;;;AC1FD,MAAaC,WAAS,OAAO,GAAG,sBAAsB,CAAC,EACpD,MAA6B,WAC5B,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,sBAAsB,MAAM,OAAO,IAAI;CACxD,MAAM,OAAO,OAAOC,SAAkB,QAAQ,CAAC,CAAC,KAC9C,OAAO,MAAM;EAAE,iBAAiB;EAAM,YAAY,UAAU;CAAM,CAAC,CACrE;CACA,IAAI,SAAS,MAAM,OAAO,OAAO,aAAa,QAAQ,QAAQ;CAC9D,MAAM,SAAS;EACb,UAAU;GACR,WAAW;GACX,YAAY;GACZ,SAAS;EACX;EACA;EACA,QAAQ,OAAO,SAAS,UAAU,cAAc;EAChD,KAAK,OAAO,OAAO;CACrB;CACA,MAAM,cAAc,UAClBC,SAAiB,KAAK,CAAC,CAAC,KACtB,OAAO,UAAU,UAAUC,UAAQ,gBAAgB,MAAM,OAAO,CAAC,CACnE;CAEF,QAAQ,OAAO,MAAf;EACE,KAAK;EACL,KAAK,QACH,OAAO,OAAO,WAAW;GAAE,GAAG;GAAQ,MAAM,OAAO;GAAM,SAAS,OAAO;EAAM,CAAC;EAClF,KAAK;EACL,KAAK,MACH,OAAO,OAAO,WAAW;GAAE,GAAG;GAAQ,MAAM,OAAO;GAAM,QAAQ,OAAO;EAAM,CAAC;EACjF,KAAK,OACH,OAAO,OAAO,WAAW;GAAE,GAAG;GAAQ,MAAM;GAAO,OAAO,OAAO;EAAM,CAAC;EAC1E,KAAK,MACH,OAAO,OAAO,WAAW;GACvB,GAAG;GACH,MAAM;GACN,UAAU,OAAO;GACjB,UAAU,OAAO,cAAc,OAAO;EACxC,CAAC;EACH,KAAK,OAAO;GACV,MAAM,QAAQ,OAAO,MAAM,MACzB,sEACF;GACA,IAAI,UAAU,MACZ,OAAO,OAAO,OAAO,KACnBA,UAAQ,gBAAgB,wCAAwC,CAClE;GAEF,OAAO,OAAO,WAAW;IACvB,GAAG;IACH,MAAM;IACN,OAAO,OAAO,MAAM,EAAE;IACtB,KAAK,MAAM;IACX,OAAO,eAAe,MAAM,MAAM,MAAM,MAAM,EAAE;GAClD,CAAC;EACH;EACA,KAAK,OAAO;GACV,MAAM,QAAQ,OAAO,MAAM,KAAK,CAAC,CAAC,MAAM,KAAK;GAC7C,MAAM,CAAC,UAAU,QAAQ,MAAM,UAC7B,MAAM,WAAW,IACb,QACA;IAAC,OAAO,OAAO,YAAY,EAAE;IAAG,MAAM;IAAI,MAAM;IAAI,MAAM;GAAE;GAClE,OAAO,OAAO,WAAW;IACvB,GAAG;IACH,MAAM;IACN,MAAM,OAAO,IAAI;IACjB,UAAU,OAAO,QAAQ;IACzB;IACA,QAAQ,OAAO,MAAM;GACvB,CAAC;EACH;EACA,SACE,OAAO,OAAO,aAAa,QAAQ,IAAI;CAC3C;AACF,CAAC,CACL;AAEA,MAAM,eAAe,OAAO,GAAG,4BAA4B,CAAC,EACzD,QAAyB,SACxBC,OAAE,oBAAoBC,MAAgB,CAAC,CAAC;CACtC,MAAM;CACN;CACA,kBAAkB,OAAO;CACzB,cAAc,OAAO;AACvB,CAAC,CAAC,CAAC,KAAK,OAAO,UAAU,UAAUF,UAAQ,gBAAgB,MAAM,OAAO,CAAC,CAAC,CAC9E;AAEA,SAAgB,OAAO,MAA6B,QAAyC;CAC3F,MAAM,SAAS;EACb,MAAM,aAAa,MAAM,OAAO,IAAI;EACpC,GAAI,OAAO,QAAQ,OAAO,CAAC,IAAI,EAAE,KAAK,OAAO,IAAI;EACjD,MAAM,OAAO;CACf;CACA,QAAQ,OAAO,MAAf;EACE,KAAK;EACL,KAAK,QACH,OAAO;GAAE,GAAG;GAAQ,OAAO,OAAO;EAAQ;EAC5C,KAAK;EACL,KAAK,MACH,OAAO;GAAE,GAAG;GAAQ,OAAO,OAAO;EAAO;EAC3C,KAAK,OACH,OAAO;GAAE,GAAG;GAAQ,OAAO,OAAO;EAAM;EAC1C,KAAK,MACH,OAAO;GAAE,GAAG;GAAQ,YAAY,OAAO;GAAU,OAAO,OAAO;EAAS;EAC1E,KAAK,OACH,OAAO;GACL,GAAG;GACH,OAAO,GAAG,OAAO,MAAM,GAAG,OAAO,IAAI,IAAI,aAAa,OAAO,KAAK,EAAE;EACtE;EACF,KAAK,OACH,OAAO;GACL,GAAG;GACH,KAAK;IACH,MAAM,OAAO;IACb,UAAU,OAAO;IACjB,QAAQ,OAAO;IACf,QAAQ,OAAO;GACjB;EACF;CACJ;AACF;AAEA,SAAS,sBAAsB,MAA6B,MAAsB;CAChF,OAAO,SAAS,MAAM,SAAS,MAC3B,OACA,SAAS,QAAQ,KAAK,SAAS,IAAI,MAAM,IACvC,OACA,GAAG,KAAK,GAAG;AACnB;AAEA,SAAS,aAAa,MAA6B,MAAqC;CACtF,IAAI,SAAS,MAAM,OAAO;CAC1B,MAAM,SAAS,IAAI;CACnB,IAAI,CAAC,KAAK,SAAS,MAAM,GACvB,MAAMA,UAAQ,gBAAgB,cAAc,KAAK,0BAA0B,QAAQ,EACjF,QAAQ,UACV,CAAC;CAEH,OAAO,KAAK,MAAM,GAAG,CAAC,OAAO,MAAM;AACrC;AAEA,SAAS,aAAa,OAAuB;CAC3C,OAAO,MAAM,WAAW,MAAM,MAAM,CAAC,CAAC,WAAW,MAAK,MAAK;AAC7D;AAEA,SAAS,eAAe,OAAuB;CAC7C,OAAO,MAAM,QAAQ,cAAc,IAAI;AACzC;AAEA,SAASA,UACP,WACA,SACA,SAAqD,CAAC,GACnC;CACnB,OAAO,IAAIG,MAAkB;EAC3B;EACA;EACA,YAAY;EACZ,QAAQ,OAAO,UAAU;CAC3B,CAAC;AACH;;;;;;;;AChHA,SAAgB,UAAU,QAAyC;CACjE,OAAO;EACL,YAAY,SAAS,OAAO,UAAU,EAAE,KAAK,CAAC;EAC9C,UAAU;CACZ;AACF;;AAGA,SAAgB,KAAK,SAA6B;CAChD,MAAM,QAAQ,QAAQ,SAAS,WAAW;CAC1C,MAAM,WAAW,QAAQ,WAAW,yBAAA,CAA0B,QAAQ,OAAO,EAAE;CAE/E,MAAM,eAAe,MAAc,SAA2C,CAAC,MAAM;EACnF,MAAM,MAAM,IAAI,IAAI,GAAG,UAAU,MAAM;EACvC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,GAAG,IAAI,aAAa,IAAI,KAAK,KAAK;EAClF,IAAI,QAAQ,QAAQ,SAAS,QAAQ,IAAI,aAAa,IAAI,UAAU,QAAQ,QAAQ,MAAM;EAC1F,OAAO;CACT;CAEA,MAAM,UAAU,OAAO,GAAG,sBAAsB,CAAC,EAC9C,KAAU,WAAmB,SAC5B,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,OAAO,OAAO,WAAW;GACxC,WACE,MAAM,KAAK;IACT,GAAG;IACH,SAAS;KACP,QAAQ;KACR,eAAe,UAAU,QAAQ,MAAM,OAAO;KAC9C,GAAI,MAAM,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;KACzE,GAAG,MAAM;IACX;GACF,CAAC;GACH,aAAaC,UAAQ,WAAW,yBAAyB,EAAE,QAAQ,YAAY,CAAC;EAClF,CAAC;EACD,MAAM,OAAO,OAAO,OAAO,WAAW;GACpC,WAAW,SAAS,KAAK;GACzB,aACEA,UACE,WACA,SAAS,KACL,wCACA,mCAAmC,SAAS,UAChD;IACE,QAAQ,SAAS,KAAK,aAAa,OAAO,SAAS,MAAM;IACzD,GAAG,UAAU,QAAQ;IACrB,QAAQ,SAAS;GACnB,CACF;EACJ,CAAC;EACD,IAAI,CAAC,SAAS,IAAI,OAAO,OAAO,OAAO,KAAK,WAAW,MAAM,WAAW,QAAQ,CAAC;EACjF,OAAO;GAAE;GAAM;EAAS;CAC1B,CAAC,CACL;CAEA,MAAM,WAAW,OAAO,GAAG,uBAAuB,CAAC,OACjD,OAAO,IAAI,aAAa;EACtB,MAAM,QAA8B,CAAC;EACrC,IAAI,QAAuB;EAC3B,OAAO,MAAM;GACX,MAAM,MAAM,IAAI,IAAI,GAAG,QAAQ,UAAU;GACzC,IAAI,aAAa,IAAI,SAAS,KAAK;GACnC,IAAI,UAAU,MAAM,IAAI,aAAa,IAAI,SAAS,OAAO,KAAK,CAAC;GAC/D,MAAM,EAAE,MAAM,aAAa,OAAO,QAAQ,KAAK,cAAc;GAC7D,MAAM,WAAW,OAAO,OAAOC,kBAA2B,MAAM,gBAAgB,QAAQ;GACxF,MAAM,KAAK,GAAG,SAAS,KAAK;GAC5B,IAAI,SAAS,WAAW,SAAS,MAAM,OAAO;GAC9C,QAAQ,SAAS,WAAW;EAC9B;CACF,CAAC,CACH;CAEA,MAAM,aAAa,OAAO,GAAG,yBAAyB,CAAC,OACrD,OAAO,IAAI,aAAa;EACtB,MAAM,UAAkC,CAAC;EACzC,IAAI,QAAuB;EAC3B,OAAO,MAAM;GACX,MAAM,SAAiC,EAAE,OAAO,MAAM;GACtD,IAAI,UAAU,MAAM,OAAO,QAAQ,OAAO,KAAK;GAC/C,MAAM,EAAE,MAAM,aAAa,OAAO,QAAQ,YAAY,eAAe,MAAM,GAAG,WAAW;GACzF,MAAM,WAAW,OAAO,OAAOC,oBAA6B,MAAM,aAAa,QAAQ;GACvF,QAAQ,KAAK,GAAG,SAAS,OAAO;GAChC,IAAI,SAAS,WAAW,SAAS,MAAM,OAAO;GAC9C,QAAQ,SAAS,WAAW;EAC9B;CACF,CAAC,CACH;CAEA,MAAM,eAAe,OAAO,GAAG,2BAA2B,CAAC,EAAE,SAC3D,OAAO,IAAI,aAAa;EACtB,MAAM,eAAe,OAAO,QAC1B,YAAY,eAAe,mBAAmB,IAAI,EAAE,QAAQ,GAC5D,aACF;EACA,MAAM,SAAS,OAAO,OACpBC,cACA,aAAa,MACb,eACA,aAAa,QACf;EACA,MAAM,eAAe,OAAO,QAC1B,YAAY,eAAe,mBAAmB,IAAI,GAAG,GACrD,aACF;EACA,MAAM,WAAW,OAAO,OACtBC,gBACA,aAAa,MACb,eACA,aAAa,QACf;EACA,IAAI,CAAC,cAAc,SAAS,QAAQ,OAAO,WAAW,GACpD,OAAO;EAET,OAAO,SAAS;CAClB,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,kBAAkB,UAChC,MAAM,WAAW,cAAc,OAAO,QAAQ,IAAI,IAAI,OAAO,KAAK,KAAK,CACzE,CACF,CACF;CAEA,MAAM,cAAc,OAAO,GAAG,0BAA0B,CAAC,EAAE,SACzD,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,OAAO,aAAa,IAAI;EACvC,IAAI,WAAW,MACb,OAAO,OAAO,OAAO,KACnBJ,UACE,eACA,eAAe,KAAK,mEACpB,EAAE,QAAQ,YAAY,CACxB,CACF;EAEF,OAAO,OAAOK,SAAkB,OAAO,IAAI,CAAC,CAAC,KAC3C,OAAO,UAAU,UACfL,UAAQ,eAAe,4CAA4C,MAAM,SAAS,CACpF,CACF;CACF,CAAC,CACH;CAEA,MAAM,cAAc,OAAO,GAAG,0BAA0B,CAAC,EAAE,aACzD,OAAO,IAAI,aAAa;EACtB,MAAM,cAAc,OAAO,YAAY,QAAQ;EAC/C,MAAM,UAAqC,CAAC;EAC5C,IAAI,QAAuB;EAC3B,OAAO,MAAM;GACX,MAAM,SAAiC,EAAE,OAAO,MAAM;GACtD,IAAI,UAAU,MAAM,OAAO,QAAQ,OAAO,KAAK;GAC/C,MAAM,EAAE,MAAM,aAAa,OAAO,QAChC,YAAY,eAAe,mBAAmB,WAAW,EAAE,WAAW,MAAM,GAC5E,aACF;GACA,MAAM,WAAW,OAAO,OAAOM,oBAA6B,MAAM,eAAe,QAAQ;GACzF,QAAQ,KACN,GAAI,OAAO,OAAO,QAAQ,SAAS,UAAU,WAC3CC,SAAe,aAAa,MAAM,CACpC,CACF;GACA,MAAM,OAAO,SAAS,YAAY,QAAQ;GAC1C,IAAI,SAAS,MACX,OAAO,QAAQ,QACZ,WAAW,OAAO,SAAS,YAAY,OAAO,KAAK,SAAS,IAAI,UAAU,CAC7E;GAEF,QAAQ;EACV;CACF,CAAC,CACH;CAEA,MAAM,eAAe,OAAO,GAAG,2BAA2B,CAAC,EACxD,UAAiC,WAChC,OAAO,IAAI,aAAa;EACtB,MAAM,cAAc,OAAO,YAAY,QAAQ;EAC/C,MAAM,OAAO,OAAO,OAAO,IAAI;GAC7B,WAAWC,OAAe,aAAa,MAAM;GAC7C,QAAQ,UACN,iBAAiBC,QACb,QACAT,UAAQ,gBAAgB,sCAAsC,EAC5D,QAAQ,UACV,CAAC;EACT,CAAC;EACD,MAAM,SAAS,OAAO,QACpB,YAAY,eAAe,mBAAmB,WAAW,EAAE,SAAS,GACpE,gBACA;GAAE,MAAM,KAAK,UAAU,IAAI;GAAG,QAAQ;EAAO,CAC/C;EAOA,OAAO,EAAE,mBAAkB,OANH,OACtBU,sBACA,OAAO,MACP,gBACA,OAAO,QACT,EAAA,CACoC,IAAI;CAC1C,CAAC,CACL;CAEA,MAAM,YAAY,OAAO,GAAG,wBAAwB,CAAC,EAClD,UAAiC,qBAChC,OAAO,IAAI,aAAa;EACtB,MAAM,cAAc,OAAO,YAAY,QAAQ;EAC/C,IAAI,QAAuB;EAC3B,OAAO,MAAM;GACX,MAAM,SAAiC,EAAE,OAAO,MAAM;GACtD,IAAI,UAAU,MAAM,OAAO,QAAQ,OAAO,KAAK;GAC/C,MAAM,EAAE,MAAM,aAAa,OAAO,QAChC,YAAY,eAAe,mBAAmB,WAAW,EAAE,WAAW,MAAM,GAC5E,WACF;GACA,MAAM,WAAW,OAAO,OAAOJ,oBAA6B,MAAM,aAAa,QAAQ;GACvF,MAAM,SAAS,SAAS,QAAQ,MAAM,EAAE,SAAS,OAAO,gBAAgB;GACxE,IAAI,WAAW,KAAA,GAAW,OAAO,OAAOC,SAAe,aAAa,MAAM;GAC1E,MAAM,OAAO,SAAS,YAAY,QAAQ;GAC1C,IAAI,SAAS,MAAM,OAAO;GAC1B,QAAQ;EACV;CACF,CAAC,CACL;CA4EA,OAAO;EACL,IAAI;EACJ;EACA,cA7EmB,OAAO,GAAG,2BAA2B,CAAC,EACxD,UAAiC,qBAChC,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO,YAAY,QAAQ;GAC/C,OAAO,QACL,YACE,eAAe,mBAAmB,WAAW,EAAE,WAAW,mBAAmB,gBAAgB,GAC/F,GACA,gBACA,EAAE,QAAQ,SAAS,CACrB;EACF,CAAC,CAkEQ;EACX;EACA,cAjEmB,OAAO,GAAG,2BAA2B,CAAC,OACzD,OAAO,IAAI,aAAa;GACtB,MAAM,aAAa,OAAO,QAAQ,IAAI,IAAI,GAAG,QAAQ,SAAS,GAAG,cAAc;GAC/E,MAAM,EAAE,SAAS,OAAO,OACtBI,cACA,WAAW,MACX,gBACA,WAAW,QACb;GACA,MAAM,QAAQ,OAAO,SAAS;GAC9B,OAAO,CACL;IAAE,IAAI,KAAK;IAAI,MAAM,KAAK,QAAQ,KAAK;IAAU,MAAM;GAAoB,GAC3E,GAAG,MAAM,KAAK,UAAU;IACtB,IAAI,KAAK;IACT,MAAM,KAAK,QAAQ,KAAK;IACxB,MAAM;GACR,EAAE,CACJ;EACF,CAAC,CA+CU;EACX;EACA,WA9CgB,OAAO,GAAG,wBAAwB,CAAC,EAAE,QAAwB,CAAC,MAC9E,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,OAAO,WAAW,EAAA,CAAG,QACnC,WACC,cAAc,MAAM,MAAM,MAAM,SAAS,KAAA,KAAa,OAAO,SAAS,MAAM,KAChF;GACA,IAAI,QAAQ,SAAS,KAAK,MAAM,SAAS,KAAA,GACvC,OAAO,OAAO,OAAO,QAAQ,SAAS,WAAW;GAEnD,MAAM,aAAa,OAAO,aAAa,MAAM,IAAI;GACjD,OAAO,eAAe,OAAO,CAAC,IAAI,CAAC,OAAO,YAAY,UAAU,CAAC;EACnE,CAAC,CAmCO;EACR,eAjCoB,OAAO,GAAG,4BAA4B,CAAC,OAC3D,OAAO,IAAI,aAAa;GACtB,IAAI;GACJ,IAAI,QAAQ,QAAQ,SAAS,QAAQ;IACnC,OAAO,WAAW;IAClB,YAAY,QAAQ,QAAQ;GAC9B,OAAO;IACL,MAAM,SAAS,OAAO,QAAQ,IAAI,IAAI,GAAG,QAAQ,SAAS,GAAG,eAAe;IAC5E,MAAM,EAAE,SAAS,OAAO,OACtBA,cACA,OAAO,MACP,iBACA,OAAO,QACT;IACA,YAAY,KAAK;GACnB;GACA,OAAO;IACL;IACA,cAAc,QAAQ;IACtB,WAAW;IACX,QAAQ,CAAC;GACX;EACF,CAAC,CAWW;CACd;AACF;AAEA,SAAS,cACP,QACA,wBAA8D,OAAO,aAC5D;CACT,OACE,0BAA0B,gBAC1B,OAAO,SAAS,QAChB,OAAO,oBAAoB,SAAS;AAExC;AAEA,MAAM,cAAc,OAAO,GAAG,0BAA0B,CAAC,EAAE,WACzD,OAAO,IAAI,aAAa;CACtB,MAAM,OAAO,OAAON,SAAkB,OAAO,IAAI,CAAC,CAAC,KACjD,OAAO,UAAU,UAAUL,UAAQ,aAAa,MAAM,SAAS,EAAE,QAAQ,WAAW,CAAC,CAAC,CACxF;CACA,MAAM,cAAc,OAAO,OAAO,QAAQ,OAAO,sBAAsB,eACrEK,SAAkB,UAAU,CAAC,CAAC,KAC5B,OAAO,UAAU,UAAUL,UAAQ,aAAa,MAAM,SAAS,EAAE,QAAQ,WAAW,CAAC,CAAC,CACxF,CACF;CACA,OAAO;EACL,WAAW,OAAO,UAAU,OAAO;EACnC,IAAI,OAAO;EACX;EACA;EACA,QAAQ,OAAO,WAAW,WAAW;CACvC;AACF,CAAC,CACH;AAEA,SAAS,OACP,QACA,OACA,WACA,UACqC;CACrC,OAAOY,OAAE,oBAAoB,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAC1C,OAAO,UAAU,UACfZ,UAAQ,WAAW,mDAAmD,MAAM,WAAW;EACrF,QAAQ;EACR,QAAQ,SAAS;CACnB,CAAC,CACH,CACF;AACF;AAEA,SAAS,WAAW,OAAgB,WAAmB,UAAuC;CAC5F,MAAM,SAASY,OAAE,oBAAoBC,aAAsB,CAAC,CAAC,KAAK;CAClE,OAAOb,UACL,WACA,OAAO,SAAS,SACZ,OAAO,MAAM,MAAM,UACnB,mCAAmC,SAAS,UAChD;EACE,GAAI,OAAO,SAAS,SAAS,EAAE,MAAM,OAAO,MAAM,MAAM,KAAK,IAAI,CAAC;EAClE,QAAQ,OAAO,SAAS,QAAQ,OAAO,SAAS,SAAS,OAAO,MAAM,MAAM,OAAO,KAAA,CAAS;EAC5F,GAAG,UAAU,UAAU,OAAO,SAAS,SAAS,OAAO,MAAM,QAAQ,KAAA,CAAS;EAC9E,QAAQ,SAAS;CACnB,CACF;AACF;AAEA,SAAS,OAAO,QAAgB,MAAwC;CACtE,IAAI,WAAW,OAAO,SAAS,iBAAiB,OAAO;CACvD,IAAI,WAAW,KAAK,OAAO;CAC3B,IAAI,WAAW,OAAO,SAAS,aAAa,OAAO;CACnD,IAAI,WAAW,OAAO,SAAS,YAAY,OAAO;CAClD,IAAI,WAAW,OAAO,SAAS,gBAAgB,OAAO;CACtD,IAAI,UAAU,KAAK,OAAO;CAC1B,OAAO;AACT;AAEA,SAAS,UACP,UACA,QACkD;CAClD,MAAM,UAAU,QAAQ,OAAO;CAC/B,MAAM,SAAS,SAAS,QAAQ,IAAI,mBAAmB;CACvD,MAAM,QAAQ,YAAY,WAAW,OAAO,KAAA,IAAY,OAAO,MAAM,IAAI;CACzE,OAAO,UAAU,KAAA,KAAa,CAAC,OAAO,SAAS,KAAK,IAChD,CAAC,IACD,EAAE,cAAc,KAAK,IAAI,GAAG,QAAQ,KAAK,IAAI,CAAC,EAAE;AACtD;AAEA,SAASA,UACP,WACA,SACA,SAA0F,CAAC,GACxE;CACnB,OAAO,IAAIS,MAAkB;EAAE,GAAG;EAAQ;EAAS;EAAW,YAAY;CAAS,CAAC;AACtF;;;;;;;;;;;;;AC3bA,MAAMK,YAAUC,OAAE,YAAY;CAC5B,UAAU,EAAE,gBAAgBA,OAAE,OAAOA,OAAE,MAAM,EAAE;CAC/C,MAAM;EAAE,gBAAgBA,OAAE,OAAOA,OAAE,MAAM;EAAG,QAAQA,OAAE;CAAO;AAC/D,CAAC;AAED,MAAa,eAAeC,MAAsB,aAAaF,SAAO;;AAGtE,SAAgB,YACd,cAC+E;CAC/E,OAAO;EACL,MAAM;EACN,cAAc,CAAC,GAAG,YAAY;EAC9B,iBAAiB;CACnB;AACF;;AAQA,SAAgB,kBACd,SACgC;CAChC,OAAO;EACL,MAAM;EACN,cAAc,CAAC,GAAG,QAAQ,YAAY;EACtC,YAAY,mCAAmC,mBAAmB,QAAQ,IAAI,EAAE;EAChF,eAAe;CACjB;AACF;;AAGA,SAAgB,SAAS,SAA0D;CACjF,OAAO;EACL,SAAS,CAAC,YAAY,QAAQ,YAAY,GAAG,kBAAkB,OAAO,CAAC;EACvE,YAAY;CACd;AACF;;AAmBA,MAAa,eAAe,OAAO,GAAG,yBAAyB,CAAC,EAAE,YAChE,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,QAAQ,SAAS,WAAW;CAC1C,MAAM,WAAW,QAAQ,WAAW,yBAAA,CAA0B,QAAQ,OAAO,EAAE;CAC/E,MAAM,OAAO,IAAI,gBAAgB;EAC/B,WAAW,QAAQ;EACnB,eAAe,QAAQ,aAAa,OAAO;EAC3C,MAAM,QAAQ,KAAK,OAAO;EAC1B,cAAc,QAAQ;CACxB,CAAC;CACD,MAAM,WAAW,OAAO,OAAO,WAAW;EACxC,WACE,MAAM,GAAG,QAAQ,sBAAsB;GACrC;GACA,SAAS;IACP,QAAQ;IACR,gBAAgB;GAClB;GACA,QAAQ;EACV,CAAC;EACH,aAAa,QAAQ,gBAAgB,gCAAgC,WAAW;CAClF,CAAC;CACD,MAAM,QAAQ,OAAO,OAAO,WAAW;EACrC,WAAW,SAAS,KAAK;EACzB,aACE,QACE,gBACA,SAAS,KACL,8CACA,0CAA0C,SAAS,UACvD,SAAS,KAAK,aAAa,SAAS,WAAW,MAAM,mBAAmB,WACxE,SAAS,MACX;CACJ,CAAC;CACD,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,SAASC,OAAE,oBAAoBE,aAAsB,CAAC,CAAC,KAAK;EAClE,OAAO,OAAO,OAAO,KACnB,QACE,gBACA,OAAO,SAAS,SACZ,OAAO,MAAM,MAAM,UACnB,0CAA0C,SAAS,UACvD,SAAS,WAAW,MAAM,mBAAmB,WAC7C,SAAS,QACT,OAAO,SAAS,SAAS,OAAO,MAAM,MAAM,OAAO,KAAA,CACrD,CACF;CACF;CACA,MAAM,QAAQ,OAAOF,OAAE,oBAAoBG,gBAAyB,CAAC,CAAC,KAAK,CAAC,CAAC,KAC3E,OAAO,UAAU,UACf,QACE,gBACA,yDAAyD,MAAM,WAC/D,YACA,SAAS,MACX,CACF,CACF;CACA,OAAO;EACL,aAAaC,OAAY,MAAM,YAAY;EAC3C,SACE,MAAM,YAAY,OACb,EAAE,MAAM,WAAW,IACnB;GAAE,MAAM;GAAQ,QAAQ,MAAM;EAAQ;EAC7C,gBAAgB,MAAM,mBAAmB;EACzC,QAAQ,MAAM;CAChB;AACF,CAAC,CACH;;AAOA,SAAgB,sBACd,SACwD;CACxD,MAAM,uBAAuB,CAAC,GAAG,QAAQ,YAAY;CACrD,OAAA,OAAyB,MAAM;EAC7B,cAAc,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAAW,OAAO;GACxE,MAAM,YAAY,OAAOC,KAAY;IAAE,GAAG;IAAS;GAAM,CAAC,CAAC,CAAC,cAAc;GAC1E,MAAM,aAAa,IAAI,KAAK,OAAO,MAAM,iBAAiB;GAC1D,OAAO;IACL,oBAAoB,UAAU,aAAa,KAAK,gBAAgB;KAC9D;KACA,UAAA,SAAyC,aAAa,EAAE,WAAW,CAAC;IACtE,EAAE;IACF,YAAY;KAAE,aAAa;KAAO,cAAc;KAAM,WAAW;IAAS;IAC1E,WAAW,UAAU;IACrB,mBAAmB,UAAU;IAC7B,iBAAiB,OAAO,aAAa,OACnC,QAAQ,QAAQ,SAAS,SACrB;KAAE,MAAM;KAAQ,gBAAgB;KAAM,QAAQ,QAAQ,QAAQ;IAAO,IACrE;KAAE,MAAM;KAAY,gBAAgB;IAAK,CAC/C;IACA,QAAQ,CAAC,GAAG,UAAU,MAAM;GAC9B;EACF,CAAC;EACD,YAAY;EACZ;EACA,OAAO,QAAQ;CACjB,CAAC;AACH;;AAGA,MAAa,4BAA4B,OAAO,GAAG,sCAAsC,CAAC,CACxF,WACE,SAGA;CACA,MAAM,YAAY,OAAO,aAAa,OAAO;CAC7C,MAAM,aAAa,IAAI,KAAK,OAAO,MAAM,iBAAiB;CAC1D,OAAO;EACL,oBAAoB,QAAQ,aAAa,KAAK,gBAAgB;GAC5D;GACA,UAAA,SAAyC,aAAa,EAAE,WAAW,CAAC;EACtE,EAAE;EACF,YAAY;GACV,aAAa,UAAU;GACvB,cAAc;GACd,WAAW;EACb;EACA,WAAW;EACX,mBACE,UAAU,QAAQ,SAAS,SAAS,UAAU,QAAQ,SAAS,UAAU;EAC3E,iBAAiB,OAAO,aAAa,OACnC,UAAU,QAAQ,SAAS,SACvB;GACE,MAAM;GACN,gBAAgB,UAAU;GAC1B,QAAQ,UAAU,QAAQ;EAC5B,IACA;GAAE,MAAM;GAAY,gBAAgB,UAAU;EAAe,CACnE;EACA,QAAQ,CAAC;CACX;AACF,CACF;;AAMA,SAAgB,gBAAgB,SAA6D;CAC3F,MAAM,SAAS,kBAAkB,OAAO;CACxC,MAAM,UAAUL,OAAE,eAAeA,OAAE,OAAO,EAAE,OAAOA,OAAE,OAAO,CAAC,CAAC;CAC9D,OAAO;EACL,UAAU,OAAO,GAAG,qCAAqC,CAAC,CAAC,WAAW,SAAS,aAAa;GAC1F,MAAM,eAAe,OAAOA,OAAE,oBAAoB,OAAO,CAAC,CAAC,QAAQ,OAAO,CAAC,CAAC,CAAC,KAC3E,OAAO,eAEH,IAAIM,QAAiB;IACnB,UAAU;IACV,SAAS;IACT,WAAW;IACX,OAAO;GACT,CAAC,CACL,CACF;GACA,MAAM,OAAO,YAAY,aAAa,IAAI,MAAM;GAChD,IAAI,YAAY,aAAa,IAAI,OAAO,MAAM,aAAa,SAAS,SAAS,MAC3E,OAAO,OAAO,IAAIA,QAAiB;IACjC,UAAU;IACV,SAAS;IACT,WAAW;IACX,OAAO;GACT,CAAC;GAEH,OAAO,OAAO,0BAA0B;IACtC,GAAI,QAAQ,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;IACpE,cAAc,QAAQ;IACtB,UAAU,QAAQ;IAClB,cAAc,QAAQ;IACtB,MAAMF,OAAY,IAAI;IACtB,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;IAC9D,aAAa,QAAQ;GACvB,CAAC;EACH,CAAC;EACD,QAAQ;EACR,YAAY;EACZ,sBAAsB,CAAC,GAAG,QAAQ,YAAY;EAC9C,QAAQ,mBAAmB;GACzB,MAAM,mBAAmB,IAAI,IAAI,OAAO,UAAU;GAClD,iBAAiB,aAAa,IAAI,UAAU,UAAU;GACtD,iBAAiB,aAAa,IAAI,SAAS,cAAc;GACzD,OAAO,OAAO,QAAQ;IACpB;IACA,SAASA,OAAY,KAAK,UAAU,EAAE,OAAO,eAAe,CAAC,CAAC;GAChE,CAAC;EACH;CACF;AACF;AAEA,SAAS,QACP,WACA,SACA,QACA,QACA,MACmB;CACnB,OAAO,IAAIG,MAAkB;EAC3B,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK;EACrC;EACA;EACA,YAAY;EACZ;EACA,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;CAC3C,CAAC;AACH"}

package/dist/{authorization-CQSKKMrW.mjs → authorization-OeaSR47S.mjs}

@@ -142,6 +142,35 @@ const complete = Effect.fn("Connection.complete")(function* (input) {
 		requiredCapabilities: continuation.requiredCapabilities
 	});
 });
+/** Extends one owner binding without repeating provider authentication. */
+const extend = Effect.fn("Connection.extend")(function* (input) {
+	const repository = yield* Service;
+	const aggregate = yield* repository.getByConnectionId(input.connectionId);
+	const binding = aggregate?.bindings.find(({ id }) => id === input.connectionId);
+	if (aggregate === null || binding === void 0 || binding.ownerId !== input.ownerId) return yield* new Error$1({
+		category: "authorization",
+		message: "Connection does not belong to this owner",
+		operation: "Connection.extend",
+		retry: "never"
+	});
+	if (aggregate.authorization.revocation._tag !== "Active") return yield* new Error$1({
+		category: "authorization",
+		message: "Provider authorization is awaiting revocation",
+		operation: "Connection.extend",
+		retry: "after-user-action"
+	});
+	const now = new Date(yield* Clock.currentTimeMillis);
+	if (aggregate.authorization.expiresAt !== null && (Number.isNaN(aggregate.authorization.expiresAt.getTime()) || aggregate.authorization.expiresAt <= now)) return yield* new Error$1({
+		category: "authorization",
+		message: "Provider authorization has expired",
+		operation: "Connection.extend",
+		retry: "after-user-action"
+	});
+	return yield* repository.bind(aggregate.authorization.id, {
+		...binding,
+		grant: mergeGrant(binding.grant, input.grant)
+	});
+});
 //#endregion
 //#region src/auth/secret.ts
 var secret_exports = /* @__PURE__ */ __exportAll({
@@ -250,6 +279,6 @@ function evidenceFor(authorization, capability) {
 	return authorization.capabilityEvidence.find((item) => item.capability === capability)?.evidence;
 }
 //#endregion
-export { StartResult as _, Schema$1 as a, encode as c, provider_context_exports as d, Value as f, Method as g, Error$1 as h, EvidenceSchema as i, evidenceFor as l, secret_exports as m, CapabilityEvidence as n, authorization_exports as o, make as p, Evidence as r, decode as s, Capability as t, codec as u, complete as v, start as y };
+export { StartResult as _, Schema$1 as a, start as b, encode as c, provider_context_exports as d, Value as f, Method as g, Error$1 as h, EvidenceSchema as i, evidenceFor as l, secret_exports as m, CapabilityEvidence as n, authorization_exports as o, make as p, Evidence as r, decode as s, Capability as t, codec as u, complete as v, extend as y };
 
-//# sourceMappingURL=authorization-CQSKKMrW.mjs.map
+//# sourceMappingURL=authorization-OeaSR47S.mjs.map

package/dist/authorization-OeaSR47S.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-OeaSR47S.mjs","names":["Error","Repository.Service","InvalidInputError","decode","encode","S","Schema","ProviderContext.Envelope","InvalidInputError"],"sources":["../src/auth/connect.ts","../src/auth/secret.ts","../src/auth/provider-context.ts","../src/auth/authorization.ts"],"sourcesContent":["import { Clock, Crypto, Data, Effect, Schema } from \"effect\";\n\nimport { CryptoError } from \"../plan/canonical-json.ts\";\nimport type { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport type * as DnsProvider from \"../provider/provider.ts\";\nimport * as ProviderAuthorization from \"./authorization.ts\";\nimport type * as Binding from \"./connection.ts\";\nimport * as Repository from \"./lifecycle-repository.ts\";\nimport type * as ProviderContext from \"./provider-context.ts\";\nimport type * as Secret from \"./secret.ts\";\n\nexport interface Authentication {\n  readonly capabilityEvidence: ReadonlyArray<ProviderAuthorization.CapabilityEvidence>;\n  readonly credential: Binding.StoredCredential;\n  readonly expiresAt: Date | null;\n  readonly providerAccountId: string;\n  readonly providerContext: ProviderContext.Envelope;\n  readonly scopes: ReadonlyArray<string>;\n}\n\nexport type AuthenticationFailure = Error | InvalidInputError | DnsProvider.Error;\n\nexport interface InteractiveStart {\n  readonly authorizationUrl: URL;\n  readonly payload: Secret.Value;\n}\n\nexport interface Continuation extends BaseInput {\n  readonly expiresAt: Date;\n  readonly id: string;\n  readonly method: \"integration\" | \"oauth2\";\n  readonly payload: Secret.Value;\n  readonly providerId: string;\n  readonly requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n}\n\nexport interface ContinuationStore {\n  readonly consume: (id: string, now: Date) => Effect.Effect<Continuation | null, Error>;\n  readonly put: (continuation: Continuation) => Effect.Effect<void, Error>;\n}\n\nexport interface InteractiveFlow {\n  readonly complete: (\n    payload: Secret.Value,\n    callbackUrl: URL,\n  ) => Effect.Effect<Authentication, AuthenticationFailure>;\n  readonly method: \"integration\" | \"oauth2\";\n  readonly providerId: string;\n  readonly requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n  readonly start: (\n    continuationId: string,\n  ) => Effect.Effect<InteractiveStart, AuthenticationFailure, Crypto.Crypto>;\n}\n\nexport type Method = Data.TaggedEnum<{\n  Interactive: {\n    readonly continuations: ContinuationStore;\n    readonly flow: InteractiveFlow;\n    readonly ttlMs?: number;\n  };\n  Token: {\n    readonly authenticate: (\n      token: Secret.Value,\n    ) => Effect.Effect<Authentication, AuthenticationFailure>;\n    readonly providerId: string;\n    readonly requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n    readonly token: Secret.Value;\n  };\n}>;\nexport const Method = Data.taggedEnum<Method>();\n\nexport type StartResult = Data.TaggedEnum<{\n  Connected: { readonly aggregate: Repository.Aggregate };\n  Redirect: { readonly authorizationUrl: URL; readonly continuationId: string };\n}>;\nexport const StartResult = Data.taggedEnum<StartResult>();\n\nexport class Error extends Schema.TaggedError<Error>()(\"ConnectionError\", {\n  category: Schema.Literals([\"authorization\", \"provider\", \"validation\"]),\n  message: Schema.String,\n  operation: Schema.String,\n  retry: Schema.Literals([\"never\", \"after-user-action\", \"safe\", \"unknown\"]),\n}) {}\n\nexport interface BaseInput {\n  readonly authorizedById: string;\n  readonly grant: Binding.Grant;\n  readonly ownerId: string;\n}\n\nexport interface CompleteInput {\n  readonly callbackUrl: URL;\n  readonly continuationId: string;\n  readonly continuations: ContinuationStore;\n  readonly flow: InteractiveFlow;\n}\n\nexport interface ExtendInput {\n  readonly connectionId: string;\n  readonly grant: Binding.Grant;\n  readonly ownerId: string;\n}\n\nconst mergeGrant = (\n  current: Binding.Grant | undefined,\n  requested: Binding.Grant,\n): Binding.Grant => {\n  if (current === undefined) return requested;\n  if (current._tag === \"account\" || requested._tag === \"account\") return { _tag: \"account\" };\n  return {\n    _tag: \"domains\",\n    domains: [...new Set([...current.domains, ...requested.domains])],\n  };\n};\n\nconst persist = Effect.fn(\"Connection.persist\")(function* (\n  input: BaseInput & {\n    readonly authentication: Authentication;\n    readonly method: \"integration\" | \"oauth2\" | \"token\";\n    readonly providerId: string;\n    readonly requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n  },\n) {\n  const repository = yield* Repository.Service;\n  const crypto = yield* Crypto.Crypto;\n  const now = new Date(yield* Clock.currentTimeMillis);\n  const missingCapability = input.requiredCapabilities.find(\n    (capability) =>\n      !input.authentication.capabilityEvidence.some((item) => item.capability === capability),\n  );\n  if (missingCapability !== undefined) {\n    return yield* new Error({\n      category: \"authorization\",\n      message: `Provider authorization lacks evidence for ${missingCapability}`,\n      operation: \"Connection.persist\",\n      retry: \"after-user-action\",\n    });\n  }\n  const existing = yield* repository.findByProviderAccount(\n    input.providerId,\n    input.authentication.providerAccountId,\n  );\n  const authorizationId =\n    existing?.authorization.id ??\n    (yield* crypto.randomUUIDv4.pipe(\n      Effect.mapError(\n        (cause) =>\n          new Error({\n            category: \"validation\",\n            message: cause.message,\n            operation: \"Connection.persist\",\n            retry: \"safe\",\n          }),\n      ),\n    ));\n  const existingBinding = existing?.bindings.find((binding) => binding.ownerId === input.ownerId);\n  const binding: Binding.Connection = {\n    authorizationId,\n    createdAt: existingBinding?.createdAt ?? now,\n    grant: mergeGrant(existingBinding?.grant, input.grant),\n    id:\n      existingBinding?.id ??\n      (yield* crypto.randomUUIDv4.pipe(\n        Effect.mapError(\n          (cause) =>\n            new Error({\n              category: \"validation\",\n              message: cause.message,\n              operation: \"Connection.persist\",\n              retry: \"safe\",\n            }),\n        ),\n      )),\n    ownerId: input.ownerId,\n  };\n  const aggregate: Repository.Aggregate = {\n    authorization: {\n      authorizedById: input.authorizedById,\n      capabilityEvidence: [...input.authentication.capabilityEvidence],\n      createdAt: existing?.authorization.createdAt ?? now,\n      expiresAt: input.authentication.expiresAt,\n      id: authorizationId,\n      method: input.method,\n      providerAccountId: input.authentication.providerAccountId,\n      providerContext: input.authentication.providerContext,\n      providerId: input.providerId,\n      requiredCapabilities: [...input.requiredCapabilities],\n      revocation: { _tag: \"Active\" },\n      scopes: [...input.authentication.scopes],\n    },\n    bindings: [\n      ...(existing?.bindings.filter((candidate) => candidate.id !== binding.id) ?? []),\n      binding,\n    ],\n    credential: input.authentication.credential,\n  };\n  return yield* repository.connect(aggregate);\n});\n\nexport const start = Effect.fn(\"Connection.start\")(function* (\n  input: BaseInput & { readonly method: Method },\n) {\n  if (input.method._tag === \"Interactive\") {\n    const crypto = yield* Crypto.Crypto;\n    const now = yield* Clock.currentTimeMillis;\n    const continuationId = yield* crypto.randomUUIDv4.pipe(\n      Effect.mapError(\n        (cause) =>\n          new Error({\n            category: \"validation\",\n            message: cause.message,\n            operation: \"Connection.start\",\n            retry: \"safe\",\n          }),\n      ),\n    );\n    const started = yield* input.method.flow.start(continuationId);\n    yield* input.method.continuations.put({\n      authorizedById: input.authorizedById,\n      expiresAt: new Date(now + (input.method.ttlMs ?? 10 * 60_000)),\n      grant: input.grant,\n      id: continuationId,\n      method: input.method.flow.method,\n      ownerId: input.ownerId,\n      payload: started.payload,\n      providerId: input.method.flow.providerId,\n      requiredCapabilities: [...input.method.flow.requiredCapabilities],\n    });\n    return StartResult.Redirect({\n      authorizationUrl: started.authorizationUrl,\n      continuationId,\n    });\n  }\n  const authentication = yield* input.method.authenticate(input.method.token);\n  const aggregate = yield* persist({\n    authentication,\n    authorizedById: input.authorizedById,\n    grant: input.grant,\n    method: \"token\",\n    ownerId: input.ownerId,\n    providerId: input.method.providerId,\n    requiredCapabilities: input.method.requiredCapabilities,\n  });\n  return StartResult.Connected({ aggregate });\n});\n\nexport const complete = Effect.fn(\"Connection.complete\")(function* (input: CompleteInput) {\n  const continuation = yield* input.continuations.consume(\n    input.continuationId,\n    new Date(yield* Clock.currentTimeMillis),\n  );\n  if (continuation === null) {\n    return yield* new Error({\n      category: \"authorization\",\n      message: \"Connection continuation is expired, unknown, or already consumed\",\n      operation: \"Connection.complete\",\n      retry: \"after-user-action\",\n    });\n  }\n  if (\n    continuation.providerId !== input.flow.providerId ||\n    continuation.method !== input.flow.method\n  ) {\n    return yield* new Error({\n      category: \"authorization\",\n      message: \"Connection continuation does not match the provider flow\",\n      operation: \"Connection.complete\",\n      retry: \"never\",\n    });\n  }\n  const authentication = yield* input.flow.complete(continuation.payload, input.callbackUrl);\n  return yield* persist({\n    authentication,\n    authorizedById: continuation.authorizedById,\n    grant: continuation.grant,\n    method: continuation.method,\n    ownerId: continuation.ownerId,\n    providerId: continuation.providerId,\n    requiredCapabilities: continuation.requiredCapabilities,\n  });\n});\n\n/** Extends one owner binding without repeating provider authentication. */\nexport const extend = Effect.fn(\"Connection.extend\")(function* (input: ExtendInput) {\n  const repository = yield* Repository.Service;\n  const aggregate = yield* repository.getByConnectionId(input.connectionId);\n  const binding = aggregate?.bindings.find(({ id }) => id === input.connectionId);\n  if (aggregate === null || binding === undefined || binding.ownerId !== input.ownerId) {\n    return yield* new Error({\n      category: \"authorization\",\n      message: \"Connection does not belong to this owner\",\n      operation: \"Connection.extend\",\n      retry: \"never\",\n    });\n  }\n  if (aggregate.authorization.revocation._tag !== \"Active\") {\n    return yield* new Error({\n      category: \"authorization\",\n      message: \"Provider authorization is awaiting revocation\",\n      operation: \"Connection.extend\",\n      retry: \"after-user-action\",\n    });\n  }\n  const now = new Date(yield* Clock.currentTimeMillis);\n  if (\n    aggregate.authorization.expiresAt !== null &&\n    (Number.isNaN(aggregate.authorization.expiresAt.getTime()) ||\n      aggregate.authorization.expiresAt <= now)\n  ) {\n    return yield* new Error({\n      category: \"authorization\",\n      message: \"Provider authorization has expired\",\n      operation: \"Connection.extend\",\n      retry: \"after-user-action\",\n    });\n  }\n  return yield* repository.bind(aggregate.authorization.id, {\n    ...binding,\n    grant: mergeGrant(binding.grant, input.grant),\n  });\n});\n\nexport type Requirements = Repository.Service | Crypto.Crypto;\nexport type Failure = AuthenticationFailure | Repository.Error | CryptoError;\n","/** A deliberately non-serializable credential value. */\nexport class Value {\n  readonly #value: string;\n\n  private constructor(value: string) {\n    this.#value = value;\n  }\n\n  static from(value: string): Value {\n    if (value.length === 0) throw new Error(\"Secret values cannot be empty\");\n    return new Value(value);\n  }\n\n  expose(): string {\n    return this.#value;\n  }\n\n  toJSON(): string {\n    return \"[REDACTED]\";\n  }\n\n  toString(): string {\n    return \"[REDACTED]\";\n  }\n}\n\nexport const make = Value.from;\n","import { Effect, Schema } from \"effect\";\n\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\n\n/** A provider-owned, versioned, non-secret context value persisted by the host. */\nexport const Envelope = Schema.Struct({\n  value: Schema.Json,\n  version: Schema.String,\n});\nexport interface Envelope extends Schema.Schema.Type<typeof Envelope> {}\n\nexport interface Codec<A> {\n  readonly decode: (envelope: Envelope) => Effect.Effect<A, InvalidInputError>;\n  readonly encode: (value: A) => Effect.Effect<Envelope, InvalidInputError>;\n  readonly version: string;\n}\n\n/** Build an adapter-owned context codec from a schema and stable version identifier. */\nexport function codec<A, I>(version: string, schema: Schema.Codec<A, I>): Codec<A> {\n  return {\n    decode: Effect.fn(\"ProviderContext.decode\")((envelope) =>\n      envelope.version !== version\n        ? Effect.fail(\n            new InvalidInputError({\n              message: `Unsupported provider context version: ${envelope.version}`,\n            }),\n          )\n        : Schema.decodeUnknownEffect(schema)(envelope.value).pipe(\n            Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n          ),\n    ),\n    encode: Effect.fn(\"ProviderContext.encode\")((value) =>\n      Schema.encodeEffect(schema)(value).pipe(\n        Effect.flatMap((encoded) => Schema.decodeUnknownEffect(Schema.Json)(encoded)),\n        Effect.map((encoded) => ({ value: encoded, version })),\n        Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n      ),\n    ),\n    version,\n  };\n}\n\nexport const decode = Effect.fn(\"ProviderContext.Envelope.decode\")((input: unknown) =>\n  Schema.decodeUnknownEffect(Envelope)(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport const encode = Schema.encodeSync(Envelope);\n","import { Data, Effect, Schema as S } from \"effect\";\n\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport * as ProviderContext from \"./provider-context.ts\";\n\nexport const Capability = S.Literals([\"dns:read\", \"dns:write\"]);\nexport type Capability = typeof Capability.Type;\n\nexport type Evidence = Data.TaggedEnum<{\n  Declared: {};\n  Exercised: { readonly observedAt: Date };\n  Introspected: { readonly observedAt: Date };\n}>;\nexport const Evidence = Data.taggedEnum<Evidence>();\n\nexport const EvidenceSchema = S.TaggedUnion({\n  Declared: {},\n  Exercised: { observedAt: S.DateFromString },\n  Introspected: { observedAt: S.DateFromString },\n});\n\nexport const CapabilityEvidence = S.Struct({\n  capability: Capability,\n  evidence: EvidenceSchema,\n});\nexport interface CapabilityEvidence extends S.Schema.Type<typeof CapabilityEvidence> {}\n\nexport const Revocation = S.TaggedUnion({\n  Active: {},\n  Pending: { requestedAt: S.DateFromString },\n});\nexport type Revocation = typeof Revocation.Type;\n\n/** A provider credential authorization shared by one or more owner connections. */\nexport const Schema = S.Struct({\n  authorizedById: S.String,\n  capabilityEvidence: S.Array(CapabilityEvidence),\n  createdAt: S.DateFromString,\n  expiresAt: S.NullOr(S.DateFromString),\n  id: S.String,\n  method: S.Literals([\"integration\", \"oauth2\", \"token\"]),\n  providerAccountId: S.String,\n  providerContext: ProviderContext.Envelope,\n  providerId: S.String,\n  requiredCapabilities: S.Array(Capability),\n  revocation: Revocation,\n  scopes: S.Array(S.String),\n});\nexport interface ProviderAuthorization extends S.Schema.Type<typeof Schema> {}\n\nexport const decode = Effect.fn(\"ProviderAuthorization.decode\")((input: unknown) =>\n  S.decodeUnknownEffect(Schema)(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport const validate = Effect.fn(\"ProviderAuthorization.validate\")((input: unknown) =>\n  S.decodeUnknownEffect(S.toType(Schema))(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport const encode = S.encodeSync(Schema);\n\nexport function evidenceFor(\n  authorization: ProviderAuthorization,\n  capability: Capability,\n): Evidence | undefined {\n  return authorization.capabilityEvidence.find((item) => item.capability === capability)?.evidence;\n}\n"],"mappings":";;;;AAqEA,MAAa,SAAS,KAAK,WAAmB;AAM9C,MAAa,cAAc,KAAK,WAAwB;AAExD,IAAaA,UAAb,cAA2B,OAAO,YAAmB,CAAC,CAAC,mBAAmB;CACxE,UAAU,OAAO,SAAS;EAAC;EAAiB;EAAY;CAAY,CAAC;CACrE,SAAS,OAAO;CAChB,WAAW,OAAO;CAClB,OAAO,OAAO,SAAS;EAAC;EAAS;EAAqB;EAAQ;CAAS,CAAC;AAC1E,CAAC,CAAC,CAAC,CAAC;AAqBJ,MAAM,cACJ,SACA,cACkB;CAClB,IAAI,YAAY,KAAA,GAAW,OAAO;CAClC,IAAI,QAAQ,SAAS,aAAa,UAAU,SAAS,WAAW,OAAO,EAAE,MAAM,UAAU;CACzF,OAAO;EACL,MAAM;EACN,SAAS,CAAC,mBAAG,IAAI,IAAI,CAAC,GAAG,QAAQ,SAAS,GAAG,UAAU,OAAO,CAAC,CAAC;CAClE;AACF;AAEA,MAAM,UAAU,OAAO,GAAG,oBAAoB,CAAC,CAAC,WAC9C,OAMA;CACA,MAAM,aAAa,OAAOC;CAC1B,MAAM,SAAS,OAAO,OAAO;CAC7B,MAAM,MAAM,IAAI,KAAK,OAAO,MAAM,iBAAiB;CACnD,MAAM,oBAAoB,MAAM,qBAAqB,MAClD,eACC,CAAC,MAAM,eAAe,mBAAmB,MAAM,SAAS,KAAK,eAAe,UAAU,CAC1F;CACA,IAAI,sBAAsB,KAAA,GACxB,OAAO,OAAO,IAAID,QAAM;EACtB,UAAU;EACV,SAAS,6CAA6C;EACtD,WAAW;EACX,OAAO;CACT,CAAC;CAEH,MAAM,WAAW,OAAO,WAAW,sBACjC,MAAM,YACN,MAAM,eAAe,iBACvB;CACA,MAAM,kBACJ,UAAU,cAAc,OACvB,OAAO,OAAO,aAAa,KAC1B,OAAO,UACJ,UACC,IAAIA,QAAM;EACR,UAAU;EACV,SAAS,MAAM;EACf,WAAW;EACX,OAAO;CACT,CAAC,CACL,CACF;CACF,MAAM,kBAAkB,UAAU,SAAS,MAAM,YAAY,QAAQ,YAAY,MAAM,OAAO;CAC9F,MAAM,UAA8B;EAClC;EACA,WAAW,iBAAiB,aAAa;EACzC,OAAO,WAAW,iBAAiB,OAAO,MAAM,KAAK;EACrD,IACE,iBAAiB,OAChB,OAAO,OAAO,aAAa,KAC1B,OAAO,UACJ,UACC,IAAIA,QAAM;GACR,UAAU;GACV,SAAS,MAAM;GACf,WAAW;GACX,OAAO;EACT,CAAC,CACL,CACF;EACF,SAAS,MAAM;CACjB;CACA,MAAM,YAAkC;EACtC,eAAe;GACb,gBAAgB,MAAM;GACtB,oBAAoB,CAAC,GAAG,MAAM,eAAe,kBAAkB;GAC/D,WAAW,UAAU,cAAc,aAAa;GAChD,WAAW,MAAM,eAAe;GAChC,IAAI;GACJ,QAAQ,MAAM;GACd,mBAAmB,MAAM,eAAe;GACxC,iBAAiB,MAAM,eAAe;GACtC,YAAY,MAAM;GAClB,sBAAsB,CAAC,GAAG,MAAM,oBAAoB;GACpD,YAAY,EAAE,MAAM,SAAS;GAC7B,QAAQ,CAAC,GAAG,MAAM,eAAe,MAAM;EACzC;EACA,UAAU,CACR,GAAI,UAAU,SAAS,QAAQ,cAAc,UAAU,OAAO,QAAQ,EAAE,KAAK,CAAC,GAC9E,OACF;EACA,YAAY,MAAM,eAAe;CACnC;CACA,OAAO,OAAO,WAAW,QAAQ,SAAS;AAC5C,CAAC;AAED,MAAa,QAAQ,OAAO,GAAG,kBAAkB,CAAC,CAAC,WACjD,OACA;CACA,IAAI,MAAM,OAAO,SAAS,eAAe;EACvC,MAAM,SAAS,OAAO,OAAO;EAC7B,MAAM,MAAM,OAAO,MAAM;EACzB,MAAM,iBAAiB,OAAO,OAAO,aAAa,KAChD,OAAO,UACJ,UACC,IAAIA,QAAM;GACR,UAAU;GACV,SAAS,MAAM;GACf,WAAW;GACX,OAAO;EACT,CAAC,CACL,CACF;EACA,MAAM,UAAU,OAAO,MAAM,OAAO,KAAK,MAAM,cAAc;EAC7D,OAAO,MAAM,OAAO,cAAc,IAAI;GACpC,gBAAgB,MAAM;GACtB,WAAW,IAAI,KAAK,OAAO,MAAM,OAAO,SAAS,IAAY;GAC7D,OAAO,MAAM;GACb,IAAI;GACJ,QAAQ,MAAM,OAAO,KAAK;GAC1B,SAAS,MAAM;GACf,SAAS,QAAQ;GACjB,YAAY,MAAM,OAAO,KAAK;GAC9B,sBAAsB,CAAC,GAAG,MAAM,OAAO,KAAK,oBAAoB;EAClE,CAAC;EACD,OAAO,YAAY,SAAS;GAC1B,kBAAkB,QAAQ;GAC1B;EACF,CAAC;CACH;CACA,MAAM,iBAAiB,OAAO,MAAM,OAAO,aAAa,MAAM,OAAO,KAAK;CAC1E,MAAM,YAAY,OAAO,QAAQ;EAC/B;EACA,gBAAgB,MAAM;EACtB,OAAO,MAAM;EACb,QAAQ;EACR,SAAS,MAAM;EACf,YAAY,MAAM,OAAO;EACzB,sBAAsB,MAAM,OAAO;CACrC,CAAC;CACD,OAAO,YAAY,UAAU,EAAE,UAAU,CAAC;AAC5C,CAAC;AAED,MAAa,WAAW,OAAO,GAAG,qBAAqB,CAAC,CAAC,WAAW,OAAsB;CACxF,MAAM,eAAe,OAAO,MAAM,cAAc,QAC9C,MAAM,gBACN,IAAI,KAAK,OAAO,MAAM,iBAAiB,CACzC;CACA,IAAI,iBAAiB,MACnB,OAAO,OAAO,IAAIA,QAAM;EACtB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAEH,IACE,aAAa,eAAe,MAAM,KAAK,cACvC,aAAa,WAAW,MAAM,KAAK,QAEnC,OAAO,OAAO,IAAIA,QAAM;EACtB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAEH,MAAM,iBAAiB,OAAO,MAAM,KAAK,SAAS,aAAa,SAAS,MAAM,WAAW;CACzF,OAAO,OAAO,QAAQ;EACpB;EACA,gBAAgB,aAAa;EAC7B,OAAO,aAAa;EACpB,QAAQ,aAAa;EACrB,SAAS,aAAa;EACtB,YAAY,aAAa;EACzB,sBAAsB,aAAa;CACrC,CAAC;AACH,CAAC;;AAGD,MAAa,SAAS,OAAO,GAAG,mBAAmB,CAAC,CAAC,WAAW,OAAoB;CAClF,MAAM,aAAa,OAAOC;CAC1B,MAAM,YAAY,OAAO,WAAW,kBAAkB,MAAM,YAAY;CACxE,MAAM,UAAU,WAAW,SAAS,MAAM,EAAE,SAAS,OAAO,MAAM,YAAY;CAC9E,IAAI,cAAc,QAAQ,YAAY,KAAA,KAAa,QAAQ,YAAY,MAAM,SAC3E,OAAO,OAAO,IAAID,QAAM;EACtB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAEH,IAAI,UAAU,cAAc,WAAW,SAAS,UAC9C,OAAO,OAAO,IAAIA,QAAM;EACtB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAEH,MAAM,MAAM,IAAI,KAAK,OAAO,MAAM,iBAAiB;CACnD,IACE,UAAU,cAAc,cAAc,SACrC,OAAO,MAAM,UAAU,cAAc,UAAU,QAAQ,CAAC,KACvD,UAAU,cAAc,aAAa,MAEvC,OAAO,OAAO,IAAIA,QAAM;EACtB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAEH,OAAO,OAAO,WAAW,KAAK,UAAU,cAAc,IAAI;EACxD,GAAG;EACH,OAAO,WAAW,QAAQ,OAAO,MAAM,KAAK;CAC9C,CAAC;AACH,CAAC;;;;;;;;AC/TD,IAAa,QAAb,MAAa,MAAM;CACjB;CAEA,YAAoB,OAAe;EACjC,KAAK,SAAS;CAChB;CAEA,OAAO,KAAK,OAAsB;EAChC,IAAI,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,+BAA+B;EACvE,OAAO,IAAI,MAAM,KAAK;CACxB;CAEA,SAAiB;EACf,OAAO,KAAK;CACd;CAEA,SAAiB;EACf,OAAO;CACT;CAEA,WAAmB;EACjB,OAAO;CACT;AACF;AAEA,MAAa,OAAO,MAAM;;;;;;;;;;ACrB1B,MAAa,WAAW,OAAO,OAAO;CACpC,OAAO,OAAO;CACd,SAAS,OAAO;AAClB,CAAC;;AAUD,SAAgB,MAAY,SAAiB,QAAsC;CACjF,OAAO;EACL,QAAQ,OAAO,GAAG,wBAAwB,CAAC,EAAE,aAC3C,SAAS,YAAY,UACjB,OAAO,KACL,IAAIE,QAAkB,EACpB,SAAS,yCAAyC,SAAS,UAC7D,CAAC,CACH,IACA,OAAO,oBAAoB,MAAM,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,KACjD,OAAO,UAAU,UAAU,IAAIA,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACN;EACA,QAAQ,OAAO,GAAG,wBAAwB,CAAC,EAAE,UAC3C,OAAO,aAAa,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KACjC,OAAO,SAAS,YAAY,OAAO,oBAAoB,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,GAC5E,OAAO,KAAK,aAAa;GAAE,OAAO;GAAS;EAAQ,EAAE,GACrD,OAAO,UAAU,UAAU,IAAIA,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;EACA;CACF;AACF;AAEA,MAAaC,WAAS,OAAO,GAAG,iCAAiC,CAAC,EAAE,UAClE,OAAO,oBAAoB,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,KAC1C,OAAO,UAAU,UAAU,IAAID,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AAEA,MAAaE,WAAS,OAAO,WAAW,QAAQ;;;;;;;;;;;;;;;AC3ChD,MAAa,aAAaC,OAAE,SAAS,CAAC,YAAY,WAAW,CAAC;AAQ9D,MAAa,WAAW,KAAK,WAAqB;AAElD,MAAa,iBAAiBA,OAAE,YAAY;CAC1C,UAAU,CAAC;CACX,WAAW,EAAE,YAAYA,OAAE,eAAe;CAC1C,cAAc,EAAE,YAAYA,OAAE,eAAe;AAC/C,CAAC;AAED,MAAa,qBAAqBA,OAAE,OAAO;CACzC,YAAY;CACZ,UAAU;AACZ,CAAC;AAGD,MAAa,aAAaA,OAAE,YAAY;CACtC,QAAQ,CAAC;CACT,SAAS,EAAE,aAAaA,OAAE,eAAe;AAC3C,CAAC;;AAID,MAAaC,WAASD,OAAE,OAAO;CAC7B,gBAAgBA,OAAE;CAClB,oBAAoBA,OAAE,MAAM,kBAAkB;CAC9C,WAAWA,OAAE;CACb,WAAWA,OAAE,OAAOA,OAAE,cAAc;CACpC,IAAIA,OAAE;CACN,QAAQA,OAAE,SAAS;EAAC;EAAe;EAAU;CAAO,CAAC;CACrD,mBAAmBA,OAAE;CACrB,iBAAiBE;CACjB,YAAYF,OAAE;CACd,sBAAsBA,OAAE,MAAM,UAAU;CACxC,YAAY;CACZ,QAAQA,OAAE,MAAMA,OAAE,MAAM;AAC1B,CAAC;AAGD,MAAa,SAAS,OAAO,GAAG,8BAA8B,CAAC,EAAE,UAC/DA,OAAE,oBAAoBC,QAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KACnC,OAAO,UAAU,UAAU,IAAIE,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AAEA,MAAa,WAAW,OAAO,GAAG,gCAAgC,CAAC,EAAE,UACnEH,OAAE,oBAAoBA,OAAE,OAAOC,QAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAC7C,OAAO,UAAU,UAAU,IAAIE,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AAEA,MAAa,SAASH,OAAE,WAAWC,QAAM;AAEzC,SAAgB,YACd,eACA,YACsB;CACtB,OAAO,cAAc,mBAAmB,MAAM,SAAS,KAAK,eAAe,UAAU,CAAC,EAAE;AAC1F"}

package/dist/{cloudflare-FDl5q7Dm.d.mts → cloudflare-BrZPU9li.d.mts}

@@ -1,6 +1,6 @@
-import { X as AsyncOAuthSubjectResolver, ct as AsyncInterface, it as TokenValidation, ot as Value } from "./zone-discovery-BA5I24vu.mjs";
-import { _ as Zone, a as SubjectResolverOptions, d as tokenMethod$1, f as Account, g as Options, h as ListZonesInput, i as OAuthMethodOptions, l as manifest$1, n as CredentialTarget, o as TokenConnectionOptions, p as Fetch, r as OAuthFlowOptions, s as TokenValidatorOptions, u as oauthMethod$1 } from "./index-B1opsgls.mjs";
-import { a as Source, n as Method, t as InteractiveFlow } from "./connection-CEqadXSm.mjs";
+import { Q as AsyncOAuthSubjectResolver, ct as Value, ot as TokenValidation, ut as AsyncInterface } from "./zone-discovery-BPnH3sLU.mjs";
+import { _ as Zone, a as SubjectResolverOptions, d as tokenMethod$1, f as Account, g as Options, h as ListZonesInput, i as OAuthMethodOptions, l as manifest$1, n as CredentialTarget, o as TokenConnectionOptions, p as Fetch, r as OAuthFlowOptions, s as TokenValidatorOptions, u as oauthMethod$1 } from "./index-BHWRTThN.mjs";
+import { a as Source, n as Method, t as InteractiveFlow } from "./connection-BfkloPZy.mjs";
 declare namespace cloudflare_auth_d_exports {
   export { CredentialTarget, OAuthFlowOptions, OAuthMethodOptions, SubjectResolverOptions, TokenValidatorOptions, manifest, oauthFlow, oauthMethod, subjectResolver, tokenConnectionMethod, tokenMethod, tokenValidator };
 }
@@ -29,4 +29,4 @@ declare function make(options: Options): Interface;
 declare function discovery(options: Options): Source;
 //#endregion
 export { cloudflare_auth_d_exports as a, make as i, cloudflare_d_exports as n, discovery as r, Interface as t };
-//# sourceMappingURL=cloudflare-FDl5q7Dm.d.mts.map
+//# sourceMappingURL=cloudflare-BrZPU9li.d.mts.map

package/dist/{cloudflare-Bg_p-M2c.mjs → cloudflare-CGmasR8A.mjs}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { a as subjectResolver$1, c as tokenValidator$1, d as make$1, i as oauthMethod$1, n as manifest$1, o as tokenConnectionMethod$1, r as oauthFlow$1, s as tokenMethod$1 } from "./auth-B4jq3yk3.mjs";
-import { n as fromEffectFlow, r as fromEffectTokenMethod } from "./connection-X3rZhrBZ.mjs";
+import { a as subjectResolver$1, c as tokenValidator$1, d as make$1, i as oauthMethod$1, n as manifest$1, o as tokenConnectionMethod$1, r as oauthFlow$1, s as tokenMethod$1 } from "./auth-BR-19zj-.mjs";
+import { n as fromEffectFlow, r as fromEffectTokenMethod } from "./connection-BwtOwpH6.mjs";
 import { Effect } from "effect";
 //#region src/promise/cloudflare-auth.ts
 var cloudflare_auth_exports = /* @__PURE__ */ __exportAll({
@@ -66,4 +66,4 @@ function discovery(options) {
 //#endregion
 export { cloudflare_auth_exports as i, discovery as n, make as r, cloudflare_exports as t };
 
-//# sourceMappingURL=cloudflare-Bg_p-M2c.mjs.map
+//# sourceMappingURL=cloudflare-CGmasR8A.mjs.map

package/dist/{cloudflare-Bg_p-M2c.mjs.map → cloudflare-CGmasR8A.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"cloudflare-Bg_p-M2c.mjs","names":["EffectAuth.manifest","EffectAuth.oauthMethod","EffectAuth.tokenMethod","EffectAuth.subjectResolver","Connection.fromEffectFlow","EffectAuth.oauthFlow","Connection.fromEffectTokenMethod","EffectAuth.tokenConnectionMethod","EffectAuth.tokenValidator","Cloudflare.make"],"sources":["../src/promise/cloudflare-auth.ts","../src/promise/cloudflare.ts"],"sourcesContent":["import type * as oauth from \"oauth4webapi\";\nimport { Effect } from \"effect\";\n\nimport type * as ProviderAuth from \"../auth/manifest.ts\";\nimport type * as Secret from \"../auth/secret.ts\";\nimport * as EffectAuth from \"../providers/cloudflare/auth.ts\";\nimport * as Connection from \"./connection.ts\";\n\nexport const manifest = EffectAuth.manifest;\nexport const oauthMethod = EffectAuth.oauthMethod;\nexport const tokenMethod = EffectAuth.tokenMethod;\nexport type {\n  CredentialTarget,\n  OAuthFlowOptions,\n  OAuthMethodOptions,\n  SubjectResolverOptions,\n  TokenValidatorOptions,\n} from \"../providers/cloudflare/auth.ts\";\n\nexport function subjectResolver(\n  options: EffectAuth.SubjectResolverOptions,\n): ProviderAuth.AsyncOAuthSubjectResolver {\n  const resolve = EffectAuth.subjectResolver(options);\n  return (tokens: oauth.TokenEndpointResponse, accessToken: Secret.Value) =>\n    Effect.runPromise(resolve(tokens, accessToken));\n}\n\n/** Creates Cloudflare's OAuth implementation for the Promise connection facade. */\nexport function oauthFlow(options: EffectAuth.OAuthFlowOptions): Connection.InteractiveFlow {\n  return Connection.fromEffectFlow(EffectAuth.oauthFlow(options));\n}\n\n/** Creates a Cloudflare token method for the Promise connection facade. */\nexport function tokenConnectionMethod(\n  options: EffectAuth.TokenConnectionOptions,\n): Extract<Connection.Method, { readonly _tag: \"Token\" }> {\n  return Connection.fromEffectTokenMethod(EffectAuth.tokenConnectionMethod(options));\n}\n\nexport function tokenValidator(\n  options: EffectAuth.TokenValidatorOptions,\n): (token: Secret.Value) => Promise<ProviderAuth.TokenValidation> {\n  const validate = EffectAuth.tokenValidator(options);\n  return (token) => Effect.runPromise(validate(token));\n}\n","import { Effect } from \"effect\";\n\nimport type * as ProviderAuth from \"../auth/manifest.ts\";\nimport type * as DnsProvider from \"../provider/provider.ts\";\nimport * as Cloudflare from \"../providers/cloudflare/index.ts\";\nimport type * as ZoneDiscovery from \"./zone-discovery.ts\";\n\nexport * as Auth from \"./cloudflare-auth.ts\";\nexport type {\n  Account,\n  Fetch,\n  ListZonesInput,\n  Options,\n  Zone,\n} from \"../providers/cloudflare/client.ts\";\n\nexport interface Interface extends DnsProvider.AsyncInterface {\n  readonly listAccounts: () => Promise<ReadonlyArray<Cloudflare.Account>>;\n  readonly listZones: (\n    input?: Cloudflare.Client.ListZonesInput,\n  ) => Promise<ReadonlyArray<Cloudflare.Zone>>;\n  readonly validateToken: () => Promise<ProviderAuth.TokenValidation>;\n}\n\n/** Creates a Promise-compatible facade over the Effect-native Cloudflare client. */\nexport function make(options: Cloudflare.Client.Options): Interface {\n  const client = Cloudflare.make(options);\n  return {\n    id: client.id,\n    createRecord: (zone, record) => Effect.runPromise(client.createRecord(zone, record)),\n    deleteRecord: (zone, providerRecordId) =>\n      Effect.runPromise(client.deleteRecord(zone, providerRecordId)),\n    getRecord: (zone, providerRecordId) =>\n      Effect.runPromise(client.getRecord(zone, providerRecordId)),\n    listAccounts: () => Effect.runPromise(client.listAccounts()),\n    listRecords: (zone) => Effect.runPromise(client.listRecords(zone)),\n    listZones: (input) => Effect.runPromise(client.listZones(input)),\n    validateToken: () => Effect.runPromise(client.validateToken()),\n  };\n}\n\n/** Creates the optional Cloudflare discovery source for Promise consumers. */\nexport function discovery(options: Cloudflare.Client.Options): ZoneDiscovery.Source {\n  const client = make(options);\n  return {\n    listZones: async (name) =>\n      (await client.listZones({ name })).map((zone) => ({\n        ...zone,\n        status: zone.status === \"active\" || zone.status === \"pending\" ? zone.status : \"unknown\",\n      })),\n    provider: client,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;AAQA,MAAa,WAAWA;AACxB,MAAa,cAAcC;AAC3B,MAAa,cAAcC;AAS3B,SAAgB,gBACd,SACwC;CACxC,MAAM,UAAUC,kBAA2B,OAAO;CAClD,QAAQ,QAAqC,gBAC3C,OAAO,WAAW,QAAQ,QAAQ,WAAW,CAAC;AAClD;;AAGA,SAAgB,UAAU,SAAkE;CAC1F,OAAOC,eAA0BC,YAAqB,OAAO,CAAC;AAChE;;AAGA,SAAgB,sBACd,SACwD;CACxD,OAAOC,sBAAiCC,wBAAiC,OAAO,CAAC;AACnF;AAEA,SAAgB,eACd,SACgE;CAChE,MAAM,WAAWC,iBAA0B,OAAO;CAClD,QAAQ,UAAU,OAAO,WAAW,SAAS,KAAK,CAAC;AACrD;;;;;;;;;ACnBA,SAAgB,KAAK,SAA+C;CAClE,MAAM,SAASC,OAAgB,OAAO;CACtC,OAAO;EACL,IAAI,OAAO;EACX,eAAe,MAAM,WAAW,OAAO,WAAW,OAAO,aAAa,MAAM,MAAM,CAAC;EACnF,eAAe,MAAM,qBACnB,OAAO,WAAW,OAAO,aAAa,MAAM,gBAAgB,CAAC;EAC/D,YAAY,MAAM,qBAChB,OAAO,WAAW,OAAO,UAAU,MAAM,gBAAgB,CAAC;EAC5D,oBAAoB,OAAO,WAAW,OAAO,aAAa,CAAC;EAC3D,cAAc,SAAS,OAAO,WAAW,OAAO,YAAY,IAAI,CAAC;EACjE,YAAY,UAAU,OAAO,WAAW,OAAO,UAAU,KAAK,CAAC;EAC/D,qBAAqB,OAAO,WAAW,OAAO,cAAc,CAAC;CAC/D;AACF;;AAGA,SAAgB,UAAU,SAA0D;CAClF,MAAM,SAAS,KAAK,OAAO;CAC3B,OAAO;EACL,WAAW,OAAO,UACf,MAAM,OAAO,UAAU,EAAE,KAAK,CAAC,EAAA,CAAG,KAAK,UAAU;GAChD,GAAG;GACH,QAAQ,KAAK,WAAW,YAAY,KAAK,WAAW,YAAY,KAAK,SAAS;EAChF,EAAE;EACJ,UAAU;CACZ;AACF"}
+{"version":3,"file":"cloudflare-CGmasR8A.mjs","names":["EffectAuth.manifest","EffectAuth.oauthMethod","EffectAuth.tokenMethod","EffectAuth.subjectResolver","Connection.fromEffectFlow","EffectAuth.oauthFlow","Connection.fromEffectTokenMethod","EffectAuth.tokenConnectionMethod","EffectAuth.tokenValidator","Cloudflare.make"],"sources":["../src/promise/cloudflare-auth.ts","../src/promise/cloudflare.ts"],"sourcesContent":["import type * as oauth from \"oauth4webapi\";\nimport { Effect } from \"effect\";\n\nimport type * as ProviderAuth from \"../auth/manifest.ts\";\nimport type * as Secret from \"../auth/secret.ts\";\nimport * as EffectAuth from \"../providers/cloudflare/auth.ts\";\nimport * as Connection from \"./connection.ts\";\n\nexport const manifest = EffectAuth.manifest;\nexport const oauthMethod = EffectAuth.oauthMethod;\nexport const tokenMethod = EffectAuth.tokenMethod;\nexport type {\n  CredentialTarget,\n  OAuthFlowOptions,\n  OAuthMethodOptions,\n  SubjectResolverOptions,\n  TokenValidatorOptions,\n} from \"../providers/cloudflare/auth.ts\";\n\nexport function subjectResolver(\n  options: EffectAuth.SubjectResolverOptions,\n): ProviderAuth.AsyncOAuthSubjectResolver {\n  const resolve = EffectAuth.subjectResolver(options);\n  return (tokens: oauth.TokenEndpointResponse, accessToken: Secret.Value) =>\n    Effect.runPromise(resolve(tokens, accessToken));\n}\n\n/** Creates Cloudflare's OAuth implementation for the Promise connection facade. */\nexport function oauthFlow(options: EffectAuth.OAuthFlowOptions): Connection.InteractiveFlow {\n  return Connection.fromEffectFlow(EffectAuth.oauthFlow(options));\n}\n\n/** Creates a Cloudflare token method for the Promise connection facade. */\nexport function tokenConnectionMethod(\n  options: EffectAuth.TokenConnectionOptions,\n): Extract<Connection.Method, { readonly _tag: \"Token\" }> {\n  return Connection.fromEffectTokenMethod(EffectAuth.tokenConnectionMethod(options));\n}\n\nexport function tokenValidator(\n  options: EffectAuth.TokenValidatorOptions,\n): (token: Secret.Value) => Promise<ProviderAuth.TokenValidation> {\n  const validate = EffectAuth.tokenValidator(options);\n  return (token) => Effect.runPromise(validate(token));\n}\n","import { Effect } from \"effect\";\n\nimport type * as ProviderAuth from \"../auth/manifest.ts\";\nimport type * as DnsProvider from \"../provider/provider.ts\";\nimport * as Cloudflare from \"../providers/cloudflare/index.ts\";\nimport type * as ZoneDiscovery from \"./zone-discovery.ts\";\n\nexport * as Auth from \"./cloudflare-auth.ts\";\nexport type {\n  Account,\n  Fetch,\n  ListZonesInput,\n  Options,\n  Zone,\n} from \"../providers/cloudflare/client.ts\";\n\nexport interface Interface extends DnsProvider.AsyncInterface {\n  readonly listAccounts: () => Promise<ReadonlyArray<Cloudflare.Account>>;\n  readonly listZones: (\n    input?: Cloudflare.Client.ListZonesInput,\n  ) => Promise<ReadonlyArray<Cloudflare.Zone>>;\n  readonly validateToken: () => Promise<ProviderAuth.TokenValidation>;\n}\n\n/** Creates a Promise-compatible facade over the Effect-native Cloudflare client. */\nexport function make(options: Cloudflare.Client.Options): Interface {\n  const client = Cloudflare.make(options);\n  return {\n    id: client.id,\n    createRecord: (zone, record) => Effect.runPromise(client.createRecord(zone, record)),\n    deleteRecord: (zone, providerRecordId) =>\n      Effect.runPromise(client.deleteRecord(zone, providerRecordId)),\n    getRecord: (zone, providerRecordId) =>\n      Effect.runPromise(client.getRecord(zone, providerRecordId)),\n    listAccounts: () => Effect.runPromise(client.listAccounts()),\n    listRecords: (zone) => Effect.runPromise(client.listRecords(zone)),\n    listZones: (input) => Effect.runPromise(client.listZones(input)),\n    validateToken: () => Effect.runPromise(client.validateToken()),\n  };\n}\n\n/** Creates the optional Cloudflare discovery source for Promise consumers. */\nexport function discovery(options: Cloudflare.Client.Options): ZoneDiscovery.Source {\n  const client = make(options);\n  return {\n    listZones: async (name) =>\n      (await client.listZones({ name })).map((zone) => ({\n        ...zone,\n        status: zone.status === \"active\" || zone.status === \"pending\" ? zone.status : \"unknown\",\n      })),\n    provider: client,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;AAQA,MAAa,WAAWA;AACxB,MAAa,cAAcC;AAC3B,MAAa,cAAcC;AAS3B,SAAgB,gBACd,SACwC;CACxC,MAAM,UAAUC,kBAA2B,OAAO;CAClD,QAAQ,QAAqC,gBAC3C,OAAO,WAAW,QAAQ,QAAQ,WAAW,CAAC;AAClD;;AAGA,SAAgB,UAAU,SAAkE;CAC1F,OAAOC,eAA0BC,YAAqB,OAAO,CAAC;AAChE;;AAGA,SAAgB,sBACd,SACwD;CACxD,OAAOC,sBAAiCC,wBAAiC,OAAO,CAAC;AACnF;AAEA,SAAgB,eACd,SACgE;CAChE,MAAM,WAAWC,iBAA0B,OAAO;CAClD,QAAQ,UAAU,OAAO,WAAW,SAAS,KAAK,CAAC;AACrD;;;;;;;;;ACnBA,SAAgB,KAAK,SAA+C;CAClE,MAAM,SAASC,OAAgB,OAAO;CACtC,OAAO;EACL,IAAI,OAAO;EACX,eAAe,MAAM,WAAW,OAAO,WAAW,OAAO,aAAa,MAAM,MAAM,CAAC;EACnF,eAAe,MAAM,qBACnB,OAAO,WAAW,OAAO,aAAa,MAAM,gBAAgB,CAAC;EAC/D,YAAY,MAAM,qBAChB,OAAO,WAAW,OAAO,UAAU,MAAM,gBAAgB,CAAC;EAC5D,oBAAoB,OAAO,WAAW,OAAO,aAAa,CAAC;EAC3D,cAAc,SAAS,OAAO,WAAW,OAAO,YAAY,IAAI,CAAC;EACjE,YAAY,UAAU,OAAO,WAAW,OAAO,UAAU,KAAK,CAAC;EAC/D,qBAAqB,OAAO,WAAW,OAAO,cAAc,CAAC;CAC/D;AACF;;AAGA,SAAgB,UAAU,SAA0D;CAClF,MAAM,SAAS,KAAK,OAAO;CAC3B,OAAO;EACL,WAAW,OAAO,UACf,MAAM,OAAO,UAAU,EAAE,KAAK,CAAC,EAAA,CAAG,KAAK,UAAU;GAChD,GAAG;GACH,QAAQ,KAAK,WAAW,YAAY,KAAK,WAAW,YAAY,KAAK,SAAS;EAChF,EAAE;EACJ,UAAU;CACZ;AACF"}

package/dist/cloudflare.d.mts

@@ -1,3 +1,3 @@
-import { _ as Zone, f as Account, g as Options, h as ListZonesInput, p as Fetch } from "./index-B1opsgls.mjs";
-import { a as cloudflare_auth_d_exports, i as make, r as discovery, t as Interface } from "./cloudflare-FDl5q7Dm.mjs";
+import { _ as Zone, f as Account, g as Options, h as ListZonesInput, p as Fetch } from "./index-BHWRTThN.mjs";
+import { a as cloudflare_auth_d_exports, i as make, r as discovery, t as Interface } from "./cloudflare-BrZPU9li.mjs";
 export { type Account, cloudflare_auth_d_exports as Auth, type Fetch, Interface, type ListZonesInput, type Options, type Zone, discovery, make };

package/dist/cloudflare.mjs

@@ -1,2 +1,2 @@
-import { i as cloudflare_auth_exports, n as discovery, r as make } from "./cloudflare-Bg_p-M2c.mjs";
+import { i as cloudflare_auth_exports, n as discovery, r as make } from "./cloudflare-CGmasR8A.mjs";
 export { cloudflare_auth_exports as Auth, discovery, make };

package/dist/{connection-CEqadXSm.d.mts → connection-BfkloPZy.d.mts}

@@ -1,5 +1,5 @@
-import { A as Connection, B as Capability, C as Aggregate, D as Service, E as Interface, F as assertGrant, M as OAuthContinuation, N as Schema$1, Nt as DomainName, P as StoredCredential, R as encode, T as Error, V as CapabilityEvidence, _ as StartResult, a as Authentication, ct as AsyncInterface, d as Error$1, h as Method$1, j as Grant, k as AuthorizationError, l as Continuation, m as InteractiveStart, ot as Value, p as InteractiveFlow$1, r as Source$1, s as BaseInput, t as Candidate, u as ContinuationStore$1, w as DetachResult } from "./zone-discovery-BA5I24vu.mjs";
-import "./connection-api-DftK7eHo.mjs";
+import { B as encode, D as Error, E as DetachResult, F as Schema$1, Ft as DomainName, H as Capability, I as StoredCredential, L as assertGrant, M as Connection, N as Grant, O as Interface, P as OAuthContinuation, T as Aggregate, U as CapabilityEvidence, a as Authentication, ct as Value, d as Error$1, f as ExtendInput, g as Method$1, h as InteractiveStart, j as AuthorizationError, k as Service, l as Continuation, m as InteractiveFlow$1, r as Source$1, s as BaseInput, t as Candidate, u as ContinuationStore$1, ut as AsyncInterface, v as StartResult } from "./zone-discovery-BPnH3sLU.mjs";
+import "./connection-api-DNuEZ_jR.mjs";
 import { Data, Layer } from "effect";
 declare namespace zone_discovery_d_exports {
   export { Candidate, Outcome, Source, discover, toEffectSource };
@@ -47,7 +47,7 @@ declare const layerFrom: (repository: Repository) => Layer.Layer<Service>;
 declare const toAsync: (repository: Interface) => Repository;
 declare const from: (repository: Repository) => Repository;
 declare namespace connection_d_exports {
-  export { Authentication, AuthorizationError, Connection, StartResult as ConnectionStartResult, ContinuationStore, Error$1 as Error, Grant, InteractiveFlow, Method, OAuthContinuation, Schema$1 as Schema, StartResult, StoredCredential, assertGrant, complete, decode, encode, fromEffectFlow, fromEffectTokenMethod, start, toAsyncContinuations };
+  export { Authentication, AuthorizationError, Connection, StartResult as ConnectionStartResult, ContinuationStore, Error$1 as Error, ExtendInput, Grant, InteractiveFlow, Method, OAuthContinuation, Schema$1 as Schema, StartResult, StoredCredential, assertGrant, complete, decode, encode, extend, fromEffectFlow, fromEffectTokenMethod, start, toAsyncContinuations };
 }
 declare function decode(input: unknown): Promise<Connection>;
 type Method = Data.TaggedEnum<{
@@ -177,6 +177,10 @@ declare function complete(input: {
   readonly flow: InteractiveFlow;
   readonly repository: Repository;
 }): Promise<Aggregate>;
+/** Extends one owner binding without repeating provider authentication. */
+declare function extend(input: ExtendInput & {
+  readonly repository: Repository;
+}): Promise<Aggregate>;
 //#endregion
 export { Source as a, authorization_lifecycle_d_exports as i, Method as n, zone_discovery_d_exports as o, connection_d_exports as r, InteractiveFlow as t };
-//# sourceMappingURL=connection-CEqadXSm.d.mts.map
+//# sourceMappingURL=connection-BfkloPZy.d.mts.map

package/dist/{connection-X3rZhrBZ.mjs → connection-BwtOwpH6.mjs}

@@ -1,7 +1,7 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
 import { M as Service, j as Error } from "./dns-record-BLeqo56C.mjs";
-import { _ as StartResult, g as Method$1, h as Error$1, v as complete$1, y as start$1 } from "./authorization-CQSKKMrW.mjs";
-import { i as assertGrant, n as Grant, o as decode$1, r as Schema$1, s as encode, t as AuthorizationError } from "./connection-BXoSrhZs.mjs";
+import { _ as StartResult, b as start$1, g as Method$1, h as Error$1, v as complete$1, y as extend$1 } from "./authorization-OeaSR47S.mjs";
+import { i as assertGrant, n as Grant, o as decode$1, r as Schema$1, s as encode, t as AuthorizationError } from "./connection-CjNQe_E-.mjs";
 import { i as webCryptoLayer } from "./canonical-json-CpvqGMcr.mjs";
 import { Data, Effect, Layer } from "effect";
 //#region src/promise/authorization-lifecycle.ts
@@ -92,6 +92,7 @@ var connection_exports = /* @__PURE__ */ __exportAll({
 	complete: () => complete,
 	decode: () => decode,
 	encode: () => encode,
+	extend: () => extend,
 	fromEffectFlow: () => fromEffectFlow,
 	fromEffectTokenMethod: () => fromEffectTokenMethod,
 	start: () => start,
@@ -180,7 +181,15 @@ async function complete(input) {
 		flow: effectFlow(input.flow)
 	}).pipe(Effect.provide(Layer.merge(layerFrom(input.repository), webCryptoLayer))));
 }
+/** Extends one owner binding without repeating provider authentication. */
+async function extend(input) {
+	return Effect.runPromise(extend$1({
+		connectionId: input.connectionId,
+		grant: input.grant,
+		ownerId: input.ownerId
+	}).pipe(Effect.provide(layerFrom(input.repository))));
+}
 //#endregion
 export { authorization_lifecycle_exports as i, fromEffectFlow as n, fromEffectTokenMethod as r, connection_exports as t };
 
-//# sourceMappingURL=connection-X3rZhrBZ.mjs.map
+//# sourceMappingURL=connection-BwtOwpH6.mjs.map

package/dist/connection-BwtOwpH6.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-BwtOwpH6.mjs","names":["Lifecycle.Error","Lifecycle.Service","Connection.decode","Connect.Error","Connect.start","LifecycleRepository.layerFrom","Connect.complete","Connect.extend"],"sources":["../src/promise/authorization-lifecycle.ts","../src/promise/connection.ts"],"sourcesContent":["import { Effect, Layer } from \"effect\";\n\nimport type * as ProviderAuthorization from \"../auth/authorization.ts\";\nimport type * as Connection from \"../auth/connection.ts\";\nimport * as Lifecycle from \"../auth/lifecycle-repository.ts\";\n\nexport interface Repository {\n  readonly bind: (\n    authorizationId: string,\n    binding: Connection.Connection,\n  ) => Promise<Lifecycle.Aggregate>;\n  readonly connect: (aggregate: Lifecycle.Aggregate) => Promise<Lifecycle.Aggregate>;\n  readonly detach: (input: {\n    readonly connectionId: string;\n    readonly revoke: (aggregate: Lifecycle.Aggregate) => Promise<void>;\n  }) => Promise<Lifecycle.DetachResult>;\n  readonly findByProviderAccount: (\n    providerId: string,\n    providerAccountId: string,\n  ) => Promise<Lifecycle.Aggregate | null>;\n  readonly get: (authorizationId: string) => Promise<Lifecycle.Aggregate | null>;\n  readonly getByConnectionId: (connectionId: string) => Promise<Lifecycle.Aggregate | null>;\n  readonly promoteEvidence: (\n    authorizationId: string,\n    evidence: ReadonlyArray<ProviderAuthorization.CapabilityEvidence>,\n  ) => Promise<Lifecycle.Aggregate>;\n  readonly recover: (input: {\n    readonly authorizationId: string;\n    readonly revoke: (aggregate: Lifecycle.Aggregate) => Promise<void>;\n  }) => Promise<Lifecycle.DetachResult>;\n  readonly rotate: (\n    authorizationId: string,\n    credential: Connection.StoredCredential,\n    expiresAt: Date | null,\n  ) => Promise<Lifecycle.Aggregate>;\n}\n\nconst failure = (operation: string, cause: unknown): Lifecycle.Error =>\n  cause instanceof Lifecycle.Error\n    ? cause\n    : new Lifecycle.Error({\n        category: \"storage\",\n        message: cause instanceof globalThis.Error ? cause.message : String(cause),\n        operation,\n        retry: \"safe\",\n      });\n\nexport const layerFrom = (repository: Repository): Layer.Layer<Lifecycle.Service> =>\n  Layer.succeed(Lifecycle.Service, {\n    bind: Effect.fn(\"AuthorizationLifecycleRepository.bind\")((authorizationId, binding) =>\n      Effect.tryPromise({\n        try: () => repository.bind(authorizationId, binding),\n        catch: (cause) => failure(\"AuthorizationLifecycleRepository.bind\", cause),\n      }),\n    ),\n    connect: Effect.fn(\"AuthorizationLifecycleRepository.connect\")((aggregate) =>\n      Effect.tryPromise({\n        try: () => repository.connect(aggregate),\n        catch: (cause) => failure(\"AuthorizationLifecycleRepository.connect\", cause),\n      }),\n    ),\n    detach: ({ connectionId, revoke }) =>\n      Effect.tryPromise({\n        try: () =>\n          repository.detach({\n            connectionId,\n            revoke: (aggregate) => Effect.runPromise(revoke(aggregate)),\n          }),\n        catch: (cause) => failure(\"AuthorizationLifecycleRepository.detach\", cause),\n      }),\n    findByProviderAccount: Effect.fn(\"AuthorizationLifecycleRepository.findByProviderAccount\")(\n      (providerId, providerAccountId) =>\n        Effect.tryPromise({\n          try: () => repository.findByProviderAccount(providerId, providerAccountId),\n          catch: (cause) =>\n            failure(\"AuthorizationLifecycleRepository.findByProviderAccount\", cause),\n        }),\n    ),\n    get: Effect.fn(\"AuthorizationLifecycleRepository.get\")((authorizationId) =>\n      Effect.tryPromise({\n        try: () => repository.get(authorizationId),\n        catch: (cause) => failure(\"AuthorizationLifecycleRepository.get\", cause),\n      }),\n    ),\n    getByConnectionId: Effect.fn(\"AuthorizationLifecycleRepository.getByConnectionId\")(\n      (connectionId) =>\n        Effect.tryPromise({\n          try: () => repository.getByConnectionId(connectionId),\n          catch: (cause) => failure(\"AuthorizationLifecycleRepository.getByConnectionId\", cause),\n        }),\n    ),\n    promoteEvidence: Effect.fn(\"AuthorizationLifecycleRepository.promoteEvidence\")(\n      (authorizationId, evidence) =>\n        Effect.tryPromise({\n          try: () => repository.promoteEvidence(authorizationId, evidence),\n          catch: (cause) => failure(\"AuthorizationLifecycleRepository.promoteEvidence\", cause),\n        }),\n    ),\n    recover: ({ authorizationId, revoke }) =>\n      Effect.tryPromise({\n        try: () =>\n          repository.recover({\n            authorizationId,\n            revoke: (aggregate) => Effect.runPromise(revoke(aggregate)),\n          }),\n        catch: (cause) => failure(\"AuthorizationLifecycleRepository.recover\", cause),\n      }),\n    rotate: Effect.fn(\"AuthorizationLifecycleRepository.rotate\")(\n      (authorizationId, credential, expiresAt) =>\n        Effect.tryPromise({\n          try: () => repository.rotate(authorizationId, credential, expiresAt),\n          catch: (cause) => failure(\"AuthorizationLifecycleRepository.rotate\", cause),\n        }),\n    ),\n  });\n\nexport const toAsync = (repository: Lifecycle.Interface): Repository => ({\n  bind: (authorizationId, binding) => Effect.runPromise(repository.bind(authorizationId, binding)),\n  connect: (aggregate) => Effect.runPromise(repository.connect(aggregate)),\n  detach: ({ connectionId, revoke }) =>\n    Effect.runPromise(\n      repository.detach({\n        connectionId,\n        revoke: (aggregate) => Effect.tryPromise(() => revoke(aggregate)),\n      }),\n    ),\n  findByProviderAccount: (providerId, providerAccountId) =>\n    Effect.runPromise(repository.findByProviderAccount(providerId, providerAccountId)),\n  get: (authorizationId) => Effect.runPromise(repository.get(authorizationId)),\n  getByConnectionId: (connectionId) =>\n    Effect.runPromise(repository.getByConnectionId(connectionId)),\n  promoteEvidence: (authorizationId, evidence) =>\n    Effect.runPromise(repository.promoteEvidence(authorizationId, evidence)),\n  recover: ({ authorizationId, revoke }) =>\n    Effect.runPromise(\n      repository.recover({\n        authorizationId,\n        revoke: (aggregate) => Effect.tryPromise(() => revoke(aggregate)),\n      }),\n    ),\n  rotate: (authorizationId, credential, expiresAt) =>\n    Effect.runPromise(repository.rotate(authorizationId, credential, expiresAt)),\n});\n\nexport const from = (repository: Repository): Repository => repository;\n\nexport { Error } from \"../auth/lifecycle-repository.ts\";\nexport type { Aggregate, DetachResult } from \"../auth/lifecycle-repository.ts\";\n","import { Data, Effect, Layer } from \"effect\";\n\nimport * as Connection from \"../auth/connection.ts\";\nimport * as Connect from \"../auth/connect.ts\";\nimport type * as Repository from \"./authorization-lifecycle.ts\";\nimport type * as ProviderAuthorization from \"../auth/authorization.ts\";\nimport { webCryptoLayer } from \"../plan/canonical-json.ts\";\nimport * as LifecycleRepository from \"./authorization-lifecycle.ts\";\nimport type * as Secret from \"../auth/secret.ts\";\n\nexport { assertGrant, AuthorizationError, encode, Grant, Schema } from \"../auth/connection.ts\";\nexport type { Connection, OAuthContinuation, StoredCredential } from \"../auth/connection.ts\";\n\nexport function decode(input: unknown): Promise<Connection.Connection> {\n  return Effect.runPromise(Connection.decode(input));\n}\n\nexport type Method = Data.TaggedEnum<{\n  Interactive: {\n    readonly continuations: ContinuationStore;\n    readonly flow: InteractiveFlow;\n    readonly ttlMs?: number;\n  };\n  Token: {\n    readonly authenticate: (token: Secret.Value) => Promise<Connect.Authentication>;\n    readonly providerId: string;\n    readonly requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n    readonly token: Secret.Value;\n  };\n}>;\nexport const Method = Data.taggedEnum<Method>();\n\nexport interface ContinuationStore {\n  readonly consume: (id: string, now: Date) => Promise<Connect.Continuation | null>;\n  readonly put: (continuation: Connect.Continuation) => Promise<void>;\n}\n\nexport interface InteractiveFlow {\n  readonly complete: (payload: Secret.Value, callbackUrl: URL) => Promise<Connect.Authentication>;\n  readonly method: \"integration\" | \"oauth2\";\n  readonly providerId: string;\n  readonly requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n  readonly start: (continuationId: string) => Promise<Connect.InteractiveStart>;\n}\n\nconst connectionFailure = (operation: string, cause: unknown): Connect.Error =>\n  cause instanceof Connect.Error\n    ? cause\n    : new Connect.Error({\n        category: \"provider\",\n        message: cause instanceof globalThis.Error ? cause.message : String(cause),\n        operation,\n        retry: \"unknown\",\n      });\n\nconst effectMethod = (method: Method): Connect.Method =>\n  method._tag === \"Interactive\"\n    ? Connect.Method.Interactive({\n        continuations: effectContinuations(method.continuations),\n        flow: effectFlow(method.flow),\n        ...(method.ttlMs === undefined ? {} : { ttlMs: method.ttlMs }),\n      })\n    : Connect.Method.Token({\n        authenticate: (token) =>\n          Effect.tryPromise({\n            try: () => method.authenticate(token),\n            catch: (cause) => connectionFailure(\"Connection.start\", cause),\n          }),\n        providerId: method.providerId,\n        requiredCapabilities: method.requiredCapabilities,\n        token: method.token,\n      });\n\nconst effectContinuations = (store: ContinuationStore): Connect.ContinuationStore => ({\n  consume: (id, now) =>\n    Effect.tryPromise({\n      try: () => store.consume(id, now),\n      catch: (cause) => connectionFailure(\"ConnectionContinuations.consume\", cause),\n    }),\n  put: (continuation) =>\n    Effect.tryPromise({\n      try: () => store.put(continuation),\n      catch: (cause) => connectionFailure(\"ConnectionContinuations.put\", cause),\n    }),\n});\n\nexport const toAsyncContinuations = (store: Connect.ContinuationStore): ContinuationStore => ({\n  consume: (id, now) => Effect.runPromise(store.consume(id, now)),\n  put: (continuation) => Effect.runPromise(store.put(continuation)),\n});\n\nconst effectFlow = (flow: InteractiveFlow): Connect.InteractiveFlow => ({\n  complete: (payload, callbackUrl) =>\n    Effect.tryPromise({\n      try: () => flow.complete(payload, callbackUrl),\n      catch: (cause) => connectionFailure(\"Connection.complete\", cause),\n    }),\n  method: flow.method,\n  providerId: flow.providerId,\n  requiredCapabilities: flow.requiredCapabilities,\n  start: (continuationId) =>\n    Effect.tryPromise({\n      try: () => flow.start(continuationId),\n      catch: (cause) => connectionFailure(\"Connection.start\", cause),\n    }),\n});\n\n/** Adapts an Effect-native provider flow to the Promise facade. */\nexport const fromEffectFlow = (flow: Connect.InteractiveFlow): InteractiveFlow => ({\n  complete: (payload, callbackUrl) => Effect.runPromise(flow.complete(payload, callbackUrl)),\n  method: flow.method,\n  providerId: flow.providerId,\n  requiredCapabilities: flow.requiredCapabilities,\n  start: (continuationId) =>\n    Effect.runPromise(flow.start(continuationId).pipe(Effect.provide(webCryptoLayer))),\n});\n\n/** Adapts an Effect-native token method to the Promise facade. */\nexport function fromEffectTokenMethod(\n  method: Extract<Connect.Method, { readonly _tag: \"Token\" }>,\n): Extract<Method, { readonly _tag: \"Token\" }> {\n  return Method.Token({\n    authenticate: (token) => Effect.runPromise(method.authenticate(token)),\n    providerId: method.providerId,\n    requiredCapabilities: method.requiredCapabilities,\n    token: method.token,\n  });\n}\n\nexport async function start(\n  input: Connect.BaseInput & {\n    readonly method: Method;\n    readonly repository: Repository.Repository;\n  },\n): Promise<Connect.StartResult> {\n  return Effect.runPromise(\n    Connect.start({\n      authorizedById: input.authorizedById,\n      grant: input.grant,\n      method: effectMethod(input.method),\n      ownerId: input.ownerId,\n    }).pipe(\n      Effect.provide(Layer.merge(LifecycleRepository.layerFrom(input.repository), webCryptoLayer)),\n    ),\n  );\n}\n\nexport async function complete(input: {\n  readonly callbackUrl: URL;\n  readonly continuationId: string;\n  readonly continuations: ContinuationStore;\n  readonly flow: InteractiveFlow;\n  readonly repository: Repository.Repository;\n}): Promise<Repository.Aggregate> {\n  return Effect.runPromise(\n    Connect.complete({\n      callbackUrl: input.callbackUrl,\n      continuationId: input.continuationId,\n      continuations: effectContinuations(input.continuations),\n      flow: effectFlow(input.flow),\n    }).pipe(\n      Effect.provide(Layer.merge(LifecycleRepository.layerFrom(input.repository), webCryptoLayer)),\n    ),\n  );\n}\n\n/** Extends one owner binding without repeating provider authentication. */\nexport async function extend(\n  input: Connect.ExtendInput & { readonly repository: Repository.Repository },\n): Promise<Repository.Aggregate> {\n  return Effect.runPromise(\n    Connect.extend({\n      connectionId: input.connectionId,\n      grant: input.grant,\n      ownerId: input.ownerId,\n    }).pipe(Effect.provide(LifecycleRepository.layerFrom(input.repository))),\n  );\n}\n\nexport { Error, StartResult } from \"../auth/connect.ts\";\nexport type { Authentication, ConnectionStartResult, ExtendInput } from \"../auth/connection-api.ts\";\n"],"mappings":";;;;;;;;;;;;;AAqCA,MAAM,WAAW,WAAmB,UAClC,iBAAiBA,QACb,QACA,IAAIA,MAAgB;CAClB,UAAU;CACV,SAAS,iBAAiB,WAAW,QAAQ,MAAM,UAAU,OAAO,KAAK;CACzE;CACA,OAAO;AACT,CAAC;AAEP,MAAa,aAAa,eACxB,MAAM,QAAQC,SAAmB;CAC/B,MAAM,OAAO,GAAG,uCAAuC,CAAC,EAAE,iBAAiB,YACzE,OAAO,WAAW;EAChB,WAAW,WAAW,KAAK,iBAAiB,OAAO;EACnD,QAAQ,UAAU,QAAQ,yCAAyC,KAAK;CAC1E,CAAC,CACH;CACA,SAAS,OAAO,GAAG,0CAA0C,CAAC,EAAE,cAC9D,OAAO,WAAW;EAChB,WAAW,WAAW,QAAQ,SAAS;EACvC,QAAQ,UAAU,QAAQ,4CAA4C,KAAK;CAC7E,CAAC,CACH;CACA,SAAS,EAAE,cAAc,aACvB,OAAO,WAAW;EAChB,WACE,WAAW,OAAO;GAChB;GACA,SAAS,cAAc,OAAO,WAAW,OAAO,SAAS,CAAC;EAC5D,CAAC;EACH,QAAQ,UAAU,QAAQ,2CAA2C,KAAK;CAC5E,CAAC;CACH,uBAAuB,OAAO,GAAG,wDAAwD,CAAC,EACvF,YAAY,sBACX,OAAO,WAAW;EAChB,WAAW,WAAW,sBAAsB,YAAY,iBAAiB;EACzE,QAAQ,UACN,QAAQ,0DAA0D,KAAK;CAC3E,CAAC,CACL;CACA,KAAK,OAAO,GAAG,sCAAsC,CAAC,EAAE,oBACtD,OAAO,WAAW;EAChB,WAAW,WAAW,IAAI,eAAe;EACzC,QAAQ,UAAU,QAAQ,wCAAwC,KAAK;CACzE,CAAC,CACH;CACA,mBAAmB,OAAO,GAAG,oDAAoD,CAAC,EAC/E,iBACC,OAAO,WAAW;EAChB,WAAW,WAAW,kBAAkB,YAAY;EACpD,QAAQ,UAAU,QAAQ,sDAAsD,KAAK;CACvF,CAAC,CACL;CACA,iBAAiB,OAAO,GAAG,kDAAkD,CAAC,EAC3E,iBAAiB,aAChB,OAAO,WAAW;EAChB,WAAW,WAAW,gBAAgB,iBAAiB,QAAQ;EAC/D,QAAQ,UAAU,QAAQ,oDAAoD,KAAK;CACrF,CAAC,CACL;CACA,UAAU,EAAE,iBAAiB,aAC3B,OAAO,WAAW;EAChB,WACE,WAAW,QAAQ;GACjB;GACA,SAAS,cAAc,OAAO,WAAW,OAAO,SAAS,CAAC;EAC5D,CAAC;EACH,QAAQ,UAAU,QAAQ,4CAA4C,KAAK;CAC7E,CAAC;CACH,QAAQ,OAAO,GAAG,yCAAyC,CAAC,EACzD,iBAAiB,YAAY,cAC5B,OAAO,WAAW;EAChB,WAAW,WAAW,OAAO,iBAAiB,YAAY,SAAS;EACnE,QAAQ,UAAU,QAAQ,2CAA2C,KAAK;CAC5E,CAAC,CACL;AACF,CAAC;AAEH,MAAa,WAAW,gBAAiD;CACvE,OAAO,iBAAiB,YAAY,OAAO,WAAW,WAAW,KAAK,iBAAiB,OAAO,CAAC;CAC/F,UAAU,cAAc,OAAO,WAAW,WAAW,QAAQ,SAAS,CAAC;CACvE,SAAS,EAAE,cAAc,aACvB,OAAO,WACL,WAAW,OAAO;EAChB;EACA,SAAS,cAAc,OAAO,iBAAiB,OAAO,SAAS,CAAC;CAClE,CAAC,CACH;CACF,wBAAwB,YAAY,sBAClC,OAAO,WAAW,WAAW,sBAAsB,YAAY,iBAAiB,CAAC;CACnF,MAAM,oBAAoB,OAAO,WAAW,WAAW,IAAI,eAAe,CAAC;CAC3E,oBAAoB,iBAClB,OAAO,WAAW,WAAW,kBAAkB,YAAY,CAAC;CAC9D,kBAAkB,iBAAiB,aACjC,OAAO,WAAW,WAAW,gBAAgB,iBAAiB,QAAQ,CAAC;CACzE,UAAU,EAAE,iBAAiB,aAC3B,OAAO,WACL,WAAW,QAAQ;EACjB;EACA,SAAS,cAAc,OAAO,iBAAiB,OAAO,SAAS,CAAC;CAClE,CAAC,CACH;CACF,SAAS,iBAAiB,YAAY,cACpC,OAAO,WAAW,WAAW,OAAO,iBAAiB,YAAY,SAAS,CAAC;AAC/E;AAEA,MAAa,QAAQ,eAAuC;;;;;;;;;;;;;;;;;;;;ACnI5D,SAAgB,OAAO,OAAgD;CACrE,OAAO,OAAO,WAAWC,SAAkB,KAAK,CAAC;AACnD;AAeA,MAAa,SAAS,KAAK,WAAmB;AAe9C,MAAM,qBAAqB,WAAmB,UAC5C,iBAAiBC,UACb,QACA,IAAIA,QAAc;CAChB,UAAU;CACV,SAAS,iBAAiB,WAAW,QAAQ,MAAM,UAAU,OAAO,KAAK;CACzE;CACA,OAAO;AACT,CAAC;AAEP,MAAM,gBAAgB,WACpB,OAAO,SAAS,gBAAA,SACG,YAAY;CACzB,eAAe,oBAAoB,OAAO,aAAa;CACvD,MAAM,WAAW,OAAO,IAAI;CAC5B,GAAI,OAAO,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,OAAO,MAAM;AAC9D,CAAC,IAAA,SACc,MAAM;CACnB,eAAe,UACb,OAAO,WAAW;EAChB,WAAW,OAAO,aAAa,KAAK;EACpC,QAAQ,UAAU,kBAAkB,oBAAoB,KAAK;CAC/D,CAAC;CACH,YAAY,OAAO;CACnB,sBAAsB,OAAO;CAC7B,OAAO,OAAO;AAChB,CAAC;AAEP,MAAM,uBAAuB,WAAyD;CACpF,UAAU,IAAI,QACZ,OAAO,WAAW;EAChB,WAAW,MAAM,QAAQ,IAAI,GAAG;EAChC,QAAQ,UAAU,kBAAkB,mCAAmC,KAAK;CAC9E,CAAC;CACH,MAAM,iBACJ,OAAO,WAAW;EAChB,WAAW,MAAM,IAAI,YAAY;EACjC,QAAQ,UAAU,kBAAkB,+BAA+B,KAAK;CAC1E,CAAC;AACL;AAEA,MAAa,wBAAwB,WAAyD;CAC5F,UAAU,IAAI,QAAQ,OAAO,WAAW,MAAM,QAAQ,IAAI,GAAG,CAAC;CAC9D,MAAM,iBAAiB,OAAO,WAAW,MAAM,IAAI,YAAY,CAAC;AAClE;AAEA,MAAM,cAAc,UAAoD;CACtE,WAAW,SAAS,gBAClB,OAAO,WAAW;EAChB,WAAW,KAAK,SAAS,SAAS,WAAW;EAC7C,QAAQ,UAAU,kBAAkB,uBAAuB,KAAK;CAClE,CAAC;CACH,QAAQ,KAAK;CACb,YAAY,KAAK;CACjB,sBAAsB,KAAK;CAC3B,QAAQ,mBACN,OAAO,WAAW;EAChB,WAAW,KAAK,MAAM,cAAc;EACpC,QAAQ,UAAU,kBAAkB,oBAAoB,KAAK;CAC/D,CAAC;AACL;;AAGA,MAAa,kBAAkB,UAAoD;CACjF,WAAW,SAAS,gBAAgB,OAAO,WAAW,KAAK,SAAS,SAAS,WAAW,CAAC;CACzF,QAAQ,KAAK;CACb,YAAY,KAAK;CACjB,sBAAsB,KAAK;CAC3B,QAAQ,mBACN,OAAO,WAAW,KAAK,MAAM,cAAc,CAAC,CAAC,KAAK,OAAO,QAAQ,cAAc,CAAC,CAAC;AACrF;;AAGA,SAAgB,sBACd,QAC6C;CAC7C,OAAO,OAAO,MAAM;EAClB,eAAe,UAAU,OAAO,WAAW,OAAO,aAAa,KAAK,CAAC;EACrE,YAAY,OAAO;EACnB,sBAAsB,OAAO;EAC7B,OAAO,OAAO;CAChB,CAAC;AACH;AAEA,eAAsB,MACpB,OAI8B;CAC9B,OAAO,OAAO,WACZC,QAAc;EACZ,gBAAgB,MAAM;EACtB,OAAO,MAAM;EACb,QAAQ,aAAa,MAAM,MAAM;EACjC,SAAS,MAAM;CACjB,CAAC,CAAC,CAAC,KACD,OAAO,QAAQ,MAAM,MAAMC,UAA8B,MAAM,UAAU,GAAG,cAAc,CAAC,CAC7F,CACF;AACF;AAEA,eAAsB,SAAS,OAMG;CAChC,OAAO,OAAO,WACZC,WAAiB;EACf,aAAa,MAAM;EACnB,gBAAgB,MAAM;EACtB,eAAe,oBAAoB,MAAM,aAAa;EACtD,MAAM,WAAW,MAAM,IAAI;CAC7B,CAAC,CAAC,CAAC,KACD,OAAO,QAAQ,MAAM,MAAMD,UAA8B,MAAM,UAAU,GAAG,cAAc,CAAC,CAC7F,CACF;AACF;;AAGA,eAAsB,OACpB,OAC+B;CAC/B,OAAO,OAAO,WACZE,SAAe;EACb,cAAc,MAAM;EACpB,OAAO,MAAM;EACb,SAAS,MAAM;CACjB,CAAC,CAAC,CAAC,KAAK,OAAO,QAAQF,UAA8B,MAAM,UAAU,CAAC,CAAC,CACzE;AACF"}

package/dist/{connection-BXoSrhZs.mjs → connection-CjNQe_E-.mjs}

@@ -1,5 +1,5 @@
 import { O as parse, T as Schema$2, k as Error$1 } from "./dns-record-BLeqo56C.mjs";
-import { l as evidenceFor } from "./authorization-CQSKKMrW.mjs";
+import { l as evidenceFor } from "./authorization-OeaSR47S.mjs";
 import { Effect, Schema } from "effect";
 //#region src/auth/connection.ts
 const Grant = Schema.TaggedUnion({
@@ -55,4 +55,4 @@ function assertGrant(connection, authorization, request) {
 //#endregion
 export { authorizationError as a, validate as c, assertGrant as i, Grant as n, decode as o, Schema$1 as r, encode as s, AuthorizationError as t };
 
-//# sourceMappingURL=connection-BXoSrhZs.mjs.map
+//# sourceMappingURL=connection-CjNQe_E-.mjs.map