domainkit 0.5.0 → 0.7.0

package/dist/testing.mjs

@@ -1,6 +1,7 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { F as webCryptoLayer, I as Error$2, L as Service$1, R as fromAsync$1, S as create, V as toAsync$2, _ as PartialApplyError, at as parse$1, b as apply, d as apply$1, f as authorize$1, ft as Error$1, h as ConflictError, i as toAsync$3, it as equals, kt as parse, n as Service$2, p as create$1, pt as Service, v as StaleError, wt as project, x as authorize, y as Target } from "./resolver-tZU6gEVq.mjs";
-import { Effect, Layer, Ref, Schema, Semaphore } from "effect";
+import { i as webCryptoLayer, k as parse, l as Revocation, o as Error$1, s as Service, w as project } from "./canonical-json-CQYKsZw7.mjs";
+import { C as authorize, I as Error$2, L as Service$1, R as fromAsync$1, S as apply, V as toAsync$2, _ as ConflictError, at as parse$1, b as StaleError, h as create$1, i as Service$2, it as equals, m as authorize$1, o as toAsync$3, p as apply$1, w as create, x as Target, y as PartialApplyError } from "./resolver-DPJs8h0a.mjs";
+import { DateTime, Effect, Layer, Ref, Schema, Semaphore } from "effect";
 //#region src/stores/in-memory-lifecycle-repository.ts
 var in_memory_lifecycle_repository_exports = /* @__PURE__ */ __exportAll({
 	layer: () => layer$2,
@@ -25,8 +26,8 @@ function conflict$1(operation, message) {
 function ownerConnection(aggregate, connectionId, ownerId) {
 	return aggregate.connections.find((connection) => connection.id === connectionId && connection.ownerId === ownerId);
 }
-function publicConnection(connection, authorization) {
-	return project(connection, authorization);
+function publicConnection(connection, authorization, credential) {
+	return project(connection, authorization, credential);
 }
 function make$3(options = {}) {
 	const state = Effect.runSync(Ref.make(/* @__PURE__ */ new Map()));
@@ -51,21 +52,19 @@ function make$3(options = {}) {
 	const get = Effect.fn("ManagedDnsConnections.get")((authorizationId) => Ref.get(state).pipe(Effect.map((entries) => entries.get(authorizationId) ?? null)));
 	const getByConnectionId = Effect.fn("ManagedDnsConnections.getByConnectionId")((connectionId) => Ref.get(state).pipe(Effect.map((entries) => [...entries.values()].find((aggregate) => aggregate.connections.some((connection) => connection.id === connectionId)) ?? null)));
 	const finishRevocation = Effect.fn("InMemoryManagedDnsConnections.finishRevocation")(function* (aggregate, connection, revoke) {
+		const requestedAt = yield* DateTime.nowAsDate;
 		const pending = {
 			...aggregate,
 			authorization: {
 				...aggregate.authorization,
-				revocation: aggregate.authorization.revocation._tag === "Pending" ? aggregate.authorization.revocation : {
-					_tag: "Pending",
-					requestedAt: /* @__PURE__ */ new Date()
-				}
+				revocation: aggregate.authorization.revocation._tag === "Pending" ? aggregate.authorization.revocation : Revocation.Pending({ requestedAt })
 			}
 		};
 		yield* commit("prepareRevocation", pending);
 		yield* revoke(pending.authorization);
 		yield* remove("completeRevocation", pending.authorization.id);
 		return {
-			connection: publicConnection(connection, pending.authorization),
+			connection: publicConnection(connection, pending.authorization, pending.credential),
 			remainingConnections: 0,
 			revokedAuthorization: true
 		};
@@ -82,7 +81,7 @@ function make$3(options = {}) {
 				if (existing.connectionId !== attachment.connectionId || existing.domain !== attachment.domain || existing.target.accountId !== attachment.target.accountId || existing.target.accountKind !== attachment.target.accountKind || existing.target.zoneId !== attachment.target.zoneId || existing.target.zoneName !== attachment.target.zoneName) return yield* conflict$1("attach", "Domain attachment id is already in use");
 				return {
 					attachment: existing,
-					connection: publicConnection(connection, aggregate.authorization)
+					connection: publicConnection(connection, aggregate.authorization, aggregate.credential)
 				};
 			}
 			if ([...(yield* Ref.get(state)).values()].some((candidate) => candidate.attachments.some(({ id }) => id === attachment.id))) return yield* conflict$1("attach", "Domain attachment id is already in use");
@@ -96,7 +95,7 @@ function make$3(options = {}) {
 			yield* commit("attach", next);
 			return {
 				attachment,
-				connection: publicConnection(connection, aggregate.authorization)
+				connection: publicConnection(connection, aggregate.authorization, aggregate.credential)
 			};
 		})),
 		connect: (input) => serialize(Effect.gen(function* () {
@@ -130,7 +129,7 @@ function make$3(options = {}) {
 				yield* commit("detach", next);
 				return {
 					attachment,
-					connection: publicConnection(connection, aggregate.authorization),
+					connection: publicConnection(connection, aggregate.authorization, aggregate.credential),
 					remainingAttachments: next.attachments.filter(({ connectionId }) => connectionId === connection.id).length
 				};
 			}
@@ -150,7 +149,7 @@ function make$3(options = {}) {
 				};
 				yield* commit("disconnectConnection", next);
 				return {
-					connection: publicConnection(connection, aggregate.authorization),
+					connection: publicConnection(connection, aggregate.authorization, aggregate.credential),
 					remainingConnections: remainingConnections.length,
 					revokedAuthorization: false
 				};
@@ -190,15 +189,11 @@ function make$3(options = {}) {
 			if (connection === void 0) return yield* missing("recover", "Pending authorization has no connection");
 			return yield* finishRevocation(aggregate, connection, revoke);
 		}).pipe(Effect.withSpan("ManagedDnsConnections.recover"))),
-		rotate: (authorizationId, credential, expiresAt) => serialize(Effect.gen(function* () {
+		rotate: (authorizationId, credential) => serialize(Effect.gen(function* () {
 			const aggregate = yield* get(authorizationId);
 			if (aggregate === null) return yield* missing("rotate", "Provider authorization does not exist");
 			const next = {
 				...aggregate,
-				authorization: {
-					...aggregate.authorization,
-					expiresAt
-				},
 				credential
 			};
 			yield* commit("rotate", next);

package/dist/testing.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"testing.mjs","names":["Lifecycle.Error","conflict","Connection.project","make","layer","Lifecycle.Service","make","make","DomainName.parse","layer","DnsProvider.Service","toAsync","DnsProvider.toAsync","DnsResolver.Service","DnsResolver.toAsync","DnsProvider.fromAsync","Provisioning.create","Provisioning.apply","Provisioning.authorize","Provisioning.PartialApplyError","DnsRecord.equals","Deletion.create","Deletion.apply","Deletion.authorize","Provisioning.ConflictError","Provisioning.StaleError","DnsProvider.Error","DnsProvider.Service","Digest.webCryptoLayer","DnsRecord.parse"],"sources":["../src/stores/in-memory-lifecycle-repository.ts","../src/stores/in-memory-continuation.ts","../src/provider/in-memory.ts","../src/verification/in-memory.ts","../src/testing/provider-conformance.ts"],"sourcesContent":["import { Effect, Layer, Ref, Semaphore } from \"effect\";\n\nimport * as ProviderAuthorization from \"../auth/authorization.ts\";\nimport * as Connection from \"../auth/connection.ts\";\nimport * as Lifecycle from \"../auth/lifecycle-repository.ts\";\n\nexport interface Options {\n  readonly beforeCommit?: (\n    operation: string,\n    aggregate: Lifecycle.Aggregate | null,\n  ) => Effect.Effect<void, Lifecycle.Error>;\n}\n\nfunction missing(operation: string, message: string): Lifecycle.Error {\n  return new Lifecycle.Error({\n    category: \"storage\",\n    message,\n    operation,\n    retry: \"never\",\n  });\n}\n\nfunction conflict(operation: string, message: string): Lifecycle.Error {\n  return new Lifecycle.Error({\n    category: \"storage\",\n    message,\n    operation,\n    retry: \"after-user-action\",\n  });\n}\n\nfunction ownerConnection(\n  aggregate: Lifecycle.Aggregate,\n  connectionId: string,\n  ownerId: string,\n): Connection.StoredConnection | undefined {\n  return aggregate.connections.find(\n    (connection) => connection.id === connectionId && connection.ownerId === ownerId,\n  );\n}\n\nfunction publicConnection(\n  connection: Connection.StoredConnection,\n  authorization: ProviderAuthorization.ProviderAuthorization,\n): Connection.ProviderConnection {\n  return Connection.project(connection, authorization);\n}\n\nexport function make(options: Options = {}): Lifecycle.Interface {\n  const state = Effect.runSync(Ref.make<ReadonlyMap<string, Lifecycle.Aggregate>>(new Map()));\n  const mutations = Semaphore.makeUnsafe(1);\n  const serialize = <A, E, R>(effect: Effect.Effect<A, E, R>) => mutations.withPermit(effect);\n\n  const commit = Effect.fn(\"InMemoryManagedDnsConnections.commit\")(function* (\n    operation: string,\n    aggregate: Lifecycle.Aggregate,\n  ) {\n    if (options.beforeCommit !== undefined) yield* options.beforeCommit(operation, aggregate);\n    yield* Ref.update(state, (entries) => {\n      const next = new Map(entries);\n      next.set(aggregate.authorization.id, aggregate);\n      return next;\n    });\n  });\n\n  const remove = Effect.fn(\"InMemoryManagedDnsConnections.remove\")(function* (\n    operation: string,\n    authorizationId: string,\n  ) {\n    if (options.beforeCommit !== undefined) yield* options.beforeCommit(operation, null);\n    yield* Ref.update(state, (entries) => {\n      const next = new Map(entries);\n      next.delete(authorizationId);\n      return next;\n    });\n  });\n\n  const get = Effect.fn(\"ManagedDnsConnections.get\")((authorizationId: string) =>\n    Ref.get(state).pipe(Effect.map((entries) => entries.get(authorizationId) ?? null)),\n  );\n\n  const getByConnectionId = Effect.fn(\"ManagedDnsConnections.getByConnectionId\")(\n    (connectionId: string) =>\n      Ref.get(state).pipe(\n        Effect.map(\n          (entries) =>\n            [...entries.values()].find((aggregate) =>\n              aggregate.connections.some((connection) => connection.id === connectionId),\n            ) ?? null,\n        ),\n      ),\n  );\n\n  const finishRevocation = Effect.fn(\"InMemoryManagedDnsConnections.finishRevocation\")(function* <\n    E,\n  >(\n    aggregate: Lifecycle.Aggregate,\n    connection: Connection.StoredConnection,\n    revoke: (authorization: ProviderAuthorization.ProviderAuthorization) => Effect.Effect<void, E>,\n  ) {\n    const pending: Lifecycle.Aggregate = {\n      ...aggregate,\n      authorization: {\n        ...aggregate.authorization,\n        revocation:\n          aggregate.authorization.revocation._tag === \"Pending\"\n            ? aggregate.authorization.revocation\n            : { _tag: \"Pending\", requestedAt: new Date() },\n      },\n    };\n    yield* commit(\"prepareRevocation\", pending);\n    yield* revoke(pending.authorization);\n    yield* remove(\"completeRevocation\", pending.authorization.id);\n    return {\n      connection: publicConnection(connection, pending.authorization),\n      remainingConnections: 0,\n      revokedAuthorization: true,\n    } satisfies Lifecycle.DisconnectResult;\n  });\n\n  return Lifecycle.Service.of({\n    attach: ({ attachment, connectionId, ownerId }) =>\n      serialize(\n        Effect.gen(function* () {\n          const aggregate = yield* getByConnectionId(connectionId);\n          if (aggregate === null) {\n            return yield* missing(\"attach\", \"Provider connection does not exist\");\n          }\n          const connection = ownerConnection(aggregate, connectionId, ownerId);\n          if (connection === undefined) {\n            return yield* missing(\"attach\", \"Provider connection does not belong to this owner\");\n          }\n          if (attachment.connectionId !== connectionId) {\n            return yield* conflict(\"attach\", \"Domain attachment targets another connection\");\n          }\n          const existing = aggregate.attachments.find(({ id }) => id === attachment.id);\n          if (existing !== undefined) {\n            if (\n              existing.connectionId !== attachment.connectionId ||\n              existing.domain !== attachment.domain ||\n              existing.target.accountId !== attachment.target.accountId ||\n              existing.target.accountKind !== attachment.target.accountKind ||\n              existing.target.zoneId !== attachment.target.zoneId ||\n              existing.target.zoneName !== attachment.target.zoneName\n            ) {\n              return yield* conflict(\"attach\", \"Domain attachment id is already in use\");\n            }\n            return {\n              attachment: existing,\n              connection: publicConnection(connection, aggregate.authorization),\n            };\n          }\n          const duplicateId = [...(yield* Ref.get(state)).values()].some((candidate) =>\n            candidate.attachments.some(({ id }) => id === attachment.id),\n          );\n          if (duplicateId) {\n            return yield* conflict(\"attach\", \"Domain attachment id is already in use\");\n          }\n          const duplicate = [...(yield* Ref.get(state)).values()].some((candidate) => {\n            return candidate.attachments.some(\n              ({ connectionId: attachmentConnectionId, domain }) =>\n                domain === attachment.domain &&\n                candidate.connections.some(\n                  (candidateConnection) =>\n                    candidateConnection.id === attachmentConnectionId &&\n                    candidateConnection.ownerId === ownerId,\n                ),\n            );\n          });\n          if (duplicate) {\n            return yield* conflict(\n              \"attach\",\n              \"An organization domain already has a provider attachment\",\n            );\n          }\n          const next: Lifecycle.Aggregate = {\n            ...aggregate,\n            attachments: [...aggregate.attachments, attachment],\n          };\n          yield* commit(\"attach\", next);\n          return {\n            attachment,\n            connection: publicConnection(connection, aggregate.authorization),\n          };\n        }),\n      ),\n    connect: (input) =>\n      serialize(\n        Effect.gen(function* () {\n          const entries = yield* Ref.get(state);\n          const current = entries.get(input.authorization.id);\n          if (\n            current?.authorization.revocation._tag === \"Pending\" ||\n            (input.expectedAuthorizationId !== undefined && current === undefined)\n          ) {\n            return yield* conflict(\n              \"connect\",\n              current === undefined\n                ? \"Provider authorization no longer exists\"\n                : \"Provider authorization is awaiting revocation recovery\",\n            );\n          }\n          if (\n            input.expectedAuthorizationId !== undefined &&\n            current?.authorization.id !== input.expectedAuthorizationId\n          ) {\n            return yield* conflict(\"connect\", \"Provider authorization changed during reconnect\");\n          }\n          if (\n            input.authorization.id !== input.connection.authorizationId ||\n            input.authorization.providerId !== input.connection.providerId ||\n            input.authorization.method !== input.connection.method\n          ) {\n            return yield* conflict(\"connect\", \"Connection does not match its authorization\");\n          }\n          const existingConnection = current?.connections.find(\n            (connection) => connection.ownerId === input.connection.ownerId,\n          );\n          if (\n            input.expectedConnectionId !== undefined &&\n            existingConnection?.id !== input.expectedConnectionId\n          ) {\n            return yield* conflict(\"connect\", \"Organization connection changed during reconnect\");\n          }\n          const connection = existingConnection ?? input.connection;\n          const next: Lifecycle.Aggregate = {\n            authorization: input.authorization,\n            connections: current\n              ? [...current.connections.filter(({ id }) => id !== connection.id), connection]\n              : [connection],\n            attachments: current?.attachments ?? [],\n            credential: input.credential,\n          };\n          yield* commit(\"connect\", next);\n          return next;\n        }),\n      ),\n    detach: ({ attachmentId, ownerId }) =>\n      serialize(\n        Effect.gen(function* () {\n          const entries = yield* Ref.get(state);\n          for (const aggregate of entries.values()) {\n            const attachment = aggregate.attachments.find(({ id }) => id === attachmentId);\n            if (attachment === undefined) continue;\n            const connection = ownerConnection(aggregate, attachment.connectionId, ownerId);\n            if (connection === undefined) {\n              return yield* missing(\"detach\", \"Domain attachment does not belong to this owner\");\n            }\n            const next: Lifecycle.Aggregate = {\n              ...aggregate,\n              attachments: aggregate.attachments.filter(({ id }) => id !== attachmentId),\n            };\n            yield* commit(\"detach\", next);\n            return {\n              attachment,\n              connection: publicConnection(connection, aggregate.authorization),\n              remainingAttachments: next.attachments.filter(\n                ({ connectionId }) => connectionId === connection.id,\n              ).length,\n            };\n          }\n          return yield* missing(\"detach\", \"Domain attachment does not exist\");\n        }),\n      ),\n    disconnect: ({ connectionId, ownerId, revoke }) =>\n      serialize(\n        Effect.gen(function* () {\n          const aggregate = yield* getByConnectionId(connectionId);\n          if (aggregate === null) {\n            return yield* missing(\"disconnect\", \"Provider connection does not exist\");\n          }\n          const connection = ownerConnection(aggregate, connectionId, ownerId);\n          if (connection === undefined) {\n            return yield* missing(\n              \"disconnect\",\n              \"Provider connection does not belong to this owner\",\n            );\n          }\n          if (aggregate.attachments.some(({ connectionId: id }) => id === connectionId)) {\n            return yield* conflict(\n              \"disconnect\",\n              \"Detach all organization domains before disconnecting the provider\",\n            );\n          }\n          const remainingConnections = aggregate.connections.filter(\n            ({ id }) => id !== connectionId,\n          );\n          if (remainingConnections.length > 0) {\n            const next: Lifecycle.Aggregate = { ...aggregate, connections: remainingConnections };\n            yield* commit(\"disconnectConnection\", next);\n            return {\n              connection: publicConnection(connection, aggregate.authorization),\n              remainingConnections: remainingConnections.length,\n              revokedAuthorization: false,\n            };\n          }\n          return yield* finishRevocation(aggregate, connection, revoke);\n        }).pipe(Effect.withSpan(\"ManagedDnsConnections.disconnect\")),\n      ),\n    findConnection: (ownerId, authorizationId) =>\n      Ref.get(state).pipe(\n        Effect.map(\n          (entries) =>\n            entries.get(authorizationId)?.connections.find(({ ownerId: id }) => id === ownerId) ??\n            null,\n        ),\n      ),\n    get,\n    getAttachment: (attachmentId) =>\n      Ref.get(state).pipe(\n        Effect.map(\n          (entries) =>\n            [...entries.values()]\n              .flatMap(({ attachments }) => attachments)\n              .find(({ id }) => id === attachmentId) ?? null,\n        ),\n      ),\n    getByConnectionId,\n    listAttachments: (connectionId, ownerId) =>\n      Effect.gen(function* () {\n        const aggregate = yield* getByConnectionId(connectionId);\n        if (aggregate === null) {\n          return yield* missing(\"listAttachments\", \"Provider connection does not exist\");\n        }\n        if (ownerConnection(aggregate, connectionId, ownerId) === undefined) {\n          return yield* missing(\n            \"listAttachments\",\n            \"Provider connection does not belong to this owner\",\n          );\n        }\n        return aggregate.attachments.filter(({ connectionId: id }) => id === connectionId);\n      }),\n    promoteEvidence: (authorizationId, evidence) =>\n      serialize(\n        Effect.gen(function* () {\n          const aggregate = yield* get(authorizationId);\n          if (aggregate === null) {\n            return yield* missing(\"promoteEvidence\", \"Provider authorization does not exist\");\n          }\n          const byCapability = new Map(\n            aggregate.authorization.capabilityEvidence.map((item) => [item.capability, item]),\n          );\n          for (const item of evidence) byCapability.set(item.capability, item);\n          const next = {\n            ...aggregate,\n            authorization: {\n              ...aggregate.authorization,\n              capabilityEvidence: [...byCapability.values()],\n            },\n          };\n          yield* commit(\"promoteEvidence\", next);\n          return next;\n        }),\n      ),\n    recover: ({ authorizationId, revoke }) =>\n      serialize(\n        Effect.gen(function* () {\n          const aggregate = yield* get(authorizationId);\n          if (aggregate === null) {\n            return yield* missing(\"recover\", \"Provider authorization does not exist\");\n          }\n          if (aggregate.authorization.revocation._tag !== \"Pending\") {\n            return yield* missing(\"recover\", \"Provider authorization is not awaiting revocation\");\n          }\n          const connection = aggregate.connections[0];\n          if (connection === undefined) {\n            return yield* missing(\"recover\", \"Pending authorization has no connection\");\n          }\n          return yield* finishRevocation(aggregate, connection, revoke);\n        }).pipe(Effect.withSpan(\"ManagedDnsConnections.recover\")),\n      ),\n    rotate: (authorizationId, credential, expiresAt) =>\n      serialize(\n        Effect.gen(function* () {\n          const aggregate = yield* get(authorizationId);\n          if (aggregate === null) {\n            return yield* missing(\"rotate\", \"Provider authorization does not exist\");\n          }\n          const next = {\n            ...aggregate,\n            authorization: { ...aggregate.authorization, expiresAt },\n            credential,\n          };\n          yield* commit(\"rotate\", next);\n          return next;\n        }),\n      ),\n  });\n}\n\nexport const layer = (options: Options = {}) => Layer.sync(Lifecycle.Service, () => make(options));\n","import { Effect, Ref } from \"effect\";\n\nimport type * as Connection from \"../auth/connect.ts\";\n\nexport function make(): Connection.ContinuationStore {\n  const state = Effect.runSync(Ref.make<ReadonlyMap<string, Connection.Continuation>>(new Map()));\n  return {\n    consume: Effect.fn(\"ConnectionContinuations.consume\")(function* (id, now) {\n      return yield* Ref.modify(state, (entries) => {\n        const continuation = entries.get(id);\n        const next = new Map(entries);\n        next.delete(id);\n        return [\n          continuation !== undefined && continuation.expiresAt > now ? continuation : null,\n          next,\n        ] as const;\n      });\n    }),\n    put: Effect.fn(\"ConnectionContinuations.put\")((continuation) =>\n      Ref.update(state, (entries) => {\n        const next = new Map(entries);\n        next.set(continuation.id, continuation);\n        return next;\n      }),\n    ),\n  };\n}\n","import { Effect, Layer } from \"effect\";\n\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport type * as DnsRecord from \"../domain/dns-record.ts\";\nimport * as DnsProvider from \"./provider.ts\";\n\nexport interface Options {\n  readonly id?: string;\n  readonly records?: Readonly<Record<string, ReadonlyArray<DnsRecord.Observed>>>;\n}\n\nexport function make(options: Options = {}): DnsProvider.Interface {\n  const id = options.id ?? \"memory\";\n  const records = new Map<DomainName.DomainName, Array<DnsRecord.Observed>>();\n  const recordIds = new Map<string, DnsRecord.Observed>();\n  for (const [zone, initial] of Object.entries(options.records ?? {})) {\n    records.set(DomainName.parse(zone), [...initial]);\n    for (const [index, record] of initial.entries()) recordIds.set(`${id}:${index + 1}`, record);\n  }\n  return {\n    id,\n    listRecords: Effect.fn(\"InMemoryDnsProvider.listRecords\")((zone) =>\n      Effect.sync(() => [...(records.get(zone) ?? [])]),\n    ),\n    createRecord: Effect.fn(\"InMemoryDnsProvider.createRecord\")((zone, record) =>\n      Effect.sync(() => {\n        const current = records.get(zone) ?? [];\n        current.push(record);\n        records.set(zone, current);\n        const providerRecordId = `${id}:${current.length}`;\n        recordIds.set(providerRecordId, record);\n        return { providerRecordId };\n      }),\n    ),\n    deleteRecord: Effect.fn(\"InMemoryDnsProvider.deleteRecord\")((zone, providerRecordId) =>\n      Effect.sync(() => {\n        const record = recordIds.get(providerRecordId);\n        if (record === undefined) return;\n        records.set(\n          zone,\n          (records.get(zone) ?? []).filter((candidate) => candidate !== record),\n        );\n        recordIds.delete(providerRecordId);\n      }),\n    ),\n    getRecord: Effect.fn(\"InMemoryDnsProvider.getRecord\")((_zone, providerRecordId) =>\n      Effect.sync(() => recordIds.get(providerRecordId) ?? null),\n    ),\n  };\n}\n\nexport const layer = (options: Options = {}): Layer.Layer<DnsProvider.Service> =>\n  Layer.succeed(DnsProvider.Service, make(options));\n\nexport const toAsync = (options: Options = {}): DnsProvider.AsyncInterface =>\n  DnsProvider.toAsync(make(options));\n","import { Effect, Layer } from \"effect\";\n\nimport * as DnsResolver from \"./resolver.ts\";\n\nexport type Resolve = (\n  query: DnsResolver.Query,\n) => DnsResolver.Resolution | Effect.Effect<DnsResolver.Resolution, DnsResolver.Error>;\n\nexport function make(resolve: Resolve): DnsResolver.Interface {\n  return {\n    resolve: Effect.fn(\"InMemoryDnsResolver.resolve\")((query) =>\n      Effect.suspend(() => {\n        const resolution = resolve(query);\n        return Effect.isEffect(resolution) ? resolution : Effect.succeed(resolution);\n      }),\n    ),\n  };\n}\n\nexport const layer = (resolve: Resolve): Layer.Layer<DnsResolver.Service> =>\n  Layer.succeed(DnsResolver.Service, make(resolve));\n\nexport const toAsync = (resolve: Resolve): DnsResolver.AsyncInterface =>\n  DnsResolver.toAsync(make(resolve));\n","import { Effect, Layer, Schema } from \"effect\";\n\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport * as DnsRecord from \"../domain/dns-record.ts\";\nimport * as Deletion from \"../plan/deletion.ts\";\nimport * as Digest from \"../plan/canonical-json.ts\";\nimport * as Provisioning from \"../plan/plan.ts\";\nimport * as DnsProvider from \"../provider/provider.ts\";\n\nexport class Error extends Schema.TaggedError<Error>()(\"ProviderConformanceError\", {\n  case: Schema.String,\n  message: Schema.String,\n  providerId: Schema.String,\n}) {}\n\nexport interface Input {\n  readonly makeProvider: () => Effect.Effect<DnsProvider.Interface, DnsProvider.Error>;\n  readonly prefix?: string;\n  readonly zone: DomainName.DomainName;\n}\n\nexport interface Report {\n  readonly cases: ReadonlyArray<string>;\n  readonly providerId: string;\n  readonly zone: DomainName.DomainName;\n}\n\n/** Adapt a fresh Promise-shaped provider factory for the Effect-native conformance runner. */\nexport function fromAsync(makeProvider: () => DnsProvider.AsyncInterface): Input[\"makeProvider\"] {\n  return () => Effect.sync(() => DnsProvider.fromAsync(makeProvider()));\n}\n\nconst cases = [\n  \"create-readback-cleanup\",\n  \"exact-noop\",\n  \"conflict\",\n  \"stale-plan\",\n  \"partial-apply-cleanup\",\n] as const;\n\n/** Run the deterministic offline contract every DomainKit DNS adapter must satisfy. */\nexport const run = Effect.fn(\"ProviderConformance.run\")(function* (input: Input) {\n  const makeProvider = () =>\n    Effect.suspend(input.makeProvider).pipe(\n      Effect.catchDefect((cause) =>\n        Effect.fail(\n          new Error({\n            case: \"factory\",\n            message: cause instanceof globalThis.Error ? cause.message : \"Provider factory failed\",\n            providerId: \"unknown\",\n          }),\n        ),\n      ),\n    );\n  const first = yield* makeProvider();\n  const providerId = first.id;\n  const prefix = input.prefix ?? \"domainkit-conformance\";\n  yield* createReadbackCleanup(first, input.zone, prefix);\n  yield* exactNoop(yield* makeProvider(), input.zone, prefix);\n  yield* conflict(yield* makeProvider(), input.zone, prefix);\n  yield* stalePlan(yield* makeProvider(), input.zone, prefix);\n  yield* partialApplyCleanup(yield* makeProvider(), input.zone, prefix);\n  return { cases, providerId, zone: input.zone } satisfies Report;\n});\n\nfunction createReadbackCleanup(\n  provider: DnsProvider.Interface,\n  zone: DomainName.DomainName,\n  prefix: string,\n) {\n  const requirements = createRequirements(zone, prefix);\n  let cleanupRecordIds: ReadonlyArray<string> = [];\n  return Effect.gen(function* () {\n    const { plan } = yield* Provisioning.create({\n      requirements,\n      target: Provisioning.Target.ExactZone({ zone }),\n    });\n    yield* requireTags(provider, \"create-readback-cleanup\", plan.operations, [\"create\", \"create\"]);\n    const receipt = yield* Provisioning.apply({\n      authorization: yield* Provisioning.authorize(plan),\n      plan,\n    }).pipe(\n      Effect.tapError((failure) =>\n        failure instanceof Provisioning.PartialApplyError\n          ? Effect.sync(() => {\n              cleanupRecordIds = providerRecordIds(failure.receipt.operations);\n            })\n          : Effect.void,\n      ),\n    );\n    cleanupRecordIds = providerRecordIds(receipt.operations);\n    yield* requireCondition(\n      provider,\n      \"create-readback-cleanup\",\n      receipt.status === \"complete\" &&\n        receipt.operations.every(({ providerRecordId }) => providerRecordId !== null),\n      \"apply must return a complete receipt with provider record IDs\",\n    );\n    const observed = yield* provider.listRecords(zone);\n    yield* requireCondition(\n      provider,\n      \"create-readback-cleanup\",\n      requirements.every((requirement) =>\n        observed.some(\n          (record) => record._tag !== \"Opaque\" && DnsRecord.equals(record, requirement),\n        ),\n      ),\n      \"listRecords must return every created record, including across provider pages\",\n    );\n    const deletion = yield* Deletion.create({ plan, receipt });\n    const deletionReceipt = yield* Deletion.apply({\n      authorization: yield* Deletion.authorize(deletion),\n      plan: deletion,\n    });\n    yield* requireCondition(\n      provider,\n      \"create-readback-cleanup\",\n      deletionReceipt.status === \"complete\" &&\n        (yield* recordIdsAbsent(provider, zone, cleanupRecordIds)),\n      \"receipt-bound cleanup must remove every created record\",\n    );\n  }).pipe(\n    Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)),\n    Effect.provide(providerLayer(provider)),\n  );\n}\n\nfunction exactNoop(provider: DnsProvider.Interface, zone: DomainName.DomainName, prefix: string) {\n  const requirement = cname(zone, `${prefix}-exact`);\n  let cleanupRecordIds: ReadonlyArray<string> = [];\n  return Effect.gen(function* () {\n    const created = yield* provider.createRecord(zone, requirement);\n    cleanupRecordIds = created.providerRecordId === null ? [] : [created.providerRecordId];\n    const { plan } = yield* Provisioning.create({\n      requirements: [requirement],\n      target: Provisioning.Target.ExactZone({ zone }),\n    });\n    yield* requireTags(provider, \"exact-noop\", plan.operations, [\"noop\"]);\n    const receipt = yield* Provisioning.apply({\n      authorization: yield* Provisioning.authorize(plan),\n      plan,\n    });\n    yield* requireCondition(\n      provider,\n      \"exact-noop\",\n      receipt.operations.length === 0,\n      \"an exact plan must not create another record\",\n    );\n    yield* deleteCreated(provider, zone, created.providerRecordId, \"exact-noop\");\n  }).pipe(\n    Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)),\n    Effect.provide(providerLayer(provider)),\n  );\n}\n\nfunction conflict(provider: DnsProvider.Interface, zone: DomainName.DomainName, prefix: string) {\n  const requirement = cname(zone, `${prefix}-conflict`);\n  const occupied = txt(zone, `${prefix}-conflict`, \"occupied\");\n  let cleanupRecordIds: ReadonlyArray<string> = [];\n  return Effect.gen(function* () {\n    const created = yield* provider.createRecord(zone, occupied);\n    cleanupRecordIds = created.providerRecordId === null ? [] : [created.providerRecordId];\n    const { plan } = yield* Provisioning.create({\n      requirements: [requirement],\n      target: Provisioning.Target.ExactZone({ zone }),\n    });\n    yield* requireTags(provider, \"conflict\", plan.operations, [\"conflict\"]);\n    const failure = yield* Provisioning.apply({\n      authorization: yield* Provisioning.authorize(plan),\n      plan,\n    }).pipe(Effect.flip);\n    yield* requireCondition(\n      provider,\n      \"conflict\",\n      failure instanceof Provisioning.ConflictError,\n      \"apply must fail closed on incompatible state\",\n    );\n    yield* deleteCreated(provider, zone, created.providerRecordId, \"conflict\");\n  }).pipe(\n    Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)),\n    Effect.provide(providerLayer(provider)),\n  );\n}\n\nfunction stalePlan(provider: DnsProvider.Interface, zone: DomainName.DomainName, prefix: string) {\n  const requirement = cname(zone, `${prefix}-stale`);\n  let cleanupRecordIds: ReadonlyArray<string> = [];\n  return Effect.gen(function* () {\n    const { plan } = yield* Provisioning.create({\n      requirements: [requirement],\n      target: Provisioning.Target.ExactZone({ zone }),\n    });\n    const authorization = yield* Provisioning.authorize(plan);\n    const created = yield* provider.createRecord(zone, requirement);\n    cleanupRecordIds = created.providerRecordId === null ? [] : [created.providerRecordId];\n    const failure = yield* Provisioning.apply({ authorization, plan }).pipe(Effect.flip);\n    yield* requireCondition(\n      provider,\n      \"stale-plan\",\n      failure instanceof Provisioning.StaleError,\n      \"apply must reject provider state that changed after authorization\",\n    );\n    yield* deleteCreated(provider, zone, created.providerRecordId, \"stale-plan\");\n  }).pipe(\n    Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)),\n    Effect.provide(providerLayer(provider)),\n  );\n}\n\nfunction partialApplyCleanup(\n  provider: DnsProvider.Interface,\n  zone: DomainName.DomainName,\n  prefix: string,\n) {\n  let creates = 0;\n  const flaky = DnsProvider.Service.of({\n    ...provider,\n    createRecord: Effect.fn(\"ProviderConformance.createRecord\")((target, record) => {\n      creates += 1;\n      return creates === 1\n        ? provider.createRecord(target, record)\n        : Effect.fail(\n            new DnsProvider.Error({\n              message: \"injected conformance failure\",\n              operation: \"createRecord\",\n              providerId: provider.id,\n            }),\n          );\n    }),\n  });\n  const requirements = [\n    cname(zone, `${prefix}-partial-one`),\n    txt(zone, `${prefix}-partial-two`, \"domainkit\"),\n  ];\n  let cleanupRecordIds: ReadonlyArray<string> = [];\n  return Effect.gen(function* () {\n    const { plan } = yield* Provisioning.create({\n      requirements,\n      target: Provisioning.Target.ExactZone({ zone }),\n    });\n    const failure = yield* Provisioning.apply({\n      authorization: yield* Provisioning.authorize(plan),\n      plan,\n    }).pipe(Effect.flip);\n    cleanupRecordIds =\n      failure instanceof Provisioning.PartialApplyError\n        ? providerRecordIds(failure.receipt.operations)\n        : [];\n    yield* requireCondition(\n      provider,\n      \"partial-apply-cleanup\",\n      failure instanceof Provisioning.PartialApplyError && failure.receipt.operations.length === 1,\n      \"a later write failure must preserve the first confirmed write in a partial receipt\",\n    );\n    if (!(failure instanceof Provisioning.PartialApplyError)) return;\n    const deletion = yield* Deletion.create({ plan, receipt: failure.receipt }).pipe(\n      Effect.provide(providerLayer(provider)),\n    );\n    yield* Deletion.apply({\n      authorization: yield* Deletion.authorize(deletion),\n      plan: deletion,\n    }).pipe(Effect.provide(providerLayer(provider)));\n    yield* requireCondition(\n      provider,\n      \"partial-apply-cleanup\",\n      yield* recordIdsAbsent(provider, zone, cleanupRecordIds),\n      \"partial receipt cleanup must remove the confirmed write\",\n    );\n  }).pipe(\n    Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)),\n    Effect.provide(providerLayer(flaky)),\n  );\n}\n\nfunction providerRecordIds(\n  operations: ReadonlyArray<{ readonly providerRecordId: string | null }>,\n): ReadonlyArray<string> {\n  return operations.flatMap(({ providerRecordId }) =>\n    providerRecordId === null ? [] : [providerRecordId],\n  );\n}\n\nfunction recordIdsAbsent(\n  provider: DnsProvider.Interface,\n  zone: DomainName.DomainName,\n  recordIds: ReadonlyArray<string>,\n) {\n  return Effect.forEach(recordIds, (providerRecordId) =>\n    provider.getRecord(zone, providerRecordId),\n  ).pipe(Effect.map((records) => records.every((record) => record === null)));\n}\n\nfunction bestEffortDelete(\n  provider: DnsProvider.Interface,\n  zone: DomainName.DomainName,\n  recordIds: () => ReadonlyArray<string>,\n) {\n  return Effect.suspend(() =>\n    Effect.forEach(\n      recordIds(),\n      (providerRecordId) => provider.deleteRecord(zone, providerRecordId).pipe(Effect.ignore),\n      { discard: true },\n    ),\n  );\n}\n\nfunction providerLayer(provider: DnsProvider.Interface) {\n  return Layer.merge(Layer.succeed(DnsProvider.Service, provider), Digest.webCryptoLayer);\n}\n\nfunction createRequirements(zone: DomainName.DomainName, prefix: string) {\n  return [cname(zone, `${prefix}-create`), txt(zone, `${prefix}-page`, \"domainkit\")];\n}\n\nfunction cname(zone: DomainName.DomainName, label: string) {\n  return DnsRecord.parse({\n    _tag: \"CNAME\",\n    metadata: { ownership: \"tester\", provenance: \"domainkit\", purpose: \"conformance\" },\n    name: `${label}.${zone}`,\n    policy: \"exclusive\",\n    target: \"target.example.net\",\n    ttl: 300,\n  });\n}\n\nfunction txt(zone: DomainName.DomainName, label: string, value: string) {\n  return DnsRecord.parse({\n    _tag: \"TXT\",\n    metadata: { ownership: \"tester\", provenance: \"domainkit\", purpose: \"conformance\" },\n    name: `${label}.${zone}`,\n    policy: \"append\",\n    ttl: 300,\n    value,\n  });\n}\n\nfunction requireTags(\n  provider: DnsProvider.Interface,\n  testCase: string,\n  operations: ReadonlyArray<{ readonly _tag: string }>,\n  expected: ReadonlyArray<string>,\n) {\n  return requireCondition(\n    provider,\n    testCase,\n    JSON.stringify(operations.map(({ _tag }) => _tag)) === JSON.stringify(expected),\n    `expected operations ${expected.join(\", \")}`,\n  );\n}\n\nfunction requireCondition(\n  provider: DnsProvider.Interface,\n  testCase: string,\n  condition: boolean,\n  message: string,\n) {\n  return condition\n    ? Effect.void\n    : Effect.fail(new Error({ case: testCase, message, providerId: provider.id }));\n}\n\nfunction deleteCreated(\n  provider: DnsProvider.Interface,\n  zone: DomainName.DomainName,\n  providerRecordId: string | null,\n  testCase: string,\n) {\n  return providerRecordId === null\n    ? Effect.fail(\n        new Error({\n          case: testCase,\n          message: \"provider must return record IDs for safe cleanup\",\n          providerId: provider.id,\n        }),\n      )\n    : provider.deleteRecord(zone, providerRecordId);\n}\n"],"mappings":";;;;;;;;AAaA,SAAS,QAAQ,WAAmB,SAAkC;CACpE,OAAO,IAAIA,QAAgB;EACzB,UAAU;EACV;EACA;EACA,OAAO;CACT,CAAC;AACH;AAEA,SAASC,WAAS,WAAmB,SAAkC;CACrE,OAAO,IAAID,QAAgB;EACzB,UAAU;EACV;EACA;EACA,OAAO;CACT,CAAC;AACH;AAEA,SAAS,gBACP,WACA,cACA,SACyC;CACzC,OAAO,UAAU,YAAY,MAC1B,eAAe,WAAW,OAAO,gBAAgB,WAAW,YAAY,OAC3E;AACF;AAEA,SAAS,iBACP,YACA,eAC+B;CAC/B,OAAOE,QAAmB,YAAY,aAAa;AACrD;AAEA,SAAgBC,OAAK,UAAmB,CAAC,GAAwB;CAC/D,MAAM,QAAQ,OAAO,QAAQ,IAAI,qBAA+C,IAAI,IAAI,CAAC,CAAC;CAC1F,MAAM,YAAY,UAAU,WAAW,CAAC;CACxC,MAAM,aAAsB,WAAmC,UAAU,WAAW,MAAM;CAE1F,MAAM,SAAS,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAC/D,WACA,WACA;EACA,IAAI,QAAQ,iBAAiB,KAAA,GAAW,OAAO,QAAQ,aAAa,WAAW,SAAS;EACxF,OAAO,IAAI,OAAO,QAAQ,YAAY;GACpC,MAAM,OAAO,IAAI,IAAI,OAAO;GAC5B,KAAK,IAAI,UAAU,cAAc,IAAI,SAAS;GAC9C,OAAO;EACT,CAAC;CACH,CAAC;CAED,MAAM,SAAS,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAC/D,WACA,iBACA;EACA,IAAI,QAAQ,iBAAiB,KAAA,GAAW,OAAO,QAAQ,aAAa,WAAW,IAAI;EACnF,OAAO,IAAI,OAAO,QAAQ,YAAY;GACpC,MAAM,OAAO,IAAI,IAAI,OAAO;GAC5B,KAAK,OAAO,eAAe;GAC3B,OAAO;EACT,CAAC;CACH,CAAC;CAED,MAAM,MAAM,OAAO,GAAG,2BAA2B,CAAC,EAAE,oBAClD,IAAI,IAAI,KAAK,CAAC,CAAC,KAAK,OAAO,KAAK,YAAY,QAAQ,IAAI,eAAe,KAAK,IAAI,CAAC,CACnF;CAEA,MAAM,oBAAoB,OAAO,GAAG,yCAAyC,CAAC,EAC3E,iBACC,IAAI,IAAI,KAAK,CAAC,CAAC,KACb,OAAO,KACJ,YACC,CAAC,GAAG,QAAQ,OAAO,CAAC,CAAC,CAAC,MAAM,cAC1B,UAAU,YAAY,MAAM,eAAe,WAAW,OAAO,YAAY,CAC3E,KAAK,IACT,CACF,CACJ;CAEA,MAAM,mBAAmB,OAAO,GAAG,gDAAgD,CAAC,CAAC,WAGnF,WACA,YACA,QACA;EACA,MAAM,UAA+B;GACnC,GAAG;GACH,eAAe;IACb,GAAG,UAAU;IACb,YACE,UAAU,cAAc,WAAW,SAAS,YACxC,UAAU,cAAc,aACxB;KAAE,MAAM;KAAW,6BAAa,IAAI,KAAK;IAAE;GACnD;EACF;EACA,OAAO,OAAO,qBAAqB,OAAO;EAC1C,OAAO,OAAO,QAAQ,aAAa;EACnC,OAAO,OAAO,sBAAsB,QAAQ,cAAc,EAAE;EAC5D,OAAO;GACL,YAAY,iBAAiB,YAAY,QAAQ,aAAa;GAC9D,sBAAsB;GACtB,sBAAsB;EACxB;CACF,CAAC;CAED,OAAA,QAAyB,GAAG;EAC1B,SAAS,EAAE,YAAY,cAAc,cACnC,UACE,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,kBAAkB,YAAY;GACvD,IAAI,cAAc,MAChB,OAAO,OAAO,QAAQ,UAAU,oCAAoC;GAEtE,MAAM,aAAa,gBAAgB,WAAW,cAAc,OAAO;GACnE,IAAI,eAAe,KAAA,GACjB,OAAO,OAAO,QAAQ,UAAU,mDAAmD;GAErF,IAAI,WAAW,iBAAiB,cAC9B,OAAO,OAAOF,WAAS,UAAU,8CAA8C;GAEjF,MAAM,WAAW,UAAU,YAAY,MAAM,EAAE,SAAS,OAAO,WAAW,EAAE;GAC5E,IAAI,aAAa,KAAA,GAAW;IAC1B,IACE,SAAS,iBAAiB,WAAW,gBACrC,SAAS,WAAW,WAAW,UAC/B,SAAS,OAAO,cAAc,WAAW,OAAO,aAChD,SAAS,OAAO,gBAAgB,WAAW,OAAO,eAClD,SAAS,OAAO,WAAW,WAAW,OAAO,UAC7C,SAAS,OAAO,aAAa,WAAW,OAAO,UAE/C,OAAO,OAAOA,WAAS,UAAU,wCAAwC;IAE3E,OAAO;KACL,YAAY;KACZ,YAAY,iBAAiB,YAAY,UAAU,aAAa;IAClE;GACF;GAIA,IAHoB,CAAC,IAAI,OAAO,IAAI,IAAI,KAAK,EAAA,CAAG,OAAO,CAAC,CAAC,CAAC,MAAM,cAC9D,UAAU,YAAY,MAAM,EAAE,SAAS,OAAO,WAAW,EAAE,CAE/C,GACZ,OAAO,OAAOA,WAAS,UAAU,wCAAwC;GAa3E,IAXkB,CAAC,IAAI,OAAO,IAAI,IAAI,KAAK,EAAA,CAAG,OAAO,CAAC,CAAC,CAAC,MAAM,cAAc;IAC1E,OAAO,UAAU,YAAY,MAC1B,EAAE,cAAc,wBAAwB,aACvC,WAAW,WAAW,UACtB,UAAU,YAAY,MACnB,wBACC,oBAAoB,OAAO,0BAC3B,oBAAoB,YAAY,OACpC,CACJ;GACF,CACY,GACV,OAAO,OAAOA,WACZ,UACA,0DACF;GAEF,MAAM,OAA4B;IAChC,GAAG;IACH,aAAa,CAAC,GAAG,UAAU,aAAa,UAAU;GACpD;GACA,OAAO,OAAO,UAAU,IAAI;GAC5B,OAAO;IACL;IACA,YAAY,iBAAiB,YAAY,UAAU,aAAa;GAClE;EACF,CAAC,CACH;EACF,UAAU,UACR,UACE,OAAO,IAAI,aAAa;GAEtB,MAAM,WAAU,OADO,IAAI,IAAI,KAAK,EAAA,CACZ,IAAI,MAAM,cAAc,EAAE;GAClD,IACE,SAAS,cAAc,WAAW,SAAS,aAC1C,MAAM,4BAA4B,KAAA,KAAa,YAAY,KAAA,GAE5D,OAAO,OAAOA,WACZ,WACA,YAAY,KAAA,IACR,4CACA,wDACN;GAEF,IACE,MAAM,4BAA4B,KAAA,KAClC,SAAS,cAAc,OAAO,MAAM,yBAEpC,OAAO,OAAOA,WAAS,WAAW,iDAAiD;GAErF,IACE,MAAM,cAAc,OAAO,MAAM,WAAW,mBAC5C,MAAM,cAAc,eAAe,MAAM,WAAW,cACpD,MAAM,cAAc,WAAW,MAAM,WAAW,QAEhD,OAAO,OAAOA,WAAS,WAAW,6CAA6C;GAEjF,MAAM,qBAAqB,SAAS,YAAY,MAC7C,eAAe,WAAW,YAAY,MAAM,WAAW,OAC1D;GACA,IACE,MAAM,yBAAyB,KAAA,KAC/B,oBAAoB,OAAO,MAAM,sBAEjC,OAAO,OAAOA,WAAS,WAAW,kDAAkD;GAEtF,MAAM,aAAa,sBAAsB,MAAM;GAC/C,MAAM,OAA4B;IAChC,eAAe,MAAM;IACrB,aAAa,UACT,CAAC,GAAG,QAAQ,YAAY,QAAQ,EAAE,SAAS,OAAO,WAAW,EAAE,GAAG,UAAU,IAC5E,CAAC,UAAU;IACf,aAAa,SAAS,eAAe,CAAC;IACtC,YAAY,MAAM;GACpB;GACA,OAAO,OAAO,WAAW,IAAI;GAC7B,OAAO;EACT,CAAC,CACH;EACF,SAAS,EAAE,cAAc,cACvB,UACE,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO,IAAI,IAAI,KAAK;GACpC,KAAK,MAAM,aAAa,QAAQ,OAAO,GAAG;IACxC,MAAM,aAAa,UAAU,YAAY,MAAM,EAAE,SAAS,OAAO,YAAY;IAC7E,IAAI,eAAe,KAAA,GAAW;IAC9B,MAAM,aAAa,gBAAgB,WAAW,WAAW,cAAc,OAAO;IAC9E,IAAI,eAAe,KAAA,GACjB,OAAO,OAAO,QAAQ,UAAU,iDAAiD;IAEnF,MAAM,OAA4B;KAChC,GAAG;KACH,aAAa,UAAU,YAAY,QAAQ,EAAE,SAAS,OAAO,YAAY;IAC3E;IACA,OAAO,OAAO,UAAU,IAAI;IAC5B,OAAO;KACL;KACA,YAAY,iBAAiB,YAAY,UAAU,aAAa;KAChE,sBAAsB,KAAK,YAAY,QACpC,EAAE,mBAAmB,iBAAiB,WAAW,EACpD,CAAC,CAAC;IACJ;GACF;GACA,OAAO,OAAO,QAAQ,UAAU,kCAAkC;EACpE,CAAC,CACH;EACF,aAAa,EAAE,cAAc,SAAS,aACpC,UACE,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,kBAAkB,YAAY;GACvD,IAAI,cAAc,MAChB,OAAO,OAAO,QAAQ,cAAc,oCAAoC;GAE1E,MAAM,aAAa,gBAAgB,WAAW,cAAc,OAAO;GACnE,IAAI,eAAe,KAAA,GACjB,OAAO,OAAO,QACZ,cACA,mDACF;GAEF,IAAI,UAAU,YAAY,MAAM,EAAE,cAAc,SAAS,OAAO,YAAY,GAC1E,OAAO,OAAOA,WACZ,cACA,mEACF;GAEF,MAAM,uBAAuB,UAAU,YAAY,QAChD,EAAE,SAAS,OAAO,YACrB;GACA,IAAI,qBAAqB,SAAS,GAAG;IACnC,MAAM,OAA4B;KAAE,GAAG;KAAW,aAAa;IAAqB;IACpF,OAAO,OAAO,wBAAwB,IAAI;IAC1C,OAAO;KACL,YAAY,iBAAiB,YAAY,UAAU,aAAa;KAChE,sBAAsB,qBAAqB;KAC3C,sBAAsB;IACxB;GACF;GACA,OAAO,OAAO,iBAAiB,WAAW,YAAY,MAAM;EAC9D,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,kCAAkC,CAAC,CAC7D;EACF,iBAAiB,SAAS,oBACxB,IAAI,IAAI,KAAK,CAAC,CAAC,KACb,OAAO,KACJ,YACC,QAAQ,IAAI,eAAe,CAAC,EAAE,YAAY,MAAM,EAAE,SAAS,SAAS,OAAO,OAAO,KAClF,IACJ,CACF;EACF;EACA,gBAAgB,iBACd,IAAI,IAAI,KAAK,CAAC,CAAC,KACb,OAAO,KACJ,YACC,CAAC,GAAG,QAAQ,OAAO,CAAC,CAAC,CAClB,SAAS,EAAE,kBAAkB,WAAW,CAAC,CACzC,MAAM,EAAE,SAAS,OAAO,YAAY,KAAK,IAChD,CACF;EACF;EACA,kBAAkB,cAAc,YAC9B,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,kBAAkB,YAAY;GACvD,IAAI,cAAc,MAChB,OAAO,OAAO,QAAQ,mBAAmB,oCAAoC;GAE/E,IAAI,gBAAgB,WAAW,cAAc,OAAO,MAAM,KAAA,GACxD,OAAO,OAAO,QACZ,mBACA,mDACF;GAEF,OAAO,UAAU,YAAY,QAAQ,EAAE,cAAc,SAAS,OAAO,YAAY;EACnF,CAAC;EACH,kBAAkB,iBAAiB,aACjC,UACE,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,IAAI,eAAe;GAC5C,IAAI,cAAc,MAChB,OAAO,OAAO,QAAQ,mBAAmB,uCAAuC;GAElF,MAAM,eAAe,IAAI,IACvB,UAAU,cAAc,mBAAmB,KAAK,SAAS,CAAC,KAAK,YAAY,IAAI,CAAC,CAClF;GACA,KAAK,MAAM,QAAQ,UAAU,aAAa,IAAI,KAAK,YAAY,IAAI;GACnE,MAAM,OAAO;IACX,GAAG;IACH,eAAe;KACb,GAAG,UAAU;KACb,oBAAoB,CAAC,GAAG,aAAa,OAAO,CAAC;IAC/C;GACF;GACA,OAAO,OAAO,mBAAmB,IAAI;GACrC,OAAO;EACT,CAAC,CACH;EACF,UAAU,EAAE,iBAAiB,aAC3B,UACE,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,IAAI,eAAe;GAC5C,IAAI,cAAc,MAChB,OAAO,OAAO,QAAQ,WAAW,uCAAuC;GAE1E,IAAI,UAAU,cAAc,WAAW,SAAS,WAC9C,OAAO,OAAO,QAAQ,WAAW,mDAAmD;GAEtF,MAAM,aAAa,UAAU,YAAY;GACzC,IAAI,eAAe,KAAA,GACjB,OAAO,OAAO,QAAQ,WAAW,yCAAyC;GAE5E,OAAO,OAAO,iBAAiB,WAAW,YAAY,MAAM;EAC9D,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,+BAA+B,CAAC,CAC1D;EACF,SAAS,iBAAiB,YAAY,cACpC,UACE,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,IAAI,eAAe;GAC5C,IAAI,cAAc,MAChB,OAAO,OAAO,QAAQ,UAAU,uCAAuC;GAEzE,MAAM,OAAO;IACX,GAAG;IACH,eAAe;KAAE,GAAG,UAAU;KAAe;IAAU;IACvD;GACF;GACA,OAAO,OAAO,UAAU,IAAI;GAC5B,OAAO;EACT,CAAC,CACH;CACJ,CAAC;AACH;AAEA,MAAaG,WAAS,UAAmB,CAAC,MAAM,MAAM,KAAKC,eAAyBF,OAAK,OAAO,CAAC;;;;AClYjG,SAAgBG,SAAqC;CACnD,MAAM,QAAQ,OAAO,QAAQ,IAAI,qBAAmD,IAAI,IAAI,CAAC,CAAC;CAC9F,OAAO;EACL,SAAS,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAAW,IAAI,KAAK;GACxE,OAAO,OAAO,IAAI,OAAO,QAAQ,YAAY;IAC3C,MAAM,eAAe,QAAQ,IAAI,EAAE;IACnC,MAAM,OAAO,IAAI,IAAI,OAAO;IAC5B,KAAK,OAAO,EAAE;IACd,OAAO,CACL,iBAAiB,KAAA,KAAa,aAAa,YAAY,MAAM,eAAe,MAC5E,IACF;GACF,CAAC;EACH,CAAC;EACD,KAAK,OAAO,GAAG,6BAA6B,CAAC,EAAE,iBAC7C,IAAI,OAAO,QAAQ,YAAY;GAC7B,MAAM,OAAO,IAAI,IAAI,OAAO;GAC5B,KAAK,IAAI,aAAa,IAAI,YAAY;GACtC,OAAO;EACT,CAAC,CACH;CACF;AACF;;;;;;;;ACfA,SAAgBC,OAAK,UAAmB,CAAC,GAA0B;CACjE,MAAM,KAAK,QAAQ,MAAM;CACzB,MAAM,0BAAU,IAAI,IAAsD;CAC1E,MAAM,4BAAY,IAAI,IAAgC;CACtD,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,QAAQ,WAAW,CAAC,CAAC,GAAG;EACnE,QAAQ,IAAIC,MAAiB,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC;EAChD,KAAK,MAAM,CAAC,OAAO,WAAW,QAAQ,QAAQ,GAAG,UAAU,IAAI,GAAG,GAAG,GAAG,QAAQ,KAAK,MAAM;CAC7F;CACA,OAAO;EACL;EACA,aAAa,OAAO,GAAG,iCAAiC,CAAC,EAAE,SACzD,OAAO,WAAW,CAAC,GAAI,QAAQ,IAAI,IAAI,KAAK,CAAC,CAAE,CAAC,CAClD;EACA,cAAc,OAAO,GAAG,kCAAkC,CAAC,EAAE,MAAM,WACjE,OAAO,WAAW;GAChB,MAAM,UAAU,QAAQ,IAAI,IAAI,KAAK,CAAC;GACtC,QAAQ,KAAK,MAAM;GACnB,QAAQ,IAAI,MAAM,OAAO;GACzB,MAAM,mBAAmB,GAAG,GAAG,GAAG,QAAQ;GAC1C,UAAU,IAAI,kBAAkB,MAAM;GACtC,OAAO,EAAE,iBAAiB;EAC5B,CAAC,CACH;EACA,cAAc,OAAO,GAAG,kCAAkC,CAAC,EAAE,MAAM,qBACjE,OAAO,WAAW;GAChB,MAAM,SAAS,UAAU,IAAI,gBAAgB;GAC7C,IAAI,WAAW,KAAA,GAAW;GAC1B,QAAQ,IACN,OACC,QAAQ,IAAI,IAAI,KAAK,CAAC,EAAA,CAAG,QAAQ,cAAc,cAAc,MAAM,CACtE;GACA,UAAU,OAAO,gBAAgB;EACnC,CAAC,CACH;EACA,WAAW,OAAO,GAAG,+BAA+B,CAAC,EAAE,OAAO,qBAC5D,OAAO,WAAW,UAAU,IAAI,gBAAgB,KAAK,IAAI,CAC3D;CACF;AACF;AAEA,MAAaC,WAAS,UAAmB,CAAC,MACxC,MAAM,QAAQC,WAAqBH,OAAK,OAAO,CAAC;AAElD,MAAaI,aAAW,UAAmB,CAAC,MAC1CC,UAAoBL,OAAK,OAAO,CAAC;;;;;;;;AC/CnC,SAAgB,KAAK,SAAyC;CAC5D,OAAO,EACL,SAAS,OAAO,GAAG,6BAA6B,CAAC,EAAE,UACjD,OAAO,cAAc;EACnB,MAAM,aAAa,QAAQ,KAAK;EAChC,OAAO,OAAO,SAAS,UAAU,IAAI,aAAa,OAAO,QAAQ,UAAU;CAC7E,CAAC,CACH,EACF;AACF;AAEA,MAAa,SAAS,YACpB,MAAM,QAAQM,WAAqB,KAAK,OAAO,CAAC;AAElD,MAAa,WAAW,YACtBC,UAAoB,KAAK,OAAO,CAAC;;;;;;;;ACdnC,IAAa,QAAb,cAA2B,OAAO,YAAmB,CAAC,CAAC,4BAA4B;CACjF,MAAM,OAAO;CACb,SAAS,OAAO;CAChB,YAAY,OAAO;AACrB,CAAC,CAAC,CAAC,CAAC;;AAeJ,SAAgB,UAAU,cAAuE;CAC/F,aAAa,OAAO,WAAWC,YAAsB,aAAa,CAAC,CAAC;AACtE;AAEA,MAAM,QAAQ;CACZ;CACA;CACA;CACA;CACA;AACF;;AAGA,MAAa,MAAM,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,OAAc;CAC/E,MAAM,qBACJ,OAAO,QAAQ,MAAM,YAAY,CAAC,CAAC,KACjC,OAAO,aAAa,UAClB,OAAO,KACL,IAAI,MAAM;EACR,MAAM;EACN,SAAS,iBAAiB,WAAW,QAAQ,MAAM,UAAU;EAC7D,YAAY;CACd,CAAC,CACH,CACF,CACF;CACF,MAAM,QAAQ,OAAO,aAAa;CAClC,MAAM,aAAa,MAAM;CACzB,MAAM,SAAS,MAAM,UAAU;CAC/B,OAAO,sBAAsB,OAAO,MAAM,MAAM,MAAM;CACtD,OAAO,UAAU,OAAO,aAAa,GAAG,MAAM,MAAM,MAAM;CAC1D,OAAO,SAAS,OAAO,aAAa,GAAG,MAAM,MAAM,MAAM;CACzD,OAAO,UAAU,OAAO,aAAa,GAAG,MAAM,MAAM,MAAM;CAC1D,OAAO,oBAAoB,OAAO,aAAa,GAAG,MAAM,MAAM,MAAM;CACpE,OAAO;EAAE;EAAO;EAAY,MAAM,MAAM;CAAK;AAC/C,CAAC;AAED,SAAS,sBACP,UACA,MACA,QACA;CACA,MAAM,eAAe,mBAAmB,MAAM,MAAM;CACpD,IAAI,mBAA0C,CAAC;CAC/C,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,EAAE,SAAS,OAAOC,OAAoB;GAC1C;GACA,QAAA,OAA4B,UAAU,EAAE,KAAK,CAAC;EAChD,CAAC;EACD,OAAO,YAAY,UAAU,2BAA2B,KAAK,YAAY,CAAC,UAAU,QAAQ,CAAC;EAC7F,MAAM,UAAU,OAAOC,MAAmB;GACxC,eAAe,OAAOC,UAAuB,IAAI;GACjD;EACF,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,YACf,mBAAmBC,oBACf,OAAO,WAAW;GAChB,mBAAmB,kBAAkB,QAAQ,QAAQ,UAAU;EACjE,CAAC,IACD,OAAO,IACb,CACF;EACA,mBAAmB,kBAAkB,QAAQ,UAAU;EACvD,OAAO,iBACL,UACA,2BACA,QAAQ,WAAW,cACjB,QAAQ,WAAW,OAAO,EAAE,uBAAuB,qBAAqB,IAAI,GAC9E,+DACF;EACA,MAAM,WAAW,OAAO,SAAS,YAAY,IAAI;EACjD,OAAO,iBACL,UACA,2BACA,aAAa,OAAO,gBAClB,SAAS,MACN,WAAW,OAAO,SAAS,YAAYC,OAAiB,QAAQ,WAAW,CAC9E,CACF,GACA,+EACF;EACA,MAAM,WAAW,OAAOC,SAAgB;GAAE;GAAM;EAAQ,CAAC;EAKzD,OAAO,iBACL,UACA,4BACA,OAP6BC,QAAe;GAC5C,eAAe,OAAOC,YAAmB,QAAQ;GACjD,MAAM;EACR,CAAC,EAAA,CAIiB,WAAW,eACxB,OAAO,gBAAgB,UAAU,MAAM,gBAAgB,IAC1D,wDACF;CACF,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,iBAAiB,UAAU,YAAY,gBAAgB,CAAC,GACxE,OAAO,QAAQ,cAAc,QAAQ,CAAC,CACxC;AACF;AAEA,SAAS,UAAU,UAAiC,MAA6B,QAAgB;CAC/F,MAAM,cAAc,MAAM,MAAM,GAAG,OAAO,OAAO;CACjD,IAAI,mBAA0C,CAAC;CAC/C,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,UAAU,OAAO,SAAS,aAAa,MAAM,WAAW;EAC9D,mBAAmB,QAAQ,qBAAqB,OAAO,CAAC,IAAI,CAAC,QAAQ,gBAAgB;EACrF,MAAM,EAAE,SAAS,OAAOP,OAAoB;GAC1C,cAAc,CAAC,WAAW;GAC1B,QAAA,OAA4B,UAAU,EAAE,KAAK,CAAC;EAChD,CAAC;EACD,OAAO,YAAY,UAAU,cAAc,KAAK,YAAY,CAAC,MAAM,CAAC;EAKpE,OAAO,iBACL,UACA,eACA,OAPqBC,MAAmB;GACxC,eAAe,OAAOC,UAAuB,IAAI;GACjD;EACF,CAAC,EAAA,CAIS,WAAW,WAAW,GAC9B,8CACF;EACA,OAAO,cAAc,UAAU,MAAM,QAAQ,kBAAkB,YAAY;CAC7E,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,iBAAiB,UAAU,YAAY,gBAAgB,CAAC,GACxE,OAAO,QAAQ,cAAc,QAAQ,CAAC,CACxC;AACF;AAEA,SAAS,SAAS,UAAiC,MAA6B,QAAgB;CAC9F,MAAM,cAAc,MAAM,MAAM,GAAG,OAAO,UAAU;CACpD,MAAM,WAAW,IAAI,MAAM,GAAG,OAAO,YAAY,UAAU;CAC3D,IAAI,mBAA0C,CAAC;CAC/C,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,UAAU,OAAO,SAAS,aAAa,MAAM,QAAQ;EAC3D,mBAAmB,QAAQ,qBAAqB,OAAO,CAAC,IAAI,CAAC,QAAQ,gBAAgB;EACrF,MAAM,EAAE,SAAS,OAAOF,OAAoB;GAC1C,cAAc,CAAC,WAAW;GAC1B,QAAA,OAA4B,UAAU,EAAE,KAAK,CAAC;EAChD,CAAC;EACD,OAAO,YAAY,UAAU,YAAY,KAAK,YAAY,CAAC,UAAU,CAAC;EAKtE,OAAO,iBACL,UACA,aACA,OAPqBC,MAAmB;GACxC,eAAe,OAAOC,UAAuB,IAAI;GACjD;EACF,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,cAIEM,eACnB,8CACF;EACA,OAAO,cAAc,UAAU,MAAM,QAAQ,kBAAkB,UAAU;CAC3E,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,iBAAiB,UAAU,YAAY,gBAAgB,CAAC,GACxE,OAAO,QAAQ,cAAc,QAAQ,CAAC,CACxC;AACF;AAEA,SAAS,UAAU,UAAiC,MAA6B,QAAgB;CAC/F,MAAM,cAAc,MAAM,MAAM,GAAG,OAAO,OAAO;CACjD,IAAI,mBAA0C,CAAC;CAC/C,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,EAAE,SAAS,OAAOR,OAAoB;GAC1C,cAAc,CAAC,WAAW;GAC1B,QAAA,OAA4B,UAAU,EAAE,KAAK,CAAC;EAChD,CAAC;EACD,MAAM,gBAAgB,OAAOE,UAAuB,IAAI;EACxD,MAAM,UAAU,OAAO,SAAS,aAAa,MAAM,WAAW;EAC9D,mBAAmB,QAAQ,qBAAqB,OAAO,CAAC,IAAI,CAAC,QAAQ,gBAAgB;EAErF,OAAO,iBACL,UACA,eACA,OAJqBD,MAAmB;GAAE;GAAe;EAAK,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,cAI9DQ,YACnB,mEACF;EACA,OAAO,cAAc,UAAU,MAAM,QAAQ,kBAAkB,YAAY;CAC7E,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,iBAAiB,UAAU,YAAY,gBAAgB,CAAC,GACxE,OAAO,QAAQ,cAAc,QAAQ,CAAC,CACxC;AACF;AAEA,SAAS,oBACP,UACA,MACA,QACA;CACA,IAAI,UAAU;CACd,MAAM,QAAA,UAA4B,GAAG;EACnC,GAAG;EACH,cAAc,OAAO,GAAG,kCAAkC,CAAC,EAAE,QAAQ,WAAW;GAC9E,WAAW;GACX,OAAO,YAAY,IACf,SAAS,aAAa,QAAQ,MAAM,IACpC,OAAO,KACL,IAAIC,QAAkB;IACpB,SAAS;IACT,WAAW;IACX,YAAY,SAAS;GACvB,CAAC,CACH;EACN,CAAC;CACH,CAAC;CACD,MAAM,eAAe,CACnB,MAAM,MAAM,GAAG,OAAO,aAAa,GACnC,IAAI,MAAM,GAAG,OAAO,eAAe,WAAW,CAChD;CACA,IAAI,mBAA0C,CAAC;CAC/C,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,EAAE,SAAS,OAAOV,OAAoB;GAC1C;GACA,QAAA,OAA4B,UAAU,EAAE,KAAK,CAAC;EAChD,CAAC;EACD,MAAM,UAAU,OAAOC,MAAmB;GACxC,eAAe,OAAOC,UAAuB,IAAI;GACjD;EACF,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI;EACnB,mBACE,mBAAmBC,oBACf,kBAAkB,QAAQ,QAAQ,UAAU,IAC5C,CAAC;EACP,OAAO,iBACL,UACA,yBACA,mBAAmBA,qBAAkC,QAAQ,QAAQ,WAAW,WAAW,GAC3F,oFACF;EACA,IAAI,EAAE,mBAAmBA,oBAAiC;EAC1D,MAAM,WAAW,OAAOE,SAAgB;GAAE;GAAM,SAAS,QAAQ;EAAQ,CAAC,CAAC,CAAC,KAC1E,OAAO,QAAQ,cAAc,QAAQ,CAAC,CACxC;EACA,OAAOC,QAAe;GACpB,eAAe,OAAOC,YAAmB,QAAQ;GACjD,MAAM;EACR,CAAC,CAAC,CAAC,KAAK,OAAO,QAAQ,cAAc,QAAQ,CAAC,CAAC;EAC/C,OAAO,iBACL,UACA,yBACA,OAAO,gBAAgB,UAAU,MAAM,gBAAgB,GACvD,yDACF;CACF,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,iBAAiB,UAAU,YAAY,gBAAgB,CAAC,GACxE,OAAO,QAAQ,cAAc,KAAK,CAAC,CACrC;AACF;AAEA,SAAS,kBACP,YACuB;CACvB,OAAO,WAAW,SAAS,EAAE,uBAC3B,qBAAqB,OAAO,CAAC,IAAI,CAAC,gBAAgB,CACpD;AACF;AAEA,SAAS,gBACP,UACA,MACA,WACA;CACA,OAAO,OAAO,QAAQ,YAAY,qBAChC,SAAS,UAAU,MAAM,gBAAgB,CAC3C,CAAC,CAAC,KAAK,OAAO,KAAK,YAAY,QAAQ,OAAO,WAAW,WAAW,IAAI,CAAC,CAAC;AAC5E;AAEA,SAAS,iBACP,UACA,MACA,WACA;CACA,OAAO,OAAO,cACZ,OAAO,QACL,UAAU,IACT,qBAAqB,SAAS,aAAa,MAAM,gBAAgB,CAAC,CAAC,KAAK,OAAO,MAAM,GACtF,EAAE,SAAS,KAAK,CAClB,CACF;AACF;AAEA,SAAS,cAAc,UAAiC;CACtD,OAAO,MAAM,MAAM,MAAM,QAAQI,WAAqB,QAAQ,GAAGC,cAAqB;AACxF;AAEA,SAAS,mBAAmB,MAA6B,QAAgB;CACvE,OAAO,CAAC,MAAM,MAAM,GAAG,OAAO,QAAQ,GAAG,IAAI,MAAM,GAAG,OAAO,QAAQ,WAAW,CAAC;AACnF;AAEA,SAAS,MAAM,MAA6B,OAAe;CACzD,OAAOC,QAAgB;EACrB,MAAM;EACN,UAAU;GAAE,WAAW;GAAU,YAAY;GAAa,SAAS;EAAc;EACjF,MAAM,GAAG,MAAM,GAAG;EAClB,QAAQ;EACR,QAAQ;EACR,KAAK;CACP,CAAC;AACH;AAEA,SAAS,IAAI,MAA6B,OAAe,OAAe;CACtE,OAAOA,QAAgB;EACrB,MAAM;EACN,UAAU;GAAE,WAAW;GAAU,YAAY;GAAa,SAAS;EAAc;EACjF,MAAM,GAAG,MAAM,GAAG;EAClB,QAAQ;EACR,KAAK;EACL;CACF,CAAC;AACH;AAEA,SAAS,YACP,UACA,UACA,YACA,UACA;CACA,OAAO,iBACL,UACA,UACA,KAAK,UAAU,WAAW,KAAK,EAAE,WAAW,IAAI,CAAC,MAAM,KAAK,UAAU,QAAQ,GAC9E,uBAAuB,SAAS,KAAK,IAAI,GAC3C;AACF;AAEA,SAAS,iBACP,UACA,UACA,WACA,SACA;CACA,OAAO,YACH,OAAO,OACP,OAAO,KAAK,IAAI,MAAM;EAAE,MAAM;EAAU;EAAS,YAAY,SAAS;CAAG,CAAC,CAAC;AACjF;AAEA,SAAS,cACP,UACA,MACA,kBACA,UACA;CACA,OAAO,qBAAqB,OACxB,OAAO,KACL,IAAI,MAAM;EACR,MAAM;EACN,SAAS;EACT,YAAY,SAAS;CACvB,CAAC,CACH,IACA,SAAS,aAAa,MAAM,gBAAgB;AAClD"}
+{"version":3,"file":"testing.mjs","names":["Lifecycle.Error","conflict","Connection.project","make","layer","Lifecycle.Service","make","make","DomainName.parse","layer","DnsProvider.Service","toAsync","DnsProvider.toAsync","DnsResolver.Service","DnsResolver.toAsync","DnsProvider.fromAsync","Provisioning.create","Provisioning.apply","Provisioning.authorize","Provisioning.PartialApplyError","DnsRecord.equals","Deletion.create","Deletion.apply","Deletion.authorize","Provisioning.ConflictError","Provisioning.StaleError","DnsProvider.Error","DnsProvider.Service","Digest.webCryptoLayer","DnsRecord.parse"],"sources":["../src/stores/in-memory-lifecycle-repository.ts","../src/stores/in-memory-continuation.ts","../src/provider/in-memory.ts","../src/verification/in-memory.ts","../src/testing/provider-conformance.ts"],"sourcesContent":["import { DateTime, Effect, Layer, Ref, Semaphore } from \"effect\";\n\nimport * as ProviderAuthorization from \"../auth/authorization.ts\";\nimport * as Connection from \"../auth/connection.ts\";\nimport * as Lifecycle from \"../auth/lifecycle-repository.ts\";\n\nexport interface Options {\n  readonly beforeCommit?: (\n    operation: string,\n    aggregate: Lifecycle.Aggregate | null,\n  ) => Effect.Effect<void, Lifecycle.Error>;\n}\n\nfunction missing(operation: string, message: string): Lifecycle.Error {\n  return new Lifecycle.Error({\n    category: \"storage\",\n    message,\n    operation,\n    retry: \"never\",\n  });\n}\n\nfunction conflict(operation: string, message: string): Lifecycle.Error {\n  return new Lifecycle.Error({\n    category: \"storage\",\n    message,\n    operation,\n    retry: \"after-user-action\",\n  });\n}\n\nfunction ownerConnection(\n  aggregate: Lifecycle.Aggregate,\n  connectionId: string,\n  ownerId: string,\n): Connection.StoredConnection | undefined {\n  return aggregate.connections.find(\n    (connection) => connection.id === connectionId && connection.ownerId === ownerId,\n  );\n}\n\nfunction publicConnection(\n  connection: Connection.StoredConnection,\n  authorization: ProviderAuthorization.ProviderAuthorization,\n  credential: Connection.StoredCredential,\n): Connection.ProviderConnection {\n  return Connection.project(connection, authorization, credential);\n}\n\nexport function make(options: Options = {}): Lifecycle.Interface {\n  const state = Effect.runSync(Ref.make<ReadonlyMap<string, Lifecycle.Aggregate>>(new Map()));\n  const mutations = Semaphore.makeUnsafe(1);\n  const serialize = <A, E, R>(effect: Effect.Effect<A, E, R>) => mutations.withPermit(effect);\n\n  const commit = Effect.fn(\"InMemoryManagedDnsConnections.commit\")(function* (\n    operation: string,\n    aggregate: Lifecycle.Aggregate,\n  ) {\n    if (options.beforeCommit !== undefined) yield* options.beforeCommit(operation, aggregate);\n    yield* Ref.update(state, (entries) => {\n      const next = new Map(entries);\n      next.set(aggregate.authorization.id, aggregate);\n      return next;\n    });\n  });\n\n  const remove = Effect.fn(\"InMemoryManagedDnsConnections.remove\")(function* (\n    operation: string,\n    authorizationId: string,\n  ) {\n    if (options.beforeCommit !== undefined) yield* options.beforeCommit(operation, null);\n    yield* Ref.update(state, (entries) => {\n      const next = new Map(entries);\n      next.delete(authorizationId);\n      return next;\n    });\n  });\n\n  const get = Effect.fn(\"ManagedDnsConnections.get\")((authorizationId: string) =>\n    Ref.get(state).pipe(Effect.map((entries) => entries.get(authorizationId) ?? null)),\n  );\n\n  const getByConnectionId = Effect.fn(\"ManagedDnsConnections.getByConnectionId\")(\n    (connectionId: string) =>\n      Ref.get(state).pipe(\n        Effect.map(\n          (entries) =>\n            [...entries.values()].find((aggregate) =>\n              aggregate.connections.some((connection) => connection.id === connectionId),\n            ) ?? null,\n        ),\n      ),\n  );\n\n  const finishRevocation = Effect.fn(\"InMemoryManagedDnsConnections.finishRevocation\")(function* <\n    E,\n  >(\n    aggregate: Lifecycle.Aggregate,\n    connection: Connection.StoredConnection,\n    revoke: (authorization: ProviderAuthorization.ProviderAuthorization) => Effect.Effect<void, E>,\n  ) {\n    const requestedAt = yield* DateTime.nowAsDate;\n    const pending: Lifecycle.Aggregate = {\n      ...aggregate,\n      authorization: {\n        ...aggregate.authorization,\n        revocation:\n          aggregate.authorization.revocation._tag === \"Pending\"\n            ? aggregate.authorization.revocation\n            : ProviderAuthorization.Revocation.Pending({ requestedAt }),\n      },\n    };\n    yield* commit(\"prepareRevocation\", pending);\n    yield* revoke(pending.authorization);\n    yield* remove(\"completeRevocation\", pending.authorization.id);\n    return {\n      connection: publicConnection(connection, pending.authorization, pending.credential),\n      remainingConnections: 0,\n      revokedAuthorization: true,\n    } satisfies Lifecycle.DisconnectResult;\n  });\n\n  return Lifecycle.Service.of({\n    attach: ({ attachment, connectionId, ownerId }) =>\n      serialize(\n        Effect.gen(function* () {\n          const aggregate = yield* getByConnectionId(connectionId);\n          if (aggregate === null) {\n            return yield* missing(\"attach\", \"Provider connection does not exist\");\n          }\n          const connection = ownerConnection(aggregate, connectionId, ownerId);\n          if (connection === undefined) {\n            return yield* missing(\"attach\", \"Provider connection does not belong to this owner\");\n          }\n          if (attachment.connectionId !== connectionId) {\n            return yield* conflict(\"attach\", \"Domain attachment targets another connection\");\n          }\n          const existing = aggregate.attachments.find(({ id }) => id === attachment.id);\n          if (existing !== undefined) {\n            if (\n              existing.connectionId !== attachment.connectionId ||\n              existing.domain !== attachment.domain ||\n              existing.target.accountId !== attachment.target.accountId ||\n              existing.target.accountKind !== attachment.target.accountKind ||\n              existing.target.zoneId !== attachment.target.zoneId ||\n              existing.target.zoneName !== attachment.target.zoneName\n            ) {\n              return yield* conflict(\"attach\", \"Domain attachment id is already in use\");\n            }\n            return {\n              attachment: existing,\n              connection: publicConnection(\n                connection,\n                aggregate.authorization,\n                aggregate.credential,\n              ),\n            };\n          }\n          const duplicateId = [...(yield* Ref.get(state)).values()].some((candidate) =>\n            candidate.attachments.some(({ id }) => id === attachment.id),\n          );\n          if (duplicateId) {\n            return yield* conflict(\"attach\", \"Domain attachment id is already in use\");\n          }\n          const duplicate = [...(yield* Ref.get(state)).values()].some((candidate) => {\n            return candidate.attachments.some(\n              ({ connectionId: attachmentConnectionId, domain }) =>\n                domain === attachment.domain &&\n                candidate.connections.some(\n                  (candidateConnection) =>\n                    candidateConnection.id === attachmentConnectionId &&\n                    candidateConnection.ownerId === ownerId,\n                ),\n            );\n          });\n          if (duplicate) {\n            return yield* conflict(\n              \"attach\",\n              \"An organization domain already has a provider attachment\",\n            );\n          }\n          const next: Lifecycle.Aggregate = {\n            ...aggregate,\n            attachments: [...aggregate.attachments, attachment],\n          };\n          yield* commit(\"attach\", next);\n          return {\n            attachment,\n            connection: publicConnection(connection, aggregate.authorization, aggregate.credential),\n          };\n        }),\n      ),\n    connect: (input) =>\n      serialize(\n        Effect.gen(function* () {\n          const entries = yield* Ref.get(state);\n          const current = entries.get(input.authorization.id);\n          if (\n            current?.authorization.revocation._tag === \"Pending\" ||\n            (input.expectedAuthorizationId !== undefined && current === undefined)\n          ) {\n            return yield* conflict(\n              \"connect\",\n              current === undefined\n                ? \"Provider authorization no longer exists\"\n                : \"Provider authorization is awaiting revocation recovery\",\n            );\n          }\n          if (\n            input.expectedAuthorizationId !== undefined &&\n            current?.authorization.id !== input.expectedAuthorizationId\n          ) {\n            return yield* conflict(\"connect\", \"Provider authorization changed during reconnect\");\n          }\n          if (\n            input.authorization.id !== input.connection.authorizationId ||\n            input.authorization.providerId !== input.connection.providerId ||\n            input.authorization.method !== input.connection.method\n          ) {\n            return yield* conflict(\"connect\", \"Connection does not match its authorization\");\n          }\n          const existingConnection = current?.connections.find(\n            (connection) => connection.ownerId === input.connection.ownerId,\n          );\n          if (\n            input.expectedConnectionId !== undefined &&\n            existingConnection?.id !== input.expectedConnectionId\n          ) {\n            return yield* conflict(\"connect\", \"Organization connection changed during reconnect\");\n          }\n          const connection = existingConnection ?? input.connection;\n          const next: Lifecycle.Aggregate = {\n            authorization: input.authorization,\n            connections: current\n              ? [...current.connections.filter(({ id }) => id !== connection.id), connection]\n              : [connection],\n            attachments: current?.attachments ?? [],\n            credential: input.credential,\n          };\n          yield* commit(\"connect\", next);\n          return next;\n        }),\n      ),\n    detach: ({ attachmentId, ownerId }) =>\n      serialize(\n        Effect.gen(function* () {\n          const entries = yield* Ref.get(state);\n          for (const aggregate of entries.values()) {\n            const attachment = aggregate.attachments.find(({ id }) => id === attachmentId);\n            if (attachment === undefined) continue;\n            const connection = ownerConnection(aggregate, attachment.connectionId, ownerId);\n            if (connection === undefined) {\n              return yield* missing(\"detach\", \"Domain attachment does not belong to this owner\");\n            }\n            const next: Lifecycle.Aggregate = {\n              ...aggregate,\n              attachments: aggregate.attachments.filter(({ id }) => id !== attachmentId),\n            };\n            yield* commit(\"detach\", next);\n            return {\n              attachment,\n              connection: publicConnection(\n                connection,\n                aggregate.authorization,\n                aggregate.credential,\n              ),\n              remainingAttachments: next.attachments.filter(\n                ({ connectionId }) => connectionId === connection.id,\n              ).length,\n            };\n          }\n          return yield* missing(\"detach\", \"Domain attachment does not exist\");\n        }),\n      ),\n    disconnect: ({ connectionId, ownerId, revoke }) =>\n      serialize(\n        Effect.gen(function* () {\n          const aggregate = yield* getByConnectionId(connectionId);\n          if (aggregate === null) {\n            return yield* missing(\"disconnect\", \"Provider connection does not exist\");\n          }\n          const connection = ownerConnection(aggregate, connectionId, ownerId);\n          if (connection === undefined) {\n            return yield* missing(\n              \"disconnect\",\n              \"Provider connection does not belong to this owner\",\n            );\n          }\n          if (aggregate.attachments.some(({ connectionId: id }) => id === connectionId)) {\n            return yield* conflict(\n              \"disconnect\",\n              \"Detach all organization domains before disconnecting the provider\",\n            );\n          }\n          const remainingConnections = aggregate.connections.filter(\n            ({ id }) => id !== connectionId,\n          );\n          if (remainingConnections.length > 0) {\n            const next: Lifecycle.Aggregate = { ...aggregate, connections: remainingConnections };\n            yield* commit(\"disconnectConnection\", next);\n            return {\n              connection: publicConnection(\n                connection,\n                aggregate.authorization,\n                aggregate.credential,\n              ),\n              remainingConnections: remainingConnections.length,\n              revokedAuthorization: false,\n            };\n          }\n          return yield* finishRevocation(aggregate, connection, revoke);\n        }).pipe(Effect.withSpan(\"ManagedDnsConnections.disconnect\")),\n      ),\n    findConnection: (ownerId, authorizationId) =>\n      Ref.get(state).pipe(\n        Effect.map(\n          (entries) =>\n            entries.get(authorizationId)?.connections.find(({ ownerId: id }) => id === ownerId) ??\n            null,\n        ),\n      ),\n    get,\n    getAttachment: (attachmentId) =>\n      Ref.get(state).pipe(\n        Effect.map(\n          (entries) =>\n            [...entries.values()]\n              .flatMap(({ attachments }) => attachments)\n              .find(({ id }) => id === attachmentId) ?? null,\n        ),\n      ),\n    getByConnectionId,\n    listAttachments: (connectionId, ownerId) =>\n      Effect.gen(function* () {\n        const aggregate = yield* getByConnectionId(connectionId);\n        if (aggregate === null) {\n          return yield* missing(\"listAttachments\", \"Provider connection does not exist\");\n        }\n        if (ownerConnection(aggregate, connectionId, ownerId) === undefined) {\n          return yield* missing(\n            \"listAttachments\",\n            \"Provider connection does not belong to this owner\",\n          );\n        }\n        return aggregate.attachments.filter(({ connectionId: id }) => id === connectionId);\n      }),\n    promoteEvidence: (authorizationId, evidence) =>\n      serialize(\n        Effect.gen(function* () {\n          const aggregate = yield* get(authorizationId);\n          if (aggregate === null) {\n            return yield* missing(\"promoteEvidence\", \"Provider authorization does not exist\");\n          }\n          const byCapability = new Map(\n            aggregate.authorization.capabilityEvidence.map((item) => [item.capability, item]),\n          );\n          for (const item of evidence) byCapability.set(item.capability, item);\n          const next = {\n            ...aggregate,\n            authorization: {\n              ...aggregate.authorization,\n              capabilityEvidence: [...byCapability.values()],\n            },\n          };\n          yield* commit(\"promoteEvidence\", next);\n          return next;\n        }),\n      ),\n    recover: ({ authorizationId, revoke }) =>\n      serialize(\n        Effect.gen(function* () {\n          const aggregate = yield* get(authorizationId);\n          if (aggregate === null) {\n            return yield* missing(\"recover\", \"Provider authorization does not exist\");\n          }\n          if (aggregate.authorization.revocation._tag !== \"Pending\") {\n            return yield* missing(\"recover\", \"Provider authorization is not awaiting revocation\");\n          }\n          const connection = aggregate.connections[0];\n          if (connection === undefined) {\n            return yield* missing(\"recover\", \"Pending authorization has no connection\");\n          }\n          return yield* finishRevocation(aggregate, connection, revoke);\n        }).pipe(Effect.withSpan(\"ManagedDnsConnections.recover\")),\n      ),\n    rotate: (authorizationId, credential) =>\n      serialize(\n        Effect.gen(function* () {\n          const aggregate = yield* get(authorizationId);\n          if (aggregate === null) {\n            return yield* missing(\"rotate\", \"Provider authorization does not exist\");\n          }\n          const next = {\n            ...aggregate,\n            credential,\n          };\n          yield* commit(\"rotate\", next);\n          return next;\n        }),\n      ),\n  });\n}\n\nexport const layer = (options: Options = {}) => Layer.sync(Lifecycle.Service, () => make(options));\n","import { Effect, Ref } from \"effect\";\n\nimport type * as Connection from \"../auth/connect.ts\";\n\nexport function make(): Connection.ContinuationStore {\n  const state = Effect.runSync(Ref.make<ReadonlyMap<string, Connection.Continuation>>(new Map()));\n  return {\n    consume: Effect.fn(\"ConnectionContinuations.consume\")(function* (id, now) {\n      return yield* Ref.modify(state, (entries) => {\n        const continuation = entries.get(id);\n        const next = new Map(entries);\n        next.delete(id);\n        return [\n          continuation !== undefined && continuation.expiresAt > now ? continuation : null,\n          next,\n        ] as const;\n      });\n    }),\n    put: Effect.fn(\"ConnectionContinuations.put\")((continuation) =>\n      Ref.update(state, (entries) => {\n        const next = new Map(entries);\n        next.set(continuation.id, continuation);\n        return next;\n      }),\n    ),\n  };\n}\n","import { Effect, Layer } from \"effect\";\n\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport type * as DnsRecord from \"../domain/dns-record.ts\";\nimport * as DnsProvider from \"./provider.ts\";\n\nexport interface Options {\n  readonly id?: string;\n  readonly records?: Readonly<Record<string, ReadonlyArray<DnsRecord.Observed>>>;\n}\n\nexport function make(options: Options = {}): DnsProvider.Interface {\n  const id = options.id ?? \"memory\";\n  const records = new Map<DomainName.DomainName, Array<DnsRecord.Observed>>();\n  const recordIds = new Map<string, DnsRecord.Observed>();\n  for (const [zone, initial] of Object.entries(options.records ?? {})) {\n    records.set(DomainName.parse(zone), [...initial]);\n    for (const [index, record] of initial.entries()) recordIds.set(`${id}:${index + 1}`, record);\n  }\n  return {\n    id,\n    listRecords: Effect.fn(\"InMemoryDnsProvider.listRecords\")((zone) =>\n      Effect.sync(() => [...(records.get(zone) ?? [])]),\n    ),\n    createRecord: Effect.fn(\"InMemoryDnsProvider.createRecord\")((zone, record) =>\n      Effect.sync(() => {\n        const current = records.get(zone) ?? [];\n        current.push(record);\n        records.set(zone, current);\n        const providerRecordId = `${id}:${current.length}`;\n        recordIds.set(providerRecordId, record);\n        return { providerRecordId };\n      }),\n    ),\n    deleteRecord: Effect.fn(\"InMemoryDnsProvider.deleteRecord\")((zone, providerRecordId) =>\n      Effect.sync(() => {\n        const record = recordIds.get(providerRecordId);\n        if (record === undefined) return;\n        records.set(\n          zone,\n          (records.get(zone) ?? []).filter((candidate) => candidate !== record),\n        );\n        recordIds.delete(providerRecordId);\n      }),\n    ),\n    getRecord: Effect.fn(\"InMemoryDnsProvider.getRecord\")((_zone, providerRecordId) =>\n      Effect.sync(() => recordIds.get(providerRecordId) ?? null),\n    ),\n  };\n}\n\nexport const layer = (options: Options = {}): Layer.Layer<DnsProvider.Service> =>\n  Layer.succeed(DnsProvider.Service, make(options));\n\nexport const toAsync = (options: Options = {}): DnsProvider.AsyncInterface =>\n  DnsProvider.toAsync(make(options));\n","import { Effect, Layer } from \"effect\";\n\nimport * as DnsResolver from \"./resolver.ts\";\n\nexport type Resolve = (\n  query: DnsResolver.Query,\n) => DnsResolver.Resolution | Effect.Effect<DnsResolver.Resolution, DnsResolver.Error>;\n\nexport function make(resolve: Resolve): DnsResolver.Interface {\n  return {\n    resolve: Effect.fn(\"InMemoryDnsResolver.resolve\")((query) =>\n      Effect.suspend(() => {\n        const resolution = resolve(query);\n        return Effect.isEffect(resolution) ? resolution : Effect.succeed(resolution);\n      }),\n    ),\n  };\n}\n\nexport const layer = (resolve: Resolve): Layer.Layer<DnsResolver.Service> =>\n  Layer.succeed(DnsResolver.Service, make(resolve));\n\nexport const toAsync = (resolve: Resolve): DnsResolver.AsyncInterface =>\n  DnsResolver.toAsync(make(resolve));\n","import { Effect, Layer, Schema } from \"effect\";\n\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport * as DnsRecord from \"../domain/dns-record.ts\";\nimport * as Deletion from \"../plan/deletion.ts\";\nimport * as Digest from \"../plan/canonical-json.ts\";\nimport * as Provisioning from \"../plan/plan.ts\";\nimport * as DnsProvider from \"../provider/provider.ts\";\n\nexport class Error extends Schema.TaggedError<Error>()(\"ProviderConformanceError\", {\n  case: Schema.String,\n  message: Schema.String,\n  providerId: Schema.String,\n}) {}\n\nexport interface Input {\n  readonly makeProvider: () => Effect.Effect<DnsProvider.Interface, DnsProvider.Error>;\n  readonly prefix?: string;\n  readonly zone: DomainName.DomainName;\n}\n\nexport interface Report {\n  readonly cases: ReadonlyArray<string>;\n  readonly providerId: string;\n  readonly zone: DomainName.DomainName;\n}\n\n/** Adapt a fresh Promise-shaped provider factory for the Effect-native conformance runner. */\nexport function fromAsync(makeProvider: () => DnsProvider.AsyncInterface): Input[\"makeProvider\"] {\n  return () => Effect.sync(() => DnsProvider.fromAsync(makeProvider()));\n}\n\nconst cases = [\n  \"create-readback-cleanup\",\n  \"exact-noop\",\n  \"conflict\",\n  \"stale-plan\",\n  \"partial-apply-cleanup\",\n] as const;\n\n/** Run the deterministic offline contract every DomainKit DNS adapter must satisfy. */\nexport const run = Effect.fn(\"ProviderConformance.run\")(function* (input: Input) {\n  const makeProvider = () =>\n    Effect.suspend(input.makeProvider).pipe(\n      Effect.catchDefect((cause) =>\n        Effect.fail(\n          new Error({\n            case: \"factory\",\n            message: cause instanceof globalThis.Error ? cause.message : \"Provider factory failed\",\n            providerId: \"unknown\",\n          }),\n        ),\n      ),\n    );\n  const first = yield* makeProvider();\n  const providerId = first.id;\n  const prefix = input.prefix ?? \"domainkit-conformance\";\n  yield* createReadbackCleanup(first, input.zone, prefix);\n  yield* exactNoop(yield* makeProvider(), input.zone, prefix);\n  yield* conflict(yield* makeProvider(), input.zone, prefix);\n  yield* stalePlan(yield* makeProvider(), input.zone, prefix);\n  yield* partialApplyCleanup(yield* makeProvider(), input.zone, prefix);\n  return { cases, providerId, zone: input.zone } satisfies Report;\n});\n\nfunction createReadbackCleanup(\n  provider: DnsProvider.Interface,\n  zone: DomainName.DomainName,\n  prefix: string,\n) {\n  const requirements = createRequirements(zone, prefix);\n  let cleanupRecordIds: ReadonlyArray<string> = [];\n  return Effect.gen(function* () {\n    const { plan } = yield* Provisioning.create({\n      requirements,\n      target: Provisioning.Target.ExactZone({ zone }),\n    });\n    yield* requireTags(provider, \"create-readback-cleanup\", plan.operations, [\"create\", \"create\"]);\n    const receipt = yield* Provisioning.apply({\n      authorization: yield* Provisioning.authorize(plan),\n      plan,\n    }).pipe(\n      Effect.tapError((failure) =>\n        failure instanceof Provisioning.PartialApplyError\n          ? Effect.sync(() => {\n              cleanupRecordIds = providerRecordIds(failure.receipt.operations);\n            })\n          : Effect.void,\n      ),\n    );\n    cleanupRecordIds = providerRecordIds(receipt.operations);\n    yield* requireCondition(\n      provider,\n      \"create-readback-cleanup\",\n      receipt.status === \"complete\" &&\n        receipt.operations.every(({ providerRecordId }) => providerRecordId !== null),\n      \"apply must return a complete receipt with provider record IDs\",\n    );\n    const observed = yield* provider.listRecords(zone);\n    yield* requireCondition(\n      provider,\n      \"create-readback-cleanup\",\n      requirements.every((requirement) =>\n        observed.some(\n          (record) => record._tag !== \"Opaque\" && DnsRecord.equals(record, requirement),\n        ),\n      ),\n      \"listRecords must return every created record, including across provider pages\",\n    );\n    const deletion = yield* Deletion.create({ plan, receipt });\n    const deletionReceipt = yield* Deletion.apply({\n      authorization: yield* Deletion.authorize(deletion),\n      plan: deletion,\n    });\n    yield* requireCondition(\n      provider,\n      \"create-readback-cleanup\",\n      deletionReceipt.status === \"complete\" &&\n        (yield* recordIdsAbsent(provider, zone, cleanupRecordIds)),\n      \"receipt-bound cleanup must remove every created record\",\n    );\n  }).pipe(\n    Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)),\n    Effect.provide(providerLayer(provider)),\n  );\n}\n\nfunction exactNoop(provider: DnsProvider.Interface, zone: DomainName.DomainName, prefix: string) {\n  const requirement = cname(zone, `${prefix}-exact`);\n  let cleanupRecordIds: ReadonlyArray<string> = [];\n  return Effect.gen(function* () {\n    const created = yield* provider.createRecord(zone, requirement);\n    cleanupRecordIds = created.providerRecordId === null ? [] : [created.providerRecordId];\n    const { plan } = yield* Provisioning.create({\n      requirements: [requirement],\n      target: Provisioning.Target.ExactZone({ zone }),\n    });\n    yield* requireTags(provider, \"exact-noop\", plan.operations, [\"noop\"]);\n    const receipt = yield* Provisioning.apply({\n      authorization: yield* Provisioning.authorize(plan),\n      plan,\n    });\n    yield* requireCondition(\n      provider,\n      \"exact-noop\",\n      receipt.operations.length === 0,\n      \"an exact plan must not create another record\",\n    );\n    yield* deleteCreated(provider, zone, created.providerRecordId, \"exact-noop\");\n  }).pipe(\n    Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)),\n    Effect.provide(providerLayer(provider)),\n  );\n}\n\nfunction conflict(provider: DnsProvider.Interface, zone: DomainName.DomainName, prefix: string) {\n  const requirement = cname(zone, `${prefix}-conflict`);\n  const occupied = txt(zone, `${prefix}-conflict`, \"occupied\");\n  let cleanupRecordIds: ReadonlyArray<string> = [];\n  return Effect.gen(function* () {\n    const created = yield* provider.createRecord(zone, occupied);\n    cleanupRecordIds = created.providerRecordId === null ? [] : [created.providerRecordId];\n    const { plan } = yield* Provisioning.create({\n      requirements: [requirement],\n      target: Provisioning.Target.ExactZone({ zone }),\n    });\n    yield* requireTags(provider, \"conflict\", plan.operations, [\"conflict\"]);\n    const failure = yield* Provisioning.apply({\n      authorization: yield* Provisioning.authorize(plan),\n      plan,\n    }).pipe(Effect.flip);\n    yield* requireCondition(\n      provider,\n      \"conflict\",\n      failure instanceof Provisioning.ConflictError,\n      \"apply must fail closed on incompatible state\",\n    );\n    yield* deleteCreated(provider, zone, created.providerRecordId, \"conflict\");\n  }).pipe(\n    Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)),\n    Effect.provide(providerLayer(provider)),\n  );\n}\n\nfunction stalePlan(provider: DnsProvider.Interface, zone: DomainName.DomainName, prefix: string) {\n  const requirement = cname(zone, `${prefix}-stale`);\n  let cleanupRecordIds: ReadonlyArray<string> = [];\n  return Effect.gen(function* () {\n    const { plan } = yield* Provisioning.create({\n      requirements: [requirement],\n      target: Provisioning.Target.ExactZone({ zone }),\n    });\n    const authorization = yield* Provisioning.authorize(plan);\n    const created = yield* provider.createRecord(zone, requirement);\n    cleanupRecordIds = created.providerRecordId === null ? [] : [created.providerRecordId];\n    const failure = yield* Provisioning.apply({ authorization, plan }).pipe(Effect.flip);\n    yield* requireCondition(\n      provider,\n      \"stale-plan\",\n      failure instanceof Provisioning.StaleError,\n      \"apply must reject provider state that changed after authorization\",\n    );\n    yield* deleteCreated(provider, zone, created.providerRecordId, \"stale-plan\");\n  }).pipe(\n    Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)),\n    Effect.provide(providerLayer(provider)),\n  );\n}\n\nfunction partialApplyCleanup(\n  provider: DnsProvider.Interface,\n  zone: DomainName.DomainName,\n  prefix: string,\n) {\n  let creates = 0;\n  const flaky = DnsProvider.Service.of({\n    ...provider,\n    createRecord: Effect.fn(\"ProviderConformance.createRecord\")((target, record) => {\n      creates += 1;\n      return creates === 1\n        ? provider.createRecord(target, record)\n        : Effect.fail(\n            new DnsProvider.Error({\n              message: \"injected conformance failure\",\n              operation: \"createRecord\",\n              providerId: provider.id,\n            }),\n          );\n    }),\n  });\n  const requirements = [\n    cname(zone, `${prefix}-partial-one`),\n    txt(zone, `${prefix}-partial-two`, \"domainkit\"),\n  ];\n  let cleanupRecordIds: ReadonlyArray<string> = [];\n  return Effect.gen(function* () {\n    const { plan } = yield* Provisioning.create({\n      requirements,\n      target: Provisioning.Target.ExactZone({ zone }),\n    });\n    const failure = yield* Provisioning.apply({\n      authorization: yield* Provisioning.authorize(plan),\n      plan,\n    }).pipe(Effect.flip);\n    cleanupRecordIds =\n      failure instanceof Provisioning.PartialApplyError\n        ? providerRecordIds(failure.receipt.operations)\n        : [];\n    yield* requireCondition(\n      provider,\n      \"partial-apply-cleanup\",\n      failure instanceof Provisioning.PartialApplyError && failure.receipt.operations.length === 1,\n      \"a later write failure must preserve the first confirmed write in a partial receipt\",\n    );\n    if (!(failure instanceof Provisioning.PartialApplyError)) return;\n    const deletion = yield* Deletion.create({ plan, receipt: failure.receipt }).pipe(\n      Effect.provide(providerLayer(provider)),\n    );\n    yield* Deletion.apply({\n      authorization: yield* Deletion.authorize(deletion),\n      plan: deletion,\n    }).pipe(Effect.provide(providerLayer(provider)));\n    yield* requireCondition(\n      provider,\n      \"partial-apply-cleanup\",\n      yield* recordIdsAbsent(provider, zone, cleanupRecordIds),\n      \"partial receipt cleanup must remove the confirmed write\",\n    );\n  }).pipe(\n    Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)),\n    Effect.provide(providerLayer(flaky)),\n  );\n}\n\nfunction providerRecordIds(\n  operations: ReadonlyArray<{ readonly providerRecordId: string | null }>,\n): ReadonlyArray<string> {\n  return operations.flatMap(({ providerRecordId }) =>\n    providerRecordId === null ? [] : [providerRecordId],\n  );\n}\n\nfunction recordIdsAbsent(\n  provider: DnsProvider.Interface,\n  zone: DomainName.DomainName,\n  recordIds: ReadonlyArray<string>,\n) {\n  return Effect.forEach(recordIds, (providerRecordId) =>\n    provider.getRecord(zone, providerRecordId),\n  ).pipe(Effect.map((records) => records.every((record) => record === null)));\n}\n\nfunction bestEffortDelete(\n  provider: DnsProvider.Interface,\n  zone: DomainName.DomainName,\n  recordIds: () => ReadonlyArray<string>,\n) {\n  return Effect.suspend(() =>\n    Effect.forEach(\n      recordIds(),\n      (providerRecordId) => provider.deleteRecord(zone, providerRecordId).pipe(Effect.ignore),\n      { discard: true },\n    ),\n  );\n}\n\nfunction providerLayer(provider: DnsProvider.Interface) {\n  return Layer.merge(Layer.succeed(DnsProvider.Service, provider), Digest.webCryptoLayer);\n}\n\nfunction createRequirements(zone: DomainName.DomainName, prefix: string) {\n  return [cname(zone, `${prefix}-create`), txt(zone, `${prefix}-page`, \"domainkit\")];\n}\n\nfunction cname(zone: DomainName.DomainName, label: string) {\n  return DnsRecord.parse({\n    _tag: \"CNAME\",\n    metadata: { ownership: \"tester\", provenance: \"domainkit\", purpose: \"conformance\" },\n    name: `${label}.${zone}`,\n    policy: \"exclusive\",\n    target: \"target.example.net\",\n    ttl: 300,\n  });\n}\n\nfunction txt(zone: DomainName.DomainName, label: string, value: string) {\n  return DnsRecord.parse({\n    _tag: \"TXT\",\n    metadata: { ownership: \"tester\", provenance: \"domainkit\", purpose: \"conformance\" },\n    name: `${label}.${zone}`,\n    policy: \"append\",\n    ttl: 300,\n    value,\n  });\n}\n\nfunction requireTags(\n  provider: DnsProvider.Interface,\n  testCase: string,\n  operations: ReadonlyArray<{ readonly _tag: string }>,\n  expected: ReadonlyArray<string>,\n) {\n  return requireCondition(\n    provider,\n    testCase,\n    JSON.stringify(operations.map(({ _tag }) => _tag)) === JSON.stringify(expected),\n    `expected operations ${expected.join(\", \")}`,\n  );\n}\n\nfunction requireCondition(\n  provider: DnsProvider.Interface,\n  testCase: string,\n  condition: boolean,\n  message: string,\n) {\n  return condition\n    ? Effect.void\n    : Effect.fail(new Error({ case: testCase, message, providerId: provider.id }));\n}\n\nfunction deleteCreated(\n  provider: DnsProvider.Interface,\n  zone: DomainName.DomainName,\n  providerRecordId: string | null,\n  testCase: string,\n) {\n  return providerRecordId === null\n    ? Effect.fail(\n        new Error({\n          case: testCase,\n          message: \"provider must return record IDs for safe cleanup\",\n          providerId: provider.id,\n        }),\n      )\n    : provider.deleteRecord(zone, providerRecordId);\n}\n"],"mappings":";;;;;;;;;AAaA,SAAS,QAAQ,WAAmB,SAAkC;CACpE,OAAO,IAAIA,QAAgB;EACzB,UAAU;EACV;EACA;EACA,OAAO;CACT,CAAC;AACH;AAEA,SAASC,WAAS,WAAmB,SAAkC;CACrE,OAAO,IAAID,QAAgB;EACzB,UAAU;EACV;EACA;EACA,OAAO;CACT,CAAC;AACH;AAEA,SAAS,gBACP,WACA,cACA,SACyC;CACzC,OAAO,UAAU,YAAY,MAC1B,eAAe,WAAW,OAAO,gBAAgB,WAAW,YAAY,OAC3E;AACF;AAEA,SAAS,iBACP,YACA,eACA,YAC+B;CAC/B,OAAOE,QAAmB,YAAY,eAAe,UAAU;AACjE;AAEA,SAAgBC,OAAK,UAAmB,CAAC,GAAwB;CAC/D,MAAM,QAAQ,OAAO,QAAQ,IAAI,qBAA+C,IAAI,IAAI,CAAC,CAAC;CAC1F,MAAM,YAAY,UAAU,WAAW,CAAC;CACxC,MAAM,aAAsB,WAAmC,UAAU,WAAW,MAAM;CAE1F,MAAM,SAAS,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAC/D,WACA,WACA;EACA,IAAI,QAAQ,iBAAiB,KAAA,GAAW,OAAO,QAAQ,aAAa,WAAW,SAAS;EACxF,OAAO,IAAI,OAAO,QAAQ,YAAY;GACpC,MAAM,OAAO,IAAI,IAAI,OAAO;GAC5B,KAAK,IAAI,UAAU,cAAc,IAAI,SAAS;GAC9C,OAAO;EACT,CAAC;CACH,CAAC;CAED,MAAM,SAAS,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAC/D,WACA,iBACA;EACA,IAAI,QAAQ,iBAAiB,KAAA,GAAW,OAAO,QAAQ,aAAa,WAAW,IAAI;EACnF,OAAO,IAAI,OAAO,QAAQ,YAAY;GACpC,MAAM,OAAO,IAAI,IAAI,OAAO;GAC5B,KAAK,OAAO,eAAe;GAC3B,OAAO;EACT,CAAC;CACH,CAAC;CAED,MAAM,MAAM,OAAO,GAAG,2BAA2B,CAAC,EAAE,oBAClD,IAAI,IAAI,KAAK,CAAC,CAAC,KAAK,OAAO,KAAK,YAAY,QAAQ,IAAI,eAAe,KAAK,IAAI,CAAC,CACnF;CAEA,MAAM,oBAAoB,OAAO,GAAG,yCAAyC,CAAC,EAC3E,iBACC,IAAI,IAAI,KAAK,CAAC,CAAC,KACb,OAAO,KACJ,YACC,CAAC,GAAG,QAAQ,OAAO,CAAC,CAAC,CAAC,MAAM,cAC1B,UAAU,YAAY,MAAM,eAAe,WAAW,OAAO,YAAY,CAC3E,KAAK,IACT,CACF,CACJ;CAEA,MAAM,mBAAmB,OAAO,GAAG,gDAAgD,CAAC,CAAC,WAGnF,WACA,YACA,QACA;EACA,MAAM,cAAc,OAAO,SAAS;EACpC,MAAM,UAA+B;GACnC,GAAG;GACH,eAAe;IACb,GAAG,UAAU;IACb,YACE,UAAU,cAAc,WAAW,SAAS,YACxC,UAAU,cAAc,aAAA,WACS,QAAQ,EAAE,YAAY,CAAC;GAChE;EACF;EACA,OAAO,OAAO,qBAAqB,OAAO;EAC1C,OAAO,OAAO,QAAQ,aAAa;EACnC,OAAO,OAAO,sBAAsB,QAAQ,cAAc,EAAE;EAC5D,OAAO;GACL,YAAY,iBAAiB,YAAY,QAAQ,eAAe,QAAQ,UAAU;GAClF,sBAAsB;GACtB,sBAAsB;EACxB;CACF,CAAC;CAED,OAAA,QAAyB,GAAG;EAC1B,SAAS,EAAE,YAAY,cAAc,cACnC,UACE,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,kBAAkB,YAAY;GACvD,IAAI,cAAc,MAChB,OAAO,OAAO,QAAQ,UAAU,oCAAoC;GAEtE,MAAM,aAAa,gBAAgB,WAAW,cAAc,OAAO;GACnE,IAAI,eAAe,KAAA,GACjB,OAAO,OAAO,QAAQ,UAAU,mDAAmD;GAErF,IAAI,WAAW,iBAAiB,cAC9B,OAAO,OAAOF,WAAS,UAAU,8CAA8C;GAEjF,MAAM,WAAW,UAAU,YAAY,MAAM,EAAE,SAAS,OAAO,WAAW,EAAE;GAC5E,IAAI,aAAa,KAAA,GAAW;IAC1B,IACE,SAAS,iBAAiB,WAAW,gBACrC,SAAS,WAAW,WAAW,UAC/B,SAAS,OAAO,cAAc,WAAW,OAAO,aAChD,SAAS,OAAO,gBAAgB,WAAW,OAAO,eAClD,SAAS,OAAO,WAAW,WAAW,OAAO,UAC7C,SAAS,OAAO,aAAa,WAAW,OAAO,UAE/C,OAAO,OAAOA,WAAS,UAAU,wCAAwC;IAE3E,OAAO;KACL,YAAY;KACZ,YAAY,iBACV,YACA,UAAU,eACV,UAAU,UACZ;IACF;GACF;GAIA,IAHoB,CAAC,IAAI,OAAO,IAAI,IAAI,KAAK,EAAA,CAAG,OAAO,CAAC,CAAC,CAAC,MAAM,cAC9D,UAAU,YAAY,MAAM,EAAE,SAAS,OAAO,WAAW,EAAE,CAE/C,GACZ,OAAO,OAAOA,WAAS,UAAU,wCAAwC;GAa3E,IAXkB,CAAC,IAAI,OAAO,IAAI,IAAI,KAAK,EAAA,CAAG,OAAO,CAAC,CAAC,CAAC,MAAM,cAAc;IAC1E,OAAO,UAAU,YAAY,MAC1B,EAAE,cAAc,wBAAwB,aACvC,WAAW,WAAW,UACtB,UAAU,YAAY,MACnB,wBACC,oBAAoB,OAAO,0BAC3B,oBAAoB,YAAY,OACpC,CACJ;GACF,CACY,GACV,OAAO,OAAOA,WACZ,UACA,0DACF;GAEF,MAAM,OAA4B;IAChC,GAAG;IACH,aAAa,CAAC,GAAG,UAAU,aAAa,UAAU;GACpD;GACA,OAAO,OAAO,UAAU,IAAI;GAC5B,OAAO;IACL;IACA,YAAY,iBAAiB,YAAY,UAAU,eAAe,UAAU,UAAU;GACxF;EACF,CAAC,CACH;EACF,UAAU,UACR,UACE,OAAO,IAAI,aAAa;GAEtB,MAAM,WAAU,OADO,IAAI,IAAI,KAAK,EAAA,CACZ,IAAI,MAAM,cAAc,EAAE;GAClD,IACE,SAAS,cAAc,WAAW,SAAS,aAC1C,MAAM,4BAA4B,KAAA,KAAa,YAAY,KAAA,GAE5D,OAAO,OAAOA,WACZ,WACA,YAAY,KAAA,IACR,4CACA,wDACN;GAEF,IACE,MAAM,4BAA4B,KAAA,KAClC,SAAS,cAAc,OAAO,MAAM,yBAEpC,OAAO,OAAOA,WAAS,WAAW,iDAAiD;GAErF,IACE,MAAM,cAAc,OAAO,MAAM,WAAW,mBAC5C,MAAM,cAAc,eAAe,MAAM,WAAW,cACpD,MAAM,cAAc,WAAW,MAAM,WAAW,QAEhD,OAAO,OAAOA,WAAS,WAAW,6CAA6C;GAEjF,MAAM,qBAAqB,SAAS,YAAY,MAC7C,eAAe,WAAW,YAAY,MAAM,WAAW,OAC1D;GACA,IACE,MAAM,yBAAyB,KAAA,KAC/B,oBAAoB,OAAO,MAAM,sBAEjC,OAAO,OAAOA,WAAS,WAAW,kDAAkD;GAEtF,MAAM,aAAa,sBAAsB,MAAM;GAC/C,MAAM,OAA4B;IAChC,eAAe,MAAM;IACrB,aAAa,UACT,CAAC,GAAG,QAAQ,YAAY,QAAQ,EAAE,SAAS,OAAO,WAAW,EAAE,GAAG,UAAU,IAC5E,CAAC,UAAU;IACf,aAAa,SAAS,eAAe,CAAC;IACtC,YAAY,MAAM;GACpB;GACA,OAAO,OAAO,WAAW,IAAI;GAC7B,OAAO;EACT,CAAC,CACH;EACF,SAAS,EAAE,cAAc,cACvB,UACE,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO,IAAI,IAAI,KAAK;GACpC,KAAK,MAAM,aAAa,QAAQ,OAAO,GAAG;IACxC,MAAM,aAAa,UAAU,YAAY,MAAM,EAAE,SAAS,OAAO,YAAY;IAC7E,IAAI,eAAe,KAAA,GAAW;IAC9B,MAAM,aAAa,gBAAgB,WAAW,WAAW,cAAc,OAAO;IAC9E,IAAI,eAAe,KAAA,GACjB,OAAO,OAAO,QAAQ,UAAU,iDAAiD;IAEnF,MAAM,OAA4B;KAChC,GAAG;KACH,aAAa,UAAU,YAAY,QAAQ,EAAE,SAAS,OAAO,YAAY;IAC3E;IACA,OAAO,OAAO,UAAU,IAAI;IAC5B,OAAO;KACL;KACA,YAAY,iBACV,YACA,UAAU,eACV,UAAU,UACZ;KACA,sBAAsB,KAAK,YAAY,QACpC,EAAE,mBAAmB,iBAAiB,WAAW,EACpD,CAAC,CAAC;IACJ;GACF;GACA,OAAO,OAAO,QAAQ,UAAU,kCAAkC;EACpE,CAAC,CACH;EACF,aAAa,EAAE,cAAc,SAAS,aACpC,UACE,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,kBAAkB,YAAY;GACvD,IAAI,cAAc,MAChB,OAAO,OAAO,QAAQ,cAAc,oCAAoC;GAE1E,MAAM,aAAa,gBAAgB,WAAW,cAAc,OAAO;GACnE,IAAI,eAAe,KAAA,GACjB,OAAO,OAAO,QACZ,cACA,mDACF;GAEF,IAAI,UAAU,YAAY,MAAM,EAAE,cAAc,SAAS,OAAO,YAAY,GAC1E,OAAO,OAAOA,WACZ,cACA,mEACF;GAEF,MAAM,uBAAuB,UAAU,YAAY,QAChD,EAAE,SAAS,OAAO,YACrB;GACA,IAAI,qBAAqB,SAAS,GAAG;IACnC,MAAM,OAA4B;KAAE,GAAG;KAAW,aAAa;IAAqB;IACpF,OAAO,OAAO,wBAAwB,IAAI;IAC1C,OAAO;KACL,YAAY,iBACV,YACA,UAAU,eACV,UAAU,UACZ;KACA,sBAAsB,qBAAqB;KAC3C,sBAAsB;IACxB;GACF;GACA,OAAO,OAAO,iBAAiB,WAAW,YAAY,MAAM;EAC9D,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,kCAAkC,CAAC,CAC7D;EACF,iBAAiB,SAAS,oBACxB,IAAI,IAAI,KAAK,CAAC,CAAC,KACb,OAAO,KACJ,YACC,QAAQ,IAAI,eAAe,CAAC,EAAE,YAAY,MAAM,EAAE,SAAS,SAAS,OAAO,OAAO,KAClF,IACJ,CACF;EACF;EACA,gBAAgB,iBACd,IAAI,IAAI,KAAK,CAAC,CAAC,KACb,OAAO,KACJ,YACC,CAAC,GAAG,QAAQ,OAAO,CAAC,CAAC,CAClB,SAAS,EAAE,kBAAkB,WAAW,CAAC,CACzC,MAAM,EAAE,SAAS,OAAO,YAAY,KAAK,IAChD,CACF;EACF;EACA,kBAAkB,cAAc,YAC9B,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,kBAAkB,YAAY;GACvD,IAAI,cAAc,MAChB,OAAO,OAAO,QAAQ,mBAAmB,oCAAoC;GAE/E,IAAI,gBAAgB,WAAW,cAAc,OAAO,MAAM,KAAA,GACxD,OAAO,OAAO,QACZ,mBACA,mDACF;GAEF,OAAO,UAAU,YAAY,QAAQ,EAAE,cAAc,SAAS,OAAO,YAAY;EACnF,CAAC;EACH,kBAAkB,iBAAiB,aACjC,UACE,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,IAAI,eAAe;GAC5C,IAAI,cAAc,MAChB,OAAO,OAAO,QAAQ,mBAAmB,uCAAuC;GAElF,MAAM,eAAe,IAAI,IACvB,UAAU,cAAc,mBAAmB,KAAK,SAAS,CAAC,KAAK,YAAY,IAAI,CAAC,CAClF;GACA,KAAK,MAAM,QAAQ,UAAU,aAAa,IAAI,KAAK,YAAY,IAAI;GACnE,MAAM,OAAO;IACX,GAAG;IACH,eAAe;KACb,GAAG,UAAU;KACb,oBAAoB,CAAC,GAAG,aAAa,OAAO,CAAC;IAC/C;GACF;GACA,OAAO,OAAO,mBAAmB,IAAI;GACrC,OAAO;EACT,CAAC,CACH;EACF,UAAU,EAAE,iBAAiB,aAC3B,UACE,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,IAAI,eAAe;GAC5C,IAAI,cAAc,MAChB,OAAO,OAAO,QAAQ,WAAW,uCAAuC;GAE1E,IAAI,UAAU,cAAc,WAAW,SAAS,WAC9C,OAAO,OAAO,QAAQ,WAAW,mDAAmD;GAEtF,MAAM,aAAa,UAAU,YAAY;GACzC,IAAI,eAAe,KAAA,GACjB,OAAO,OAAO,QAAQ,WAAW,yCAAyC;GAE5E,OAAO,OAAO,iBAAiB,WAAW,YAAY,MAAM;EAC9D,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,+BAA+B,CAAC,CAC1D;EACF,SAAS,iBAAiB,eACxB,UACE,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,IAAI,eAAe;GAC5C,IAAI,cAAc,MAChB,OAAO,OAAO,QAAQ,UAAU,uCAAuC;GAEzE,MAAM,OAAO;IACX,GAAG;IACH;GACF;GACA,OAAO,OAAO,UAAU,IAAI;GAC5B,OAAO;EACT,CAAC,CACH;CACJ,CAAC;AACH;AAEA,MAAaG,WAAS,UAAmB,CAAC,MAAM,MAAM,KAAKC,eAAyBF,OAAK,OAAO,CAAC;;;;AC/YjG,SAAgBG,SAAqC;CACnD,MAAM,QAAQ,OAAO,QAAQ,IAAI,qBAAmD,IAAI,IAAI,CAAC,CAAC;CAC9F,OAAO;EACL,SAAS,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAAW,IAAI,KAAK;GACxE,OAAO,OAAO,IAAI,OAAO,QAAQ,YAAY;IAC3C,MAAM,eAAe,QAAQ,IAAI,EAAE;IACnC,MAAM,OAAO,IAAI,IAAI,OAAO;IAC5B,KAAK,OAAO,EAAE;IACd,OAAO,CACL,iBAAiB,KAAA,KAAa,aAAa,YAAY,MAAM,eAAe,MAC5E,IACF;GACF,CAAC;EACH,CAAC;EACD,KAAK,OAAO,GAAG,6BAA6B,CAAC,EAAE,iBAC7C,IAAI,OAAO,QAAQ,YAAY;GAC7B,MAAM,OAAO,IAAI,IAAI,OAAO;GAC5B,KAAK,IAAI,aAAa,IAAI,YAAY;GACtC,OAAO;EACT,CAAC,CACH;CACF;AACF;;;;;;;;ACfA,SAAgBC,OAAK,UAAmB,CAAC,GAA0B;CACjE,MAAM,KAAK,QAAQ,MAAM;CACzB,MAAM,0BAAU,IAAI,IAAsD;CAC1E,MAAM,4BAAY,IAAI,IAAgC;CACtD,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,QAAQ,WAAW,CAAC,CAAC,GAAG;EACnE,QAAQ,IAAIC,MAAiB,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC;EAChD,KAAK,MAAM,CAAC,OAAO,WAAW,QAAQ,QAAQ,GAAG,UAAU,IAAI,GAAG,GAAG,GAAG,QAAQ,KAAK,MAAM;CAC7F;CACA,OAAO;EACL;EACA,aAAa,OAAO,GAAG,iCAAiC,CAAC,EAAE,SACzD,OAAO,WAAW,CAAC,GAAI,QAAQ,IAAI,IAAI,KAAK,CAAC,CAAE,CAAC,CAClD;EACA,cAAc,OAAO,GAAG,kCAAkC,CAAC,EAAE,MAAM,WACjE,OAAO,WAAW;GAChB,MAAM,UAAU,QAAQ,IAAI,IAAI,KAAK,CAAC;GACtC,QAAQ,KAAK,MAAM;GACnB,QAAQ,IAAI,MAAM,OAAO;GACzB,MAAM,mBAAmB,GAAG,GAAG,GAAG,QAAQ;GAC1C,UAAU,IAAI,kBAAkB,MAAM;GACtC,OAAO,EAAE,iBAAiB;EAC5B,CAAC,CACH;EACA,cAAc,OAAO,GAAG,kCAAkC,CAAC,EAAE,MAAM,qBACjE,OAAO,WAAW;GAChB,MAAM,SAAS,UAAU,IAAI,gBAAgB;GAC7C,IAAI,WAAW,KAAA,GAAW;GAC1B,QAAQ,IACN,OACC,QAAQ,IAAI,IAAI,KAAK,CAAC,EAAA,CAAG,QAAQ,cAAc,cAAc,MAAM,CACtE;GACA,UAAU,OAAO,gBAAgB;EACnC,CAAC,CACH;EACA,WAAW,OAAO,GAAG,+BAA+B,CAAC,EAAE,OAAO,qBAC5D,OAAO,WAAW,UAAU,IAAI,gBAAgB,KAAK,IAAI,CAC3D;CACF;AACF;AAEA,MAAaC,WAAS,UAAmB,CAAC,MACxC,MAAM,QAAQC,WAAqBH,OAAK,OAAO,CAAC;AAElD,MAAaI,aAAW,UAAmB,CAAC,MAC1CC,UAAoBL,OAAK,OAAO,CAAC;;;;;;;;AC/CnC,SAAgB,KAAK,SAAyC;CAC5D,OAAO,EACL,SAAS,OAAO,GAAG,6BAA6B,CAAC,EAAE,UACjD,OAAO,cAAc;EACnB,MAAM,aAAa,QAAQ,KAAK;EAChC,OAAO,OAAO,SAAS,UAAU,IAAI,aAAa,OAAO,QAAQ,UAAU;CAC7E,CAAC,CACH,EACF;AACF;AAEA,MAAa,SAAS,YACpB,MAAM,QAAQM,WAAqB,KAAK,OAAO,CAAC;AAElD,MAAa,WAAW,YACtBC,UAAoB,KAAK,OAAO,CAAC;;;;;;;;ACdnC,IAAa,QAAb,cAA2B,OAAO,YAAmB,CAAC,CAAC,4BAA4B;CACjF,MAAM,OAAO;CACb,SAAS,OAAO;CAChB,YAAY,OAAO;AACrB,CAAC,CAAC,CAAC,CAAC;;AAeJ,SAAgB,UAAU,cAAuE;CAC/F,aAAa,OAAO,WAAWC,YAAsB,aAAa,CAAC,CAAC;AACtE;AAEA,MAAM,QAAQ;CACZ;CACA;CACA;CACA;CACA;AACF;;AAGA,MAAa,MAAM,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,OAAc;CAC/E,MAAM,qBACJ,OAAO,QAAQ,MAAM,YAAY,CAAC,CAAC,KACjC,OAAO,aAAa,UAClB,OAAO,KACL,IAAI,MAAM;EACR,MAAM;EACN,SAAS,iBAAiB,WAAW,QAAQ,MAAM,UAAU;EAC7D,YAAY;CACd,CAAC,CACH,CACF,CACF;CACF,MAAM,QAAQ,OAAO,aAAa;CAClC,MAAM,aAAa,MAAM;CACzB,MAAM,SAAS,MAAM,UAAU;CAC/B,OAAO,sBAAsB,OAAO,MAAM,MAAM,MAAM;CACtD,OAAO,UAAU,OAAO,aAAa,GAAG,MAAM,MAAM,MAAM;CAC1D,OAAO,SAAS,OAAO,aAAa,GAAG,MAAM,MAAM,MAAM;CACzD,OAAO,UAAU,OAAO,aAAa,GAAG,MAAM,MAAM,MAAM;CAC1D,OAAO,oBAAoB,OAAO,aAAa,GAAG,MAAM,MAAM,MAAM;CACpE,OAAO;EAAE;EAAO;EAAY,MAAM,MAAM;CAAK;AAC/C,CAAC;AAED,SAAS,sBACP,UACA,MACA,QACA;CACA,MAAM,eAAe,mBAAmB,MAAM,MAAM;CACpD,IAAI,mBAA0C,CAAC;CAC/C,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,EAAE,SAAS,OAAOC,OAAoB;GAC1C;GACA,QAAA,OAA4B,UAAU,EAAE,KAAK,CAAC;EAChD,CAAC;EACD,OAAO,YAAY,UAAU,2BAA2B,KAAK,YAAY,CAAC,UAAU,QAAQ,CAAC;EAC7F,MAAM,UAAU,OAAOC,MAAmB;GACxC,eAAe,OAAOC,UAAuB,IAAI;GACjD;EACF,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,YACf,mBAAmBC,oBACf,OAAO,WAAW;GAChB,mBAAmB,kBAAkB,QAAQ,QAAQ,UAAU;EACjE,CAAC,IACD,OAAO,IACb,CACF;EACA,mBAAmB,kBAAkB,QAAQ,UAAU;EACvD,OAAO,iBACL,UACA,2BACA,QAAQ,WAAW,cACjB,QAAQ,WAAW,OAAO,EAAE,uBAAuB,qBAAqB,IAAI,GAC9E,+DACF;EACA,MAAM,WAAW,OAAO,SAAS,YAAY,IAAI;EACjD,OAAO,iBACL,UACA,2BACA,aAAa,OAAO,gBAClB,SAAS,MACN,WAAW,OAAO,SAAS,YAAYC,OAAiB,QAAQ,WAAW,CAC9E,CACF,GACA,+EACF;EACA,MAAM,WAAW,OAAOC,SAAgB;GAAE;GAAM;EAAQ,CAAC;EAKzD,OAAO,iBACL,UACA,4BACA,OAP6BC,QAAe;GAC5C,eAAe,OAAOC,YAAmB,QAAQ;GACjD,MAAM;EACR,CAAC,EAAA,CAIiB,WAAW,eACxB,OAAO,gBAAgB,UAAU,MAAM,gBAAgB,IAC1D,wDACF;CACF,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,iBAAiB,UAAU,YAAY,gBAAgB,CAAC,GACxE,OAAO,QAAQ,cAAc,QAAQ,CAAC,CACxC;AACF;AAEA,SAAS,UAAU,UAAiC,MAA6B,QAAgB;CAC/F,MAAM,cAAc,MAAM,MAAM,GAAG,OAAO,OAAO;CACjD,IAAI,mBAA0C,CAAC;CAC/C,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,UAAU,OAAO,SAAS,aAAa,MAAM,WAAW;EAC9D,mBAAmB,QAAQ,qBAAqB,OAAO,CAAC,IAAI,CAAC,QAAQ,gBAAgB;EACrF,MAAM,EAAE,SAAS,OAAOP,OAAoB;GAC1C,cAAc,CAAC,WAAW;GAC1B,QAAA,OAA4B,UAAU,EAAE,KAAK,CAAC;EAChD,CAAC;EACD,OAAO,YAAY,UAAU,cAAc,KAAK,YAAY,CAAC,MAAM,CAAC;EAKpE,OAAO,iBACL,UACA,eACA,OAPqBC,MAAmB;GACxC,eAAe,OAAOC,UAAuB,IAAI;GACjD;EACF,CAAC,EAAA,CAIS,WAAW,WAAW,GAC9B,8CACF;EACA,OAAO,cAAc,UAAU,MAAM,QAAQ,kBAAkB,YAAY;CAC7E,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,iBAAiB,UAAU,YAAY,gBAAgB,CAAC,GACxE,OAAO,QAAQ,cAAc,QAAQ,CAAC,CACxC;AACF;AAEA,SAAS,SAAS,UAAiC,MAA6B,QAAgB;CAC9F,MAAM,cAAc,MAAM,MAAM,GAAG,OAAO,UAAU;CACpD,MAAM,WAAW,IAAI,MAAM,GAAG,OAAO,YAAY,UAAU;CAC3D,IAAI,mBAA0C,CAAC;CAC/C,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,UAAU,OAAO,SAAS,aAAa,MAAM,QAAQ;EAC3D,mBAAmB,QAAQ,qBAAqB,OAAO,CAAC,IAAI,CAAC,QAAQ,gBAAgB;EACrF,MAAM,EAAE,SAAS,OAAOF,OAAoB;GAC1C,cAAc,CAAC,WAAW;GAC1B,QAAA,OAA4B,UAAU,EAAE,KAAK,CAAC;EAChD,CAAC;EACD,OAAO,YAAY,UAAU,YAAY,KAAK,YAAY,CAAC,UAAU,CAAC;EAKtE,OAAO,iBACL,UACA,aACA,OAPqBC,MAAmB;GACxC,eAAe,OAAOC,UAAuB,IAAI;GACjD;EACF,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,cAIEM,eACnB,8CACF;EACA,OAAO,cAAc,UAAU,MAAM,QAAQ,kBAAkB,UAAU;CAC3E,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,iBAAiB,UAAU,YAAY,gBAAgB,CAAC,GACxE,OAAO,QAAQ,cAAc,QAAQ,CAAC,CACxC;AACF;AAEA,SAAS,UAAU,UAAiC,MAA6B,QAAgB;CAC/F,MAAM,cAAc,MAAM,MAAM,GAAG,OAAO,OAAO;CACjD,IAAI,mBAA0C,CAAC;CAC/C,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,EAAE,SAAS,OAAOR,OAAoB;GAC1C,cAAc,CAAC,WAAW;GAC1B,QAAA,OAA4B,UAAU,EAAE,KAAK,CAAC;EAChD,CAAC;EACD,MAAM,gBAAgB,OAAOE,UAAuB,IAAI;EACxD,MAAM,UAAU,OAAO,SAAS,aAAa,MAAM,WAAW;EAC9D,mBAAmB,QAAQ,qBAAqB,OAAO,CAAC,IAAI,CAAC,QAAQ,gBAAgB;EAErF,OAAO,iBACL,UACA,eACA,OAJqBD,MAAmB;GAAE;GAAe;EAAK,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,cAI9DQ,YACnB,mEACF;EACA,OAAO,cAAc,UAAU,MAAM,QAAQ,kBAAkB,YAAY;CAC7E,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,iBAAiB,UAAU,YAAY,gBAAgB,CAAC,GACxE,OAAO,QAAQ,cAAc,QAAQ,CAAC,CACxC;AACF;AAEA,SAAS,oBACP,UACA,MACA,QACA;CACA,IAAI,UAAU;CACd,MAAM,QAAA,UAA4B,GAAG;EACnC,GAAG;EACH,cAAc,OAAO,GAAG,kCAAkC,CAAC,EAAE,QAAQ,WAAW;GAC9E,WAAW;GACX,OAAO,YAAY,IACf,SAAS,aAAa,QAAQ,MAAM,IACpC,OAAO,KACL,IAAIC,QAAkB;IACpB,SAAS;IACT,WAAW;IACX,YAAY,SAAS;GACvB,CAAC,CACH;EACN,CAAC;CACH,CAAC;CACD,MAAM,eAAe,CACnB,MAAM,MAAM,GAAG,OAAO,aAAa,GACnC,IAAI,MAAM,GAAG,OAAO,eAAe,WAAW,CAChD;CACA,IAAI,mBAA0C,CAAC;CAC/C,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,EAAE,SAAS,OAAOV,OAAoB;GAC1C;GACA,QAAA,OAA4B,UAAU,EAAE,KAAK,CAAC;EAChD,CAAC;EACD,MAAM,UAAU,OAAOC,MAAmB;GACxC,eAAe,OAAOC,UAAuB,IAAI;GACjD;EACF,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI;EACnB,mBACE,mBAAmBC,oBACf,kBAAkB,QAAQ,QAAQ,UAAU,IAC5C,CAAC;EACP,OAAO,iBACL,UACA,yBACA,mBAAmBA,qBAAkC,QAAQ,QAAQ,WAAW,WAAW,GAC3F,oFACF;EACA,IAAI,EAAE,mBAAmBA,oBAAiC;EAC1D,MAAM,WAAW,OAAOE,SAAgB;GAAE;GAAM,SAAS,QAAQ;EAAQ,CAAC,CAAC,CAAC,KAC1E,OAAO,QAAQ,cAAc,QAAQ,CAAC,CACxC;EACA,OAAOC,QAAe;GACpB,eAAe,OAAOC,YAAmB,QAAQ;GACjD,MAAM;EACR,CAAC,CAAC,CAAC,KAAK,OAAO,QAAQ,cAAc,QAAQ,CAAC,CAAC;EAC/C,OAAO,iBACL,UACA,yBACA,OAAO,gBAAgB,UAAU,MAAM,gBAAgB,GACvD,yDACF;CACF,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,iBAAiB,UAAU,YAAY,gBAAgB,CAAC,GACxE,OAAO,QAAQ,cAAc,KAAK,CAAC,CACrC;AACF;AAEA,SAAS,kBACP,YACuB;CACvB,OAAO,WAAW,SAAS,EAAE,uBAC3B,qBAAqB,OAAO,CAAC,IAAI,CAAC,gBAAgB,CACpD;AACF;AAEA,SAAS,gBACP,UACA,MACA,WACA;CACA,OAAO,OAAO,QAAQ,YAAY,qBAChC,SAAS,UAAU,MAAM,gBAAgB,CAC3C,CAAC,CAAC,KAAK,OAAO,KAAK,YAAY,QAAQ,OAAO,WAAW,WAAW,IAAI,CAAC,CAAC;AAC5E;AAEA,SAAS,iBACP,UACA,MACA,WACA;CACA,OAAO,OAAO,cACZ,OAAO,QACL,UAAU,IACT,qBAAqB,SAAS,aAAa,MAAM,gBAAgB,CAAC,CAAC,KAAK,OAAO,MAAM,GACtF,EAAE,SAAS,KAAK,CAClB,CACF;AACF;AAEA,SAAS,cAAc,UAAiC;CACtD,OAAO,MAAM,MAAM,MAAM,QAAQI,WAAqB,QAAQ,GAAGC,cAAqB;AACxF;AAEA,SAAS,mBAAmB,MAA6B,QAAgB;CACvE,OAAO,CAAC,MAAM,MAAM,GAAG,OAAO,QAAQ,GAAG,IAAI,MAAM,GAAG,OAAO,QAAQ,WAAW,CAAC;AACnF;AAEA,SAAS,MAAM,MAA6B,OAAe;CACzD,OAAOC,QAAgB;EACrB,MAAM;EACN,UAAU;GAAE,WAAW;GAAU,YAAY;GAAa,SAAS;EAAc;EACjF,MAAM,GAAG,MAAM,GAAG;EAClB,QAAQ;EACR,QAAQ;EACR,KAAK;CACP,CAAC;AACH;AAEA,SAAS,IAAI,MAA6B,OAAe,OAAe;CACtE,OAAOA,QAAgB;EACrB,MAAM;EACN,UAAU;GAAE,WAAW;GAAU,YAAY;GAAa,SAAS;EAAc;EACjF,MAAM,GAAG,MAAM,GAAG;EAClB,QAAQ;EACR,KAAK;EACL;CACF,CAAC;AACH;AAEA,SAAS,YACP,UACA,UACA,YACA,UACA;CACA,OAAO,iBACL,UACA,UACA,KAAK,UAAU,WAAW,KAAK,EAAE,WAAW,IAAI,CAAC,MAAM,KAAK,UAAU,QAAQ,GAC9E,uBAAuB,SAAS,KAAK,IAAI,GAC3C;AACF;AAEA,SAAS,iBACP,UACA,UACA,WACA,SACA;CACA,OAAO,YACH,OAAO,OACP,OAAO,KAAK,IAAI,MAAM;EAAE,MAAM;EAAU;EAAS,YAAY,SAAS;CAAG,CAAC,CAAC;AACjF;AAEA,SAAS,cACP,UACA,MACA,kBACA,UACA;CACA,OAAO,qBAAqB,OACxB,OAAO,KACL,IAAI,MAAM;EACR,MAAM;EACN,SAAS;EACT,YAAY,SAAS;CACvB,CAAC,CACH,IACA,SAAS,aAAa,MAAM,gBAAgB;AAClD"}

package/dist/{verify-6xK05pwL.d.mts → verify-C3V_GtzL.d.mts}

@@ -1,4 +1,5 @@
-import { Bt as TokenValidation, H as Source, Ht as Value, It as OAuthClientConfiguration, Jt as Service$2, Kt as Error, Lt as OAuthMethod, Nt as IntegrationMethod, Pt as Manifest, Q as InteractiveFlow, Rt as OAuthSubjectResolver, Wt as AsyncInterface$1, a as Interface$5, at as Envelope, bt as ProviderConnection, c as Service$1, en as DnsRecord, et as Method, hn as DomainName, i as Error$2, it as Codec, jt as ProviderAuthorization, kt as Capability, n as AsyncInterface$2, o as Query, qt as Interface$4, t as Answer, xt as ProviderTarget, yn as Error$1, yt as DomainAttachment } from "./resolver-BGBLnPjJ.mjs";
+import { H as Capability, J as Manifest, M as ProviderConnection, N as ProviderTarget, Nt as Error$1, Q as OAuthSubjectResolver, W as ProviderAuthorization, X as OAuthClientConfiguration, Z as OAuthMethod, ct as Service$1, d as Method, et as TokenValidation, g as Envelope, h as Codec, it as AsyncInterface$1, j as DomainAttachment, kt as DomainName, l as InteractiveFlow, mt as DnsRecord, nt as Value, ot as Error, q as IntegrationMethod, s as Error$2, st as Interface$4 } from "./connect-10vHuShV.mjs";
+import { H as Source, a as Interface$5, c as Service$2, i as Error$3, n as AsyncInterface$2, o as Query, t as Answer } from "./resolver-DRrLm_hB.mjs";
 import { Context, Data, Effect, Layer, Schema } from "effect";
 import * as oauth from "oauth4webapi";
 declare namespace diagnostic_d_exports {
@@ -202,11 +203,12 @@ declare const Resolution: {
 /** The credential material a provider adapter needs to restore a session. */
 interface Credential {
   readonly accessToken: Value;
+  readonly expiresAt: Date | null;
   readonly refreshToken: Value | null;
   readonly tokenType: string;
 }
 /** The non-secret authorization projection required when restoring a provider session. */
-type Authorization = Pick<ProviderAuthorization, "capabilityEvidence" | "expiresAt" | "method" | "providerContext" | "providerId" | "requiredCapabilities" | "revocation">;
+type Authorization = Pick<ProviderAuthorization, "capabilityEvidence" | "method" | "providerContext" | "providerId" | "requiredCapabilities" | "revocation">;
 interface RestoreInput {
   readonly authorization: Authorization;
   readonly credential: Credential;
@@ -293,7 +295,7 @@ declare const validateDomainToken: (options: DomainCredentialOptions) => Effect.
 /** Creates an Effect-native Cloudflare client without owning the credential lifecycle. */
 declare function make$5(options: Options$4): Interface$2;
 declare namespace auth_d_exports$1 {
-  export { Context$2 as Context, CredentialTarget, OAuthFlowOptions, OAuthMethodOptions, SubjectResolverOptions, TokenConnectionOptions$1 as TokenConnectionOptions, TokenValidatorOptions, contextCodec$1 as contextCodec, manifest$1 as manifest, oauthAuthentication, oauthFlow, oauthMethod, restore$1 as restore, subjectResolver, tokenConnectionMethod$1 as tokenConnectionMethod, tokenMethod$1 as tokenMethod, tokenValidator };
+  export { Context$2 as Context, CredentialTarget, OAuthFlowOptions, OAuthMethodOptions, RefreshCredentialOptions, SubjectResolverOptions, TokenConnectionOptions$1 as TokenConnectionOptions, TokenValidatorOptions, contextCodec$1 as contextCodec, manifest$1 as manifest, oauthAuthentication, oauthFlow, oauthMethod, refreshCredential, restore$1 as restore, subjectResolver, tokenConnectionMethod$1 as tokenConnectionMethod, tokenMethod$1 as tokenMethod, tokenValidator };
 }
 declare const Context$2: Schema.Struct<{
   readonly accountId: Schema.optionalKey<Schema.String>;
@@ -364,16 +366,29 @@ declare const oauthAuthentication: (options: SubjectResolverOptions & {
   }[];
   credential: {
     accessToken: Value;
+    expiresAt: Date | null;
     refreshToken: Value | null;
     tokenType: Lowercase<string>;
   };
-  expiresAt: Date | null;
   providerAccountId: string;
   providerContext: Envelope;
   scopes: string[];
 }, Error$1 | Error, never>;
 /** Restore a credential-scoped Cloudflare session from persisted authorization state. */
 declare function restore$1(options: RestoreInput & Pick<Options$4, "baseUrl" | "fetch">): Effect.Effect<Interface$2, Error>;
+interface RefreshCredentialOptions {
+  readonly client: OAuthClientConfiguration;
+  readonly clientAuth: OAuthMethod["clientAuth"];
+  readonly credential: Credential;
+  readonly fetch?: Fetch$2;
+}
+/** Exchanges a Cloudflare refresh token for a fresh provider credential. */
+declare const refreshCredential: (options: RefreshCredentialOptions) => Effect.Effect<{
+  accessToken: Value;
+  expiresAt: Date | null;
+  refreshToken: Value;
+  tokenType: Lowercase<string>;
+}, Error | Error$2, never>;
 type OAuthFlowOptions = SubjectResolverOptions & {
   readonly client: OAuthClientConfiguration;
   readonly clientAuth: OAuthMethod["clientAuth"];
@@ -396,6 +411,17 @@ type AccountContext = {
   readonly _tag: "team";
   readonly teamId: string;
 };
+/** Constructs the account scope used by Vercel API requests. */
+declare const AccountContext: {
+  personal: () => Extract<AccountContext, {
+    readonly _tag: "personal";
+  }>;
+  team: ({ teamId }: {
+    readonly teamId: string;
+  }) => Extract<AccountContext, {
+    readonly _tag: "team";
+  }>;
+};
 /** Configuration for an Effect-native Vercel authoritative-DNS client. */
 interface Options$3 {
   readonly baseUrl?: string;
@@ -489,7 +515,6 @@ declare const exchangeCode: (options: ExchangeCodeOptions) => Effect.Effect<{
   accessToken: Value;
   context: {
     readonly _tag: "personal";
-    readonly teamId?: never;
   } | {
     readonly _tag: "team";
     readonly teamId: string;
@@ -517,10 +542,10 @@ declare const integrationAuthentication: (options: ExchangeCodeOptions & {
   }[];
   credential: {
     accessToken: Value;
+    expiresAt: null;
     refreshToken: null;
     tokenType: string;
   };
-  expiresAt: null;
   providerAccountId: string;
   providerContext: Envelope;
   scopes: never[];
@@ -543,7 +568,7 @@ interface Options$2 {
   readonly timeoutMs?: number;
 }
 declare function make$3(options: Options$2): Interface$5;
-declare const layer$2: (options: Options$2) => Layer.Layer<Service$1>;
+declare const layer$2: (options: Options$2) => Layer.Layer<Service$2>;
 declare const toAsync$2: (options: Options$2) => AsyncInterface$2;
 declare namespace cloudflare_doh_d_exports {
   export { Options$1 as Options, layer$1 as layer, make$2 as make, toAsync$1 as toAsync };
@@ -552,7 +577,7 @@ interface Options$1 extends Omit<Options$2, "endpoint"> {
   readonly endpoint?: string;
 }
 declare function make$2(options?: Options$1): Interface$5;
-declare const layer$1: (options?: Options$1) => Layer.Layer<Service$1>;
+declare const layer$1: (options?: Options$1) => Layer.Layer<Service$2>;
 declare const toAsync$1: (options?: Options$1) => AsyncInterface$2;
 declare namespace google_doh_d_exports {
   export { Options, layer, make$1 as make, toAsync };
@@ -561,7 +586,7 @@ interface Options extends Omit<Options$2, "endpoint"> {
   readonly endpoint?: string;
 }
 declare function make$1(options?: Options): Interface$5;
-declare const layer: (options?: Options) => Layer.Layer<Service$1>;
+declare const layer: (options?: Options) => Layer.Layer<Service$2>;
 declare const toAsync: (options?: Options) => AsyncInterface$2;
 declare namespace resolver_pool_d_exports {
   export { DefaultOptions, Entry, Interface, Observation, Policy, Service, defaultLayer, defaultMake, make };
@@ -578,7 +603,7 @@ type Observation = Data.TaggedEnum<{
   };
   Failed: {
     readonly message: string;
-    readonly reason: Exclude<Error$2["reason"], "timeout">;
+    readonly reason: Exclude<Error$3["reason"], "timeout">;
     readonly resolverId: string;
   };
   NoData: {
@@ -599,7 +624,7 @@ declare const Observation: {
   }> | Extract<{
     readonly _tag: "Failed";
     readonly message: string;
-    readonly reason: Exclude<Error$2["reason"], "timeout">;
+    readonly reason: Exclude<Error$3["reason"], "timeout">;
     readonly resolverId: string;
   }, {
     readonly _tag: Tag;
@@ -623,7 +648,7 @@ declare const Observation: {
     } | {
       readonly _tag: "Failed";
       readonly message: string;
-      readonly reason: Exclude<Error$2["reason"], "timeout">;
+      readonly reason: Exclude<Error$3["reason"], "timeout">;
       readonly resolverId: string;
     } | {
       readonly _tag: "NoData";
@@ -641,7 +666,7 @@ declare const Observation: {
     } | {
       readonly _tag: "Failed";
       readonly message: string;
-      readonly reason: Exclude<Error$2["reason"], "timeout">;
+      readonly reason: Exclude<Error$3["reason"], "timeout">;
       readonly resolverId: string;
     } | {
       readonly _tag: "NoData";
@@ -658,7 +683,7 @@ declare const Observation: {
     } | {
       readonly _tag: "Failed";
       readonly message: string;
-      readonly reason: Exclude<Error$2["reason"], "timeout">;
+      readonly reason: Exclude<Error$3["reason"], "timeout">;
       readonly resolverId: string;
     } | {
       readonly _tag: "NoData";
@@ -676,7 +701,7 @@ declare const Observation: {
     } | {
       readonly _tag: "Failed";
       readonly message: string;
-      readonly reason: Exclude<Error$2["reason"], "timeout">;
+      readonly reason: Exclude<Error$3["reason"], "timeout">;
       readonly resolverId: string;
     } | {
       readonly _tag: "NoData";
@@ -695,7 +720,7 @@ declare const Observation: {
   readonly Failed: Data.TaggedEnum.ConstructorFrom<{
     readonly _tag: "Failed";
     readonly message: string;
-    readonly reason: Exclude<Error$2["reason"], "timeout">;
+    readonly reason: Exclude<Error$3["reason"], "timeout">;
     readonly resolverId: string;
   }, "_tag">;
   readonly NoData: Data.TaggedEnum.ConstructorFrom<{
@@ -1236,8 +1261,8 @@ declare const Result: {
   }, "_tag">;
 };
 declare function observe(input: PublicOnlyConfig): Effect.Effect<Result, Error$1>;
-declare function observe(input: ProviderConfig): Effect.Effect<Result, Error$1, Service$2>;
-declare function observe(input: Config): Effect.Effect<Result, Error$1, Service$2>;
+declare function observe(input: ProviderConfig): Effect.Effect<Result, Error$1, Service$1>;
+declare function observe(input: Config): Effect.Effect<Result, Error$1, Service$1>;
 //#endregion
-export { zones_d_exports as $, Options$3 as A, oauthMethod as B, manifest as C, Fetch$1 as D, AccountContext as E, OAuthMethodOptions as F, ListZonesInput$1 as G, Account$1 as H, SubjectResolverOptions as I, Interface$3 as J, Options$4 as K, TokenConnectionOptions$1 as L, index_d_exports$1 as M, CredentialTarget as N, Interface$1 as O, OAuthFlowOptions as P, session_d_exports as Q, TokenValidatorOptions as R, integrationMethod as S, Account as T, Fetch$2 as U, tokenMethod$1 as V, Interface$2 as W, Resolution as X, ListTargetsInput as Y, RestoreInput as Z, ExchangeCodeOptions as _, verify_d_exports as a, IntegrationMethodOptions as b, Policy as c, google_doh_d_exports as d, selection_d_exports as et, Options$1 as f, index_d_exports as g, doh_d_exports as h, Result as i, Zone as j, ListZonesInput as k, resolver_pool_d_exports as l, Options$2 as m, PublicDns as n, DefaultOptions as o, cloudflare_doh_d_exports as p, Zone$1 as q, PublicDnsObservation as r, Observation as s, ProviderObservation as t, diagnostic_d_exports as tt, Options as u, IntegrationCredential as v, tokenMethod as w, TokenConnectionOptions as x, IntegrationFlowOptions as y, manifest$1 as z };
-//# sourceMappingURL=verify-6xK05pwL.d.mts.map
+export { RestoreInput as $, Options$3 as A, manifest$1 as B, manifest as C, Fetch$1 as D, AccountContext as E, OAuthMethodOptions as F, Interface$2 as G, tokenMethod$1 as H, RefreshCredentialOptions as I, Zone$1 as J, ListZonesInput$1 as K, SubjectResolverOptions as L, index_d_exports$1 as M, CredentialTarget as N, Interface$1 as O, OAuthFlowOptions as P, Resolution as Q, TokenConnectionOptions$1 as R, integrationMethod as S, Account as T, Account$1 as U, oauthMethod as V, Fetch$2 as W, Interface$3 as X, Credential as Y, ListTargetsInput as Z, ExchangeCodeOptions as _, verify_d_exports as a, IntegrationMethodOptions as b, Policy as c, google_doh_d_exports as d, session_d_exports as et, Options$1 as f, index_d_exports as g, doh_d_exports as h, Result as i, Zone as j, ListZonesInput as k, resolver_pool_d_exports as l, Options$2 as m, PublicDns as n, selection_d_exports as nt, DefaultOptions as o, cloudflare_doh_d_exports as p, Options$4 as q, PublicDnsObservation as r, diagnostic_d_exports as rt, Observation as s, ProviderObservation as t, zones_d_exports as tt, Options as u, IntegrationCredential as v, tokenMethod as w, TokenConnectionOptions as x, IntegrationFlowOptions as y, TokenValidatorOptions as z };
+//# sourceMappingURL=verify-C3V_GtzL.d.mts.map