domainkit 0.2.1 → 0.3.0

package/dist/auth-B4jq3yk3.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-B4jq3yk3.mjs","names":["Secret.make","failure","Connection.Error","S","Data","S","decode","DomainName.decode","failure","DnsRecord.decode","DnsRecord.Opaque","DnsProvider.Error","Protocol.ZoneListEnvelope","Protocol.TokenEnvelope","Zones.candidates","Protocol.RecordListEnvelope","Records.decode","Records.encode","Protocol.RecordEnvelope","DomainName.decode","S","Protocol.BaseEnvelope","DnsProvider.Error","Context","ProviderContext.codec","Client.discoverAuthorizationAccount","Client.make","Client.validateDomainToken","AuthorizationCode.complete","Secret.make","AuthorizationCode.start"],"sources":["../src/auth/authorization-code.ts","../src/providers/cloudflare/protocol.ts","../src/providers/cloudflare/records.ts","../src/providers/cloudflare/client.ts","../src/providers/cloudflare/auth.ts"],"sourcesContent":["import { Crypto, Effect, Schema } from \"effect\";\nimport * as oauth from \"oauth4webapi\";\n\nimport type * as ProviderAuth from \"./manifest.ts\";\nimport * as Connection from \"./connect.ts\";\nimport * as Secret from \"./secret.ts\";\n\nexport type Fetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;\n\nexport interface Payload {\n  readonly codeVerifier: string;\n  readonly redirectUri: string;\n  readonly state: string;\n}\n\nexport const start = Effect.fn(\"AuthorizationCode.start\")(function* (input: {\n  readonly client: ProviderAuth.OAuthClientConfiguration;\n  readonly method: ProviderAuth.OAuthMethod;\n  readonly redirectUri: string;\n  readonly state: string;\n}) {\n  const crypto = yield* Crypto.Crypto;\n  const codeVerifier = base64Url(yield* randomBytes(crypto, 32));\n  const challenge = base64Url(yield* digest(crypto, codeVerifier));\n  const authorizationUrl = new URL(input.method.authorizationServer.authorization_endpoint);\n  authorizationUrl.search = new URLSearchParams({\n    client_id: input.client.clientId,\n    code_challenge: challenge,\n    code_challenge_method: \"S256\",\n    redirect_uri: input.redirectUri,\n    response_type: \"code\",\n    scope: input.method.scopes.join(\" \"),\n    state: input.state,\n  }).toString();\n  return {\n    authorizationUrl,\n    payload: Secret.make(\n      JSON.stringify({ codeVerifier, redirectUri: input.redirectUri, state: input.state }),\n    ),\n  };\n});\n\nexport const complete = Effect.fn(\"AuthorizationCode.complete\")(function* (input: {\n  readonly callbackUrl: URL;\n  readonly client: ProviderAuth.OAuthClientConfiguration;\n  readonly fetch?: Fetch;\n  readonly method: ProviderAuth.OAuthMethod;\n  readonly payload: Secret.Value;\n  readonly providerId: string;\n}) {\n  const payload = yield* decodePayload(input.payload);\n  if (input.callbackUrl.searchParams.get(\"state\") !== payload.state) {\n    return yield* failure(\"Authorization callback state does not match its continuation\");\n  }\n  const server = input.method.authorizationServer as oauth.AuthorizationServer;\n  const client: oauth.Client = { client_id: input.client.clientId };\n  const authentication = yield* clientAuthentication(input.method, input.client);\n  return yield* Effect.tryPromise({\n    try: async (signal) => {\n      const callback = oauth.validateAuthResponse(server, client, input.callbackUrl, payload.state);\n      const response = await oauth.authorizationCodeGrantRequest(\n        server,\n        client,\n        authentication,\n        callback,\n        payload.redirectUri,\n        payload.codeVerifier,\n        requestOptions(input.fetch, signal),\n      );\n      return oauth.processAuthorizationCodeResponse(server, client, response);\n    },\n    catch: (cause) =>\n      new Connection.Error({\n        category: \"provider\",\n        message: cause instanceof globalThis.Error ? cause.name : \"OAuth provider request failed\",\n        operation: \"AuthorizationCode.complete\",\n        retry: \"unknown\",\n      }),\n  });\n});\n\nconst PayloadSchema = Schema.Struct({\n  codeVerifier: Schema.String,\n  redirectUri: Schema.String,\n  state: Schema.String,\n});\n\nfunction decodePayload(payload: Secret.Value): Effect.Effect<Payload, Connection.Error> {\n  return Schema.decodeUnknownEffect(Schema.fromJsonString(PayloadSchema))(payload.expose()).pipe(\n    Effect.mapError(\n      () =>\n        new Connection.Error({\n          category: \"authorization\",\n          message: \"OAuth continuation payload is invalid\",\n          operation: \"AuthorizationCode\",\n          retry: \"after-user-action\",\n        }),\n    ),\n  );\n}\n\nfunction clientAuthentication(\n  method: ProviderAuth.OAuthMethod,\n  client: ProviderAuth.OAuthClientConfiguration,\n): Effect.Effect<oauth.ClientAuth, Connection.Error> {\n  switch (method.clientAuth) {\n    case \"none\":\n      return Effect.succeed(oauth.None());\n    case \"client_secret_basic\":\n      return client.clientSecret === undefined\n        ? failure(\"OAuth client secret is required\")\n        : Effect.succeed(oauth.ClientSecretBasic(client.clientSecret.expose()));\n    case \"client_secret_post\":\n      return client.clientSecret === undefined\n        ? failure(\"OAuth client secret is required\")\n        : Effect.succeed(oauth.ClientSecretPost(client.clientSecret.expose()));\n  }\n}\n\nfunction requestOptions(\n  fetchImplementation: Fetch | undefined,\n  signal: AbortSignal,\n): oauth.TokenEndpointRequestOptions {\n  return fetchImplementation === undefined\n    ? { signal }\n    : {\n        signal,\n        [oauth.customFetch]: (url, options) =>\n          fetchImplementation(url, { ...options, body: options.body }),\n      };\n}\n\nconst failure = (message: string): Effect.Effect<never, Connection.Error> =>\n  Effect.fail(\n    new Connection.Error({\n      category: \"authorization\",\n      message,\n      operation: \"AuthorizationCode\",\n      retry: \"after-user-action\",\n    }),\n  );\n\nfunction randomBytes(\n  crypto: Crypto.Crypto,\n  size: number,\n): Effect.Effect<Uint8Array, Connection.Error> {\n  return crypto.randomBytes(size).pipe(\n    Effect.mapError(\n      (cause) =>\n        new Connection.Error({\n          category: \"validation\",\n          message: cause.message,\n          operation: \"AuthorizationCode.start\",\n          retry: \"safe\",\n        }),\n    ),\n  );\n}\n\nfunction digest(crypto: Crypto.Crypto, value: string): Effect.Effect<Uint8Array, Connection.Error> {\n  return crypto.digest(\"SHA-256\", new TextEncoder().encode(value)).pipe(\n    Effect.mapError(\n      (cause) =>\n        new Connection.Error({\n          category: \"validation\",\n          message: cause.message,\n          operation: \"AuthorizationCode.start\",\n          retry: \"safe\",\n        }),\n    ),\n  );\n}\n\nfunction base64Url(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replaceAll(\"=\", \"\");\n}\n","import { Schema as S } from \"effect\";\n\nexport const ErrorDetail = S.Struct({\n  code: S.Number,\n  message: S.String,\n});\nexport interface ErrorDetail extends S.Schema.Type<typeof ErrorDetail> {}\n\nexport const ResultInfo = S.Struct({\n  count: S.optionalKey(S.Number),\n  page: S.optionalKey(S.Number),\n  per_page: S.optionalKey(S.Number),\n  total_count: S.optionalKey(S.Number),\n  total_pages: S.optionalKey(S.Number),\n});\n\nconst Message = S.Struct({\n  code: S.optionalKey(S.Number),\n  message: S.String,\n});\n\nexport const BaseEnvelope = S.Struct({\n  errors: S.Array(ErrorDetail),\n  messages: S.Array(Message),\n  success: S.Boolean,\n});\n\nexport const Account = S.Struct({\n  id: S.String,\n  name: S.String,\n});\nexport interface Account extends S.Schema.Type<typeof Account> {}\n\nexport const Zone = S.Struct({\n  account: Account,\n  id: S.String,\n  name: S.String,\n  name_servers: S.Array(S.String),\n  status: S.optionalKey(S.String),\n});\nexport interface Zone extends S.Schema.Type<typeof Zone> {}\n\nexport const Record = S.Struct({\n  content: S.optionalKey(S.String),\n  data: S.optionalKey(S.Unknown),\n  id: S.String,\n  name: S.String,\n  priority: S.optionalKey(S.Number),\n  proxied: S.optionalKey(S.Boolean),\n  ttl: S.Number,\n  type: S.String,\n});\nexport interface Record extends S.Schema.Type<typeof Record> {}\n\nexport const Token = S.Struct({\n  expires_on: S.optionalKey(S.String),\n  id: S.String,\n  not_before: S.optionalKey(S.String),\n  status: S.Literals([\"active\", \"disabled\", \"expired\"]),\n});\nexport interface Token extends S.Schema.Type<typeof Token> {}\n\nexport const ZoneListEnvelope = S.Struct({\n  errors: S.Array(ErrorDetail),\n  messages: S.Array(Message),\n  result: S.Array(Zone),\n  result_info: S.optionalKey(ResultInfo),\n  success: S.Boolean,\n});\nexport const RecordListEnvelope = S.Struct({\n  errors: S.Array(ErrorDetail),\n  messages: S.Array(Message),\n  result: S.Array(Record),\n  result_info: S.optionalKey(ResultInfo),\n  success: S.Boolean,\n});\nexport const RecordEnvelope = S.Struct({\n  errors: S.Array(ErrorDetail),\n  messages: S.Array(Message),\n  result: Record,\n  success: S.Boolean,\n});\nexport const TokenEnvelope = S.Struct({\n  errors: S.Array(ErrorDetail),\n  messages: S.Array(Message),\n  result: Token,\n  success: S.Boolean,\n});\n","import { Effect, Schema as S } from \"effect\";\n\nimport * as DomainName from \"../../domain/domain-name.ts\";\nimport * as DnsRecord from \"../../domain/dns-record.ts\";\nimport * as DnsProvider from \"../../provider/provider.ts\";\nimport type * as Protocol from \"./protocol.ts\";\n\nconst Data = S.Struct({\n  flags: S.optionalKey(S.Number),\n  port: S.optionalKey(S.Number),\n  priority: S.optionalKey(S.Number),\n  tag: S.optionalKey(S.String),\n  target: S.optionalKey(S.String),\n  value: S.optionalKey(S.String),\n  weight: S.optionalKey(S.Number),\n});\n\nexport type CreateBody = Readonly<Record<string, unknown>>;\n\nexport const decode = Effect.fn(\"CloudflareRecords.decode\")((record: Protocol.Record) =>\n  Effect.gen(function* () {\n    const name = yield* DomainName.decode(record.name).pipe(\n      Effect.match({ onFailure: () => null, onSuccess: (value) => value }),\n    );\n    if (name === null) return yield* decodeOpaque(record);\n    const common = {\n      metadata: {\n        ownership: \"provider\",\n        provenance: record.proxied === true ? \"cloudflare:proxied\" : \"cloudflare\",\n        purpose: \"existing DNS record\",\n      },\n      name,\n      policy: record.type === \"CNAME\" ? \"exclusive\" : \"append\",\n      ttl: record.ttl === 1 ? null : record.ttl,\n    } as const;\n    const content = () =>\n      record.content === undefined\n        ? Effect.fail(failure(\"decodeRecord\", `Cloudflare ${record.type} record has no content`))\n        : Effect.succeed(record.content);\n\n    switch (record.type) {\n      case \"A\":\n      case \"AAAA\":\n        return yield* DnsRecord.decode({\n          ...common,\n          _tag: record.type,\n          address: yield* content(),\n        }).pipe(Effect.mapError((cause) => failure(\"decodeRecord\", cause.message)));\n      case \"CNAME\":\n      case \"NS\":\n        return yield* DnsRecord.decode({\n          ...common,\n          _tag: record.type,\n          target: yield* content(),\n        }).pipe(Effect.mapError((cause) => failure(\"decodeRecord\", cause.message)));\n      case \"TXT\":\n        return yield* DnsRecord.decode({\n          ...common,\n          _tag: \"TXT\",\n          value: yield* content(),\n        }).pipe(Effect.mapError((cause) => failure(\"decodeRecord\", cause.message)));\n      case \"MX\":\n        return yield* DnsRecord.decode({\n          ...common,\n          _tag: \"MX\",\n          exchange: yield* content(),\n          priority: record.priority,\n        }).pipe(Effect.mapError((cause) => failure(\"decodeRecord\", cause.message)));\n      case \"CAA\": {\n        const data = yield* decodeData(record);\n        return yield* DnsRecord.decode({ ...common, _tag: \"CAA\", ...data }).pipe(\n          Effect.mapError((cause) => failure(\"decodeRecord\", cause.message)),\n        );\n      }\n      case \"SRV\": {\n        const data = yield* decodeData(record);\n        return yield* DnsRecord.decode({ ...common, _tag: \"SRV\", ...data }).pipe(\n          Effect.mapError((cause) => failure(\"decodeRecord\", cause.message)),\n        );\n      }\n      default:\n        return yield* decodeOpaque(record);\n    }\n  }),\n);\n\nconst decodeOpaque = Effect.fn(\"CloudflareRecords.decodeOpaque\")((record: Protocol.Record) =>\n  S.decodeUnknownEffect(DnsRecord.Opaque)({\n    _tag: \"Opaque\",\n    name: record.name,\n    providerRecordId: record.id,\n    providerType: record.type,\n  }).pipe(Effect.mapError((cause) => failure(\"decodeRecord\", cause.message))),\n);\n\nexport function encode(record: DnsRecord.DnsRecord): CreateBody {\n  const common = {\n    name: record.name,\n    proxied: false,\n    ttl: record.ttl ?? 1,\n    type: record._tag,\n  };\n  switch (record._tag) {\n    case \"A\":\n    case \"AAAA\":\n      return { ...common, content: record.address };\n    case \"CNAME\":\n    case \"NS\":\n      return { ...common, content: record.target };\n    case \"TXT\":\n      return { ...common, content: record.value };\n    case \"MX\":\n      return { ...common, content: record.exchange, priority: record.priority };\n    case \"CAA\":\n      return {\n        ...common,\n        data: { flags: record.flags, tag: record.tag, value: record.value },\n      };\n    case \"SRV\":\n      return {\n        ...common,\n        data: {\n          port: record.port,\n          priority: record.priority,\n          target: record.target,\n          weight: record.weight,\n        },\n      };\n  }\n}\n\nconst decodeData = Effect.fn(\"CloudflareRecords.decodeData\")((record: Protocol.Record) =>\n  S.decodeUnknownEffect(Data)(record.data).pipe(\n    Effect.mapError((cause) => failure(\"decodeRecord\", cause.message)),\n  ),\n);\n\nfunction failure(\n  operation: string,\n  message: string,\n  fields: Partial<Pick<DnsProvider.Error, \"reason\">> = {},\n): DnsProvider.Error {\n  return new DnsProvider.Error({\n    message,\n    operation,\n    providerId: \"cloudflare\",\n    reason: fields.reason ?? \"response\",\n  });\n}\n","import { Effect, Schema as S } from \"effect\";\n\nimport type * as ProviderAuth from \"../../auth/manifest.ts\";\nimport type * as Secret from \"../../auth/secret.ts\";\nimport * as DomainName from \"../../domain/domain-name.ts\";\nimport type * as DnsRecord from \"../../domain/dns-record.ts\";\nimport type * as ZoneDiscovery from \"../../discovery/zone-discovery.ts\";\nimport * as Zones from \"../../discovery/zones.ts\";\nimport * as DnsProvider from \"../../provider/provider.ts\";\nimport * as Protocol from \"./protocol.ts\";\nimport * as Records from \"./records.ts\";\n\nexport type Fetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;\n\n/** Configuration for an Effect-native Cloudflare authoritative-DNS client. */\nexport interface Options {\n  readonly accountId: string;\n  readonly baseUrl?: string;\n  /** Capabilities the host required when issuing or authorizing this credential. */\n  readonly capabilities: ProviderAuth.TokenValidation[\"capabilities\"];\n  readonly fetch?: Fetch;\n  readonly token: Secret.Value;\n  readonly tokenKind?: \"account\" | \"user\";\n}\n\nexport interface ListZonesInput {\n  readonly accountId?: string;\n  readonly name?: DomainName.DomainName;\n}\n\nexport type Account = Protocol.Account;\n\n/** A portable Cloudflare authoritative zone with normalized nameserver evidence. */\nexport interface Zone {\n  readonly accountId: string;\n  readonly id: string;\n  readonly name: DomainName.DomainName;\n  readonly nameservers: ReadonlyArray<DomainName.DomainName>;\n  readonly status: string | null;\n}\n\nexport interface Interface extends DnsProvider.Interface {\n  readonly listAccounts: () => Effect.Effect<ReadonlyArray<Account>, DnsProvider.Error>;\n  readonly listZones: (\n    input?: ListZonesInput,\n  ) => Effect.Effect<ReadonlyArray<Zone>, DnsProvider.Error>;\n  readonly validateToken: () => Effect.Effect<ProviderAuth.TokenValidation, DnsProvider.Error>;\n}\n\n/** Exposes Cloudflare zone lookup as the optional provider discovery capability. */\nexport function discovery(client: Interface): ZoneDiscovery.Source {\n  return {\n    listZones: (name) =>\n      client.listZones({ name }).pipe(\n        Effect.map((zones) =>\n          zones.map((zone) => ({\n            ...zone,\n            status: zone.status === \"active\" || zone.status === \"pending\" ? zone.status : \"unknown\",\n          })),\n        ),\n      ),\n    provider: client,\n  };\n}\n\ninterface CredentialOptions {\n  readonly baseUrl?: string;\n  readonly fetch?: Fetch;\n  readonly token: Secret.Value;\n}\n\ninterface DomainCredentialOptions extends CredentialOptions {\n  readonly capabilities: ProviderAuth.TokenValidation[\"capabilities\"];\n  readonly domain: DomainName.DomainName;\n  readonly tokenKind?: \"account\" | \"user\";\n}\n\nconst makeTransport = (options: CredentialOptions) => {\n  const fetch = options.fetch ?? globalThis.fetch;\n  const baseUrl = (options.baseUrl ?? \"https://api.cloudflare.com/client/v4\").replace(/\\/$/, \"\");\n\n  const request = Effect.fn(\"CloudflareClient.request\")(\n    (path: string, operation: string, init?: RequestInit) =>\n      Effect.gen(function* () {\n        const response = yield* Effect.tryPromise({\n          try: () =>\n            fetch(`${baseUrl}${path}`, {\n              ...init,\n              headers: {\n                Accept: \"application/json\",\n                Authorization: `Bearer ${options.token.expose()}`,\n                ...(init?.body === undefined ? {} : { \"Content-Type\": \"application/json\" }),\n                ...init?.headers,\n              },\n            }),\n          catch: () =>\n            failure(operation, \"Cloudflare request failed\", {\n              reason: \"transport\",\n            }),\n        });\n        const body = yield* Effect.tryPromise({\n          try: () => response.json() as Promise<unknown>,\n          catch: () => {\n            const retryAfterMs = retryAfter(response.headers.get(\"retry-after\"));\n            return failure(\n              operation,\n              response.ok\n                ? \"Cloudflare returned a non-JSON response\"\n                : `Cloudflare request failed with HTTP ${response.status}`,\n              {\n                reason: response.ok ? \"response\" : reason(response.status),\n                ...(retryAfterMs === undefined ? {} : { retryAfterMs }),\n                status: response.status,\n              },\n            );\n          },\n        });\n        return { body, response } as const;\n      }),\n  );\n\n  const listZonesPage = Effect.fn(\"CloudflareClient.listZonesPage\")(\n    (accountId: string | undefined, name: DomainName.DomainName | undefined, page: number) =>\n      Effect.gen(function* () {\n        const query = new URLSearchParams({ page: String(page), per_page: \"50\" });\n        query.set(\"type\", \"full,partial,secondary,internal\");\n        if (accountId !== undefined) query.set(\"account.id\", accountId);\n        if (name !== undefined) query.set(\"name\", name);\n        const { body, response } = yield* request(`/zones?${query}`, \"listZones\");\n        yield* ensureSuccess(body, \"listZones\", response);\n        return yield* decode(Protocol.ZoneListEnvelope, body, \"listZones\", response);\n      }),\n  );\n\n  const allZones = Effect.fn(\"CloudflareClient.allZones\")(\n    (accountId?: string, name?: DomainName.DomainName) =>\n      Effect.gen(function* () {\n        const zones: Array<Protocol.Zone> = [];\n        let page = 1;\n        while (true) {\n          const envelope = yield* listZonesPage(accountId, name, page);\n          zones.push(...envelope.result);\n          const totalPages = envelope.result_info?.total_pages;\n          if (\n            (totalPages !== undefined && page >= totalPages) ||\n            (totalPages === undefined && envelope.result.length < 50)\n          ) {\n            return zones;\n          }\n          page += 1;\n        }\n      }),\n  );\n\n  const inspectToken = Effect.fn(\"CloudflareClient.inspectToken\")((path: string) =>\n    Effect.gen(function* () {\n      const { body, response } = yield* request(path, \"validateToken\");\n      yield* ensureSuccess(body, \"validateToken\", response);\n      const envelope = yield* decode(Protocol.TokenEnvelope, body, \"validateToken\", response);\n      if (envelope.result.status !== \"active\") {\n        return yield* Effect.fail(\n          failure(\"validateToken\", `Cloudflare token is ${envelope.result.status}`, {\n            reason: \"authentication\",\n            status: response.status,\n          }),\n        );\n      }\n      const expiresAt =\n        envelope.result.expires_on === undefined ? null : new Date(envelope.result.expires_on);\n      if (expiresAt !== null && Number.isNaN(expiresAt.valueOf())) {\n        return yield* Effect.fail(\n          failure(\"validateToken\", \"Cloudflare token expiry is not a valid timestamp\", {\n            reason: \"response\",\n            status: response.status,\n          }),\n        );\n      }\n      return expiresAt;\n    }),\n  );\n\n  return { allZones, inspectToken, request } as const;\n};\n\nconst discoverAccount = Effect.fn(\"CloudflareClient.discoverAccount\")(\n  (options: CredentialOptions & { readonly domain: DomainName.DomainName }) =>\n    Effect.gen(function* () {\n      const { allZones } = makeTransport(options);\n      for (const candidate of Zones.candidates(options.domain)) {\n        const matches = yield* allZones(undefined, candidate);\n        const match = matches[0];\n        if (matches.length === 0) continue;\n        if (matches.length === 1 && match !== undefined) return match.account;\n        return yield* Effect.fail(\n          failure(\n            \"discoverAccount\",\n            `Cloudflare returned multiple accessible zones named ${candidate}`,\n            { reason: \"conflict\" },\n          ),\n        );\n      }\n      return yield* Effect.fail(\n        failure(\n          \"discoverAccount\",\n          `Cloudflare did not expose an accessible zone for ${options.domain}`,\n          { reason: \"not_found\" },\n        ),\n      );\n    }),\n);\n\nexport const discoverAuthorizationAccount = discoverAccount;\n\nexport const validateDomainToken = Effect.fn(\"CloudflareClient.validateDomainToken\")(\n  (options: DomainCredentialOptions) =>\n    Effect.gen(function* () {\n      const transport = makeTransport(options);\n      const account = options.tokenKind === \"account\" ? yield* discoverAccount(options) : undefined;\n      const expiresAt = yield* transport.inspectToken(\n        account === undefined\n          ? \"/user/tokens/verify\"\n          : `/accounts/${encodeURIComponent(account.id)}/tokens/verify`,\n      );\n      const discoveredAccount = account ?? (yield* discoverAccount(options));\n      return {\n        accountId: discoveredAccount.id,\n        capabilities: options.capabilities,\n        expiresAt,\n        scopes: [],\n      } satisfies ProviderAuth.TokenValidation;\n    }),\n);\n\n/** Creates an Effect-native Cloudflare client without owning the credential lifecycle. */\nexport function make(options: Options): Interface {\n  const { allZones, inspectToken, request } = makeTransport(options);\n\n  const resolveZone = Effect.fn(\"CloudflareClient.resolveZone\")((name: DomainName.DomainName) =>\n    Effect.gen(function* () {\n      const matches = yield* allZones(options.accountId, name);\n      const match = matches[0];\n      if (matches.length === 1 && match !== undefined) return match;\n      return yield* Effect.fail(\n        failure(\n          \"resolveZone\",\n          matches.length === 0\n            ? `Cloudflare zone ${name} was not found in account ${options.accountId}`\n            : `Cloudflare returned multiple zones named ${name} in account ${options.accountId}`,\n          { reason: matches.length === 0 ? \"not_found\" : \"response\" },\n        ),\n      );\n    }),\n  );\n\n  const listRecords = Effect.fn(\"CloudflareClient.listRecords\")((zoneName: DomainName.DomainName) =>\n    Effect.gen(function* () {\n      const zone = yield* resolveZone(zoneName);\n      const records: Array<DnsRecord.Observed> = [];\n      let page = 1;\n      while (true) {\n        const query = new URLSearchParams({ page: String(page), per_page: \"100\" });\n        const { body, response } = yield* request(\n          `/zones/${encodeURIComponent(zone.id)}/dns_records?${query}`,\n          \"listRecords\",\n        );\n        yield* ensureSuccess(body, \"listRecords\", response);\n        const envelope = yield* decode(Protocol.RecordListEnvelope, body, \"listRecords\", response);\n        records.push(...(yield* Effect.forEach(envelope.result, Records.decode)));\n        const totalPages = envelope.result_info?.total_pages;\n        if (\n          (totalPages !== undefined && page >= totalPages) ||\n          (totalPages === undefined && envelope.result.length < 100)\n        ) {\n          return records;\n        }\n        page += 1;\n      }\n    }),\n  );\n\n  const createRecord = Effect.fn(\"CloudflareClient.createRecord\")(\n    (zoneName: DomainName.DomainName, record: DnsRecord.DnsRecord) =>\n      Effect.gen(function* () {\n        const zone = yield* resolveZone(zoneName);\n        const { body, response } = yield* request(\n          `/zones/${encodeURIComponent(zone.id)}/dns_records`,\n          \"createRecord\",\n          { body: JSON.stringify(Records.encode(record)), method: \"POST\" },\n        );\n        yield* ensureSuccess(body, \"createRecord\", response);\n        const envelope = yield* decode(Protocol.RecordEnvelope, body, \"createRecord\", response);\n        return { providerRecordId: envelope.result.id };\n      }),\n  );\n\n  const getRecord = Effect.fn(\"CloudflareClient.getRecord\")(\n    (zoneName: DomainName.DomainName, providerRecordId: string) =>\n      Effect.gen(function* () {\n        const zone = yield* resolveZone(zoneName);\n        const { body, response } = yield* request(\n          `/zones/${encodeURIComponent(zone.id)}/dns_records/${encodeURIComponent(providerRecordId)}`,\n          \"getRecord\",\n        );\n        if (response.status === 404) return null;\n        yield* ensureSuccess(body, \"getRecord\", response);\n        const envelope = yield* decode(Protocol.RecordEnvelope, body, \"getRecord\", response);\n        return yield* Records.decode(envelope.result);\n      }),\n  );\n\n  const deleteRecord = Effect.fn(\"CloudflareClient.deleteRecord\")(\n    (zoneName: DomainName.DomainName, providerRecordId: string) =>\n      Effect.gen(function* () {\n        const zone = yield* resolveZone(zoneName);\n        const { body, response } = yield* request(\n          `/zones/${encodeURIComponent(zone.id)}/dns_records/${encodeURIComponent(providerRecordId)}`,\n          \"deleteRecord\",\n          { method: \"DELETE\" },\n        );\n        yield* ensureSuccess(body, \"deleteRecord\", response);\n      }),\n  );\n\n  const listAccounts = Effect.fn(\"CloudflareClient.listAccounts\")(() =>\n    allZones().pipe(\n      Effect.map((zones) => {\n        const accounts = new Map<string, Protocol.Account>();\n        for (const zone of zones) accounts.set(zone.account.id, zone.account);\n        return [...accounts.values()].sort((left, right) => left.name.localeCompare(right.name));\n      }),\n    ),\n  );\n\n  const listZones = Effect.fn(\"CloudflareClient.listZones\")((input: ListZonesInput = {}) =>\n    allZones(input.accountId ?? options.accountId, input.name).pipe(\n      Effect.flatMap((zones) => Effect.forEach(zones, projectZone)),\n    ),\n  );\n\n  const validateToken = Effect.fn(\"CloudflareClient.validateToken\")(() =>\n    Effect.gen(function* () {\n      const path =\n        options.tokenKind === \"account\"\n          ? `/accounts/${encodeURIComponent(options.accountId)}/tokens/verify`\n          : \"/user/tokens/verify\";\n      const expiresAt = yield* inspectToken(path);\n      yield* allZones(options.accountId);\n      return {\n        accountId: options.accountId,\n        capabilities: options.capabilities,\n        expiresAt,\n        scopes: [],\n      };\n    }),\n  );\n\n  return {\n    id: \"cloudflare\",\n    createRecord,\n    deleteRecord,\n    getRecord,\n    listAccounts,\n    listRecords,\n    listZones,\n    validateToken,\n  };\n}\n\nconst projectZone = Effect.fn(\"CloudflareClient.projectZone\")((zone: Protocol.Zone) =>\n  Effect.gen(function* () {\n    const name = yield* DomainName.decode(zone.name).pipe(\n      Effect.mapError((cause) => failure(\"listZones\", cause.message, { reason: \"response\" })),\n    );\n    const nameservers = yield* Effect.forEach(zone.name_servers, (nameserver) =>\n      DomainName.decode(nameserver).pipe(\n        Effect.mapError((cause) => failure(\"listZones\", cause.message, { reason: \"response\" })),\n      ),\n    );\n    return {\n      accountId: zone.account.id,\n      id: zone.id,\n      name,\n      nameservers,\n      status: zone.status ?? null,\n    };\n  }),\n);\n\nfunction decode<A>(\n  schema: S.ConstraintCodec<A, unknown, never, unknown>,\n  input: unknown,\n  operation: string,\n  response: Response,\n): Effect.Effect<A, DnsProvider.Error> {\n  return S.decodeUnknownEffect(schema)(input).pipe(\n    Effect.mapError((cause) =>\n      failure(operation, `Cloudflare response did not match its API contract: ${cause.message}`, {\n        reason: \"response\",\n        status: response.status,\n      }),\n    ),\n  );\n}\n\nfunction ensureSuccess(\n  input: unknown,\n  operation: string,\n  response: Response,\n): Effect.Effect<void, DnsProvider.Error> {\n  return S.decodeUnknownEffect(Protocol.BaseEnvelope)(input).pipe(\n    Effect.mapError(() =>\n      failure(operation, \"Cloudflare response did not contain a valid API envelope\", {\n        reason: \"response\",\n        status: response.status,\n      }),\n    ),\n    Effect.flatMap((envelope) => {\n      if (response.ok && envelope.success) return Effect.void;\n      const detail = envelope.errors[0];\n      const retryAfterMs = retryAfter(response.headers.get(\"retry-after\"));\n      return Effect.fail(\n        failure(\n          operation,\n          detail?.message ?? `Cloudflare request failed with HTTP ${response.status}`,\n          {\n            ...(detail === undefined ? {} : { code: detail.code }),\n            reason: reason(response.status, detail?.code),\n            ...(retryAfterMs === undefined ? {} : { retryAfterMs }),\n            status: response.status,\n          },\n        ),\n      );\n    }),\n  );\n}\n\nfunction reason(status: number, code?: number): DnsProvider.ErrorReason {\n  if (status === 401) return \"authentication\";\n  if (status === 403) return \"authorization\";\n  if (status === 404) return \"not_found\";\n  if (status === 409 || code === 81056 || code === 81057 || code === 81058) return \"conflict\";\n  if (status === 429) return \"rate_limit\";\n  if (status >= 500) return \"response\";\n  return \"request\";\n}\n\nfunction retryAfter(value: string | null): number | undefined {\n  if (value === null) return undefined;\n  const seconds = Number(value);\n  if (Number.isFinite(seconds)) return Math.max(0, seconds * 1_000);\n  const date = Date.parse(value);\n  return Number.isNaN(date) ? undefined : Math.max(0, date - Date.now());\n}\n\nfunction failure(\n  operation: string,\n  message: string,\n  fields: Partial<Pick<DnsProvider.Error, \"code\" | \"reason\" | \"retryAfterMs\" | \"status\">> = {},\n): DnsProvider.Error {\n  return new DnsProvider.Error({\n    ...fields,\n    message,\n    operation,\n    providerId: \"cloudflare\",\n  });\n}\n","import type * as oauth from \"oauth4webapi\";\nimport { Clock, Effect, Schema } from \"effect\";\n\nimport * as AuthorizationCode from \"../../auth/authorization-code.ts\";\nimport * as Connection from \"../../auth/connect.ts\";\nimport * as ProviderAuthorization from \"../../auth/authorization.ts\";\nimport type * as ProviderAuth from \"../../auth/manifest.ts\";\nimport * as ProviderContext from \"../../auth/provider-context.ts\";\nimport * as Secret from \"../../auth/secret.ts\";\nimport type * as DomainName from \"../../domain/domain-name.ts\";\nimport * as Client from \"./client.ts\";\n\nconst authorizationServer = {\n  authorization_endpoint: \"https://dash.cloudflare.com/oauth2/auth\",\n  issuer: \"https://dash.cloudflare.com\",\n  revocation_endpoint: \"https://dash.cloudflare.com/oauth2/revoke\",\n  token_endpoint: \"https://dash.cloudflare.com/oauth2/token\",\n} as const;\n\nconst Context = Schema.Struct({ tokenKind: Schema.Literals([\"account\", \"user\"]) });\nexport type Context = typeof Context.Type;\nexport const contextCodec = ProviderContext.codec(\"cloudflare.v1\", Context);\n\n/** Describes Cloudflare's caller-created API-token authorization method. */\nexport function tokenMethod(\n  capabilities: ProviderAuth.TokenValidation[\"capabilities\"],\n): Extract<ProviderAuth.Manifest[\"methods\"][number], { readonly _tag: \"token\" }> {\n  return {\n    _tag: \"token\",\n    capabilities: [...capabilities],\n    instructionsUrl: \"https://developers.cloudflare.com/fundamentals/api/get-started/create-token/\",\n  };\n}\n\nexport interface OAuthMethodOptions {\n  /** Scope IDs assigned to the OAuth client by Cloudflare. */\n  readonly scopes: ReadonlyArray<string>;\n  /** Capabilities represented by those assigned scope IDs. */\n  readonly capabilities: ProviderAuth.TokenValidation[\"capabilities\"];\n  readonly clientAuth: ProviderAuth.OAuthMethod[\"clientAuth\"];\n}\n\n/** Describes a registered Cloudflare OAuth client and its assigned scope IDs. */\nexport function oauthMethod(options: OAuthMethodOptions): ProviderAuth.OAuthMethod {\n  return {\n    _tag: \"oauth2\",\n    authorizationServer,\n    capabilities: [...options.capabilities],\n    clientAuth: options.clientAuth,\n    scopes: [...options.scopes],\n  };\n}\n\n/** Creates the Cloudflare token and OAuth authorization manifest. */\nexport function manifest(options: OAuthMethodOptions): ProviderAuth.Manifest {\n  return {\n    methods: [tokenMethod(options.capabilities), oauthMethod(options)],\n    providerId: \"cloudflare\",\n  };\n}\n\ntype CredentialOptions = Omit<Client.Options, \"accountId\" | \"token\" | \"tokenKind\">;\n\n/** Selects an explicit Cloudflare account or discovers it from an authorized domain. */\nexport type CredentialTarget =\n  | {\n      readonly accountId: string;\n      readonly domain?: never;\n    }\n  | {\n      readonly accountId?: never;\n      readonly domain: DomainName.DomainName;\n    };\n\nexport type SubjectResolverOptions = CredentialOptions & CredentialTarget;\n\n/** Configuration for validating a Cloudflare token against an account or authorized domain. */\nexport type TokenValidatorOptions = CredentialOptions &\n  (\n    | {\n        readonly accountId: string;\n        readonly domain?: never;\n        readonly tokenKind?: \"account\" | \"user\";\n      }\n    | {\n        readonly accountId?: never;\n        readonly domain: DomainName.DomainName;\n        readonly tokenKind?: \"account\" | \"user\";\n      }\n  );\n\n/** Resolves the Cloudflare account selected by a completed OAuth grant. */\nexport function subjectResolver(\n  options: SubjectResolverOptions,\n): ProviderAuth.OAuthSubjectResolver {\n  return (tokens: oauth.TokenEndpointResponse, accessToken: Secret.Value) =>\n    Effect.gen(function* () {\n      const accountId =\n        options.accountId ??\n        (yield* Client.discoverAuthorizationAccount({\n          ...(options.baseUrl === undefined ? {} : { baseUrl: options.baseUrl }),\n          domain: options.domain,\n          ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          token: accessToken,\n        }).pipe(Effect.map((account) => account.id)));\n      if (options.accountId !== undefined) {\n        yield* Client.make({\n          accountId: options.accountId,\n          ...(options.baseUrl === undefined ? {} : { baseUrl: options.baseUrl }),\n          capabilities: options.capabilities,\n          ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          token: accessToken,\n          tokenKind: \"user\",\n        }).listZones();\n      }\n      const now = yield* Clock.currentTimeMillis;\n      return {\n        accountId,\n        expiresAt:\n          typeof tokens.expires_in === \"number\" ? new Date(now + tokens.expires_in * 1_000) : null,\n      };\n    });\n}\n\n/** Creates a host callback that validates a Cloudflare API token. */\nexport function tokenValidator(\n  options: TokenValidatorOptions,\n): (token: Secret.Value) => ReturnType<Client.Interface[\"validateToken\"]> {\n  return (token) =>\n    options.accountId === undefined\n      ? Client.validateDomainToken({\n          ...(options.baseUrl === undefined ? {} : { baseUrl: options.baseUrl }),\n          capabilities: options.capabilities,\n          domain: options.domain,\n          ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          token,\n          ...(options.tokenKind === undefined ? {} : { tokenKind: options.tokenKind }),\n        })\n      : Client.make({\n          accountId: options.accountId,\n          ...(options.baseUrl === undefined ? {} : { baseUrl: options.baseUrl }),\n          capabilities: options.capabilities,\n          ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n          token,\n          ...(options.tokenKind === undefined ? {} : { tokenKind: options.tokenKind }),\n        }).validateToken();\n}\n\nexport type TokenConnectionOptions = TokenValidatorOptions & {\n  readonly token: Secret.Value;\n};\n\n/** Creates a provider-independent token connection method backed by Cloudflare validation. */\nexport function tokenConnectionMethod(\n  options: TokenConnectionOptions,\n): Extract<Connection.Method, { readonly _tag: \"Token\" }> {\n  const requiredCapabilities = [...options.capabilities];\n  return Connection.Method.Token({\n    authenticate: Effect.fn(\"CloudflareAuth.authenticateToken\")(function* (token) {\n      const validated = yield* tokenValidator(options)(token);\n      const observedAt = new Date(yield* Clock.currentTimeMillis);\n      return {\n        capabilityEvidence: validated.capabilities.map((capability) => ({\n          capability,\n          evidence: ProviderAuthorization.Evidence.Introspected({ observedAt }),\n        })),\n        credential: { accessToken: token, refreshToken: null, tokenType: \"bearer\" },\n        expiresAt: validated.expiresAt,\n        providerAccountId: validated.accountId,\n        providerContext: yield* contextCodec.encode({ tokenKind: options.tokenKind ?? \"user\" }),\n        scopes: [...validated.scopes],\n      } satisfies Connection.Authentication;\n    }),\n    providerId: \"cloudflare\",\n    requiredCapabilities,\n    token: options.token,\n  });\n}\n\n/** Converts a completed Cloudflare OAuth grant into the canonical connection authentication. */\nexport const oauthAuthentication = Effect.fn(\"CloudflareAuth.oauthAuthentication\")(function* (\n  options: SubjectResolverOptions & {\n    readonly accessToken: Secret.Value;\n    readonly tokens: oauth.TokenEndpointResponse;\n  },\n) {\n  const resolved = yield* subjectResolver(options)(options.tokens, options.accessToken);\n  const observedAt = new Date(yield* Clock.currentTimeMillis);\n  return {\n    capabilityEvidence: options.capabilities.map((capability) => ({\n      capability,\n      evidence: ProviderAuthorization.Evidence.Introspected({ observedAt }),\n    })),\n    credential: {\n      accessToken: options.accessToken,\n      refreshToken:\n        options.tokens.refresh_token === undefined\n          ? null\n          : Secret.Value.from(options.tokens.refresh_token),\n      tokenType: options.tokens.token_type,\n    },\n    expiresAt: resolved.expiresAt,\n    providerAccountId: resolved.accountId,\n    providerContext: yield* contextCodec.encode({ tokenKind: \"user\" }),\n    scopes: (options.tokens.scope ?? \"\").split(\" \").filter(Boolean),\n  } satisfies Connection.Authentication;\n});\n\nexport type OAuthFlowOptions = SubjectResolverOptions & {\n  readonly client: ProviderAuth.OAuthClientConfiguration;\n  readonly clientAuth: ProviderAuth.OAuthMethod[\"clientAuth\"];\n  readonly redirectUri: string;\n  readonly scopes: ReadonlyArray<string>;\n};\n\n/** Creates Cloudflare's OAuth implementation of the common interactive connection capability. */\nexport function oauthFlow(options: OAuthFlowOptions): Connection.InteractiveFlow {\n  const method = oauthMethod({\n    capabilities: options.capabilities,\n    clientAuth: options.clientAuth,\n    scopes: options.scopes,\n  });\n  return {\n    complete: Effect.fn(\"CloudflareAuth.oauthFlow.complete\")(function* (payload, callbackUrl) {\n      const tokens = yield* AuthorizationCode.complete({\n        callbackUrl,\n        client: options.client,\n        ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n        method,\n        payload,\n        providerId: \"cloudflare\",\n      });\n      return yield* oauthAuthentication({\n        ...(options.accountId === undefined\n          ? { domain: options.domain }\n          : { accountId: options.accountId }),\n        ...(options.baseUrl === undefined ? {} : { baseUrl: options.baseUrl }),\n        capabilities: options.capabilities,\n        ...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n        accessToken: Secret.make(tokens.access_token),\n        tokens,\n      });\n    }),\n    method: \"oauth2\",\n    providerId: \"cloudflare\",\n    requiredCapabilities: [...options.capabilities],\n    start: (continuationId) =>\n      AuthorizationCode.start({\n        client: options.client,\n        method,\n        redirectUri: options.redirectUri,\n        state: continuationId,\n      }),\n  };\n}\n"],"mappings":";;;;;;;AAeA,MAAa,QAAQ,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,OAKlE;CACD,MAAM,SAAS,OAAO,OAAO;CAC7B,MAAM,eAAe,UAAU,OAAO,YAAY,QAAQ,EAAE,CAAC;CAC7D,MAAM,YAAY,UAAU,OAAO,OAAO,QAAQ,YAAY,CAAC;CAC/D,MAAM,mBAAmB,IAAI,IAAI,MAAM,OAAO,oBAAoB,sBAAsB;CACxF,iBAAiB,SAAS,IAAI,gBAAgB;EAC5C,WAAW,MAAM,OAAO;EACxB,gBAAgB;EAChB,uBAAuB;EACvB,cAAc,MAAM;EACpB,eAAe;EACf,OAAO,MAAM,OAAO,OAAO,KAAK,GAAG;EACnC,OAAO,MAAM;CACf,CAAC,CAAC,CAAC,SAAS;CACZ,OAAO;EACL;EACA,SAASA,OACP,KAAK,UAAU;GAAE;GAAc,aAAa,MAAM;GAAa,OAAO,MAAM;EAAM,CAAC,CACrF;CACF;AACF,CAAC;AAED,MAAa,WAAW,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAAW,OAOxE;CACD,MAAM,UAAU,OAAO,cAAc,MAAM,OAAO;CAClD,IAAI,MAAM,YAAY,aAAa,IAAI,OAAO,MAAM,QAAQ,OAC1D,OAAO,OAAOC,UAAQ,8DAA8D;CAEtF,MAAM,SAAS,MAAM,OAAO;CAC5B,MAAM,SAAuB,EAAE,WAAW,MAAM,OAAO,SAAS;CAChE,MAAM,iBAAiB,OAAO,qBAAqB,MAAM,QAAQ,MAAM,MAAM;CAC7E,OAAO,OAAO,OAAO,WAAW;EAC9B,KAAK,OAAO,WAAW;GACrB,MAAM,WAAW,MAAM,qBAAqB,QAAQ,QAAQ,MAAM,aAAa,QAAQ,KAAK;GAC5F,MAAM,WAAW,MAAM,MAAM,8BAC3B,QACA,QACA,gBACA,UACA,QAAQ,aACR,QAAQ,cACR,eAAe,MAAM,OAAO,MAAM,CACpC;GACA,OAAO,MAAM,iCAAiC,QAAQ,QAAQ,QAAQ;EACxE;EACA,QAAQ,UACN,IAAIC,QAAiB;GACnB,UAAU;GACV,SAAS,iBAAiB,WAAW,QAAQ,MAAM,OAAO;GAC1D,WAAW;GACX,OAAO;EACT,CAAC;CACL,CAAC;AACH,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO;CAClC,cAAc,OAAO;CACrB,aAAa,OAAO;CACpB,OAAO,OAAO;AAChB,CAAC;AAED,SAAS,cAAc,SAAiE;CACtF,OAAO,OAAO,oBAAoB,OAAO,eAAe,aAAa,CAAC,CAAC,CAAC,QAAQ,OAAO,CAAC,CAAC,CAAC,KACxF,OAAO,eAEH,IAAIA,QAAiB;EACnB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC,CACL,CACF;AACF;AAEA,SAAS,qBACP,QACA,QACmD;CACnD,QAAQ,OAAO,YAAf;EACE,KAAK,QACH,OAAO,OAAO,QAAQ,MAAM,KAAK,CAAC;EACpC,KAAK,uBACH,OAAO,OAAO,iBAAiB,KAAA,IAC3BD,UAAQ,iCAAiC,IACzC,OAAO,QAAQ,MAAM,kBAAkB,OAAO,aAAa,OAAO,CAAC,CAAC;EAC1E,KAAK,sBACH,OAAO,OAAO,iBAAiB,KAAA,IAC3BA,UAAQ,iCAAiC,IACzC,OAAO,QAAQ,MAAM,iBAAiB,OAAO,aAAa,OAAO,CAAC,CAAC;CAC3E;AACF;AAEA,SAAS,eACP,qBACA,QACmC;CACnC,OAAO,wBAAwB,KAAA,IAC3B,EAAE,OAAO,IACT;EACE;GACC,MAAM,eAAe,KAAK,YACzB,oBAAoB,KAAK;GAAE,GAAG;GAAS,MAAM,QAAQ;EAAK,CAAC;CAC/D;AACN;AAEA,MAAMA,aAAW,YACf,OAAO,KACL,IAAIC,QAAiB;CACnB,UAAU;CACV;CACA,WAAW;CACX,OAAO;AACT,CAAC,CACH;AAEF,SAAS,YACP,QACA,MAC6C;CAC7C,OAAO,OAAO,YAAY,IAAI,CAAC,CAAC,KAC9B,OAAO,UACJ,UACC,IAAIA,QAAiB;EACnB,UAAU;EACV,SAAS,MAAM;EACf,WAAW;EACX,OAAO;CACT,CAAC,CACL,CACF;AACF;AAEA,SAAS,OAAO,QAAuB,OAA4D;CACjG,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAC/D,OAAO,UACJ,UACC,IAAIA,QAAiB;EACnB,UAAU;EACV,SAAS,MAAM;EACf,WAAW;EACX,OAAO;CACT,CAAC,CACL,CACF;AACF;AAEA,SAAS,UAAU,OAA2B;CAC5C,IAAI,SAAS;CACb,KAAK,MAAM,QAAQ,OAAO,UAAU,OAAO,aAAa,IAAI;CAC5D,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,EAAE;AAClF;;;AC/KA,MAAa,cAAcC,OAAE,OAAO;CAClC,MAAMA,OAAE;CACR,SAASA,OAAE;AACb,CAAC;AAGD,MAAa,aAAaA,OAAE,OAAO;CACjC,OAAOA,OAAE,YAAYA,OAAE,MAAM;CAC7B,MAAMA,OAAE,YAAYA,OAAE,MAAM;CAC5B,UAAUA,OAAE,YAAYA,OAAE,MAAM;CAChC,aAAaA,OAAE,YAAYA,OAAE,MAAM;CACnC,aAAaA,OAAE,YAAYA,OAAE,MAAM;AACrC,CAAC;AAED,MAAM,UAAUA,OAAE,OAAO;CACvB,MAAMA,OAAE,YAAYA,OAAE,MAAM;CAC5B,SAASA,OAAE;AACb,CAAC;AAED,MAAa,eAAeA,OAAE,OAAO;CACnC,QAAQA,OAAE,MAAM,WAAW;CAC3B,UAAUA,OAAE,MAAM,OAAO;CACzB,SAASA,OAAE;AACb,CAAC;AAED,MAAa,UAAUA,OAAE,OAAO;CAC9B,IAAIA,OAAE;CACN,MAAMA,OAAE;AACV,CAAC;AAGD,MAAa,OAAOA,OAAE,OAAO;CAC3B,SAAS;CACT,IAAIA,OAAE;CACN,MAAMA,OAAE;CACR,cAAcA,OAAE,MAAMA,OAAE,MAAM;CAC9B,QAAQA,OAAE,YAAYA,OAAE,MAAM;AAChC,CAAC;AAGD,MAAa,SAASA,OAAE,OAAO;CAC7B,SAASA,OAAE,YAAYA,OAAE,MAAM;CAC/B,MAAMA,OAAE,YAAYA,OAAE,OAAO;CAC7B,IAAIA,OAAE;CACN,MAAMA,OAAE;CACR,UAAUA,OAAE,YAAYA,OAAE,MAAM;CAChC,SAASA,OAAE,YAAYA,OAAE,OAAO;CAChC,KAAKA,OAAE;CACP,MAAMA,OAAE;AACV,CAAC;AAGD,MAAa,QAAQA,OAAE,OAAO;CAC5B,YAAYA,OAAE,YAAYA,OAAE,MAAM;CAClC,IAAIA,OAAE;CACN,YAAYA,OAAE,YAAYA,OAAE,MAAM;CAClC,QAAQA,OAAE,SAAS;EAAC;EAAU;EAAY;CAAS,CAAC;AACtD,CAAC;AAGD,MAAa,mBAAmBA,OAAE,OAAO;CACvC,QAAQA,OAAE,MAAM,WAAW;CAC3B,UAAUA,OAAE,MAAM,OAAO;CACzB,QAAQA,OAAE,MAAM,IAAI;CACpB,aAAaA,OAAE,YAAY,UAAU;CACrC,SAASA,OAAE;AACb,CAAC;AACD,MAAa,qBAAqBA,OAAE,OAAO;CACzC,QAAQA,OAAE,MAAM,WAAW;CAC3B,UAAUA,OAAE,MAAM,OAAO;CACzB,QAAQA,OAAE,MAAM,MAAM;CACtB,aAAaA,OAAE,YAAY,UAAU;CACrC,SAASA,OAAE;AACb,CAAC;AACD,MAAa,iBAAiBA,OAAE,OAAO;CACrC,QAAQA,OAAE,MAAM,WAAW;CAC3B,UAAUA,OAAE,MAAM,OAAO;CACzB,QAAQ;CACR,SAASA,OAAE;AACb,CAAC;AACD,MAAa,gBAAgBA,OAAE,OAAO;CACpC,QAAQA,OAAE,MAAM,WAAW;CAC3B,UAAUA,OAAE,MAAM,OAAO;CACzB,QAAQ;CACR,SAASA,OAAE;AACb,CAAC;;;AChFD,MAAMC,SAAOC,OAAE,OAAO;CACpB,OAAOA,OAAE,YAAYA,OAAE,MAAM;CAC7B,MAAMA,OAAE,YAAYA,OAAE,MAAM;CAC5B,UAAUA,OAAE,YAAYA,OAAE,MAAM;CAChC,KAAKA,OAAE,YAAYA,OAAE,MAAM;CAC3B,QAAQA,OAAE,YAAYA,OAAE,MAAM;CAC9B,OAAOA,OAAE,YAAYA,OAAE,MAAM;CAC7B,QAAQA,OAAE,YAAYA,OAAE,MAAM;AAChC,CAAC;AAID,MAAaC,WAAS,OAAO,GAAG,0BAA0B,CAAC,EAAE,WAC3D,OAAO,IAAI,aAAa;CACtB,MAAM,OAAO,OAAOC,SAAkB,OAAO,IAAI,CAAC,CAAC,KACjD,OAAO,MAAM;EAAE,iBAAiB;EAAM,YAAY,UAAU;CAAM,CAAC,CACrE;CACA,IAAI,SAAS,MAAM,OAAO,OAAO,aAAa,MAAM;CACpD,MAAM,SAAS;EACb,UAAU;GACR,WAAW;GACX,YAAY,OAAO,YAAY,OAAO,uBAAuB;GAC7D,SAAS;EACX;EACA;EACA,QAAQ,OAAO,SAAS,UAAU,cAAc;EAChD,KAAK,OAAO,QAAQ,IAAI,OAAO,OAAO;CACxC;CACA,MAAM,gBACJ,OAAO,YAAY,KAAA,IACf,OAAO,KAAKC,UAAQ,gBAAgB,cAAc,OAAO,KAAK,uBAAuB,CAAC,IACtF,OAAO,QAAQ,OAAO,OAAO;CAEnC,QAAQ,OAAO,MAAf;EACE,KAAK;EACL,KAAK,QACH,OAAO,OAAOC,SAAiB;GAC7B,GAAG;GACH,MAAM,OAAO;GACb,SAAS,OAAO,QAAQ;EAC1B,CAAC,CAAC,CAAC,KAAK,OAAO,UAAU,UAAUD,UAAQ,gBAAgB,MAAM,OAAO,CAAC,CAAC;EAC5E,KAAK;EACL,KAAK,MACH,OAAO,OAAOC,SAAiB;GAC7B,GAAG;GACH,MAAM,OAAO;GACb,QAAQ,OAAO,QAAQ;EACzB,CAAC,CAAC,CAAC,KAAK,OAAO,UAAU,UAAUD,UAAQ,gBAAgB,MAAM,OAAO,CAAC,CAAC;EAC5E,KAAK,OACH,OAAO,OAAOC,SAAiB;GAC7B,GAAG;GACH,MAAM;GACN,OAAO,OAAO,QAAQ;EACxB,CAAC,CAAC,CAAC,KAAK,OAAO,UAAU,UAAUD,UAAQ,gBAAgB,MAAM,OAAO,CAAC,CAAC;EAC5E,KAAK,MACH,OAAO,OAAOC,SAAiB;GAC7B,GAAG;GACH,MAAM;GACN,UAAU,OAAO,QAAQ;GACzB,UAAU,OAAO;EACnB,CAAC,CAAC,CAAC,KAAK,OAAO,UAAU,UAAUD,UAAQ,gBAAgB,MAAM,OAAO,CAAC,CAAC;EAC5E,KAAK,OAAO;GACV,MAAM,OAAO,OAAO,WAAW,MAAM;GACrC,OAAO,OAAOC,SAAiB;IAAE,GAAG;IAAQ,MAAM;IAAO,GAAG;GAAK,CAAC,CAAC,CAAC,KAClE,OAAO,UAAU,UAAUD,UAAQ,gBAAgB,MAAM,OAAO,CAAC,CACnE;EACF;EACA,KAAK,OAAO;GACV,MAAM,OAAO,OAAO,WAAW,MAAM;GACrC,OAAO,OAAOC,SAAiB;IAAE,GAAG;IAAQ,MAAM;IAAO,GAAG;GAAK,CAAC,CAAC,CAAC,KAClE,OAAO,UAAU,UAAUD,UAAQ,gBAAgB,MAAM,OAAO,CAAC,CACnE;EACF;EACA,SACE,OAAO,OAAO,aAAa,MAAM;CACrC;AACF,CAAC,CACH;AAEA,MAAM,eAAe,OAAO,GAAG,gCAAgC,CAAC,EAAE,WAChEH,OAAE,oBAAoBK,MAAgB,CAAC,CAAC;CACtC,MAAM;CACN,MAAM,OAAO;CACb,kBAAkB,OAAO;CACzB,cAAc,OAAO;AACvB,CAAC,CAAC,CAAC,KAAK,OAAO,UAAU,UAAUF,UAAQ,gBAAgB,MAAM,OAAO,CAAC,CAAC,CAC5E;AAEA,SAAgB,OAAO,QAAyC;CAC9D,MAAM,SAAS;EACb,MAAM,OAAO;EACb,SAAS;EACT,KAAK,OAAO,OAAO;EACnB,MAAM,OAAO;CACf;CACA,QAAQ,OAAO,MAAf;EACE,KAAK;EACL,KAAK,QACH,OAAO;GAAE,GAAG;GAAQ,SAAS,OAAO;EAAQ;EAC9C,KAAK;EACL,KAAK,MACH,OAAO;GAAE,GAAG;GAAQ,SAAS,OAAO;EAAO;EAC7C,KAAK,OACH,OAAO;GAAE,GAAG;GAAQ,SAAS,OAAO;EAAM;EAC5C,KAAK,MACH,OAAO;GAAE,GAAG;GAAQ,SAAS,OAAO;GAAU,UAAU,OAAO;EAAS;EAC1E,KAAK,OACH,OAAO;GACL,GAAG;GACH,MAAM;IAAE,OAAO,OAAO;IAAO,KAAK,OAAO;IAAK,OAAO,OAAO;GAAM;EACpE;EACF,KAAK,OACH,OAAO;GACL,GAAG;GACH,MAAM;IACJ,MAAM,OAAO;IACb,UAAU,OAAO;IACjB,QAAQ,OAAO;IACf,QAAQ,OAAO;GACjB;EACF;CACJ;AACF;AAEA,MAAM,aAAa,OAAO,GAAG,8BAA8B,CAAC,EAAE,WAC5DH,OAAE,oBAAoBD,MAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KACvC,OAAO,UAAU,UAAUI,UAAQ,gBAAgB,MAAM,OAAO,CAAC,CACnE,CACF;AAEA,SAASA,UACP,WACA,SACA,SAAqD,CAAC,GACnC;CACnB,OAAO,IAAIG,MAAkB;EAC3B;EACA;EACA,YAAY;EACZ,QAAQ,OAAO,UAAU;CAC3B,CAAC;AACH;;;;;;;;;;AClGA,SAAgB,UAAU,QAAyC;CACjE,OAAO;EACL,YAAY,SACV,OAAO,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,KACzB,OAAO,KAAK,UACV,MAAM,KAAK,UAAU;GACnB,GAAG;GACH,QAAQ,KAAK,WAAW,YAAY,KAAK,WAAW,YAAY,KAAK,SAAS;EAChF,EAAE,CACJ,CACF;EACF,UAAU;CACZ;AACF;AAcA,MAAM,iBAAiB,YAA+B;CACpD,MAAM,QAAQ,QAAQ,SAAS,WAAW;CAC1C,MAAM,WAAW,QAAQ,WAAW,uCAAA,CAAwC,QAAQ,OAAO,EAAE;CAE7F,MAAM,UAAU,OAAO,GAAG,0BAA0B,CAAC,EAClD,MAAc,WAAmB,SAChC,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,OAAO,OAAO,WAAW;GACxC,WACE,MAAM,GAAG,UAAU,QAAQ;IACzB,GAAG;IACH,SAAS;KACP,QAAQ;KACR,eAAe,UAAU,QAAQ,MAAM,OAAO;KAC9C,GAAI,MAAM,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;KACzE,GAAG,MAAM;IACX;GACF,CAAC;GACH,aACE,QAAQ,WAAW,6BAA6B,EAC9C,QAAQ,YACV,CAAC;EACL,CAAC;EAkBD,OAAO;GAAE,MAAA,OAjBW,OAAO,WAAW;IACpC,WAAW,SAAS,KAAK;IACzB,aAAa;KACX,MAAM,eAAe,WAAW,SAAS,QAAQ,IAAI,aAAa,CAAC;KACnE,OAAO,QACL,WACA,SAAS,KACL,4CACA,uCAAuC,SAAS,UACpD;MACE,QAAQ,SAAS,KAAK,aAAa,OAAO,SAAS,MAAM;MACzD,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa;MACrD,QAAQ,SAAS;KACnB,CACF;IACF;GACF,CAAC;GACc;EAAS;CAC1B,CAAC,CACL;CAEA,MAAM,gBAAgB,OAAO,GAAG,gCAAgC,CAAC,EAC9D,WAA+B,MAAyC,SACvE,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,IAAI,gBAAgB;GAAE,MAAM,OAAO,IAAI;GAAG,UAAU;EAAK,CAAC;EACxE,MAAM,IAAI,QAAQ,iCAAiC;EACnD,IAAI,cAAc,KAAA,GAAW,MAAM,IAAI,cAAc,SAAS;EAC9D,IAAI,SAAS,KAAA,GAAW,MAAM,IAAI,QAAQ,IAAI;EAC9C,MAAM,EAAE,MAAM,aAAa,OAAO,QAAQ,UAAU,SAAS,WAAW;EACxE,OAAO,cAAc,MAAM,aAAa,QAAQ;EAChD,OAAO,OAAO,OAAOC,kBAA2B,MAAM,aAAa,QAAQ;CAC7E,CAAC,CACL;CAiDA,OAAO;EAAE,UA/CQ,OAAO,GAAG,2BAA2B,CAAC,EACpD,WAAoB,SACnB,OAAO,IAAI,aAAa;GACtB,MAAM,QAA8B,CAAC;GACrC,IAAI,OAAO;GACX,OAAO,MAAM;IACX,MAAM,WAAW,OAAO,cAAc,WAAW,MAAM,IAAI;IAC3D,MAAM,KAAK,GAAG,SAAS,MAAM;IAC7B,MAAM,aAAa,SAAS,aAAa;IACzC,IACG,eAAe,KAAA,KAAa,QAAQ,cACpC,eAAe,KAAA,KAAa,SAAS,OAAO,SAAS,IAEtD,OAAO;IAET,QAAQ;GACV;EACF,CAAC,CA8BW;EAAG,cA3BE,OAAO,GAAG,+BAA+B,CAAC,EAAE,SAC/D,OAAO,IAAI,aAAa;GACtB,MAAM,EAAE,MAAM,aAAa,OAAO,QAAQ,MAAM,eAAe;GAC/D,OAAO,cAAc,MAAM,iBAAiB,QAAQ;GACpD,MAAM,WAAW,OAAO,OAAOC,eAAwB,MAAM,iBAAiB,QAAQ;GACtF,IAAI,SAAS,OAAO,WAAW,UAC7B,OAAO,OAAO,OAAO,KACnB,QAAQ,iBAAiB,uBAAuB,SAAS,OAAO,UAAU;IACxE,QAAQ;IACR,QAAQ,SAAS;GACnB,CAAC,CACH;GAEF,MAAM,YACJ,SAAS,OAAO,eAAe,KAAA,IAAY,OAAO,IAAI,KAAK,SAAS,OAAO,UAAU;GACvF,IAAI,cAAc,QAAQ,OAAO,MAAM,UAAU,QAAQ,CAAC,GACxD,OAAO,OAAO,OAAO,KACnB,QAAQ,iBAAiB,oDAAoD;IAC3E,QAAQ;IACR,QAAQ,SAAS;GACnB,CAAC,CACH;GAEF,OAAO;EACT,CAAC,CAG2B;EAAG;CAAQ;AAC3C;AAEA,MAAM,kBAAkB,OAAO,GAAG,kCAAkC,CAAC,EAClE,YACC,OAAO,IAAI,aAAa;CACtB,MAAM,EAAE,aAAa,cAAc,OAAO;CAC1C,KAAK,MAAM,aAAaC,WAAiB,QAAQ,MAAM,GAAG;EACxD,MAAM,UAAU,OAAO,SAAS,KAAA,GAAW,SAAS;EACpD,MAAM,QAAQ,QAAQ;EACtB,IAAI,QAAQ,WAAW,GAAG;EAC1B,IAAI,QAAQ,WAAW,KAAK,UAAU,KAAA,GAAW,OAAO,MAAM;EAC9D,OAAO,OAAO,OAAO,KACnB,QACE,mBACA,uDAAuD,aACvD,EAAE,QAAQ,WAAW,CACvB,CACF;CACF;CACA,OAAO,OAAO,OAAO,KACnB,QACE,mBACA,oDAAoD,QAAQ,UAC5D,EAAE,QAAQ,YAAY,CACxB,CACF;AACF,CAAC,CACL;AAEA,MAAa,+BAA+B;AAE5C,MAAa,sBAAsB,OAAO,GAAG,sCAAsC,CAAC,EACjF,YACC,OAAO,IAAI,aAAa;CACtB,MAAM,YAAY,cAAc,OAAO;CACvC,MAAM,UAAU,QAAQ,cAAc,YAAY,OAAO,gBAAgB,OAAO,IAAI,KAAA;CACpF,MAAM,YAAY,OAAO,UAAU,aACjC,YAAY,KAAA,IACR,wBACA,aAAa,mBAAmB,QAAQ,EAAE,EAAE,eAClD;CAEA,OAAO;EACL,YAFwB,YAAY,OAAO,gBAAgB,OAAO,GAAA,CAErC;EAC7B,cAAc,QAAQ;EACtB;EACA,QAAQ,CAAC;CACX;AACF,CAAC,CACL;;AAGA,SAAgB,KAAK,SAA6B;CAChD,MAAM,EAAE,UAAU,cAAc,YAAY,cAAc,OAAO;CAEjE,MAAM,cAAc,OAAO,GAAG,8BAA8B,CAAC,EAAE,SAC7D,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,SAAS,QAAQ,WAAW,IAAI;EACvD,MAAM,QAAQ,QAAQ;EACtB,IAAI,QAAQ,WAAW,KAAK,UAAU,KAAA,GAAW,OAAO;EACxD,OAAO,OAAO,OAAO,KACnB,QACE,eACA,QAAQ,WAAW,IACf,mBAAmB,KAAK,4BAA4B,QAAQ,cAC5D,4CAA4C,KAAK,cAAc,QAAQ,aAC3E,EAAE,QAAQ,QAAQ,WAAW,IAAI,cAAc,WAAW,CAC5D,CACF;CACF,CAAC,CACH;CAEA,MAAM,cAAc,OAAO,GAAG,8BAA8B,CAAC,EAAE,aAC7D,OAAO,IAAI,aAAa;EACtB,MAAM,OAAO,OAAO,YAAY,QAAQ;EACxC,MAAM,UAAqC,CAAC;EAC5C,IAAI,OAAO;EACX,OAAO,MAAM;GACX,MAAM,QAAQ,IAAI,gBAAgB;IAAE,MAAM,OAAO,IAAI;IAAG,UAAU;GAAM,CAAC;GACzE,MAAM,EAAE,MAAM,aAAa,OAAO,QAChC,UAAU,mBAAmB,KAAK,EAAE,EAAE,eAAe,SACrD,aACF;GACA,OAAO,cAAc,MAAM,eAAe,QAAQ;GAClD,MAAM,WAAW,OAAO,OAAOC,oBAA6B,MAAM,eAAe,QAAQ;GACzF,QAAQ,KAAK,GAAI,OAAO,OAAO,QAAQ,SAAS,QAAQC,QAAc,CAAE;GACxE,MAAM,aAAa,SAAS,aAAa;GACzC,IACG,eAAe,KAAA,KAAa,QAAQ,cACpC,eAAe,KAAA,KAAa,SAAS,OAAO,SAAS,KAEtD,OAAO;GAET,QAAQ;EACV;CACF,CAAC,CACH;CAEA,MAAM,eAAe,OAAO,GAAG,+BAA+B,CAAC,EAC5D,UAAiC,WAChC,OAAO,IAAI,aAAa;EACtB,MAAM,OAAO,OAAO,YAAY,QAAQ;EACxC,MAAM,EAAE,MAAM,aAAa,OAAO,QAChC,UAAU,mBAAmB,KAAK,EAAE,EAAE,eACtC,gBACA;GAAE,MAAM,KAAK,UAAUC,OAAe,MAAM,CAAC;GAAG,QAAQ;EAAO,CACjE;EACA,OAAO,cAAc,MAAM,gBAAgB,QAAQ;EAEnD,OAAO,EAAE,mBAAkB,OADH,OAAOC,gBAAyB,MAAM,gBAAgB,QAAQ,EAAA,CAClD,OAAO,GAAG;CAChD,CAAC,CACL;CAEA,MAAM,YAAY,OAAO,GAAG,4BAA4B,CAAC,EACtD,UAAiC,qBAChC,OAAO,IAAI,aAAa;EACtB,MAAM,OAAO,OAAO,YAAY,QAAQ;EACxC,MAAM,EAAE,MAAM,aAAa,OAAO,QAChC,UAAU,mBAAmB,KAAK,EAAE,EAAE,eAAe,mBAAmB,gBAAgB,KACxF,WACF;EACA,IAAI,SAAS,WAAW,KAAK,OAAO;EACpC,OAAO,cAAc,MAAM,aAAa,QAAQ;EAChD,MAAM,WAAW,OAAO,OAAOA,gBAAyB,MAAM,aAAa,QAAQ;EACnF,OAAO,OAAOF,SAAe,SAAS,MAAM;CAC9C,CAAC,CACL;CAgDA,OAAO;EACL,IAAI;EACJ;EACA,cAjDmB,OAAO,GAAG,+BAA+B,CAAC,EAC5D,UAAiC,qBAChC,OAAO,IAAI,aAAa;GACtB,MAAM,OAAO,OAAO,YAAY,QAAQ;GACxC,MAAM,EAAE,MAAM,aAAa,OAAO,QAChC,UAAU,mBAAmB,KAAK,EAAE,EAAE,eAAe,mBAAmB,gBAAgB,KACxF,gBACA,EAAE,QAAQ,SAAS,CACrB;GACA,OAAO,cAAc,MAAM,gBAAgB,QAAQ;EACrD,CAAC,CAuCQ;EACX;EACA,cAtCmB,OAAO,GAAG,+BAA+B,CAAC,OAC7D,SAAS,CAAC,CAAC,KACT,OAAO,KAAK,UAAU;GACpB,MAAM,2BAAW,IAAI,IAA8B;GACnD,KAAK,MAAM,QAAQ,OAAO,SAAS,IAAI,KAAK,QAAQ,IAAI,KAAK,OAAO;GACpE,OAAO,CAAC,GAAG,SAAS,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC;EACzF,CAAC,CACH,CA+BW;EACX;EACA,WA9BgB,OAAO,GAAG,4BAA4B,CAAC,EAAE,QAAwB,CAAC,MAClF,SAAS,MAAM,aAAa,QAAQ,WAAW,MAAM,IAAI,CAAC,CAAC,KACzD,OAAO,SAAS,UAAU,OAAO,QAAQ,OAAO,WAAW,CAAC,CAC9D,CA2BQ;EACR,eAzBoB,OAAO,GAAG,gCAAgC,CAAC,OAC/D,OAAO,IAAI,aAAa;GACtB,MAAM,OACJ,QAAQ,cAAc,YAClB,aAAa,mBAAmB,QAAQ,SAAS,EAAE,kBACnD;GACN,MAAM,YAAY,OAAO,aAAa,IAAI;GAC1C,OAAO,SAAS,QAAQ,SAAS;GACjC,OAAO;IACL,WAAW,QAAQ;IACnB,cAAc,QAAQ;IACtB;IACA,QAAQ,CAAC;GACX;EACF,CAAC,CAWW;CACd;AACF;AAEA,MAAM,cAAc,OAAO,GAAG,8BAA8B,CAAC,EAAE,SAC7D,OAAO,IAAI,aAAa;CACtB,MAAM,OAAO,OAAOG,SAAkB,KAAK,IAAI,CAAC,CAAC,KAC/C,OAAO,UAAU,UAAU,QAAQ,aAAa,MAAM,SAAS,EAAE,QAAQ,WAAW,CAAC,CAAC,CACxF;CACA,MAAM,cAAc,OAAO,OAAO,QAAQ,KAAK,eAAe,eAC5DA,SAAkB,UAAU,CAAC,CAAC,KAC5B,OAAO,UAAU,UAAU,QAAQ,aAAa,MAAM,SAAS,EAAE,QAAQ,WAAW,CAAC,CAAC,CACxF,CACF;CACA,OAAO;EACL,WAAW,KAAK,QAAQ;EACxB,IAAI,KAAK;EACT;EACA;EACA,QAAQ,KAAK,UAAU;CACzB;AACF,CAAC,CACH;AAEA,SAAS,OACP,QACA,OACA,WACA,UACqC;CACrC,OAAOC,OAAE,oBAAoB,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAC1C,OAAO,UAAU,UACf,QAAQ,WAAW,uDAAuD,MAAM,WAAW;EACzF,QAAQ;EACR,QAAQ,SAAS;CACnB,CAAC,CACH,CACF;AACF;AAEA,SAAS,cACP,OACA,WACA,UACwC;CACxC,OAAOA,OAAE,oBAAoBC,YAAqB,CAAC,CAAC,KAAK,CAAC,CAAC,KACzD,OAAO,eACL,QAAQ,WAAW,4DAA4D;EAC7E,QAAQ;EACR,QAAQ,SAAS;CACnB,CAAC,CACH,GACA,OAAO,SAAS,aAAa;EAC3B,IAAI,SAAS,MAAM,SAAS,SAAS,OAAO,OAAO;EACnD,MAAM,SAAS,SAAS,OAAO;EAC/B,MAAM,eAAe,WAAW,SAAS,QAAQ,IAAI,aAAa,CAAC;EACnE,OAAO,OAAO,KACZ,QACE,WACA,QAAQ,WAAW,uCAAuC,SAAS,UACnE;GACE,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,OAAO,KAAK;GACpD,QAAQ,OAAO,SAAS,QAAQ,QAAQ,IAAI;GAC5C,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa;GACrD,QAAQ,SAAS;EACnB,CACF,CACF;CACF,CAAC,CACH;AACF;AAEA,SAAS,OAAO,QAAgB,MAAwC;CACtE,IAAI,WAAW,KAAK,OAAO;CAC3B,IAAI,WAAW,KAAK,OAAO;CAC3B,IAAI,WAAW,KAAK,OAAO;CAC3B,IAAI,WAAW,OAAO,SAAS,SAAS,SAAS,SAAS,SAAS,OAAO,OAAO;CACjF,IAAI,WAAW,KAAK,OAAO;CAC3B,IAAI,UAAU,KAAK,OAAO;CAC1B,OAAO;AACT;AAEA,SAAS,WAAW,OAA0C;CAC5D,IAAI,UAAU,MAAM,OAAO,KAAA;CAC3B,MAAM,UAAU,OAAO,KAAK;CAC5B,IAAI,OAAO,SAAS,OAAO,GAAG,OAAO,KAAK,IAAI,GAAG,UAAU,GAAK;CAChE,MAAM,OAAO,KAAK,MAAM,KAAK;CAC7B,OAAO,OAAO,MAAM,IAAI,IAAI,KAAA,IAAY,KAAK,IAAI,GAAG,OAAO,KAAK,IAAI,CAAC;AACvE;AAEA,SAAS,QACP,WACA,SACA,SAA0F,CAAC,GACxE;CACnB,OAAO,IAAIC,MAAkB;EAC3B,GAAG;EACH;EACA;EACA,YAAY;CACd,CAAC;AACH;;;;;;;;;;;;;;ACrcA,MAAM,sBAAsB;CAC1B,wBAAwB;CACxB,QAAQ;CACR,qBAAqB;CACrB,gBAAgB;AAClB;AAEA,MAAMC,YAAU,OAAO,OAAO,EAAE,WAAW,OAAO,SAAS,CAAC,WAAW,MAAM,CAAC,EAAE,CAAC;AAEjF,MAAa,eAAeC,MAAsB,iBAAiBD,SAAO;;AAG1E,SAAgB,YACd,cAC+E;CAC/E,OAAO;EACL,MAAM;EACN,cAAc,CAAC,GAAG,YAAY;EAC9B,iBAAiB;CACnB;AACF;;AAWA,SAAgB,YAAY,SAAuD;CACjF,OAAO;EACL,MAAM;EACN;EACA,cAAc,CAAC,GAAG,QAAQ,YAAY;EACtC,YAAY,QAAQ;EACpB,QAAQ,CAAC,GAAG,QAAQ,MAAM;CAC5B;AACF;;AAGA,SAAgB,SAAS,SAAoD;CAC3E,OAAO;EACL,SAAS,CAAC,YAAY,QAAQ,YAAY,GAAG,YAAY,OAAO,CAAC;EACjE,YAAY;CACd;AACF;;AAiCA,SAAgB,gBACd,SACmC;CACnC,QAAQ,QAAqC,gBAC3C,OAAO,IAAI,aAAa;EACtB,MAAM,YACJ,QAAQ,cACP,OAAOE,6BAAoC;GAC1C,GAAI,QAAQ,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;GACpE,QAAQ,QAAQ;GAChB,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;GAC9D,OAAO;EACT,CAAC,CAAC,CAAC,KAAK,OAAO,KAAK,YAAY,QAAQ,EAAE,CAAC;EAC7C,IAAI,QAAQ,cAAc,KAAA,GACxB,OAAOC,KAAY;GACjB,WAAW,QAAQ;GACnB,GAAI,QAAQ,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;GACpE,cAAc,QAAQ;GACtB,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;GAC9D,OAAO;GACP,WAAW;EACb,CAAC,CAAC,CAAC,UAAU;EAEf,MAAM,MAAM,OAAO,MAAM;EACzB,OAAO;GACL;GACA,WACE,OAAO,OAAO,eAAe,WAAW,IAAI,KAAK,MAAM,OAAO,aAAa,GAAK,IAAI;EACxF;CACF,CAAC;AACL;;AAGA,SAAgB,eACd,SACwE;CACxE,QAAQ,UACN,QAAQ,cAAc,KAAA,IAClBC,oBAA2B;EACzB,GAAI,QAAQ,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;EACpE,cAAc,QAAQ;EACtB,QAAQ,QAAQ;EAChB,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAC9D;EACA,GAAI,QAAQ,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,QAAQ,UAAU;CAC5E,CAAC,IACDD,KAAY;EACV,WAAW,QAAQ;EACnB,GAAI,QAAQ,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;EACpE,cAAc,QAAQ;EACtB,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAC9D;EACA,GAAI,QAAQ,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,QAAQ,UAAU;CAC5E,CAAC,CAAC,CAAC,cAAc;AACzB;;AAOA,SAAgB,sBACd,SACwD;CACxD,MAAM,uBAAuB,CAAC,GAAG,QAAQ,YAAY;CACrD,OAAA,OAAyB,MAAM;EAC7B,cAAc,OAAO,GAAG,kCAAkC,CAAC,CAAC,WAAW,OAAO;GAC5E,MAAM,YAAY,OAAO,eAAe,OAAO,CAAC,CAAC,KAAK;GACtD,MAAM,aAAa,IAAI,KAAK,OAAO,MAAM,iBAAiB;GAC1D,OAAO;IACL,oBAAoB,UAAU,aAAa,KAAK,gBAAgB;KAC9D;KACA,UAAA,SAAyC,aAAa,EAAE,WAAW,CAAC;IACtE,EAAE;IACF,YAAY;KAAE,aAAa;KAAO,cAAc;KAAM,WAAW;IAAS;IAC1E,WAAW,UAAU;IACrB,mBAAmB,UAAU;IAC7B,iBAAiB,OAAO,aAAa,OAAO,EAAE,WAAW,QAAQ,aAAa,OAAO,CAAC;IACtF,QAAQ,CAAC,GAAG,UAAU,MAAM;GAC9B;EACF,CAAC;EACD,YAAY;EACZ;EACA,OAAO,QAAQ;CACjB,CAAC;AACH;;AAGA,MAAa,sBAAsB,OAAO,GAAG,oCAAoC,CAAC,CAAC,WACjF,SAIA;CACA,MAAM,WAAW,OAAO,gBAAgB,OAAO,CAAC,CAAC,QAAQ,QAAQ,QAAQ,WAAW;CACpF,MAAM,aAAa,IAAI,KAAK,OAAO,MAAM,iBAAiB;CAC1D,OAAO;EACL,oBAAoB,QAAQ,aAAa,KAAK,gBAAgB;GAC5D;GACA,UAAA,SAAyC,aAAa,EAAE,WAAW,CAAC;EACtE,EAAE;EACF,YAAY;GACV,aAAa,QAAQ;GACrB,cACE,QAAQ,OAAO,kBAAkB,KAAA,IAC7B,OAAA,MACa,KAAK,QAAQ,OAAO,aAAa;GACpD,WAAW,QAAQ,OAAO;EAC5B;EACA,WAAW,SAAS;EACpB,mBAAmB,SAAS;EAC5B,iBAAiB,OAAO,aAAa,OAAO,EAAE,WAAW,OAAO,CAAC;EACjE,SAAS,QAAQ,OAAO,SAAS,GAAA,CAAI,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO;CAChE;AACF,CAAC;;AAUD,SAAgB,UAAU,SAAuD;CAC/E,MAAM,SAAS,YAAY;EACzB,cAAc,QAAQ;EACtB,YAAY,QAAQ;EACpB,QAAQ,QAAQ;CAClB,CAAC;CACD,OAAO;EACL,UAAU,OAAO,GAAG,mCAAmC,CAAC,CAAC,WAAW,SAAS,aAAa;GACxF,MAAM,SAAS,OAAOE,SAA2B;IAC/C;IACA,QAAQ,QAAQ;IAChB,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;IAC9D;IACA;IACA,YAAY;GACd,CAAC;GACD,OAAO,OAAO,oBAAoB;IAChC,GAAI,QAAQ,cAAc,KAAA,IACtB,EAAE,QAAQ,QAAQ,OAAO,IACzB,EAAE,WAAW,QAAQ,UAAU;IACnC,GAAI,QAAQ,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;IACpE,cAAc,QAAQ;IACtB,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;IAC9D,aAAaC,OAAY,OAAO,YAAY;IAC5C;GACF,CAAC;EACH,CAAC;EACD,QAAQ;EACR,YAAY;EACZ,sBAAsB,CAAC,GAAG,QAAQ,YAAY;EAC9C,QAAQ,mBACNC,MAAwB;GACtB,QAAQ,QAAQ;GAChB;GACA,aAAa,QAAQ;GACrB,OAAO;EACT,CAAC;CACL;AACF"}

package/dist/authorization-CQSKKMrW.mjs

@@ -1,255 +0,0 @@
-import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { M as Service, k as Error$2 } from "./dns-record-BLeqo56C.mjs";
-import { Clock, Crypto, Data, Effect, Schema } from "effect";
-//#region src/auth/connect.ts
-const Method = Data.taggedEnum();
-const StartResult = Data.taggedEnum();
-var Error$1 = class extends Schema.TaggedError()("ConnectionError", {
-	category: Schema.Literals([
-		"authorization",
-		"provider",
-		"validation"
-	]),
-	message: Schema.String,
-	operation: Schema.String,
-	retry: Schema.Literals([
-		"never",
-		"after-user-action",
-		"safe",
-		"unknown"
-	])
-}) {};
-const mergeGrant = (current, requested) => {
-	if (current === void 0) return requested;
-	if (current._tag === "account" || requested._tag === "account") return { _tag: "account" };
-	return {
-		_tag: "domains",
-		domains: [.../* @__PURE__ */ new Set([...current.domains, ...requested.domains])]
-	};
-};
-const persist = Effect.fn("Connection.persist")(function* (input) {
-	const repository = yield* Service;
-	const crypto = yield* Crypto.Crypto;
-	const now = new Date(yield* Clock.currentTimeMillis);
-	const missingCapability = input.requiredCapabilities.find((capability) => !input.authentication.capabilityEvidence.some((item) => item.capability === capability));
-	if (missingCapability !== void 0) return yield* new Error$1({
-		category: "authorization",
-		message: `Provider authorization lacks evidence for ${missingCapability}`,
-		operation: "Connection.persist",
-		retry: "after-user-action"
-	});
-	const existing = yield* repository.findByProviderAccount(input.providerId, input.authentication.providerAccountId);
-	const authorizationId = existing?.authorization.id ?? (yield* crypto.randomUUIDv4.pipe(Effect.mapError((cause) => new Error$1({
-		category: "validation",
-		message: cause.message,
-		operation: "Connection.persist",
-		retry: "safe"
-	}))));
-	const existingBinding = existing?.bindings.find((binding) => binding.ownerId === input.ownerId);
-	const binding = {
-		authorizationId,
-		createdAt: existingBinding?.createdAt ?? now,
-		grant: mergeGrant(existingBinding?.grant, input.grant),
-		id: existingBinding?.id ?? (yield* crypto.randomUUIDv4.pipe(Effect.mapError((cause) => new Error$1({
-			category: "validation",
-			message: cause.message,
-			operation: "Connection.persist",
-			retry: "safe"
-		})))),
-		ownerId: input.ownerId
-	};
-	const aggregate = {
-		authorization: {
-			authorizedById: input.authorizedById,
-			capabilityEvidence: [...input.authentication.capabilityEvidence],
-			createdAt: existing?.authorization.createdAt ?? now,
-			expiresAt: input.authentication.expiresAt,
-			id: authorizationId,
-			method: input.method,
-			providerAccountId: input.authentication.providerAccountId,
-			providerContext: input.authentication.providerContext,
-			providerId: input.providerId,
-			requiredCapabilities: [...input.requiredCapabilities],
-			revocation: { _tag: "Active" },
-			scopes: [...input.authentication.scopes]
-		},
-		bindings: [...existing?.bindings.filter((candidate) => candidate.id !== binding.id) ?? [], binding],
-		credential: input.authentication.credential
-	};
-	return yield* repository.connect(aggregate);
-});
-const start = Effect.fn("Connection.start")(function* (input) {
-	if (input.method._tag === "Interactive") {
-		const crypto = yield* Crypto.Crypto;
-		const now = yield* Clock.currentTimeMillis;
-		const continuationId = yield* crypto.randomUUIDv4.pipe(Effect.mapError((cause) => new Error$1({
-			category: "validation",
-			message: cause.message,
-			operation: "Connection.start",
-			retry: "safe"
-		})));
-		const started = yield* input.method.flow.start(continuationId);
-		yield* input.method.continuations.put({
-			authorizedById: input.authorizedById,
-			expiresAt: new Date(now + (input.method.ttlMs ?? 6e5)),
-			grant: input.grant,
-			id: continuationId,
-			method: input.method.flow.method,
-			ownerId: input.ownerId,
-			payload: started.payload,
-			providerId: input.method.flow.providerId,
-			requiredCapabilities: [...input.method.flow.requiredCapabilities]
-		});
-		return StartResult.Redirect({
-			authorizationUrl: started.authorizationUrl,
-			continuationId
-		});
-	}
-	const authentication = yield* input.method.authenticate(input.method.token);
-	const aggregate = yield* persist({
-		authentication,
-		authorizedById: input.authorizedById,
-		grant: input.grant,
-		method: "token",
-		ownerId: input.ownerId,
-		providerId: input.method.providerId,
-		requiredCapabilities: input.method.requiredCapabilities
-	});
-	return StartResult.Connected({ aggregate });
-});
-const complete = Effect.fn("Connection.complete")(function* (input) {
-	const continuation = yield* input.continuations.consume(input.continuationId, new Date(yield* Clock.currentTimeMillis));
-	if (continuation === null) return yield* new Error$1({
-		category: "authorization",
-		message: "Connection continuation is expired, unknown, or already consumed",
-		operation: "Connection.complete",
-		retry: "after-user-action"
-	});
-	if (continuation.providerId !== input.flow.providerId || continuation.method !== input.flow.method) return yield* new Error$1({
-		category: "authorization",
-		message: "Connection continuation does not match the provider flow",
-		operation: "Connection.complete",
-		retry: "never"
-	});
-	const authentication = yield* input.flow.complete(continuation.payload, input.callbackUrl);
-	return yield* persist({
-		authentication,
-		authorizedById: continuation.authorizedById,
-		grant: continuation.grant,
-		method: continuation.method,
-		ownerId: continuation.ownerId,
-		providerId: continuation.providerId,
-		requiredCapabilities: continuation.requiredCapabilities
-	});
-});
-//#endregion
-//#region src/auth/secret.ts
-var secret_exports = /* @__PURE__ */ __exportAll({
-	Value: () => Value,
-	make: () => make
-});
-/** A deliberately non-serializable credential value. */
-var Value = class Value {
-	#value;
-	constructor(value) {
-		this.#value = value;
-	}
-	static from(value) {
-		if (value.length === 0) throw new Error("Secret values cannot be empty");
-		return new Value(value);
-	}
-	expose() {
-		return this.#value;
-	}
-	toJSON() {
-		return "[REDACTED]";
-	}
-	toString() {
-		return "[REDACTED]";
-	}
-};
-const make = Value.from;
-//#endregion
-//#region src/auth/provider-context.ts
-var provider_context_exports = /* @__PURE__ */ __exportAll({
-	Envelope: () => Envelope,
-	codec: () => codec,
-	decode: () => decode$1,
-	encode: () => encode$1
-});
-/** A provider-owned, versioned, non-secret context value persisted by the host. */
-const Envelope = Schema.Struct({
-	value: Schema.Json,
-	version: Schema.String
-});
-/** Build an adapter-owned context codec from a schema and stable version identifier. */
-function codec(version, schema) {
-	return {
-		decode: Effect.fn("ProviderContext.decode")((envelope) => envelope.version !== version ? Effect.fail(new Error$2({ message: `Unsupported provider context version: ${envelope.version}` })) : Schema.decodeUnknownEffect(schema)(envelope.value).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message })))),
-		encode: Effect.fn("ProviderContext.encode")((value) => Schema.encodeEffect(schema)(value).pipe(Effect.flatMap((encoded) => Schema.decodeUnknownEffect(Schema.Json)(encoded)), Effect.map((encoded) => ({
-			value: encoded,
-			version
-		})), Effect.mapError((cause) => new Error$2({ message: cause.message })))),
-		version
-	};
-}
-const decode$1 = Effect.fn("ProviderContext.Envelope.decode")((input) => Schema.decodeUnknownEffect(Envelope)(input).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message }))));
-const encode$1 = Schema.encodeSync(Envelope);
-//#endregion
-//#region src/auth/authorization.ts
-var authorization_exports = /* @__PURE__ */ __exportAll({
-	Capability: () => Capability,
-	CapabilityEvidence: () => CapabilityEvidence,
-	Evidence: () => Evidence,
-	EvidenceSchema: () => EvidenceSchema,
-	Revocation: () => Revocation,
-	Schema: () => Schema$1,
-	decode: () => decode,
-	encode: () => encode,
-	evidenceFor: () => evidenceFor,
-	validate: () => validate
-});
-const Capability = Schema.Literals(["dns:read", "dns:write"]);
-const Evidence = Data.taggedEnum();
-const EvidenceSchema = Schema.TaggedUnion({
-	Declared: {},
-	Exercised: { observedAt: Schema.DateFromString },
-	Introspected: { observedAt: Schema.DateFromString }
-});
-const CapabilityEvidence = Schema.Struct({
-	capability: Capability,
-	evidence: EvidenceSchema
-});
-const Revocation = Schema.TaggedUnion({
-	Active: {},
-	Pending: { requestedAt: Schema.DateFromString }
-});
-/** A provider credential authorization shared by one or more owner connections. */
-const Schema$1 = Schema.Struct({
-	authorizedById: Schema.String,
-	capabilityEvidence: Schema.Array(CapabilityEvidence),
-	createdAt: Schema.DateFromString,
-	expiresAt: Schema.NullOr(Schema.DateFromString),
-	id: Schema.String,
-	method: Schema.Literals([
-		"integration",
-		"oauth2",
-		"token"
-	]),
-	providerAccountId: Schema.String,
-	providerContext: Envelope,
-	providerId: Schema.String,
-	requiredCapabilities: Schema.Array(Capability),
-	revocation: Revocation,
-	scopes: Schema.Array(Schema.String)
-});
-const decode = Effect.fn("ProviderAuthorization.decode")((input) => Schema.decodeUnknownEffect(Schema$1)(input).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message }))));
-const validate = Effect.fn("ProviderAuthorization.validate")((input) => Schema.decodeUnknownEffect(Schema.toType(Schema$1))(input).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message }))));
-const encode = Schema.encodeSync(Schema$1);
-function evidenceFor(authorization, capability) {
-	return authorization.capabilityEvidence.find((item) => item.capability === capability)?.evidence;
-}
-//#endregion
-export { StartResult as _, Schema$1 as a, encode as c, provider_context_exports as d, Value as f, Method as g, Error$1 as h, EvidenceSchema as i, evidenceFor as l, secret_exports as m, CapabilityEvidence as n, authorization_exports as o, make as p, Evidence as r, decode as s, Capability as t, codec as u, complete as v, start as y };
-
-//# sourceMappingURL=authorization-CQSKKMrW.mjs.map

package/dist/authorization-CQSKKMrW.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"authorization-CQSKKMrW.mjs","names":["Error","Repository.Service","InvalidInputError","decode","encode","S","Schema","ProviderContext.Envelope","InvalidInputError"],"sources":["../src/auth/connect.ts","../src/auth/secret.ts","../src/auth/provider-context.ts","../src/auth/authorization.ts"],"sourcesContent":["import { Clock, Crypto, Data, Effect, Schema } from \"effect\";\n\nimport { CryptoError } from \"../plan/canonical-json.ts\";\nimport type { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport type * as DnsProvider from \"../provider/provider.ts\";\nimport * as ProviderAuthorization from \"./authorization.ts\";\nimport type * as Binding from \"./connection.ts\";\nimport * as Repository from \"./lifecycle-repository.ts\";\nimport type * as ProviderContext from \"./provider-context.ts\";\nimport type * as Secret from \"./secret.ts\";\n\nexport interface Authentication {\n  readonly capabilityEvidence: ReadonlyArray<ProviderAuthorization.CapabilityEvidence>;\n  readonly credential: Binding.StoredCredential;\n  readonly expiresAt: Date | null;\n  readonly providerAccountId: string;\n  readonly providerContext: ProviderContext.Envelope;\n  readonly scopes: ReadonlyArray<string>;\n}\n\nexport type AuthenticationFailure = Error | InvalidInputError | DnsProvider.Error;\n\nexport interface InteractiveStart {\n  readonly authorizationUrl: URL;\n  readonly payload: Secret.Value;\n}\n\nexport interface Continuation extends BaseInput {\n  readonly expiresAt: Date;\n  readonly id: string;\n  readonly method: \"integration\" | \"oauth2\";\n  readonly payload: Secret.Value;\n  readonly providerId: string;\n  readonly requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n}\n\nexport interface ContinuationStore {\n  readonly consume: (id: string, now: Date) => Effect.Effect<Continuation | null, Error>;\n  readonly put: (continuation: Continuation) => Effect.Effect<void, Error>;\n}\n\nexport interface InteractiveFlow {\n  readonly complete: (\n    payload: Secret.Value,\n    callbackUrl: URL,\n  ) => Effect.Effect<Authentication, AuthenticationFailure>;\n  readonly method: \"integration\" | \"oauth2\";\n  readonly providerId: string;\n  readonly requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n  readonly start: (\n    continuationId: string,\n  ) => Effect.Effect<InteractiveStart, AuthenticationFailure, Crypto.Crypto>;\n}\n\nexport type Method = Data.TaggedEnum<{\n  Interactive: {\n    readonly continuations: ContinuationStore;\n    readonly flow: InteractiveFlow;\n    readonly ttlMs?: number;\n  };\n  Token: {\n    readonly authenticate: (\n      token: Secret.Value,\n    ) => Effect.Effect<Authentication, AuthenticationFailure>;\n    readonly providerId: string;\n    readonly requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n    readonly token: Secret.Value;\n  };\n}>;\nexport const Method = Data.taggedEnum<Method>();\n\nexport type StartResult = Data.TaggedEnum<{\n  Connected: { readonly aggregate: Repository.Aggregate };\n  Redirect: { readonly authorizationUrl: URL; readonly continuationId: string };\n}>;\nexport const StartResult = Data.taggedEnum<StartResult>();\n\nexport class Error extends Schema.TaggedError<Error>()(\"ConnectionError\", {\n  category: Schema.Literals([\"authorization\", \"provider\", \"validation\"]),\n  message: Schema.String,\n  operation: Schema.String,\n  retry: Schema.Literals([\"never\", \"after-user-action\", \"safe\", \"unknown\"]),\n}) {}\n\nexport interface BaseInput {\n  readonly authorizedById: string;\n  readonly grant: Binding.Grant;\n  readonly ownerId: string;\n}\n\nexport interface CompleteInput {\n  readonly callbackUrl: URL;\n  readonly continuationId: string;\n  readonly continuations: ContinuationStore;\n  readonly flow: InteractiveFlow;\n}\n\nconst mergeGrant = (\n  current: Binding.Grant | undefined,\n  requested: Binding.Grant,\n): Binding.Grant => {\n  if (current === undefined) return requested;\n  if (current._tag === \"account\" || requested._tag === \"account\") return { _tag: \"account\" };\n  return {\n    _tag: \"domains\",\n    domains: [...new Set([...current.domains, ...requested.domains])],\n  };\n};\n\nconst persist = Effect.fn(\"Connection.persist\")(function* (\n  input: BaseInput & {\n    readonly authentication: Authentication;\n    readonly method: \"integration\" | \"oauth2\" | \"token\";\n    readonly providerId: string;\n    readonly requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n  },\n) {\n  const repository = yield* Repository.Service;\n  const crypto = yield* Crypto.Crypto;\n  const now = new Date(yield* Clock.currentTimeMillis);\n  const missingCapability = input.requiredCapabilities.find(\n    (capability) =>\n      !input.authentication.capabilityEvidence.some((item) => item.capability === capability),\n  );\n  if (missingCapability !== undefined) {\n    return yield* new Error({\n      category: \"authorization\",\n      message: `Provider authorization lacks evidence for ${missingCapability}`,\n      operation: \"Connection.persist\",\n      retry: \"after-user-action\",\n    });\n  }\n  const existing = yield* repository.findByProviderAccount(\n    input.providerId,\n    input.authentication.providerAccountId,\n  );\n  const authorizationId =\n    existing?.authorization.id ??\n    (yield* crypto.randomUUIDv4.pipe(\n      Effect.mapError(\n        (cause) =>\n          new Error({\n            category: \"validation\",\n            message: cause.message,\n            operation: \"Connection.persist\",\n            retry: \"safe\",\n          }),\n      ),\n    ));\n  const existingBinding = existing?.bindings.find((binding) => binding.ownerId === input.ownerId);\n  const binding: Binding.Connection = {\n    authorizationId,\n    createdAt: existingBinding?.createdAt ?? now,\n    grant: mergeGrant(existingBinding?.grant, input.grant),\n    id:\n      existingBinding?.id ??\n      (yield* crypto.randomUUIDv4.pipe(\n        Effect.mapError(\n          (cause) =>\n            new Error({\n              category: \"validation\",\n              message: cause.message,\n              operation: \"Connection.persist\",\n              retry: \"safe\",\n            }),\n        ),\n      )),\n    ownerId: input.ownerId,\n  };\n  const aggregate: Repository.Aggregate = {\n    authorization: {\n      authorizedById: input.authorizedById,\n      capabilityEvidence: [...input.authentication.capabilityEvidence],\n      createdAt: existing?.authorization.createdAt ?? now,\n      expiresAt: input.authentication.expiresAt,\n      id: authorizationId,\n      method: input.method,\n      providerAccountId: input.authentication.providerAccountId,\n      providerContext: input.authentication.providerContext,\n      providerId: input.providerId,\n      requiredCapabilities: [...input.requiredCapabilities],\n      revocation: { _tag: \"Active\" },\n      scopes: [...input.authentication.scopes],\n    },\n    bindings: [\n      ...(existing?.bindings.filter((candidate) => candidate.id !== binding.id) ?? []),\n      binding,\n    ],\n    credential: input.authentication.credential,\n  };\n  return yield* repository.connect(aggregate);\n});\n\nexport const start = Effect.fn(\"Connection.start\")(function* (\n  input: BaseInput & { readonly method: Method },\n) {\n  if (input.method._tag === \"Interactive\") {\n    const crypto = yield* Crypto.Crypto;\n    const now = yield* Clock.currentTimeMillis;\n    const continuationId = yield* crypto.randomUUIDv4.pipe(\n      Effect.mapError(\n        (cause) =>\n          new Error({\n            category: \"validation\",\n            message: cause.message,\n            operation: \"Connection.start\",\n            retry: \"safe\",\n          }),\n      ),\n    );\n    const started = yield* input.method.flow.start(continuationId);\n    yield* input.method.continuations.put({\n      authorizedById: input.authorizedById,\n      expiresAt: new Date(now + (input.method.ttlMs ?? 10 * 60_000)),\n      grant: input.grant,\n      id: continuationId,\n      method: input.method.flow.method,\n      ownerId: input.ownerId,\n      payload: started.payload,\n      providerId: input.method.flow.providerId,\n      requiredCapabilities: [...input.method.flow.requiredCapabilities],\n    });\n    return StartResult.Redirect({\n      authorizationUrl: started.authorizationUrl,\n      continuationId,\n    });\n  }\n  const authentication = yield* input.method.authenticate(input.method.token);\n  const aggregate = yield* persist({\n    authentication,\n    authorizedById: input.authorizedById,\n    grant: input.grant,\n    method: \"token\",\n    ownerId: input.ownerId,\n    providerId: input.method.providerId,\n    requiredCapabilities: input.method.requiredCapabilities,\n  });\n  return StartResult.Connected({ aggregate });\n});\n\nexport const complete = Effect.fn(\"Connection.complete\")(function* (input: CompleteInput) {\n  const continuation = yield* input.continuations.consume(\n    input.continuationId,\n    new Date(yield* Clock.currentTimeMillis),\n  );\n  if (continuation === null) {\n    return yield* new Error({\n      category: \"authorization\",\n      message: \"Connection continuation is expired, unknown, or already consumed\",\n      operation: \"Connection.complete\",\n      retry: \"after-user-action\",\n    });\n  }\n  if (\n    continuation.providerId !== input.flow.providerId ||\n    continuation.method !== input.flow.method\n  ) {\n    return yield* new Error({\n      category: \"authorization\",\n      message: \"Connection continuation does not match the provider flow\",\n      operation: \"Connection.complete\",\n      retry: \"never\",\n    });\n  }\n  const authentication = yield* input.flow.complete(continuation.payload, input.callbackUrl);\n  return yield* persist({\n    authentication,\n    authorizedById: continuation.authorizedById,\n    grant: continuation.grant,\n    method: continuation.method,\n    ownerId: continuation.ownerId,\n    providerId: continuation.providerId,\n    requiredCapabilities: continuation.requiredCapabilities,\n  });\n});\n\nexport type Requirements = Repository.Service | Crypto.Crypto;\nexport type Failure = AuthenticationFailure | Repository.Error | CryptoError;\n","/** A deliberately non-serializable credential value. */\nexport class Value {\n  readonly #value: string;\n\n  private constructor(value: string) {\n    this.#value = value;\n  }\n\n  static from(value: string): Value {\n    if (value.length === 0) throw new Error(\"Secret values cannot be empty\");\n    return new Value(value);\n  }\n\n  expose(): string {\n    return this.#value;\n  }\n\n  toJSON(): string {\n    return \"[REDACTED]\";\n  }\n\n  toString(): string {\n    return \"[REDACTED]\";\n  }\n}\n\nexport const make = Value.from;\n","import { Effect, Schema } from \"effect\";\n\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\n\n/** A provider-owned, versioned, non-secret context value persisted by the host. */\nexport const Envelope = Schema.Struct({\n  value: Schema.Json,\n  version: Schema.String,\n});\nexport interface Envelope extends Schema.Schema.Type<typeof Envelope> {}\n\nexport interface Codec<A> {\n  readonly decode: (envelope: Envelope) => Effect.Effect<A, InvalidInputError>;\n  readonly encode: (value: A) => Effect.Effect<Envelope, InvalidInputError>;\n  readonly version: string;\n}\n\n/** Build an adapter-owned context codec from a schema and stable version identifier. */\nexport function codec<A, I>(version: string, schema: Schema.Codec<A, I>): Codec<A> {\n  return {\n    decode: Effect.fn(\"ProviderContext.decode\")((envelope) =>\n      envelope.version !== version\n        ? Effect.fail(\n            new InvalidInputError({\n              message: `Unsupported provider context version: ${envelope.version}`,\n            }),\n          )\n        : Schema.decodeUnknownEffect(schema)(envelope.value).pipe(\n            Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n          ),\n    ),\n    encode: Effect.fn(\"ProviderContext.encode\")((value) =>\n      Schema.encodeEffect(schema)(value).pipe(\n        Effect.flatMap((encoded) => Schema.decodeUnknownEffect(Schema.Json)(encoded)),\n        Effect.map((encoded) => ({ value: encoded, version })),\n        Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n      ),\n    ),\n    version,\n  };\n}\n\nexport const decode = Effect.fn(\"ProviderContext.Envelope.decode\")((input: unknown) =>\n  Schema.decodeUnknownEffect(Envelope)(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport const encode = Schema.encodeSync(Envelope);\n","import { Data, Effect, Schema as S } from \"effect\";\n\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport * as ProviderContext from \"./provider-context.ts\";\n\nexport const Capability = S.Literals([\"dns:read\", \"dns:write\"]);\nexport type Capability = typeof Capability.Type;\n\nexport type Evidence = Data.TaggedEnum<{\n  Declared: {};\n  Exercised: { readonly observedAt: Date };\n  Introspected: { readonly observedAt: Date };\n}>;\nexport const Evidence = Data.taggedEnum<Evidence>();\n\nexport const EvidenceSchema = S.TaggedUnion({\n  Declared: {},\n  Exercised: { observedAt: S.DateFromString },\n  Introspected: { observedAt: S.DateFromString },\n});\n\nexport const CapabilityEvidence = S.Struct({\n  capability: Capability,\n  evidence: EvidenceSchema,\n});\nexport interface CapabilityEvidence extends S.Schema.Type<typeof CapabilityEvidence> {}\n\nexport const Revocation = S.TaggedUnion({\n  Active: {},\n  Pending: { requestedAt: S.DateFromString },\n});\nexport type Revocation = typeof Revocation.Type;\n\n/** A provider credential authorization shared by one or more owner connections. */\nexport const Schema = S.Struct({\n  authorizedById: S.String,\n  capabilityEvidence: S.Array(CapabilityEvidence),\n  createdAt: S.DateFromString,\n  expiresAt: S.NullOr(S.DateFromString),\n  id: S.String,\n  method: S.Literals([\"integration\", \"oauth2\", \"token\"]),\n  providerAccountId: S.String,\n  providerContext: ProviderContext.Envelope,\n  providerId: S.String,\n  requiredCapabilities: S.Array(Capability),\n  revocation: Revocation,\n  scopes: S.Array(S.String),\n});\nexport interface ProviderAuthorization extends S.Schema.Type<typeof Schema> {}\n\nexport const decode = Effect.fn(\"ProviderAuthorization.decode\")((input: unknown) =>\n  S.decodeUnknownEffect(Schema)(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport const validate = Effect.fn(\"ProviderAuthorization.validate\")((input: unknown) =>\n  S.decodeUnknownEffect(S.toType(Schema))(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport const encode = S.encodeSync(Schema);\n\nexport function evidenceFor(\n  authorization: ProviderAuthorization,\n  capability: Capability,\n): Evidence | undefined {\n  return authorization.capabilityEvidence.find((item) => item.capability === capability)?.evidence;\n}\n"],"mappings":";;;;AAqEA,MAAa,SAAS,KAAK,WAAmB;AAM9C,MAAa,cAAc,KAAK,WAAwB;AAExD,IAAaA,UAAb,cAA2B,OAAO,YAAmB,CAAC,CAAC,mBAAmB;CACxE,UAAU,OAAO,SAAS;EAAC;EAAiB;EAAY;CAAY,CAAC;CACrE,SAAS,OAAO;CAChB,WAAW,OAAO;CAClB,OAAO,OAAO,SAAS;EAAC;EAAS;EAAqB;EAAQ;CAAS,CAAC;AAC1E,CAAC,CAAC,CAAC,CAAC;AAeJ,MAAM,cACJ,SACA,cACkB;CAClB,IAAI,YAAY,KAAA,GAAW,OAAO;CAClC,IAAI,QAAQ,SAAS,aAAa,UAAU,SAAS,WAAW,OAAO,EAAE,MAAM,UAAU;CACzF,OAAO;EACL,MAAM;EACN,SAAS,CAAC,mBAAG,IAAI,IAAI,CAAC,GAAG,QAAQ,SAAS,GAAG,UAAU,OAAO,CAAC,CAAC;CAClE;AACF;AAEA,MAAM,UAAU,OAAO,GAAG,oBAAoB,CAAC,CAAC,WAC9C,OAMA;CACA,MAAM,aAAa,OAAOC;CAC1B,MAAM,SAAS,OAAO,OAAO;CAC7B,MAAM,MAAM,IAAI,KAAK,OAAO,MAAM,iBAAiB;CACnD,MAAM,oBAAoB,MAAM,qBAAqB,MAClD,eACC,CAAC,MAAM,eAAe,mBAAmB,MAAM,SAAS,KAAK,eAAe,UAAU,CAC1F;CACA,IAAI,sBAAsB,KAAA,GACxB,OAAO,OAAO,IAAID,QAAM;EACtB,UAAU;EACV,SAAS,6CAA6C;EACtD,WAAW;EACX,OAAO;CACT,CAAC;CAEH,MAAM,WAAW,OAAO,WAAW,sBACjC,MAAM,YACN,MAAM,eAAe,iBACvB;CACA,MAAM,kBACJ,UAAU,cAAc,OACvB,OAAO,OAAO,aAAa,KAC1B,OAAO,UACJ,UACC,IAAIA,QAAM;EACR,UAAU;EACV,SAAS,MAAM;EACf,WAAW;EACX,OAAO;CACT,CAAC,CACL,CACF;CACF,MAAM,kBAAkB,UAAU,SAAS,MAAM,YAAY,QAAQ,YAAY,MAAM,OAAO;CAC9F,MAAM,UAA8B;EAClC;EACA,WAAW,iBAAiB,aAAa;EACzC,OAAO,WAAW,iBAAiB,OAAO,MAAM,KAAK;EACrD,IACE,iBAAiB,OAChB,OAAO,OAAO,aAAa,KAC1B,OAAO,UACJ,UACC,IAAIA,QAAM;GACR,UAAU;GACV,SAAS,MAAM;GACf,WAAW;GACX,OAAO;EACT,CAAC,CACL,CACF;EACF,SAAS,MAAM;CACjB;CACA,MAAM,YAAkC;EACtC,eAAe;GACb,gBAAgB,MAAM;GACtB,oBAAoB,CAAC,GAAG,MAAM,eAAe,kBAAkB;GAC/D,WAAW,UAAU,cAAc,aAAa;GAChD,WAAW,MAAM,eAAe;GAChC,IAAI;GACJ,QAAQ,MAAM;GACd,mBAAmB,MAAM,eAAe;GACxC,iBAAiB,MAAM,eAAe;GACtC,YAAY,MAAM;GAClB,sBAAsB,CAAC,GAAG,MAAM,oBAAoB;GACpD,YAAY,EAAE,MAAM,SAAS;GAC7B,QAAQ,CAAC,GAAG,MAAM,eAAe,MAAM;EACzC;EACA,UAAU,CACR,GAAI,UAAU,SAAS,QAAQ,cAAc,UAAU,OAAO,QAAQ,EAAE,KAAK,CAAC,GAC9E,OACF;EACA,YAAY,MAAM,eAAe;CACnC;CACA,OAAO,OAAO,WAAW,QAAQ,SAAS;AAC5C,CAAC;AAED,MAAa,QAAQ,OAAO,GAAG,kBAAkB,CAAC,CAAC,WACjD,OACA;CACA,IAAI,MAAM,OAAO,SAAS,eAAe;EACvC,MAAM,SAAS,OAAO,OAAO;EAC7B,MAAM,MAAM,OAAO,MAAM;EACzB,MAAM,iBAAiB,OAAO,OAAO,aAAa,KAChD,OAAO,UACJ,UACC,IAAIA,QAAM;GACR,UAAU;GACV,SAAS,MAAM;GACf,WAAW;GACX,OAAO;EACT,CAAC,CACL,CACF;EACA,MAAM,UAAU,OAAO,MAAM,OAAO,KAAK,MAAM,cAAc;EAC7D,OAAO,MAAM,OAAO,cAAc,IAAI;GACpC,gBAAgB,MAAM;GACtB,WAAW,IAAI,KAAK,OAAO,MAAM,OAAO,SAAS,IAAY;GAC7D,OAAO,MAAM;GACb,IAAI;GACJ,QAAQ,MAAM,OAAO,KAAK;GAC1B,SAAS,MAAM;GACf,SAAS,QAAQ;GACjB,YAAY,MAAM,OAAO,KAAK;GAC9B,sBAAsB,CAAC,GAAG,MAAM,OAAO,KAAK,oBAAoB;EAClE,CAAC;EACD,OAAO,YAAY,SAAS;GAC1B,kBAAkB,QAAQ;GAC1B;EACF,CAAC;CACH;CACA,MAAM,iBAAiB,OAAO,MAAM,OAAO,aAAa,MAAM,OAAO,KAAK;CAC1E,MAAM,YAAY,OAAO,QAAQ;EAC/B;EACA,gBAAgB,MAAM;EACtB,OAAO,MAAM;EACb,QAAQ;EACR,SAAS,MAAM;EACf,YAAY,MAAM,OAAO;EACzB,sBAAsB,MAAM,OAAO;CACrC,CAAC;CACD,OAAO,YAAY,UAAU,EAAE,UAAU,CAAC;AAC5C,CAAC;AAED,MAAa,WAAW,OAAO,GAAG,qBAAqB,CAAC,CAAC,WAAW,OAAsB;CACxF,MAAM,eAAe,OAAO,MAAM,cAAc,QAC9C,MAAM,gBACN,IAAI,KAAK,OAAO,MAAM,iBAAiB,CACzC;CACA,IAAI,iBAAiB,MACnB,OAAO,OAAO,IAAIA,QAAM;EACtB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAEH,IACE,aAAa,eAAe,MAAM,KAAK,cACvC,aAAa,WAAW,MAAM,KAAK,QAEnC,OAAO,OAAO,IAAIA,QAAM;EACtB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAEH,MAAM,iBAAiB,OAAO,MAAM,KAAK,SAAS,aAAa,SAAS,MAAM,WAAW;CACzF,OAAO,OAAO,QAAQ;EACpB;EACA,gBAAgB,aAAa;EAC7B,OAAO,aAAa;EACpB,QAAQ,aAAa;EACrB,SAAS,aAAa;EACtB,YAAY,aAAa;EACzB,sBAAsB,aAAa;CACrC,CAAC;AACH,CAAC;;;;;;;;ACjRD,IAAa,QAAb,MAAa,MAAM;CACjB;CAEA,YAAoB,OAAe;EACjC,KAAK,SAAS;CAChB;CAEA,OAAO,KAAK,OAAsB;EAChC,IAAI,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,+BAA+B;EACvE,OAAO,IAAI,MAAM,KAAK;CACxB;CAEA,SAAiB;EACf,OAAO,KAAK;CACd;CAEA,SAAiB;EACf,OAAO;CACT;CAEA,WAAmB;EACjB,OAAO;CACT;AACF;AAEA,MAAa,OAAO,MAAM;;;;;;;;;;ACrB1B,MAAa,WAAW,OAAO,OAAO;CACpC,OAAO,OAAO;CACd,SAAS,OAAO;AAClB,CAAC;;AAUD,SAAgB,MAAY,SAAiB,QAAsC;CACjF,OAAO;EACL,QAAQ,OAAO,GAAG,wBAAwB,CAAC,EAAE,aAC3C,SAAS,YAAY,UACjB,OAAO,KACL,IAAIE,QAAkB,EACpB,SAAS,yCAAyC,SAAS,UAC7D,CAAC,CACH,IACA,OAAO,oBAAoB,MAAM,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,KACjD,OAAO,UAAU,UAAU,IAAIA,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACN;EACA,QAAQ,OAAO,GAAG,wBAAwB,CAAC,EAAE,UAC3C,OAAO,aAAa,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KACjC,OAAO,SAAS,YAAY,OAAO,oBAAoB,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,GAC5E,OAAO,KAAK,aAAa;GAAE,OAAO;GAAS;EAAQ,EAAE,GACrD,OAAO,UAAU,UAAU,IAAIA,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;EACA;CACF;AACF;AAEA,MAAaC,WAAS,OAAO,GAAG,iCAAiC,CAAC,EAAE,UAClE,OAAO,oBAAoB,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,KAC1C,OAAO,UAAU,UAAU,IAAID,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AAEA,MAAaE,WAAS,OAAO,WAAW,QAAQ;;;;;;;;;;;;;;;AC3ChD,MAAa,aAAaC,OAAE,SAAS,CAAC,YAAY,WAAW,CAAC;AAQ9D,MAAa,WAAW,KAAK,WAAqB;AAElD,MAAa,iBAAiBA,OAAE,YAAY;CAC1C,UAAU,CAAC;CACX,WAAW,EAAE,YAAYA,OAAE,eAAe;CAC1C,cAAc,EAAE,YAAYA,OAAE,eAAe;AAC/C,CAAC;AAED,MAAa,qBAAqBA,OAAE,OAAO;CACzC,YAAY;CACZ,UAAU;AACZ,CAAC;AAGD,MAAa,aAAaA,OAAE,YAAY;CACtC,QAAQ,CAAC;CACT,SAAS,EAAE,aAAaA,OAAE,eAAe;AAC3C,CAAC;;AAID,MAAaC,WAASD,OAAE,OAAO;CAC7B,gBAAgBA,OAAE;CAClB,oBAAoBA,OAAE,MAAM,kBAAkB;CAC9C,WAAWA,OAAE;CACb,WAAWA,OAAE,OAAOA,OAAE,cAAc;CACpC,IAAIA,OAAE;CACN,QAAQA,OAAE,SAAS;EAAC;EAAe;EAAU;CAAO,CAAC;CACrD,mBAAmBA,OAAE;CACrB,iBAAiBE;CACjB,YAAYF,OAAE;CACd,sBAAsBA,OAAE,MAAM,UAAU;CACxC,YAAY;CACZ,QAAQA,OAAE,MAAMA,OAAE,MAAM;AAC1B,CAAC;AAGD,MAAa,SAAS,OAAO,GAAG,8BAA8B,CAAC,EAAE,UAC/DA,OAAE,oBAAoBC,QAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KACnC,OAAO,UAAU,UAAU,IAAIE,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AAEA,MAAa,WAAW,OAAO,GAAG,gCAAgC,CAAC,EAAE,UACnEH,OAAE,oBAAoBA,OAAE,OAAOC,QAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAC7C,OAAO,UAAU,UAAU,IAAIE,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AAEA,MAAa,SAASH,OAAE,WAAWC,QAAM;AAEzC,SAAgB,YACd,eACA,YACsB;CACtB,OAAO,cAAc,mBAAmB,MAAM,SAAS,KAAK,eAAe,UAAU,CAAC,EAAE;AAC1F"}

package/dist/canonical-json-CpvqGMcr.mjs

@@ -1,57 +0,0 @@
-import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { Crypto, Effect, Layer, PlatformError, Schema } from "effect";
-//#region src/plan/canonical-json.ts
-var canonical_json_exports = /* @__PURE__ */ __exportAll({
-	CryptoError: () => CryptoError,
-	sha256Encoded: () => sha256Encoded,
-	sha256Json: () => sha256Json,
-	sha256Text: () => sha256Text,
-	stringify: () => stringify,
-	webCryptoLayer: () => webCryptoLayer
-});
-var CryptoError = class extends Schema.TaggedError()("CryptoError", { message: Schema.String }) {};
-/** Deterministic JSON serialization for already schema-encoded protocol values. */
-function stringify(value) {
-	if (value === null || typeof value !== "object") {
-		const encoded = JSON.stringify(value);
-		if (encoded === void 0) throw new TypeError("Value is not representable as JSON");
-		return encoded;
-	}
-	if (isJsonArray(value)) return `[${value.map(stringify).join(",")}]`;
-	return `{${Object.entries(value).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, entry]) => `${JSON.stringify(key)}:${stringify(entry)}`).join(",")}}`;
-}
-function isJsonArray(value) {
-	return Array.isArray(value);
-}
-const sha256Text = Effect.fn("Digest.sha256Text")(function* (value) {
-	return [...yield* (yield* Crypto.Crypto).digest("SHA-256", new TextEncoder().encode(value)).pipe(Effect.mapError((cause) => new CryptoError({ message: cause.message })))].map((byte) => byte.toString(16).padStart(2, "0")).join("");
-});
-const sha256Json = Effect.fn("Digest.sha256Json")((value) => Effect.try({
-	try: () => stringify(value),
-	catch: (cause) => new CryptoError({ message: cause instanceof Error ? cause.message : String(cause) })
-}).pipe(Effect.flatMap(sha256Text)));
-function sha256EncodedProgram(schema, value) {
-	return Schema.encodeEffect(schema)(value).pipe(Effect.mapError((cause) => new CryptoError({ message: cause.message })), Effect.flatMap(Schema.decodeUnknownEffect(Schema.Json)), Effect.mapError((cause) => new CryptoError({ message: cause.message })), Effect.flatMap(sha256Json));
-}
-const sha256Encoded = Effect.fn("Digest.sha256Encoded")(sha256EncodedProgram);
-/** Portable Web Crypto implementation for hosts that want a ready-made Layer. */
-const webCryptoLayer = Layer.succeed(Crypto.Crypto, Crypto.make({
-	randomBytes: (size) => crypto.getRandomValues(new Uint8Array(size)),
-	digest: (algorithm, data) => Effect.tryPromise({
-		try: async () => {
-			const bytes = new Uint8Array(data.byteLength);
-			bytes.set(data);
-			return new Uint8Array(await crypto.subtle.digest(algorithm, bytes.buffer));
-		},
-		catch: (cause) => PlatformError.systemError({
-			_tag: "Unknown",
-			module: "WebCrypto",
-			method: "digest",
-			cause
-		})
-	})
-}));
-//#endregion
-export { webCryptoLayer as i, sha256Encoded as n, stringify as r, canonical_json_exports as t };
-
-//# sourceMappingURL=canonical-json-CpvqGMcr.mjs.map

package/dist/canonical-json-CpvqGMcr.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"canonical-json-CpvqGMcr.mjs","names":[],"sources":["../src/plan/canonical-json.ts"],"sourcesContent":["import { Crypto, Effect, Layer, PlatformError, Schema } from \"effect\";\n\nexport class CryptoError extends Schema.TaggedError<CryptoError>()(\"CryptoError\", {\n  message: Schema.String,\n}) {}\n\nexport type Json =\n  | null\n  | boolean\n  | number\n  | string\n  | ReadonlyArray<Json>\n  | { readonly [key: string]: Json };\n\n/** Deterministic JSON serialization for already schema-encoded protocol values. */\nexport function stringify(value: Json): string {\n  if (value === null || typeof value !== \"object\") {\n    const encoded = JSON.stringify(value);\n    if (encoded === undefined) throw new TypeError(\"Value is not representable as JSON\");\n    return encoded;\n  }\n  if (isJsonArray(value)) return `[${value.map(stringify).join(\",\")}]`;\n  return `{${Object.entries(value)\n    .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))\n    .map(([key, entry]) => `${JSON.stringify(key)}:${stringify(entry)}`)\n    .join(\",\")}}`;\n}\n\nfunction isJsonArray(value: Json): value is ReadonlyArray<Json> {\n  return Array.isArray(value);\n}\n\nexport const sha256Text = Effect.fn(\"Digest.sha256Text\")(function* (value: string) {\n  const cryptoService = yield* Crypto.Crypto;\n  const digest = yield* cryptoService\n    .digest(\"SHA-256\", new TextEncoder().encode(value))\n    .pipe(Effect.mapError((cause) => new CryptoError({ message: cause.message })));\n  return [...digest].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n});\n\nexport const sha256Json = Effect.fn(\"Digest.sha256Json\")((value: Json) =>\n  Effect.try({\n    try: () => stringify(value),\n    catch: (cause) =>\n      new CryptoError({ message: cause instanceof Error ? cause.message : String(cause) }),\n  }).pipe(Effect.flatMap(sha256Text)),\n);\n\nfunction sha256EncodedProgram<S extends Schema.Constraint>(\n  schema: S,\n  value: S[\"Type\"],\n): Effect.Effect<string, CryptoError, Crypto.Crypto | S[\"EncodingServices\"]> {\n  return Schema.encodeEffect(schema)(value).pipe(\n    Effect.mapError((cause) => new CryptoError({ message: cause.message })),\n    Effect.flatMap(Schema.decodeUnknownEffect(Schema.Json)),\n    Effect.mapError((cause) => new CryptoError({ message: cause.message })),\n    Effect.flatMap(sha256Json),\n  );\n}\n\nexport const sha256Encoded = Effect.fn(\"Digest.sha256Encoded\")(sha256EncodedProgram);\n\n/** Portable Web Crypto implementation for hosts that want a ready-made Layer. */\nexport const webCryptoLayer: Layer.Layer<Crypto.Crypto> = Layer.succeed(\n  Crypto.Crypto,\n  Crypto.make({\n    randomBytes: (size) => crypto.getRandomValues(new Uint8Array(size)),\n    digest: (algorithm, data) =>\n      Effect.tryPromise({\n        try: async () => {\n          const bytes = new Uint8Array(data.byteLength);\n          bytes.set(data);\n          return new Uint8Array(await crypto.subtle.digest(algorithm, bytes.buffer));\n        },\n        catch: (cause) =>\n          PlatformError.systemError({\n            _tag: \"Unknown\",\n            module: \"WebCrypto\",\n            method: \"digest\",\n            cause,\n          }),\n      }),\n  }),\n);\n"],"mappings":";;;;;;;;;;;AAEA,IAAa,cAAb,cAAiC,OAAO,YAAyB,CAAC,CAAC,eAAe,EAChF,SAAS,OAAO,OAClB,CAAC,CAAC,CAAC,CAAC;;AAWJ,SAAgB,UAAU,OAAqB;CAC7C,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;EAC/C,MAAM,UAAU,KAAK,UAAU,KAAK;EACpC,IAAI,YAAY,KAAA,GAAW,MAAM,IAAI,UAAU,oCAAoC;EACnF,OAAO;CACT;CACA,IAAI,YAAY,KAAK,GAAG,OAAO,IAAI,MAAM,IAAI,SAAS,CAAC,CAAC,KAAK,GAAG,EAAE;CAClE,OAAO,IAAI,OAAO,QAAQ,KAAK,CAAC,CAC7B,MAAM,CAAC,OAAO,CAAC,WAAY,OAAO,QAAQ,KAAK,OAAO,QAAQ,IAAI,CAAE,CAAC,CACrE,KAAK,CAAC,KAAK,WAAW,GAAG,KAAK,UAAU,GAAG,EAAE,GAAG,UAAU,KAAK,GAAG,CAAC,CACnE,KAAK,GAAG,EAAE;AACf;AAEA,SAAS,YAAY,OAA2C;CAC9D,OAAO,MAAM,QAAQ,KAAK;AAC5B;AAEA,MAAa,aAAa,OAAO,GAAG,mBAAmB,CAAC,CAAC,WAAW,OAAe;CAKjF,OAAO,CAAC,GAAG,QAHW,OADO,OAAO,OAAA,CAEjC,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAClD,KAAK,OAAO,UAAU,UAAU,IAAI,YAAY,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAAC,CAC9D,CAAC,CAAC,KAAK,SAAS,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;AAC9E,CAAC;AAED,MAAa,aAAa,OAAO,GAAG,mBAAmB,CAAC,EAAE,UACxD,OAAO,IAAI;CACT,WAAW,UAAU,KAAK;CAC1B,QAAQ,UACN,IAAI,YAAY,EAAE,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,CAAC;AACvF,CAAC,CAAC,CAAC,KAAK,OAAO,QAAQ,UAAU,CAAC,CACpC;AAEA,SAAS,qBACP,QACA,OAC2E;CAC3E,OAAO,OAAO,aAAa,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KACxC,OAAO,UAAU,UAAU,IAAI,YAAY,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,GACtE,OAAO,QAAQ,OAAO,oBAAoB,OAAO,IAAI,CAAC,GACtD,OAAO,UAAU,UAAU,IAAI,YAAY,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,GACtE,OAAO,QAAQ,UAAU,CAC3B;AACF;AAEA,MAAa,gBAAgB,OAAO,GAAG,sBAAsB,CAAC,CAAC,oBAAoB;;AAGnF,MAAa,iBAA6C,MAAM,QAC9D,OAAO,QACP,OAAO,KAAK;CACV,cAAc,SAAS,OAAO,gBAAgB,IAAI,WAAW,IAAI,CAAC;CAClE,SAAS,WAAW,SAClB,OAAO,WAAW;EAChB,KAAK,YAAY;GACf,MAAM,QAAQ,IAAI,WAAW,KAAK,UAAU;GAC5C,MAAM,IAAI,IAAI;GACd,OAAO,IAAI,WAAW,MAAM,OAAO,OAAO,OAAO,WAAW,MAAM,MAAM,CAAC;EAC3E;EACA,QAAQ,UACN,cAAc,YAAY;GACxB,MAAM;GACN,QAAQ;GACR,QAAQ;GACR;EACF,CAAC;CACL,CAAC;AACL,CAAC,CACH"}

package/dist/cloudflare-Bg_p-M2c.mjs

@@ -1,69 +0,0 @@
-import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { a as subjectResolver$1, c as tokenValidator$1, d as make$1, i as oauthMethod$1, n as manifest$1, o as tokenConnectionMethod$1, r as oauthFlow$1, s as tokenMethod$1 } from "./auth-B4jq3yk3.mjs";
-import { n as fromEffectFlow, r as fromEffectTokenMethod } from "./connection-X3rZhrBZ.mjs";
-import { Effect } from "effect";
-//#region src/promise/cloudflare-auth.ts
-var cloudflare_auth_exports = /* @__PURE__ */ __exportAll({
-	manifest: () => manifest,
-	oauthFlow: () => oauthFlow,
-	oauthMethod: () => oauthMethod,
-	subjectResolver: () => subjectResolver,
-	tokenConnectionMethod: () => tokenConnectionMethod,
-	tokenMethod: () => tokenMethod,
-	tokenValidator: () => tokenValidator
-});
-const manifest = manifest$1;
-const oauthMethod = oauthMethod$1;
-const tokenMethod = tokenMethod$1;
-function subjectResolver(options) {
-	const resolve = subjectResolver$1(options);
-	return (tokens, accessToken) => Effect.runPromise(resolve(tokens, accessToken));
-}
-/** Creates Cloudflare's OAuth implementation for the Promise connection facade. */
-function oauthFlow(options) {
-	return fromEffectFlow(oauthFlow$1(options));
-}
-/** Creates a Cloudflare token method for the Promise connection facade. */
-function tokenConnectionMethod(options) {
-	return fromEffectTokenMethod(tokenConnectionMethod$1(options));
-}
-function tokenValidator(options) {
-	const validate = tokenValidator$1(options);
-	return (token) => Effect.runPromise(validate(token));
-}
-//#endregion
-//#region src/promise/cloudflare.ts
-var cloudflare_exports = /* @__PURE__ */ __exportAll({
-	Auth: () => cloudflare_auth_exports,
-	discovery: () => discovery,
-	make: () => make
-});
-/** Creates a Promise-compatible facade over the Effect-native Cloudflare client. */
-function make(options) {
-	const client = make$1(options);
-	return {
-		id: client.id,
-		createRecord: (zone, record) => Effect.runPromise(client.createRecord(zone, record)),
-		deleteRecord: (zone, providerRecordId) => Effect.runPromise(client.deleteRecord(zone, providerRecordId)),
-		getRecord: (zone, providerRecordId) => Effect.runPromise(client.getRecord(zone, providerRecordId)),
-		listAccounts: () => Effect.runPromise(client.listAccounts()),
-		listRecords: (zone) => Effect.runPromise(client.listRecords(zone)),
-		listZones: (input) => Effect.runPromise(client.listZones(input)),
-		validateToken: () => Effect.runPromise(client.validateToken())
-	};
-}
-/** Creates the optional Cloudflare discovery source for Promise consumers. */
-function discovery(options) {
-	const client = make(options);
-	return {
-		listZones: async (name) => (await client.listZones({ name })).map((zone) => ({
-			...zone,
-			status: zone.status === "active" || zone.status === "pending" ? zone.status : "unknown"
-		})),
-		provider: client
-	};
-}
-//#endregion
-export { cloudflare_auth_exports as i, discovery as n, make as r, cloudflare_exports as t };
-
-//# sourceMappingURL=cloudflare-Bg_p-M2c.mjs.map

package/dist/cloudflare-Bg_p-M2c.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"cloudflare-Bg_p-M2c.mjs","names":["EffectAuth.manifest","EffectAuth.oauthMethod","EffectAuth.tokenMethod","EffectAuth.subjectResolver","Connection.fromEffectFlow","EffectAuth.oauthFlow","Connection.fromEffectTokenMethod","EffectAuth.tokenConnectionMethod","EffectAuth.tokenValidator","Cloudflare.make"],"sources":["../src/promise/cloudflare-auth.ts","../src/promise/cloudflare.ts"],"sourcesContent":["import type * as oauth from \"oauth4webapi\";\nimport { Effect } from \"effect\";\n\nimport type * as ProviderAuth from \"../auth/manifest.ts\";\nimport type * as Secret from \"../auth/secret.ts\";\nimport * as EffectAuth from \"../providers/cloudflare/auth.ts\";\nimport * as Connection from \"./connection.ts\";\n\nexport const manifest = EffectAuth.manifest;\nexport const oauthMethod = EffectAuth.oauthMethod;\nexport const tokenMethod = EffectAuth.tokenMethod;\nexport type {\n  CredentialTarget,\n  OAuthFlowOptions,\n  OAuthMethodOptions,\n  SubjectResolverOptions,\n  TokenValidatorOptions,\n} from \"../providers/cloudflare/auth.ts\";\n\nexport function subjectResolver(\n  options: EffectAuth.SubjectResolverOptions,\n): ProviderAuth.AsyncOAuthSubjectResolver {\n  const resolve = EffectAuth.subjectResolver(options);\n  return (tokens: oauth.TokenEndpointResponse, accessToken: Secret.Value) =>\n    Effect.runPromise(resolve(tokens, accessToken));\n}\n\n/** Creates Cloudflare's OAuth implementation for the Promise connection facade. */\nexport function oauthFlow(options: EffectAuth.OAuthFlowOptions): Connection.InteractiveFlow {\n  return Connection.fromEffectFlow(EffectAuth.oauthFlow(options));\n}\n\n/** Creates a Cloudflare token method for the Promise connection facade. */\nexport function tokenConnectionMethod(\n  options: EffectAuth.TokenConnectionOptions,\n): Extract<Connection.Method, { readonly _tag: \"Token\" }> {\n  return Connection.fromEffectTokenMethod(EffectAuth.tokenConnectionMethod(options));\n}\n\nexport function tokenValidator(\n  options: EffectAuth.TokenValidatorOptions,\n): (token: Secret.Value) => Promise<ProviderAuth.TokenValidation> {\n  const validate = EffectAuth.tokenValidator(options);\n  return (token) => Effect.runPromise(validate(token));\n}\n","import { Effect } from \"effect\";\n\nimport type * as ProviderAuth from \"../auth/manifest.ts\";\nimport type * as DnsProvider from \"../provider/provider.ts\";\nimport * as Cloudflare from \"../providers/cloudflare/index.ts\";\nimport type * as ZoneDiscovery from \"./zone-discovery.ts\";\n\nexport * as Auth from \"./cloudflare-auth.ts\";\nexport type {\n  Account,\n  Fetch,\n  ListZonesInput,\n  Options,\n  Zone,\n} from \"../providers/cloudflare/client.ts\";\n\nexport interface Interface extends DnsProvider.AsyncInterface {\n  readonly listAccounts: () => Promise<ReadonlyArray<Cloudflare.Account>>;\n  readonly listZones: (\n    input?: Cloudflare.Client.ListZonesInput,\n  ) => Promise<ReadonlyArray<Cloudflare.Zone>>;\n  readonly validateToken: () => Promise<ProviderAuth.TokenValidation>;\n}\n\n/** Creates a Promise-compatible facade over the Effect-native Cloudflare client. */\nexport function make(options: Cloudflare.Client.Options): Interface {\n  const client = Cloudflare.make(options);\n  return {\n    id: client.id,\n    createRecord: (zone, record) => Effect.runPromise(client.createRecord(zone, record)),\n    deleteRecord: (zone, providerRecordId) =>\n      Effect.runPromise(client.deleteRecord(zone, providerRecordId)),\n    getRecord: (zone, providerRecordId) =>\n      Effect.runPromise(client.getRecord(zone, providerRecordId)),\n    listAccounts: () => Effect.runPromise(client.listAccounts()),\n    listRecords: (zone) => Effect.runPromise(client.listRecords(zone)),\n    listZones: (input) => Effect.runPromise(client.listZones(input)),\n    validateToken: () => Effect.runPromise(client.validateToken()),\n  };\n}\n\n/** Creates the optional Cloudflare discovery source for Promise consumers. */\nexport function discovery(options: Cloudflare.Client.Options): ZoneDiscovery.Source {\n  const client = make(options);\n  return {\n    listZones: async (name) =>\n      (await client.listZones({ name })).map((zone) => ({\n        ...zone,\n        status: zone.status === \"active\" || zone.status === \"pending\" ? zone.status : \"unknown\",\n      })),\n    provider: client,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;AAQA,MAAa,WAAWA;AACxB,MAAa,cAAcC;AAC3B,MAAa,cAAcC;AAS3B,SAAgB,gBACd,SACwC;CACxC,MAAM,UAAUC,kBAA2B,OAAO;CAClD,QAAQ,QAAqC,gBAC3C,OAAO,WAAW,QAAQ,QAAQ,WAAW,CAAC;AAClD;;AAGA,SAAgB,UAAU,SAAkE;CAC1F,OAAOC,eAA0BC,YAAqB,OAAO,CAAC;AAChE;;AAGA,SAAgB,sBACd,SACwD;CACxD,OAAOC,sBAAiCC,wBAAiC,OAAO,CAAC;AACnF;AAEA,SAAgB,eACd,SACgE;CAChE,MAAM,WAAWC,iBAA0B,OAAO;CAClD,QAAQ,UAAU,OAAO,WAAW,SAAS,KAAK,CAAC;AACrD;;;;;;;;;ACnBA,SAAgB,KAAK,SAA+C;CAClE,MAAM,SAASC,OAAgB,OAAO;CACtC,OAAO;EACL,IAAI,OAAO;EACX,eAAe,MAAM,WAAW,OAAO,WAAW,OAAO,aAAa,MAAM,MAAM,CAAC;EACnF,eAAe,MAAM,qBACnB,OAAO,WAAW,OAAO,aAAa,MAAM,gBAAgB,CAAC;EAC/D,YAAY,MAAM,qBAChB,OAAO,WAAW,OAAO,UAAU,MAAM,gBAAgB,CAAC;EAC5D,oBAAoB,OAAO,WAAW,OAAO,aAAa,CAAC;EAC3D,cAAc,SAAS,OAAO,WAAW,OAAO,YAAY,IAAI,CAAC;EACjE,YAAY,UAAU,OAAO,WAAW,OAAO,UAAU,KAAK,CAAC;EAC/D,qBAAqB,OAAO,WAAW,OAAO,cAAc,CAAC;CAC/D;AACF;;AAGA,SAAgB,UAAU,SAA0D;CAClF,MAAM,SAAS,KAAK,OAAO;CAC3B,OAAO;EACL,WAAW,OAAO,UACf,MAAM,OAAO,UAAU,EAAE,KAAK,CAAC,EAAA,CAAG,KAAK,UAAU;GAChD,GAAG;GACH,QAAQ,KAAK,WAAW,YAAY,KAAK,WAAW,YAAY,KAAK,SAAS;EAChF,EAAE;EACJ,UAAU;CACZ;AACF"}