domainkit 0.4.0 → 0.6.0

package/dist/{verify-CkgVrwyl.d.mts → verify-yAy-r9no.d.mts}

@@ -1,9 +1,7 @@
-import { $ as InteractiveFlow, At as coversDomain, Bt as ProviderAuthorization, Ct as Connection, Dn as DomainName, Dt as StoredCredential, Et as Schema$1, Ft as validate, G as AuthenticationFailure, Gt as IntegrationMethod, H as Source, It as Capability, J as Continuation, Jt as OAuthClientConfiguration, K as BaseInput, Kt as Manifest, Mt as encode, Nt as includeDomains, Ot as assertGrant, Pt as removeDomain$1, Q as Failure, Qt as TokenValidation, St as AuthorizationError, Tn as Value, W as Authentication, X as Error, Xt as OAuthSubjectResolver, Y as ContinuationStore, Yt as OAuthMethod, Z as ExtendInput, a as Interface$4, at as StartResult, c as Service$1, ct as removeDomain, dt as Envelope, et as InteractiveStart, i as Error$3, in as Service$2, it as Requirements, jn as Error$2, jt as decode, kt as authorizationError, lt as start, n as AsyncInterface, nn as Error$1, nt as RemoveDomainInput, o as Query, ot as complete, q as CompleteInput, rn as Interface$3, rt as RemoveDomainResult, st as extend, t as Answer, tt as Method, un as DnsRecord, ut as Codec, wt as Grant } from "./resolver-uqe1h5Vz.mjs";
+import { H as Capability, J as Manifest, M as ProviderConnection, N as ProviderTarget, Nt as Error$1, Q as OAuthSubjectResolver, W as ProviderAuthorization, X as OAuthClientConfiguration, Z as OAuthMethod, ct as Service$1, d as Method, et as TokenValidation, g as Envelope, h as Codec, it as AsyncInterface$1, j as DomainAttachment, kt as DomainName, l as InteractiveFlow, mt as DnsRecord, nt as Value, ot as Error, q as IntegrationMethod, s as Error$2, st as Interface$4 } from "./connect-Db830jad.mjs";
+import { H as Source, a as Interface$5, c as Service$2, i as Error$3, n as AsyncInterface$2, o as Query, t as Answer } from "./resolver-DUAIlm2I.mjs";
 import { Context, Data, Effect, Layer, Schema } from "effect";
 import * as oauth from "oauth4webapi";
-declare namespace connection_api_d_exports {
-  export { Authentication, AuthenticationFailure, AuthorizationError, BaseInput, CompleteInput, Connection, Method as ConnectionMethod, RemoveDomainResult as ConnectionRemoveDomainResult, StartResult as ConnectionStartResult, Continuation, ContinuationStore, Error, ExtendInput, Failure, Grant, InteractiveFlow, InteractiveStart, Method, RemoveDomainInput, RemoveDomainResult, Requirements, Schema$1 as Schema, StartResult, StoredCredential, assertGrant, authorizationError, complete, coversDomain, decode, encode, extend, includeDomains, removeDomain, removeDomain$1 as removeDomainFromGrant, start, validate };
-}
 declare namespace diagnostic_d_exports {
   export { Category, Diagnostic, Fields, RetryAdvice, from };
 }
@@ -36,10 +34,9 @@ declare namespace selection_d_exports {
 }
 interface ConnectedZone {
   readonly authorization: ProviderAuthorization;
-  readonly connection: Connection;
+  readonly attachment: DomainAttachment;
+  readonly connection: ProviderConnection;
   readonly nameservers: ReadonlyArray<string>;
-  readonly providerId: string;
-  readonly zone: string;
 }
 declare const Evidence$1: Schema.Struct<{
   readonly accountId: Schema.String;
@@ -98,6 +95,135 @@ declare namespace zones_d_exports {
   export { candidates };
 }
 declare function candidates(input: string): ReadonlyArray<DomainName>;
+declare namespace session_d_exports {
+  export { AsyncInterface, Authorization, Credential, Interface$3 as Interface, ListTargetsInput, Resolution, RestoreInput, fromAsync, toAsync$3 as toAsync };
+}
+/** A credential-scoped provider session that discovers safe targets before DNS access. */
+interface Interface$3 {
+  /** The provider represented by this credential. */
+  readonly providerId: string;
+  /** Lists provider account and authoritative-zone targets visible to this credential. */
+  readonly listTargets: (input?: ListTargetsInput) => Effect.Effect<ReadonlyArray<ProviderTarget>, Error>;
+  /** Resolves a domain without guessing when more than one account owns a matching zone. */
+  readonly resolveTarget: (domain: DomainName) => Effect.Effect<Resolution, Error>;
+  /** Creates the focused DNS-record capability bound to one exact discovered target. */
+  readonly forTarget: (target: ProviderTarget) => Effect.Effect<Interface$4, Error>;
+}
+interface ListTargetsInput {
+  /** Restrict results to the authoritative zone candidates for this domain. */
+  readonly domain?: DomainName;
+  /** Provider-specific account filter, when supported by the adapter. */
+  readonly accountId?: string;
+}
+type Resolution = Data.TaggedEnum<{
+  NotFound: {
+    readonly domain: DomainName;
+  };
+  Resolved: {
+    readonly target: ProviderTarget;
+  };
+  SelectionRequired: {
+    readonly candidates: ReadonlyArray<ProviderTarget>;
+  };
+}>;
+declare const Resolution: {
+  readonly $is: <Tag extends "NotFound" | "Resolved" | "SelectionRequired">(tag: Tag) => (u: unknown) => u is Extract<{
+    readonly _tag: "NotFound";
+    readonly domain: DomainName;
+  }, {
+    readonly _tag: Tag;
+  }> | Extract<{
+    readonly _tag: "Resolved";
+    readonly target: ProviderTarget;
+  }, {
+    readonly _tag: Tag;
+  }> | Extract<{
+    readonly _tag: "SelectionRequired";
+    readonly candidates: ReadonlyArray<ProviderTarget>;
+  }, {
+    readonly _tag: Tag;
+  }>;
+  readonly $match: {
+    <Cases extends { readonly [Tag in "NotFound" | "Resolved" | "SelectionRequired"]: (args: Extract<{
+      readonly _tag: "NotFound";
+      readonly domain: DomainName;
+    } | {
+      readonly _tag: "Resolved";
+      readonly target: ProviderTarget;
+    } | {
+      readonly _tag: "SelectionRequired";
+      readonly candidates: ReadonlyArray<ProviderTarget>;
+    }, {
+      readonly _tag: Tag;
+    }>) => any; }>(cases: Cases): (value: {
+      readonly _tag: "NotFound";
+      readonly domain: DomainName;
+    } | {
+      readonly _tag: "Resolved";
+      readonly target: ProviderTarget;
+    } | {
+      readonly _tag: "SelectionRequired";
+      readonly candidates: ReadonlyArray<ProviderTarget>;
+    }) => import("effect/Unify").Unify<ReturnType<Cases["NotFound" | "Resolved" | "SelectionRequired"]>>;
+    <Cases extends { readonly [Tag in "NotFound" | "Resolved" | "SelectionRequired"]: (args: Extract<{
+      readonly _tag: "NotFound";
+      readonly domain: DomainName;
+    } | {
+      readonly _tag: "Resolved";
+      readonly target: ProviderTarget;
+    } | {
+      readonly _tag: "SelectionRequired";
+      readonly candidates: ReadonlyArray<ProviderTarget>;
+    }, {
+      readonly _tag: Tag;
+    }>) => any; }>(value: {
+      readonly _tag: "NotFound";
+      readonly domain: DomainName;
+    } | {
+      readonly _tag: "Resolved";
+      readonly target: ProviderTarget;
+    } | {
+      readonly _tag: "SelectionRequired";
+      readonly candidates: ReadonlyArray<ProviderTarget>;
+    }, cases: Cases): import("effect/Unify").Unify<ReturnType<Cases["NotFound" | "Resolved" | "SelectionRequired"]>>;
+  };
+  readonly NotFound: Data.TaggedEnum.ConstructorFrom<{
+    readonly _tag: "NotFound";
+    readonly domain: DomainName;
+  }, "_tag">;
+  readonly Resolved: Data.TaggedEnum.ConstructorFrom<{
+    readonly _tag: "Resolved";
+    readonly target: ProviderTarget;
+  }, "_tag">;
+  readonly SelectionRequired: Data.TaggedEnum.ConstructorFrom<{
+    readonly _tag: "SelectionRequired";
+    readonly candidates: ReadonlyArray<ProviderTarget>;
+  }, "_tag">;
+};
+/** The credential material a provider adapter needs to restore a session. */
+interface Credential {
+  readonly accessToken: Value;
+  readonly expiresAt: Date | null;
+  readonly refreshToken: Value | null;
+  readonly tokenType: string;
+}
+/** The non-secret authorization projection required when restoring a provider session. */
+type Authorization = Pick<ProviderAuthorization, "capabilityEvidence" | "method" | "providerContext" | "providerId" | "requiredCapabilities" | "revocation">;
+interface RestoreInput {
+  readonly authorization: Authorization;
+  readonly credential: Credential;
+}
+/** Minimal Promise-shaped provider-session contract for hosts that do not use Effect directly. */
+interface AsyncInterface {
+  readonly providerId: string;
+  readonly listTargets: (input?: ListTargetsInput) => Promise<ReadonlyArray<ProviderTarget>>;
+  readonly resolveTarget: (domain: DomainName) => Promise<Resolution>;
+  readonly forTarget: (target: ProviderTarget) => Promise<AsyncInterface$1>;
+}
+/** Adapts a Promise-shaped session to the Effect-native session boundary. */
+declare const fromAsync: (session: AsyncInterface) => Interface$3;
+/** Adapts an Effect-native session to the Promise facade. */
+declare const toAsync$3: (session: Interface$3) => AsyncInterface;
 //#endregion
 //#region src/providers/cloudflare/protocol.d.ts
 declare const Account$2: Schema.Struct<{
@@ -111,7 +237,8 @@ declare namespace client_d_exports$1 {
 type Fetch$2 = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
 /** Configuration for an Effect-native Cloudflare authoritative-DNS client. */
 interface Options$4 {
-  readonly accountId: string;
+  /** Account scope for account tokens; omit for user or OAuth credentials. */
+  readonly accountId?: string;
   readonly baseUrl?: string;
   /** Capabilities the host required when issuing or authorizing this credential. */
   readonly capabilities: TokenValidation["capabilities"];
@@ -132,10 +259,14 @@ interface Zone$1 {
   readonly nameservers: ReadonlyArray<DomainName>;
   readonly status: string | null;
 }
-interface Interface$2 extends Interface$3 {
-  readonly listAccounts: () => Effect.Effect<ReadonlyArray<Account$1>, Error$1>;
-  readonly listZones: (input?: ListZonesInput$1) => Effect.Effect<ReadonlyArray<Zone$1>, Error$1>;
-  readonly validateToken: () => Effect.Effect<TokenValidation, Error$1>;
+interface Interface$2 extends Interface$4 {
+  readonly providerId: "cloudflare";
+  readonly forTarget: (target: ProviderTarget) => Effect.Effect<Interface$4, Error>;
+  readonly listAccounts: () => Effect.Effect<ReadonlyArray<Account$1>, Error>;
+  readonly listZones: (input?: ListZonesInput$1) => Effect.Effect<ReadonlyArray<Zone$1>, Error>;
+  readonly listTargets: (input?: ListTargetsInput) => Effect.Effect<ReadonlyArray<ProviderTarget>, Error>;
+  readonly resolveTarget: (domain: DomainName) => Effect.Effect<Resolution, Error>;
+  readonly validateToken: () => Effect.Effect<TokenValidation, Error>;
 }
 /** Exposes Cloudflare zone lookup as the optional provider discovery capability. */
 declare function discovery$1(client: Interface$2): Source;
@@ -154,23 +285,25 @@ declare const discoverAuthorizationAccount: (options: CredentialOptions$1 & {
 }) => Effect.Effect<{
   readonly id: string;
   readonly name: string;
-}, Error$1, never>;
+}, Error, never>;
 declare const validateDomainToken: (options: DomainCredentialOptions) => Effect.Effect<{
   accountId: string;
   capabilities: readonly ("dns:read" | "dns:write")[];
   expiresAt: Date | null;
   scopes: never[];
-}, Error$1, never>;
+}, Error, never>;
 /** Creates an Effect-native Cloudflare client without owning the credential lifecycle. */
 declare function make$5(options: Options$4): Interface$2;
 declare namespace auth_d_exports$1 {
-  export { Context$2 as Context, CredentialTarget, OAuthFlowOptions, OAuthMethodOptions, SubjectResolverOptions, TokenConnectionOptions$1 as TokenConnectionOptions, TokenValidatorOptions, contextCodec$1 as contextCodec, manifest$1 as manifest, oauthAuthentication, oauthFlow, oauthMethod, subjectResolver, tokenConnectionMethod$1 as tokenConnectionMethod, tokenMethod$1 as tokenMethod, tokenValidator };
+  export { Context$2 as Context, CredentialTarget, OAuthFlowOptions, OAuthMethodOptions, RefreshCredentialOptions, SubjectResolverOptions, TokenConnectionOptions$1 as TokenConnectionOptions, TokenValidatorOptions, contextCodec$1 as contextCodec, manifest$1 as manifest, oauthAuthentication, oauthFlow, oauthMethod, refreshCredential, restore$1 as restore, subjectResolver, tokenConnectionMethod$1 as tokenConnectionMethod, tokenMethod$1 as tokenMethod, tokenValidator };
 }
 declare const Context$2: Schema.Struct<{
+  readonly accountId: Schema.optionalKey<Schema.String>;
   readonly tokenKind: Schema.Literals<readonly ["account", "user"]>;
 }>;
 type Context$2 = typeof Context$2.Type;
 declare const contextCodec$1: Codec<{
+  readonly accountId?: string;
   readonly tokenKind: "account" | "user";
 }>;
 /** Describes Cloudflare's caller-created API-token authorization method. */
@@ -208,7 +341,7 @@ type TokenValidatorOptions = CredentialOptions & ({
   readonly domain: DomainName;
   readonly tokenKind?: "account" | "user";
 });
-/** Resolves the Cloudflare account selected by a completed OAuth grant. */
+/** Resolves the Cloudflare account selected by a completed OAuth authorization. */
 declare function subjectResolver(options: SubjectResolverOptions): OAuthSubjectResolver;
 /** Creates a host callback that validates a Cloudflare API token. */
 declare function tokenValidator(options: TokenValidatorOptions): (token: Value) => ReturnType<Interface$2["validateToken"]>;
@@ -219,7 +352,7 @@ type TokenConnectionOptions$1 = TokenValidatorOptions & {
 declare function tokenConnectionMethod$1(options: TokenConnectionOptions$1): Extract<Method, {
   readonly _tag: "Token";
 }>;
-/** Converts a completed Cloudflare OAuth grant into the canonical connection authentication. */
+/** Converts a completed Cloudflare OAuth authorization into canonical connection authentication. */
 declare const oauthAuthentication: (options: SubjectResolverOptions & {
   readonly accessToken: Value;
   readonly tokens: oauth.TokenEndpointResponse;
@@ -233,14 +366,29 @@ declare const oauthAuthentication: (options: SubjectResolverOptions & {
   }[];
   credential: {
     accessToken: Value;
+    expiresAt: Date | null;
     refreshToken: Value | null;
     tokenType: Lowercase<string>;
   };
-  expiresAt: Date | null;
   providerAccountId: string;
   providerContext: Envelope;
   scopes: string[];
-}, Error$2 | Error$1, never>;
+}, Error$1 | Error, never>;
+/** Restore a credential-scoped Cloudflare session from persisted authorization state. */
+declare function restore$1(options: RestoreInput & Pick<Options$4, "baseUrl" | "fetch">): Effect.Effect<Interface$2, Error>;
+interface RefreshCredentialOptions {
+  readonly client: OAuthClientConfiguration;
+  readonly clientAuth: OAuthMethod["clientAuth"];
+  readonly credential: Credential;
+  readonly fetch?: Fetch$2;
+}
+/** Exchanges a Cloudflare refresh token for a fresh provider credential. */
+declare const refreshCredential: (options: RefreshCredentialOptions) => Effect.Effect<{
+  accessToken: Value;
+  expiresAt: Date | null;
+  refreshToken: Value;
+  tokenType: Lowercase<string>;
+}, Error | Error$2, never>;
 type OAuthFlowOptions = SubjectResolverOptions & {
   readonly client: OAuthClientConfiguration;
   readonly clientAuth: OAuthMethod["clientAuth"];
@@ -289,17 +437,21 @@ interface Zone {
   readonly nameservers: ReadonlyArray<DomainName>;
   readonly status: "active" | "pending";
 }
-interface Interface$1 extends Interface$3 {
-  readonly listAccounts: () => Effect.Effect<ReadonlyArray<Account>, Error$1>;
-  readonly listZones: (input?: ListZonesInput) => Effect.Effect<ReadonlyArray<Zone>, Error$1>;
-  readonly validateToken: () => Effect.Effect<TokenValidation, Error$1>;
+interface Interface$1 extends Interface$4 {
+  readonly providerId: "vercel";
+  readonly forTarget: (target: ProviderTarget) => Effect.Effect<Interface$4, Error>;
+  readonly listAccounts: () => Effect.Effect<ReadonlyArray<Account>, Error>;
+  readonly listZones: (input?: ListZonesInput) => Effect.Effect<ReadonlyArray<Zone>, Error>;
+  readonly listTargets: (input?: ListTargetsInput) => Effect.Effect<ReadonlyArray<ProviderTarget>, Error>;
+  readonly resolveTarget: (domain: DomainName) => Effect.Effect<Resolution, Error>;
+  readonly validateToken: () => Effect.Effect<TokenValidation, Error>;
 }
 /** Exposes Vercel zone lookup as the optional provider discovery capability. */
 declare function discovery(client: Interface$1): Source;
 /** Creates an Effect-native Vercel client without owning the credential lifecycle. */
 declare function make$4(options: Options$3): Interface$1;
 declare namespace auth_d_exports {
-  export { Context$1 as Context, ExchangeCodeOptions, IntegrationCredential, IntegrationFlowOptions, IntegrationMethodOptions, TokenConnectionOptions, contextCodec, exchangeCode, integrationAuthentication, integrationFlow, integrationMethod, manifest, tokenConnectionMethod, tokenMethod };
+  export { Context$1 as Context, ExchangeCodeOptions, IntegrationCredential, IntegrationFlowOptions, IntegrationMethodOptions, TokenConnectionOptions, contextCodec, exchangeCode, integrationAuthentication, integrationFlow, integrationMethod, manifest, restore, tokenConnectionMethod, tokenMethod };
 }
 declare const Context$1: Schema.TaggedUnion<{
   readonly personal: Schema.TaggedStruct<"personal", {
@@ -336,6 +488,8 @@ interface ExchangeCodeOptions {
   readonly clientId: string;
   readonly clientSecret: Value;
   readonly code: Value;
+  /** Configuration ID returned by Vercel's integration callback, when available. */
+  readonly configurationId?: string;
   readonly fetch?: Fetch$1;
   readonly redirectUri: string;
 }
@@ -357,7 +511,7 @@ declare const exchangeCode: (options: ExchangeCodeOptions) => Effect.Effect<{
   };
   installationId: string | null;
   userId: string;
-}, Error$1, never>;
+}, Error, never>;
 interface TokenConnectionOptions extends Omit<Options$3, "token"> {
   readonly token: Value;
 }
@@ -378,14 +532,16 @@ declare const integrationAuthentication: (options: ExchangeCodeOptions & {
   }[];
   credential: {
     accessToken: Value;
+    expiresAt: null;
     refreshToken: null;
     tokenType: string;
   };
-  expiresAt: null;
   providerAccountId: string;
   providerContext: Envelope;
   scopes: never[];
-}, Error$2 | Error$1, never>;
+}, Error$1 | Error, never>;
+/** Restore a credential-scoped Vercel session from persisted authorization state. */
+declare function restore(options: RestoreInput & Pick<Options$3, "baseUrl" | "fetch">): Effect.Effect<Interface$1, Error>;
 interface IntegrationFlowOptions extends Omit<ExchangeCodeOptions, "code">, IntegrationMethodOptions {}
 /** Creates Vercel Integration's implementation of the common interactive connection capability. */
 declare function integrationFlow(options: IntegrationFlowOptions): InteractiveFlow;
@@ -401,33 +557,33 @@ interface Options$2 {
   readonly fetch?: Fetch;
   readonly timeoutMs?: number;
 }
-declare function make$3(options: Options$2): Interface$4;
-declare const layer$2: (options: Options$2) => Layer.Layer<Service$1>;
-declare const toAsync$2: (options: Options$2) => AsyncInterface;
+declare function make$3(options: Options$2): Interface$5;
+declare const layer$2: (options: Options$2) => Layer.Layer<Service$2>;
+declare const toAsync$2: (options: Options$2) => AsyncInterface$2;
 declare namespace cloudflare_doh_d_exports {
   export { Options$1 as Options, layer$1 as layer, make$2 as make, toAsync$1 as toAsync };
 }
 interface Options$1 extends Omit<Options$2, "endpoint"> {
   readonly endpoint?: string;
 }
-declare function make$2(options?: Options$1): Interface$4;
-declare const layer$1: (options?: Options$1) => Layer.Layer<Service$1>;
-declare const toAsync$1: (options?: Options$1) => AsyncInterface;
+declare function make$2(options?: Options$1): Interface$5;
+declare const layer$1: (options?: Options$1) => Layer.Layer<Service$2>;
+declare const toAsync$1: (options?: Options$1) => AsyncInterface$2;
 declare namespace google_doh_d_exports {
   export { Options, layer, make$1 as make, toAsync };
 }
 interface Options extends Omit<Options$2, "endpoint"> {
   readonly endpoint?: string;
 }
-declare function make$1(options?: Options): Interface$4;
-declare const layer: (options?: Options) => Layer.Layer<Service$1>;
-declare const toAsync: (options?: Options) => AsyncInterface;
+declare function make$1(options?: Options): Interface$5;
+declare const layer: (options?: Options) => Layer.Layer<Service$2>;
+declare const toAsync: (options?: Options) => AsyncInterface$2;
 declare namespace resolver_pool_d_exports {
   export { DefaultOptions, Entry, Interface, Observation, Policy, Service, defaultLayer, defaultMake, make };
 }
 interface Entry {
   readonly id: string;
-  readonly resolver: Interface$4;
+  readonly resolver: Interface$5;
   readonly timeoutMs?: number;
 }
 type Observation = Data.TaggedEnum<{
@@ -1094,9 +1250,9 @@ declare const Result: {
     readonly publicDns: PublicDnsObservation | null;
   }, "_tag">;
 };
-declare function observe(input: PublicOnlyConfig): Effect.Effect<Result, Error$2>;
-declare function observe(input: ProviderConfig): Effect.Effect<Result, Error$2, Service$2>;
-declare function observe(input: Config): Effect.Effect<Result, Error$2, Service$2>;
+declare function observe(input: PublicOnlyConfig): Effect.Effect<Result, Error$1>;
+declare function observe(input: ProviderConfig): Effect.Effect<Result, Error$1, Service$1>;
+declare function observe(input: Config): Effect.Effect<Result, Error$1, Service$1>;
 //#endregion
-export { Zone as A, tokenMethod$1 as B, manifest as C, Fetch$1 as D, AccountContext as E, SubjectResolverOptions as F, Zone$1 as G, Fetch$2 as H, TokenConnectionOptions$1 as I, diagnostic_d_exports as J, zones_d_exports as K, TokenValidatorOptions as L, CredentialTarget as M, OAuthFlowOptions as N, ListZonesInput as O, OAuthMethodOptions as P, manifest$1 as R, integrationMethod as S, Account as T, ListZonesInput$1 as U, Account$1 as V, Options$4 as W, connection_api_d_exports as Y, ExchangeCodeOptions as _, verify_d_exports as a, IntegrationMethodOptions as b, Policy as c, google_doh_d_exports as d, Options$1 as f, index_d_exports as g, doh_d_exports as h, Result as i, index_d_exports$1 as j, Options$3 as k, resolver_pool_d_exports as l, Options$2 as m, PublicDns as n, DefaultOptions as o, cloudflare_doh_d_exports as p, selection_d_exports as q, PublicDnsObservation as r, Observation as s, ProviderObservation as t, Options as u, IntegrationCredential as v, tokenMethod as w, TokenConnectionOptions as x, IntegrationFlowOptions as y, oauthMethod as z };
-//# sourceMappingURL=verify-CkgVrwyl.d.mts.map
+export { RestoreInput as $, Options$3 as A, manifest$1 as B, manifest as C, Fetch$1 as D, AccountContext as E, OAuthMethodOptions as F, Interface$2 as G, tokenMethod$1 as H, RefreshCredentialOptions as I, Zone$1 as J, ListZonesInput$1 as K, SubjectResolverOptions as L, index_d_exports$1 as M, CredentialTarget as N, Interface$1 as O, OAuthFlowOptions as P, Resolution as Q, TokenConnectionOptions$1 as R, integrationMethod as S, Account as T, Account$1 as U, oauthMethod as V, Fetch$2 as W, Interface$3 as X, Credential as Y, ListTargetsInput as Z, ExchangeCodeOptions as _, verify_d_exports as a, IntegrationMethodOptions as b, Policy as c, google_doh_d_exports as d, session_d_exports as et, Options$1 as f, index_d_exports as g, doh_d_exports as h, Result as i, Zone as j, ListZonesInput as k, resolver_pool_d_exports as l, Options$2 as m, PublicDns as n, selection_d_exports as nt, DefaultOptions as o, cloudflare_doh_d_exports as p, Options$4 as q, PublicDnsObservation as r, diagnostic_d_exports as rt, Observation as s, ProviderObservation as t, zones_d_exports as tt, Options as u, IntegrationCredential as v, tokenMethod as w, TokenConnectionOptions as x, IntegrationFlowOptions as y, TokenValidatorOptions as z };
+//# sourceMappingURL=verify-yAy-r9no.d.mts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domainkit",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Provider-independent DNS provisioning plans and authorization for TypeScript",
   "keywords": [
     "dns",
@@ -35,6 +35,10 @@
       "types": "./dist/promise.d.mts",
       "import": "./dist/promise.mjs"
     },
+    "./server": {
+      "types": "./dist/server.d.mts",
+      "import": "./dist/server.mjs"
+    },
     "./testing": {
       "types": "./dist/testing.d.mts",
       "import": "./dist/testing.mjs"

package/dist/resolver-CvK7JoJM.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolver-CvK7JoJM.mjs","names":["Error","Type","S","Schema","decode","InvalidInputError","parse","Error","Service","DomainName.parse","InvalidInputError","Domain.Schema","Service","Zones.candidates","S","DomainName.Schema","Schema","decode","InvalidInputError","Error","Service","layerFromAsync","toAsync","Operation","S","DnsRecord.Schema","DnsRecord.Observed","Schema","DomainName.Schema","Authorization","Receipt","InvalidInputError","UnsignedPlan","S","DnsPlan.Operation","DomainName.Schema","DnsRecord.Schema","DnsPlan.Receipt","create","DnsProvider.Service","DomainName.decode","ZoneDiscovery.Service","DnsRecord.decode","authorize","validate","apply","makeReceipt","data","DnsRecord.data","DnsRecord.equals","DnsRecord.Observed","S","DnsRecord.Schema","DomainName.Schema","Error","DnsProvider.Service","Provisioning.validate","DnsRecord.equals","DomainName.Schema","DnsRecord.Type","Error"],"sources":["../src/invalid-input.ts","../src/domain/domain-name.ts","../src/auth/lifecycle-repository.ts","../src/discovery/zones.ts","../src/discovery/zone-discovery.ts","../src/domain/dns-record.ts","../src/provider/provider.ts","../src/plan/canonical-json.ts","../src/plan/types.ts","../src/plan/plan.ts","../src/plan/deletion.ts","../src/verification/resolver.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nexport class Error extends Schema.TaggedError<Error>()(\"InvalidInputError\", {\n  message: Schema.String,\n}) {}\n","import { Effect, Schema as S, SchemaIssue, SchemaTransformation } from \"effect\";\n\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\n\nconst labelPattern = /^[a-z0-9_](?:[a-z0-9_-]{0,61}[a-z0-9_])?$/;\n\nconst Type = S.String.check(\n  S.makeFilter<string>(\n    (value) =>\n      value.length <= 253 &&\n      value.includes(\".\") &&\n      value.split(\".\").every((label) => labelPattern.test(label))\n        ? undefined\n        : \"Expected a fully qualified DNS name\",\n    { identifier: \"DomainName\" },\n  ),\n).pipe(S.brand(\"DomainName\"));\n\n/** A lower-case, fully qualified DNS name without a trailing dot. */\nexport type DomainName = typeof Type.Type;\n\n/** Decodes user and wire strings into canonical domain names. */\nexport const Schema = S.String.pipe(\n  S.decodeTo(\n    Type,\n    SchemaTransformation.transformOrFail({\n      decode: (input, options) =>\n        Effect.try({\n          try: () => normalize(input),\n          catch: (cause) =>\n            new SchemaIssue.InvalidValue(\n              { message: cause instanceof Error ? cause.message : String(cause) },\n              input,\n              options,\n            ),\n        }),\n      encode: (domain) => Effect.succeed(domain),\n    }),\n  ),\n);\n\nexport const decode = Effect.fn(\"DomainName.decode\")((input: unknown) =>\n  S.decodeUnknownEffect(Schema)(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport function parse(input: unknown): DomainName {\n  try {\n    return S.decodeUnknownSync(Schema)(input);\n  } catch (cause) {\n    throw new InvalidInputError({\n      message: cause instanceof Error ? cause.message : String(cause),\n    });\n  }\n}\n\nfunction normalize(input: string): string {\n  const labels = input\n    .trim()\n    .replace(/\\.+$/, \"\")\n    .split(\".\")\n    .map((label) => {\n      if (label.includes(\"_\") || [...label].every((character) => character.charCodeAt(0) <= 127)) {\n        return label.toLowerCase();\n      }\n      const hostname = new URL(`http://${label}.example`).hostname;\n      const normalized = hostname.split(\".\")[0];\n      if (normalized === undefined) throw new Error(\"Domain label could not be normalized\");\n      return normalized.toLowerCase();\n    });\n  return labels.join(\".\");\n}\n","import { Context, Effect, Schema } from \"effect\";\n\nimport type * as ProviderAuthorization from \"./authorization.ts\";\nimport type * as Connection from \"./connection.ts\";\n\nexport interface Aggregate {\n  readonly authorization: ProviderAuthorization.ProviderAuthorization;\n  readonly bindings: ReadonlyArray<Connection.Connection>;\n  readonly credential: Connection.StoredCredential;\n}\n\nexport interface DetachResult {\n  readonly authorizationId: string;\n  readonly remainingBindings: number;\n  readonly revokedAuthorization: boolean;\n}\n\nexport interface BindingModification<A> {\n  readonly aggregate: Aggregate;\n  readonly value: A;\n}\n\nexport class Error extends Schema.TaggedError<Error>()(\"LifecycleRepositoryError\", {\n  category: Schema.Literal(\"storage\"),\n  message: Schema.String,\n  operation: Schema.String,\n  retry: Schema.Literals([\"never\", \"after-user-action\", \"safe\", \"unknown\"]),\n}) {}\n\nexport interface Interface {\n  readonly bind: (\n    authorizationId: string,\n    binding: Connection.Connection,\n  ) => Effect.Effect<Aggregate, Error>;\n  readonly connect: (aggregate: Aggregate) => Effect.Effect<Aggregate, Error>;\n  readonly detach: <E>(input: {\n    readonly connectionId: string;\n    readonly revoke: (aggregate: Aggregate) => Effect.Effect<void, E>;\n  }) => Effect.Effect<DetachResult, Error | E>;\n  readonly findByProviderAccount: (\n    providerId: string,\n    providerAccountId: string,\n  ) => Effect.Effect<Aggregate | null, Error>;\n  readonly get: (authorizationId: string) => Effect.Effect<Aggregate | null, Error>;\n  readonly getByConnectionId: (connectionId: string) => Effect.Effect<Aggregate | null, Error>;\n  readonly modifyBinding: <A>(\n    connectionId: string,\n    modify: (binding: Connection.Connection) => {\n      readonly binding: Connection.Connection;\n      readonly value: A;\n    },\n  ) => Effect.Effect<BindingModification<A>, Error>;\n  readonly promoteEvidence: (\n    authorizationId: string,\n    evidence: ReadonlyArray<ProviderAuthorization.CapabilityEvidence>,\n  ) => Effect.Effect<Aggregate, Error>;\n  readonly recover: <E>(input: {\n    readonly authorizationId: string;\n    readonly revoke: (aggregate: Aggregate) => Effect.Effect<void, E>;\n  }) => Effect.Effect<DetachResult, Error | E>;\n  readonly rotate: (\n    authorizationId: string,\n    credential: Connection.StoredCredential,\n    expiresAt: Date | null,\n  ) => Effect.Effect<Aggregate, Error>;\n}\n\nexport class Service extends Context.Service<Service, Interface>()(\n  \"@domainkit/AuthorizationLifecycleRepository\",\n) {}\n","import { getDomain } from \"tldts\";\n\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\n\nexport function candidates(input: string): ReadonlyArray<DomainName.DomainName> {\n  const domain = DomainName.parse(input);\n  const registrable = getDomain(domain, { allowPrivateDomains: true });\n  if (registrable === null) {\n    throw new InvalidInputError({ message: \"Domain does not have a registrable DNS zone\" });\n  }\n  const labels = domain.split(\".\");\n  const registrableLabels = registrable.split(\".\").length;\n  const values: Array<DomainName.DomainName> = [];\n  for (let index = 0; index <= labels.length - registrableLabels; index += 1) {\n    values.push(DomainName.parse(labels.slice(index).join(\".\")));\n  }\n  return values;\n}\n","import { Context, Data, Effect, Schema } from \"effect\";\n\nimport type * as DomainName from \"../domain/domain-name.ts\";\nimport * as Domain from \"../domain/domain-name.ts\";\nimport * as DnsProvider from \"../provider/provider.ts\";\nimport * as Zones from \"./zones.ts\";\n\n/** Display-safe identity and nameserver evidence for one provider-owned zone. */\nexport const Candidate = Schema.Struct({\n  accountId: Schema.String,\n  id: Schema.String,\n  name: Domain.Schema,\n  nameservers: Schema.Array(Domain.Schema),\n  providerId: Schema.String,\n  status: Schema.Literals([\"active\", \"pending\", \"unknown\"]),\n});\nexport interface Candidate extends Schema.Schema.Type<typeof Candidate> {}\n\nexport interface Source {\n  readonly listZones: (\n    name: DomainName.DomainName,\n  ) => Effect.Effect<ReadonlyArray<Omit<Candidate, \"providerId\">>, DnsProvider.Error>;\n  readonly provider: DnsProvider.Interface;\n}\n\nexport type Outcome = Data.TaggedEnum<{\n  NotFound: { readonly domain: DomainName.DomainName };\n  Resolved: { readonly candidate: Candidate; readonly provider: DnsProvider.Interface };\n  SelectionRequired: { readonly candidates: ReadonlyArray<Candidate> };\n}>;\nexport const Outcome = Data.taggedEnum<Outcome>();\n\nexport interface Interface {\n  readonly discover: (domain: DomainName.DomainName) => Effect.Effect<Outcome, DnsProvider.Error>;\n}\n\nexport class Service extends Context.Service<Service, Interface>()(\"@domainkit/ZoneDiscovery\") {}\n\n/** Compose provider-account discovery sources without expanding the record-provider contract. */\nexport function make(sources: ReadonlyArray<Source>): Interface {\n  return Service.of({\n    discover: Effect.fn(\"ZoneDiscovery.discover\")(function* (domain) {\n      for (const name of Zones.candidates(domain)) {\n        const matches = deduplicate(\n          (yield* Effect.forEach(\n            sources,\n            (source) =>\n              source.listZones(name).pipe(\n                Effect.map((zones) =>\n                  zones\n                    .filter((zone) => zone.name === name)\n                    .map((zone) => ({\n                      candidate: { ...zone, providerId: source.provider.id },\n                      provider: source.provider,\n                    })),\n                ),\n              ),\n            { concurrency: \"unbounded\" },\n          )).flat(),\n        );\n        const match = matches[0];\n        if (matches.length === 1 && match !== undefined) {\n          return Outcome.Resolved(match);\n        }\n        if (matches.length > 1) {\n          return Outcome.SelectionRequired({\n            candidates: matches.map(({ candidate }) => candidate),\n          });\n        }\n      }\n      return Outcome.NotFound({ domain });\n    }),\n  });\n}\n\nfunction deduplicate(\n  matches: ReadonlyArray<{\n    readonly candidate: Candidate;\n    readonly provider: DnsProvider.Interface;\n  }>,\n): ReadonlyArray<{\n  readonly candidate: Candidate;\n  readonly provider: DnsProvider.Interface;\n}> {\n  const unique = new Map<string, (typeof matches)[number]>();\n  for (const match of matches) {\n    const key = [\n      match.candidate.providerId,\n      match.candidate.accountId,\n      match.candidate.id,\n      match.candidate.name,\n    ].join(\":\");\n    const existing = unique.get(key);\n    if (existing === undefined) unique.set(key, match);\n  }\n  return [...unique.values()].sort((left, right) =>\n    candidateKey(left.candidate).localeCompare(candidateKey(right.candidate)),\n  );\n}\n\nfunction candidateKey(candidate: Candidate): string {\n  return [candidate.name, candidate.providerId, candidate.accountId, candidate.id].join(\":\");\n}\n","import { Effect, Schema as S } from \"effect\";\n\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport * as DomainName from \"./domain-name.ts\";\n\nexport const Type = S.Literals([\"A\", \"AAAA\", \"CNAME\", \"TXT\", \"MX\", \"CAA\", \"NS\", \"SRV\"]);\nexport type Type = typeof Type.Type;\n\nexport const RequirementMetadata = S.Struct({\n  ownership: S.String.check(S.isMinLength(1)),\n  provenance: S.String.check(S.isMinLength(1)),\n  purpose: S.String.check(S.isMinLength(1)),\n});\nexport interface RequirementMetadata extends S.Schema.Type<typeof RequirementMetadata> {}\n\nconst CommonFields = {\n  metadata: RequirementMetadata,\n  name: DomainName.Schema,\n  policy: S.Literals([\"exclusive\", \"append\"]),\n  ttl: S.NullOr(S.Int.check(S.isBetween({ minimum: 60, maximum: 2_147_483_647 }))),\n};\n\nconst ExclusiveCommonFields = { ...CommonFields, policy: S.Literal(\"exclusive\") };\nconst Address = S.String.check(\n  S.makeFilter((value) => (isIpv4(value) ? undefined : \"Expected an IPv4 address\")),\n);\nconst Ipv6Address = S.String.check(\n  S.makeFilter((value) => (isIpv6(value) ? undefined : \"Expected an IPv6 address\")),\n);\nconst Port = S.Int.check(S.isBetween({ minimum: 0, maximum: 65_535 }));\nconst Priority = S.Int.check(S.isBetween({ minimum: 0, maximum: 65_535 }));\n\nexport const Schema = S.TaggedUnion({\n  A: { ...CommonFields, address: Address },\n  AAAA: { ...CommonFields, address: Ipv6Address },\n  CNAME: { ...ExclusiveCommonFields, target: DomainName.Schema },\n  TXT: { ...CommonFields, value: S.String.check(S.isMinLength(1)) },\n  MX: { ...CommonFields, exchange: DomainName.Schema, priority: Priority },\n  CAA: {\n    ...CommonFields,\n    flags: S.Int.check(S.isBetween({ minimum: 0, maximum: 255 })),\n    tag: S.Literals([\"issue\", \"issuewild\", \"iodef\"]),\n    value: S.String.check(S.isMinLength(1)),\n  },\n  NS: { ...CommonFields, target: DomainName.Schema },\n  SRV: {\n    ...CommonFields,\n    port: Port,\n    priority: Priority,\n    target: DomainName.Schema,\n    weight: Priority,\n  },\n});\nexport const {\n  A,\n  AAAA: Aaaa,\n  CAA: Caa,\n  CNAME: Cname,\n  MX: Mx,\n  NS: Ns,\n  SRV: Srv,\n  TXT: Txt,\n} = Schema.cases;\nexport type DnsRecord = typeof Schema.Type;\nexport type Encoded = typeof Schema.Encoded;\n\n/** Provider state that DomainKit cannot create but must retain for safe reconciliation. */\nexport const Opaque = S.Struct({\n  _tag: S.Literal(\"Opaque\"),\n  name: S.String.check(S.isMinLength(1)),\n  providerRecordId: S.NullOr(S.String),\n  providerType: S.String.check(S.isMinLength(1)),\n});\nexport interface Opaque extends S.Schema.Type<typeof Opaque> {}\n\n/** Any DNS record observed through a provider, including non-portable record types. */\nexport const Observed = S.Union([Schema, Opaque]);\nexport type Observed = typeof Observed.Type;\n\nexport const decode = Effect.fn(\"DnsRecord.decode\")((input: unknown) =>\n  S.decodeUnknownEffect(Schema)(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport function parse(input: unknown): DnsRecord {\n  try {\n    return S.decodeUnknownSync(Schema)(input);\n  } catch (cause) {\n    throw new InvalidInputError({\n      message: cause instanceof Error ? cause.message : String(cause),\n    });\n  }\n}\n\nexport function data(record: DnsRecord): Readonly<Record<string, number | string>> {\n  switch (record._tag) {\n    case \"A\":\n    case \"AAAA\":\n      return { address: record.address };\n    case \"CNAME\":\n    case \"NS\":\n      return { target: record.target };\n    case \"TXT\":\n      return { value: record.value };\n    case \"MX\":\n      return { exchange: record.exchange, priority: record.priority };\n    case \"CAA\":\n      return { flags: record.flags, tag: record.tag, value: record.value };\n    case \"SRV\":\n      return {\n        port: record.port,\n        priority: record.priority,\n        target: record.target,\n        weight: record.weight,\n      };\n  }\n}\n\nexport function equals(left: DnsRecord, right: DnsRecord): boolean {\n  return (\n    left._tag === right._tag &&\n    left.name === right.name &&\n    JSON.stringify(data(left)) === JSON.stringify(data(right))\n  );\n}\n\nfunction isIpv4(value: string): boolean {\n  const parts = value.split(\".\");\n  return (\n    parts.length === 4 &&\n    parts.every(\n      (part) => /^\\d{1,3}$/.test(part) && Number(part) <= 255 && String(Number(part)) === part,\n    )\n  );\n}\n\nfunction isIpv6(value: string): boolean {\n  try {\n    return new URL(`http://[${value}]/`).hostname.startsWith(\"[\");\n  } catch {\n    return false;\n  }\n}\n","import { Context, Effect, Layer, Schema } from \"effect\";\n\nimport type * as DomainName from \"../domain/domain-name.ts\";\nimport type * as DnsRecord from \"../domain/dns-record.ts\";\n\nexport interface CreateResult {\n  readonly providerRecordId: string | null;\n}\n\nexport const ErrorReason = Schema.Literals([\n  \"authentication\",\n  \"authorization\",\n  \"conflict\",\n  \"not_found\",\n  \"rate_limit\",\n  \"request\",\n  \"response\",\n  \"transport\",\n  \"unsupported\",\n]);\nexport type ErrorReason = typeof ErrorReason.Type;\n\nexport class Error extends Schema.TaggedError<Error>()(\"ProviderError\", {\n  cause: Schema.optionalKey(Schema.Unknown),\n  code: Schema.optionalKey(Schema.Union([Schema.Number, Schema.String])),\n  message: Schema.String,\n  operation: Schema.String,\n  providerId: Schema.String,\n  reason: Schema.optionalKey(ErrorReason),\n  retryAfterMs: Schema.optionalKey(Schema.Number),\n  status: Schema.optionalKey(Schema.Number),\n}) {}\n\n/** The provider capability used by DNS planning, application, and verification. */\nexport interface Interface {\n  readonly id: string;\n  readonly createRecord: (\n    zone: DomainName.DomainName,\n    record: DnsRecord.DnsRecord,\n  ) => Effect.Effect<CreateResult, Error>;\n  readonly deleteRecord: (\n    zone: DomainName.DomainName,\n    providerRecordId: string,\n  ) => Effect.Effect<void, Error>;\n  readonly getRecord: (\n    zone: DomainName.DomainName,\n    providerRecordId: string,\n  ) => Effect.Effect<DnsRecord.Observed | null, Error>;\n  readonly listRecords: (\n    zone: DomainName.DomainName,\n  ) => Effect.Effect<ReadonlyArray<DnsRecord.Observed>, Error>;\n}\n\nexport class Service extends Context.Service<Service, Interface>()(\"@domainkit/DnsProvider\") {}\n\n/** Minimal Promise-shaped provider contract for hosts that do not use Effect directly. */\nexport interface AsyncInterface {\n  readonly id: string;\n  readonly createRecord: (\n    zone: DomainName.DomainName,\n    record: DnsRecord.DnsRecord,\n  ) => Promise<CreateResult>;\n  readonly deleteRecord: (zone: DomainName.DomainName, providerRecordId: string) => Promise<void>;\n  readonly getRecord: (\n    zone: DomainName.DomainName,\n    providerRecordId: string,\n  ) => Promise<DnsRecord.Observed | null>;\n  readonly listRecords: (zone: DomainName.DomainName) => Promise<ReadonlyArray<DnsRecord.Observed>>;\n}\n\nexport const fromAsync = (provider: AsyncInterface): Interface =>\n  Service.of({\n    id: provider.id,\n    createRecord: Effect.fn(\"DnsProvider.createRecord\")((zone, record) =>\n      Effect.tryPromise({\n        try: () => provider.createRecord(zone, record),\n        catch: (cause) => failure(provider, \"createRecord\", cause),\n      }),\n    ),\n    deleteRecord: Effect.fn(\"DnsProvider.deleteRecord\")((zone, providerRecordId) =>\n      Effect.tryPromise({\n        try: () => provider.deleteRecord(zone, providerRecordId),\n        catch: (cause) => failure(provider, \"deleteRecord\", cause),\n      }),\n    ),\n    getRecord: Effect.fn(\"DnsProvider.getRecord\")((zone, providerRecordId) =>\n      Effect.tryPromise({\n        try: () => provider.getRecord(zone, providerRecordId),\n        catch: (cause) => failure(provider, \"getRecord\", cause),\n      }),\n    ),\n    listRecords: Effect.fn(\"DnsProvider.listRecords\")((zone) =>\n      Effect.tryPromise({\n        try: () => provider.listRecords(zone),\n        catch: (cause) => failure(provider, \"listRecords\", cause),\n      }),\n    ),\n  });\n\nexport const layerFromAsync = (provider: AsyncInterface): Layer.Layer<Service> =>\n  Layer.succeed(Service, fromAsync(provider));\n\nexport const toAsync = (provider: Interface): AsyncInterface => ({\n  id: provider.id,\n  createRecord: (zone, record) => Effect.runPromise(provider.createRecord(zone, record)),\n  deleteRecord: (zone, providerRecordId) =>\n    Effect.runPromise(provider.deleteRecord(zone, providerRecordId)),\n  getRecord: (zone, providerRecordId) =>\n    Effect.runPromise(provider.getRecord(zone, providerRecordId)),\n  listRecords: (zone) => Effect.runPromise(provider.listRecords(zone)),\n});\n\nfunction failure(provider: AsyncInterface, operation: string, cause: unknown): Error {\n  return cause instanceof Error\n    ? cause\n    : new Error({\n        cause,\n        message: cause instanceof globalThis.Error ? cause.message : String(cause),\n        operation,\n        providerId: provider.id,\n      });\n}\n","import { Crypto, Effect, Layer, PlatformError, Schema } from \"effect\";\n\nexport class CryptoError extends Schema.TaggedError<CryptoError>()(\"CryptoError\", {\n  message: Schema.String,\n}) {}\n\nexport type Json =\n  | null\n  | boolean\n  | number\n  | string\n  | ReadonlyArray<Json>\n  | { readonly [key: string]: Json };\n\n/** Deterministic JSON serialization for already schema-encoded protocol values. */\nexport function stringify(value: Json): string {\n  if (value === null || typeof value !== \"object\") {\n    const encoded = JSON.stringify(value);\n    if (encoded === undefined) throw new TypeError(\"Value is not representable as JSON\");\n    return encoded;\n  }\n  if (isJsonArray(value)) return `[${value.map(stringify).join(\",\")}]`;\n  return `{${Object.entries(value)\n    .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))\n    .map(([key, entry]) => `${JSON.stringify(key)}:${stringify(entry)}`)\n    .join(\",\")}}`;\n}\n\nfunction isJsonArray(value: Json): value is ReadonlyArray<Json> {\n  return Array.isArray(value);\n}\n\nexport const sha256Text = Effect.fn(\"Digest.sha256Text\")(function* (value: string) {\n  const cryptoService = yield* Crypto.Crypto;\n  const digest = yield* cryptoService\n    .digest(\"SHA-256\", new TextEncoder().encode(value))\n    .pipe(Effect.mapError((cause) => new CryptoError({ message: cause.message })));\n  return [...digest].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n});\n\nexport const sha256Json = Effect.fn(\"Digest.sha256Json\")((value: Json) =>\n  Effect.try({\n    try: () => stringify(value),\n    catch: (cause) =>\n      new CryptoError({ message: cause instanceof Error ? cause.message : String(cause) }),\n  }).pipe(Effect.flatMap(sha256Text)),\n);\n\nfunction sha256EncodedProgram<S extends Schema.Constraint>(\n  schema: S,\n  value: S[\"Type\"],\n): Effect.Effect<string, CryptoError, Crypto.Crypto | S[\"EncodingServices\"]> {\n  return Schema.encodeEffect(schema)(value).pipe(\n    Effect.mapError((cause) => new CryptoError({ message: cause.message })),\n    Effect.flatMap(Schema.decodeUnknownEffect(Schema.Json)),\n    Effect.mapError((cause) => new CryptoError({ message: cause.message })),\n    Effect.flatMap(sha256Json),\n  );\n}\n\nexport const sha256Encoded = Effect.fn(\"Digest.sha256Encoded\")(sha256EncodedProgram);\n\n/** Portable Web Crypto implementation for hosts that want a ready-made Layer. */\nexport const webCryptoLayer: Layer.Layer<Crypto.Crypto> = Layer.succeed(\n  Crypto.Crypto,\n  Crypto.make({\n    randomBytes: (size) => crypto.getRandomValues(new Uint8Array(size)),\n    digest: (algorithm, data) =>\n      Effect.tryPromise({\n        try: async () => {\n          const bytes = new Uint8Array(data.byteLength);\n          bytes.set(data);\n          return new Uint8Array(await crypto.subtle.digest(algorithm, bytes.buffer));\n        },\n        catch: (cause) =>\n          PlatformError.systemError({\n            _tag: \"Unknown\",\n            module: \"WebCrypto\",\n            method: \"digest\",\n            cause,\n          }),\n      }),\n  }),\n);\n","import { Effect, Schema as S } from \"effect\";\n\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport * as DnsRecord from \"../domain/dns-record.ts\";\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\n\nexport const Operation = S.TaggedUnion({\n  create: {\n    id: S.String,\n    requirement: DnsRecord.Schema,\n  },\n  noop: {\n    id: S.String,\n    requirement: DnsRecord.Schema,\n    ttlDrift: S.Boolean,\n  },\n  conflict: {\n    existing: S.Array(DnsRecord.Observed),\n    id: S.String,\n    reason: S.String,\n    requirement: DnsRecord.Schema,\n  },\n});\nexport type Operation = typeof Operation.Type;\n\nexport const Schema = S.Struct({\n  digest: S.String,\n  operations: S.Array(Operation),\n  providerId: S.String,\n  version: S.Literal(\"domainkit.dns-plan.v1\"),\n  zone: DomainName.Schema,\n});\nexport interface DnsPlan extends S.Schema.Type<typeof Schema> {}\n\nexport const Authorization = S.Struct({\n  allowPartial: S.Boolean,\n  operationIds: S.Array(S.String),\n  planDigest: S.String,\n  version: S.Literal(\"domainkit.plan-authorization.v1\"),\n});\nexport interface PlanAuthorization extends S.Schema.Type<typeof Authorization> {}\n\nexport const Receipt = S.Struct({\n  appliedAt: S.DateFromString,\n  operations: S.Array(\n    S.Struct({\n      operationId: S.String,\n      providerRecordId: S.NullOr(S.String),\n    }),\n  ),\n  planDigest: S.String,\n  providerId: S.String,\n  status: S.Literals([\"complete\", \"partial\"]),\n  version: S.Literal(\"domainkit.apply-receipt.v1\"),\n  zone: DomainName.Schema,\n});\nexport interface ApplyReceipt extends S.Schema.Type<typeof Receipt> {}\n\nexport const decode = Effect.fn(\"DnsPlan.decode\")((input: unknown) =>\n  S.decodeUnknownEffect(Schema)(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport const encode = S.encodeSync(Schema);\nexport const decodeReceipt = Effect.fn(\"DnsPlan.decodeReceipt\")((input: unknown) =>\n  S.decodeUnknownEffect(Receipt)(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\nexport const encodeReceipt = S.encodeSync(Receipt);\n","import { Cause, Clock, Crypto, Data, Effect, Schema as S } from \"effect\";\n\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport * as DnsRecord from \"../domain/dns-record.ts\";\nimport * as ZoneDiscovery from \"../discovery/zone-discovery.ts\";\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport * as DnsProvider from \"../provider/provider.ts\";\nimport { CryptoError, sha256Encoded, stringify } from \"./canonical-json.ts\";\nimport * as DnsPlan from \"./types.ts\";\n\nconst UnsignedPlan = S.Struct({\n  operations: S.Array(DnsPlan.Operation),\n  providerId: S.String,\n  version: S.Literal(\"domainkit.dns-plan.v1\"),\n  zone: DomainName.Schema,\n});\n\nconst RequirementDigest = S.Struct({ requirement: DnsRecord.Schema });\n\nexport class ConflictError extends S.TaggedError<ConflictError>()(\"PlanConflictError\", {\n  operationIds: S.Array(S.String),\n}) {}\n\nexport class AuthorizationError extends S.TaggedError<AuthorizationError>()(\"AuthorizationError\", {\n  message: S.String,\n}) {}\n\nexport class StaleError extends S.TaggedError<StaleError>()(\"StalePlanError\", {\n  approvedPlanDigest: S.String,\n  currentPlanDigest: S.String,\n}) {}\n\nexport class PartialApplyError extends S.TaggedError<PartialApplyError>()(\"PartialApplyError\", {\n  causeTag: S.Literals([\n    \"CryptoError\",\n    \"InvalidInputError\",\n    \"Interrupted\",\n    \"ProviderError\",\n    \"StalePlanError\",\n  ]),\n  failedOperationId: S.String,\n  message: S.String,\n  receipt: DnsPlan.Receipt,\n}) {}\n\nexport type Target = Data.TaggedEnum<{\n  DiscoverFromDomain: { readonly domain: string };\n  ExactZone: { readonly zone: string };\n}>;\nexport const Target = Data.taggedEnum<Target>();\n\nexport type CreateResult = Data.TaggedEnum<{\n  NotFound: { readonly domain: DomainName.DomainName };\n  Resolved: {\n    readonly candidate: ZoneDiscovery.Candidate | null;\n    readonly plan: DnsPlan.DnsPlan;\n  };\n  SelectionRequired: { readonly candidates: ReadonlyArray<ZoneDiscovery.Candidate> };\n}>;\nexport const CreateResult = Data.taggedEnum<CreateResult>();\nexport type ResolvedCreateResult = Extract<CreateResult, { readonly _tag: \"Resolved\" }>;\n\nexport interface CreateInput {\n  readonly requirements: ReadonlyArray<DnsRecord.Encoded | DnsRecord.DnsRecord>;\n  readonly target: Target;\n}\nexport type ExactCreateInput = Omit<CreateInput, \"target\"> & {\n  readonly target: Extract<Target, { readonly _tag: \"ExactZone\" }>;\n};\nexport type DiscoverCreateInput = Omit<CreateInput, \"target\"> & {\n  readonly target: Extract<Target, { readonly _tag: \"DiscoverFromDomain\" }>;\n};\n\nexport interface ApplyInput {\n  readonly authorization: DnsPlan.PlanAuthorization;\n  readonly plan: DnsPlan.DnsPlan;\n}\n\nexport type CreateError = InvalidInputError | DnsProvider.Error | CryptoError;\nexport type AuthorizeError = AuthorizationError | CryptoError;\nexport type ApplyError =\n  | InvalidInputError\n  | DnsProvider.Error\n  | CryptoError\n  | AuthorizationError\n  | ConflictError\n  | StaleError\n  | PartialApplyError;\n\n/** Builds a deterministic DNS plan through an exact or discoverable authoritative-zone target. */\nexport function create(\n  input: ExactCreateInput,\n): Effect.Effect<ResolvedCreateResult, CreateError, Crypto.Crypto | DnsProvider.Service>;\nexport function create(\n  input: DiscoverCreateInput,\n): Effect.Effect<CreateResult, CreateError, Crypto.Crypto | ZoneDiscovery.Service>;\nexport function create(\n  input: CreateInput,\n): Effect.Effect<\n  CreateResult,\n  CreateError,\n  Crypto.Crypto | DnsProvider.Service | ZoneDiscovery.Service\n> {\n  const target = input.target;\n  if (target._tag === \"ExactZone\") {\n    return Effect.gen(function* () {\n      const provider = yield* DnsProvider.Service;\n      const zone = yield* DomainName.decode(target.zone);\n      return CreateResult.Resolved({\n        candidate: null,\n        plan: yield* planAgainst(provider, zone, input.requirements),\n      });\n    }).pipe(Effect.withSpan(\"Provisioning.create\"));\n  }\n  return Effect.gen(function* () {\n    const discovery = yield* ZoneDiscovery.Service;\n    const domain = yield* DomainName.decode(target.domain);\n    const outcome = yield* discovery.discover(domain);\n    switch (outcome._tag) {\n      case \"NotFound\":\n        return CreateResult.NotFound({ domain: outcome.domain });\n      case \"SelectionRequired\":\n        return CreateResult.SelectionRequired({ candidates: outcome.candidates });\n      case \"Resolved\":\n        return CreateResult.Resolved({\n          candidate: outcome.candidate,\n          plan: yield* planAgainst(outcome.provider, outcome.candidate.name, input.requirements),\n        });\n    }\n  }).pipe(Effect.withSpan(\"Provisioning.create\"));\n}\n\nconst planAgainst = Effect.fn(\"Provisioning.planAgainst\")(function* (\n  provider: DnsProvider.Interface,\n  zone: DomainName.DomainName,\n  inputs: ReadonlyArray<DnsRecord.Encoded | DnsRecord.DnsRecord>,\n) {\n  const requirements = (yield* Effect.forEach(inputs, DnsRecord.decode, {\n    concurrency: \"unbounded\",\n  })).sort(compareRecords);\n  const existing = [...(yield* provider.listRecords(zone))].sort(compareRecords);\n  const { operations } = yield* Effect.reduce(\n    requirements,\n    (): PlanningState => ({ operations: [], projected: existing }),\n    (state, requirement) =>\n      reconcileRequirement(requirement, state.projected).pipe(\n        Effect.map((operation) => ({\n          operations: [...state.operations, operation],\n          projected:\n            operation._tag === \"create\"\n              ? [...state.projected, operation.requirement].sort(compareRecords)\n              : state.projected,\n        })),\n      ),\n  );\n  const unsigned: S.Schema.Type<typeof UnsignedPlan> = {\n    operations,\n    providerId: provider.id,\n    version: \"domainkit.dns-plan.v1\",\n    zone,\n  };\n  return { ...unsigned, digest: yield* sha256Encoded(UnsignedPlan, unsigned) };\n});\n\ninterface PlanningState {\n  readonly operations: ReadonlyArray<DnsPlan.Operation>;\n  readonly projected: ReadonlyArray<DnsRecord.Observed>;\n}\n\n/** Authorizes all or a selected subset of create operations in a digest-bound plan. */\nexport const authorize = Effect.fn(\"Provisioning.authorize\")(function* (\n  plan: DnsPlan.DnsPlan,\n  operationIds?: ReadonlyArray<string>,\n  options: { readonly allowPartial?: boolean } = {},\n) {\n  yield* validate(plan);\n  const createIds = plan.operations\n    .filter((operation) => operation._tag === \"create\")\n    .map(({ id }) => id);\n  const selected = [...new Set(operationIds ?? createIds)].sort();\n  const unknown = selected.filter((id) => !createIds.includes(id));\n  if (unknown.length > 0) {\n    return yield* new AuthorizationError({\n      message: `Unknown operation IDs: ${unknown.join(\", \")}`,\n    });\n  }\n  if (!options.allowPartial && selected.length !== createIds.length) {\n    return yield* new AuthorizationError({\n      message: \"Partial authorization requires allowPartial\",\n    });\n  }\n  return {\n    allowPartial: options.allowPartial ?? false,\n    operationIds: selected,\n    planDigest: plan.digest,\n    version: \"domainkit.plan-authorization.v1\" as const,\n  };\n});\n\n/** Applies approved creates sequentially after full and per-operation revalidation. */\nexport const apply = Effect.fn(\"Provisioning.apply\")(function* (input: ApplyInput) {\n  const { authorization, plan } = input;\n  const provider = yield* DnsProvider.Service;\n  yield* validate(plan);\n  if (authorization.planDigest !== plan.digest) {\n    return yield* new AuthorizationError({\n      message: \"Authorization belongs to a different plan\",\n    });\n  }\n  if (provider.id !== plan.providerId) {\n    return yield* new AuthorizationError({\n      message: \"Provider does not match the approved plan\",\n    });\n  }\n  const conflicts = plan.operations.filter((operation) => operation._tag === \"conflict\");\n  if (conflicts.length > 0) {\n    return yield* new ConflictError({\n      operationIds: conflicts.map(({ id }) => id),\n    });\n  }\n\n  const creates = plan.operations.filter(DnsPlan.Operation.guards.create);\n  const approved = new Set(authorization.operationIds);\n  const unknown = authorization.operationIds.filter(\n    (id) => !creates.some((operation) => operation.id === id),\n  );\n  if (unknown.length > 0) {\n    return yield* new AuthorizationError({\n      message: `Authorization contains unknown operations: ${unknown.join(\", \")}`,\n    });\n  }\n  if (!authorization.allowPartial && creates.some(({ id }) => !approved.has(id))) {\n    return yield* new AuthorizationError({\n      message: \"Authorization does not cover every create operation\",\n    });\n  }\n\n  const currentPlan = yield* planAgainst(\n    provider,\n    plan.zone,\n    plan.operations.map(({ requirement }) => requirement),\n  );\n  if (currentPlan.digest !== plan.digest) {\n    return yield* new StaleError({\n      approvedPlanDigest: plan.digest,\n      currentPlanDigest: currentPlan.digest,\n    });\n  }\n\n  const operations: Array<{\n    operationId: string;\n    providerRecordId: string | null;\n  }> = [];\n  for (const operation of creates) {\n    if (!approved.has(operation.id)) continue;\n    yield* Effect.gen(function* () {\n      yield* assertStillCreatable(plan, operation);\n      const result = yield* provider.createRecord(plan.zone, operation.requirement);\n      operations.push({\n        operationId: operation.id,\n        providerRecordId: result.providerRecordId,\n      });\n    }).pipe(\n      Effect.catch((failure): Effect.Effect<never, CreateError | StaleError | PartialApplyError> =>\n        operations.length === 0\n          ? Effect.fail(failure)\n          : makeReceipt(input, operations, \"partial\").pipe(\n              Effect.flatMap((receipt) =>\n                Effect.fail(\n                  new PartialApplyError({\n                    causeTag: failure._tag,\n                    failedOperationId: operation.id,\n                    message: failureMessage(failure),\n                    receipt,\n                  }),\n                ),\n              ),\n            ),\n      ),\n      Effect.catchCause((cause) => {\n        if (!Cause.hasInterruptsOnly(cause) || operations.length === 0) {\n          return Effect.failCause(cause);\n        }\n        return makeReceipt(input, operations, \"partial\").pipe(\n          Effect.flatMap((receipt) =>\n            Effect.fail(\n              new PartialApplyError({\n                causeTag: \"Interrupted\",\n                failedOperationId: operation.id,\n                message: \"DNS apply was interrupted after confirmed writes\",\n                receipt,\n              }),\n            ),\n          ),\n        );\n      }),\n    );\n  }\n  return yield* makeReceipt(input, operations, \"complete\");\n});\n\nexport function renderManualInstructions(plan: DnsPlan.DnsPlan): ReadonlyArray<string> {\n  return plan.operations.map((operation) => {\n    const record = operation.requirement;\n    const data = Object.entries(DnsRecord.data(record))\n      .map(([key, value]) => `${key}=${value}`)\n      .join(\" \");\n    return `${operation._tag.toUpperCase()} ${record._tag} ${record.name} ${data}`.trim();\n  });\n}\n\nfunction makeReceipt(\n  input: ApplyInput,\n  operations: ReadonlyArray<{\n    readonly operationId: string;\n    readonly providerRecordId: string | null;\n  }>,\n  status: \"complete\" | \"partial\",\n): Effect.Effect<DnsPlan.ApplyReceipt> {\n  return Clock.currentTimeMillis.pipe(\n    Effect.map((now) => ({\n      appliedAt: new Date(now),\n      operations,\n      planDigest: input.plan.digest,\n      providerId: input.plan.providerId,\n      status,\n      version: \"domainkit.apply-receipt.v1\" as const,\n      zone: input.plan.zone,\n    })),\n  );\n}\n\nfunction assertStillCreatable(\n  plan: DnsPlan.DnsPlan,\n  operation: Extract<DnsPlan.Operation, { readonly _tag: \"create\" }>,\n): Effect.Effect<void, CreateError | StaleError, DnsProvider.Service | Crypto.Crypto> {\n  return DnsProvider.Service.pipe(\n    Effect.flatMap((provider) => planAgainst(provider, plan.zone, [operation.requirement])),\n    Effect.flatMap((currentPlan) => {\n      const currentOperation = currentPlan.operations[0];\n      return currentOperation?._tag === \"create\" && currentOperation.id === operation.id\n        ? Effect.void\n        : Effect.fail(\n            new StaleError({\n              approvedPlanDigest: plan.digest,\n              currentPlanDigest: currentPlan.digest,\n            }),\n          );\n    }),\n  );\n}\n\nfunction reconcileRequirement(\n  requirement: DnsRecord.DnsRecord,\n  allExisting: ReadonlyArray<DnsRecord.Observed>,\n): Effect.Effect<DnsPlan.Operation, CryptoError, Crypto.Crypto> {\n  return Effect.gen(function* () {\n    const sameName = allExisting.filter((record) => record.name === requirement.name);\n    const sameSet = sameName.filter(\n      (record): record is DnsRecord.DnsRecord =>\n        record._tag !== \"Opaque\" && record._tag === requirement._tag,\n    );\n    const exact = sameSet.find((record) => DnsRecord.equals(record, requirement));\n    const id = yield* sha256Encoded(RequirementDigest, { requirement });\n    if (exact !== undefined) {\n      return {\n        _tag: \"noop\",\n        id,\n        requirement,\n        ttlDrift: exact.ttl !== requirement.ttl,\n      };\n    }\n    const cnameConflict =\n      sameName.length > 0 &&\n      (requirement._tag === \"CNAME\" || sameName.some((record) => record._tag === \"CNAME\"));\n    if (cnameConflict) {\n      return {\n        _tag: \"conflict\",\n        existing: sameName,\n        id,\n        reason: \"CNAME records cannot coexist with other records at the same name\",\n        requirement,\n      };\n    }\n    if (\n      sameSet.length > 0 &&\n      (requirement.policy === \"exclusive\" || sameSet.some(({ policy }) => policy === \"exclusive\"))\n    ) {\n      return {\n        _tag: \"conflict\",\n        existing: sameSet,\n        id,\n        reason: \"The exclusive record set already contains incompatible data\",\n        requirement,\n      };\n    }\n    return { _tag: \"create\", id, requirement };\n  });\n}\n\nexport function validate(\n  plan: DnsPlan.DnsPlan,\n): Effect.Effect<void, AuthorizeError, Crypto.Crypto> {\n  const unsigned: S.Schema.Type<typeof UnsignedPlan> = {\n    operations: plan.operations,\n    providerId: plan.providerId,\n    version: plan.version,\n    zone: plan.zone,\n  };\n  return sha256Encoded(UnsignedPlan, unsigned).pipe(\n    Effect.flatMap((digest) =>\n      digest === plan.digest\n        ? Effect.void\n        : Effect.fail(\n            new AuthorizationError({\n              message: \"Plan digest does not match its contents\",\n            }),\n          ),\n    ),\n  );\n}\n\nfunction failureMessage(failure: CreateError | StaleError): string {\n  return failure._tag === \"StalePlanError\"\n    ? \"DNS state changed while applying the approved plan\"\n    : failure.message;\n}\n\nfunction compareRecords(left: DnsRecord.Observed, right: DnsRecord.Observed): number {\n  const encode = S.encodeSync(DnsRecord.Observed);\n  const toJson = S.decodeUnknownSync(S.Json);\n  const leftJson = stringify(toJson(encode(left)));\n  const rightJson = stringify(toJson(encode(right)));\n  return leftJson < rightJson ? -1 : leftJson > rightJson ? 1 : 0;\n}\n","import { Clock, Crypto, Effect, Schema as S } from \"effect\";\n\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport * as DnsRecord from \"../domain/dns-record.ts\";\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport * as DnsProvider from \"../provider/provider.ts\";\nimport { CryptoError, sha256Encoded } from \"./canonical-json.ts\";\nimport * as Provisioning from \"./plan.ts\";\nimport * as DnsPlan from \"./types.ts\";\n\nexport const Operation = S.Struct({\n  id: S.String,\n  providerRecordId: S.String,\n  record: DnsRecord.Schema,\n});\nexport interface Operation extends S.Schema.Type<typeof Operation> {}\n\nconst UnsignedPlan = S.Struct({\n  createdAt: S.DateFromString,\n  expiresAt: S.DateFromString,\n  operations: S.Array(Operation),\n  providerId: S.String,\n  sourcePlanDigest: S.String,\n  version: S.Literal(\"domainkit.deletion-plan.v1\"),\n  zone: DomainName.Schema,\n});\n\nexport const Plan = S.Struct({ ...UnsignedPlan.fields, digest: S.String });\nexport interface Plan extends S.Schema.Type<typeof Plan> {}\n\nexport const Authorization = S.Struct({\n  operationIds: S.Array(S.String),\n  planDigest: S.String,\n  version: S.Literal(\"domainkit.deletion-authorization.v1\"),\n});\nexport interface Authorization extends S.Schema.Type<typeof Authorization> {}\n\nexport const Receipt = S.Struct({\n  deletedAt: S.DateFromString,\n  operations: S.Array(S.Struct({ operationId: S.String, providerRecordId: S.String })),\n  planDigest: S.String,\n  providerId: S.String,\n  status: S.Literals([\"complete\", \"partial\"]),\n  version: S.Literal(\"domainkit.deletion-receipt.v1\"),\n  zone: DomainName.Schema,\n});\nexport interface Receipt extends S.Schema.Type<typeof Receipt> {}\n\nexport class Error extends S.TaggedError<Error>()(\"UnsafeDeletionError\", {\n  message: S.String,\n  operationId: S.optionalKey(S.String),\n}) {}\n\nexport class PartialError extends S.TaggedError<PartialError>()(\"PartialDeletionError\", {\n  failedOperationId: S.String,\n  message: S.String,\n  receipt: Receipt,\n}) {}\n\nexport interface CreateInput {\n  readonly plan: DnsPlan.DnsPlan;\n  readonly receipt: DnsPlan.ApplyReceipt;\n  readonly ttlMs?: number;\n}\n\n/** Build a fresh deletion plan only from records proven by a prior create receipt. */\nexport const create = Effect.fn(\"Deletion.create\")(function* (input: CreateInput) {\n  const provider = yield* DnsProvider.Service;\n  yield* Provisioning.validate(input.plan);\n  if (\n    input.receipt.planDigest !== input.plan.digest ||\n    input.receipt.providerId !== input.plan.providerId ||\n    input.receipt.zone !== input.plan.zone\n  ) {\n    return yield* new Error({ message: \"Create receipt does not belong to the source plan\" });\n  }\n  if (provider.id !== input.plan.providerId) {\n    return yield* new Error({ message: \"Provider does not match the source receipt\" });\n  }\n  const operations = yield* Effect.forEach(input.receipt.operations, (applied) =>\n    Effect.gen(function* () {\n      const source = input.plan.operations.find(\n        (operation) => operation._tag === \"create\" && operation.id === applied.operationId,\n      );\n      if (source === undefined || source._tag !== \"create\") {\n        return yield* new Error({\n          message: \"Receipt operation is not a created source record\",\n          operationId: applied.operationId,\n        });\n      }\n      if (applied.providerRecordId === null) {\n        return yield* new Error({\n          message: \"Provider record ID is required for safe deletion\",\n          operationId: applied.operationId,\n        });\n      }\n      yield* assertExact(\n        provider,\n        input.plan.zone,\n        applied.providerRecordId,\n        source.requirement,\n        source.id,\n      );\n      return {\n        id: source.id,\n        providerRecordId: applied.providerRecordId,\n        record: source.requirement,\n      };\n    }),\n  );\n  const now = yield* Clock.currentTimeMillis;\n  const unsigned: S.Schema.Type<typeof UnsignedPlan> = {\n    createdAt: new Date(now),\n    expiresAt: new Date(now + (input.ttlMs ?? 15 * 60_000)),\n    operations,\n    providerId: input.plan.providerId,\n    sourcePlanDigest: input.plan.digest,\n    version: \"domainkit.deletion-plan.v1\",\n    zone: input.plan.zone,\n  };\n  return { ...unsigned, digest: yield* sha256Encoded(UnsignedPlan, unsigned) };\n});\n\n/** Produce a separate digest-bound consent artifact for destructive operations. */\nexport const authorize = Effect.fn(\"Deletion.authorize\")(function* (\n  plan: Plan,\n  operationIds?: ReadonlyArray<string>,\n) {\n  yield* validate(plan);\n  const selected = [...new Set(operationIds ?? plan.operations.map(({ id }) => id))].sort();\n  const unknown = selected.filter(\n    (id) => !plan.operations.some((operation) => operation.id === id),\n  );\n  if (unknown.length > 0) {\n    return yield* new Error({ message: `Unknown deletion operation IDs: ${unknown.join(\", \")}` });\n  }\n  return {\n    operationIds: selected,\n    planDigest: plan.digest,\n    version: \"domainkit.deletion-authorization.v1\" as const,\n  };\n});\n\n/** Re-read every approved record before the first delete, then delete by provider record ID. */\nexport const apply = Effect.fn(\"Deletion.apply\")(function* (input: {\n  readonly authorization: Authorization;\n  readonly plan: Plan;\n  readonly priorReceipt?: Receipt;\n}) {\n  const provider = yield* DnsProvider.Service;\n  yield* validate(input.plan);\n  if (input.authorization.planDigest !== input.plan.digest) {\n    return yield* new Error({ message: \"Deletion authorization belongs to a different plan\" });\n  }\n  if (provider.id !== input.plan.providerId) {\n    return yield* new Error({ message: \"Provider does not match the deletion plan\" });\n  }\n  const now = yield* Clock.currentTimeMillis;\n  if (input.plan.expiresAt <= new Date(now)) {\n    return yield* new Error({ message: \"Deletion plan has expired\" });\n  }\n  const selected = input.plan.operations.filter(({ id }) =>\n    input.authorization.operationIds.includes(id),\n  );\n  if (selected.length !== input.authorization.operationIds.length) {\n    return yield* new Error({ message: \"Deletion authorization contains unknown operations\" });\n  }\n  const previouslyDeleted = yield* validatePriorReceipt(input.plan, input.priorReceipt);\n  const completedIds = new Set(previouslyDeleted.map(({ operationId }) => operationId));\n  if (\n    previouslyDeleted.some(\n      ({ operationId }) => !input.authorization.operationIds.includes(operationId),\n    )\n  ) {\n    return yield* new Error({ message: \"Prior receipt contains an unauthorized operation\" });\n  }\n  const remaining = selected.filter(({ id }) => !completedIds.has(id));\n  yield* Effect.forEach(remaining, (operation) =>\n    assertExact(\n      provider,\n      input.plan.zone,\n      operation.providerRecordId,\n      operation.record,\n      operation.id,\n    ),\n  );\n\n  const deleted: Array<{ operationId: string; providerRecordId: string }> = [...previouslyDeleted];\n  for (const operation of remaining) {\n    const failure = yield* Effect.gen(function* () {\n      yield* assertExact(\n        provider,\n        input.plan.zone,\n        operation.providerRecordId,\n        operation.record,\n        operation.id,\n      );\n      yield* provider.deleteRecord(input.plan.zone, operation.providerRecordId);\n      deleted.push({ operationId: operation.id, providerRecordId: operation.providerRecordId });\n    }).pipe(Effect.match({ onFailure: (cause) => cause, onSuccess: () => null }));\n    if (failure !== null) {\n      if (deleted.length === 0) return yield* failure;\n      return yield* new PartialError({\n        failedOperationId: operation.id,\n        message: failure.message,\n        receipt: yield* makeReceipt(input.plan, deleted, \"partial\"),\n      });\n    }\n  }\n  return yield* makeReceipt(input.plan, deleted, \"complete\");\n});\n\nexport function validate(plan: Plan): Effect.Effect<void, Error | CryptoError, Crypto.Crypto> {\n  const unsigned: S.Schema.Type<typeof UnsignedPlan> = {\n    createdAt: plan.createdAt,\n    expiresAt: plan.expiresAt,\n    operations: plan.operations,\n    providerId: plan.providerId,\n    sourcePlanDigest: plan.sourcePlanDigest,\n    version: plan.version,\n    zone: plan.zone,\n  };\n  return sha256Encoded(UnsignedPlan, unsigned).pipe(\n    Effect.flatMap((digest) =>\n      digest === plan.digest\n        ? Effect.void\n        : Effect.fail(new Error({ message: \"Deletion plan digest does not match its contents\" })),\n    ),\n  );\n}\n\nfunction validatePriorReceipt(\n  plan: Plan,\n  receipt: Receipt | undefined,\n): Effect.Effect<ReadonlyArray<{ operationId: string; providerRecordId: string }>, Error> {\n  if (receipt === undefined) return Effect.succeed([]);\n  if (\n    receipt.planDigest !== plan.digest ||\n    receipt.providerId !== plan.providerId ||\n    receipt.zone !== plan.zone ||\n    receipt.status !== \"partial\"\n  ) {\n    return Effect.fail(\n      new Error({ message: \"Prior receipt does not belong to this deletion plan\" }),\n    );\n  }\n  for (const completed of receipt.operations) {\n    const operation = plan.operations.find(({ id }) => id === completed.operationId);\n    if (operation === undefined || operation.providerRecordId !== completed.providerRecordId) {\n      return Effect.fail(\n        new Error({ message: \"Prior receipt operation does not match the deletion plan\" }),\n      );\n    }\n  }\n  return Effect.succeed([...receipt.operations]);\n}\n\nfunction assertExact(\n  provider: DnsProvider.Interface,\n  zone: DomainName.DomainName,\n  providerRecordId: string,\n  expected: DnsRecord.DnsRecord,\n  operationId: string,\n): Effect.Effect<void, Error | DnsProvider.Error> {\n  return provider.getRecord(zone, providerRecordId).pipe(\n    Effect.flatMap((observed) =>\n      observed !== null && observed._tag !== \"Opaque\" && DnsRecord.equals(observed, expected)\n        ? Effect.void\n        : Effect.fail(\n            new Error({\n              message:\n                observed === null\n                  ? \"Created record no longer exists\"\n                  : \"Created record content no longer matches its receipt\",\n              operationId,\n            }),\n          ),\n    ),\n  );\n}\n\nfunction makeReceipt(\n  plan: Plan,\n  operations: ReadonlyArray<{ readonly operationId: string; readonly providerRecordId: string }>,\n  status: \"complete\" | \"partial\",\n): Effect.Effect<Receipt> {\n  return Clock.currentTimeMillis.pipe(\n    Effect.map((now) => ({\n      deletedAt: new Date(now),\n      operations,\n      planDigest: plan.digest,\n      providerId: plan.providerId,\n      status,\n      version: \"domainkit.deletion-receipt.v1\" as const,\n      zone: plan.zone,\n    })),\n  );\n}\n\nexport type CreateError =\n  | Error\n  | InvalidInputError\n  | Provisioning.AuthorizationError\n  | DnsProvider.Error\n  | CryptoError;\nexport type ApplyError = Error | PartialError | DnsProvider.Error | CryptoError;\nexport type Requirements = DnsProvider.Service | Crypto.Crypto;\n","import { Context, Effect, Layer, Schema } from \"effect\";\n\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport * as DnsRecord from \"../domain/dns-record.ts\";\n\nexport interface Query {\n  readonly name: DomainName.DomainName;\n  readonly signal?: AbortSignal;\n  readonly type: DnsRecord.Type;\n}\n\nexport const Answer = Schema.Struct({\n  data: Schema.String,\n  name: DomainName.Schema,\n  ttl: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),\n  type: DnsRecord.Type,\n});\nexport interface Answer extends Schema.Schema.Type<typeof Answer> {}\n\nexport const Resolution = Schema.TaggedUnion({\n  answer: { answers: Schema.Array(Answer) },\n  nodata: {},\n});\nexport type Resolution = typeof Resolution.Type;\n\nexport class Error extends Schema.TaggedError<Error>()(\"ResolverError\", {\n  cause: Schema.optionalKey(Schema.Unknown),\n  message: Schema.String,\n  reason: Schema.Literals([\"response\", \"timeout\", \"transport\"]),\n}) {}\n\nexport interface Interface {\n  readonly resolve: (query: Query) => Effect.Effect<Resolution, Error>;\n}\n\nexport class Service extends Context.Service<Service, Interface>()(\"@domainkit/DnsResolver\") {}\n\nexport type AsyncResolution =\n  | Resolution\n  | { readonly _tag: \"timeout\" }\n  | { readonly _tag: \"failure\"; readonly message: string };\n\nexport interface AsyncInterface {\n  readonly resolve: (query: Query) => Promise<AsyncResolution>;\n}\n\nexport const layerFromAsync = (resolver: AsyncInterface): Layer.Layer<Service> =>\n  Layer.succeed(Service, {\n    resolve: Effect.fn(\"DnsResolver.resolve\")((query) =>\n      Effect.tryPromise({\n        try: () => resolver.resolve(query),\n        catch: (cause) =>\n          new Error({\n            cause,\n            message: cause instanceof globalThis.Error ? cause.message : String(cause),\n            reason: \"transport\",\n          }),\n      }).pipe(\n        Effect.flatMap((resolution) => {\n          switch (resolution._tag) {\n            case \"answer\":\n            case \"nodata\":\n              return Effect.succeed(resolution);\n            case \"timeout\":\n              return Effect.fail(new Error({ message: \"DNS query timed out\", reason: \"timeout\" }));\n            case \"failure\":\n              return Effect.fail(new Error({ message: resolution.message, reason: \"transport\" }));\n          }\n        }),\n      ),\n    ),\n  });\n\nexport const toAsync = (resolver: Interface): AsyncInterface => ({\n  resolve: (query) =>\n    Effect.runPromise(\n      resolver.resolve(query).pipe(\n        Effect.match({\n          onFailure: (failure): AsyncResolution =>\n            failure.reason === \"timeout\"\n              ? { _tag: \"timeout\" }\n              : { _tag: \"failure\", message: failure.message },\n          onSuccess: (resolution) => resolution,\n        }),\n      ),\n    ),\n});\n"],"mappings":";;;;;AAEA,IAAaA,UAAb,cAA2B,OAAO,YAAmB,CAAC,CAAC,qBAAqB,EAC1E,SAAS,OAAO,OAClB,CAAC,CAAC,CAAC,CAAC;;;;;;;;ACAJ,MAAM,eAAe;AAErB,MAAMC,SAAOC,OAAE,OAAO,MACpBA,OAAE,YACC,UACC,MAAM,UAAU,OAChB,MAAM,SAAS,GAAG,KAClB,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,UAAU,aAAa,KAAK,KAAK,CAAC,IACtD,KAAA,IACA,uCACN,EAAE,YAAY,aAAa,CAC7B,CACF,CAAC,CAAC,KAAKA,OAAE,MAAM,YAAY,CAAC;;AAM5B,MAAaC,WAASD,OAAE,OAAO,KAC7BA,OAAE,SACAD,QACA,qBAAqB,gBAAgB;CACnC,SAAS,OAAO,YACd,OAAO,IAAI;EACT,WAAW,UAAU,KAAK;EAC1B,QAAQ,UACN,IAAI,YAAY,aACd,EAAE,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAClE,OACA,OACF;CACJ,CAAC;CACH,SAAS,WAAW,OAAO,QAAQ,MAAM;AAC3C,CAAC,CACH,CACF;AAEA,MAAaG,WAAS,OAAO,GAAG,mBAAmB,CAAC,EAAE,UACpDF,OAAE,oBAAoBC,QAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KACnC,OAAO,UAAU,UAAU,IAAIE,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AAEA,SAAgBC,QAAM,OAA4B;CAChD,IAAI;EACF,OAAOJ,OAAE,kBAAkBC,QAAM,CAAC,CAAC,KAAK;CAC1C,SAAS,OAAO;EACd,MAAM,IAAIE,QAAkB,EAC1B,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAChE,CAAC;CACH;AACF;AAEA,SAAS,UAAU,OAAuB;CAcxC,OAbe,MACZ,KAAK,CAAC,CACN,QAAQ,QAAQ,EAAE,CAAC,CACnB,MAAM,GAAG,CAAC,CACV,KAAK,UAAU;EACd,IAAI,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,cAAc,UAAU,WAAW,CAAC,KAAK,GAAG,GACvF,OAAO,MAAM,YAAY;EAG3B,MAAM,aADW,IAAI,IAAI,UAAU,MAAM,SAAS,CAAC,CAAC,SACxB,MAAM,GAAG,CAAC,CAAC;EACvC,IAAI,eAAe,KAAA,GAAW,MAAM,IAAI,MAAM,sCAAsC;EACpF,OAAO,WAAW,YAAY;CAChC,CACU,CAAC,CAAC,KAAK,GAAG;AACxB;;;;;;;AClDA,IAAaE,UAAb,cAA2B,OAAO,YAAmB,CAAC,CAAC,4BAA4B;CACjF,UAAU,OAAO,QAAQ,SAAS;CAClC,SAAS,OAAO;CAChB,WAAW,OAAO;CAClB,OAAO,OAAO,SAAS;EAAC;EAAS;EAAqB;EAAQ;CAAS,CAAC;AAC1E,CAAC,CAAC,CAAC,CAAC;AAwCJ,IAAaC,YAAb,cAA6B,QAAQ,QAA4B,CAAC,CAChE,6CACF,CAAC,CAAC,CAAC;;;;AChEH,SAAgB,WAAW,OAAqD;CAC9E,MAAM,SAASC,QAAiB,KAAK;CACrC,MAAM,cAAc,UAAU,QAAQ,EAAE,qBAAqB,KAAK,CAAC;CACnE,IAAI,gBAAgB,MAClB,MAAM,IAAIC,QAAkB,EAAE,SAAS,8CAA8C,CAAC;CAExF,MAAM,SAAS,OAAO,MAAM,GAAG;CAC/B,MAAM,oBAAoB,YAAY,MAAM,GAAG,CAAC,CAAC;CACjD,MAAM,SAAuC,CAAC;CAC9C,KAAK,IAAI,QAAQ,GAAG,SAAS,OAAO,SAAS,mBAAmB,SAAS,GACvE,OAAO,KAAKD,QAAiB,OAAO,MAAM,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;CAE7D,OAAO;AACT;;;;;;;;;;ACVA,MAAa,YAAY,OAAO,OAAO;CACrC,WAAW,OAAO;CAClB,IAAI,OAAO;CACX,MAAME;CACN,aAAa,OAAO,MAAMA,QAAa;CACvC,YAAY,OAAO;CACnB,QAAQ,OAAO,SAAS;EAAC;EAAU;EAAW;CAAS,CAAC;AAC1D,CAAC;AAeD,MAAa,UAAU,KAAK,WAAoB;AAMhD,IAAaC,YAAb,cAA6B,QAAQ,QAA4B,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC;;AAGhG,SAAgB,KAAK,SAA2C;CAC9D,OAAOA,UAAQ,GAAG,EAChB,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAAW,QAAQ;EAC/D,KAAK,MAAM,QAAQC,WAAiB,MAAM,GAAG;GAC3C,MAAM,UAAU,aACb,OAAO,OAAO,QACb,UACC,WACC,OAAO,UAAU,IAAI,CAAC,CAAC,KACrB,OAAO,KAAK,UACV,MACG,QAAQ,SAAS,KAAK,SAAS,IAAI,CAAC,CACpC,KAAK,UAAU;IACd,WAAW;KAAE,GAAG;KAAM,YAAY,OAAO,SAAS;IAAG;IACrD,UAAU,OAAO;GACnB,EAAE,CACN,CACF,GACF,EAAE,aAAa,YAAY,CAC7B,EAAA,CAAG,KAAK,CACV;GACA,MAAM,QAAQ,QAAQ;GACtB,IAAI,QAAQ,WAAW,KAAK,UAAU,KAAA,GACpC,OAAO,QAAQ,SAAS,KAAK;GAE/B,IAAI,QAAQ,SAAS,GACnB,OAAO,QAAQ,kBAAkB,EAC/B,YAAY,QAAQ,KAAK,EAAE,gBAAgB,SAAS,EACtD,CAAC;EAEL;EACA,OAAO,QAAQ,SAAS,EAAE,OAAO,CAAC;CACpC,CAAC,EACH,CAAC;AACH;AAEA,SAAS,YACP,SAOC;CACD,MAAM,yBAAS,IAAI,IAAsC;CACzD,KAAK,MAAM,SAAS,SAAS;EAC3B,MAAM,MAAM;GACV,MAAM,UAAU;GAChB,MAAM,UAAU;GAChB,MAAM,UAAU;GAChB,MAAM,UAAU;EAClB,CAAC,CAAC,KAAK,GAAG;EAEV,IADiB,OAAO,IAAI,GACjB,MAAM,KAAA,GAAW,OAAO,IAAI,KAAK,KAAK;CACnD;CACA,OAAO,CAAC,GAAG,OAAO,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,UACtC,aAAa,KAAK,SAAS,CAAC,CAAC,cAAc,aAAa,MAAM,SAAS,CAAC,CAC1E;AACF;AAEA,SAAS,aAAa,WAA8B;CAClD,OAAO;EAAC,UAAU;EAAM,UAAU;EAAY,UAAU;EAAW,UAAU;CAAE,CAAC,CAAC,KAAK,GAAG;AAC3F;;;;;;;;;;;;;;;;;;;;;;ACjGA,MAAa,OAAOC,OAAE,SAAS;CAAC;CAAK;CAAQ;CAAS;CAAO;CAAM;CAAO;CAAM;AAAK,CAAC;AAGtF,MAAa,sBAAsBA,OAAE,OAAO;CAC1C,WAAWA,OAAE,OAAO,MAAMA,OAAE,YAAY,CAAC,CAAC;CAC1C,YAAYA,OAAE,OAAO,MAAMA,OAAE,YAAY,CAAC,CAAC;CAC3C,SAASA,OAAE,OAAO,MAAMA,OAAE,YAAY,CAAC,CAAC;AAC1C,CAAC;AAGD,MAAM,eAAe;CACnB,UAAU;CACV,MAAMC;CACN,QAAQD,OAAE,SAAS,CAAC,aAAa,QAAQ,CAAC;CAC1C,KAAKA,OAAE,OAAOA,OAAE,IAAI,MAAMA,OAAE,UAAU;EAAE,SAAS;EAAI,SAAS;CAAc,CAAC,CAAC,CAAC;AACjF;AAEA,MAAM,wBAAwB;CAAE,GAAG;CAAc,QAAQA,OAAE,QAAQ,WAAW;AAAE;AAChF,MAAM,UAAUA,OAAE,OAAO,MACvBA,OAAE,YAAY,UAAW,OAAO,KAAK,IAAI,KAAA,IAAY,0BAA2B,CAClF;AACA,MAAM,cAAcA,OAAE,OAAO,MAC3BA,OAAE,YAAY,UAAW,OAAO,KAAK,IAAI,KAAA,IAAY,0BAA2B,CAClF;AACA,MAAM,OAAOA,OAAE,IAAI,MAAMA,OAAE,UAAU;CAAE,SAAS;CAAG,SAAS;AAAO,CAAC,CAAC;AACrE,MAAM,WAAWA,OAAE,IAAI,MAAMA,OAAE,UAAU;CAAE,SAAS;CAAG,SAAS;AAAO,CAAC,CAAC;AAEzE,MAAaE,WAASF,OAAE,YAAY;CAClC,GAAG;EAAE,GAAG;EAAc,SAAS;CAAQ;CACvC,MAAM;EAAE,GAAG;EAAc,SAAS;CAAY;CAC9C,OAAO;EAAE,GAAG;EAAuB,QAAQC;CAAkB;CAC7D,KAAK;EAAE,GAAG;EAAc,OAAOD,OAAE,OAAO,MAAMA,OAAE,YAAY,CAAC,CAAC;CAAE;CAChE,IAAI;EAAE,GAAG;EAAc,UAAUC;EAAmB,UAAU;CAAS;CACvE,KAAK;EACH,GAAG;EACH,OAAOD,OAAE,IAAI,MAAMA,OAAE,UAAU;GAAE,SAAS;GAAG,SAAS;EAAI,CAAC,CAAC;EAC5D,KAAKA,OAAE,SAAS;GAAC;GAAS;GAAa;EAAO,CAAC;EAC/C,OAAOA,OAAE,OAAO,MAAMA,OAAE,YAAY,CAAC,CAAC;CACxC;CACA,IAAI;EAAE,GAAG;EAAc,QAAQC;CAAkB;CACjD,KAAK;EACH,GAAG;EACH,MAAM;EACN,UAAU;EACV,QAAQA;EACR,QAAQ;CACV;AACF,CAAC;AACD,MAAa,EACX,GACA,MAAM,MACN,KAAK,KACL,OAAO,OACP,IAAI,IACJ,IAAI,IACJ,KAAK,KACL,KAAK,QACHC,SAAO;;AAKX,MAAa,SAASF,OAAE,OAAO;CAC7B,MAAMA,OAAE,QAAQ,QAAQ;CACxB,MAAMA,OAAE,OAAO,MAAMA,OAAE,YAAY,CAAC,CAAC;CACrC,kBAAkBA,OAAE,OAAOA,OAAE,MAAM;CACnC,cAAcA,OAAE,OAAO,MAAMA,OAAE,YAAY,CAAC,CAAC;AAC/C,CAAC;;AAID,MAAa,WAAWA,OAAE,MAAM,CAACE,UAAQ,MAAM,CAAC;AAGhD,MAAaC,WAAS,OAAO,GAAG,kBAAkB,CAAC,EAAE,UACnDH,OAAE,oBAAoBE,QAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KACnC,OAAO,UAAU,UAAU,IAAIE,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AAEA,SAAgB,MAAM,OAA2B;CAC/C,IAAI;EACF,OAAOJ,OAAE,kBAAkBE,QAAM,CAAC,CAAC,KAAK;CAC1C,SAAS,OAAO;EACd,MAAM,IAAIE,QAAkB,EAC1B,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAChE,CAAC;CACH;AACF;AAEA,SAAgB,KAAK,QAA8D;CACjF,QAAQ,OAAO,MAAf;EACE,KAAK;EACL,KAAK,QACH,OAAO,EAAE,SAAS,OAAO,QAAQ;EACnC,KAAK;EACL,KAAK,MACH,OAAO,EAAE,QAAQ,OAAO,OAAO;EACjC,KAAK,OACH,OAAO,EAAE,OAAO,OAAO,MAAM;EAC/B,KAAK,MACH,OAAO;GAAE,UAAU,OAAO;GAAU,UAAU,OAAO;EAAS;EAChE,KAAK,OACH,OAAO;GAAE,OAAO,OAAO;GAAO,KAAK,OAAO;GAAK,OAAO,OAAO;EAAM;EACrE,KAAK,OACH,OAAO;GACL,MAAM,OAAO;GACb,UAAU,OAAO;GACjB,QAAQ,OAAO;GACf,QAAQ,OAAO;EACjB;CACJ;AACF;AAEA,SAAgB,OAAO,MAAiB,OAA2B;CACjE,OACE,KAAK,SAAS,MAAM,QACpB,KAAK,SAAS,MAAM,QACpB,KAAK,UAAU,KAAK,IAAI,CAAC,MAAM,KAAK,UAAU,KAAK,KAAK,CAAC;AAE7D;AAEA,SAAS,OAAO,OAAwB;CACtC,MAAM,QAAQ,MAAM,MAAM,GAAG;CAC7B,OACE,MAAM,WAAW,KACjB,MAAM,OACH,SAAS,YAAY,KAAK,IAAI,KAAK,OAAO,IAAI,KAAK,OAAO,OAAO,OAAO,IAAI,CAAC,MAAM,IACtF;AAEJ;AAEA,SAAS,OAAO,OAAwB;CACtC,IAAI;EACF,OAAO,IAAI,IAAI,WAAW,MAAM,GAAG,CAAC,CAAC,SAAS,WAAW,GAAG;CAC9D,QAAQ;EACN,OAAO;CACT;AACF;;;;;;;;;;;ACtIA,MAAa,cAAc,OAAO,SAAS;CACzC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAGD,IAAaC,UAAb,cAA2B,OAAO,YAAmB,CAAC,CAAC,iBAAiB;CACtE,OAAO,OAAO,YAAY,OAAO,OAAO;CACxC,MAAM,OAAO,YAAY,OAAO,MAAM,CAAC,OAAO,QAAQ,OAAO,MAAM,CAAC,CAAC;CACrE,SAAS,OAAO;CAChB,WAAW,OAAO;CAClB,YAAY,OAAO;CACnB,QAAQ,OAAO,YAAY,WAAW;CACtC,cAAc,OAAO,YAAY,OAAO,MAAM;CAC9C,QAAQ,OAAO,YAAY,OAAO,MAAM;AAC1C,CAAC,CAAC,CAAC,CAAC;AAsBJ,IAAaC,YAAb,cAA6B,QAAQ,QAA4B,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC;AAiB9F,MAAa,aAAa,aACxBA,UAAQ,GAAG;CACT,IAAI,SAAS;CACb,cAAc,OAAO,GAAG,0BAA0B,CAAC,EAAE,MAAM,WACzD,OAAO,WAAW;EAChB,WAAW,SAAS,aAAa,MAAM,MAAM;EAC7C,QAAQ,UAAU,QAAQ,UAAU,gBAAgB,KAAK;CAC3D,CAAC,CACH;CACA,cAAc,OAAO,GAAG,0BAA0B,CAAC,EAAE,MAAM,qBACzD,OAAO,WAAW;EAChB,WAAW,SAAS,aAAa,MAAM,gBAAgB;EACvD,QAAQ,UAAU,QAAQ,UAAU,gBAAgB,KAAK;CAC3D,CAAC,CACH;CACA,WAAW,OAAO,GAAG,uBAAuB,CAAC,EAAE,MAAM,qBACnD,OAAO,WAAW;EAChB,WAAW,SAAS,UAAU,MAAM,gBAAgB;EACpD,QAAQ,UAAU,QAAQ,UAAU,aAAa,KAAK;CACxD,CAAC,CACH;CACA,aAAa,OAAO,GAAG,yBAAyB,CAAC,EAAE,SACjD,OAAO,WAAW;EAChB,WAAW,SAAS,YAAY,IAAI;EACpC,QAAQ,UAAU,QAAQ,UAAU,eAAe,KAAK;CAC1D,CAAC,CACH;AACF,CAAC;AAEH,MAAaC,oBAAkB,aAC7B,MAAM,QAAQD,WAAS,UAAU,QAAQ,CAAC;AAE5C,MAAaE,aAAW,cAAyC;CAC/D,IAAI,SAAS;CACb,eAAe,MAAM,WAAW,OAAO,WAAW,SAAS,aAAa,MAAM,MAAM,CAAC;CACrF,eAAe,MAAM,qBACnB,OAAO,WAAW,SAAS,aAAa,MAAM,gBAAgB,CAAC;CACjE,YAAY,MAAM,qBAChB,OAAO,WAAW,SAAS,UAAU,MAAM,gBAAgB,CAAC;CAC9D,cAAc,SAAS,OAAO,WAAW,SAAS,YAAY,IAAI,CAAC;AACrE;AAEA,SAAS,QAAQ,UAA0B,WAAmB,OAAuB;CACnF,OAAO,iBAAiBH,UACpB,QACA,IAAIA,QAAM;EACR;EACA,SAAS,iBAAiB,WAAW,QAAQ,MAAM,UAAU,OAAO,KAAK;EACzE;EACA,YAAY,SAAS;CACvB,CAAC;AACP;;;;;;;;;;;ACvHA,IAAa,cAAb,cAAiC,OAAO,YAAyB,CAAC,CAAC,eAAe,EAChF,SAAS,OAAO,OAClB,CAAC,CAAC,CAAC,CAAC;;AAWJ,SAAgB,UAAU,OAAqB;CAC7C,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;EAC/C,MAAM,UAAU,KAAK,UAAU,KAAK;EACpC,IAAI,YAAY,KAAA,GAAW,MAAM,IAAI,UAAU,oCAAoC;EACnF,OAAO;CACT;CACA,IAAI,YAAY,KAAK,GAAG,OAAO,IAAI,MAAM,IAAI,SAAS,CAAC,CAAC,KAAK,GAAG,EAAE;CAClE,OAAO,IAAI,OAAO,QAAQ,KAAK,CAAC,CAC7B,MAAM,CAAC,OAAO,CAAC,WAAY,OAAO,QAAQ,KAAK,OAAO,QAAQ,IAAI,CAAE,CAAC,CACrE,KAAK,CAAC,KAAK,WAAW,GAAG,KAAK,UAAU,GAAG,EAAE,GAAG,UAAU,KAAK,GAAG,CAAC,CACnE,KAAK,GAAG,EAAE;AACf;AAEA,SAAS,YAAY,OAA2C;CAC9D,OAAO,MAAM,QAAQ,KAAK;AAC5B;AAEA,MAAa,aAAa,OAAO,GAAG,mBAAmB,CAAC,CAAC,WAAW,OAAe;CAKjF,OAAO,CAAC,GAAG,QAHW,OADO,OAAO,OAAA,CAEjC,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAClD,KAAK,OAAO,UAAU,UAAU,IAAI,YAAY,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAAC,CAC9D,CAAC,CAAC,KAAK,SAAS,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;AAC9E,CAAC;AAED,MAAa,aAAa,OAAO,GAAG,mBAAmB,CAAC,EAAE,UACxD,OAAO,IAAI;CACT,WAAW,UAAU,KAAK;CAC1B,QAAQ,UACN,IAAI,YAAY,EAAE,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,CAAC;AACvF,CAAC,CAAC,CAAC,KAAK,OAAO,QAAQ,UAAU,CAAC,CACpC;AAEA,SAAS,qBACP,QACA,OAC2E;CAC3E,OAAO,OAAO,aAAa,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KACxC,OAAO,UAAU,UAAU,IAAI,YAAY,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,GACtE,OAAO,QAAQ,OAAO,oBAAoB,OAAO,IAAI,CAAC,GACtD,OAAO,UAAU,UAAU,IAAI,YAAY,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,GACtE,OAAO,QAAQ,UAAU,CAC3B;AACF;AAEA,MAAa,gBAAgB,OAAO,GAAG,sBAAsB,CAAC,CAAC,oBAAoB;;AAGnF,MAAa,iBAA6C,MAAM,QAC9D,OAAO,QACP,OAAO,KAAK;CACV,cAAc,SAAS,OAAO,gBAAgB,IAAI,WAAW,IAAI,CAAC;CAClE,SAAS,WAAW,SAClB,OAAO,WAAW;EAChB,KAAK,YAAY;GACf,MAAM,QAAQ,IAAI,WAAW,KAAK,UAAU;GAC5C,MAAM,IAAI,IAAI;GACd,OAAO,IAAI,WAAW,MAAM,OAAO,OAAO,OAAO,WAAW,MAAM,MAAM,CAAC;EAC3E;EACA,QAAQ,UACN,cAAc,YAAY;GACxB,MAAM;GACN,QAAQ;GACR,QAAQ;GACR;EACF,CAAC;CACL,CAAC;AACL,CAAC,CACH;;;;;;;;;;;;;AC7EA,MAAaI,cAAYC,OAAE,YAAY;CACrC,QAAQ;EACN,IAAIA,OAAE;EACN,aAAaC;CACf;CACA,MAAM;EACJ,IAAID,OAAE;EACN,aAAaC;EACb,UAAUD,OAAE;CACd;CACA,UAAU;EACR,UAAUA,OAAE,MAAME,QAAkB;EACpC,IAAIF,OAAE;EACN,QAAQA,OAAE;EACV,aAAaC;CACf;AACF,CAAC;AAGD,MAAaE,WAASH,OAAE,OAAO;CAC7B,QAAQA,OAAE;CACV,YAAYA,OAAE,MAAMD,WAAS;CAC7B,YAAYC,OAAE;CACd,SAASA,OAAE,QAAQ,uBAAuB;CAC1C,MAAMI;AACR,CAAC;AAGD,MAAaC,kBAAgBL,OAAE,OAAO;CACpC,cAAcA,OAAE;CAChB,cAAcA,OAAE,MAAMA,OAAE,MAAM;CAC9B,YAAYA,OAAE;CACd,SAASA,OAAE,QAAQ,iCAAiC;AACtD,CAAC;AAGD,MAAaM,YAAUN,OAAE,OAAO;CAC9B,WAAWA,OAAE;CACb,YAAYA,OAAE,MACZA,OAAE,OAAO;EACP,aAAaA,OAAE;EACf,kBAAkBA,OAAE,OAAOA,OAAE,MAAM;CACrC,CAAC,CACH;CACA,YAAYA,OAAE;CACd,YAAYA,OAAE;CACd,QAAQA,OAAE,SAAS,CAAC,YAAY,SAAS,CAAC;CAC1C,SAASA,OAAE,QAAQ,4BAA4B;CAC/C,MAAMI;AACR,CAAC;AAGD,MAAa,SAAS,OAAO,GAAG,gBAAgB,CAAC,EAAE,UACjDJ,OAAE,oBAAoBG,QAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KACnC,OAAO,UAAU,UAAU,IAAII,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AAEA,MAAa,SAASP,OAAE,WAAWG,QAAM;AACzC,MAAa,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,EAAE,UAC/DH,OAAE,oBAAoBM,SAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KACpC,OAAO,UAAU,UAAU,IAAIC,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AACA,MAAa,gBAAgBP,OAAE,WAAWM,SAAO;;;;;;;;;;;;;;;;AC5DjD,MAAME,iBAAeC,OAAE,OAAO;CAC5B,YAAYA,OAAE,MAAMC,WAAiB;CACrC,YAAYD,OAAE;CACd,SAASA,OAAE,QAAQ,uBAAuB;CAC1C,MAAME;AACR,CAAC;AAED,MAAM,oBAAoBF,OAAE,OAAO,EAAE,aAAaG,SAAiB,CAAC;AAEpE,IAAa,gBAAb,cAAmCH,OAAE,YAA2B,CAAC,CAAC,qBAAqB,EACrF,cAAcA,OAAE,MAAMA,OAAE,MAAM,EAChC,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,qBAAb,cAAwCA,OAAE,YAAgC,CAAC,CAAC,sBAAsB,EAChG,SAASA,OAAE,OACb,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,aAAb,cAAgCA,OAAE,YAAwB,CAAC,CAAC,kBAAkB;CAC5E,oBAAoBA,OAAE;CACtB,mBAAmBA,OAAE;AACvB,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,oBAAb,cAAuCA,OAAE,YAA+B,CAAC,CAAC,qBAAqB;CAC7F,UAAUA,OAAE,SAAS;EACnB;EACA;EACA;EACA;EACA;CACF,CAAC;CACD,mBAAmBA,OAAE;CACrB,SAASA,OAAE;CACX,SAASI;AACX,CAAC,CAAC,CAAC,CAAC;AAMJ,MAAa,SAAS,KAAK,WAAmB;AAU9C,MAAa,eAAe,KAAK,WAAyB;AAqC1D,SAAgBC,SACd,OAKA;CACA,MAAM,SAAS,MAAM;CACrB,IAAI,OAAO,SAAS,aAClB,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,WAAW,OAAOC;EACxB,MAAM,OAAO,OAAOC,SAAkB,OAAO,IAAI;EACjD,OAAO,aAAa,SAAS;GAC3B,WAAW;GACX,MAAM,OAAO,YAAY,UAAU,MAAM,MAAM,YAAY;EAC7D,CAAC;CACH,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,qBAAqB,CAAC;CAEhD,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,YAAY,OAAOC;EACzB,MAAM,SAAS,OAAOD,SAAkB,OAAO,MAAM;EACrD,MAAM,UAAU,OAAO,UAAU,SAAS,MAAM;EAChD,QAAQ,QAAQ,MAAhB;GACE,KAAK,YACH,OAAO,aAAa,SAAS,EAAE,QAAQ,QAAQ,OAAO,CAAC;GACzD,KAAK,qBACH,OAAO,aAAa,kBAAkB,EAAE,YAAY,QAAQ,WAAW,CAAC;GAC1E,KAAK,YACH,OAAO,aAAa,SAAS;IAC3B,WAAW,QAAQ;IACnB,MAAM,OAAO,YAAY,QAAQ,UAAU,QAAQ,UAAU,MAAM,MAAM,YAAY;GACvF,CAAC;EACL;CACF,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,qBAAqB,CAAC;AAChD;AAEA,MAAM,cAAc,OAAO,GAAG,0BAA0B,CAAC,CAAC,WACxD,UACA,MACA,QACA;CACA,MAAM,gBAAgB,OAAO,OAAO,QAAQ,QAAQE,UAAkB,EACpE,aAAa,YACf,CAAC,EAAA,CAAG,KAAK,cAAc;CACvB,MAAM,WAAW,CAAC,GAAI,OAAO,SAAS,YAAY,IAAI,CAAE,CAAC,CAAC,KAAK,cAAc;CAC7E,MAAM,EAAE,eAAe,OAAO,OAAO,OACnC,qBACsB;EAAE,YAAY,CAAC;EAAG,WAAW;CAAS,KAC3D,OAAO,gBACN,qBAAqB,aAAa,MAAM,SAAS,CAAC,CAAC,KACjD,OAAO,KAAK,eAAe;EACzB,YAAY,CAAC,GAAG,MAAM,YAAY,SAAS;EAC3C,WACE,UAAU,SAAS,WACf,CAAC,GAAG,MAAM,WAAW,UAAU,WAAW,CAAC,CAAC,KAAK,cAAc,IAC/D,MAAM;CACd,EAAE,CACJ,CACJ;CACA,MAAM,WAA+C;EACnD;EACA,YAAY,SAAS;EACrB,SAAS;EACT;CACF;CACA,OAAO;EAAE,GAAG;EAAU,QAAQ,OAAO,cAAcV,gBAAc,QAAQ;CAAE;AAC7E,CAAC;;AAQD,MAAaW,cAAY,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAC3D,MACA,cACA,UAA+C,CAAC,GAChD;CACA,OAAOC,WAAS,IAAI;CACpB,MAAM,YAAY,KAAK,WACpB,QAAQ,cAAc,UAAU,SAAS,QAAQ,CAAC,CAClD,KAAK,EAAE,SAAS,EAAE;CACrB,MAAM,WAAW,CAAC,GAAG,IAAI,IAAI,gBAAgB,SAAS,CAAC,CAAC,CAAC,KAAK;CAC9D,MAAM,UAAU,SAAS,QAAQ,OAAO,CAAC,UAAU,SAAS,EAAE,CAAC;CAC/D,IAAI,QAAQ,SAAS,GACnB,OAAO,OAAO,IAAI,mBAAmB,EACnC,SAAS,0BAA0B,QAAQ,KAAK,IAAI,IACtD,CAAC;CAEH,IAAI,CAAC,QAAQ,gBAAgB,SAAS,WAAW,UAAU,QACzD,OAAO,OAAO,IAAI,mBAAmB,EACnC,SAAS,8CACX,CAAC;CAEH,OAAO;EACL,cAAc,QAAQ,gBAAgB;EACtC,cAAc;EACd,YAAY,KAAK;EACjB,SAAS;CACX;AACF,CAAC;;AAGD,MAAaC,UAAQ,OAAO,GAAG,oBAAoB,CAAC,CAAC,WAAW,OAAmB;CACjF,MAAM,EAAE,eAAe,SAAS;CAChC,MAAM,WAAW,OAAON;CACxB,OAAOK,WAAS,IAAI;CACpB,IAAI,cAAc,eAAe,KAAK,QACpC,OAAO,OAAO,IAAI,mBAAmB,EACnC,SAAS,4CACX,CAAC;CAEH,IAAI,SAAS,OAAO,KAAK,YACvB,OAAO,OAAO,IAAI,mBAAmB,EACnC,SAAS,4CACX,CAAC;CAEH,MAAM,YAAY,KAAK,WAAW,QAAQ,cAAc,UAAU,SAAS,UAAU;CACrF,IAAI,UAAU,SAAS,GACrB,OAAO,OAAO,IAAI,cAAc,EAC9B,cAAc,UAAU,KAAK,EAAE,SAAS,EAAE,EAC5C,CAAC;CAGH,MAAM,UAAU,KAAK,WAAW,OAAA,YAAyB,OAAO,MAAM;CACtE,MAAM,WAAW,IAAI,IAAI,cAAc,YAAY;CACnD,MAAM,UAAU,cAAc,aAAa,QACxC,OAAO,CAAC,QAAQ,MAAM,cAAc,UAAU,OAAO,EAAE,CAC1D;CACA,IAAI,QAAQ,SAAS,GACnB,OAAO,OAAO,IAAI,mBAAmB,EACnC,SAAS,8CAA8C,QAAQ,KAAK,IAAI,IAC1E,CAAC;CAEH,IAAI,CAAC,cAAc,gBAAgB,QAAQ,MAAM,EAAE,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,GAC3E,OAAO,OAAO,IAAI,mBAAmB,EACnC,SAAS,sDACX,CAAC;CAGH,MAAM,cAAc,OAAO,YACzB,UACA,KAAK,MACL,KAAK,WAAW,KAAK,EAAE,kBAAkB,WAAW,CACtD;CACA,IAAI,YAAY,WAAW,KAAK,QAC9B,OAAO,OAAO,IAAI,WAAW;EAC3B,oBAAoB,KAAK;EACzB,mBAAmB,YAAY;CACjC,CAAC;CAGH,MAAM,aAGD,CAAC;CACN,KAAK,MAAM,aAAa,SAAS;EAC/B,IAAI,CAAC,SAAS,IAAI,UAAU,EAAE,GAAG;EACjC,OAAO,OAAO,IAAI,aAAa;GAC7B,OAAO,qBAAqB,MAAM,SAAS;GAC3C,MAAM,SAAS,OAAO,SAAS,aAAa,KAAK,MAAM,UAAU,WAAW;GAC5E,WAAW,KAAK;IACd,aAAa,UAAU;IACvB,kBAAkB,OAAO;GAC3B,CAAC;EACH,CAAC,CAAC,CAAC,KACD,OAAO,OAAO,YACZ,WAAW,WAAW,IAClB,OAAO,KAAK,OAAO,IACnBE,cAAY,OAAO,YAAY,SAAS,CAAC,CAAC,KACxC,OAAO,SAAS,YACd,OAAO,KACL,IAAI,kBAAkB;GACpB,UAAU,QAAQ;GAClB,mBAAmB,UAAU;GAC7B,SAAS,eAAe,OAAO;GAC/B;EACF,CAAC,CACH,CACF,CACF,CACN,GACA,OAAO,YAAY,UAAU;GAC3B,IAAI,CAAC,MAAM,kBAAkB,KAAK,KAAK,WAAW,WAAW,GAC3D,OAAO,OAAO,UAAU,KAAK;GAE/B,OAAOA,cAAY,OAAO,YAAY,SAAS,CAAC,CAAC,KAC/C,OAAO,SAAS,YACd,OAAO,KACL,IAAI,kBAAkB;IACpB,UAAU;IACV,mBAAmB,UAAU;IAC7B,SAAS;IACT;GACF,CAAC,CACH,CACF,CACF;EACF,CAAC,CACH;CACF;CACA,OAAO,OAAOA,cAAY,OAAO,YAAY,UAAU;AACzD,CAAC;AAED,SAAgB,yBAAyB,MAA8C;CACrF,OAAO,KAAK,WAAW,KAAK,cAAc;EACxC,MAAM,SAAS,UAAU;EACzB,MAAMC,SAAO,OAAO,QAAQC,KAAe,MAAM,CAAC,CAAC,CAChD,KAAK,CAAC,KAAK,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,CACxC,KAAK,GAAG;EACX,OAAO,GAAG,UAAU,KAAK,YAAY,EAAE,GAAG,OAAO,KAAK,GAAG,OAAO,KAAK,GAAGD,SAAO,KAAK;CACtF,CAAC;AACH;AAEA,SAASD,cACP,OACA,YAIA,QACqC;CACrC,OAAO,MAAM,kBAAkB,KAC7B,OAAO,KAAK,SAAS;EACnB,WAAW,IAAI,KAAK,GAAG;EACvB;EACA,YAAY,MAAM,KAAK;EACvB,YAAY,MAAM,KAAK;EACvB;EACA,SAAS;EACT,MAAM,MAAM,KAAK;CACnB,EAAE,CACJ;AACF;AAEA,SAAS,qBACP,MACA,WACoF;CACpF,OAAA,UAA2B,KACzB,OAAO,SAAS,aAAa,YAAY,UAAU,KAAK,MAAM,CAAC,UAAU,WAAW,CAAC,CAAC,GACtF,OAAO,SAAS,gBAAgB;EAC9B,MAAM,mBAAmB,YAAY,WAAW;EAChD,OAAO,kBAAkB,SAAS,YAAY,iBAAiB,OAAO,UAAU,KAC5E,OAAO,OACP,OAAO,KACL,IAAI,WAAW;GACb,oBAAoB,KAAK;GACzB,mBAAmB,YAAY;EACjC,CAAC,CACH;CACN,CAAC,CACH;AACF;AAEA,SAAS,qBACP,aACA,aAC8D;CAC9D,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,WAAW,YAAY,QAAQ,WAAW,OAAO,SAAS,YAAY,IAAI;EAChF,MAAM,UAAU,SAAS,QACtB,WACC,OAAO,SAAS,YAAY,OAAO,SAAS,YAAY,IAC5D;EACA,MAAM,QAAQ,QAAQ,MAAM,WAAWG,OAAiB,QAAQ,WAAW,CAAC;EAC5E,MAAM,KAAK,OAAO,cAAc,mBAAmB,EAAE,YAAY,CAAC;EAClE,IAAI,UAAU,KAAA,GACZ,OAAO;GACL,MAAM;GACN;GACA;GACA,UAAU,MAAM,QAAQ,YAAY;EACtC;EAKF,IAFE,SAAS,SAAS,MACjB,YAAY,SAAS,WAAW,SAAS,MAAM,WAAW,OAAO,SAAS,OAAO,IAElF,OAAO;GACL,MAAM;GACN,UAAU;GACV;GACA,QAAQ;GACR;EACF;EAEF,IACE,QAAQ,SAAS,MAChB,YAAY,WAAW,eAAe,QAAQ,MAAM,EAAE,aAAa,WAAW,WAAW,IAE1F,OAAO;GACL,MAAM;GACN,UAAU;GACV;GACA,QAAQ;GACR;EACF;EAEF,OAAO;GAAE,MAAM;GAAU;GAAI;EAAY;CAC3C,CAAC;AACH;AAEA,SAAgBL,WACd,MACoD;CACpD,MAAM,WAA+C;EACnD,YAAY,KAAK;EACjB,YAAY,KAAK;EACjB,SAAS,KAAK;EACd,MAAM,KAAK;CACb;CACA,OAAO,cAAcZ,gBAAc,QAAQ,CAAC,CAAC,KAC3C,OAAO,SAAS,WACd,WAAW,KAAK,SACZ,OAAO,OACP,OAAO,KACL,IAAI,mBAAmB,EACrB,SAAS,0CACX,CAAC,CACH,CACN,CACF;AACF;AAEA,SAAS,eAAe,SAA2C;CACjE,OAAO,QAAQ,SAAS,mBACpB,uDACA,QAAQ;AACd;AAEA,SAAS,eAAe,MAA0B,OAAmC;CACnF,MAAM,SAASC,OAAE,WAAWiB,QAAkB;CAC9C,MAAM,SAASjB,OAAE,kBAAkBA,OAAE,IAAI;CACzC,MAAM,WAAW,UAAU,OAAO,OAAO,IAAI,CAAC,CAAC;CAC/C,MAAM,YAAY,UAAU,OAAO,OAAO,KAAK,CAAC,CAAC;CACjD,OAAO,WAAW,YAAY,KAAK,WAAW,YAAY,IAAI;AAChE;;;;;;;;;;;;;;;ACxaA,MAAa,YAAYkB,OAAE,OAAO;CAChC,IAAIA,OAAE;CACN,kBAAkBA,OAAE;CACpB,QAAQC;AACV,CAAC;AAGD,MAAM,eAAeD,OAAE,OAAO;CAC5B,WAAWA,OAAE;CACb,WAAWA,OAAE;CACb,YAAYA,OAAE,MAAM,SAAS;CAC7B,YAAYA,OAAE;CACd,kBAAkBA,OAAE;CACpB,SAASA,OAAE,QAAQ,4BAA4B;CAC/C,MAAME;AACR,CAAC;AAED,MAAa,OAAOF,OAAE,OAAO;CAAE,GAAG,aAAa;CAAQ,QAAQA,OAAE;AAAO,CAAC;AAGzE,MAAa,gBAAgBA,OAAE,OAAO;CACpC,cAAcA,OAAE,MAAMA,OAAE,MAAM;CAC9B,YAAYA,OAAE;CACd,SAASA,OAAE,QAAQ,qCAAqC;AAC1D,CAAC;AAGD,MAAa,UAAUA,OAAE,OAAO;CAC9B,WAAWA,OAAE;CACb,YAAYA,OAAE,MAAMA,OAAE,OAAO;EAAE,aAAaA,OAAE;EAAQ,kBAAkBA,OAAE;CAAO,CAAC,CAAC;CACnF,YAAYA,OAAE;CACd,YAAYA,OAAE;CACd,QAAQA,OAAE,SAAS,CAAC,YAAY,SAAS,CAAC;CAC1C,SAASA,OAAE,QAAQ,+BAA+B;CAClD,MAAME;AACR,CAAC;AAGD,IAAaC,UAAb,cAA2BH,OAAE,YAAmB,CAAC,CAAC,uBAAuB;CACvE,SAASA,OAAE;CACX,aAAaA,OAAE,YAAYA,OAAE,MAAM;AACrC,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,eAAb,cAAkCA,OAAE,YAA0B,CAAC,CAAC,wBAAwB;CACtF,mBAAmBA,OAAE;CACrB,SAASA,OAAE;CACX,SAAS;AACX,CAAC,CAAC,CAAC,CAAC;;AASJ,MAAa,SAAS,OAAO,GAAG,iBAAiB,CAAC,CAAC,WAAW,OAAoB;CAChF,MAAM,WAAW,OAAOI;CACxB,OAAOC,WAAsB,MAAM,IAAI;CACvC,IACE,MAAM,QAAQ,eAAe,MAAM,KAAK,UACxC,MAAM,QAAQ,eAAe,MAAM,KAAK,cACxC,MAAM,QAAQ,SAAS,MAAM,KAAK,MAElC,OAAO,OAAO,IAAIF,QAAM,EAAE,SAAS,oDAAoD,CAAC;CAE1F,IAAI,SAAS,OAAO,MAAM,KAAK,YAC7B,OAAO,OAAO,IAAIA,QAAM,EAAE,SAAS,6CAA6C,CAAC;CAEnF,MAAM,aAAa,OAAO,OAAO,QAAQ,MAAM,QAAQ,aAAa,YAClE,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,MAAM,KAAK,WAAW,MAClC,cAAc,UAAU,SAAS,YAAY,UAAU,OAAO,QAAQ,WACzE;EACA,IAAI,WAAW,KAAA,KAAa,OAAO,SAAS,UAC1C,OAAO,OAAO,IAAIA,QAAM;GACtB,SAAS;GACT,aAAa,QAAQ;EACvB,CAAC;EAEH,IAAI,QAAQ,qBAAqB,MAC/B,OAAO,OAAO,IAAIA,QAAM;GACtB,SAAS;GACT,aAAa,QAAQ;EACvB,CAAC;EAEH,OAAO,YACL,UACA,MAAM,KAAK,MACX,QAAQ,kBACR,OAAO,aACP,OAAO,EACT;EACA,OAAO;GACL,IAAI,OAAO;GACX,kBAAkB,QAAQ;GAC1B,QAAQ,OAAO;EACjB;CACF,CAAC,CACH;CACA,MAAM,MAAM,OAAO,MAAM;CACzB,MAAM,WAA+C;EACnD,WAAW,IAAI,KAAK,GAAG;EACvB,WAAW,IAAI,KAAK,OAAO,MAAM,SAAS,IAAY;EACtD;EACA,YAAY,MAAM,KAAK;EACvB,kBAAkB,MAAM,KAAK;EAC7B,SAAS;EACT,MAAM,MAAM,KAAK;CACnB;CACA,OAAO;EAAE,GAAG;EAAU,QAAQ,OAAO,cAAc,cAAc,QAAQ;CAAE;AAC7E,CAAC;;AAGD,MAAa,YAAY,OAAO,GAAG,oBAAoB,CAAC,CAAC,WACvD,MACA,cACA;CACA,OAAO,SAAS,IAAI;CACpB,MAAM,WAAW,CAAC,GAAG,IAAI,IAAI,gBAAgB,KAAK,WAAW,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK;CACxF,MAAM,UAAU,SAAS,QACtB,OAAO,CAAC,KAAK,WAAW,MAAM,cAAc,UAAU,OAAO,EAAE,CAClE;CACA,IAAI,QAAQ,SAAS,GACnB,OAAO,OAAO,IAAIA,QAAM,EAAE,SAAS,mCAAmC,QAAQ,KAAK,IAAI,IAAI,CAAC;CAE9F,OAAO;EACL,cAAc;EACd,YAAY,KAAK;EACjB,SAAS;CACX;AACF,CAAC;;AAGD,MAAa,QAAQ,OAAO,GAAG,gBAAgB,CAAC,CAAC,WAAW,OAIzD;CACD,MAAM,WAAW,OAAOC;CACxB,OAAO,SAAS,MAAM,IAAI;CAC1B,IAAI,MAAM,cAAc,eAAe,MAAM,KAAK,QAChD,OAAO,OAAO,IAAID,QAAM,EAAE,SAAS,qDAAqD,CAAC;CAE3F,IAAI,SAAS,OAAO,MAAM,KAAK,YAC7B,OAAO,OAAO,IAAIA,QAAM,EAAE,SAAS,4CAA4C,CAAC;CAElF,MAAM,MAAM,OAAO,MAAM;CACzB,IAAI,MAAM,KAAK,aAAa,IAAI,KAAK,GAAG,GACtC,OAAO,OAAO,IAAIA,QAAM,EAAE,SAAS,4BAA4B,CAAC;CAElE,MAAM,WAAW,MAAM,KAAK,WAAW,QAAQ,EAAE,SAC/C,MAAM,cAAc,aAAa,SAAS,EAAE,CAC9C;CACA,IAAI,SAAS,WAAW,MAAM,cAAc,aAAa,QACvD,OAAO,OAAO,IAAIA,QAAM,EAAE,SAAS,qDAAqD,CAAC;CAE3F,MAAM,oBAAoB,OAAO,qBAAqB,MAAM,MAAM,MAAM,YAAY;CACpF,MAAM,eAAe,IAAI,IAAI,kBAAkB,KAAK,EAAE,kBAAkB,WAAW,CAAC;CACpF,IACE,kBAAkB,MACf,EAAE,kBAAkB,CAAC,MAAM,cAAc,aAAa,SAAS,WAAW,CAC7E,GAEA,OAAO,OAAO,IAAIA,QAAM,EAAE,SAAS,mDAAmD,CAAC;CAEzF,MAAM,YAAY,SAAS,QAAQ,EAAE,SAAS,CAAC,aAAa,IAAI,EAAE,CAAC;CACnE,OAAO,OAAO,QAAQ,YAAY,cAChC,YACE,UACA,MAAM,KAAK,MACX,UAAU,kBACV,UAAU,QACV,UAAU,EACZ,CACF;CAEA,MAAM,UAAoE,CAAC,GAAG,iBAAiB;CAC/F,KAAK,MAAM,aAAa,WAAW;EACjC,MAAM,UAAU,OAAO,OAAO,IAAI,aAAa;GAC7C,OAAO,YACL,UACA,MAAM,KAAK,MACX,UAAU,kBACV,UAAU,QACV,UAAU,EACZ;GACA,OAAO,SAAS,aAAa,MAAM,KAAK,MAAM,UAAU,gBAAgB;GACxE,QAAQ,KAAK;IAAE,aAAa,UAAU;IAAI,kBAAkB,UAAU;GAAiB,CAAC;EAC1F,CAAC,CAAC,CAAC,KAAK,OAAO,MAAM;GAAE,YAAY,UAAU;GAAO,iBAAiB;EAAK,CAAC,CAAC;EAC5E,IAAI,YAAY,MAAM;GACpB,IAAI,QAAQ,WAAW,GAAG,OAAO,OAAO;GACxC,OAAO,OAAO,IAAI,aAAa;IAC7B,mBAAmB,UAAU;IAC7B,SAAS,QAAQ;IACjB,SAAS,OAAO,YAAY,MAAM,MAAM,SAAS,SAAS;GAC5D,CAAC;EACH;CACF;CACA,OAAO,OAAO,YAAY,MAAM,MAAM,SAAS,UAAU;AAC3D,CAAC;AAED,SAAgB,SAAS,MAAqE;CAC5F,MAAM,WAA+C;EACnD,WAAW,KAAK;EAChB,WAAW,KAAK;EAChB,YAAY,KAAK;EACjB,YAAY,KAAK;EACjB,kBAAkB,KAAK;EACvB,SAAS,KAAK;EACd,MAAM,KAAK;CACb;CACA,OAAO,cAAc,cAAc,QAAQ,CAAC,CAAC,KAC3C,OAAO,SAAS,WACd,WAAW,KAAK,SACZ,OAAO,OACP,OAAO,KAAK,IAAIA,QAAM,EAAE,SAAS,mDAAmD,CAAC,CAAC,CAC5F,CACF;AACF;AAEA,SAAS,qBACP,MACA,SACwF;CACxF,IAAI,YAAY,KAAA,GAAW,OAAO,OAAO,QAAQ,CAAC,CAAC;CACnD,IACE,QAAQ,eAAe,KAAK,UAC5B,QAAQ,eAAe,KAAK,cAC5B,QAAQ,SAAS,KAAK,QACtB,QAAQ,WAAW,WAEnB,OAAO,OAAO,KACZ,IAAIA,QAAM,EAAE,SAAS,sDAAsD,CAAC,CAC9E;CAEF,KAAK,MAAM,aAAa,QAAQ,YAAY;EAC1C,MAAM,YAAY,KAAK,WAAW,MAAM,EAAE,SAAS,OAAO,UAAU,WAAW;EAC/E,IAAI,cAAc,KAAA,KAAa,UAAU,qBAAqB,UAAU,kBACtE,OAAO,OAAO,KACZ,IAAIA,QAAM,EAAE,SAAS,2DAA2D,CAAC,CACnF;CAEJ;CACA,OAAO,OAAO,QAAQ,CAAC,GAAG,QAAQ,UAAU,CAAC;AAC/C;AAEA,SAAS,YACP,UACA,MACA,kBACA,UACA,aACgD;CAChD,OAAO,SAAS,UAAU,MAAM,gBAAgB,CAAC,CAAC,KAChD,OAAO,SAAS,aACd,aAAa,QAAQ,SAAS,SAAS,YAAYG,OAAiB,UAAU,QAAQ,IAClF,OAAO,OACP,OAAO,KACL,IAAIH,QAAM;EACR,SACE,aAAa,OACT,oCACA;EACN;CACF,CAAC,CACH,CACN,CACF;AACF;AAEA,SAAS,YACP,MACA,YACA,QACwB;CACxB,OAAO,MAAM,kBAAkB,KAC7B,OAAO,KAAK,SAAS;EACnB,WAAW,IAAI,KAAK,GAAG;EACvB;EACA,YAAY,KAAK;EACjB,YAAY,KAAK;EACjB;EACA,SAAS;EACT,MAAM,KAAK;CACb,EAAE,CACJ;AACF;;;;;;;;;;;AC9RA,MAAa,SAAS,OAAO,OAAO;CAClC,MAAM,OAAO;CACb,MAAMI;CACN,KAAK,OAAO,IAAI,MAAM,OAAO,uBAAuB,CAAC,CAAC;CACtD,MAAMC;AACR,CAAC;AAGD,MAAa,aAAa,OAAO,YAAY;CAC3C,QAAQ,EAAE,SAAS,OAAO,MAAM,MAAM,EAAE;CACxC,QAAQ,CAAC;AACX,CAAC;AAGD,IAAaC,UAAb,cAA2B,OAAO,YAAmB,CAAC,CAAC,iBAAiB;CACtE,OAAO,OAAO,YAAY,OAAO,OAAO;CACxC,SAAS,OAAO;CAChB,QAAQ,OAAO,SAAS;EAAC;EAAY;EAAW;CAAW,CAAC;AAC9D,CAAC,CAAC,CAAC,CAAC;AAMJ,IAAa,UAAb,cAA6B,QAAQ,QAA4B,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC;AAW9F,MAAa,kBAAkB,aAC7B,MAAM,QAAQ,SAAS,EACrB,SAAS,OAAO,GAAG,qBAAqB,CAAC,EAAE,UACzC,OAAO,WAAW;CAChB,WAAW,SAAS,QAAQ,KAAK;CACjC,QAAQ,UACN,IAAIA,QAAM;EACR;EACA,SAAS,iBAAiB,WAAW,QAAQ,MAAM,UAAU,OAAO,KAAK;EACzE,QAAQ;CACV,CAAC;AACL,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,eAAe;CAC7B,QAAQ,WAAW,MAAnB;EACE,KAAK;EACL,KAAK,UACH,OAAO,OAAO,QAAQ,UAAU;EAClC,KAAK,WACH,OAAO,OAAO,KAAK,IAAIA,QAAM;GAAE,SAAS;GAAuB,QAAQ;EAAU,CAAC,CAAC;EACrF,KAAK,WACH,OAAO,OAAO,KAAK,IAAIA,QAAM;GAAE,SAAS,WAAW;GAAS,QAAQ;EAAY,CAAC,CAAC;CACtF;AACF,CAAC,CACH,CACF,EACF,CAAC;AAEH,MAAa,WAAW,cAAyC,EAC/D,UAAU,UACR,OAAO,WACL,SAAS,QAAQ,KAAK,CAAC,CAAC,KACtB,OAAO,MAAM;CACX,YAAY,YACV,QAAQ,WAAW,YACf,EAAE,MAAM,UAAU,IAClB;EAAE,MAAM;EAAW,SAAS,QAAQ;CAAQ;CAClD,YAAY,eAAe;AAC7B,CAAC,CACH,CACF,EACJ"}