domainkit 0.5.0 → 0.7.0

package/dist/server.d.mts

@@ -0,0 +1,128 @@
+import { O as Service, a as Continuation, l as InteractiveFlow } from "./connect-10vHuShV.mjs";
+import "./connection-api-DW7xUJdj.mjs";
+import { i as AsyncInterface, t as InteractiveFlow$1 } from "./connection-C0xsU41C.mjs";
+import { Context, Crypto, Effect, Layer, Schema } from "effect";
+declare namespace index_d_exports {
+  export { AsyncConnectionPolicy, AsyncIdentity, AsyncInteractiveFlow, AsyncInteractiveProvider, AsyncPendingAuthorizations, AuthorizationReuseInput, Configuration, ConnectionPolicy, ConnectionPolicyInterface, CreateDomainKitOptions, DEFAULT_BASE_PATH, Error, Handler, Identity, IdentityInterface, InteractiveFlowInput, InteractiveProvider, Interface, PendingAuthorization, PendingAuthorizationContext, PendingAuthorizations, PendingAuthorizationsInterface, Principal, Providers, ProvidersInterface, WebHandler, createDomainKit, layer, make, providersLayer, toWebHandler };
+}
+declare const DEFAULT_BASE_PATH = "/api/domainkit";
+declare const Error_base: Schema.Class<Error, Schema.TaggedStruct<"DomainKitServerError", {
+  readonly category: Schema.Literals<readonly ["authentication", "authorization", "configuration", "provider", "request", "storage"]>;
+  readonly message: Schema.String;
+  readonly operation: Schema.String;
+  readonly retry: Schema.Literals<readonly ["never", "after-user-action", "safe", "unknown"]>;
+}>, import("effect/Cause").YieldableError>;
+declare class Error extends Error_base {}
+interface Principal {
+  readonly authorizedById: string;
+  readonly ownerId: string;
+}
+interface IdentityInterface {
+  readonly authenticate: (request: Request) => Effect.Effect<Principal, Error>;
+}
+declare const Identity_base: Context.ServiceClass<Identity, "@domainkit/server/Identity", IdentityInterface>;
+declare class Identity extends Identity_base {}
+interface AuthorizationReuseInput {
+  readonly authorizationId: string;
+  readonly domain: string | undefined;
+  readonly method: "integration" | "oauth2";
+  readonly principal: Principal;
+  readonly providerId: string;
+}
+interface ConnectionPolicyInterface {
+  readonly authorizeReuse: (input: AuthorizationReuseInput) => Effect.Effect<void, Error>;
+}
+declare const ConnectionPolicy_base: Context.ServiceClass<ConnectionPolicy, "@domainkit/server/ConnectionPolicy", ConnectionPolicyInterface>;
+/** Host authorization boundary for reusing an existing provider authorization. */
+declare class ConnectionPolicy extends ConnectionPolicy_base {}
+interface InteractiveFlowInput {
+  readonly callbackUrl: URL;
+  readonly domain: string | undefined;
+  readonly method: "integration" | "oauth2";
+  readonly providerId: string;
+}
+interface ProvidersInterface {
+  readonly interactiveFlow: (input: InteractiveFlowInput) => Effect.Effect<InteractiveFlow, Error>;
+}
+declare const Providers_base: Context.ServiceClass<Providers, "@domainkit/server/Providers", ProvidersInterface>;
+declare class Providers extends Providers_base {}
+interface InteractiveProvider {
+  readonly create: (input: Omit<InteractiveFlowInput, "method" | "providerId">) => Effect.Effect<InteractiveFlow, Error>;
+  readonly method: "integration" | "oauth2";
+  readonly providerId: string;
+}
+/** Configure all interactive providers once at the host composition root. */
+declare const providersLayer: (definitions: ReadonlyArray<InteractiveProvider>) => Layer.Layer<Providers>;
+interface PendingAuthorizationContext {
+  readonly baseURL: string;
+  readonly domain: string | undefined;
+  readonly method: "integration" | "oauth2";
+  readonly providerId: string;
+  readonly returnTo: string;
+}
+interface PendingAuthorization {
+  readonly context: PendingAuthorizationContext;
+  readonly continuation: Continuation;
+}
+interface PendingAuthorizationsInterface {
+  readonly consume: (id: string, now: Date) => Effect.Effect<PendingAuthorization | null, Error>;
+  readonly get: (id: string, now: Date) => Effect.Effect<PendingAuthorization | null, Error>;
+  readonly put: (pending: PendingAuthorization) => Effect.Effect<void, Error>;
+}
+declare const PendingAuthorizations_base: Context.ServiceClass<PendingAuthorizations, "@domainkit/server/PendingAuthorizations", PendingAuthorizationsInterface>;
+declare class PendingAuthorizations extends PendingAuthorizations_base {}
+interface Configuration {
+  /** Public origin used to construct provider callbacks. Defaults to the incoming request origin. */
+  readonly baseURL?: string;
+  /** Catch-all mount path. */
+  readonly basePath?: string;
+  /** Relative same-origin destination used when a start request omits `returnTo`. */
+  readonly defaultReturnTo?: string;
+}
+interface AsyncIdentity {
+  readonly authenticate: (request: Request) => Promise<Principal>;
+}
+interface AsyncConnectionPolicy {
+  readonly authorizeReuse: (input: AuthorizationReuseInput) => Promise<void>;
+}
+type AsyncInteractiveFlow = InteractiveFlow$1;
+interface AsyncInteractiveProvider {
+  readonly create: (input: Omit<InteractiveFlowInput, "method" | "providerId">) => Promise<AsyncInteractiveFlow>;
+  readonly method: "integration" | "oauth2";
+  readonly providerId: string;
+}
+interface AsyncPendingAuthorizations {
+  readonly consume: (id: string, now: Date) => Promise<PendingAuthorization | null>;
+  readonly get: (id: string, now: Date) => Promise<PendingAuthorization | null>;
+  readonly put: (pending: PendingAuthorization) => Promise<void>;
+}
+interface CreateDomainKitOptions extends Configuration {
+  readonly connectionPolicy: AsyncConnectionPolicy;
+  readonly identity: AsyncIdentity;
+  readonly pendingAuthorizations: AsyncPendingAuthorizations;
+  /** Host-owned Promise persistence. DomainKit does not initialize or dispose this resource. */
+  readonly persistence: AsyncInterface;
+  readonly providers: ReadonlyArray<AsyncInteractiveProvider>;
+}
+interface Interface {
+  readonly handle: (request: Request) => Effect.Effect<Response>;
+}
+declare const Handler_base: Context.ServiceClass<Handler, "@domainkit/server/Handler", Interface>;
+declare class Handler extends Handler_base {}
+/** Construct the Effect-native server handler from host-provided services. */
+declare const make: (configuration?: Configuration) => Effect.Effect<Interface, never, ConnectionPolicy | Crypto.Crypto | Identity | PendingAuthorizations | Providers | Service>;
+/** Provide the Effect-native server handler as a Layer. */
+declare const layer: (configuration?: Configuration) => Layer.Layer<Handler, never, ConnectionPolicy | Crypto.Crypto | Identity | PendingAuthorizations | Providers | Service>;
+interface WebHandler {
+  readonly dispose: () => Promise<void>;
+  readonly fetch: (request: Request) => Promise<Response>;
+}
+/** Build one reusable Web handler from a fully provided Effect server Layer. */
+declare function toWebHandler<E>(serverLayer: Layer.Layer<Handler, E>): WebHandler;
+/**
+ * Build a Web handler for async hosts. The host owns persistence setup, migrations, and disposal.
+ */
+declare function createDomainKit(options: CreateDomainKitOptions): Promise<WebHandler>;
+//#endregion
+export { index_d_exports as Server, createDomainKit };
+//# sourceMappingURL=server.d.mts.map

package/dist/server.mjs

@@ -0,0 +1,319 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
+import { i as webCryptoLayer, o as Error$1, s as Service } from "./canonical-json-CQYKsZw7.mjs";
+import { a as start, i as complete, n as Method, t as Error$2 } from "./connect-oI8hcMxc.mjs";
+import { t as layerFromAsync } from "./managed-dns-connections-C3A_GBaz.mjs";
+import { Context, Crypto, Effect, Layer, ManagedRuntime, Schema } from "effect";
+//#region src/server/index.ts
+var server_exports = /* @__PURE__ */ __exportAll({
+	ConnectionPolicy: () => ConnectionPolicy,
+	DEFAULT_BASE_PATH: () => DEFAULT_BASE_PATH,
+	Error: () => Error,
+	Handler: () => Handler,
+	Identity: () => Identity,
+	PendingAuthorizations: () => PendingAuthorizations,
+	Providers: () => Providers,
+	createDomainKit: () => createDomainKit,
+	layer: () => layer,
+	make: () => make,
+	providersLayer: () => providersLayer,
+	toWebHandler: () => toWebHandler
+});
+const DEFAULT_BASE_PATH = "/api/domainkit";
+var Error = class extends Schema.TaggedError()("DomainKitServerError", {
+	category: Schema.Literals([
+		"authentication",
+		"authorization",
+		"configuration",
+		"provider",
+		"request",
+		"storage"
+	]),
+	message: Schema.String,
+	operation: Schema.String,
+	retry: Schema.Literals([
+		"never",
+		"after-user-action",
+		"safe",
+		"unknown"
+	])
+}) {};
+var Identity = class extends Context.Service()("@domainkit/server/Identity") {};
+/** Host authorization boundary for reusing an existing provider authorization. */
+var ConnectionPolicy = class extends Context.Service()("@domainkit/server/ConnectionPolicy") {};
+var Providers = class extends Context.Service()("@domainkit/server/Providers") {};
+/** Configure all interactive providers once at the host composition root. */
+const providersLayer = (definitions) => {
+	const providers = /* @__PURE__ */ new Map();
+	for (const definition of definitions) {
+		const key = `${definition.providerId}:${definition.method}`;
+		if (providers.has(key)) throw new globalThis.Error(`Interactive provider ${key} is configured more than once`);
+		providers.set(key, definition);
+	}
+	return Layer.succeed(Providers)({ interactiveFlow: (input) => {
+		const provider = providers.get(`${input.providerId}:${input.method}`);
+		return provider === void 0 ? Effect.fail(new Error({
+			category: "configuration",
+			message: `Interactive provider ${input.providerId}:${input.method} is not configured`,
+			operation: "Server.Providers.interactiveFlow",
+			retry: "never"
+		})) : provider.create({
+			callbackUrl: input.callbackUrl,
+			domain: input.domain
+		});
+	} });
+};
+var PendingAuthorizations = class extends Context.Service()("@domainkit/server/PendingAuthorizations") {};
+var Handler = class extends Context.Service()("@domainkit/server/Handler") {};
+const requestError = (operation, message) => new Error({
+	category: "request",
+	message,
+	operation,
+	retry: "after-user-action"
+});
+const connectionError = (operation, cause) => new Error$2({
+	category: cause.category === "provider" ? "provider" : "authorization",
+	message: cause.message,
+	operation,
+	retry: cause.retry
+});
+const serverError = (operation, cause) => {
+	if (cause instanceof Error) return cause;
+	if (cause instanceof Error$2) return new Error({
+		category: cause.operation.startsWith("Server.pending.") ? "storage" : cause.category === "provider" ? "provider" : "request",
+		message: cause.message,
+		operation,
+		retry: cause.retry
+	});
+	if (cause instanceof Error$1) return new Error({
+		category: "storage",
+		message: cause.message,
+		operation,
+		retry: cause.retry
+	});
+	return new Error({
+		category: "provider",
+		message: cause instanceof globalThis.Error ? cause.message : "Domain connection failed",
+		operation,
+		retry: "unknown"
+	});
+};
+const normalizeBasePath = (input) => {
+	const path = input ?? "/api/domainkit";
+	if (!path.startsWith("/") || path.includes("?") || path.includes("#")) throw new globalThis.Error("DomainKit server basePath must be an absolute path");
+	if (path === "/") return "";
+	return path.endsWith("/") ? path.slice(0, -1) : path;
+};
+const configuredBaseUrl = (input) => {
+	if (input === void 0) return void 0;
+	const url = new URL(input);
+	if (url.protocol !== "http:" && url.protocol !== "https:") throw new globalThis.Error("DomainKit server baseURL must use http or https");
+	url.pathname = "/";
+	url.search = "";
+	url.hash = "";
+	return url;
+};
+const canonicalReturnTo = Effect.fn("Server.canonicalReturnTo")((input, baseUrl) => Effect.try({
+	try: () => new URL(input, baseUrl),
+	catch: () => requestError("Server.start", "returnTo must be a valid application URL")
+}).pipe(Effect.filterOrFail((target) => target.origin === baseUrl.origin, () => requestError("Server.start", "returnTo must stay on the configured application origin")), Effect.map((target) => `${target.pathname}${target.search}${target.hash}`)));
+const parseStartInput = Effect.fn("Server.parseStartInput")((request) => Effect.tryPromise({
+	try: () => request.json(),
+	catch: () => requestError("Server.start", "Request body must be valid JSON")
+}).pipe(Effect.flatMap((input) => {
+	if (typeof input !== "object" || input === null) return Effect.fail(requestError("Server.start", "Request body must be an object"));
+	const value = input;
+	if (typeof value.providerId !== "string" || !/^[a-z0-9][a-z0-9._-]*$/.test(value.providerId) || value.method !== "oauth2" && value.method !== "integration" || value.domain !== void 0 && typeof value.domain !== "string" || value.returnTo !== void 0 && typeof value.returnTo !== "string" || value.authorizationId !== void 0 && typeof value.authorizationId !== "string") return Effect.fail(requestError("Server.start", "providerId and a supported interactive method are required"));
+	return Effect.succeed({
+		...value.authorizationId === void 0 ? {} : { authorizationId: value.authorizationId },
+		...value.domain === void 0 ? {} : { domain: value.domain },
+		method: value.method,
+		providerId: value.providerId,
+		...value.returnTo === void 0 ? {} : { returnTo: value.returnTo }
+	});
+})));
+const errorStatus = (cause) => {
+	switch (cause.category) {
+		case "authentication": return 401;
+		case "authorization": return 403;
+		case "request": return 400;
+		case "storage": return 503;
+		case "configuration": return 500;
+		case "provider": return cause.retry === "safe" || cause.retry === "unknown" ? 502 : 400;
+	}
+};
+const jsonError = (cause) => Response.json({ error: {
+	category: cause.category,
+	message: cause.message,
+	operation: cause.operation,
+	retry: cause.retry
+} }, { status: errorStatus(cause) });
+/** Construct the Effect-native server handler from host-provided services. */
+const make = (configuration = {}) => Effect.gen(function* () {
+	const identity = yield* Identity;
+	const policy = yield* ConnectionPolicy;
+	const providers = yield* Providers;
+	const pending = yield* PendingAuthorizations;
+	const repository = yield* Service;
+	const crypto = yield* Crypto.Crypto;
+	const basePath = normalizeBasePath(configuration.basePath);
+	const fixedBaseUrl = configuredBaseUrl(configuration.baseURL);
+	const defaultReturnTo = configuration.defaultReturnTo ?? "/";
+	const withCore = (effect) => effect.pipe(Effect.provideService(Service, repository), Effect.provideService(Crypto.Crypto, crypto));
+	const start$1 = Effect.fn("Server.start")(function* (request) {
+		const principal = yield* identity.authenticate(request);
+		const input = yield* parseStartInput(request);
+		if (input.authorizationId !== void 0) yield* policy.authorizeReuse({
+			authorizationId: input.authorizationId,
+			domain: input.domain,
+			method: input.method,
+			principal,
+			providerId: input.providerId
+		});
+		const requestUrl = new URL(request.url);
+		const baseUrl = fixedBaseUrl ?? new URL(requestUrl.origin);
+		const callbackUrl = new URL(`${basePath}/callback/${encodeURIComponent(input.providerId)}`, baseUrl);
+		const returnTo = yield* canonicalReturnTo(input.returnTo ?? defaultReturnTo, baseUrl);
+		const flow = yield* providers.interactiveFlow({
+			callbackUrl,
+			domain: input.domain,
+			method: input.method,
+			providerId: input.providerId
+		});
+		if (flow.providerId !== input.providerId || flow.method !== input.method) return yield* requestError("Server.start", "Configured provider flow does not match the requested provider and method");
+		const continuations = {
+			consume: () => Effect.succeed(null),
+			put: (continuation) => pending.put({
+				context: {
+					baseURL: baseUrl.origin,
+					domain: input.domain,
+					method: input.method,
+					providerId: input.providerId,
+					returnTo
+				},
+				continuation
+			}).pipe(Effect.mapError((cause) => connectionError("Server.pending.put", cause)))
+		};
+		const result = yield* withCore(start({
+			authorizedById: principal.authorizedById,
+			...input.authorizationId === void 0 ? {} : { authorizationId: input.authorizationId },
+			method: Method.Interactive({
+				continuations,
+				flow
+			}),
+			ownerId: principal.ownerId
+		}));
+		if (result._tag !== "Redirect") return yield* requestError("Server.start", "Interactive connection did not redirect");
+		return Response.json({
+			authorizationUrl: result.authorizationUrl.toString(),
+			continuationId: result.continuationId
+		});
+	});
+	const complete$1 = Effect.fn("Server.complete")(function* (request, providerId) {
+		const callbackUrl = new URL(request.url);
+		const continuationId = callbackUrl.searchParams.get("state");
+		if (continuationId === null || continuationId.length === 0) return yield* requestError("Server.complete", "Provider callback is missing state");
+		const now = /* @__PURE__ */ new Date();
+		const stored = yield* pending.get(continuationId, now);
+		if (stored === null) return yield* requestError("Server.complete", "Connection continuation is expired, unknown, or already consumed");
+		if (stored.context.providerId !== providerId) return yield* requestError("Server.complete", "Provider callback does not match its continuation");
+		const callbackBaseUrl = yield* Effect.try({
+			try: () => configuredBaseUrl(stored.context.baseURL),
+			catch: () => new Error({
+				category: "storage",
+				message: "Stored provider callback origin is invalid",
+				operation: "Server.complete",
+				retry: "never"
+			})
+		}).pipe(Effect.flatMap((value) => value === void 0 ? Effect.fail(new Error({
+			category: "storage",
+			message: "Stored provider callback origin is missing",
+			operation: "Server.complete",
+			retry: "never"
+		})) : Effect.succeed(value)));
+		if (fixedBaseUrl !== void 0 && callbackBaseUrl.origin !== fixedBaseUrl.origin) return yield* requestError("Server.complete", "Provider callback does not match the configured application origin");
+		const expectedCallback = new URL(`${basePath}/callback/${encodeURIComponent(providerId)}`, callbackBaseUrl);
+		if (callbackUrl.origin !== expectedCallback.origin || callbackUrl.pathname !== expectedCallback.pathname) return yield* requestError("Server.complete", "Provider callback URL is invalid");
+		const flow = yield* providers.interactiveFlow({
+			callbackUrl: expectedCallback,
+			domain: stored.context.domain,
+			method: stored.context.method,
+			providerId
+		});
+		if (flow.providerId !== providerId || flow.method !== stored.context.method) return yield* requestError("Server.complete", "Configured provider flow does not match the stored continuation");
+		const connection = yield* withCore(complete({
+			callbackUrl,
+			continuationId,
+			continuations: {
+				consume: (id, consumedAt) => pending.consume(id, consumedAt).pipe(Effect.map((value) => value?.continuation ?? null), Effect.mapError((cause) => connectionError("Server.pending.consume", cause))),
+				put: () => Effect.die("Callback continuation store cannot put")
+			},
+			flow
+		}));
+		const returnTo = yield* canonicalReturnTo(stored.context.returnTo, callbackBaseUrl);
+		const destination = new URL(returnTo, callbackBaseUrl);
+		destination.searchParams.set("domainkit", "connected");
+		destination.searchParams.set("connectionId", connection.id);
+		return new Response(null, {
+			headers: { location: destination.toString() },
+			status: 303
+		});
+	});
+	const handle = (request) => {
+		const url = new URL(request.url);
+		const callbackPrefix = `${basePath}/callback/`;
+		return (request.method === "POST" && url.pathname === `${basePath}/connection/start` ? start$1(request) : request.method === "GET" && url.pathname.startsWith(callbackPrefix) ? complete$1(request, url.pathname.slice(callbackPrefix.length)) : Effect.succeed(Response.json({ error: { message: "Not found" } }, { status: 404 }))).pipe(Effect.mapError((cause) => serverError("Server.handle", cause)), Effect.catch((cause) => Effect.succeed(jsonError(cause))));
+	};
+	return Handler.of({ handle });
+});
+/** Provide the Effect-native server handler as a Layer. */
+const layer = (configuration = {}) => Layer.effect(Handler, make(configuration));
+const fromPromise = (operation, category, evaluate) => Effect.tryPromise({
+	try: evaluate,
+	catch: (cause) => cause instanceof Error ? cause : new Error({
+		category,
+		message: cause instanceof globalThis.Error ? cause.message : String(cause),
+		operation,
+		retry: category === "storage" ? "safe" : "unknown"
+	})
+});
+const asyncProvidersLayer = (definitions) => providersLayer(definitions.map((definition) => ({
+	create: (input) => fromPromise("Server.Providers.interactiveFlow", "provider", () => definition.create(input)).pipe(Effect.map((flow) => ({
+		complete: (payload, callbackUrl) => fromPromise("Server.Provider.complete", "provider", () => flow.complete(payload, callbackUrl)).pipe(Effect.mapError((cause) => connectionError("Server.Provider.complete", cause))),
+		method: flow.method,
+		providerId: flow.providerId,
+		requiredCapabilities: flow.requiredCapabilities,
+		start: (continuationId) => fromPromise("Server.Provider.start", "provider", () => flow.start(continuationId)).pipe(Effect.mapError((cause) => connectionError("Server.Provider.start", cause)))
+	}))),
+	method: definition.method,
+	providerId: definition.providerId
+})));
+const asyncDependencies = (options) => Layer.mergeAll(Layer.succeed(Identity, { authenticate: (request) => fromPromise("Server.Identity.authenticate", "authentication", () => options.identity.authenticate(request)) }), Layer.succeed(ConnectionPolicy, { authorizeReuse: (input) => fromPromise("Server.ConnectionPolicy.authorizeReuse", "authorization", () => options.connectionPolicy.authorizeReuse(input)) }), asyncProvidersLayer(options.providers), Layer.succeed(PendingAuthorizations, {
+	consume: (id, now) => fromPromise("Server.PendingAuthorizations.consume", "storage", () => options.pendingAuthorizations.consume(id, now)),
+	get: (id, now) => fromPromise("Server.PendingAuthorizations.get", "storage", () => options.pendingAuthorizations.get(id, now)),
+	put: (pending) => fromPromise("Server.PendingAuthorizations.put", "storage", () => options.pendingAuthorizations.put(pending))
+}), layerFromAsync(options.persistence), webCryptoLayer);
+const webHandler = (runtime) => ({
+	dispose: () => runtime.dispose(),
+	fetch: (request) => runtime.runPromise(Effect.flatMap(Handler, (handler) => handler.handle(request)), { signal: request.signal })
+});
+/** Build one reusable Web handler from a fully provided Effect server Layer. */
+function toWebHandler(serverLayer) {
+	return webHandler(ManagedRuntime.make(serverLayer));
+}
+/**
+* Build a Web handler for async hosts. The host owns persistence setup, migrations, and disposal.
+*/
+async function createDomainKit(options) {
+	const runtime = ManagedRuntime.make(layer(options).pipe(Layer.provide(asyncDependencies(options))));
+	try {
+		await runtime.context();
+		return webHandler(runtime);
+	} catch (cause) {
+		await runtime.dispose();
+		throw cause;
+	}
+}
+//#endregion
+export { server_exports as Server, createDomainKit };
+
+//# sourceMappingURL=server.mjs.map

package/dist/server.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.mjs","names":["Connection.Error","Lifecycle.Error","Lifecycle.Service","start","Connection.start","complete","Connection.complete","ManagedDnsConnections.layerFromAsync"],"sources":["../src/server/index.ts"],"sourcesContent":["import { Context, Crypto, Effect, Layer, ManagedRuntime, Schema } from \"effect\";\n\nimport * as Connection from \"../auth/connection-api.ts\";\nimport * as Lifecycle from \"../auth/lifecycle-repository.ts\";\nimport { webCryptoLayer } from \"../plan/canonical-json.ts\";\nimport type * as PromiseConnection from \"../promise/connection.ts\";\nimport * as ManagedDnsConnections from \"../promise/managed-dns-connections.ts\";\n\nexport const DEFAULT_BASE_PATH = \"/api/domainkit\";\n\nexport class Error extends Schema.TaggedError<Error>()(\"DomainKitServerError\", {\n  category: Schema.Literals([\n    \"authentication\",\n    \"authorization\",\n    \"configuration\",\n    \"provider\",\n    \"request\",\n    \"storage\",\n  ]),\n  message: Schema.String,\n  operation: Schema.String,\n  retry: Schema.Literals([\"never\", \"after-user-action\", \"safe\", \"unknown\"]),\n}) {}\n\nexport interface Principal {\n  readonly authorizedById: string;\n  readonly ownerId: string;\n}\n\nexport interface IdentityInterface {\n  readonly authenticate: (request: Request) => Effect.Effect<Principal, Error>;\n}\n\nexport class Identity extends Context.Service<Identity, IdentityInterface>()(\n  \"@domainkit/server/Identity\",\n) {}\n\nexport interface AuthorizationReuseInput {\n  readonly authorizationId: string;\n  readonly domain: string | undefined;\n  readonly method: \"integration\" | \"oauth2\";\n  readonly principal: Principal;\n  readonly providerId: string;\n}\n\nexport interface ConnectionPolicyInterface {\n  readonly authorizeReuse: (input: AuthorizationReuseInput) => Effect.Effect<void, Error>;\n}\n\n/** Host authorization boundary for reusing an existing provider authorization. */\nexport class ConnectionPolicy extends Context.Service<\n  ConnectionPolicy,\n  ConnectionPolicyInterface\n>()(\"@domainkit/server/ConnectionPolicy\") {}\n\nexport interface InteractiveFlowInput {\n  readonly callbackUrl: URL;\n  readonly domain: string | undefined;\n  readonly method: \"integration\" | \"oauth2\";\n  readonly providerId: string;\n}\n\nexport interface ProvidersInterface {\n  readonly interactiveFlow: (\n    input: InteractiveFlowInput,\n  ) => Effect.Effect<Connection.InteractiveFlow, Error>;\n}\n\nexport class Providers extends Context.Service<Providers, ProvidersInterface>()(\n  \"@domainkit/server/Providers\",\n) {}\n\nexport interface InteractiveProvider {\n  readonly create: (\n    input: Omit<InteractiveFlowInput, \"method\" | \"providerId\">,\n  ) => Effect.Effect<Connection.InteractiveFlow, Error>;\n  readonly method: \"integration\" | \"oauth2\";\n  readonly providerId: string;\n}\n\n/** Configure all interactive providers once at the host composition root. */\nexport const providersLayer = (\n  definitions: ReadonlyArray<InteractiveProvider>,\n): Layer.Layer<Providers> => {\n  const providers = new Map<string, InteractiveProvider>();\n  for (const definition of definitions) {\n    const key = `${definition.providerId}:${definition.method}`;\n    if (providers.has(key)) {\n      throw new globalThis.Error(`Interactive provider ${key} is configured more than once`);\n    }\n    providers.set(key, definition);\n  }\n  return Layer.succeed(Providers)({\n    interactiveFlow: (input) => {\n      const provider = providers.get(`${input.providerId}:${input.method}`);\n      return provider === undefined\n        ? Effect.fail(\n            new Error({\n              category: \"configuration\",\n              message: `Interactive provider ${input.providerId}:${input.method} is not configured`,\n              operation: \"Server.Providers.interactiveFlow\",\n              retry: \"never\",\n            }),\n          )\n        : provider.create({\n            callbackUrl: input.callbackUrl,\n            domain: input.domain,\n          });\n    },\n  });\n};\n\nexport interface PendingAuthorizationContext {\n  readonly baseURL: string;\n  readonly domain: string | undefined;\n  readonly method: \"integration\" | \"oauth2\";\n  readonly providerId: string;\n  readonly returnTo: string;\n}\n\nexport interface PendingAuthorization {\n  readonly context: PendingAuthorizationContext;\n  readonly continuation: Connection.Continuation;\n}\n\nexport interface PendingAuthorizationsInterface {\n  readonly consume: (id: string, now: Date) => Effect.Effect<PendingAuthorization | null, Error>;\n  readonly get: (id: string, now: Date) => Effect.Effect<PendingAuthorization | null, Error>;\n  readonly put: (pending: PendingAuthorization) => Effect.Effect<void, Error>;\n}\n\nexport class PendingAuthorizations extends Context.Service<\n  PendingAuthorizations,\n  PendingAuthorizationsInterface\n>()(\"@domainkit/server/PendingAuthorizations\") {}\n\nexport interface Configuration {\n  /** Public origin used to construct provider callbacks. Defaults to the incoming request origin. */\n  readonly baseURL?: string;\n  /** Catch-all mount path. */\n  readonly basePath?: string;\n  /** Relative same-origin destination used when a start request omits `returnTo`. */\n  readonly defaultReturnTo?: string;\n}\n\nexport interface AsyncIdentity {\n  readonly authenticate: (request: Request) => Promise<Principal>;\n}\n\nexport interface AsyncConnectionPolicy {\n  readonly authorizeReuse: (input: AuthorizationReuseInput) => Promise<void>;\n}\n\nexport type AsyncInteractiveFlow = PromiseConnection.InteractiveFlow;\n\nexport interface AsyncInteractiveProvider {\n  readonly create: (\n    input: Omit<InteractiveFlowInput, \"method\" | \"providerId\">,\n  ) => Promise<AsyncInteractiveFlow>;\n  readonly method: \"integration\" | \"oauth2\";\n  readonly providerId: string;\n}\n\nexport interface AsyncPendingAuthorizations {\n  readonly consume: (id: string, now: Date) => Promise<PendingAuthorization | null>;\n  readonly get: (id: string, now: Date) => Promise<PendingAuthorization | null>;\n  readonly put: (pending: PendingAuthorization) => Promise<void>;\n}\n\nexport interface CreateDomainKitOptions extends Configuration {\n  readonly connectionPolicy: AsyncConnectionPolicy;\n  readonly identity: AsyncIdentity;\n  readonly pendingAuthorizations: AsyncPendingAuthorizations;\n  /** Host-owned Promise persistence. DomainKit does not initialize or dispose this resource. */\n  readonly persistence: ManagedDnsConnections.AsyncInterface;\n  readonly providers: ReadonlyArray<AsyncInteractiveProvider>;\n}\n\nexport interface Interface {\n  readonly handle: (request: Request) => Effect.Effect<Response>;\n}\n\nexport class Handler extends Context.Service<Handler, Interface>()(\"@domainkit/server/Handler\") {}\n\ninterface StartInput {\n  readonly authorizationId?: string;\n  readonly domain?: string;\n  readonly method: \"integration\" | \"oauth2\";\n  readonly providerId: string;\n  readonly returnTo?: string;\n}\n\nconst requestError = (operation: string, message: string) =>\n  new Error({\n    category: \"request\",\n    message,\n    operation,\n    retry: \"after-user-action\",\n  });\n\nconst connectionError = (operation: string, cause: Error) =>\n  new Connection.Error({\n    category: cause.category === \"provider\" ? \"provider\" : \"authorization\",\n    message: cause.message,\n    operation,\n    retry: cause.retry,\n  });\n\nconst serverError = (operation: string, cause: unknown): Error => {\n  if (cause instanceof Error) return cause;\n  if (cause instanceof Connection.Error) {\n    return new Error({\n      category: cause.operation.startsWith(\"Server.pending.\")\n        ? \"storage\"\n        : cause.category === \"provider\"\n          ? \"provider\"\n          : \"request\",\n      message: cause.message,\n      operation,\n      retry: cause.retry,\n    });\n  }\n  if (cause instanceof Lifecycle.Error) {\n    return new Error({\n      category: \"storage\",\n      message: cause.message,\n      operation,\n      retry: cause.retry,\n    });\n  }\n  return new Error({\n    category: \"provider\",\n    message: cause instanceof globalThis.Error ? cause.message : \"Domain connection failed\",\n    operation,\n    retry: \"unknown\",\n  });\n};\n\nconst normalizeBasePath = (input: string | undefined): string => {\n  const path = input ?? DEFAULT_BASE_PATH;\n  if (!path.startsWith(\"/\") || path.includes(\"?\") || path.includes(\"#\")) {\n    throw new globalThis.Error(\"DomainKit server basePath must be an absolute path\");\n  }\n  if (path === \"/\") return \"\";\n  return path.endsWith(\"/\") ? path.slice(0, -1) : path;\n};\n\nconst configuredBaseUrl = (input: string | undefined): URL | undefined => {\n  if (input === undefined) return undefined;\n  const url = new URL(input);\n  if (url.protocol !== \"http:\" && url.protocol !== \"https:\") {\n    throw new globalThis.Error(\"DomainKit server baseURL must use http or https\");\n  }\n  url.pathname = \"/\";\n  url.search = \"\";\n  url.hash = \"\";\n  return url;\n};\n\nconst canonicalReturnTo = Effect.fn(\"Server.canonicalReturnTo\")((input: string, baseUrl: URL) =>\n  Effect.try({\n    try: () => new URL(input, baseUrl),\n    catch: () => requestError(\"Server.start\", \"returnTo must be a valid application URL\"),\n  }).pipe(\n    Effect.filterOrFail(\n      (target) => target.origin === baseUrl.origin,\n      () => requestError(\"Server.start\", \"returnTo must stay on the configured application origin\"),\n    ),\n    Effect.map((target) => `${target.pathname}${target.search}${target.hash}`),\n  ),\n);\n\nconst parseStartInput = Effect.fn(\"Server.parseStartInput\")((request: Request) =>\n  Effect.tryPromise({\n    try: () => request.json(),\n    catch: () => requestError(\"Server.start\", \"Request body must be valid JSON\"),\n  }).pipe(\n    Effect.flatMap((input) => {\n      if (typeof input !== \"object\" || input === null) {\n        return Effect.fail(requestError(\"Server.start\", \"Request body must be an object\"));\n      }\n      const value = input as Record<string, unknown>;\n      if (\n        typeof value.providerId !== \"string\" ||\n        !/^[a-z0-9][a-z0-9._-]*$/.test(value.providerId) ||\n        (value.method !== \"oauth2\" && value.method !== \"integration\") ||\n        (value.domain !== undefined && typeof value.domain !== \"string\") ||\n        (value.returnTo !== undefined && typeof value.returnTo !== \"string\") ||\n        (value.authorizationId !== undefined && typeof value.authorizationId !== \"string\")\n      ) {\n        return Effect.fail(\n          requestError(\n            \"Server.start\",\n            \"providerId and a supported interactive method are required\",\n          ),\n        );\n      }\n      return Effect.succeed({\n        ...(value.authorizationId === undefined ? {} : { authorizationId: value.authorizationId }),\n        ...(value.domain === undefined ? {} : { domain: value.domain }),\n        method: value.method,\n        providerId: value.providerId,\n        ...(value.returnTo === undefined ? {} : { returnTo: value.returnTo }),\n      } satisfies StartInput);\n    }),\n  ),\n);\n\nconst errorStatus = (cause: Error): number => {\n  switch (cause.category) {\n    case \"authentication\":\n      return 401;\n    case \"authorization\":\n      return 403;\n    case \"request\":\n      return 400;\n    case \"storage\":\n      return 503;\n    case \"configuration\":\n      return 500;\n    case \"provider\":\n      return cause.retry === \"safe\" || cause.retry === \"unknown\" ? 502 : 400;\n  }\n};\n\nconst jsonError = (cause: Error): Response =>\n  Response.json(\n    {\n      error: {\n        category: cause.category,\n        message: cause.message,\n        operation: cause.operation,\n        retry: cause.retry,\n      },\n    },\n    { status: errorStatus(cause) },\n  );\n\n/** Construct the Effect-native server handler from host-provided services. */\nexport const make = (configuration: Configuration = {}) =>\n  Effect.gen(function* () {\n    const identity = yield* Identity;\n    const policy = yield* ConnectionPolicy;\n    const providers = yield* Providers;\n    const pending = yield* PendingAuthorizations;\n    const repository = yield* Lifecycle.Service;\n    const crypto = yield* Crypto.Crypto;\n    const basePath = normalizeBasePath(configuration.basePath);\n    const fixedBaseUrl = configuredBaseUrl(configuration.baseURL);\n    const defaultReturnTo = configuration.defaultReturnTo ?? \"/\";\n\n    const withCore = <A, E>(effect: Effect.Effect<A, E, Lifecycle.Service | Crypto.Crypto>) =>\n      effect.pipe(\n        Effect.provideService(Lifecycle.Service, repository),\n        Effect.provideService(Crypto.Crypto, crypto),\n      );\n\n    const start = Effect.fn(\"Server.start\")(function* (request: Request) {\n      const principal = yield* identity.authenticate(request);\n      const input = yield* parseStartInput(request);\n      if (input.authorizationId !== undefined) {\n        yield* policy.authorizeReuse({\n          authorizationId: input.authorizationId,\n          domain: input.domain,\n          method: input.method,\n          principal,\n          providerId: input.providerId,\n        });\n      }\n      const requestUrl = new URL(request.url);\n      const baseUrl = fixedBaseUrl ?? new URL(requestUrl.origin);\n      const callbackUrl = new URL(\n        `${basePath}/callback/${encodeURIComponent(input.providerId)}`,\n        baseUrl,\n      );\n      const returnTo = yield* canonicalReturnTo(input.returnTo ?? defaultReturnTo, baseUrl);\n      const flow = yield* providers.interactiveFlow({\n        callbackUrl,\n        domain: input.domain,\n        method: input.method,\n        providerId: input.providerId,\n      });\n      if (flow.providerId !== input.providerId || flow.method !== input.method) {\n        return yield* requestError(\n          \"Server.start\",\n          \"Configured provider flow does not match the requested provider and method\",\n        );\n      }\n      const continuations: Connection.ContinuationStore = {\n        consume: () => Effect.succeed(null),\n        put: (continuation) =>\n          pending\n            .put({\n              context: {\n                baseURL: baseUrl.origin,\n                domain: input.domain,\n                method: input.method,\n                providerId: input.providerId,\n                returnTo,\n              },\n              continuation,\n            })\n            .pipe(Effect.mapError((cause) => connectionError(\"Server.pending.put\", cause))),\n      };\n      const result = yield* withCore(\n        Connection.start({\n          authorizedById: principal.authorizedById,\n          ...(input.authorizationId === undefined\n            ? {}\n            : { authorizationId: input.authorizationId }),\n          method: Connection.Method.Interactive({ continuations, flow }),\n          ownerId: principal.ownerId,\n        }),\n      );\n      if (result._tag !== \"Redirect\") {\n        return yield* requestError(\"Server.start\", \"Interactive connection did not redirect\");\n      }\n      return Response.json({\n        authorizationUrl: result.authorizationUrl.toString(),\n        continuationId: result.continuationId,\n      });\n    });\n\n    const complete = Effect.fn(\"Server.complete\")(function* (request: Request, providerId: string) {\n      const callbackUrl = new URL(request.url);\n      const continuationId = callbackUrl.searchParams.get(\"state\");\n      if (continuationId === null || continuationId.length === 0) {\n        return yield* requestError(\"Server.complete\", \"Provider callback is missing state\");\n      }\n      const now = new Date();\n      const stored = yield* pending.get(continuationId, now);\n      if (stored === null) {\n        return yield* requestError(\n          \"Server.complete\",\n          \"Connection continuation is expired, unknown, or already consumed\",\n        );\n      }\n      if (stored.context.providerId !== providerId) {\n        return yield* requestError(\n          \"Server.complete\",\n          \"Provider callback does not match its continuation\",\n        );\n      }\n      const callbackBaseUrl = yield* Effect.try({\n        try: () => configuredBaseUrl(stored.context.baseURL),\n        catch: () =>\n          new Error({\n            category: \"storage\",\n            message: \"Stored provider callback origin is invalid\",\n            operation: \"Server.complete\",\n            retry: \"never\",\n          }),\n      }).pipe(\n        Effect.flatMap((value) =>\n          value === undefined\n            ? Effect.fail(\n                new Error({\n                  category: \"storage\",\n                  message: \"Stored provider callback origin is missing\",\n                  operation: \"Server.complete\",\n                  retry: \"never\",\n                }),\n              )\n            : Effect.succeed(value),\n        ),\n      );\n      if (fixedBaseUrl !== undefined && callbackBaseUrl.origin !== fixedBaseUrl.origin) {\n        return yield* requestError(\n          \"Server.complete\",\n          \"Provider callback does not match the configured application origin\",\n        );\n      }\n      const expectedCallback = new URL(\n        `${basePath}/callback/${encodeURIComponent(providerId)}`,\n        callbackBaseUrl,\n      );\n      if (\n        callbackUrl.origin !== expectedCallback.origin ||\n        callbackUrl.pathname !== expectedCallback.pathname\n      ) {\n        return yield* requestError(\"Server.complete\", \"Provider callback URL is invalid\");\n      }\n      const flow = yield* providers.interactiveFlow({\n        callbackUrl: expectedCallback,\n        domain: stored.context.domain,\n        method: stored.context.method,\n        providerId,\n      });\n      if (flow.providerId !== providerId || flow.method !== stored.context.method) {\n        return yield* requestError(\n          \"Server.complete\",\n          \"Configured provider flow does not match the stored continuation\",\n        );\n      }\n      const continuations: Connection.ContinuationStore = {\n        consume: (id, consumedAt) =>\n          pending.consume(id, consumedAt).pipe(\n            Effect.map((value) => value?.continuation ?? null),\n            Effect.mapError((cause) => connectionError(\"Server.pending.consume\", cause)),\n          ),\n        put: () => Effect.die(\"Callback continuation store cannot put\"),\n      };\n      const connection = yield* withCore(\n        Connection.complete({\n          callbackUrl,\n          continuationId,\n          continuations,\n          flow,\n        }),\n      );\n      const returnTo = yield* canonicalReturnTo(stored.context.returnTo, callbackBaseUrl);\n      const destination = new URL(returnTo, callbackBaseUrl);\n      destination.searchParams.set(\"domainkit\", \"connected\");\n      destination.searchParams.set(\"connectionId\", connection.id);\n      return new Response(null, {\n        headers: { location: destination.toString() },\n        status: 303,\n      });\n    });\n\n    const handle = (request: Request): Effect.Effect<Response> => {\n      const url = new URL(request.url);\n      const callbackPrefix = `${basePath}/callback/`;\n      const route =\n        request.method === \"POST\" && url.pathname === `${basePath}/connection/start`\n          ? start(request)\n          : request.method === \"GET\" && url.pathname.startsWith(callbackPrefix)\n            ? complete(request, url.pathname.slice(callbackPrefix.length))\n            : Effect.succeed(Response.json({ error: { message: \"Not found\" } }, { status: 404 }));\n      return route.pipe(\n        Effect.mapError((cause) => serverError(\"Server.handle\", cause)),\n        Effect.catch((cause) => Effect.succeed(jsonError(cause))),\n      );\n    };\n\n    return Handler.of({ handle });\n  });\n\n/** Provide the Effect-native server handler as a Layer. */\nexport const layer = (configuration: Configuration = {}) =>\n  Layer.effect(Handler, make(configuration));\n\nexport interface WebHandler {\n  readonly dispose: () => Promise<void>;\n  readonly fetch: (request: Request) => Promise<Response>;\n}\n\nconst fromPromise = <A>(\n  operation: string,\n  category: Error[\"category\"],\n  evaluate: () => Promise<A>,\n): Effect.Effect<A, Error> =>\n  Effect.tryPromise({\n    try: evaluate,\n    catch: (cause) =>\n      cause instanceof Error\n        ? cause\n        : new Error({\n            category,\n            message: cause instanceof globalThis.Error ? cause.message : String(cause),\n            operation,\n            retry: category === \"storage\" ? \"safe\" : \"unknown\",\n          }),\n  });\n\nconst asyncProvidersLayer = (\n  definitions: ReadonlyArray<AsyncInteractiveProvider>,\n): Layer.Layer<Providers> =>\n  providersLayer(\n    definitions.map((definition) => ({\n      create: (input) =>\n        fromPromise(\"Server.Providers.interactiveFlow\", \"provider\", () =>\n          definition.create(input),\n        ).pipe(\n          Effect.map((flow) => ({\n            complete: (payload, callbackUrl) =>\n              fromPromise(\"Server.Provider.complete\", \"provider\", () =>\n                flow.complete(payload, callbackUrl),\n              ).pipe(\n                Effect.mapError((cause) => connectionError(\"Server.Provider.complete\", cause)),\n              ),\n            method: flow.method,\n            providerId: flow.providerId,\n            requiredCapabilities: flow.requiredCapabilities,\n            start: (continuationId) =>\n              fromPromise(\"Server.Provider.start\", \"provider\", () =>\n                flow.start(continuationId),\n              ).pipe(Effect.mapError((cause) => connectionError(\"Server.Provider.start\", cause))),\n          })),\n        ),\n      method: definition.method,\n      providerId: definition.providerId,\n    })),\n  );\n\nconst asyncDependencies = (options: CreateDomainKitOptions) =>\n  Layer.mergeAll(\n    Layer.succeed(Identity, {\n      authenticate: (request) =>\n        fromPromise(\"Server.Identity.authenticate\", \"authentication\", () =>\n          options.identity.authenticate(request),\n        ),\n    }),\n    Layer.succeed(ConnectionPolicy, {\n      authorizeReuse: (input) =>\n        fromPromise(\"Server.ConnectionPolicy.authorizeReuse\", \"authorization\", () =>\n          options.connectionPolicy.authorizeReuse(input),\n        ),\n    }),\n    asyncProvidersLayer(options.providers),\n    Layer.succeed(PendingAuthorizations, {\n      consume: (id, now) =>\n        fromPromise(\"Server.PendingAuthorizations.consume\", \"storage\", () =>\n          options.pendingAuthorizations.consume(id, now),\n        ),\n      get: (id, now) =>\n        fromPromise(\"Server.PendingAuthorizations.get\", \"storage\", () =>\n          options.pendingAuthorizations.get(id, now),\n        ),\n      put: (pending) =>\n        fromPromise(\"Server.PendingAuthorizations.put\", \"storage\", () =>\n          options.pendingAuthorizations.put(pending),\n        ),\n    }),\n    ManagedDnsConnections.layerFromAsync(options.persistence),\n    webCryptoLayer,\n  );\n\nconst webHandler = <E>(runtime: ManagedRuntime.ManagedRuntime<Handler, E>): WebHandler => ({\n  dispose: () => runtime.dispose(),\n  fetch: (request) =>\n    runtime.runPromise(\n      Effect.flatMap(Handler, (handler) => handler.handle(request)),\n      {\n        signal: request.signal,\n      },\n    ),\n});\n\n/** Build one reusable Web handler from a fully provided Effect server Layer. */\nexport function toWebHandler<E>(serverLayer: Layer.Layer<Handler, E>): WebHandler {\n  return webHandler(ManagedRuntime.make(serverLayer));\n}\n\n/**\n * Build a Web handler for async hosts. The host owns persistence setup, migrations, and disposal.\n */\nexport async function createDomainKit(options: CreateDomainKitOptions): Promise<WebHandler> {\n  const runtime = ManagedRuntime.make(\n    layer(options).pipe(Layer.provide(asyncDependencies(options))),\n  );\n  try {\n    await runtime.context();\n    return webHandler(runtime);\n  } catch (cause) {\n    await runtime.dispose();\n    throw cause;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAQA,MAAa,oBAAoB;AAEjC,IAAa,QAAb,cAA2B,OAAO,YAAmB,CAAC,CAAC,wBAAwB;CAC7E,UAAU,OAAO,SAAS;EACxB;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;CACD,SAAS,OAAO;CAChB,WAAW,OAAO;CAClB,OAAO,OAAO,SAAS;EAAC;EAAS;EAAqB;EAAQ;CAAS,CAAC;AAC1E,CAAC,CAAC,CAAC,CAAC;AAWJ,IAAa,WAAb,cAA8B,QAAQ,QAAqC,CAAC,CAC1E,4BACF,CAAC,CAAC,CAAC;;AAeH,IAAa,mBAAb,cAAsC,QAAQ,QAG5C,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC;AAe3C,IAAa,YAAb,cAA+B,QAAQ,QAAuC,CAAC,CAC7E,6BACF,CAAC,CAAC,CAAC;;AAWH,MAAa,kBACX,gBAC2B;CAC3B,MAAM,4BAAY,IAAI,IAAiC;CACvD,KAAK,MAAM,cAAc,aAAa;EACpC,MAAM,MAAM,GAAG,WAAW,WAAW,GAAG,WAAW;EACnD,IAAI,UAAU,IAAI,GAAG,GACnB,MAAM,IAAI,WAAW,MAAM,wBAAwB,IAAI,8BAA8B;EAEvF,UAAU,IAAI,KAAK,UAAU;CAC/B;CACA,OAAO,MAAM,QAAQ,SAAS,CAAC,CAAC,EAC9B,kBAAkB,UAAU;EAC1B,MAAM,WAAW,UAAU,IAAI,GAAG,MAAM,WAAW,GAAG,MAAM,QAAQ;EACpE,OAAO,aAAa,KAAA,IAChB,OAAO,KACL,IAAI,MAAM;GACR,UAAU;GACV,SAAS,wBAAwB,MAAM,WAAW,GAAG,MAAM,OAAO;GAClE,WAAW;GACX,OAAO;EACT,CAAC,CACH,IACA,SAAS,OAAO;GACd,aAAa,MAAM;GACnB,QAAQ,MAAM;EAChB,CAAC;CACP,EACF,CAAC;AACH;AAqBA,IAAa,wBAAb,cAA2C,QAAQ,QAGjD,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC;AAgDhD,IAAa,UAAb,cAA6B,QAAQ,QAA4B,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC;AAUjG,MAAM,gBAAgB,WAAmB,YACvC,IAAI,MAAM;CACR,UAAU;CACV;CACA;CACA,OAAO;AACT,CAAC;AAEH,MAAM,mBAAmB,WAAmB,UAC1C,IAAIA,QAAiB;CACnB,UAAU,MAAM,aAAa,aAAa,aAAa;CACvD,SAAS,MAAM;CACf;CACA,OAAO,MAAM;AACf,CAAC;AAEH,MAAM,eAAe,WAAmB,UAA0B;CAChE,IAAI,iBAAiB,OAAO,OAAO;CACnC,IAAI,iBAAiBA,SACnB,OAAO,IAAI,MAAM;EACf,UAAU,MAAM,UAAU,WAAW,iBAAiB,IAClD,YACA,MAAM,aAAa,aACjB,aACA;EACN,SAAS,MAAM;EACf;EACA,OAAO,MAAM;CACf,CAAC;CAEH,IAAI,iBAAiBC,SACnB,OAAO,IAAI,MAAM;EACf,UAAU;EACV,SAAS,MAAM;EACf;EACA,OAAO,MAAM;CACf,CAAC;CAEH,OAAO,IAAI,MAAM;EACf,UAAU;EACV,SAAS,iBAAiB,WAAW,QAAQ,MAAM,UAAU;EAC7D;EACA,OAAO;CACT,CAAC;AACH;AAEA,MAAM,qBAAqB,UAAsC;CAC/D,MAAM,OAAO,SAAA;CACb,IAAI,CAAC,KAAK,WAAW,GAAG,KAAK,KAAK,SAAS,GAAG,KAAK,KAAK,SAAS,GAAG,GAClE,MAAM,IAAI,WAAW,MAAM,oDAAoD;CAEjF,IAAI,SAAS,KAAK,OAAO;CACzB,OAAO,KAAK,SAAS,GAAG,IAAI,KAAK,MAAM,GAAG,EAAE,IAAI;AAClD;AAEA,MAAM,qBAAqB,UAA+C;CACxE,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,MAAM,MAAM,IAAI,IAAI,KAAK;CACzB,IAAI,IAAI,aAAa,WAAW,IAAI,aAAa,UAC/C,MAAM,IAAI,WAAW,MAAM,iDAAiD;CAE9E,IAAI,WAAW;CACf,IAAI,SAAS;CACb,IAAI,OAAO;CACX,OAAO;AACT;AAEA,MAAM,oBAAoB,OAAO,GAAG,0BAA0B,CAAC,EAAE,OAAe,YAC9E,OAAO,IAAI;CACT,WAAW,IAAI,IAAI,OAAO,OAAO;CACjC,aAAa,aAAa,gBAAgB,0CAA0C;AACtF,CAAC,CAAC,CAAC,KACD,OAAO,cACJ,WAAW,OAAO,WAAW,QAAQ,cAChC,aAAa,gBAAgB,yDAAyD,CAC9F,GACA,OAAO,KAAK,WAAW,GAAG,OAAO,WAAW,OAAO,SAAS,OAAO,MAAM,CAC3E,CACF;AAEA,MAAM,kBAAkB,OAAO,GAAG,wBAAwB,CAAC,EAAE,YAC3D,OAAO,WAAW;CAChB,WAAW,QAAQ,KAAK;CACxB,aAAa,aAAa,gBAAgB,iCAAiC;AAC7E,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,UAAU;CACxB,IAAI,OAAO,UAAU,YAAY,UAAU,MACzC,OAAO,OAAO,KAAK,aAAa,gBAAgB,gCAAgC,CAAC;CAEnF,MAAM,QAAQ;CACd,IACE,OAAO,MAAM,eAAe,YAC5B,CAAC,yBAAyB,KAAK,MAAM,UAAU,KAC9C,MAAM,WAAW,YAAY,MAAM,WAAW,iBAC9C,MAAM,WAAW,KAAA,KAAa,OAAO,MAAM,WAAW,YACtD,MAAM,aAAa,KAAA,KAAa,OAAO,MAAM,aAAa,YAC1D,MAAM,oBAAoB,KAAA,KAAa,OAAO,MAAM,oBAAoB,UAEzE,OAAO,OAAO,KACZ,aACE,gBACA,4DACF,CACF;CAEF,OAAO,OAAO,QAAQ;EACpB,GAAI,MAAM,oBAAoB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB,MAAM,gBAAgB;EACxF,GAAI,MAAM,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;EAC7D,QAAQ,MAAM;EACd,YAAY,MAAM;EAClB,GAAI,MAAM,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS;CACrE,CAAsB;AACxB,CAAC,CACH,CACF;AAEA,MAAM,eAAe,UAAyB;CAC5C,QAAQ,MAAM,UAAd;EACE,KAAK,kBACH,OAAO;EACT,KAAK,iBACH,OAAO;EACT,KAAK,WACH,OAAO;EACT,KAAK,WACH,OAAO;EACT,KAAK,iBACH,OAAO;EACT,KAAK,YACH,OAAO,MAAM,UAAU,UAAU,MAAM,UAAU,YAAY,MAAM;CACvE;AACF;AAEA,MAAM,aAAa,UACjB,SAAS,KACP,EACE,OAAO;CACL,UAAU,MAAM;CAChB,SAAS,MAAM;CACf,WAAW,MAAM;CACjB,OAAO,MAAM;AACf,EACF,GACA,EAAE,QAAQ,YAAY,KAAK,EAAE,CAC/B;;AAGF,MAAa,QAAQ,gBAA+B,CAAC,MACnD,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,OAAO;CACxB,MAAM,SAAS,OAAO;CACtB,MAAM,YAAY,OAAO;CACzB,MAAM,UAAU,OAAO;CACvB,MAAM,aAAa,OAAOC;CAC1B,MAAM,SAAS,OAAO,OAAO;CAC7B,MAAM,WAAW,kBAAkB,cAAc,QAAQ;CACzD,MAAM,eAAe,kBAAkB,cAAc,OAAO;CAC5D,MAAM,kBAAkB,cAAc,mBAAmB;CAEzD,MAAM,YAAkB,WACtB,OAAO,KACL,OAAO,eAAeA,SAAmB,UAAU,GACnD,OAAO,eAAe,OAAO,QAAQ,MAAM,CAC7C;CAEF,MAAMC,UAAQ,OAAO,GAAG,cAAc,CAAC,CAAC,WAAW,SAAkB;EACnE,MAAM,YAAY,OAAO,SAAS,aAAa,OAAO;EACtD,MAAM,QAAQ,OAAO,gBAAgB,OAAO;EAC5C,IAAI,MAAM,oBAAoB,KAAA,GAC5B,OAAO,OAAO,eAAe;GAC3B,iBAAiB,MAAM;GACvB,QAAQ,MAAM;GACd,QAAQ,MAAM;GACd;GACA,YAAY,MAAM;EACpB,CAAC;EAEH,MAAM,aAAa,IAAI,IAAI,QAAQ,GAAG;EACtC,MAAM,UAAU,gBAAgB,IAAI,IAAI,WAAW,MAAM;EACzD,MAAM,cAAc,IAAI,IACtB,GAAG,SAAS,YAAY,mBAAmB,MAAM,UAAU,KAC3D,OACF;EACA,MAAM,WAAW,OAAO,kBAAkB,MAAM,YAAY,iBAAiB,OAAO;EACpF,MAAM,OAAO,OAAO,UAAU,gBAAgB;GAC5C;GACA,QAAQ,MAAM;GACd,QAAQ,MAAM;GACd,YAAY,MAAM;EACpB,CAAC;EACD,IAAI,KAAK,eAAe,MAAM,cAAc,KAAK,WAAW,MAAM,QAChE,OAAO,OAAO,aACZ,gBACA,2EACF;EAEF,MAAM,gBAA8C;GAClD,eAAe,OAAO,QAAQ,IAAI;GAClC,MAAM,iBACJ,QACG,IAAI;IACH,SAAS;KACP,SAAS,QAAQ;KACjB,QAAQ,MAAM;KACd,QAAQ,MAAM;KACd,YAAY,MAAM;KAClB;IACF;IACA;GACF,CAAC,CAAC,CACD,KAAK,OAAO,UAAU,UAAU,gBAAgB,sBAAsB,KAAK,CAAC,CAAC;EACpF;EACA,MAAM,SAAS,OAAO,SACpBC,MAAiB;GACf,gBAAgB,UAAU;GAC1B,GAAI,MAAM,oBAAoB,KAAA,IAC1B,CAAC,IACD,EAAE,iBAAiB,MAAM,gBAAgB;GAC7C,QAAA,OAA0B,YAAY;IAAE;IAAe;GAAK,CAAC;GAC7D,SAAS,UAAU;EACrB,CAAC,CACH;EACA,IAAI,OAAO,SAAS,YAClB,OAAO,OAAO,aAAa,gBAAgB,yCAAyC;EAEtF,OAAO,SAAS,KAAK;GACnB,kBAAkB,OAAO,iBAAiB,SAAS;GACnD,gBAAgB,OAAO;EACzB,CAAC;CACH,CAAC;CAED,MAAMC,aAAW,OAAO,GAAG,iBAAiB,CAAC,CAAC,WAAW,SAAkB,YAAoB;EAC7F,MAAM,cAAc,IAAI,IAAI,QAAQ,GAAG;EACvC,MAAM,iBAAiB,YAAY,aAAa,IAAI,OAAO;EAC3D,IAAI,mBAAmB,QAAQ,eAAe,WAAW,GACvD,OAAO,OAAO,aAAa,mBAAmB,oCAAoC;EAEpF,MAAM,sBAAM,IAAI,KAAK;EACrB,MAAM,SAAS,OAAO,QAAQ,IAAI,gBAAgB,GAAG;EACrD,IAAI,WAAW,MACb,OAAO,OAAO,aACZ,mBACA,kEACF;EAEF,IAAI,OAAO,QAAQ,eAAe,YAChC,OAAO,OAAO,aACZ,mBACA,mDACF;EAEF,MAAM,kBAAkB,OAAO,OAAO,IAAI;GACxC,WAAW,kBAAkB,OAAO,QAAQ,OAAO;GACnD,aACE,IAAI,MAAM;IACR,UAAU;IACV,SAAS;IACT,WAAW;IACX,OAAO;GACT,CAAC;EACL,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,UACd,UAAU,KAAA,IACN,OAAO,KACL,IAAI,MAAM;GACR,UAAU;GACV,SAAS;GACT,WAAW;GACX,OAAO;EACT,CAAC,CACH,IACA,OAAO,QAAQ,KAAK,CAC1B,CACF;EACA,IAAI,iBAAiB,KAAA,KAAa,gBAAgB,WAAW,aAAa,QACxE,OAAO,OAAO,aACZ,mBACA,oEACF;EAEF,MAAM,mBAAmB,IAAI,IAC3B,GAAG,SAAS,YAAY,mBAAmB,UAAU,KACrD,eACF;EACA,IACE,YAAY,WAAW,iBAAiB,UACxC,YAAY,aAAa,iBAAiB,UAE1C,OAAO,OAAO,aAAa,mBAAmB,kCAAkC;EAElF,MAAM,OAAO,OAAO,UAAU,gBAAgB;GAC5C,aAAa;GACb,QAAQ,OAAO,QAAQ;GACvB,QAAQ,OAAO,QAAQ;GACvB;EACF,CAAC;EACD,IAAI,KAAK,eAAe,cAAc,KAAK,WAAW,OAAO,QAAQ,QACnE,OAAO,OAAO,aACZ,mBACA,iEACF;EAUF,MAAM,aAAa,OAAO,SACxBC,SAAoB;GAClB;GACA;GACA,eAAA;IAXF,UAAU,IAAI,eACZ,QAAQ,QAAQ,IAAI,UAAU,CAAC,CAAC,KAC9B,OAAO,KAAK,UAAU,OAAO,gBAAgB,IAAI,GACjD,OAAO,UAAU,UAAU,gBAAgB,0BAA0B,KAAK,CAAC,CAC7E;IACF,WAAW,OAAO,IAAI,wCAAwC;GAMhD;GACZ;EACF,CAAC,CACH;EACA,MAAM,WAAW,OAAO,kBAAkB,OAAO,QAAQ,UAAU,eAAe;EAClF,MAAM,cAAc,IAAI,IAAI,UAAU,eAAe;EACrD,YAAY,aAAa,IAAI,aAAa,WAAW;EACrD,YAAY,aAAa,IAAI,gBAAgB,WAAW,EAAE;EAC1D,OAAO,IAAI,SAAS,MAAM;GACxB,SAAS,EAAE,UAAU,YAAY,SAAS,EAAE;GAC5C,QAAQ;EACV,CAAC;CACH,CAAC;CAED,MAAM,UAAU,YAA8C;EAC5D,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;EAC/B,MAAM,iBAAiB,GAAG,SAAS;EAOnC,QALE,QAAQ,WAAW,UAAU,IAAI,aAAa,GAAG,SAAS,qBACtDH,QAAM,OAAO,IACb,QAAQ,WAAW,SAAS,IAAI,SAAS,WAAW,cAAc,IAChEE,WAAS,SAAS,IAAI,SAAS,MAAM,eAAe,MAAM,CAAC,IAC3D,OAAO,QAAQ,SAAS,KAAK,EAAE,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC,CAAC,EAAA,CAC7E,KACX,OAAO,UAAU,UAAU,YAAY,iBAAiB,KAAK,CAAC,GAC9D,OAAO,OAAO,UAAU,OAAO,QAAQ,UAAU,KAAK,CAAC,CAAC,CAC1D;CACF;CAEA,OAAO,QAAQ,GAAG,EAAE,OAAO,CAAC;AAC9B,CAAC;;AAGH,MAAa,SAAS,gBAA+B,CAAC,MACpD,MAAM,OAAO,SAAS,KAAK,aAAa,CAAC;AAO3C,MAAM,eACJ,WACA,UACA,aAEA,OAAO,WAAW;CAChB,KAAK;CACL,QAAQ,UACN,iBAAiB,QACb,QACA,IAAI,MAAM;EACR;EACA,SAAS,iBAAiB,WAAW,QAAQ,MAAM,UAAU,OAAO,KAAK;EACzE;EACA,OAAO,aAAa,YAAY,SAAS;CAC3C,CAAC;AACT,CAAC;AAEH,MAAM,uBACJ,gBAEA,eACE,YAAY,KAAK,gBAAgB;CAC/B,SAAS,UACP,YAAY,oCAAoC,kBAC9C,WAAW,OAAO,KAAK,CACzB,CAAC,CAAC,KACA,OAAO,KAAK,UAAU;EACpB,WAAW,SAAS,gBAClB,YAAY,4BAA4B,kBACtC,KAAK,SAAS,SAAS,WAAW,CACpC,CAAC,CAAC,KACA,OAAO,UAAU,UAAU,gBAAgB,4BAA4B,KAAK,CAAC,CAC/E;EACF,QAAQ,KAAK;EACb,YAAY,KAAK;EACjB,sBAAsB,KAAK;EAC3B,QAAQ,mBACN,YAAY,yBAAyB,kBACnC,KAAK,MAAM,cAAc,CAC3B,CAAC,CAAC,KAAK,OAAO,UAAU,UAAU,gBAAgB,yBAAyB,KAAK,CAAC,CAAC;CACtF,EAAE,CACJ;CACF,QAAQ,WAAW;CACnB,YAAY,WAAW;AACzB,EAAE,CACJ;AAEF,MAAM,qBAAqB,YACzB,MAAM,SACJ,MAAM,QAAQ,UAAU,EACtB,eAAe,YACb,YAAY,gCAAgC,wBAC1C,QAAQ,SAAS,aAAa,OAAO,CACvC,EACJ,CAAC,GACD,MAAM,QAAQ,kBAAkB,EAC9B,iBAAiB,UACf,YAAY,0CAA0C,uBACpD,QAAQ,iBAAiB,eAAe,KAAK,CAC/C,EACJ,CAAC,GACD,oBAAoB,QAAQ,SAAS,GACrC,MAAM,QAAQ,uBAAuB;CACnC,UAAU,IAAI,QACZ,YAAY,wCAAwC,iBAClD,QAAQ,sBAAsB,QAAQ,IAAI,GAAG,CAC/C;CACF,MAAM,IAAI,QACR,YAAY,oCAAoC,iBAC9C,QAAQ,sBAAsB,IAAI,IAAI,GAAG,CAC3C;CACF,MAAM,YACJ,YAAY,oCAAoC,iBAC9C,QAAQ,sBAAsB,IAAI,OAAO,CAC3C;AACJ,CAAC,GACDE,eAAqC,QAAQ,WAAW,GACxD,cACF;AAEF,MAAM,cAAiB,aAAoE;CACzF,eAAe,QAAQ,QAAQ;CAC/B,QAAQ,YACN,QAAQ,WACN,OAAO,QAAQ,UAAU,YAAY,QAAQ,OAAO,OAAO,CAAC,GAC5D,EACE,QAAQ,QAAQ,OAClB,CACF;AACJ;;AAGA,SAAgB,aAAgB,aAAkD;CAChF,OAAO,WAAW,eAAe,KAAK,WAAW,CAAC;AACpD;;;;AAKA,eAAsB,gBAAgB,SAAsD;CAC1F,MAAM,UAAU,eAAe,KAC7B,MAAM,OAAO,CAAC,CAAC,KAAK,MAAM,QAAQ,kBAAkB,OAAO,CAAC,CAAC,CAC/D;CACA,IAAI;EACF,MAAM,QAAQ,QAAQ;EACtB,OAAO,WAAW,OAAO;CAC3B,SAAS,OAAO;EACd,MAAM,QAAQ,QAAQ;EACtB,MAAM;CACR;AACF"}

package/dist/testing.d.mts

@@ -1,4 +1,5 @@
-import { D as StaleError, Jt as Service$1, Kt as Error$3, T as PartialApplyError, Wt as AsyncInterface, Y as ContinuationStore, a as Interface$2, c as Service$2, gt as Service, h as PartialError, hn as DomainName, ht as Interface, i as Error$2, in as Observed, j as ApplyReceipt, lt as Aggregate, mt as Error$1, n as AsyncInterface$1, o as Query, p as Error$5, qt as Interface$1, s as Resolution, st as CryptoError, x as ConflictError, y as AuthorizationError, yn as Error$4 } from "./resolver-BGBLnPjJ.mjs";
+import { D as Interface, E as Error$1, Nt as Error$3, O as Service, b as Aggregate, ct as Service$1, it as AsyncInterface, kt as DomainName, o as ContinuationStore, ot as Error$2, st as Interface$1, v as CryptoError, vt as Observed } from "./connect-10vHuShV.mjs";
+import { D as StaleError, T as PartialApplyError, a as Interface$2, c as Service$2, h as PartialError, i as Error$4, j as ApplyReceipt, n as AsyncInterface$1, o as Query, p as Error$5, s as Resolution, x as ConflictError, y as AuthorizationError } from "./resolver-DRrLm_hB.mjs";
 import { Effect, Layer, Schema } from "effect";
 declare namespace in_memory_lifecycle_repository_d_exports {
   export { Options$1 as Options, layer$2 as layer, make$3 as make };
@@ -25,7 +26,7 @@ declare const toAsync$1: (options?: Options) => AsyncInterface;
 declare namespace in_memory_d_exports$1 {
   export { Resolve, layer, make, toAsync };
 }
-type Resolve = (query: Query) => Resolution | Effect.Effect<Resolution, Error$2>;
+type Resolve = (query: Query) => Resolution | Effect.Effect<Resolution, Error$4>;
 declare function make(resolve: Resolve): Interface$2;
 declare const layer: (resolve: Resolve) => Layer.Layer<Service$2>;
 declare const toAsync: (resolve: Resolve) => AsyncInterface$1;
@@ -39,7 +40,7 @@ declare const Error_base: Schema.Class<Error, Schema.TaggedStruct<"ProviderConfo
 }>, import("effect/Cause").YieldableError>;
 declare class Error extends Error_base {}
 interface Input {
-  readonly makeProvider: () => Effect.Effect<Interface$1, Error$3>;
+  readonly makeProvider: () => Effect.Effect<Interface$1, Error$2>;
   readonly prefix?: string;
   readonly zone: DomainName;
 }
@@ -55,7 +56,7 @@ declare const run: (input: Input) => Effect.Effect<{
   cases: readonly ["create-readback-cleanup", "exact-noop", "conflict", "stale-plan", "partial-apply-cleanup"];
   providerId: string;
   zone: string & import("effect/Brand").Brand<"DomainName">;
-}, ApplyReceipt | AuthorizationError | ConflictError | CryptoError | Error$4 | Error$3 | Error$5 | Error | PartialApplyError | PartialError | StaleError, never>;
+}, ApplyReceipt | AuthorizationError | ConflictError | CryptoError | Error$3 | Error$2 | Error$5 | Error | PartialApplyError | PartialError | StaleError, never>;
 //#endregion
 export { in_memory_continuation_d_exports as InMemoryConnectionContinuations, in_memory_d_exports as InMemoryDnsProvider, in_memory_d_exports$1 as InMemoryDnsResolver, in_memory_lifecycle_repository_d_exports as InMemoryManagedDnsConnections, provider_conformance_d_exports as ProviderConformance };
 //# sourceMappingURL=testing.d.mts.map