domainkit 0.6.0 → 0.8.0

package/dist/server.d.mts

@@ -1,6 +1,6 @@
-import { O as Service, a as Continuation, l as InteractiveFlow } from "./connect-Db830jad.mjs";
-import "./connection-api-B__0M3PA.mjs";
-import { i as AsyncInterface, t as InteractiveFlow$1 } from "./connection-DuYDgWir.mjs";
+import { O as Service, a as Continuation, l as InteractiveFlow } from "./connect-D-X8T9W8.mjs";
+import "./connection-api-lqG1nBtD.mjs";
+import { i as AsyncInterface, t as InteractiveFlow$1 } from "./connection-Dp6ZdSo8.mjs";
 import { Context, Crypto, Effect, Layer, Schema } from "effect";
 declare namespace index_d_exports {
   export { AsyncConnectionPolicy, AsyncIdentity, AsyncInteractiveFlow, AsyncInteractiveProvider, AsyncPendingAuthorizations, AuthorizationReuseInput, Configuration, ConnectionPolicy, ConnectionPolicyInterface, CreateDomainKitOptions, DEFAULT_BASE_PATH, Error, Handler, Identity, IdentityInterface, InteractiveFlowInput, InteractiveProvider, Interface, PendingAuthorization, PendingAuthorizationContext, PendingAuthorizations, PendingAuthorizationsInterface, Principal, Providers, ProvidersInterface, WebHandler, createDomainKit, layer, make, providersLayer, toWebHandler };

package/dist/server.mjs

@@ -1,7 +1,7 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { i as webCryptoLayer, o as Error$1, s as Service } from "./canonical-json-9x7gHIoS.mjs";
-import { a as start, i as complete, n as Method, t as Error$2 } from "./connect-ks3cpqBD.mjs";
-import { t as layerFromAsync } from "./managed-dns-connections-CaXts84E.mjs";
+import { i as webCryptoLayer, o as Error$1, s as Service } from "./canonical-json-CQYKsZw7.mjs";
+import { a as start, i as complete, n as Method, t as Error$2 } from "./connect-oI8hcMxc.mjs";
+import { t as layerFromAsync } from "./managed-dns-connections-C3A_GBaz.mjs";
 import { Context, Crypto, Effect, Layer, ManagedRuntime, Schema } from "effect";
 //#region src/server/index.ts
 var server_exports = /* @__PURE__ */ __exportAll({

package/dist/testing.d.mts

@@ -1,5 +1,5 @@
-import { D as Interface, E as Error$1, Nt as Error$3, O as Service, b as Aggregate, ct as Service$1, it as AsyncInterface, kt as DomainName, o as ContinuationStore, ot as Error$2, st as Interface$1, v as CryptoError, vt as Observed } from "./connect-Db830jad.mjs";
-import { D as StaleError, T as PartialApplyError, a as Interface$2, c as Service$2, h as PartialError, i as Error$4, j as ApplyReceipt, n as AsyncInterface$1, o as Query, p as Error$5, s as Resolution, x as ConflictError, y as AuthorizationError } from "./resolver-DUAIlm2I.mjs";
+import { D as Interface, E as Error$1, Nt as Error$3, O as Service, b as Aggregate, ct as Service$1, it as AsyncInterface, kt as DomainName, o as ContinuationStore, ot as Error$2, st as Interface$1, v as CryptoError, vt as Observed } from "./connect-D-X8T9W8.mjs";
+import { D as StaleError, T as PartialApplyError, a as Interface$2, c as Service$2, h as PartialError, i as Error$4, j as ApplyReceipt, n as AsyncInterface$1, o as Query, p as Error$5, s as Resolution, x as ConflictError, y as AuthorizationError } from "./resolver-xoSwyXDJ.mjs";
 import { Effect, Layer, Schema } from "effect";
 declare namespace in_memory_lifecycle_repository_d_exports {
   export { Options$1 as Options, layer$2 as layer, make$3 as make };

package/dist/testing.mjs

@@ -1,7 +1,7 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { C as project, O as parse, i as webCryptoLayer, o as Error$1, s as Service } from "./canonical-json-9x7gHIoS.mjs";
-import { F as Service$1, I as fromAsync$1, P as Error$2, S as create, _ as PartialApplyError, b as apply, d as apply$1, f as authorize$1, h as ConflictError, i as toAsync$3, n as Service$2, nt as equals, p as create$1, rt as parse$1, v as StaleError, x as authorize, y as Target, z as toAsync$2 } from "./resolver-DxJPsq6l.mjs";
-import { Effect, Layer, Ref, Schema, Semaphore } from "effect";
+import { i as webCryptoLayer, k as parse, l as Revocation, o as Error$1, s as Service, w as project } from "./canonical-json-CQYKsZw7.mjs";
+import { C as authorize, I as Error$2, L as Service$1, R as fromAsync$1, S as apply, V as toAsync$2, _ as ConflictError, at as parse$1, b as StaleError, h as create$1, i as Service$2, it as equals, m as authorize$1, o as toAsync$3, p as apply$1, w as create, x as Target, y as PartialApplyError } from "./resolver-BeGz1ukw.mjs";
+import { DateTime, Effect, Layer, Ref, Schema, Semaphore } from "effect";
 //#region src/stores/in-memory-lifecycle-repository.ts
 var in_memory_lifecycle_repository_exports = /* @__PURE__ */ __exportAll({
 	layer: () => layer$2,
@@ -52,14 +52,12 @@ function make$3(options = {}) {
 	const get = Effect.fn("ManagedDnsConnections.get")((authorizationId) => Ref.get(state).pipe(Effect.map((entries) => entries.get(authorizationId) ?? null)));
 	const getByConnectionId = Effect.fn("ManagedDnsConnections.getByConnectionId")((connectionId) => Ref.get(state).pipe(Effect.map((entries) => [...entries.values()].find((aggregate) => aggregate.connections.some((connection) => connection.id === connectionId)) ?? null)));
 	const finishRevocation = Effect.fn("InMemoryManagedDnsConnections.finishRevocation")(function* (aggregate, connection, revoke) {
+		const requestedAt = yield* DateTime.nowAsDate;
 		const pending = {
 			...aggregate,
 			authorization: {
 				...aggregate.authorization,
-				revocation: aggregate.authorization.revocation._tag === "Pending" ? aggregate.authorization.revocation : {
-					_tag: "Pending",
-					requestedAt: /* @__PURE__ */ new Date()
-				}
+				revocation: aggregate.authorization.revocation._tag === "Pending" ? aggregate.authorization.revocation : Revocation.Pending({ requestedAt })
 			}
 		};
 		yield* commit("prepareRevocation", pending);

package/dist/testing.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"testing.mjs","names":["Lifecycle.Error","conflict","Connection.project","make","layer","Lifecycle.Service","make","make","DomainName.parse","layer","DnsProvider.Service","toAsync","DnsProvider.toAsync","DnsResolver.Service","DnsResolver.toAsync","DnsProvider.fromAsync","Provisioning.create","Provisioning.apply","Provisioning.authorize","Provisioning.PartialApplyError","DnsRecord.equals","Deletion.create","Deletion.apply","Deletion.authorize","Provisioning.ConflictError","Provisioning.StaleError","DnsProvider.Error","DnsProvider.Service","Digest.webCryptoLayer","DnsRecord.parse"],"sources":["../src/stores/in-memory-lifecycle-repository.ts","../src/stores/in-memory-continuation.ts","../src/provider/in-memory.ts","../src/verification/in-memory.ts","../src/testing/provider-conformance.ts"],"sourcesContent":["import { Effect, Layer, Ref, Semaphore } from \"effect\";\n\nimport * as ProviderAuthorization from \"../auth/authorization.ts\";\nimport * as Connection from \"../auth/connection.ts\";\nimport * as Lifecycle from \"../auth/lifecycle-repository.ts\";\n\nexport interface Options {\n  readonly beforeCommit?: (\n    operation: string,\n    aggregate: Lifecycle.Aggregate | null,\n  ) => Effect.Effect<void, Lifecycle.Error>;\n}\n\nfunction missing(operation: string, message: string): Lifecycle.Error {\n  return new Lifecycle.Error({\n    category: \"storage\",\n    message,\n    operation,\n    retry: \"never\",\n  });\n}\n\nfunction conflict(operation: string, message: string): Lifecycle.Error {\n  return new Lifecycle.Error({\n    category: \"storage\",\n    message,\n    operation,\n    retry: \"after-user-action\",\n  });\n}\n\nfunction ownerConnection(\n  aggregate: Lifecycle.Aggregate,\n  connectionId: string,\n  ownerId: string,\n): Connection.StoredConnection | undefined {\n  return aggregate.connections.find(\n    (connection) => connection.id === connectionId && connection.ownerId === ownerId,\n  );\n}\n\nfunction publicConnection(\n  connection: Connection.StoredConnection,\n  authorization: ProviderAuthorization.ProviderAuthorization,\n  credential: Connection.StoredCredential,\n): Connection.ProviderConnection {\n  return Connection.project(connection, authorization, credential);\n}\n\nexport function make(options: Options = {}): Lifecycle.Interface {\n  const state = Effect.runSync(Ref.make<ReadonlyMap<string, Lifecycle.Aggregate>>(new Map()));\n  const mutations = Semaphore.makeUnsafe(1);\n  const serialize = <A, E, R>(effect: Effect.Effect<A, E, R>) => mutations.withPermit(effect);\n\n  const commit = Effect.fn(\"InMemoryManagedDnsConnections.commit\")(function* (\n    operation: string,\n    aggregate: Lifecycle.Aggregate,\n  ) {\n    if (options.beforeCommit !== undefined) yield* options.beforeCommit(operation, aggregate);\n    yield* Ref.update(state, (entries) => {\n      const next = new Map(entries);\n      next.set(aggregate.authorization.id, aggregate);\n      return next;\n    });\n  });\n\n  const remove = Effect.fn(\"InMemoryManagedDnsConnections.remove\")(function* (\n    operation: string,\n    authorizationId: string,\n  ) {\n    if (options.beforeCommit !== undefined) yield* options.beforeCommit(operation, null);\n    yield* Ref.update(state, (entries) => {\n      const next = new Map(entries);\n      next.delete(authorizationId);\n      return next;\n    });\n  });\n\n  const get = Effect.fn(\"ManagedDnsConnections.get\")((authorizationId: string) =>\n    Ref.get(state).pipe(Effect.map((entries) => entries.get(authorizationId) ?? null)),\n  );\n\n  const getByConnectionId = Effect.fn(\"ManagedDnsConnections.getByConnectionId\")(\n    (connectionId: string) =>\n      Ref.get(state).pipe(\n        Effect.map(\n          (entries) =>\n            [...entries.values()].find((aggregate) =>\n              aggregate.connections.some((connection) => connection.id === connectionId),\n            ) ?? null,\n        ),\n      ),\n  );\n\n  const finishRevocation = Effect.fn(\"InMemoryManagedDnsConnections.finishRevocation\")(function* <\n    E,\n  >(\n    aggregate: Lifecycle.Aggregate,\n    connection: Connection.StoredConnection,\n    revoke: (authorization: ProviderAuthorization.ProviderAuthorization) => Effect.Effect<void, E>,\n  ) {\n    const pending: Lifecycle.Aggregate = {\n      ...aggregate,\n      authorization: {\n        ...aggregate.authorization,\n        revocation:\n          aggregate.authorization.revocation._tag === \"Pending\"\n            ? aggregate.authorization.revocation\n            : { _tag: \"Pending\", requestedAt: new Date() },\n      },\n    };\n    yield* commit(\"prepareRevocation\", pending);\n    yield* revoke(pending.authorization);\n    yield* remove(\"completeRevocation\", pending.authorization.id);\n    return {\n      connection: publicConnection(connection, pending.authorization, pending.credential),\n      remainingConnections: 0,\n      revokedAuthorization: true,\n    } satisfies Lifecycle.DisconnectResult;\n  });\n\n  return Lifecycle.Service.of({\n    attach: ({ attachment, connectionId, ownerId }) =>\n      serialize(\n        Effect.gen(function* () {\n          const aggregate = yield* getByConnectionId(connectionId);\n          if (aggregate === null) {\n            return yield* missing(\"attach\", \"Provider connection does not exist\");\n          }\n          const connection = ownerConnection(aggregate, connectionId, ownerId);\n          if (connection === undefined) {\n            return yield* missing(\"attach\", \"Provider connection does not belong to this owner\");\n          }\n          if (attachment.connectionId !== connectionId) {\n            return yield* conflict(\"attach\", \"Domain attachment targets another connection\");\n          }\n          const existing = aggregate.attachments.find(({ id }) => id === attachment.id);\n          if (existing !== undefined) {\n            if (\n              existing.connectionId !== attachment.connectionId ||\n              existing.domain !== attachment.domain ||\n              existing.target.accountId !== attachment.target.accountId ||\n              existing.target.accountKind !== attachment.target.accountKind ||\n              existing.target.zoneId !== attachment.target.zoneId ||\n              existing.target.zoneName !== attachment.target.zoneName\n            ) {\n              return yield* conflict(\"attach\", \"Domain attachment id is already in use\");\n            }\n            return {\n              attachment: existing,\n              connection: publicConnection(\n                connection,\n                aggregate.authorization,\n                aggregate.credential,\n              ),\n            };\n          }\n          const duplicateId = [...(yield* Ref.get(state)).values()].some((candidate) =>\n            candidate.attachments.some(({ id }) => id === attachment.id),\n          );\n          if (duplicateId) {\n            return yield* conflict(\"attach\", \"Domain attachment id is already in use\");\n          }\n          const duplicate = [...(yield* Ref.get(state)).values()].some((candidate) => {\n            return candidate.attachments.some(\n              ({ connectionId: attachmentConnectionId, domain }) =>\n                domain === attachment.domain &&\n                candidate.connections.some(\n                  (candidateConnection) =>\n                    candidateConnection.id === attachmentConnectionId &&\n                    candidateConnection.ownerId === ownerId,\n                ),\n            );\n          });\n          if (duplicate) {\n            return yield* conflict(\n              \"attach\",\n              \"An organization domain already has a provider attachment\",\n            );\n          }\n          const next: Lifecycle.Aggregate = {\n            ...aggregate,\n            attachments: [...aggregate.attachments, attachment],\n          };\n          yield* commit(\"attach\", next);\n          return {\n            attachment,\n            connection: publicConnection(connection, aggregate.authorization, aggregate.credential),\n          };\n        }),\n      ),\n    connect: (input) =>\n      serialize(\n        Effect.gen(function* () {\n          const entries = yield* Ref.get(state);\n          const current = entries.get(input.authorization.id);\n          if (\n            current?.authorization.revocation._tag === \"Pending\" ||\n            (input.expectedAuthorizationId !== undefined && current === undefined)\n          ) {\n            return yield* conflict(\n              \"connect\",\n              current === undefined\n                ? \"Provider authorization no longer exists\"\n                : \"Provider authorization is awaiting revocation recovery\",\n            );\n          }\n          if (\n            input.expectedAuthorizationId !== undefined &&\n            current?.authorization.id !== input.expectedAuthorizationId\n          ) {\n            return yield* conflict(\"connect\", \"Provider authorization changed during reconnect\");\n          }\n          if (\n            input.authorization.id !== input.connection.authorizationId ||\n            input.authorization.providerId !== input.connection.providerId ||\n            input.authorization.method !== input.connection.method\n          ) {\n            return yield* conflict(\"connect\", \"Connection does not match its authorization\");\n          }\n          const existingConnection = current?.connections.find(\n            (connection) => connection.ownerId === input.connection.ownerId,\n          );\n          if (\n            input.expectedConnectionId !== undefined &&\n            existingConnection?.id !== input.expectedConnectionId\n          ) {\n            return yield* conflict(\"connect\", \"Organization connection changed during reconnect\");\n          }\n          const connection = existingConnection ?? input.connection;\n          const next: Lifecycle.Aggregate = {\n            authorization: input.authorization,\n            connections: current\n              ? [...current.connections.filter(({ id }) => id !== connection.id), connection]\n              : [connection],\n            attachments: current?.attachments ?? [],\n            credential: input.credential,\n          };\n          yield* commit(\"connect\", next);\n          return next;\n        }),\n      ),\n    detach: ({ attachmentId, ownerId }) =>\n      serialize(\n        Effect.gen(function* () {\n          const entries = yield* Ref.get(state);\n          for (const aggregate of entries.values()) {\n            const attachment = aggregate.attachments.find(({ id }) => id === attachmentId);\n            if (attachment === undefined) continue;\n            const connection = ownerConnection(aggregate, attachment.connectionId, ownerId);\n            if (connection === undefined) {\n              return yield* missing(\"detach\", \"Domain attachment does not belong to this owner\");\n            }\n            const next: Lifecycle.Aggregate = {\n              ...aggregate,\n              attachments: aggregate.attachments.filter(({ id }) => id !== attachmentId),\n            };\n            yield* commit(\"detach\", next);\n            return {\n              attachment,\n              connection: publicConnection(\n                connection,\n                aggregate.authorization,\n                aggregate.credential,\n              ),\n              remainingAttachments: next.attachments.filter(\n                ({ connectionId }) => connectionId === connection.id,\n              ).length,\n            };\n          }\n          return yield* missing(\"detach\", \"Domain attachment does not exist\");\n        }),\n      ),\n    disconnect: ({ connectionId, ownerId, revoke }) =>\n      serialize(\n        Effect.gen(function* () {\n          const aggregate = yield* getByConnectionId(connectionId);\n          if (aggregate === null) {\n            return yield* missing(\"disconnect\", \"Provider connection does not exist\");\n          }\n          const connection = ownerConnection(aggregate, connectionId, ownerId);\n          if (connection === undefined) {\n            return yield* missing(\n              \"disconnect\",\n              \"Provider connection does not belong to this owner\",\n            );\n          }\n          if (aggregate.attachments.some(({ connectionId: id }) => id === connectionId)) {\n            return yield* conflict(\n              \"disconnect\",\n              \"Detach all organization domains before disconnecting the provider\",\n            );\n          }\n          const remainingConnections = aggregate.connections.filter(\n            ({ id }) => id !== connectionId,\n          );\n          if (remainingConnections.length > 0) {\n            const next: Lifecycle.Aggregate = { ...aggregate, connections: remainingConnections };\n            yield* commit(\"disconnectConnection\", next);\n            return {\n              connection: publicConnection(\n                connection,\n                aggregate.authorization,\n                aggregate.credential,\n              ),\n              remainingConnections: remainingConnections.length,\n              revokedAuthorization: false,\n            };\n          }\n          return yield* finishRevocation(aggregate, connection, revoke);\n        }).pipe(Effect.withSpan(\"ManagedDnsConnections.disconnect\")),\n      ),\n    findConnection: (ownerId, authorizationId) =>\n      Ref.get(state).pipe(\n        Effect.map(\n          (entries) =>\n            entries.get(authorizationId)?.connections.find(({ ownerId: id }) => id === ownerId) ??\n            null,\n        ),\n      ),\n    get,\n    getAttachment: (attachmentId) =>\n      Ref.get(state).pipe(\n        Effect.map(\n          (entries) =>\n            [...entries.values()]\n              .flatMap(({ attachments }) => attachments)\n              .find(({ id }) => id === attachmentId) ?? null,\n        ),\n      ),\n    getByConnectionId,\n    listAttachments: (connectionId, ownerId) =>\n      Effect.gen(function* () {\n        const aggregate = yield* getByConnectionId(connectionId);\n        if (aggregate === null) {\n          return yield* missing(\"listAttachments\", \"Provider connection does not exist\");\n        }\n        if (ownerConnection(aggregate, connectionId, ownerId) === undefined) {\n          return yield* missing(\n            \"listAttachments\",\n            \"Provider connection does not belong to this owner\",\n          );\n        }\n        return aggregate.attachments.filter(({ connectionId: id }) => id === connectionId);\n      }),\n    promoteEvidence: (authorizationId, evidence) =>\n      serialize(\n        Effect.gen(function* () {\n          const aggregate = yield* get(authorizationId);\n          if (aggregate === null) {\n            return yield* missing(\"promoteEvidence\", \"Provider authorization does not exist\");\n          }\n          const byCapability = new Map(\n            aggregate.authorization.capabilityEvidence.map((item) => [item.capability, item]),\n          );\n          for (const item of evidence) byCapability.set(item.capability, item);\n          const next = {\n            ...aggregate,\n            authorization: {\n              ...aggregate.authorization,\n              capabilityEvidence: [...byCapability.values()],\n            },\n          };\n          yield* commit(\"promoteEvidence\", next);\n          return next;\n        }),\n      ),\n    recover: ({ authorizationId, revoke }) =>\n      serialize(\n        Effect.gen(function* () {\n          const aggregate = yield* get(authorizationId);\n          if (aggregate === null) {\n            return yield* missing(\"recover\", \"Provider authorization does not exist\");\n          }\n          if (aggregate.authorization.revocation._tag !== \"Pending\") {\n            return yield* missing(\"recover\", \"Provider authorization is not awaiting revocation\");\n          }\n          const connection = aggregate.connections[0];\n          if (connection === undefined) {\n            return yield* missing(\"recover\", \"Pending authorization has no connection\");\n          }\n          return yield* finishRevocation(aggregate, connection, revoke);\n        }).pipe(Effect.withSpan(\"ManagedDnsConnections.recover\")),\n      ),\n    rotate: (authorizationId, credential) =>\n      serialize(\n        Effect.gen(function* () {\n          const aggregate = yield* get(authorizationId);\n          if (aggregate === null) {\n            return yield* missing(\"rotate\", \"Provider authorization does not exist\");\n          }\n          const next = {\n            ...aggregate,\n            credential,\n          };\n          yield* commit(\"rotate\", next);\n          return next;\n        }),\n      ),\n  });\n}\n\nexport const layer = (options: Options = {}) => Layer.sync(Lifecycle.Service, () => make(options));\n","import { Effect, Ref } from \"effect\";\n\nimport type * as Connection from \"../auth/connect.ts\";\n\nexport function make(): Connection.ContinuationStore {\n  const state = Effect.runSync(Ref.make<ReadonlyMap<string, Connection.Continuation>>(new Map()));\n  return {\n    consume: Effect.fn(\"ConnectionContinuations.consume\")(function* (id, now) {\n      return yield* Ref.modify(state, (entries) => {\n        const continuation = entries.get(id);\n        const next = new Map(entries);\n        next.delete(id);\n        return [\n          continuation !== undefined && continuation.expiresAt > now ? continuation : null,\n          next,\n        ] as const;\n      });\n    }),\n    put: Effect.fn(\"ConnectionContinuations.put\")((continuation) =>\n      Ref.update(state, (entries) => {\n        const next = new Map(entries);\n        next.set(continuation.id, continuation);\n        return next;\n      }),\n    ),\n  };\n}\n","import { Effect, Layer } from \"effect\";\n\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport type * as DnsRecord from \"../domain/dns-record.ts\";\nimport * as DnsProvider from \"./provider.ts\";\n\nexport interface Options {\n  readonly id?: string;\n  readonly records?: Readonly<Record<string, ReadonlyArray<DnsRecord.Observed>>>;\n}\n\nexport function make(options: Options = {}): DnsProvider.Interface {\n  const id = options.id ?? \"memory\";\n  const records = new Map<DomainName.DomainName, Array<DnsRecord.Observed>>();\n  const recordIds = new Map<string, DnsRecord.Observed>();\n  for (const [zone, initial] of Object.entries(options.records ?? {})) {\n    records.set(DomainName.parse(zone), [...initial]);\n    for (const [index, record] of initial.entries()) recordIds.set(`${id}:${index + 1}`, record);\n  }\n  return {\n    id,\n    listRecords: Effect.fn(\"InMemoryDnsProvider.listRecords\")((zone) =>\n      Effect.sync(() => [...(records.get(zone) ?? [])]),\n    ),\n    createRecord: Effect.fn(\"InMemoryDnsProvider.createRecord\")((zone, record) =>\n      Effect.sync(() => {\n        const current = records.get(zone) ?? [];\n        current.push(record);\n        records.set(zone, current);\n        const providerRecordId = `${id}:${current.length}`;\n        recordIds.set(providerRecordId, record);\n        return { providerRecordId };\n      }),\n    ),\n    deleteRecord: Effect.fn(\"InMemoryDnsProvider.deleteRecord\")((zone, providerRecordId) =>\n      Effect.sync(() => {\n        const record = recordIds.get(providerRecordId);\n        if (record === undefined) return;\n        records.set(\n          zone,\n          (records.get(zone) ?? []).filter((candidate) => candidate !== record),\n        );\n        recordIds.delete(providerRecordId);\n      }),\n    ),\n    getRecord: Effect.fn(\"InMemoryDnsProvider.getRecord\")((_zone, providerRecordId) =>\n      Effect.sync(() => recordIds.get(providerRecordId) ?? null),\n    ),\n  };\n}\n\nexport const layer = (options: Options = {}): Layer.Layer<DnsProvider.Service> =>\n  Layer.succeed(DnsProvider.Service, make(options));\n\nexport const toAsync = (options: Options = {}): DnsProvider.AsyncInterface =>\n  DnsProvider.toAsync(make(options));\n","import { Effect, Layer } from \"effect\";\n\nimport * as DnsResolver from \"./resolver.ts\";\n\nexport type Resolve = (\n  query: DnsResolver.Query,\n) => DnsResolver.Resolution | Effect.Effect<DnsResolver.Resolution, DnsResolver.Error>;\n\nexport function make(resolve: Resolve): DnsResolver.Interface {\n  return {\n    resolve: Effect.fn(\"InMemoryDnsResolver.resolve\")((query) =>\n      Effect.suspend(() => {\n        const resolution = resolve(query);\n        return Effect.isEffect(resolution) ? resolution : Effect.succeed(resolution);\n      }),\n    ),\n  };\n}\n\nexport const layer = (resolve: Resolve): Layer.Layer<DnsResolver.Service> =>\n  Layer.succeed(DnsResolver.Service, make(resolve));\n\nexport const toAsync = (resolve: Resolve): DnsResolver.AsyncInterface =>\n  DnsResolver.toAsync(make(resolve));\n","import { Effect, Layer, Schema } from \"effect\";\n\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport * as DnsRecord from \"../domain/dns-record.ts\";\nimport * as Deletion from \"../plan/deletion.ts\";\nimport * as Digest from \"../plan/canonical-json.ts\";\nimport * as Provisioning from \"../plan/plan.ts\";\nimport * as DnsProvider from \"../provider/provider.ts\";\n\nexport class Error extends Schema.TaggedError<Error>()(\"ProviderConformanceError\", {\n  case: Schema.String,\n  message: Schema.String,\n  providerId: Schema.String,\n}) {}\n\nexport interface Input {\n  readonly makeProvider: () => Effect.Effect<DnsProvider.Interface, DnsProvider.Error>;\n  readonly prefix?: string;\n  readonly zone: DomainName.DomainName;\n}\n\nexport interface Report {\n  readonly cases: ReadonlyArray<string>;\n  readonly providerId: string;\n  readonly zone: DomainName.DomainName;\n}\n\n/** Adapt a fresh Promise-shaped provider factory for the Effect-native conformance runner. */\nexport function fromAsync(makeProvider: () => DnsProvider.AsyncInterface): Input[\"makeProvider\"] {\n  return () => Effect.sync(() => DnsProvider.fromAsync(makeProvider()));\n}\n\nconst cases = [\n  \"create-readback-cleanup\",\n  \"exact-noop\",\n  \"conflict\",\n  \"stale-plan\",\n  \"partial-apply-cleanup\",\n] as const;\n\n/** Run the deterministic offline contract every DomainKit DNS adapter must satisfy. */\nexport const run = Effect.fn(\"ProviderConformance.run\")(function* (input: Input) {\n  const makeProvider = () =>\n    Effect.suspend(input.makeProvider).pipe(\n      Effect.catchDefect((cause) =>\n        Effect.fail(\n          new Error({\n            case: \"factory\",\n            message: cause instanceof globalThis.Error ? cause.message : \"Provider factory failed\",\n            providerId: \"unknown\",\n          }),\n        ),\n      ),\n    );\n  const first = yield* makeProvider();\n  const providerId = first.id;\n  const prefix = input.prefix ?? \"domainkit-conformance\";\n  yield* createReadbackCleanup(first, input.zone, prefix);\n  yield* exactNoop(yield* makeProvider(), input.zone, prefix);\n  yield* conflict(yield* makeProvider(), input.zone, prefix);\n  yield* stalePlan(yield* makeProvider(), input.zone, prefix);\n  yield* partialApplyCleanup(yield* makeProvider(), input.zone, prefix);\n  return { cases, providerId, zone: input.zone } satisfies Report;\n});\n\nfunction createReadbackCleanup(\n  provider: DnsProvider.Interface,\n  zone: DomainName.DomainName,\n  prefix: string,\n) {\n  const requirements = createRequirements(zone, prefix);\n  let cleanupRecordIds: ReadonlyArray<string> = [];\n  return Effect.gen(function* () {\n    const { plan } = yield* Provisioning.create({\n      requirements,\n      target: Provisioning.Target.ExactZone({ zone }),\n    });\n    yield* requireTags(provider, \"create-readback-cleanup\", plan.operations, [\"create\", \"create\"]);\n    const receipt = yield* Provisioning.apply({\n      authorization: yield* Provisioning.authorize(plan),\n      plan,\n    }).pipe(\n      Effect.tapError((failure) =>\n        failure instanceof Provisioning.PartialApplyError\n          ? Effect.sync(() => {\n              cleanupRecordIds = providerRecordIds(failure.receipt.operations);\n            })\n          : Effect.void,\n      ),\n    );\n    cleanupRecordIds = providerRecordIds(receipt.operations);\n    yield* requireCondition(\n      provider,\n      \"create-readback-cleanup\",\n      receipt.status === \"complete\" &&\n        receipt.operations.every(({ providerRecordId }) => providerRecordId !== null),\n      \"apply must return a complete receipt with provider record IDs\",\n    );\n    const observed = yield* provider.listRecords(zone);\n    yield* requireCondition(\n      provider,\n      \"create-readback-cleanup\",\n      requirements.every((requirement) =>\n        observed.some(\n          (record) => record._tag !== \"Opaque\" && DnsRecord.equals(record, requirement),\n        ),\n      ),\n      \"listRecords must return every created record, including across provider pages\",\n    );\n    const deletion = yield* Deletion.create({ plan, receipt });\n    const deletionReceipt = yield* Deletion.apply({\n      authorization: yield* Deletion.authorize(deletion),\n      plan: deletion,\n    });\n    yield* requireCondition(\n      provider,\n      \"create-readback-cleanup\",\n      deletionReceipt.status === \"complete\" &&\n        (yield* recordIdsAbsent(provider, zone, cleanupRecordIds)),\n      \"receipt-bound cleanup must remove every created record\",\n    );\n  }).pipe(\n    Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)),\n    Effect.provide(providerLayer(provider)),\n  );\n}\n\nfunction exactNoop(provider: DnsProvider.Interface, zone: DomainName.DomainName, prefix: string) {\n  const requirement = cname(zone, `${prefix}-exact`);\n  let cleanupRecordIds: ReadonlyArray<string> = [];\n  return Effect.gen(function* () {\n    const created = yield* provider.createRecord(zone, requirement);\n    cleanupRecordIds = created.providerRecordId === null ? [] : [created.providerRecordId];\n    const { plan } = yield* Provisioning.create({\n      requirements: [requirement],\n      target: Provisioning.Target.ExactZone({ zone }),\n    });\n    yield* requireTags(provider, \"exact-noop\", plan.operations, [\"noop\"]);\n    const receipt = yield* Provisioning.apply({\n      authorization: yield* Provisioning.authorize(plan),\n      plan,\n    });\n    yield* requireCondition(\n      provider,\n      \"exact-noop\",\n      receipt.operations.length === 0,\n      \"an exact plan must not create another record\",\n    );\n    yield* deleteCreated(provider, zone, created.providerRecordId, \"exact-noop\");\n  }).pipe(\n    Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)),\n    Effect.provide(providerLayer(provider)),\n  );\n}\n\nfunction conflict(provider: DnsProvider.Interface, zone: DomainName.DomainName, prefix: string) {\n  const requirement = cname(zone, `${prefix}-conflict`);\n  const occupied = txt(zone, `${prefix}-conflict`, \"occupied\");\n  let cleanupRecordIds: ReadonlyArray<string> = [];\n  return Effect.gen(function* () {\n    const created = yield* provider.createRecord(zone, occupied);\n    cleanupRecordIds = created.providerRecordId === null ? [] : [created.providerRecordId];\n    const { plan } = yield* Provisioning.create({\n      requirements: [requirement],\n      target: Provisioning.Target.ExactZone({ zone }),\n    });\n    yield* requireTags(provider, \"conflict\", plan.operations, [\"conflict\"]);\n    const failure = yield* Provisioning.apply({\n      authorization: yield* Provisioning.authorize(plan),\n      plan,\n    }).pipe(Effect.flip);\n    yield* requireCondition(\n      provider,\n      \"conflict\",\n      failure instanceof Provisioning.ConflictError,\n      \"apply must fail closed on incompatible state\",\n    );\n    yield* deleteCreated(provider, zone, created.providerRecordId, \"conflict\");\n  }).pipe(\n    Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)),\n    Effect.provide(providerLayer(provider)),\n  );\n}\n\nfunction stalePlan(provider: DnsProvider.Interface, zone: DomainName.DomainName, prefix: string) {\n  const requirement = cname(zone, `${prefix}-stale`);\n  let cleanupRecordIds: ReadonlyArray<string> = [];\n  return Effect.gen(function* () {\n    const { plan } = yield* Provisioning.create({\n      requirements: [requirement],\n      target: Provisioning.Target.ExactZone({ zone }),\n    });\n    const authorization = yield* Provisioning.authorize(plan);\n    const created = yield* provider.createRecord(zone, requirement);\n    cleanupRecordIds = created.providerRecordId === null ? [] : [created.providerRecordId];\n    const failure = yield* Provisioning.apply({ authorization, plan }).pipe(Effect.flip);\n    yield* requireCondition(\n      provider,\n      \"stale-plan\",\n      failure instanceof Provisioning.StaleError,\n      \"apply must reject provider state that changed after authorization\",\n    );\n    yield* deleteCreated(provider, zone, created.providerRecordId, \"stale-plan\");\n  }).pipe(\n    Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)),\n    Effect.provide(providerLayer(provider)),\n  );\n}\n\nfunction partialApplyCleanup(\n  provider: DnsProvider.Interface,\n  zone: DomainName.DomainName,\n  prefix: string,\n) {\n  let creates = 0;\n  const flaky = DnsProvider.Service.of({\n    ...provider,\n    createRecord: Effect.fn(\"ProviderConformance.createRecord\")((target, record) => {\n      creates += 1;\n      return creates === 1\n        ? provider.createRecord(target, record)\n        : Effect.fail(\n            new DnsProvider.Error({\n              message: \"injected conformance failure\",\n              operation: \"createRecord\",\n              providerId: provider.id,\n            }),\n          );\n    }),\n  });\n  const requirements = [\n    cname(zone, `${prefix}-partial-one`),\n    txt(zone, `${prefix}-partial-two`, \"domainkit\"),\n  ];\n  let cleanupRecordIds: ReadonlyArray<string> = [];\n  return Effect.gen(function* () {\n    const { plan } = yield* Provisioning.create({\n      requirements,\n      target: Provisioning.Target.ExactZone({ zone }),\n    });\n    const failure = yield* Provisioning.apply({\n      authorization: yield* Provisioning.authorize(plan),\n      plan,\n    }).pipe(Effect.flip);\n    cleanupRecordIds =\n      failure instanceof Provisioning.PartialApplyError\n        ? providerRecordIds(failure.receipt.operations)\n        : [];\n    yield* requireCondition(\n      provider,\n      \"partial-apply-cleanup\",\n      failure instanceof Provisioning.PartialApplyError && failure.receipt.operations.length === 1,\n      \"a later write failure must preserve the first confirmed write in a partial receipt\",\n    );\n    if (!(failure instanceof Provisioning.PartialApplyError)) return;\n    const deletion = yield* Deletion.create({ plan, receipt: failure.receipt }).pipe(\n      Effect.provide(providerLayer(provider)),\n    );\n    yield* Deletion.apply({\n      authorization: yield* Deletion.authorize(deletion),\n      plan: deletion,\n    }).pipe(Effect.provide(providerLayer(provider)));\n    yield* requireCondition(\n      provider,\n      \"partial-apply-cleanup\",\n      yield* recordIdsAbsent(provider, zone, cleanupRecordIds),\n      \"partial receipt cleanup must remove the confirmed write\",\n    );\n  }).pipe(\n    Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)),\n    Effect.provide(providerLayer(flaky)),\n  );\n}\n\nfunction providerRecordIds(\n  operations: ReadonlyArray<{ readonly providerRecordId: string | null }>,\n): ReadonlyArray<string> {\n  return operations.flatMap(({ providerRecordId }) =>\n    providerRecordId === null ? [] : [providerRecordId],\n  );\n}\n\nfunction recordIdsAbsent(\n  provider: DnsProvider.Interface,\n  zone: DomainName.DomainName,\n  recordIds: ReadonlyArray<string>,\n) {\n  return Effect.forEach(recordIds, (providerRecordId) =>\n    provider.getRecord(zone, providerRecordId),\n  ).pipe(Effect.map((records) => records.every((record) => record === null)));\n}\n\nfunction bestEffortDelete(\n  provider: DnsProvider.Interface,\n  zone: DomainName.DomainName,\n  recordIds: () => ReadonlyArray<string>,\n) {\n  return Effect.suspend(() =>\n    Effect.forEach(\n      recordIds(),\n      (providerRecordId) => provider.deleteRecord(zone, providerRecordId).pipe(Effect.ignore),\n      { discard: true },\n    ),\n  );\n}\n\nfunction providerLayer(provider: DnsProvider.Interface) {\n  return Layer.merge(Layer.succeed(DnsProvider.Service, provider), Digest.webCryptoLayer);\n}\n\nfunction createRequirements(zone: DomainName.DomainName, prefix: string) {\n  return [cname(zone, `${prefix}-create`), txt(zone, `${prefix}-page`, \"domainkit\")];\n}\n\nfunction cname(zone: DomainName.DomainName, label: string) {\n  return DnsRecord.parse({\n    _tag: \"CNAME\",\n    metadata: { ownership: \"tester\", provenance: \"domainkit\", purpose: \"conformance\" },\n    name: `${label}.${zone}`,\n    policy: \"exclusive\",\n    target: \"target.example.net\",\n    ttl: 300,\n  });\n}\n\nfunction txt(zone: DomainName.DomainName, label: string, value: string) {\n  return DnsRecord.parse({\n    _tag: \"TXT\",\n    metadata: { ownership: \"tester\", provenance: \"domainkit\", purpose: \"conformance\" },\n    name: `${label}.${zone}`,\n    policy: \"append\",\n    ttl: 300,\n    value,\n  });\n}\n\nfunction requireTags(\n  provider: DnsProvider.Interface,\n  testCase: string,\n  operations: ReadonlyArray<{ readonly _tag: string }>,\n  expected: ReadonlyArray<string>,\n) {\n  return requireCondition(\n    provider,\n    testCase,\n    JSON.stringify(operations.map(({ _tag }) => _tag)) === JSON.stringify(expected),\n    `expected operations ${expected.join(\", \")}`,\n  );\n}\n\nfunction requireCondition(\n  provider: DnsProvider.Interface,\n  testCase: string,\n  condition: boolean,\n  message: string,\n) {\n  return condition\n    ? Effect.void\n    : Effect.fail(new Error({ case: testCase, message, providerId: provider.id }));\n}\n\nfunction deleteCreated(\n  provider: DnsProvider.Interface,\n  zone: DomainName.DomainName,\n  providerRecordId: string | null,\n  testCase: string,\n) {\n  return providerRecordId === null\n    ? Effect.fail(\n        new Error({\n          case: testCase,\n          message: \"provider must return record IDs for safe cleanup\",\n          providerId: provider.id,\n        }),\n      )\n    : provider.deleteRecord(zone, providerRecordId);\n}\n"],"mappings":";;;;;;;;;AAaA,SAAS,QAAQ,WAAmB,SAAkC;CACpE,OAAO,IAAIA,QAAgB;EACzB,UAAU;EACV;EACA;EACA,OAAO;CACT,CAAC;AACH;AAEA,SAASC,WAAS,WAAmB,SAAkC;CACrE,OAAO,IAAID,QAAgB;EACzB,UAAU;EACV;EACA;EACA,OAAO;CACT,CAAC;AACH;AAEA,SAAS,gBACP,WACA,cACA,SACyC;CACzC,OAAO,UAAU,YAAY,MAC1B,eAAe,WAAW,OAAO,gBAAgB,WAAW,YAAY,OAC3E;AACF;AAEA,SAAS,iBACP,YACA,eACA,YAC+B;CAC/B,OAAOE,QAAmB,YAAY,eAAe,UAAU;AACjE;AAEA,SAAgBC,OAAK,UAAmB,CAAC,GAAwB;CAC/D,MAAM,QAAQ,OAAO,QAAQ,IAAI,qBAA+C,IAAI,IAAI,CAAC,CAAC;CAC1F,MAAM,YAAY,UAAU,WAAW,CAAC;CACxC,MAAM,aAAsB,WAAmC,UAAU,WAAW,MAAM;CAE1F,MAAM,SAAS,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAC/D,WACA,WACA;EACA,IAAI,QAAQ,iBAAiB,KAAA,GAAW,OAAO,QAAQ,aAAa,WAAW,SAAS;EACxF,OAAO,IAAI,OAAO,QAAQ,YAAY;GACpC,MAAM,OAAO,IAAI,IAAI,OAAO;GAC5B,KAAK,IAAI,UAAU,cAAc,IAAI,SAAS;GAC9C,OAAO;EACT,CAAC;CACH,CAAC;CAED,MAAM,SAAS,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAC/D,WACA,iBACA;EACA,IAAI,QAAQ,iBAAiB,KAAA,GAAW,OAAO,QAAQ,aAAa,WAAW,IAAI;EACnF,OAAO,IAAI,OAAO,QAAQ,YAAY;GACpC,MAAM,OAAO,IAAI,IAAI,OAAO;GAC5B,KAAK,OAAO,eAAe;GAC3B,OAAO;EACT,CAAC;CACH,CAAC;CAED,MAAM,MAAM,OAAO,GAAG,2BAA2B,CAAC,EAAE,oBAClD,IAAI,IAAI,KAAK,CAAC,CAAC,KAAK,OAAO,KAAK,YAAY,QAAQ,IAAI,eAAe,KAAK,IAAI,CAAC,CACnF;CAEA,MAAM,oBAAoB,OAAO,GAAG,yCAAyC,CAAC,EAC3E,iBACC,IAAI,IAAI,KAAK,CAAC,CAAC,KACb,OAAO,KACJ,YACC,CAAC,GAAG,QAAQ,OAAO,CAAC,CAAC,CAAC,MAAM,cAC1B,UAAU,YAAY,MAAM,eAAe,WAAW,OAAO,YAAY,CAC3E,KAAK,IACT,CACF,CACJ;CAEA,MAAM,mBAAmB,OAAO,GAAG,gDAAgD,CAAC,CAAC,WAGnF,WACA,YACA,QACA;EACA,MAAM,UAA+B;GACnC,GAAG;GACH,eAAe;IACb,GAAG,UAAU;IACb,YACE,UAAU,cAAc,WAAW,SAAS,YACxC,UAAU,cAAc,aACxB;KAAE,MAAM;KAAW,6BAAa,IAAI,KAAK;IAAE;GACnD;EACF;EACA,OAAO,OAAO,qBAAqB,OAAO;EAC1C,OAAO,OAAO,QAAQ,aAAa;EACnC,OAAO,OAAO,sBAAsB,QAAQ,cAAc,EAAE;EAC5D,OAAO;GACL,YAAY,iBAAiB,YAAY,QAAQ,eAAe,QAAQ,UAAU;GAClF,sBAAsB;GACtB,sBAAsB;EACxB;CACF,CAAC;CAED,OAAA,QAAyB,GAAG;EAC1B,SAAS,EAAE,YAAY,cAAc,cACnC,UACE,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,kBAAkB,YAAY;GACvD,IAAI,cAAc,MAChB,OAAO,OAAO,QAAQ,UAAU,oCAAoC;GAEtE,MAAM,aAAa,gBAAgB,WAAW,cAAc,OAAO;GACnE,IAAI,eAAe,KAAA,GACjB,OAAO,OAAO,QAAQ,UAAU,mDAAmD;GAErF,IAAI,WAAW,iBAAiB,cAC9B,OAAO,OAAOF,WAAS,UAAU,8CAA8C;GAEjF,MAAM,WAAW,UAAU,YAAY,MAAM,EAAE,SAAS,OAAO,WAAW,EAAE;GAC5E,IAAI,aAAa,KAAA,GAAW;IAC1B,IACE,SAAS,iBAAiB,WAAW,gBACrC,SAAS,WAAW,WAAW,UAC/B,SAAS,OAAO,cAAc,WAAW,OAAO,aAChD,SAAS,OAAO,gBAAgB,WAAW,OAAO,eAClD,SAAS,OAAO,WAAW,WAAW,OAAO,UAC7C,SAAS,OAAO,aAAa,WAAW,OAAO,UAE/C,OAAO,OAAOA,WAAS,UAAU,wCAAwC;IAE3E,OAAO;KACL,YAAY;KACZ,YAAY,iBACV,YACA,UAAU,eACV,UAAU,UACZ;IACF;GACF;GAIA,IAHoB,CAAC,IAAI,OAAO,IAAI,IAAI,KAAK,EAAA,CAAG,OAAO,CAAC,CAAC,CAAC,MAAM,cAC9D,UAAU,YAAY,MAAM,EAAE,SAAS,OAAO,WAAW,EAAE,CAE/C,GACZ,OAAO,OAAOA,WAAS,UAAU,wCAAwC;GAa3E,IAXkB,CAAC,IAAI,OAAO,IAAI,IAAI,KAAK,EAAA,CAAG,OAAO,CAAC,CAAC,CAAC,MAAM,cAAc;IAC1E,OAAO,UAAU,YAAY,MAC1B,EAAE,cAAc,wBAAwB,aACvC,WAAW,WAAW,UACtB,UAAU,YAAY,MACnB,wBACC,oBAAoB,OAAO,0BAC3B,oBAAoB,YAAY,OACpC,CACJ;GACF,CACY,GACV,OAAO,OAAOA,WACZ,UACA,0DACF;GAEF,MAAM,OAA4B;IAChC,GAAG;IACH,aAAa,CAAC,GAAG,UAAU,aAAa,UAAU;GACpD;GACA,OAAO,OAAO,UAAU,IAAI;GAC5B,OAAO;IACL;IACA,YAAY,iBAAiB,YAAY,UAAU,eAAe,UAAU,UAAU;GACxF;EACF,CAAC,CACH;EACF,UAAU,UACR,UACE,OAAO,IAAI,aAAa;GAEtB,MAAM,WAAU,OADO,IAAI,IAAI,KAAK,EAAA,CACZ,IAAI,MAAM,cAAc,EAAE;GAClD,IACE,SAAS,cAAc,WAAW,SAAS,aAC1C,MAAM,4BAA4B,KAAA,KAAa,YAAY,KAAA,GAE5D,OAAO,OAAOA,WACZ,WACA,YAAY,KAAA,IACR,4CACA,wDACN;GAEF,IACE,MAAM,4BAA4B,KAAA,KAClC,SAAS,cAAc,OAAO,MAAM,yBAEpC,OAAO,OAAOA,WAAS,WAAW,iDAAiD;GAErF,IACE,MAAM,cAAc,OAAO,MAAM,WAAW,mBAC5C,MAAM,cAAc,eAAe,MAAM,WAAW,cACpD,MAAM,cAAc,WAAW,MAAM,WAAW,QAEhD,OAAO,OAAOA,WAAS,WAAW,6CAA6C;GAEjF,MAAM,qBAAqB,SAAS,YAAY,MAC7C,eAAe,WAAW,YAAY,MAAM,WAAW,OAC1D;GACA,IACE,MAAM,yBAAyB,KAAA,KAC/B,oBAAoB,OAAO,MAAM,sBAEjC,OAAO,OAAOA,WAAS,WAAW,kDAAkD;GAEtF,MAAM,aAAa,sBAAsB,MAAM;GAC/C,MAAM,OAA4B;IAChC,eAAe,MAAM;IACrB,aAAa,UACT,CAAC,GAAG,QAAQ,YAAY,QAAQ,EAAE,SAAS,OAAO,WAAW,EAAE,GAAG,UAAU,IAC5E,CAAC,UAAU;IACf,aAAa,SAAS,eAAe,CAAC;IACtC,YAAY,MAAM;GACpB;GACA,OAAO,OAAO,WAAW,IAAI;GAC7B,OAAO;EACT,CAAC,CACH;EACF,SAAS,EAAE,cAAc,cACvB,UACE,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO,IAAI,IAAI,KAAK;GACpC,KAAK,MAAM,aAAa,QAAQ,OAAO,GAAG;IACxC,MAAM,aAAa,UAAU,YAAY,MAAM,EAAE,SAAS,OAAO,YAAY;IAC7E,IAAI,eAAe,KAAA,GAAW;IAC9B,MAAM,aAAa,gBAAgB,WAAW,WAAW,cAAc,OAAO;IAC9E,IAAI,eAAe,KAAA,GACjB,OAAO,OAAO,QAAQ,UAAU,iDAAiD;IAEnF,MAAM,OAA4B;KAChC,GAAG;KACH,aAAa,UAAU,YAAY,QAAQ,EAAE,SAAS,OAAO,YAAY;IAC3E;IACA,OAAO,OAAO,UAAU,IAAI;IAC5B,OAAO;KACL;KACA,YAAY,iBACV,YACA,UAAU,eACV,UAAU,UACZ;KACA,sBAAsB,KAAK,YAAY,QACpC,EAAE,mBAAmB,iBAAiB,WAAW,EACpD,CAAC,CAAC;IACJ;GACF;GACA,OAAO,OAAO,QAAQ,UAAU,kCAAkC;EACpE,CAAC,CACH;EACF,aAAa,EAAE,cAAc,SAAS,aACpC,UACE,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,kBAAkB,YAAY;GACvD,IAAI,cAAc,MAChB,OAAO,OAAO,QAAQ,cAAc,oCAAoC;GAE1E,MAAM,aAAa,gBAAgB,WAAW,cAAc,OAAO;GACnE,IAAI,eAAe,KAAA,GACjB,OAAO,OAAO,QACZ,cACA,mDACF;GAEF,IAAI,UAAU,YAAY,MAAM,EAAE,cAAc,SAAS,OAAO,YAAY,GAC1E,OAAO,OAAOA,WACZ,cACA,mEACF;GAEF,MAAM,uBAAuB,UAAU,YAAY,QAChD,EAAE,SAAS,OAAO,YACrB;GACA,IAAI,qBAAqB,SAAS,GAAG;IACnC,MAAM,OAA4B;KAAE,GAAG;KAAW,aAAa;IAAqB;IACpF,OAAO,OAAO,wBAAwB,IAAI;IAC1C,OAAO;KACL,YAAY,iBACV,YACA,UAAU,eACV,UAAU,UACZ;KACA,sBAAsB,qBAAqB;KAC3C,sBAAsB;IACxB;GACF;GACA,OAAO,OAAO,iBAAiB,WAAW,YAAY,MAAM;EAC9D,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,kCAAkC,CAAC,CAC7D;EACF,iBAAiB,SAAS,oBACxB,IAAI,IAAI,KAAK,CAAC,CAAC,KACb,OAAO,KACJ,YACC,QAAQ,IAAI,eAAe,CAAC,EAAE,YAAY,MAAM,EAAE,SAAS,SAAS,OAAO,OAAO,KAClF,IACJ,CACF;EACF;EACA,gBAAgB,iBACd,IAAI,IAAI,KAAK,CAAC,CAAC,KACb,OAAO,KACJ,YACC,CAAC,GAAG,QAAQ,OAAO,CAAC,CAAC,CAClB,SAAS,EAAE,kBAAkB,WAAW,CAAC,CACzC,MAAM,EAAE,SAAS,OAAO,YAAY,KAAK,IAChD,CACF;EACF;EACA,kBAAkB,cAAc,YAC9B,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,kBAAkB,YAAY;GACvD,IAAI,cAAc,MAChB,OAAO,OAAO,QAAQ,mBAAmB,oCAAoC;GAE/E,IAAI,gBAAgB,WAAW,cAAc,OAAO,MAAM,KAAA,GACxD,OAAO,OAAO,QACZ,mBACA,mDACF;GAEF,OAAO,UAAU,YAAY,QAAQ,EAAE,cAAc,SAAS,OAAO,YAAY;EACnF,CAAC;EACH,kBAAkB,iBAAiB,aACjC,UACE,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,IAAI,eAAe;GAC5C,IAAI,cAAc,MAChB,OAAO,OAAO,QAAQ,mBAAmB,uCAAuC;GAElF,MAAM,eAAe,IAAI,IACvB,UAAU,cAAc,mBAAmB,KAAK,SAAS,CAAC,KAAK,YAAY,IAAI,CAAC,CAClF;GACA,KAAK,MAAM,QAAQ,UAAU,aAAa,IAAI,KAAK,YAAY,IAAI;GACnE,MAAM,OAAO;IACX,GAAG;IACH,eAAe;KACb,GAAG,UAAU;KACb,oBAAoB,CAAC,GAAG,aAAa,OAAO,CAAC;IAC/C;GACF;GACA,OAAO,OAAO,mBAAmB,IAAI;GACrC,OAAO;EACT,CAAC,CACH;EACF,UAAU,EAAE,iBAAiB,aAC3B,UACE,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,IAAI,eAAe;GAC5C,IAAI,cAAc,MAChB,OAAO,OAAO,QAAQ,WAAW,uCAAuC;GAE1E,IAAI,UAAU,cAAc,WAAW,SAAS,WAC9C,OAAO,OAAO,QAAQ,WAAW,mDAAmD;GAEtF,MAAM,aAAa,UAAU,YAAY;GACzC,IAAI,eAAe,KAAA,GACjB,OAAO,OAAO,QAAQ,WAAW,yCAAyC;GAE5E,OAAO,OAAO,iBAAiB,WAAW,YAAY,MAAM;EAC9D,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,+BAA+B,CAAC,CAC1D;EACF,SAAS,iBAAiB,eACxB,UACE,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,IAAI,eAAe;GAC5C,IAAI,cAAc,MAChB,OAAO,OAAO,QAAQ,UAAU,uCAAuC;GAEzE,MAAM,OAAO;IACX,GAAG;IACH;GACF;GACA,OAAO,OAAO,UAAU,IAAI;GAC5B,OAAO;EACT,CAAC,CACH;CACJ,CAAC;AACH;AAEA,MAAaG,WAAS,UAAmB,CAAC,MAAM,MAAM,KAAKC,eAAyBF,OAAK,OAAO,CAAC;;;;AC9YjG,SAAgBG,SAAqC;CACnD,MAAM,QAAQ,OAAO,QAAQ,IAAI,qBAAmD,IAAI,IAAI,CAAC,CAAC;CAC9F,OAAO;EACL,SAAS,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAAW,IAAI,KAAK;GACxE,OAAO,OAAO,IAAI,OAAO,QAAQ,YAAY;IAC3C,MAAM,eAAe,QAAQ,IAAI,EAAE;IACnC,MAAM,OAAO,IAAI,IAAI,OAAO;IAC5B,KAAK,OAAO,EAAE;IACd,OAAO,CACL,iBAAiB,KAAA,KAAa,aAAa,YAAY,MAAM,eAAe,MAC5E,IACF;GACF,CAAC;EACH,CAAC;EACD,KAAK,OAAO,GAAG,6BAA6B,CAAC,EAAE,iBAC7C,IAAI,OAAO,QAAQ,YAAY;GAC7B,MAAM,OAAO,IAAI,IAAI,OAAO;GAC5B,KAAK,IAAI,aAAa,IAAI,YAAY;GACtC,OAAO;EACT,CAAC,CACH;CACF;AACF;;;;;;;;ACfA,SAAgBC,OAAK,UAAmB,CAAC,GAA0B;CACjE,MAAM,KAAK,QAAQ,MAAM;CACzB,MAAM,0BAAU,IAAI,IAAsD;CAC1E,MAAM,4BAAY,IAAI,IAAgC;CACtD,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,QAAQ,WAAW,CAAC,CAAC,GAAG;EACnE,QAAQ,IAAIC,MAAiB,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC;EAChD,KAAK,MAAM,CAAC,OAAO,WAAW,QAAQ,QAAQ,GAAG,UAAU,IAAI,GAAG,GAAG,GAAG,QAAQ,KAAK,MAAM;CAC7F;CACA,OAAO;EACL;EACA,aAAa,OAAO,GAAG,iCAAiC,CAAC,EAAE,SACzD,OAAO,WAAW,CAAC,GAAI,QAAQ,IAAI,IAAI,KAAK,CAAC,CAAE,CAAC,CAClD;EACA,cAAc,OAAO,GAAG,kCAAkC,CAAC,EAAE,MAAM,WACjE,OAAO,WAAW;GAChB,MAAM,UAAU,QAAQ,IAAI,IAAI,KAAK,CAAC;GACtC,QAAQ,KAAK,MAAM;GACnB,QAAQ,IAAI,MAAM,OAAO;GACzB,MAAM,mBAAmB,GAAG,GAAG,GAAG,QAAQ;GAC1C,UAAU,IAAI,kBAAkB,MAAM;GACtC,OAAO,EAAE,iBAAiB;EAC5B,CAAC,CACH;EACA,cAAc,OAAO,GAAG,kCAAkC,CAAC,EAAE,MAAM,qBACjE,OAAO,WAAW;GAChB,MAAM,SAAS,UAAU,IAAI,gBAAgB;GAC7C,IAAI,WAAW,KAAA,GAAW;GAC1B,QAAQ,IACN,OACC,QAAQ,IAAI,IAAI,KAAK,CAAC,EAAA,CAAG,QAAQ,cAAc,cAAc,MAAM,CACtE;GACA,UAAU,OAAO,gBAAgB;EACnC,CAAC,CACH;EACA,WAAW,OAAO,GAAG,+BAA+B,CAAC,EAAE,OAAO,qBAC5D,OAAO,WAAW,UAAU,IAAI,gBAAgB,KAAK,IAAI,CAC3D;CACF;AACF;AAEA,MAAaC,WAAS,UAAmB,CAAC,MACxC,MAAM,QAAQC,WAAqBH,OAAK,OAAO,CAAC;AAElD,MAAaI,aAAW,UAAmB,CAAC,MAC1CC,UAAoBL,OAAK,OAAO,CAAC;;;;;;;;AC/CnC,SAAgB,KAAK,SAAyC;CAC5D,OAAO,EACL,SAAS,OAAO,GAAG,6BAA6B,CAAC,EAAE,UACjD,OAAO,cAAc;EACnB,MAAM,aAAa,QAAQ,KAAK;EAChC,OAAO,OAAO,SAAS,UAAU,IAAI,aAAa,OAAO,QAAQ,UAAU;CAC7E,CAAC,CACH,EACF;AACF;AAEA,MAAa,SAAS,YACpB,MAAM,QAAQM,WAAqB,KAAK,OAAO,CAAC;AAElD,MAAa,WAAW,YACtBC,UAAoB,KAAK,OAAO,CAAC;;;;;;;;ACdnC,IAAa,QAAb,cAA2B,OAAO,YAAmB,CAAC,CAAC,4BAA4B;CACjF,MAAM,OAAO;CACb,SAAS,OAAO;CAChB,YAAY,OAAO;AACrB,CAAC,CAAC,CAAC,CAAC;;AAeJ,SAAgB,UAAU,cAAuE;CAC/F,aAAa,OAAO,WAAWC,YAAsB,aAAa,CAAC,CAAC;AACtE;AAEA,MAAM,QAAQ;CACZ;CACA;CACA;CACA;CACA;AACF;;AAGA,MAAa,MAAM,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,OAAc;CAC/E,MAAM,qBACJ,OAAO,QAAQ,MAAM,YAAY,CAAC,CAAC,KACjC,OAAO,aAAa,UAClB,OAAO,KACL,IAAI,MAAM;EACR,MAAM;EACN,SAAS,iBAAiB,WAAW,QAAQ,MAAM,UAAU;EAC7D,YAAY;CACd,CAAC,CACH,CACF,CACF;CACF,MAAM,QAAQ,OAAO,aAAa;CAClC,MAAM,aAAa,MAAM;CACzB,MAAM,SAAS,MAAM,UAAU;CAC/B,OAAO,sBAAsB,OAAO,MAAM,MAAM,MAAM;CACtD,OAAO,UAAU,OAAO,aAAa,GAAG,MAAM,MAAM,MAAM;CAC1D,OAAO,SAAS,OAAO,aAAa,GAAG,MAAM,MAAM,MAAM;CACzD,OAAO,UAAU,OAAO,aAAa,GAAG,MAAM,MAAM,MAAM;CAC1D,OAAO,oBAAoB,OAAO,aAAa,GAAG,MAAM,MAAM,MAAM;CACpE,OAAO;EAAE;EAAO;EAAY,MAAM,MAAM;CAAK;AAC/C,CAAC;AAED,SAAS,sBACP,UACA,MACA,QACA;CACA,MAAM,eAAe,mBAAmB,MAAM,MAAM;CACpD,IAAI,mBAA0C,CAAC;CAC/C,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,EAAE,SAAS,OAAOC,OAAoB;GAC1C;GACA,QAAA,OAA4B,UAAU,EAAE,KAAK,CAAC;EAChD,CAAC;EACD,OAAO,YAAY,UAAU,2BAA2B,KAAK,YAAY,CAAC,UAAU,QAAQ,CAAC;EAC7F,MAAM,UAAU,OAAOC,MAAmB;GACxC,eAAe,OAAOC,UAAuB,IAAI;GACjD;EACF,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,YACf,mBAAmBC,oBACf,OAAO,WAAW;GAChB,mBAAmB,kBAAkB,QAAQ,QAAQ,UAAU;EACjE,CAAC,IACD,OAAO,IACb,CACF;EACA,mBAAmB,kBAAkB,QAAQ,UAAU;EACvD,OAAO,iBACL,UACA,2BACA,QAAQ,WAAW,cACjB,QAAQ,WAAW,OAAO,EAAE,uBAAuB,qBAAqB,IAAI,GAC9E,+DACF;EACA,MAAM,WAAW,OAAO,SAAS,YAAY,IAAI;EACjD,OAAO,iBACL,UACA,2BACA,aAAa,OAAO,gBAClB,SAAS,MACN,WAAW,OAAO,SAAS,YAAYC,OAAiB,QAAQ,WAAW,CAC9E,CACF,GACA,+EACF;EACA,MAAM,WAAW,OAAOC,SAAgB;GAAE;GAAM;EAAQ,CAAC;EAKzD,OAAO,iBACL,UACA,4BACA,OAP6BC,QAAe;GAC5C,eAAe,OAAOC,YAAmB,QAAQ;GACjD,MAAM;EACR,CAAC,EAAA,CAIiB,WAAW,eACxB,OAAO,gBAAgB,UAAU,MAAM,gBAAgB,IAC1D,wDACF;CACF,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,iBAAiB,UAAU,YAAY,gBAAgB,CAAC,GACxE,OAAO,QAAQ,cAAc,QAAQ,CAAC,CACxC;AACF;AAEA,SAAS,UAAU,UAAiC,MAA6B,QAAgB;CAC/F,MAAM,cAAc,MAAM,MAAM,GAAG,OAAO,OAAO;CACjD,IAAI,mBAA0C,CAAC;CAC/C,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,UAAU,OAAO,SAAS,aAAa,MAAM,WAAW;EAC9D,mBAAmB,QAAQ,qBAAqB,OAAO,CAAC,IAAI,CAAC,QAAQ,gBAAgB;EACrF,MAAM,EAAE,SAAS,OAAOP,OAAoB;GAC1C,cAAc,CAAC,WAAW;GAC1B,QAAA,OAA4B,UAAU,EAAE,KAAK,CAAC;EAChD,CAAC;EACD,OAAO,YAAY,UAAU,cAAc,KAAK,YAAY,CAAC,MAAM,CAAC;EAKpE,OAAO,iBACL,UACA,eACA,OAPqBC,MAAmB;GACxC,eAAe,OAAOC,UAAuB,IAAI;GACjD;EACF,CAAC,EAAA,CAIS,WAAW,WAAW,GAC9B,8CACF;EACA,OAAO,cAAc,UAAU,MAAM,QAAQ,kBAAkB,YAAY;CAC7E,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,iBAAiB,UAAU,YAAY,gBAAgB,CAAC,GACxE,OAAO,QAAQ,cAAc,QAAQ,CAAC,CACxC;AACF;AAEA,SAAS,SAAS,UAAiC,MAA6B,QAAgB;CAC9F,MAAM,cAAc,MAAM,MAAM,GAAG,OAAO,UAAU;CACpD,MAAM,WAAW,IAAI,MAAM,GAAG,OAAO,YAAY,UAAU;CAC3D,IAAI,mBAA0C,CAAC;CAC/C,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,UAAU,OAAO,SAAS,aAAa,MAAM,QAAQ;EAC3D,mBAAmB,QAAQ,qBAAqB,OAAO,CAAC,IAAI,CAAC,QAAQ,gBAAgB;EACrF,MAAM,EAAE,SAAS,OAAOF,OAAoB;GAC1C,cAAc,CAAC,WAAW;GAC1B,QAAA,OAA4B,UAAU,EAAE,KAAK,CAAC;EAChD,CAAC;EACD,OAAO,YAAY,UAAU,YAAY,KAAK,YAAY,CAAC,UAAU,CAAC;EAKtE,OAAO,iBACL,UACA,aACA,OAPqBC,MAAmB;GACxC,eAAe,OAAOC,UAAuB,IAAI;GACjD;EACF,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,cAIEM,eACnB,8CACF;EACA,OAAO,cAAc,UAAU,MAAM,QAAQ,kBAAkB,UAAU;CAC3E,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,iBAAiB,UAAU,YAAY,gBAAgB,CAAC,GACxE,OAAO,QAAQ,cAAc,QAAQ,CAAC,CACxC;AACF;AAEA,SAAS,UAAU,UAAiC,MAA6B,QAAgB;CAC/F,MAAM,cAAc,MAAM,MAAM,GAAG,OAAO,OAAO;CACjD,IAAI,mBAA0C,CAAC;CAC/C,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,EAAE,SAAS,OAAOR,OAAoB;GAC1C,cAAc,CAAC,WAAW;GAC1B,QAAA,OAA4B,UAAU,EAAE,KAAK,CAAC;EAChD,CAAC;EACD,MAAM,gBAAgB,OAAOE,UAAuB,IAAI;EACxD,MAAM,UAAU,OAAO,SAAS,aAAa,MAAM,WAAW;EAC9D,mBAAmB,QAAQ,qBAAqB,OAAO,CAAC,IAAI,CAAC,QAAQ,gBAAgB;EAErF,OAAO,iBACL,UACA,eACA,OAJqBD,MAAmB;GAAE;GAAe;EAAK,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,cAI9DQ,YACnB,mEACF;EACA,OAAO,cAAc,UAAU,MAAM,QAAQ,kBAAkB,YAAY;CAC7E,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,iBAAiB,UAAU,YAAY,gBAAgB,CAAC,GACxE,OAAO,QAAQ,cAAc,QAAQ,CAAC,CACxC;AACF;AAEA,SAAS,oBACP,UACA,MACA,QACA;CACA,IAAI,UAAU;CACd,MAAM,QAAA,UAA4B,GAAG;EACnC,GAAG;EACH,cAAc,OAAO,GAAG,kCAAkC,CAAC,EAAE,QAAQ,WAAW;GAC9E,WAAW;GACX,OAAO,YAAY,IACf,SAAS,aAAa,QAAQ,MAAM,IACpC,OAAO,KACL,IAAIC,QAAkB;IACpB,SAAS;IACT,WAAW;IACX,YAAY,SAAS;GACvB,CAAC,CACH;EACN,CAAC;CACH,CAAC;CACD,MAAM,eAAe,CACnB,MAAM,MAAM,GAAG,OAAO,aAAa,GACnC,IAAI,MAAM,GAAG,OAAO,eAAe,WAAW,CAChD;CACA,IAAI,mBAA0C,CAAC;CAC/C,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,EAAE,SAAS,OAAOV,OAAoB;GAC1C;GACA,QAAA,OAA4B,UAAU,EAAE,KAAK,CAAC;EAChD,CAAC;EACD,MAAM,UAAU,OAAOC,MAAmB;GACxC,eAAe,OAAOC,UAAuB,IAAI;GACjD;EACF,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI;EACnB,mBACE,mBAAmBC,oBACf,kBAAkB,QAAQ,QAAQ,UAAU,IAC5C,CAAC;EACP,OAAO,iBACL,UACA,yBACA,mBAAmBA,qBAAkC,QAAQ,QAAQ,WAAW,WAAW,GAC3F,oFACF;EACA,IAAI,EAAE,mBAAmBA,oBAAiC;EAC1D,MAAM,WAAW,OAAOE,SAAgB;GAAE;GAAM,SAAS,QAAQ;EAAQ,CAAC,CAAC,CAAC,KAC1E,OAAO,QAAQ,cAAc,QAAQ,CAAC,CACxC;EACA,OAAOC,QAAe;GACpB,eAAe,OAAOC,YAAmB,QAAQ;GACjD,MAAM;EACR,CAAC,CAAC,CAAC,KAAK,OAAO,QAAQ,cAAc,QAAQ,CAAC,CAAC;EAC/C,OAAO,iBACL,UACA,yBACA,OAAO,gBAAgB,UAAU,MAAM,gBAAgB,GACvD,yDACF;CACF,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,iBAAiB,UAAU,YAAY,gBAAgB,CAAC,GACxE,OAAO,QAAQ,cAAc,KAAK,CAAC,CACrC;AACF;AAEA,SAAS,kBACP,YACuB;CACvB,OAAO,WAAW,SAAS,EAAE,uBAC3B,qBAAqB,OAAO,CAAC,IAAI,CAAC,gBAAgB,CACpD;AACF;AAEA,SAAS,gBACP,UACA,MACA,WACA;CACA,OAAO,OAAO,QAAQ,YAAY,qBAChC,SAAS,UAAU,MAAM,gBAAgB,CAC3C,CAAC,CAAC,KAAK,OAAO,KAAK,YAAY,QAAQ,OAAO,WAAW,WAAW,IAAI,CAAC,CAAC;AAC5E;AAEA,SAAS,iBACP,UACA,MACA,WACA;CACA,OAAO,OAAO,cACZ,OAAO,QACL,UAAU,IACT,qBAAqB,SAAS,aAAa,MAAM,gBAAgB,CAAC,CAAC,KAAK,OAAO,MAAM,GACtF,EAAE,SAAS,KAAK,CAClB,CACF;AACF;AAEA,SAAS,cAAc,UAAiC;CACtD,OAAO,MAAM,MAAM,MAAM,QAAQI,WAAqB,QAAQ,GAAGC,cAAqB;AACxF;AAEA,SAAS,mBAAmB,MAA6B,QAAgB;CACvE,OAAO,CAAC,MAAM,MAAM,GAAG,OAAO,QAAQ,GAAG,IAAI,MAAM,GAAG,OAAO,QAAQ,WAAW,CAAC;AACnF;AAEA,SAAS,MAAM,MAA6B,OAAe;CACzD,OAAOC,QAAgB;EACrB,MAAM;EACN,UAAU;GAAE,WAAW;GAAU,YAAY;GAAa,SAAS;EAAc;EACjF,MAAM,GAAG,MAAM,GAAG;EAClB,QAAQ;EACR,QAAQ;EACR,KAAK;CACP,CAAC;AACH;AAEA,SAAS,IAAI,MAA6B,OAAe,OAAe;CACtE,OAAOA,QAAgB;EACrB,MAAM;EACN,UAAU;GAAE,WAAW;GAAU,YAAY;GAAa,SAAS;EAAc;EACjF,MAAM,GAAG,MAAM,GAAG;EAClB,QAAQ;EACR,KAAK;EACL;CACF,CAAC;AACH;AAEA,SAAS,YACP,UACA,UACA,YACA,UACA;CACA,OAAO,iBACL,UACA,UACA,KAAK,UAAU,WAAW,KAAK,EAAE,WAAW,IAAI,CAAC,MAAM,KAAK,UAAU,QAAQ,GAC9E,uBAAuB,SAAS,KAAK,IAAI,GAC3C;AACF;AAEA,SAAS,iBACP,UACA,UACA,WACA,SACA;CACA,OAAO,YACH,OAAO,OACP,OAAO,KAAK,IAAI,MAAM;EAAE,MAAM;EAAU;EAAS,YAAY,SAAS;CAAG,CAAC,CAAC;AACjF;AAEA,SAAS,cACP,UACA,MACA,kBACA,UACA;CACA,OAAO,qBAAqB,OACxB,OAAO,KACL,IAAI,MAAM;EACR,MAAM;EACN,SAAS;EACT,YAAY,SAAS;CACvB,CAAC,CACH,IACA,SAAS,aAAa,MAAM,gBAAgB;AAClD"}
+{"version":3,"file":"testing.mjs","names":["Lifecycle.Error","conflict","Connection.project","make","layer","Lifecycle.Service","make","make","DomainName.parse","layer","DnsProvider.Service","toAsync","DnsProvider.toAsync","DnsResolver.Service","DnsResolver.toAsync","DnsProvider.fromAsync","Provisioning.create","Provisioning.apply","Provisioning.authorize","Provisioning.PartialApplyError","DnsRecord.equals","Deletion.create","Deletion.apply","Deletion.authorize","Provisioning.ConflictError","Provisioning.StaleError","DnsProvider.Error","DnsProvider.Service","Digest.webCryptoLayer","DnsRecord.parse"],"sources":["../src/stores/in-memory-lifecycle-repository.ts","../src/stores/in-memory-continuation.ts","../src/provider/in-memory.ts","../src/verification/in-memory.ts","../src/testing/provider-conformance.ts"],"sourcesContent":["import { DateTime, Effect, Layer, Ref, Semaphore } from \"effect\";\n\nimport * as ProviderAuthorization from \"../auth/authorization.ts\";\nimport * as Connection from \"../auth/connection.ts\";\nimport * as Lifecycle from \"../auth/lifecycle-repository.ts\";\n\nexport interface Options {\n  readonly beforeCommit?: (\n    operation: string,\n    aggregate: Lifecycle.Aggregate | null,\n  ) => Effect.Effect<void, Lifecycle.Error>;\n}\n\nfunction missing(operation: string, message: string): Lifecycle.Error {\n  return new Lifecycle.Error({\n    category: \"storage\",\n    message,\n    operation,\n    retry: \"never\",\n  });\n}\n\nfunction conflict(operation: string, message: string): Lifecycle.Error {\n  return new Lifecycle.Error({\n    category: \"storage\",\n    message,\n    operation,\n    retry: \"after-user-action\",\n  });\n}\n\nfunction ownerConnection(\n  aggregate: Lifecycle.Aggregate,\n  connectionId: string,\n  ownerId: string,\n): Connection.StoredConnection | undefined {\n  return aggregate.connections.find(\n    (connection) => connection.id === connectionId && connection.ownerId === ownerId,\n  );\n}\n\nfunction publicConnection(\n  connection: Connection.StoredConnection,\n  authorization: ProviderAuthorization.ProviderAuthorization,\n  credential: Connection.StoredCredential,\n): Connection.ProviderConnection {\n  return Connection.project(connection, authorization, credential);\n}\n\nexport function make(options: Options = {}): Lifecycle.Interface {\n  const state = Effect.runSync(Ref.make<ReadonlyMap<string, Lifecycle.Aggregate>>(new Map()));\n  const mutations = Semaphore.makeUnsafe(1);\n  const serialize = <A, E, R>(effect: Effect.Effect<A, E, R>) => mutations.withPermit(effect);\n\n  const commit = Effect.fn(\"InMemoryManagedDnsConnections.commit\")(function* (\n    operation: string,\n    aggregate: Lifecycle.Aggregate,\n  ) {\n    if (options.beforeCommit !== undefined) yield* options.beforeCommit(operation, aggregate);\n    yield* Ref.update(state, (entries) => {\n      const next = new Map(entries);\n      next.set(aggregate.authorization.id, aggregate);\n      return next;\n    });\n  });\n\n  const remove = Effect.fn(\"InMemoryManagedDnsConnections.remove\")(function* (\n    operation: string,\n    authorizationId: string,\n  ) {\n    if (options.beforeCommit !== undefined) yield* options.beforeCommit(operation, null);\n    yield* Ref.update(state, (entries) => {\n      const next = new Map(entries);\n      next.delete(authorizationId);\n      return next;\n    });\n  });\n\n  const get = Effect.fn(\"ManagedDnsConnections.get\")((authorizationId: string) =>\n    Ref.get(state).pipe(Effect.map((entries) => entries.get(authorizationId) ?? null)),\n  );\n\n  const getByConnectionId = Effect.fn(\"ManagedDnsConnections.getByConnectionId\")(\n    (connectionId: string) =>\n      Ref.get(state).pipe(\n        Effect.map(\n          (entries) =>\n            [...entries.values()].find((aggregate) =>\n              aggregate.connections.some((connection) => connection.id === connectionId),\n            ) ?? null,\n        ),\n      ),\n  );\n\n  const finishRevocation = Effect.fn(\"InMemoryManagedDnsConnections.finishRevocation\")(function* <\n    E,\n  >(\n    aggregate: Lifecycle.Aggregate,\n    connection: Connection.StoredConnection,\n    revoke: (authorization: ProviderAuthorization.ProviderAuthorization) => Effect.Effect<void, E>,\n  ) {\n    const requestedAt = yield* DateTime.nowAsDate;\n    const pending: Lifecycle.Aggregate = {\n      ...aggregate,\n      authorization: {\n        ...aggregate.authorization,\n        revocation:\n          aggregate.authorization.revocation._tag === \"Pending\"\n            ? aggregate.authorization.revocation\n            : ProviderAuthorization.Revocation.Pending({ requestedAt }),\n      },\n    };\n    yield* commit(\"prepareRevocation\", pending);\n    yield* revoke(pending.authorization);\n    yield* remove(\"completeRevocation\", pending.authorization.id);\n    return {\n      connection: publicConnection(connection, pending.authorization, pending.credential),\n      remainingConnections: 0,\n      revokedAuthorization: true,\n    } satisfies Lifecycle.DisconnectResult;\n  });\n\n  return Lifecycle.Service.of({\n    attach: ({ attachment, connectionId, ownerId }) =>\n      serialize(\n        Effect.gen(function* () {\n          const aggregate = yield* getByConnectionId(connectionId);\n          if (aggregate === null) {\n            return yield* missing(\"attach\", \"Provider connection does not exist\");\n          }\n          const connection = ownerConnection(aggregate, connectionId, ownerId);\n          if (connection === undefined) {\n            return yield* missing(\"attach\", \"Provider connection does not belong to this owner\");\n          }\n          if (attachment.connectionId !== connectionId) {\n            return yield* conflict(\"attach\", \"Domain attachment targets another connection\");\n          }\n          const existing = aggregate.attachments.find(({ id }) => id === attachment.id);\n          if (existing !== undefined) {\n            if (\n              existing.connectionId !== attachment.connectionId ||\n              existing.domain !== attachment.domain ||\n              existing.target.accountId !== attachment.target.accountId ||\n              existing.target.accountKind !== attachment.target.accountKind ||\n              existing.target.zoneId !== attachment.target.zoneId ||\n              existing.target.zoneName !== attachment.target.zoneName\n            ) {\n              return yield* conflict(\"attach\", \"Domain attachment id is already in use\");\n            }\n            return {\n              attachment: existing,\n              connection: publicConnection(\n                connection,\n                aggregate.authorization,\n                aggregate.credential,\n              ),\n            };\n          }\n          const duplicateId = [...(yield* Ref.get(state)).values()].some((candidate) =>\n            candidate.attachments.some(({ id }) => id === attachment.id),\n          );\n          if (duplicateId) {\n            return yield* conflict(\"attach\", \"Domain attachment id is already in use\");\n          }\n          const duplicate = [...(yield* Ref.get(state)).values()].some((candidate) => {\n            return candidate.attachments.some(\n              ({ connectionId: attachmentConnectionId, domain }) =>\n                domain === attachment.domain &&\n                candidate.connections.some(\n                  (candidateConnection) =>\n                    candidateConnection.id === attachmentConnectionId &&\n                    candidateConnection.ownerId === ownerId,\n                ),\n            );\n          });\n          if (duplicate) {\n            return yield* conflict(\n              \"attach\",\n              \"An organization domain already has a provider attachment\",\n            );\n          }\n          const next: Lifecycle.Aggregate = {\n            ...aggregate,\n            attachments: [...aggregate.attachments, attachment],\n          };\n          yield* commit(\"attach\", next);\n          return {\n            attachment,\n            connection: publicConnection(connection, aggregate.authorization, aggregate.credential),\n          };\n        }),\n      ),\n    connect: (input) =>\n      serialize(\n        Effect.gen(function* () {\n          const entries = yield* Ref.get(state);\n          const current = entries.get(input.authorization.id);\n          if (\n            current?.authorization.revocation._tag === \"Pending\" ||\n            (input.expectedAuthorizationId !== undefined && current === undefined)\n          ) {\n            return yield* conflict(\n              \"connect\",\n              current === undefined\n                ? \"Provider authorization no longer exists\"\n                : \"Provider authorization is awaiting revocation recovery\",\n            );\n          }\n          if (\n            input.expectedAuthorizationId !== undefined &&\n            current?.authorization.id !== input.expectedAuthorizationId\n          ) {\n            return yield* conflict(\"connect\", \"Provider authorization changed during reconnect\");\n          }\n          if (\n            input.authorization.id !== input.connection.authorizationId ||\n            input.authorization.providerId !== input.connection.providerId ||\n            input.authorization.method !== input.connection.method\n          ) {\n            return yield* conflict(\"connect\", \"Connection does not match its authorization\");\n          }\n          const existingConnection = current?.connections.find(\n            (connection) => connection.ownerId === input.connection.ownerId,\n          );\n          if (\n            input.expectedConnectionId !== undefined &&\n            existingConnection?.id !== input.expectedConnectionId\n          ) {\n            return yield* conflict(\"connect\", \"Organization connection changed during reconnect\");\n          }\n          const connection = existingConnection ?? input.connection;\n          const next: Lifecycle.Aggregate = {\n            authorization: input.authorization,\n            connections: current\n              ? [...current.connections.filter(({ id }) => id !== connection.id), connection]\n              : [connection],\n            attachments: current?.attachments ?? [],\n            credential: input.credential,\n          };\n          yield* commit(\"connect\", next);\n          return next;\n        }),\n      ),\n    detach: ({ attachmentId, ownerId }) =>\n      serialize(\n        Effect.gen(function* () {\n          const entries = yield* Ref.get(state);\n          for (const aggregate of entries.values()) {\n            const attachment = aggregate.attachments.find(({ id }) => id === attachmentId);\n            if (attachment === undefined) continue;\n            const connection = ownerConnection(aggregate, attachment.connectionId, ownerId);\n            if (connection === undefined) {\n              return yield* missing(\"detach\", \"Domain attachment does not belong to this owner\");\n            }\n            const next: Lifecycle.Aggregate = {\n              ...aggregate,\n              attachments: aggregate.attachments.filter(({ id }) => id !== attachmentId),\n            };\n            yield* commit(\"detach\", next);\n            return {\n              attachment,\n              connection: publicConnection(\n                connection,\n                aggregate.authorization,\n                aggregate.credential,\n              ),\n              remainingAttachments: next.attachments.filter(\n                ({ connectionId }) => connectionId === connection.id,\n              ).length,\n            };\n          }\n          return yield* missing(\"detach\", \"Domain attachment does not exist\");\n        }),\n      ),\n    disconnect: ({ connectionId, ownerId, revoke }) =>\n      serialize(\n        Effect.gen(function* () {\n          const aggregate = yield* getByConnectionId(connectionId);\n          if (aggregate === null) {\n            return yield* missing(\"disconnect\", \"Provider connection does not exist\");\n          }\n          const connection = ownerConnection(aggregate, connectionId, ownerId);\n          if (connection === undefined) {\n            return yield* missing(\n              \"disconnect\",\n              \"Provider connection does not belong to this owner\",\n            );\n          }\n          if (aggregate.attachments.some(({ connectionId: id }) => id === connectionId)) {\n            return yield* conflict(\n              \"disconnect\",\n              \"Detach all organization domains before disconnecting the provider\",\n            );\n          }\n          const remainingConnections = aggregate.connections.filter(\n            ({ id }) => id !== connectionId,\n          );\n          if (remainingConnections.length > 0) {\n            const next: Lifecycle.Aggregate = { ...aggregate, connections: remainingConnections };\n            yield* commit(\"disconnectConnection\", next);\n            return {\n              connection: publicConnection(\n                connection,\n                aggregate.authorization,\n                aggregate.credential,\n              ),\n              remainingConnections: remainingConnections.length,\n              revokedAuthorization: false,\n            };\n          }\n          return yield* finishRevocation(aggregate, connection, revoke);\n        }).pipe(Effect.withSpan(\"ManagedDnsConnections.disconnect\")),\n      ),\n    findConnection: (ownerId, authorizationId) =>\n      Ref.get(state).pipe(\n        Effect.map(\n          (entries) =>\n            entries.get(authorizationId)?.connections.find(({ ownerId: id }) => id === ownerId) ??\n            null,\n        ),\n      ),\n    get,\n    getAttachment: (attachmentId) =>\n      Ref.get(state).pipe(\n        Effect.map(\n          (entries) =>\n            [...entries.values()]\n              .flatMap(({ attachments }) => attachments)\n              .find(({ id }) => id === attachmentId) ?? null,\n        ),\n      ),\n    getByConnectionId,\n    listAttachments: (connectionId, ownerId) =>\n      Effect.gen(function* () {\n        const aggregate = yield* getByConnectionId(connectionId);\n        if (aggregate === null) {\n          return yield* missing(\"listAttachments\", \"Provider connection does not exist\");\n        }\n        if (ownerConnection(aggregate, connectionId, ownerId) === undefined) {\n          return yield* missing(\n            \"listAttachments\",\n            \"Provider connection does not belong to this owner\",\n          );\n        }\n        return aggregate.attachments.filter(({ connectionId: id }) => id === connectionId);\n      }),\n    promoteEvidence: (authorizationId, evidence) =>\n      serialize(\n        Effect.gen(function* () {\n          const aggregate = yield* get(authorizationId);\n          if (aggregate === null) {\n            return yield* missing(\"promoteEvidence\", \"Provider authorization does not exist\");\n          }\n          const byCapability = new Map(\n            aggregate.authorization.capabilityEvidence.map((item) => [item.capability, item]),\n          );\n          for (const item of evidence) byCapability.set(item.capability, item);\n          const next = {\n            ...aggregate,\n            authorization: {\n              ...aggregate.authorization,\n              capabilityEvidence: [...byCapability.values()],\n            },\n          };\n          yield* commit(\"promoteEvidence\", next);\n          return next;\n        }),\n      ),\n    recover: ({ authorizationId, revoke }) =>\n      serialize(\n        Effect.gen(function* () {\n          const aggregate = yield* get(authorizationId);\n          if (aggregate === null) {\n            return yield* missing(\"recover\", \"Provider authorization does not exist\");\n          }\n          if (aggregate.authorization.revocation._tag !== \"Pending\") {\n            return yield* missing(\"recover\", \"Provider authorization is not awaiting revocation\");\n          }\n          const connection = aggregate.connections[0];\n          if (connection === undefined) {\n            return yield* missing(\"recover\", \"Pending authorization has no connection\");\n          }\n          return yield* finishRevocation(aggregate, connection, revoke);\n        }).pipe(Effect.withSpan(\"ManagedDnsConnections.recover\")),\n      ),\n    rotate: (authorizationId, credential) =>\n      serialize(\n        Effect.gen(function* () {\n          const aggregate = yield* get(authorizationId);\n          if (aggregate === null) {\n            return yield* missing(\"rotate\", \"Provider authorization does not exist\");\n          }\n          const next = {\n            ...aggregate,\n            credential,\n          };\n          yield* commit(\"rotate\", next);\n          return next;\n        }),\n      ),\n  });\n}\n\nexport const layer = (options: Options = {}) => Layer.sync(Lifecycle.Service, () => make(options));\n","import { Effect, Ref } from \"effect\";\n\nimport type * as Connection from \"../auth/connect.ts\";\n\nexport function make(): Connection.ContinuationStore {\n  const state = Effect.runSync(Ref.make<ReadonlyMap<string, Connection.Continuation>>(new Map()));\n  return {\n    consume: Effect.fn(\"ConnectionContinuations.consume\")(function* (id, now) {\n      return yield* Ref.modify(state, (entries) => {\n        const continuation = entries.get(id);\n        const next = new Map(entries);\n        next.delete(id);\n        return [\n          continuation !== undefined && continuation.expiresAt > now ? continuation : null,\n          next,\n        ] as const;\n      });\n    }),\n    put: Effect.fn(\"ConnectionContinuations.put\")((continuation) =>\n      Ref.update(state, (entries) => {\n        const next = new Map(entries);\n        next.set(continuation.id, continuation);\n        return next;\n      }),\n    ),\n  };\n}\n","import { Effect, Layer } from \"effect\";\n\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport type * as DnsRecord from \"../domain/dns-record.ts\";\nimport * as DnsProvider from \"./provider.ts\";\n\nexport interface Options {\n  readonly id?: string;\n  readonly records?: Readonly<Record<string, ReadonlyArray<DnsRecord.Observed>>>;\n}\n\nexport function make(options: Options = {}): DnsProvider.Interface {\n  const id = options.id ?? \"memory\";\n  const records = new Map<DomainName.DomainName, Array<DnsRecord.Observed>>();\n  const recordIds = new Map<string, DnsRecord.Observed>();\n  for (const [zone, initial] of Object.entries(options.records ?? {})) {\n    records.set(DomainName.parse(zone), [...initial]);\n    for (const [index, record] of initial.entries()) recordIds.set(`${id}:${index + 1}`, record);\n  }\n  return {\n    id,\n    listRecords: Effect.fn(\"InMemoryDnsProvider.listRecords\")((zone) =>\n      Effect.sync(() => [...(records.get(zone) ?? [])]),\n    ),\n    createRecord: Effect.fn(\"InMemoryDnsProvider.createRecord\")((zone, record) =>\n      Effect.sync(() => {\n        const current = records.get(zone) ?? [];\n        current.push(record);\n        records.set(zone, current);\n        const providerRecordId = `${id}:${current.length}`;\n        recordIds.set(providerRecordId, record);\n        return { providerRecordId };\n      }),\n    ),\n    deleteRecord: Effect.fn(\"InMemoryDnsProvider.deleteRecord\")((zone, providerRecordId) =>\n      Effect.sync(() => {\n        const record = recordIds.get(providerRecordId);\n        if (record === undefined) return;\n        records.set(\n          zone,\n          (records.get(zone) ?? []).filter((candidate) => candidate !== record),\n        );\n        recordIds.delete(providerRecordId);\n      }),\n    ),\n    getRecord: Effect.fn(\"InMemoryDnsProvider.getRecord\")((_zone, providerRecordId) =>\n      Effect.sync(() => recordIds.get(providerRecordId) ?? null),\n    ),\n  };\n}\n\nexport const layer = (options: Options = {}): Layer.Layer<DnsProvider.Service> =>\n  Layer.succeed(DnsProvider.Service, make(options));\n\nexport const toAsync = (options: Options = {}): DnsProvider.AsyncInterface =>\n  DnsProvider.toAsync(make(options));\n","import { Effect, Layer } from \"effect\";\n\nimport * as DnsResolver from \"./resolver.ts\";\n\nexport type Resolve = (\n  query: DnsResolver.Query,\n) => DnsResolver.Resolution | Effect.Effect<DnsResolver.Resolution, DnsResolver.Error>;\n\nexport function make(resolve: Resolve): DnsResolver.Interface {\n  return {\n    resolve: Effect.fn(\"InMemoryDnsResolver.resolve\")((query) =>\n      Effect.suspend(() => {\n        const resolution = resolve(query);\n        return Effect.isEffect(resolution) ? resolution : Effect.succeed(resolution);\n      }),\n    ),\n  };\n}\n\nexport const layer = (resolve: Resolve): Layer.Layer<DnsResolver.Service> =>\n  Layer.succeed(DnsResolver.Service, make(resolve));\n\nexport const toAsync = (resolve: Resolve): DnsResolver.AsyncInterface =>\n  DnsResolver.toAsync(make(resolve));\n","import { Effect, Layer, Schema } from \"effect\";\n\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport * as DnsRecord from \"../domain/dns-record.ts\";\nimport * as Deletion from \"../plan/deletion.ts\";\nimport * as Digest from \"../plan/canonical-json.ts\";\nimport * as Provisioning from \"../plan/plan.ts\";\nimport * as DnsProvider from \"../provider/provider.ts\";\n\nexport class Error extends Schema.TaggedError<Error>()(\"ProviderConformanceError\", {\n  case: Schema.String,\n  message: Schema.String,\n  providerId: Schema.String,\n}) {}\n\nexport interface Input {\n  readonly makeProvider: () => Effect.Effect<DnsProvider.Interface, DnsProvider.Error>;\n  readonly prefix?: string;\n  readonly zone: DomainName.DomainName;\n}\n\nexport interface Report {\n  readonly cases: ReadonlyArray<string>;\n  readonly providerId: string;\n  readonly zone: DomainName.DomainName;\n}\n\n/** Adapt a fresh Promise-shaped provider factory for the Effect-native conformance runner. */\nexport function fromAsync(makeProvider: () => DnsProvider.AsyncInterface): Input[\"makeProvider\"] {\n  return () => Effect.sync(() => DnsProvider.fromAsync(makeProvider()));\n}\n\nconst cases = [\n  \"create-readback-cleanup\",\n  \"exact-noop\",\n  \"conflict\",\n  \"stale-plan\",\n  \"partial-apply-cleanup\",\n] as const;\n\n/** Run the deterministic offline contract every DomainKit DNS adapter must satisfy. */\nexport const run = Effect.fn(\"ProviderConformance.run\")(function* (input: Input) {\n  const makeProvider = () =>\n    Effect.suspend(input.makeProvider).pipe(\n      Effect.catchDefect((cause) =>\n        Effect.fail(\n          new Error({\n            case: \"factory\",\n            message: cause instanceof globalThis.Error ? cause.message : \"Provider factory failed\",\n            providerId: \"unknown\",\n          }),\n        ),\n      ),\n    );\n  const first = yield* makeProvider();\n  const providerId = first.id;\n  const prefix = input.prefix ?? \"domainkit-conformance\";\n  yield* createReadbackCleanup(first, input.zone, prefix);\n  yield* exactNoop(yield* makeProvider(), input.zone, prefix);\n  yield* conflict(yield* makeProvider(), input.zone, prefix);\n  yield* stalePlan(yield* makeProvider(), input.zone, prefix);\n  yield* partialApplyCleanup(yield* makeProvider(), input.zone, prefix);\n  return { cases, providerId, zone: input.zone } satisfies Report;\n});\n\nfunction createReadbackCleanup(\n  provider: DnsProvider.Interface,\n  zone: DomainName.DomainName,\n  prefix: string,\n) {\n  const requirements = createRequirements(zone, prefix);\n  let cleanupRecordIds: ReadonlyArray<string> = [];\n  return Effect.gen(function* () {\n    const { plan } = yield* Provisioning.create({\n      requirements,\n      target: Provisioning.Target.ExactZone({ zone }),\n    });\n    yield* requireTags(provider, \"create-readback-cleanup\", plan.operations, [\"create\", \"create\"]);\n    const receipt = yield* Provisioning.apply({\n      authorization: yield* Provisioning.authorize(plan),\n      plan,\n    }).pipe(\n      Effect.tapError((failure) =>\n        failure instanceof Provisioning.PartialApplyError\n          ? Effect.sync(() => {\n              cleanupRecordIds = providerRecordIds(failure.receipt.operations);\n            })\n          : Effect.void,\n      ),\n    );\n    cleanupRecordIds = providerRecordIds(receipt.operations);\n    yield* requireCondition(\n      provider,\n      \"create-readback-cleanup\",\n      receipt.status === \"complete\" &&\n        receipt.operations.every(({ providerRecordId }) => providerRecordId !== null),\n      \"apply must return a complete receipt with provider record IDs\",\n    );\n    const observed = yield* provider.listRecords(zone);\n    yield* requireCondition(\n      provider,\n      \"create-readback-cleanup\",\n      requirements.every((requirement) =>\n        observed.some(\n          (record) => record._tag !== \"Opaque\" && DnsRecord.equals(record, requirement),\n        ),\n      ),\n      \"listRecords must return every created record, including across provider pages\",\n    );\n    const deletion = yield* Deletion.create({ plan, receipt });\n    const deletionReceipt = yield* Deletion.apply({\n      authorization: yield* Deletion.authorize(deletion),\n      plan: deletion,\n    });\n    yield* requireCondition(\n      provider,\n      \"create-readback-cleanup\",\n      deletionReceipt.status === \"complete\" &&\n        (yield* recordIdsAbsent(provider, zone, cleanupRecordIds)),\n      \"receipt-bound cleanup must remove every created record\",\n    );\n  }).pipe(\n    Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)),\n    Effect.provide(providerLayer(provider)),\n  );\n}\n\nfunction exactNoop(provider: DnsProvider.Interface, zone: DomainName.DomainName, prefix: string) {\n  const requirement = cname(zone, `${prefix}-exact`);\n  let cleanupRecordIds: ReadonlyArray<string> = [];\n  return Effect.gen(function* () {\n    const created = yield* provider.createRecord(zone, requirement);\n    cleanupRecordIds = created.providerRecordId === null ? [] : [created.providerRecordId];\n    const { plan } = yield* Provisioning.create({\n      requirements: [requirement],\n      target: Provisioning.Target.ExactZone({ zone }),\n    });\n    yield* requireTags(provider, \"exact-noop\", plan.operations, [\"noop\"]);\n    const receipt = yield* Provisioning.apply({\n      authorization: yield* Provisioning.authorize(plan),\n      plan,\n    });\n    yield* requireCondition(\n      provider,\n      \"exact-noop\",\n      receipt.operations.length === 0,\n      \"an exact plan must not create another record\",\n    );\n    yield* deleteCreated(provider, zone, created.providerRecordId, \"exact-noop\");\n  }).pipe(\n    Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)),\n    Effect.provide(providerLayer(provider)),\n  );\n}\n\nfunction conflict(provider: DnsProvider.Interface, zone: DomainName.DomainName, prefix: string) {\n  const requirement = cname(zone, `${prefix}-conflict`);\n  const occupied = txt(zone, `${prefix}-conflict`, \"occupied\");\n  let cleanupRecordIds: ReadonlyArray<string> = [];\n  return Effect.gen(function* () {\n    const created = yield* provider.createRecord(zone, occupied);\n    cleanupRecordIds = created.providerRecordId === null ? [] : [created.providerRecordId];\n    const { plan } = yield* Provisioning.create({\n      requirements: [requirement],\n      target: Provisioning.Target.ExactZone({ zone }),\n    });\n    yield* requireTags(provider, \"conflict\", plan.operations, [\"conflict\"]);\n    const failure = yield* Provisioning.apply({\n      authorization: yield* Provisioning.authorize(plan),\n      plan,\n    }).pipe(Effect.flip);\n    yield* requireCondition(\n      provider,\n      \"conflict\",\n      failure instanceof Provisioning.ConflictError,\n      \"apply must fail closed on incompatible state\",\n    );\n    yield* deleteCreated(provider, zone, created.providerRecordId, \"conflict\");\n  }).pipe(\n    Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)),\n    Effect.provide(providerLayer(provider)),\n  );\n}\n\nfunction stalePlan(provider: DnsProvider.Interface, zone: DomainName.DomainName, prefix: string) {\n  const requirement = cname(zone, `${prefix}-stale`);\n  let cleanupRecordIds: ReadonlyArray<string> = [];\n  return Effect.gen(function* () {\n    const { plan } = yield* Provisioning.create({\n      requirements: [requirement],\n      target: Provisioning.Target.ExactZone({ zone }),\n    });\n    const authorization = yield* Provisioning.authorize(plan);\n    const created = yield* provider.createRecord(zone, requirement);\n    cleanupRecordIds = created.providerRecordId === null ? [] : [created.providerRecordId];\n    const failure = yield* Provisioning.apply({ authorization, plan }).pipe(Effect.flip);\n    yield* requireCondition(\n      provider,\n      \"stale-plan\",\n      failure instanceof Provisioning.StaleError,\n      \"apply must reject provider state that changed after authorization\",\n    );\n    yield* deleteCreated(provider, zone, created.providerRecordId, \"stale-plan\");\n  }).pipe(\n    Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)),\n    Effect.provide(providerLayer(provider)),\n  );\n}\n\nfunction partialApplyCleanup(\n  provider: DnsProvider.Interface,\n  zone: DomainName.DomainName,\n  prefix: string,\n) {\n  let creates = 0;\n  const flaky = DnsProvider.Service.of({\n    ...provider,\n    createRecord: Effect.fn(\"ProviderConformance.createRecord\")((target, record) => {\n      creates += 1;\n      return creates === 1\n        ? provider.createRecord(target, record)\n        : Effect.fail(\n            new DnsProvider.Error({\n              message: \"injected conformance failure\",\n              operation: \"createRecord\",\n              providerId: provider.id,\n            }),\n          );\n    }),\n  });\n  const requirements = [\n    cname(zone, `${prefix}-partial-one`),\n    txt(zone, `${prefix}-partial-two`, \"domainkit\"),\n  ];\n  let cleanupRecordIds: ReadonlyArray<string> = [];\n  return Effect.gen(function* () {\n    const { plan } = yield* Provisioning.create({\n      requirements,\n      target: Provisioning.Target.ExactZone({ zone }),\n    });\n    const failure = yield* Provisioning.apply({\n      authorization: yield* Provisioning.authorize(plan),\n      plan,\n    }).pipe(Effect.flip);\n    cleanupRecordIds =\n      failure instanceof Provisioning.PartialApplyError\n        ? providerRecordIds(failure.receipt.operations)\n        : [];\n    yield* requireCondition(\n      provider,\n      \"partial-apply-cleanup\",\n      failure instanceof Provisioning.PartialApplyError && failure.receipt.operations.length === 1,\n      \"a later write failure must preserve the first confirmed write in a partial receipt\",\n    );\n    if (!(failure instanceof Provisioning.PartialApplyError)) return;\n    const deletion = yield* Deletion.create({ plan, receipt: failure.receipt }).pipe(\n      Effect.provide(providerLayer(provider)),\n    );\n    yield* Deletion.apply({\n      authorization: yield* Deletion.authorize(deletion),\n      plan: deletion,\n    }).pipe(Effect.provide(providerLayer(provider)));\n    yield* requireCondition(\n      provider,\n      \"partial-apply-cleanup\",\n      yield* recordIdsAbsent(provider, zone, cleanupRecordIds),\n      \"partial receipt cleanup must remove the confirmed write\",\n    );\n  }).pipe(\n    Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)),\n    Effect.provide(providerLayer(flaky)),\n  );\n}\n\nfunction providerRecordIds(\n  operations: ReadonlyArray<{ readonly providerRecordId: string | null }>,\n): ReadonlyArray<string> {\n  return operations.flatMap(({ providerRecordId }) =>\n    providerRecordId === null ? [] : [providerRecordId],\n  );\n}\n\nfunction recordIdsAbsent(\n  provider: DnsProvider.Interface,\n  zone: DomainName.DomainName,\n  recordIds: ReadonlyArray<string>,\n) {\n  return Effect.forEach(recordIds, (providerRecordId) =>\n    provider.getRecord(zone, providerRecordId),\n  ).pipe(Effect.map((records) => records.every((record) => record === null)));\n}\n\nfunction bestEffortDelete(\n  provider: DnsProvider.Interface,\n  zone: DomainName.DomainName,\n  recordIds: () => ReadonlyArray<string>,\n) {\n  return Effect.suspend(() =>\n    Effect.forEach(\n      recordIds(),\n      (providerRecordId) => provider.deleteRecord(zone, providerRecordId).pipe(Effect.ignore),\n      { discard: true },\n    ),\n  );\n}\n\nfunction providerLayer(provider: DnsProvider.Interface) {\n  return Layer.merge(Layer.succeed(DnsProvider.Service, provider), Digest.webCryptoLayer);\n}\n\nfunction createRequirements(zone: DomainName.DomainName, prefix: string) {\n  return [cname(zone, `${prefix}-create`), txt(zone, `${prefix}-page`, \"domainkit\")];\n}\n\nfunction cname(zone: DomainName.DomainName, label: string) {\n  return DnsRecord.parse({\n    _tag: \"CNAME\",\n    metadata: { ownership: \"tester\", provenance: \"domainkit\", purpose: \"conformance\" },\n    name: `${label}.${zone}`,\n    policy: \"exclusive\",\n    target: \"target.example.net\",\n    ttl: 300,\n  });\n}\n\nfunction txt(zone: DomainName.DomainName, label: string, value: string) {\n  return DnsRecord.parse({\n    _tag: \"TXT\",\n    metadata: { ownership: \"tester\", provenance: \"domainkit\", purpose: \"conformance\" },\n    name: `${label}.${zone}`,\n    policy: \"append\",\n    ttl: 300,\n    value,\n  });\n}\n\nfunction requireTags(\n  provider: DnsProvider.Interface,\n  testCase: string,\n  operations: ReadonlyArray<{ readonly _tag: string }>,\n  expected: ReadonlyArray<string>,\n) {\n  return requireCondition(\n    provider,\n    testCase,\n    JSON.stringify(operations.map(({ _tag }) => _tag)) === JSON.stringify(expected),\n    `expected operations ${expected.join(\", \")}`,\n  );\n}\n\nfunction requireCondition(\n  provider: DnsProvider.Interface,\n  testCase: string,\n  condition: boolean,\n  message: string,\n) {\n  return condition\n    ? Effect.void\n    : Effect.fail(new Error({ case: testCase, message, providerId: provider.id }));\n}\n\nfunction deleteCreated(\n  provider: DnsProvider.Interface,\n  zone: DomainName.DomainName,\n  providerRecordId: string | null,\n  testCase: string,\n) {\n  return providerRecordId === null\n    ? Effect.fail(\n        new Error({\n          case: testCase,\n          message: \"provider must return record IDs for safe cleanup\",\n          providerId: provider.id,\n        }),\n      )\n    : provider.deleteRecord(zone, providerRecordId);\n}\n"],"mappings":";;;;;;;;;AAaA,SAAS,QAAQ,WAAmB,SAAkC;CACpE,OAAO,IAAIA,QAAgB;EACzB,UAAU;EACV;EACA;EACA,OAAO;CACT,CAAC;AACH;AAEA,SAASC,WAAS,WAAmB,SAAkC;CACrE,OAAO,IAAID,QAAgB;EACzB,UAAU;EACV;EACA;EACA,OAAO;CACT,CAAC;AACH;AAEA,SAAS,gBACP,WACA,cACA,SACyC;CACzC,OAAO,UAAU,YAAY,MAC1B,eAAe,WAAW,OAAO,gBAAgB,WAAW,YAAY,OAC3E;AACF;AAEA,SAAS,iBACP,YACA,eACA,YAC+B;CAC/B,OAAOE,QAAmB,YAAY,eAAe,UAAU;AACjE;AAEA,SAAgBC,OAAK,UAAmB,CAAC,GAAwB;CAC/D,MAAM,QAAQ,OAAO,QAAQ,IAAI,qBAA+C,IAAI,IAAI,CAAC,CAAC;CAC1F,MAAM,YAAY,UAAU,WAAW,CAAC;CACxC,MAAM,aAAsB,WAAmC,UAAU,WAAW,MAAM;CAE1F,MAAM,SAAS,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAC/D,WACA,WACA;EACA,IAAI,QAAQ,iBAAiB,KAAA,GAAW,OAAO,QAAQ,aAAa,WAAW,SAAS;EACxF,OAAO,IAAI,OAAO,QAAQ,YAAY;GACpC,MAAM,OAAO,IAAI,IAAI,OAAO;GAC5B,KAAK,IAAI,UAAU,cAAc,IAAI,SAAS;GAC9C,OAAO;EACT,CAAC;CACH,CAAC;CAED,MAAM,SAAS,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAC/D,WACA,iBACA;EACA,IAAI,QAAQ,iBAAiB,KAAA,GAAW,OAAO,QAAQ,aAAa,WAAW,IAAI;EACnF,OAAO,IAAI,OAAO,QAAQ,YAAY;GACpC,MAAM,OAAO,IAAI,IAAI,OAAO;GAC5B,KAAK,OAAO,eAAe;GAC3B,OAAO;EACT,CAAC;CACH,CAAC;CAED,MAAM,MAAM,OAAO,GAAG,2BAA2B,CAAC,EAAE,oBAClD,IAAI,IAAI,KAAK,CAAC,CAAC,KAAK,OAAO,KAAK,YAAY,QAAQ,IAAI,eAAe,KAAK,IAAI,CAAC,CACnF;CAEA,MAAM,oBAAoB,OAAO,GAAG,yCAAyC,CAAC,EAC3E,iBACC,IAAI,IAAI,KAAK,CAAC,CAAC,KACb,OAAO,KACJ,YACC,CAAC,GAAG,QAAQ,OAAO,CAAC,CAAC,CAAC,MAAM,cAC1B,UAAU,YAAY,MAAM,eAAe,WAAW,OAAO,YAAY,CAC3E,KAAK,IACT,CACF,CACJ;CAEA,MAAM,mBAAmB,OAAO,GAAG,gDAAgD,CAAC,CAAC,WAGnF,WACA,YACA,QACA;EACA,MAAM,cAAc,OAAO,SAAS;EACpC,MAAM,UAA+B;GACnC,GAAG;GACH,eAAe;IACb,GAAG,UAAU;IACb,YACE,UAAU,cAAc,WAAW,SAAS,YACxC,UAAU,cAAc,aAAA,WACS,QAAQ,EAAE,YAAY,CAAC;GAChE;EACF;EACA,OAAO,OAAO,qBAAqB,OAAO;EAC1C,OAAO,OAAO,QAAQ,aAAa;EACnC,OAAO,OAAO,sBAAsB,QAAQ,cAAc,EAAE;EAC5D,OAAO;GACL,YAAY,iBAAiB,YAAY,QAAQ,eAAe,QAAQ,UAAU;GAClF,sBAAsB;GACtB,sBAAsB;EACxB;CACF,CAAC;CAED,OAAA,QAAyB,GAAG;EAC1B,SAAS,EAAE,YAAY,cAAc,cACnC,UACE,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,kBAAkB,YAAY;GACvD,IAAI,cAAc,MAChB,OAAO,OAAO,QAAQ,UAAU,oCAAoC;GAEtE,MAAM,aAAa,gBAAgB,WAAW,cAAc,OAAO;GACnE,IAAI,eAAe,KAAA,GACjB,OAAO,OAAO,QAAQ,UAAU,mDAAmD;GAErF,IAAI,WAAW,iBAAiB,cAC9B,OAAO,OAAOF,WAAS,UAAU,8CAA8C;GAEjF,MAAM,WAAW,UAAU,YAAY,MAAM,EAAE,SAAS,OAAO,WAAW,EAAE;GAC5E,IAAI,aAAa,KAAA,GAAW;IAC1B,IACE,SAAS,iBAAiB,WAAW,gBACrC,SAAS,WAAW,WAAW,UAC/B,SAAS,OAAO,cAAc,WAAW,OAAO,aAChD,SAAS,OAAO,gBAAgB,WAAW,OAAO,eAClD,SAAS,OAAO,WAAW,WAAW,OAAO,UAC7C,SAAS,OAAO,aAAa,WAAW,OAAO,UAE/C,OAAO,OAAOA,WAAS,UAAU,wCAAwC;IAE3E,OAAO;KACL,YAAY;KACZ,YAAY,iBACV,YACA,UAAU,eACV,UAAU,UACZ;IACF;GACF;GAIA,IAHoB,CAAC,IAAI,OAAO,IAAI,IAAI,KAAK,EAAA,CAAG,OAAO,CAAC,CAAC,CAAC,MAAM,cAC9D,UAAU,YAAY,MAAM,EAAE,SAAS,OAAO,WAAW,EAAE,CAE/C,GACZ,OAAO,OAAOA,WAAS,UAAU,wCAAwC;GAa3E,IAXkB,CAAC,IAAI,OAAO,IAAI,IAAI,KAAK,EAAA,CAAG,OAAO,CAAC,CAAC,CAAC,MAAM,cAAc;IAC1E,OAAO,UAAU,YAAY,MAC1B,EAAE,cAAc,wBAAwB,aACvC,WAAW,WAAW,UACtB,UAAU,YAAY,MACnB,wBACC,oBAAoB,OAAO,0BAC3B,oBAAoB,YAAY,OACpC,CACJ;GACF,CACY,GACV,OAAO,OAAOA,WACZ,UACA,0DACF;GAEF,MAAM,OAA4B;IAChC,GAAG;IACH,aAAa,CAAC,GAAG,UAAU,aAAa,UAAU;GACpD;GACA,OAAO,OAAO,UAAU,IAAI;GAC5B,OAAO;IACL;IACA,YAAY,iBAAiB,YAAY,UAAU,eAAe,UAAU,UAAU;GACxF;EACF,CAAC,CACH;EACF,UAAU,UACR,UACE,OAAO,IAAI,aAAa;GAEtB,MAAM,WAAU,OADO,IAAI,IAAI,KAAK,EAAA,CACZ,IAAI,MAAM,cAAc,EAAE;GAClD,IACE,SAAS,cAAc,WAAW,SAAS,aAC1C,MAAM,4BAA4B,KAAA,KAAa,YAAY,KAAA,GAE5D,OAAO,OAAOA,WACZ,WACA,YAAY,KAAA,IACR,4CACA,wDACN;GAEF,IACE,MAAM,4BAA4B,KAAA,KAClC,SAAS,cAAc,OAAO,MAAM,yBAEpC,OAAO,OAAOA,WAAS,WAAW,iDAAiD;GAErF,IACE,MAAM,cAAc,OAAO,MAAM,WAAW,mBAC5C,MAAM,cAAc,eAAe,MAAM,WAAW,cACpD,MAAM,cAAc,WAAW,MAAM,WAAW,QAEhD,OAAO,OAAOA,WAAS,WAAW,6CAA6C;GAEjF,MAAM,qBAAqB,SAAS,YAAY,MAC7C,eAAe,WAAW,YAAY,MAAM,WAAW,OAC1D;GACA,IACE,MAAM,yBAAyB,KAAA,KAC/B,oBAAoB,OAAO,MAAM,sBAEjC,OAAO,OAAOA,WAAS,WAAW,kDAAkD;GAEtF,MAAM,aAAa,sBAAsB,MAAM;GAC/C,MAAM,OAA4B;IAChC,eAAe,MAAM;IACrB,aAAa,UACT,CAAC,GAAG,QAAQ,YAAY,QAAQ,EAAE,SAAS,OAAO,WAAW,EAAE,GAAG,UAAU,IAC5E,CAAC,UAAU;IACf,aAAa,SAAS,eAAe,CAAC;IACtC,YAAY,MAAM;GACpB;GACA,OAAO,OAAO,WAAW,IAAI;GAC7B,OAAO;EACT,CAAC,CACH;EACF,SAAS,EAAE,cAAc,cACvB,UACE,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO,IAAI,IAAI,KAAK;GACpC,KAAK,MAAM,aAAa,QAAQ,OAAO,GAAG;IACxC,MAAM,aAAa,UAAU,YAAY,MAAM,EAAE,SAAS,OAAO,YAAY;IAC7E,IAAI,eAAe,KAAA,GAAW;IAC9B,MAAM,aAAa,gBAAgB,WAAW,WAAW,cAAc,OAAO;IAC9E,IAAI,eAAe,KAAA,GACjB,OAAO,OAAO,QAAQ,UAAU,iDAAiD;IAEnF,MAAM,OAA4B;KAChC,GAAG;KACH,aAAa,UAAU,YAAY,QAAQ,EAAE,SAAS,OAAO,YAAY;IAC3E;IACA,OAAO,OAAO,UAAU,IAAI;IAC5B,OAAO;KACL;KACA,YAAY,iBACV,YACA,UAAU,eACV,UAAU,UACZ;KACA,sBAAsB,KAAK,YAAY,QACpC,EAAE,mBAAmB,iBAAiB,WAAW,EACpD,CAAC,CAAC;IACJ;GACF;GACA,OAAO,OAAO,QAAQ,UAAU,kCAAkC;EACpE,CAAC,CACH;EACF,aAAa,EAAE,cAAc,SAAS,aACpC,UACE,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,kBAAkB,YAAY;GACvD,IAAI,cAAc,MAChB,OAAO,OAAO,QAAQ,cAAc,oCAAoC;GAE1E,MAAM,aAAa,gBAAgB,WAAW,cAAc,OAAO;GACnE,IAAI,eAAe,KAAA,GACjB,OAAO,OAAO,QACZ,cACA,mDACF;GAEF,IAAI,UAAU,YAAY,MAAM,EAAE,cAAc,SAAS,OAAO,YAAY,GAC1E,OAAO,OAAOA,WACZ,cACA,mEACF;GAEF,MAAM,uBAAuB,UAAU,YAAY,QAChD,EAAE,SAAS,OAAO,YACrB;GACA,IAAI,qBAAqB,SAAS,GAAG;IACnC,MAAM,OAA4B;KAAE,GAAG;KAAW,aAAa;IAAqB;IACpF,OAAO,OAAO,wBAAwB,IAAI;IAC1C,OAAO;KACL,YAAY,iBACV,YACA,UAAU,eACV,UAAU,UACZ;KACA,sBAAsB,qBAAqB;KAC3C,sBAAsB;IACxB;GACF;GACA,OAAO,OAAO,iBAAiB,WAAW,YAAY,MAAM;EAC9D,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,kCAAkC,CAAC,CAC7D;EACF,iBAAiB,SAAS,oBACxB,IAAI,IAAI,KAAK,CAAC,CAAC,KACb,OAAO,KACJ,YACC,QAAQ,IAAI,eAAe,CAAC,EAAE,YAAY,MAAM,EAAE,SAAS,SAAS,OAAO,OAAO,KAClF,IACJ,CACF;EACF;EACA,gBAAgB,iBACd,IAAI,IAAI,KAAK,CAAC,CAAC,KACb,OAAO,KACJ,YACC,CAAC,GAAG,QAAQ,OAAO,CAAC,CAAC,CAClB,SAAS,EAAE,kBAAkB,WAAW,CAAC,CACzC,MAAM,EAAE,SAAS,OAAO,YAAY,KAAK,IAChD,CACF;EACF;EACA,kBAAkB,cAAc,YAC9B,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,kBAAkB,YAAY;GACvD,IAAI,cAAc,MAChB,OAAO,OAAO,QAAQ,mBAAmB,oCAAoC;GAE/E,IAAI,gBAAgB,WAAW,cAAc,OAAO,MAAM,KAAA,GACxD,OAAO,OAAO,QACZ,mBACA,mDACF;GAEF,OAAO,UAAU,YAAY,QAAQ,EAAE,cAAc,SAAS,OAAO,YAAY;EACnF,CAAC;EACH,kBAAkB,iBAAiB,aACjC,UACE,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,IAAI,eAAe;GAC5C,IAAI,cAAc,MAChB,OAAO,OAAO,QAAQ,mBAAmB,uCAAuC;GAElF,MAAM,eAAe,IAAI,IACvB,UAAU,cAAc,mBAAmB,KAAK,SAAS,CAAC,KAAK,YAAY,IAAI,CAAC,CAClF;GACA,KAAK,MAAM,QAAQ,UAAU,aAAa,IAAI,KAAK,YAAY,IAAI;GACnE,MAAM,OAAO;IACX,GAAG;IACH,eAAe;KACb,GAAG,UAAU;KACb,oBAAoB,CAAC,GAAG,aAAa,OAAO,CAAC;IAC/C;GACF;GACA,OAAO,OAAO,mBAAmB,IAAI;GACrC,OAAO;EACT,CAAC,CACH;EACF,UAAU,EAAE,iBAAiB,aAC3B,UACE,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,IAAI,eAAe;GAC5C,IAAI,cAAc,MAChB,OAAO,OAAO,QAAQ,WAAW,uCAAuC;GAE1E,IAAI,UAAU,cAAc,WAAW,SAAS,WAC9C,OAAO,OAAO,QAAQ,WAAW,mDAAmD;GAEtF,MAAM,aAAa,UAAU,YAAY;GACzC,IAAI,eAAe,KAAA,GACjB,OAAO,OAAO,QAAQ,WAAW,yCAAyC;GAE5E,OAAO,OAAO,iBAAiB,WAAW,YAAY,MAAM;EAC9D,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,+BAA+B,CAAC,CAC1D;EACF,SAAS,iBAAiB,eACxB,UACE,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,IAAI,eAAe;GAC5C,IAAI,cAAc,MAChB,OAAO,OAAO,QAAQ,UAAU,uCAAuC;GAEzE,MAAM,OAAO;IACX,GAAG;IACH;GACF;GACA,OAAO,OAAO,UAAU,IAAI;GAC5B,OAAO;EACT,CAAC,CACH;CACJ,CAAC;AACH;AAEA,MAAaG,WAAS,UAAmB,CAAC,MAAM,MAAM,KAAKC,eAAyBF,OAAK,OAAO,CAAC;;;;AC/YjG,SAAgBG,SAAqC;CACnD,MAAM,QAAQ,OAAO,QAAQ,IAAI,qBAAmD,IAAI,IAAI,CAAC,CAAC;CAC9F,OAAO;EACL,SAAS,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAAW,IAAI,KAAK;GACxE,OAAO,OAAO,IAAI,OAAO,QAAQ,YAAY;IAC3C,MAAM,eAAe,QAAQ,IAAI,EAAE;IACnC,MAAM,OAAO,IAAI,IAAI,OAAO;IAC5B,KAAK,OAAO,EAAE;IACd,OAAO,CACL,iBAAiB,KAAA,KAAa,aAAa,YAAY,MAAM,eAAe,MAC5E,IACF;GACF,CAAC;EACH,CAAC;EACD,KAAK,OAAO,GAAG,6BAA6B,CAAC,EAAE,iBAC7C,IAAI,OAAO,QAAQ,YAAY;GAC7B,MAAM,OAAO,IAAI,IAAI,OAAO;GAC5B,KAAK,IAAI,aAAa,IAAI,YAAY;GACtC,OAAO;EACT,CAAC,CACH;CACF;AACF;;;;;;;;ACfA,SAAgBC,OAAK,UAAmB,CAAC,GAA0B;CACjE,MAAM,KAAK,QAAQ,MAAM;CACzB,MAAM,0BAAU,IAAI,IAAsD;CAC1E,MAAM,4BAAY,IAAI,IAAgC;CACtD,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,QAAQ,WAAW,CAAC,CAAC,GAAG;EACnE,QAAQ,IAAIC,MAAiB,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC;EAChD,KAAK,MAAM,CAAC,OAAO,WAAW,QAAQ,QAAQ,GAAG,UAAU,IAAI,GAAG,GAAG,GAAG,QAAQ,KAAK,MAAM;CAC7F;CACA,OAAO;EACL;EACA,aAAa,OAAO,GAAG,iCAAiC,CAAC,EAAE,SACzD,OAAO,WAAW,CAAC,GAAI,QAAQ,IAAI,IAAI,KAAK,CAAC,CAAE,CAAC,CAClD;EACA,cAAc,OAAO,GAAG,kCAAkC,CAAC,EAAE,MAAM,WACjE,OAAO,WAAW;GAChB,MAAM,UAAU,QAAQ,IAAI,IAAI,KAAK,CAAC;GACtC,QAAQ,KAAK,MAAM;GACnB,QAAQ,IAAI,MAAM,OAAO;GACzB,MAAM,mBAAmB,GAAG,GAAG,GAAG,QAAQ;GAC1C,UAAU,IAAI,kBAAkB,MAAM;GACtC,OAAO,EAAE,iBAAiB;EAC5B,CAAC,CACH;EACA,cAAc,OAAO,GAAG,kCAAkC,CAAC,EAAE,MAAM,qBACjE,OAAO,WAAW;GAChB,MAAM,SAAS,UAAU,IAAI,gBAAgB;GAC7C,IAAI,WAAW,KAAA,GAAW;GAC1B,QAAQ,IACN,OACC,QAAQ,IAAI,IAAI,KAAK,CAAC,EAAA,CAAG,QAAQ,cAAc,cAAc,MAAM,CACtE;GACA,UAAU,OAAO,gBAAgB;EACnC,CAAC,CACH;EACA,WAAW,OAAO,GAAG,+BAA+B,CAAC,EAAE,OAAO,qBAC5D,OAAO,WAAW,UAAU,IAAI,gBAAgB,KAAK,IAAI,CAC3D;CACF;AACF;AAEA,MAAaC,WAAS,UAAmB,CAAC,MACxC,MAAM,QAAQC,WAAqBH,OAAK,OAAO,CAAC;AAElD,MAAaI,aAAW,UAAmB,CAAC,MAC1CC,UAAoBL,OAAK,OAAO,CAAC;;;;;;;;AC/CnC,SAAgB,KAAK,SAAyC;CAC5D,OAAO,EACL,SAAS,OAAO,GAAG,6BAA6B,CAAC,EAAE,UACjD,OAAO,cAAc;EACnB,MAAM,aAAa,QAAQ,KAAK;EAChC,OAAO,OAAO,SAAS,UAAU,IAAI,aAAa,OAAO,QAAQ,UAAU;CAC7E,CAAC,CACH,EACF;AACF;AAEA,MAAa,SAAS,YACpB,MAAM,QAAQM,WAAqB,KAAK,OAAO,CAAC;AAElD,MAAa,WAAW,YACtBC,UAAoB,KAAK,OAAO,CAAC;;;;;;;;ACdnC,IAAa,QAAb,cAA2B,OAAO,YAAmB,CAAC,CAAC,4BAA4B;CACjF,MAAM,OAAO;CACb,SAAS,OAAO;CAChB,YAAY,OAAO;AACrB,CAAC,CAAC,CAAC,CAAC;;AAeJ,SAAgB,UAAU,cAAuE;CAC/F,aAAa,OAAO,WAAWC,YAAsB,aAAa,CAAC,CAAC;AACtE;AAEA,MAAM,QAAQ;CACZ;CACA;CACA;CACA;CACA;AACF;;AAGA,MAAa,MAAM,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,OAAc;CAC/E,MAAM,qBACJ,OAAO,QAAQ,MAAM,YAAY,CAAC,CAAC,KACjC,OAAO,aAAa,UAClB,OAAO,KACL,IAAI,MAAM;EACR,MAAM;EACN,SAAS,iBAAiB,WAAW,QAAQ,MAAM,UAAU;EAC7D,YAAY;CACd,CAAC,CACH,CACF,CACF;CACF,MAAM,QAAQ,OAAO,aAAa;CAClC,MAAM,aAAa,MAAM;CACzB,MAAM,SAAS,MAAM,UAAU;CAC/B,OAAO,sBAAsB,OAAO,MAAM,MAAM,MAAM;CACtD,OAAO,UAAU,OAAO,aAAa,GAAG,MAAM,MAAM,MAAM;CAC1D,OAAO,SAAS,OAAO,aAAa,GAAG,MAAM,MAAM,MAAM;CACzD,OAAO,UAAU,OAAO,aAAa,GAAG,MAAM,MAAM,MAAM;CAC1D,OAAO,oBAAoB,OAAO,aAAa,GAAG,MAAM,MAAM,MAAM;CACpE,OAAO;EAAE;EAAO;EAAY,MAAM,MAAM;CAAK;AAC/C,CAAC;AAED,SAAS,sBACP,UACA,MACA,QACA;CACA,MAAM,eAAe,mBAAmB,MAAM,MAAM;CACpD,IAAI,mBAA0C,CAAC;CAC/C,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,EAAE,SAAS,OAAOC,OAAoB;GAC1C;GACA,QAAA,OAA4B,UAAU,EAAE,KAAK,CAAC;EAChD,CAAC;EACD,OAAO,YAAY,UAAU,2BAA2B,KAAK,YAAY,CAAC,UAAU,QAAQ,CAAC;EAC7F,MAAM,UAAU,OAAOC,MAAmB;GACxC,eAAe,OAAOC,UAAuB,IAAI;GACjD;EACF,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,YACf,mBAAmBC,oBACf,OAAO,WAAW;GAChB,mBAAmB,kBAAkB,QAAQ,QAAQ,UAAU;EACjE,CAAC,IACD,OAAO,IACb,CACF;EACA,mBAAmB,kBAAkB,QAAQ,UAAU;EACvD,OAAO,iBACL,UACA,2BACA,QAAQ,WAAW,cACjB,QAAQ,WAAW,OAAO,EAAE,uBAAuB,qBAAqB,IAAI,GAC9E,+DACF;EACA,MAAM,WAAW,OAAO,SAAS,YAAY,IAAI;EACjD,OAAO,iBACL,UACA,2BACA,aAAa,OAAO,gBAClB,SAAS,MACN,WAAW,OAAO,SAAS,YAAYC,OAAiB,QAAQ,WAAW,CAC9E,CACF,GACA,+EACF;EACA,MAAM,WAAW,OAAOC,SAAgB;GAAE;GAAM;EAAQ,CAAC;EAKzD,OAAO,iBACL,UACA,4BACA,OAP6BC,QAAe;GAC5C,eAAe,OAAOC,YAAmB,QAAQ;GACjD,MAAM;EACR,CAAC,EAAA,CAIiB,WAAW,eACxB,OAAO,gBAAgB,UAAU,MAAM,gBAAgB,IAC1D,wDACF;CACF,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,iBAAiB,UAAU,YAAY,gBAAgB,CAAC,GACxE,OAAO,QAAQ,cAAc,QAAQ,CAAC,CACxC;AACF;AAEA,SAAS,UAAU,UAAiC,MAA6B,QAAgB;CAC/F,MAAM,cAAc,MAAM,MAAM,GAAG,OAAO,OAAO;CACjD,IAAI,mBAA0C,CAAC;CAC/C,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,UAAU,OAAO,SAAS,aAAa,MAAM,WAAW;EAC9D,mBAAmB,QAAQ,qBAAqB,OAAO,CAAC,IAAI,CAAC,QAAQ,gBAAgB;EACrF,MAAM,EAAE,SAAS,OAAOP,OAAoB;GAC1C,cAAc,CAAC,WAAW;GAC1B,QAAA,OAA4B,UAAU,EAAE,KAAK,CAAC;EAChD,CAAC;EACD,OAAO,YAAY,UAAU,cAAc,KAAK,YAAY,CAAC,MAAM,CAAC;EAKpE,OAAO,iBACL,UACA,eACA,OAPqBC,MAAmB;GACxC,eAAe,OAAOC,UAAuB,IAAI;GACjD;EACF,CAAC,EAAA,CAIS,WAAW,WAAW,GAC9B,8CACF;EACA,OAAO,cAAc,UAAU,MAAM,QAAQ,kBAAkB,YAAY;CAC7E,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,iBAAiB,UAAU,YAAY,gBAAgB,CAAC,GACxE,OAAO,QAAQ,cAAc,QAAQ,CAAC,CACxC;AACF;AAEA,SAAS,SAAS,UAAiC,MAA6B,QAAgB;CAC9F,MAAM,cAAc,MAAM,MAAM,GAAG,OAAO,UAAU;CACpD,MAAM,WAAW,IAAI,MAAM,GAAG,OAAO,YAAY,UAAU;CAC3D,IAAI,mBAA0C,CAAC;CAC/C,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,UAAU,OAAO,SAAS,aAAa,MAAM,QAAQ;EAC3D,mBAAmB,QAAQ,qBAAqB,OAAO,CAAC,IAAI,CAAC,QAAQ,gBAAgB;EACrF,MAAM,EAAE,SAAS,OAAOF,OAAoB;GAC1C,cAAc,CAAC,WAAW;GAC1B,QAAA,OAA4B,UAAU,EAAE,KAAK,CAAC;EAChD,CAAC;EACD,OAAO,YAAY,UAAU,YAAY,KAAK,YAAY,CAAC,UAAU,CAAC;EAKtE,OAAO,iBACL,UACA,aACA,OAPqBC,MAAmB;GACxC,eAAe,OAAOC,UAAuB,IAAI;GACjD;EACF,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,cAIEM,eACnB,8CACF;EACA,OAAO,cAAc,UAAU,MAAM,QAAQ,kBAAkB,UAAU;CAC3E,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,iBAAiB,UAAU,YAAY,gBAAgB,CAAC,GACxE,OAAO,QAAQ,cAAc,QAAQ,CAAC,CACxC;AACF;AAEA,SAAS,UAAU,UAAiC,MAA6B,QAAgB;CAC/F,MAAM,cAAc,MAAM,MAAM,GAAG,OAAO,OAAO;CACjD,IAAI,mBAA0C,CAAC;CAC/C,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,EAAE,SAAS,OAAOR,OAAoB;GAC1C,cAAc,CAAC,WAAW;GAC1B,QAAA,OAA4B,UAAU,EAAE,KAAK,CAAC;EAChD,CAAC;EACD,MAAM,gBAAgB,OAAOE,UAAuB,IAAI;EACxD,MAAM,UAAU,OAAO,SAAS,aAAa,MAAM,WAAW;EAC9D,mBAAmB,QAAQ,qBAAqB,OAAO,CAAC,IAAI,CAAC,QAAQ,gBAAgB;EAErF,OAAO,iBACL,UACA,eACA,OAJqBD,MAAmB;GAAE;GAAe;EAAK,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,cAI9DQ,YACnB,mEACF;EACA,OAAO,cAAc,UAAU,MAAM,QAAQ,kBAAkB,YAAY;CAC7E,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,iBAAiB,UAAU,YAAY,gBAAgB,CAAC,GACxE,OAAO,QAAQ,cAAc,QAAQ,CAAC,CACxC;AACF;AAEA,SAAS,oBACP,UACA,MACA,QACA;CACA,IAAI,UAAU;CACd,MAAM,QAAA,UAA4B,GAAG;EACnC,GAAG;EACH,cAAc,OAAO,GAAG,kCAAkC,CAAC,EAAE,QAAQ,WAAW;GAC9E,WAAW;GACX,OAAO,YAAY,IACf,SAAS,aAAa,QAAQ,MAAM,IACpC,OAAO,KACL,IAAIC,QAAkB;IACpB,SAAS;IACT,WAAW;IACX,YAAY,SAAS;GACvB,CAAC,CACH;EACN,CAAC;CACH,CAAC;CACD,MAAM,eAAe,CACnB,MAAM,MAAM,GAAG,OAAO,aAAa,GACnC,IAAI,MAAM,GAAG,OAAO,eAAe,WAAW,CAChD;CACA,IAAI,mBAA0C,CAAC;CAC/C,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,EAAE,SAAS,OAAOV,OAAoB;GAC1C;GACA,QAAA,OAA4B,UAAU,EAAE,KAAK,CAAC;EAChD,CAAC;EACD,MAAM,UAAU,OAAOC,MAAmB;GACxC,eAAe,OAAOC,UAAuB,IAAI;GACjD;EACF,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI;EACnB,mBACE,mBAAmBC,oBACf,kBAAkB,QAAQ,QAAQ,UAAU,IAC5C,CAAC;EACP,OAAO,iBACL,UACA,yBACA,mBAAmBA,qBAAkC,QAAQ,QAAQ,WAAW,WAAW,GAC3F,oFACF;EACA,IAAI,EAAE,mBAAmBA,oBAAiC;EAC1D,MAAM,WAAW,OAAOE,SAAgB;GAAE;GAAM,SAAS,QAAQ;EAAQ,CAAC,CAAC,CAAC,KAC1E,OAAO,QAAQ,cAAc,QAAQ,CAAC,CACxC;EACA,OAAOC,QAAe;GACpB,eAAe,OAAOC,YAAmB,QAAQ;GACjD,MAAM;EACR,CAAC,CAAC,CAAC,KAAK,OAAO,QAAQ,cAAc,QAAQ,CAAC,CAAC;EAC/C,OAAO,iBACL,UACA,yBACA,OAAO,gBAAgB,UAAU,MAAM,gBAAgB,GACvD,yDACF;CACF,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,iBAAiB,UAAU,YAAY,gBAAgB,CAAC,GACxE,OAAO,QAAQ,cAAc,KAAK,CAAC,CACrC;AACF;AAEA,SAAS,kBACP,YACuB;CACvB,OAAO,WAAW,SAAS,EAAE,uBAC3B,qBAAqB,OAAO,CAAC,IAAI,CAAC,gBAAgB,CACpD;AACF;AAEA,SAAS,gBACP,UACA,MACA,WACA;CACA,OAAO,OAAO,QAAQ,YAAY,qBAChC,SAAS,UAAU,MAAM,gBAAgB,CAC3C,CAAC,CAAC,KAAK,OAAO,KAAK,YAAY,QAAQ,OAAO,WAAW,WAAW,IAAI,CAAC,CAAC;AAC5E;AAEA,SAAS,iBACP,UACA,MACA,WACA;CACA,OAAO,OAAO,cACZ,OAAO,QACL,UAAU,IACT,qBAAqB,SAAS,aAAa,MAAM,gBAAgB,CAAC,CAAC,KAAK,OAAO,MAAM,GACtF,EAAE,SAAS,KAAK,CAClB,CACF;AACF;AAEA,SAAS,cAAc,UAAiC;CACtD,OAAO,MAAM,MAAM,MAAM,QAAQI,WAAqB,QAAQ,GAAGC,cAAqB;AACxF;AAEA,SAAS,mBAAmB,MAA6B,QAAgB;CACvE,OAAO,CAAC,MAAM,MAAM,GAAG,OAAO,QAAQ,GAAG,IAAI,MAAM,GAAG,OAAO,QAAQ,WAAW,CAAC;AACnF;AAEA,SAAS,MAAM,MAA6B,OAAe;CACzD,OAAOC,QAAgB;EACrB,MAAM;EACN,UAAU;GAAE,WAAW;GAAU,YAAY;GAAa,SAAS;EAAc;EACjF,MAAM,GAAG,MAAM,GAAG;EAClB,QAAQ;EACR,QAAQ;EACR,KAAK;CACP,CAAC;AACH;AAEA,SAAS,IAAI,MAA6B,OAAe,OAAe;CACtE,OAAOA,QAAgB;EACrB,MAAM;EACN,UAAU;GAAE,WAAW;GAAU,YAAY;GAAa,SAAS;EAAc;EACjF,MAAM,GAAG,MAAM,GAAG;EAClB,QAAQ;EACR,KAAK;EACL;CACF,CAAC;AACH;AAEA,SAAS,YACP,UACA,UACA,YACA,UACA;CACA,OAAO,iBACL,UACA,UACA,KAAK,UAAU,WAAW,KAAK,EAAE,WAAW,IAAI,CAAC,MAAM,KAAK,UAAU,QAAQ,GAC9E,uBAAuB,SAAS,KAAK,IAAI,GAC3C;AACF;AAEA,SAAS,iBACP,UACA,UACA,WACA,SACA;CACA,OAAO,YACH,OAAO,OACP,OAAO,KAAK,IAAI,MAAM;EAAE,MAAM;EAAU;EAAS,YAAY,SAAS;CAAG,CAAC,CAAC;AACjF;AAEA,SAAS,cACP,UACA,MACA,kBACA,UACA;CACA,OAAO,qBAAqB,OACxB,OAAO,KACL,IAAI,MAAM;EACR,MAAM;EACN,SAAS;EACT,YAAY,SAAS;CACvB,CAAC,CACH,IACA,SAAS,aAAa,MAAM,gBAAgB;AAClD"}

package/dist/{verify-DAtUAEeg.mjs → verify-DvGPb5C9.mjs}

@@ -1,12 +1,12 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { E as decode$5, O as parse$1, T as Schema$2, b as authorizationError, c as Evidence$1, f as AuthorizationError, k as Error$1, s as Service$1, u as codec, y as assertAttachment } from "./canonical-json-9x7gHIoS.mjs";
-import { n as Method$1, t as Error$2 } from "./connect-ks3cpqBD.mjs";
-import { $ as data, F as Service$3, I as fromAsync$1, P as Error$3, ct as candidates, et as decode$6, i as toAsync$5, n as Service$2, nt as equals, q as Opaque, t as Error$4, x as authorize$1, z as toAsync$4 } from "./resolver-DxJPsq6l.mjs";
+import { A as Error$1, D as decode$5, E as Schema$2, b as assertAttachment, c as Evidence$1, d as codec, k as parse$1, p as AuthorizationError, s as Service$1, x as authorizationError } from "./canonical-json-CQYKsZw7.mjs";
+import { n as Method$1, t as Error$2 } from "./connect-oI8hcMxc.mjs";
+import { C as authorize$1, I as Error$3, L as Service$3, R as fromAsync$1, V as toAsync$4, Y as Opaque, i as Service$2, it as equals, n as Error$4, nt as decode$6, o as toAsync$5, r as Resolution$1, tt as data, ut as candidates } from "./resolver-BeGz1ukw.mjs";
 import { Clock, Context, Crypto, Data, Effect, Layer, Option, Schema, SchemaIssue, SchemaTransformation } from "effect";
 import * as oauth from "oauth4webapi";
 import * as DnsPacket from "@leichtgewicht/dns-packet";
 //#region package.json
-var version = "0.6.0";
+var version = "0.8.0";
 //#endregion
 //#region src/auth/diagnostic.ts
 var diagnostic_exports = /* @__PURE__ */ __exportAll({
@@ -50,7 +50,7 @@ var manifest_exports = /* @__PURE__ */ __exportAll({
 	Schema: () => Schema$1,
 	decode: () => decode$4
 });
-const Method = Schema.TaggedUnion({
+const MethodSchema = Schema.TaggedUnion({
 	integration: {
 		capabilities: Schema.Array(Schema.Literals(["dns:read", "dns:write"])),
 		installUrl: Schema.String,
@@ -76,8 +76,15 @@ const Method = Schema.TaggedUnion({
 		instructionsUrl: Schema.String
 	}
 });
+/** Provider authentication method schema and constructors for trusted manifests. */
+const Method = {
+	Schema: MethodSchema,
+	integration: (input) => MethodSchema.cases.integration.make(input),
+	oauth2: (input) => MethodSchema.cases.oauth2.make(input),
+	token: (input) => MethodSchema.cases.token.make(input)
+};
 const Schema$1 = Schema.Struct({
-	methods: Schema.Array(Method),
+	methods: Schema.Array(Method.Schema),
 	providerId: Schema.String
 });
 const decode$4 = Effect.fn("ProviderAuth.decode")((input) => Schema.decodeUnknownEffect(Schema$1)(input).pipe(Effect.mapError((cause) => new Error$1({ message: cause.message }))));
@@ -123,7 +130,7 @@ const Evidence = Schema.Struct({
 	providerId: Schema.String,
 	zone: Schema$2
 });
-const Selection = Schema.TaggedUnion({
+const SelectionSchema = Schema.TaggedUnion({
 	selected: {
 		candidate: Evidence,
 		evidence: Schema.Array(Evidence),
@@ -134,6 +141,12 @@ const Selection = Schema.TaggedUnion({
 		reason: Schema.Literals(["ambiguous", "unsupported"])
 	}
 });
+/** Provider selection schema and constructors for trusted discovery results. */
+const Selection = {
+	Schema: SelectionSchema,
+	manual: (input) => SelectionSchema.cases.manual.make(input),
+	selected: (input) => SelectionSchema.cases.selected.make(input)
+};
 function select(input) {
 	const domain = parse$1(input.domain);
 	const zoneCandidates = new Set(candidates(domain));
@@ -162,25 +175,22 @@ function select(input) {
 		if (index < 0) throw authorizationError("Explicit provider zone is not connected for this domain", "ProviderDiscovery.select");
 		const candidate = evidence[index];
 		if (candidate === void 0) throw new Error("Eligible provider evidence is missing");
-		return {
-			_tag: "selected",
+		return Selection.selected({
 			candidate,
 			evidence,
 			reason: "explicit"
-		};
+		});
 	}
 	const decisive = evidence.filter(({ decisiveNameserverMatch }) => decisiveNameserverMatch);
 	const candidate = decisive[0];
-	return decisive.length === 1 && candidate !== void 0 ? {
-		_tag: "selected",
+	return decisive.length === 1 && candidate !== void 0 ? Selection.selected({
 		candidate,
 		evidence,
 		reason: "unique-nameserver-match"
-	} : {
-		_tag: "manual",
+	}) : Selection.manual({
 		evidence,
 		reason: decisive.length > 1 ? "ambiguous" : "unsupported"
-	};
+	});
 }
 function evidenceFor(connected, authoritative) {
 	const configured = new Set(nameserverSet(connected.nameservers));
@@ -518,7 +528,7 @@ const decode$3 = Effect.fn("CloudflareRecords.decode")((record) => Effect.gen(fu
 		default: return yield* decodeOpaque$1(record);
 	}
 }));
-const decodeOpaque$1 = Effect.fn("CloudflareRecords.decodeOpaque")((record) => Schema.decodeUnknownEffect(Opaque)({
+const decodeOpaque$1 = Effect.fn("CloudflareRecords.decodeOpaque")((record) => Schema.decodeUnknownEffect(Opaque.Schema)({
 	_tag: "Opaque",
 	name: record.name,
 	providerRecordId: record.id,
@@ -926,21 +936,19 @@ const Context$2 = Schema.Struct({
 const contextCodec$1 = codec("cloudflare.v1", Context$2);
 /** Describes Cloudflare's caller-created API-token authorization method. */
 function tokenMethod$1(capabilities) {
-	return {
-		_tag: "token",
+	return Method.token({
 		capabilities: [...capabilities],
 		instructionsUrl: "https://developers.cloudflare.com/fundamentals/api/get-started/create-token/"
-	};
+	});
 }
 /** Describes a registered Cloudflare OAuth client and its assigned scope IDs. */
 function oauthMethod(options) {
-	return {
-		_tag: "oauth2",
+	return Method.oauth2({
 		authorizationServer,
 		capabilities: [...options.capabilities],
 		clientAuth: options.clientAuth,
 		scopes: [...options.scopes]
-	};
+	});
 }
 /** Creates the Cloudflare token and OAuth authorization manifest. */
 function manifest$1(options) {
@@ -1322,7 +1330,7 @@ const decode$1 = Effect.fn("VercelRecords.decode")((zone, record) => Effect.gen(
 		default: return yield* decodeOpaque(record, name);
 	}
 }));
-const decodeOpaque = Effect.fn("VercelRecords.decodeOpaque")((record, name) => Schema.decodeUnknownEffect(Opaque)({
+const decodeOpaque = Effect.fn("VercelRecords.decodeOpaque")((record, name) => Schema.decodeUnknownEffect(Opaque.Schema)({
 	_tag: "Opaque",
 	name,
 	providerRecordId: record.id,
@@ -1395,9 +1403,18 @@ function failure$2(operation, message, fields = {}) {
 //#endregion
 //#region src/providers/vercel/client.ts
 var client_exports = /* @__PURE__ */ __exportAll({
+	AccountContext: () => AccountContext,
 	discovery: () => discovery,
 	make: () => make$4
 });
+/** Constructs the account scope used by Vercel API requests. */
+const AccountContext = {
+	personal: () => ({ _tag: "personal" }),
+	team: ({ teamId }) => ({
+		_tag: "team",
+		teamId
+	})
+};
 /** Exposes Vercel zone lookup as the optional provider discovery capability. */
 function discovery(client) {
 	return {
@@ -1719,20 +1736,18 @@ const Context$1 = Schema.TaggedUnion({
 const contextCodec = codec("vercel.v1", Context$1);
 /** Describes Vercel's caller-created personal access-token method. */
 function tokenMethod(capabilities) {
-	return {
-		_tag: "token",
+	return Method.token({
 		capabilities: [...capabilities],
 		instructionsUrl: "https://vercel.com/account/settings/tokens"
-	};
+	});
 }
 /** Describes Vercel's provider-specific integration installation flow. */
 function integrationMethod(options) {
-	return {
-		_tag: "integration",
+	return Method.integration({
 		capabilities: [...options.capabilities],
 		installUrl: `https://vercel.com/integrations/${encodeURIComponent(options.slug)}/new`,
 		tokenEndpoint: "https://api.vercel.com/v2/oauth/access_token"
-	};
+	});
 }
 /** Creates the Vercel token and integration authorization manifest. */
 function manifest(options) {
@@ -1773,10 +1788,7 @@ const exchangeCode = Effect.fn("VercelAuth.exchangeCode")((options) => Effect.ge
 	const token = yield* Schema.decodeUnknownEffect(IntegrationToken)(input).pipe(Effect.mapError((cause) => failure("exchangeCode", `Vercel token response did not match its API contract: ${cause.message}`, "response", response.status)));
 	return {
 		accessToken: make$6(token.access_token),
-		context: token.team_id === null ? { _tag: "personal" } : {
-			_tag: "team",
-			teamId: token.team_id
-		},
+		context: token.team_id === null ? AccountContext.personal() : AccountContext.team({ teamId: token.team_id }),
 		installationId: token.installation_id ?? options.configurationId ?? null,
 		userId: token.user_id
 	};
@@ -1859,10 +1871,7 @@ function restore(options) {
 			...options.baseUrl === void 0 ? {} : { baseUrl: options.baseUrl },
 			capabilities: options.authorization.capabilityEvidence.map(({ capability }) => capability),
 			...options.fetch === void 0 ? {} : { fetch: options.fetch },
-			context: context._tag === "team" ? {
-				_tag: "team",
-				teamId: context.teamId
-			} : { _tag: "personal" },
+			context: context._tag === "team" ? AccountContext.team({ teamId: context.teamId }) : AccountContext.personal(),
 			token: options.credential.accessToken
 		});
 	});
@@ -2039,18 +2048,15 @@ function decodeResolution(query, message) {
 	}).pipe(Effect.flatMap((packet) => validatePacket(query, packet)), Effect.flatMap(decodePacket));
 }
 function decodePacket(packet) {
-	if (packet.rcode === "NXDOMAIN") return Effect.succeed({ _tag: "nodata" });
+	if (packet.rcode === "NXDOMAIN") return Effect.succeed(Resolution$1.nodata());
 	if (packet.rcode !== "NOERROR") return Effect.fail(new Error$4({
 		message: `DNS resolver returned ${packet.rcode ?? "an unknown response code"}`,
 		reason: "response"
 	}));
-	if (packet.answers === void 0 || packet.answers.length === 0) return Effect.succeed({ _tag: "nodata" });
+	if (packet.answers === void 0 || packet.answers.length === 0) return Effect.succeed(Resolution$1.nodata());
 	return Effect.forEach(packet.answers, decodeAnswer, { concurrency: "unbounded" }).pipe(Effect.map((answers) => {
 		const supportedAnswers = answers.filter((answer) => answer !== null);
-		return supportedAnswers.length === 0 ? { _tag: "nodata" } : {
-			_tag: "answer",
-			answers: supportedAnswers
-		};
+		return supportedAnswers.length === 0 ? Resolution$1.nodata() : Resolution$1.answer({ answers: supportedAnswers });
 	}));
 }
 function validatePacket(query, packet) {
@@ -2391,6 +2397,6 @@ function recordValue(requirement) {
 	}
 }
 //#endregion
-export { manifest_exports as $, discovery as A, tokenMethod$1 as B, integrationFlow as C, tokenConnectionMethod as D, restore as E, oauthMethod as F, authorize as G, client_exports$1 as H, refreshCredential as I, selection_exports as J, connection_authorization_exports as K, restore$1 as L, auth_exports$1 as M, manifest$1 as N, tokenMethod as O, oauthFlow as P, decode$4 as Q, subjectResolver as R, exchangeCode as S, manifest as T, discovery$1 as U, tokenValidator as V, make$5 as W, Method as X, secret_exports as Y, Schema$1 as Z, toAsync$1 as _, Result as a, dns_data_exports as b, Observation as c, defaultMake as d, diagnostic_exports as et, make as f, cloudflare_doh_exports as g, toAsync as h, PublicDnsObservation as i, make$4 as j, client_exports as k, Policy as l, google_doh_exports as m, ProviderObservation as n, observe as o, resolver_pool_exports as p, session_exports as q, PublicDns as r, verify_exports as s, Provider as t, version as tt, Service as u, doh_exports as v, integrationMethod as w, auth_exports as x, toAsync$2 as y, tokenConnectionMethod$1 as z };
+export { decode$4 as $, client_exports as A, tokenConnectionMethod$1 as B, integrationFlow as C, tokenConnectionMethod as D, restore as E, oauthFlow as F, make$5 as G, tokenValidator as H, oauthMethod as I, session_exports as J, authorize as K, refreshCredential as L, make$4 as M, auth_exports$1 as N, tokenMethod as O, manifest$1 as P, Schema$1 as Q, restore$1 as R, exchangeCode as S, manifest as T, client_exports$1 as U, tokenMethod$1 as V, discovery$1 as W, secret_exports as X, selection_exports as Y, Method as Z, toAsync$1 as _, Result as a, dns_data_exports as b, Observation as c, defaultMake as d, manifest_exports as et, make as f, cloudflare_doh_exports as g, toAsync as h, PublicDnsObservation as i, discovery as j, AccountContext as k, Policy as l, google_doh_exports as m, ProviderObservation as n, version as nt, observe as o, resolver_pool_exports as p, connection_authorization_exports as q, PublicDns as r, verify_exports as s, Provider as t, diagnostic_exports as tt, Service as u, doh_exports as v, integrationMethod as w, auth_exports as x, toAsync$2 as y, subjectResolver as z };
 
-//# sourceMappingURL=verify-DAtUAEeg.mjs.map
+//# sourceMappingURL=verify-DvGPb5C9.mjs.map