domainkit 0.7.0 → 0.9.0

package/dist/internal/attempts.mjs

@@ -0,0 +1,284 @@
+import { isWithin } from "../DomainName.mjs";
+import { equals } from "../DnsRecord.mjs";
+import { Conflict, Delete, Model, PlanId, conflicts, writes } from "../Plan.mjs";
+import { Conflict as Conflict$1, Expired, InvalidInput, NotFound, Stale } from "../Reason.mjs";
+import { fail } from "./error.mjs";
+import { ApprovalId, Model as Model$1 } from "../Approval.mjs";
+import { fresh } from "./ids.mjs";
+import { Service } from "../Principal.mjs";
+import { Applied, Failed, Model as Model$2, ReceiptId, Skipped } from "../Receipt.mjs";
+import { Attempt } from "../Storage.mjs";
+import { digest, reconcile, requirements } from "./planner.mjs";
+import { DateTime, Duration, Effect } from "effect";
+//#region src/internal/attempts.ts
+const stale = (plan) => fail(new Stale({
+	planId: plan.id,
+	digest: plan.digest
+}));
+const expired = (entity, id) => fail(new Expired({
+	entity,
+	id
+}));
+const past = (at, now) => DateTime.toEpochMillis(at) <= DateTime.toEpochMillis(now);
+/** Every requirement must sit at or below the attached domain; other tenants share the zone. */
+const assertWithin = (attachment, records) => {
+	const outside = records.filter((record) => !isWithin(record.name, attachment.domain));
+	return outside.length === 0 ? Effect.void : fail(new InvalidInput({
+		message: `${outside.map(({ name }) => name).join(", ")} is outside the attached domain ${attachment.domain}`,
+		field: "requirements"
+	}));
+};
+/** Shared plan -> approve -> apply machinery for provisioning and cleanup attempts. */
+const make = (storage, connect, kind) => {
+	const providerOf = (attachment) => Effect.gen(function* () {
+		const connection = yield* storage.connections.get(attachment.connectionId);
+		return (yield* storage.authorizations.get(connection.authorizationId)).provider;
+	});
+	/** Persist a freshly built plan as a `planned` attempt. */
+	const record = (input) => Effect.gen(function* () {
+		const principal = yield* Service;
+		const provider = yield* providerOf(input.attachment);
+		const now = yield* DateTime.now;
+		const unsigned = {
+			version: "domainkit.plan.v2",
+			kind,
+			domain: input.attachment.domain,
+			zone: input.target.zone,
+			provider,
+			attachmentId: input.attachment.id,
+			operations: input.operations
+		};
+		const plan = new Model({
+			...unsigned,
+			id: PlanId.make(yield* fresh("plan")),
+			digest: yield* digest(unsigned),
+			createdAt: now,
+			expiresAt: DateTime.addDuration(now, Duration.millis(input.ttlMs))
+		});
+		yield* storage.attempts.create(new Attempt({
+			id: plan.id,
+			ownerId: principal.ownerId,
+			attachmentId: input.attachment.id,
+			kind,
+			status: "planned",
+			plan,
+			approval: null,
+			receipt: null,
+			rejection: null,
+			sourceReceiptId: input.sourceReceiptId,
+			leaseExpiresAt: null,
+			failure: null,
+			updatedAt: now
+		}));
+		return plan;
+	});
+	const attemptOf = (plan) => Effect.gen(function* () {
+		const attempt = yield* storage.attempts.get(typeof plan === "string" ? plan : plan.id);
+		if (attempt.kind !== kind) return yield* fail(new NotFound({
+			entity: "plan",
+			id: attempt.id
+		}));
+		if (typeof plan !== "string" && plan.digest !== attempt.plan.digest) return yield* stale(plan);
+		return attempt;
+	});
+	const approve = (plan, options = {}) => Effect.gen(function* () {
+		const attempt = yield* attemptOf(plan);
+		if (attempt.approval !== null) return attempt.approval;
+		const principal = yield* Service;
+		const now = yield* DateTime.now;
+		if (past(attempt.plan.expiresAt, now)) return yield* expired("plan", attempt.plan.id);
+		const writes$1 = writes(attempt.plan);
+		const writeIds = new Set(writes$1.map(({ id }) => id));
+		const selected = [...new Set(options.operationIds ?? writes$1.map(({ id }) => id))].sort();
+		const unknown = selected.filter((id) => !writeIds.has(id));
+		if (unknown.length > 0) return yield* fail(new InvalidInput({
+			message: `Operations ${unknown.join(", ")} are not writable in plan ${attempt.plan.id}`,
+			field: "operationIds"
+		}));
+		const conflicts$1 = conflicts(attempt.plan);
+		if (options.allowPartial !== true) {
+			if (conflicts$1.length > 0) return yield* fail(new Conflict$1({
+				planId: attempt.plan.id,
+				operations: conflicts$1
+			}));
+			if (selected.length !== writes$1.length) return yield* fail(new InvalidInput({
+				message: "Approving a subset of the plan requires allowPartial",
+				field: "operationIds"
+			}));
+		}
+		const approval = new Model$1({
+			id: ApprovalId.make(yield* fresh("apr")),
+			version: "domainkit.approval.v2",
+			kind,
+			planId: attempt.plan.id,
+			digest: attempt.plan.digest,
+			operationIds: selected,
+			approvedBy: principal.actorId,
+			approvedAt: now,
+			expiresAt: attempt.plan.expiresAt
+		});
+		return (yield* storage.attempts.approve(attempt.id, approval)).approval ?? approval;
+	});
+	/** Decline a planned attempt on behalf of the principal's actor. */
+	const reject = (plan, options = {}) => Effect.gen(function* () {
+		const attempt = yield* attemptOf(plan);
+		const principal = yield* Service;
+		return yield* storage.attempts.reject(attempt.id, {
+			digest: attempt.plan.digest,
+			actorId: principal.actorId,
+			reason: options.reason ?? null
+		});
+	});
+	const apply = (approval, policy) => Effect.gen(function* () {
+		const attempt = typeof approval === "string" ? yield* storage.attempts.byApproval(approval) : yield* attemptOf(approval.planId);
+		if (attempt.kind !== kind) return yield* fail(new NotFound({
+			entity: "approval",
+			id: typeof approval === "string" ? approval : approval.id
+		}));
+		const stored = attempt.approval;
+		if (stored === null || typeof approval !== "string" && stored.id !== approval.id) return yield* fail(new NotFound({
+			entity: "approval",
+			id: typeof approval === "string" ? approval : approval.id
+		}));
+		if (attempt.receipt !== null) return attempt.receipt;
+		const now = yield* DateTime.now;
+		if (past(stored.expiresAt, now)) return yield* expired("approval", stored.id);
+		const claimed = yield* storage.attempts.claim(attempt.id, DateTime.addDuration(now, Duration.millis(policy.applyLeaseMs)));
+		return yield* run(claimed, stored).pipe(Effect.tapError((error) => storage.attempts.fail(claimed.id, error.message).pipe(Effect.ignore)));
+	});
+	/** Writes under a claimed lease; a failure before any write releases the attempt as `failed`. */
+	const run = (attempt, approval) => Effect.gen(function* () {
+		const plan = attempt.plan;
+		const attachment = yield* storage.attachments.get(attempt.attachmentId);
+		const { session, target } = yield* connect.session(attachment.id);
+		const dns = session.dns(target);
+		yield* revalidate(plan, dns, target.zone);
+		const approved = new Set(approval.operationIds);
+		const outcomes = [];
+		const applied = [];
+		let stopped = false;
+		const finish = (status) => Effect.gen(function* () {
+			const receipt = new Model$2({
+				id: ReceiptId.make(yield* fresh("rcpt")),
+				version: "domainkit.receipt.v2",
+				kind,
+				planId: plan.id,
+				approvalId: approval.id,
+				digest: plan.digest,
+				provider: plan.provider,
+				zone: plan.zone,
+				status,
+				outcomes: [...outcomes],
+				appliedAt: yield* DateTime.now
+			});
+			yield* storage.attempts.complete(attempt.id, receipt);
+			return receipt;
+		});
+		return yield* Effect.gen(function* () {
+			for (const operation of plan.operations) {
+				if (operation._tag === "Noop") {
+					outcomes.push(new Skipped({
+						operationId: operation.id,
+						reason: "noop"
+					}));
+					continue;
+				}
+				if (operation._tag === "Conflict" || !approved.has(operation.id)) {
+					outcomes.push(new Skipped({
+						operationId: operation.id,
+						reason: "not-approved"
+					}));
+					continue;
+				}
+				if (stopped) {
+					outcomes.push(new Skipped({
+						operationId: operation.id,
+						reason: "not-attempted"
+					}));
+					continue;
+				}
+				const result = yield* write(plan, operation, dns, target.zone).pipe(Effect.result);
+				if (result._tag === "Success") {
+					const outcome = new Applied({
+						operationId: operation.id,
+						providerRecordId: result.success
+					});
+					outcomes.push(outcome);
+					applied.push(outcome);
+					continue;
+				}
+				if (applied.length === 0) return yield* Effect.fail(result.failure);
+				stopped = true;
+				outcomes.push(new Failed({
+					operationId: operation.id,
+					message: result.failure.message
+				}));
+			}
+			return yield* finish(stopped ? "partial" : "complete");
+		}).pipe(Effect.onInterrupt(() => applied.length === 0 ? Effect.void : Effect.gen(function* () {
+			for (const operation of plan.operations) {
+				if (outcomes.some((outcome) => outcome.operationId === operation.id)) continue;
+				outcomes.push(new Skipped({
+					operationId: operation.id,
+					reason: "not-attempted"
+				}));
+			}
+			yield* finish("partial");
+		}).pipe(Effect.ignore)));
+	});
+	/** Re-plan the zone and fail `Stale` when the digest moved since the plan was built. */
+	const revalidate = (plan, dns, zone) => Effect.gen(function* () {
+		const current = yield* currentOperations(plan, dns, zone);
+		if ((yield* digest({
+			version: plan.version,
+			kind: plan.kind,
+			domain: plan.domain,
+			zone: plan.zone,
+			provider: plan.provider,
+			attachmentId: plan.attachmentId,
+			operations: current
+		})) !== plan.digest) return yield* stale(plan);
+	});
+	const currentOperations = (plan, dns, zone) => kind === "provisioning" ? Effect.flatMap(dns.list(zone), (observed) => reconcile(requirements(plan), observed.map(({ record: observedRecord }) => observedRecord))) : Effect.forEach(plan.operations, (operation) => operation._tag === "Delete" ? cleanupOperation(dns, zone, operation.id, operation.record, operation.providerRecordId) : Effect.succeed(operation));
+	const write = (plan, operation, dns, zone) => operation._tag === "Create" ? Effect.gen(function* () {
+		const observed = yield* dns.list(zone);
+		const [check] = yield* reconcile([operation.record], observed.map(({ record: observedRecord }) => observedRecord));
+		if (check?._tag !== "Create") return yield* stale(plan);
+		return (yield* dns.create(zone, operation.record)).providerRecordId;
+	}) : Effect.gen(function* () {
+		if ((yield* cleanupOperation(dns, zone, operation.id, operation.record, operation.providerRecordId))._tag !== "Delete") return yield* stale(plan);
+		yield* dns.delete(zone, operation.providerRecordId);
+		return operation.providerRecordId;
+	});
+	return {
+		record,
+		approve,
+		reject,
+		apply,
+		attemptOf
+	};
+};
+/** Read one receipt-proven record back; anything but an exact match is a conflict. */
+const cleanupOperation = (dns, zone, id, record, providerRecordId) => Effect.map(dns.get(zone, providerRecordId), (observed) => {
+	if (observed === null) return new Conflict({
+		id,
+		record,
+		existing: [],
+		reason: "missing"
+	});
+	if (!equals(observed, record)) return new Conflict({
+		id,
+		record,
+		existing: [observed],
+		reason: "value-mismatch"
+	});
+	return new Delete({
+		id,
+		record,
+		providerRecordId
+	});
+});
+//#endregion
+export { assertWithin, cleanupOperation, make };
+
+//# sourceMappingURL=attempts.mjs.map

package/dist/internal/attempts.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"attempts.mjs","names":["Errors.fail","Reason.Stale","Reason.Expired","DomainName.isWithin","Reason.InvalidInput","Principal.Service","Plan.Model","Planner.digest","Storage.Attempt","Reason.NotFound","writes","Plan.writes","conflicts","Plan.conflicts","Reason.Conflict","Approval.Model","Receipt.Model","Receipt.Skipped","Receipt.Applied","Receipt.Failed","Planner.reconcile","Planner.requirements","Plan.Conflict","DnsRecord.equals","Plan.Delete"],"sources":["../../src/internal/attempts.ts"],"sourcesContent":["import { DateTime, Duration, Effect } from \"effect\";\n\nimport * as Approval from \"../Approval.ts\";\nimport * as Connect from \"../Connect.ts\";\nimport * as DnsRecord from \"../DnsRecord.ts\";\nimport * as Errors from \"./error.ts\";\nimport * as Reason from \"../Reason.ts\";\nimport * as DomainName from \"../DomainName.ts\";\nimport * as Plan from \"../Plan.ts\";\nimport * as Principal from \"../Principal.ts\";\nimport type * as Provider from \"../Provider.ts\";\nimport * as Receipt from \"../Receipt.ts\";\nimport * as Storage from \"../Storage.ts\";\nimport { fresh } from \"./ids.ts\";\nimport * as Planner from \"./planner.ts\";\n\ntype Fx<A> = Effect.Effect<A, Errors.DomainKitError, Principal.Service>;\n\nexport interface ApproveOptions {\n  readonly operationIds?: ReadonlyArray<Plan.OperationId>;\n  readonly allowPartial?: boolean;\n}\n\nexport interface PolicyShape {\n  readonly planTtlMs: number;\n  readonly applyLeaseMs: number;\n}\n\nconst stale = (plan: Plan.Model) =>\n  Errors.fail(new Reason.Stale({ planId: plan.id, digest: plan.digest }));\n\nconst expired = (entity: \"plan\" | \"approval\", id: string) =>\n  Errors.fail(new Reason.Expired({ entity, id }));\n\nconst past = (at: DateTime.Utc, now: DateTime.Utc) =>\n  DateTime.toEpochMillis(at) <= DateTime.toEpochMillis(now);\n\n/** Every requirement must sit at or below the attached domain; other tenants share the zone. */\nexport const assertWithin = (\n  attachment: Storage.Attachment,\n  records: ReadonlyArray<DnsRecord.Model>,\n): Effect.Effect<void, Errors.DomainKitError> => {\n  const outside = records.filter((record) => !DomainName.isWithin(record.name, attachment.domain));\n  return outside.length === 0\n    ? Effect.void\n    : Errors.fail(\n        new Reason.InvalidInput({\n          message: `${outside.map(({ name }) => name).join(\", \")} is outside the attached domain ${attachment.domain}`,\n          field: \"requirements\",\n        }),\n      );\n};\n\n/** Shared plan -> approve -> apply machinery for provisioning and cleanup attempts. */\nexport const make = (storage: Storage.Interface, connect: Connect.Interface, kind: Plan.Kind) => {\n  const providerOf = (attachment: Storage.Attachment) =>\n    Effect.gen(function* () {\n      const connection = yield* storage.connections.get(attachment.connectionId);\n      const authorization = yield* storage.authorizations.get(connection.authorizationId);\n      return authorization.provider;\n    });\n\n  /** Persist a freshly built plan as a `planned` attempt. */\n  const record = (input: {\n    readonly attachment: Storage.Attachment;\n    readonly target: Provider.Target;\n    readonly operations: ReadonlyArray<Plan.Operation>;\n    readonly ttlMs: number;\n    readonly sourceReceiptId: Receipt.ReceiptId | null;\n  }): Fx<Plan.Model> =>\n    Effect.gen(function* () {\n      const principal = yield* Principal.Service;\n      const provider = yield* providerOf(input.attachment);\n      const now = yield* DateTime.now;\n      const unsigned: Planner.Unsigned = {\n        version: \"domainkit.plan.v2\",\n        kind,\n        domain: input.attachment.domain,\n        zone: input.target.zone,\n        provider,\n        attachmentId: input.attachment.id,\n        operations: input.operations,\n      };\n      const plan = new Plan.Model({\n        ...unsigned,\n        id: Plan.PlanId.make(yield* fresh(\"plan\")),\n        digest: yield* Planner.digest(unsigned),\n        createdAt: now,\n        expiresAt: DateTime.addDuration(now, Duration.millis(input.ttlMs)),\n      });\n      yield* storage.attempts.create(\n        new Storage.Attempt({\n          id: plan.id,\n          ownerId: principal.ownerId,\n          attachmentId: input.attachment.id,\n          kind,\n          status: \"planned\",\n          plan,\n          approval: null,\n          receipt: null,\n          rejection: null,\n          sourceReceiptId: input.sourceReceiptId,\n          leaseExpiresAt: null,\n          failure: null,\n          updatedAt: now,\n        }),\n      );\n      return plan;\n    });\n\n  const attemptOf = (plan: Plan.Model | Plan.PlanId): Fx<Storage.Attempt> =>\n    Effect.gen(function* () {\n      const attempt = yield* storage.attempts.get(typeof plan === \"string\" ? plan : plan.id);\n      if (attempt.kind !== kind) {\n        return yield* Errors.fail(new Reason.NotFound({ entity: \"plan\", id: attempt.id }));\n      }\n      if (typeof plan !== \"string\" && plan.digest !== attempt.plan.digest)\n        return yield* stale(plan);\n      return attempt;\n    });\n\n  const approve = (\n    plan: Plan.Model | Plan.PlanId,\n    options: ApproveOptions = {},\n  ): Fx<Approval.Model> =>\n    Effect.gen(function* () {\n      const attempt = yield* attemptOf(plan);\n      if (attempt.approval !== null) return attempt.approval;\n      const principal = yield* Principal.Service;\n      const now = yield* DateTime.now;\n      if (past(attempt.plan.expiresAt, now)) return yield* expired(\"plan\", attempt.plan.id);\n      const writes = Plan.writes(attempt.plan);\n      const writeIds = new Set(writes.map(({ id }) => id));\n      const selected = [...new Set(options.operationIds ?? writes.map(({ id }) => id))].sort();\n      const unknown = selected.filter((id) => !writeIds.has(id));\n      if (unknown.length > 0) {\n        return yield* Errors.fail(\n          new Reason.InvalidInput({\n            message: `Operations ${unknown.join(\", \")} are not writable in plan ${attempt.plan.id}`,\n            field: \"operationIds\",\n          }),\n        );\n      }\n      const conflicts = Plan.conflicts(attempt.plan);\n      if (options.allowPartial !== true) {\n        if (conflicts.length > 0) {\n          return yield* Errors.fail(\n            new Reason.Conflict({ planId: attempt.plan.id, operations: conflicts }),\n          );\n        }\n        if (selected.length !== writes.length) {\n          return yield* Errors.fail(\n            new Reason.InvalidInput({\n              message: \"Approving a subset of the plan requires allowPartial\",\n              field: \"operationIds\",\n            }),\n          );\n        }\n      }\n      const approval = new Approval.Model({\n        id: Approval.ApprovalId.make(yield* fresh(\"apr\")),\n        version: \"domainkit.approval.v2\",\n        kind,\n        planId: attempt.plan.id,\n        digest: attempt.plan.digest,\n        operationIds: selected,\n        approvedBy: principal.actorId,\n        approvedAt: now,\n        expiresAt: attempt.plan.expiresAt,\n      });\n      const stored = yield* storage.attempts.approve(attempt.id, approval);\n      return stored.approval ?? approval;\n    });\n\n  /** Decline a planned attempt on behalf of the principal's actor. */\n  const reject = (\n    plan: Plan.Model | Plan.PlanId,\n    options: { readonly reason?: string } = {},\n  ): Fx<Storage.Attempt> =>\n    Effect.gen(function* () {\n      const attempt = yield* attemptOf(plan);\n      const principal = yield* Principal.Service;\n      return yield* storage.attempts.reject(attempt.id, {\n        digest: attempt.plan.digest,\n        actorId: principal.actorId,\n        reason: options.reason ?? null,\n      });\n    });\n\n  const apply = (\n    approval: Approval.Model | Approval.ApprovalId,\n    policy: PolicyShape,\n  ): Fx<Receipt.Model> =>\n    Effect.gen(function* () {\n      const attempt =\n        typeof approval === \"string\"\n          ? yield* storage.attempts.byApproval(approval)\n          : yield* attemptOf(approval.planId);\n      if (attempt.kind !== kind) {\n        return yield* Errors.fail(\n          new Reason.NotFound({\n            entity: \"approval\",\n            id: typeof approval === \"string\" ? approval : approval.id,\n          }),\n        );\n      }\n      const stored = attempt.approval;\n      if (stored === null || (typeof approval !== \"string\" && stored.id !== approval.id)) {\n        return yield* Errors.fail(\n          new Reason.NotFound({\n            entity: \"approval\",\n            id: typeof approval === \"string\" ? approval : approval.id,\n          }),\n        );\n      }\n      if (attempt.receipt !== null) return attempt.receipt;\n      const now = yield* DateTime.now;\n      if (past(stored.expiresAt, now)) return yield* expired(\"approval\", stored.id);\n      const claimed = yield* storage.attempts.claim(\n        attempt.id,\n        DateTime.addDuration(now, Duration.millis(policy.applyLeaseMs)),\n      );\n      return yield* run(claimed, stored).pipe(\n        Effect.tapError((error) =>\n          storage.attempts.fail(claimed.id, error.message).pipe(Effect.ignore),\n        ),\n      );\n    });\n\n  /** Writes under a claimed lease; a failure before any write releases the attempt as `failed`. */\n  const run = (attempt: Storage.Attempt, approval: Approval.Model): Fx<Receipt.Model> =>\n    Effect.gen(function* () {\n      const plan = attempt.plan;\n      const attachment = yield* storage.attachments.get(attempt.attachmentId);\n      const { session, target } = yield* connect.session(attachment.id);\n      const dns = session.dns(target);\n      yield* revalidate(plan, dns, target.zone);\n      const approved = new Set(approval.operationIds);\n      const outcomes: Array<Receipt.Outcome> = [];\n      const applied: Array<Receipt.Applied> = [];\n      let stopped = false;\n      const finish = (status: \"complete\" | \"partial\") =>\n        Effect.gen(function* () {\n          const receipt = new Receipt.Model({\n            id: Receipt.ReceiptId.make(yield* fresh(\"rcpt\")),\n            version: \"domainkit.receipt.v2\",\n            kind,\n            planId: plan.id,\n            approvalId: approval.id,\n            digest: plan.digest,\n            provider: plan.provider,\n            zone: plan.zone,\n            status,\n            outcomes: [...outcomes],\n            appliedAt: yield* DateTime.now,\n          });\n          yield* storage.attempts.complete(attempt.id, receipt);\n          return receipt;\n        });\n      const writes = Effect.gen(function* () {\n        for (const operation of plan.operations) {\n          if (operation._tag === \"Noop\") {\n            outcomes.push(new Receipt.Skipped({ operationId: operation.id, reason: \"noop\" }));\n            continue;\n          }\n          if (operation._tag === \"Conflict\" || !approved.has(operation.id)) {\n            outcomes.push(\n              new Receipt.Skipped({ operationId: operation.id, reason: \"not-approved\" }),\n            );\n            continue;\n          }\n          if (stopped) {\n            outcomes.push(\n              new Receipt.Skipped({ operationId: operation.id, reason: \"not-attempted\" }),\n            );\n            continue;\n          }\n          const result = yield* write(plan, operation, dns, target.zone).pipe(Effect.result);\n          if (result._tag === \"Success\") {\n            const outcome = new Receipt.Applied({\n              operationId: operation.id,\n              providerRecordId: result.success,\n            });\n            outcomes.push(outcome);\n            applied.push(outcome);\n            continue;\n          }\n          if (applied.length === 0) return yield* Effect.fail(result.failure);\n          stopped = true;\n          outcomes.push(\n            new Receipt.Failed({ operationId: operation.id, message: result.failure.message }),\n          );\n        }\n        return yield* finish(stopped ? \"partial\" : \"complete\");\n      });\n      return yield* writes.pipe(\n        Effect.onInterrupt(() =>\n          applied.length === 0\n            ? Effect.void\n            : Effect.gen(function* () {\n                for (const operation of plan.operations) {\n                  if (outcomes.some((outcome) => outcome.operationId === operation.id)) continue;\n                  outcomes.push(\n                    new Receipt.Skipped({ operationId: operation.id, reason: \"not-attempted\" }),\n                  );\n                }\n                yield* finish(\"partial\");\n              }).pipe(Effect.ignore),\n        ),\n      );\n    });\n\n  /** Re-plan the zone and fail `Stale` when the digest moved since the plan was built. */\n  const revalidate = (plan: Plan.Model, dns: Provider.Dns, zone: string) =>\n    Effect.gen(function* () {\n      const current = yield* currentOperations(plan, dns, zone);\n      const digest = yield* Planner.digest({\n        version: plan.version,\n        kind: plan.kind,\n        domain: plan.domain,\n        zone: plan.zone,\n        provider: plan.provider,\n        attachmentId: plan.attachmentId,\n        operations: current,\n      });\n      if (digest !== plan.digest) return yield* stale(plan);\n    });\n\n  const currentOperations = (\n    plan: Plan.Model,\n    dns: Provider.Dns,\n    zone: string,\n  ): Effect.Effect<ReadonlyArray<Plan.Operation>, Errors.DomainKitError> =>\n    kind === \"provisioning\"\n      ? Effect.flatMap(dns.list(zone), (observed) =>\n          Planner.reconcile(\n            Planner.requirements(plan),\n            observed.map(({ record: observedRecord }) => observedRecord),\n          ),\n        )\n      : Effect.forEach(\n          plan.operations,\n          (operation): Effect.Effect<Plan.Operation, Errors.DomainKitError> =>\n            operation._tag === \"Delete\"\n              ? cleanupOperation(\n                  dns,\n                  zone,\n                  operation.id,\n                  operation.record,\n                  operation.providerRecordId,\n                )\n              : Effect.succeed(operation),\n        );\n\n  const write = (\n    plan: Plan.Model,\n    operation: Plan.Create | Plan.Delete,\n    dns: Provider.Dns,\n    zone: string,\n  ): Effect.Effect<string, Errors.DomainKitError> =>\n    operation._tag === \"Create\"\n      ? Effect.gen(function* () {\n          const observed = yield* dns.list(zone);\n          const [check] = yield* Planner.reconcile(\n            [operation.record],\n            observed.map(({ record: observedRecord }) => observedRecord),\n          );\n          if (check?._tag !== \"Create\") return yield* stale(plan);\n          const created = yield* dns.create(zone, operation.record);\n          return created.providerRecordId;\n        })\n      : Effect.gen(function* () {\n          const check = yield* cleanupOperation(\n            dns,\n            zone,\n            operation.id,\n            operation.record,\n            operation.providerRecordId,\n          );\n          if (check._tag !== \"Delete\") return yield* stale(plan);\n          yield* dns.delete(zone, operation.providerRecordId);\n          return operation.providerRecordId;\n        });\n\n  return { record, approve, reject, apply, attemptOf };\n};\n\n/** Read one receipt-proven record back; anything but an exact match is a conflict. */\nexport const cleanupOperation = (\n  dns: Provider.Dns,\n  zone: string,\n  id: Plan.OperationId,\n  record: DnsRecord.Model,\n  providerRecordId: string,\n): Effect.Effect<Plan.Delete | Plan.Conflict, Errors.DomainKitError> =>\n  Effect.map(dns.get(zone, providerRecordId), (observed) => {\n    if (observed === null)\n      return new Plan.Conflict({ id, record, existing: [], reason: \"missing\" });\n    if (!DnsRecord.equals(observed, record)) {\n      return new Plan.Conflict({ id, record, existing: [observed], reason: \"value-mismatch\" });\n    }\n    return new Plan.Delete({ id, record, providerRecordId });\n  });\n"],"mappings":";;;;;;;;;;;;;AA4BA,MAAM,SAAS,SACbA,KAAY,IAAIC,MAAa;CAAE,QAAQ,KAAK;CAAI,QAAQ,KAAK;AAAO,CAAC,CAAC;AAExE,MAAM,WAAW,QAA6B,OAC5CD,KAAY,IAAIE,QAAe;CAAE;CAAQ;AAAG,CAAC,CAAC;AAEhD,MAAM,QAAQ,IAAkB,QAC9B,SAAS,cAAc,EAAE,KAAK,SAAS,cAAc,GAAG;;AAG1D,MAAa,gBACX,YACA,YAC+C;CAC/C,MAAM,UAAU,QAAQ,QAAQ,WAAW,CAACC,SAAoB,OAAO,MAAM,WAAW,MAAM,CAAC;CAC/F,OAAO,QAAQ,WAAW,IACtB,OAAO,OACPH,KACE,IAAII,aAAoB;EACtB,SAAS,GAAG,QAAQ,KAAK,EAAE,WAAW,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,kCAAkC,WAAW;EACpG,OAAO;CACT,CAAC,CACH;AACN;;AAGA,MAAa,QAAQ,SAA4B,SAA4B,SAAoB;CAC/F,MAAM,cAAc,eAClB,OAAO,IAAI,aAAa;EACtB,MAAM,aAAa,OAAO,QAAQ,YAAY,IAAI,WAAW,YAAY;EAEzE,QAAO,OADsB,QAAQ,eAAe,IAAI,WAAW,eAAe,EAAA,CAC7D;CACvB,CAAC;;CAGH,MAAM,UAAU,UAOd,OAAO,IAAI,aAAa;EACtB,MAAM,YAAY,OAAOC;EACzB,MAAM,WAAW,OAAO,WAAW,MAAM,UAAU;EACnD,MAAM,MAAM,OAAO,SAAS;EAC5B,MAAM,WAA6B;GACjC,SAAS;GACT;GACA,QAAQ,MAAM,WAAW;GACzB,MAAM,MAAM,OAAO;GACnB;GACA,cAAc,MAAM,WAAW;GAC/B,YAAY,MAAM;EACpB;EACA,MAAM,OAAO,IAAIC,MAAW;GAC1B,GAAG;GACH,IAAA,OAAgB,KAAK,OAAO,MAAM,MAAM,CAAC;GACzC,QAAQ,OAAOC,OAAe,QAAQ;GACtC,WAAW;GACX,WAAW,SAAS,YAAY,KAAK,SAAS,OAAO,MAAM,KAAK,CAAC;EACnE,CAAC;EACD,OAAO,QAAQ,SAAS,OACtB,IAAIC,QAAgB;GAClB,IAAI,KAAK;GACT,SAAS,UAAU;GACnB,cAAc,MAAM,WAAW;GAC/B;GACA,QAAQ;GACR;GACA,UAAU;GACV,SAAS;GACT,WAAW;GACX,iBAAiB,MAAM;GACvB,gBAAgB;GAChB,SAAS;GACT,WAAW;EACb,CAAC,CACH;EACA,OAAO;CACT,CAAC;CAEH,MAAM,aAAa,SACjB,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,QAAQ,SAAS,IAAI,OAAO,SAAS,WAAW,OAAO,KAAK,EAAE;EACrF,IAAI,QAAQ,SAAS,MACnB,OAAO,OAAOR,KAAY,IAAIS,SAAgB;GAAE,QAAQ;GAAQ,IAAI,QAAQ;EAAG,CAAC,CAAC;EAEnF,IAAI,OAAO,SAAS,YAAY,KAAK,WAAW,QAAQ,KAAK,QAC3D,OAAO,OAAO,MAAM,IAAI;EAC1B,OAAO;CACT,CAAC;CAEH,MAAM,WACJ,MACA,UAA0B,CAAC,MAE3B,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,UAAU,IAAI;EACrC,IAAI,QAAQ,aAAa,MAAM,OAAO,QAAQ;EAC9C,MAAM,YAAY,OAAOJ;EACzB,MAAM,MAAM,OAAO,SAAS;EAC5B,IAAI,KAAK,QAAQ,KAAK,WAAW,GAAG,GAAG,OAAO,OAAO,QAAQ,QAAQ,QAAQ,KAAK,EAAE;EACpF,MAAMK,WAASC,OAAY,QAAQ,IAAI;EACvC,MAAM,WAAW,IAAI,IAAID,SAAO,KAAK,EAAE,SAAS,EAAE,CAAC;EACnD,MAAM,WAAW,CAAC,GAAG,IAAI,IAAI,QAAQ,gBAAgBA,SAAO,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK;EACvF,MAAM,UAAU,SAAS,QAAQ,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;EACzD,IAAI,QAAQ,SAAS,GACnB,OAAO,OAAOV,KACZ,IAAII,aAAoB;GACtB,SAAS,cAAc,QAAQ,KAAK,IAAI,EAAE,4BAA4B,QAAQ,KAAK;GACnF,OAAO;EACT,CAAC,CACH;EAEF,MAAMQ,cAAYC,UAAe,QAAQ,IAAI;EAC7C,IAAI,QAAQ,iBAAiB,MAAM;GACjC,IAAID,YAAU,SAAS,GACrB,OAAO,OAAOZ,KACZ,IAAIc,WAAgB;IAAE,QAAQ,QAAQ,KAAK;IAAI,YAAYF;GAAU,CAAC,CACxE;GAEF,IAAI,SAAS,WAAWF,SAAO,QAC7B,OAAO,OAAOV,KACZ,IAAII,aAAoB;IACtB,SAAS;IACT,OAAO;GACT,CAAC,CACH;EAEJ;EACA,MAAM,WAAW,IAAIW,QAAe;GAClC,IAAA,WAAwB,KAAK,OAAO,MAAM,KAAK,CAAC;GAChD,SAAS;GACT;GACA,QAAQ,QAAQ,KAAK;GACrB,QAAQ,QAAQ,KAAK;GACrB,cAAc;GACd,YAAY,UAAU;GACtB,YAAY;GACZ,WAAW,QAAQ,KAAK;EAC1B,CAAC;EAED,QAAO,OADe,QAAQ,SAAS,QAAQ,QAAQ,IAAI,QAAQ,EAAA,CACrD,YAAY;CAC5B,CAAC;;CAGH,MAAM,UACJ,MACA,UAAwC,CAAC,MAEzC,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,UAAU,IAAI;EACrC,MAAM,YAAY,OAAOV;EACzB,OAAO,OAAO,QAAQ,SAAS,OAAO,QAAQ,IAAI;GAChD,QAAQ,QAAQ,KAAK;GACrB,SAAS,UAAU;GACnB,QAAQ,QAAQ,UAAU;EAC5B,CAAC;CACH,CAAC;CAEH,MAAM,SACJ,UACA,WAEA,OAAO,IAAI,aAAa;EACtB,MAAM,UACJ,OAAO,aAAa,WAChB,OAAO,QAAQ,SAAS,WAAW,QAAQ,IAC3C,OAAO,UAAU,SAAS,MAAM;EACtC,IAAI,QAAQ,SAAS,MACnB,OAAO,OAAOL,KACZ,IAAIS,SAAgB;GAClB,QAAQ;GACR,IAAI,OAAO,aAAa,WAAW,WAAW,SAAS;EACzD,CAAC,CACH;EAEF,MAAM,SAAS,QAAQ;EACvB,IAAI,WAAW,QAAS,OAAO,aAAa,YAAY,OAAO,OAAO,SAAS,IAC7E,OAAO,OAAOT,KACZ,IAAIS,SAAgB;GAClB,QAAQ;GACR,IAAI,OAAO,aAAa,WAAW,WAAW,SAAS;EACzD,CAAC,CACH;EAEF,IAAI,QAAQ,YAAY,MAAM,OAAO,QAAQ;EAC7C,MAAM,MAAM,OAAO,SAAS;EAC5B,IAAI,KAAK,OAAO,WAAW,GAAG,GAAG,OAAO,OAAO,QAAQ,YAAY,OAAO,EAAE;EAC5E,MAAM,UAAU,OAAO,QAAQ,SAAS,MACtC,QAAQ,IACR,SAAS,YAAY,KAAK,SAAS,OAAO,OAAO,YAAY,CAAC,CAChE;EACA,OAAO,OAAO,IAAI,SAAS,MAAM,CAAC,CAAC,KACjC,OAAO,UAAU,UACf,QAAQ,SAAS,KAAK,QAAQ,IAAI,MAAM,OAAO,CAAC,CAAC,KAAK,OAAO,MAAM,CACrE,CACF;CACF,CAAC;;CAGH,MAAM,OAAO,SAA0B,aACrC,OAAO,IAAI,aAAa;EACtB,MAAM,OAAO,QAAQ;EACrB,MAAM,aAAa,OAAO,QAAQ,YAAY,IAAI,QAAQ,YAAY;EACtE,MAAM,EAAE,SAAS,WAAW,OAAO,QAAQ,QAAQ,WAAW,EAAE;EAChE,MAAM,MAAM,QAAQ,IAAI,MAAM;EAC9B,OAAO,WAAW,MAAM,KAAK,OAAO,IAAI;EACxC,MAAM,WAAW,IAAI,IAAI,SAAS,YAAY;EAC9C,MAAM,WAAmC,CAAC;EAC1C,MAAM,UAAkC,CAAC;EACzC,IAAI,UAAU;EACd,MAAM,UAAU,WACd,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,IAAIO,QAAc;IAChC,IAAA,UAAsB,KAAK,OAAO,MAAM,MAAM,CAAC;IAC/C,SAAS;IACT;IACA,QAAQ,KAAK;IACb,YAAY,SAAS;IACrB,QAAQ,KAAK;IACb,UAAU,KAAK;IACf,MAAM,KAAK;IACX;IACA,UAAU,CAAC,GAAG,QAAQ;IACtB,WAAW,OAAO,SAAS;GAC7B,CAAC;GACD,OAAO,QAAQ,SAAS,SAAS,QAAQ,IAAI,OAAO;GACpD,OAAO;EACT,CAAC;EAqCH,OAAO,OApCQ,OAAO,IAAI,aAAa;GACrC,KAAK,MAAM,aAAa,KAAK,YAAY;IACvC,IAAI,UAAU,SAAS,QAAQ;KAC7B,SAAS,KAAK,IAAIC,QAAgB;MAAE,aAAa,UAAU;MAAI,QAAQ;KAAO,CAAC,CAAC;KAChF;IACF;IACA,IAAI,UAAU,SAAS,cAAc,CAAC,SAAS,IAAI,UAAU,EAAE,GAAG;KAChE,SAAS,KACP,IAAIA,QAAgB;MAAE,aAAa,UAAU;MAAI,QAAQ;KAAe,CAAC,CAC3E;KACA;IACF;IACA,IAAI,SAAS;KACX,SAAS,KACP,IAAIA,QAAgB;MAAE,aAAa,UAAU;MAAI,QAAQ;KAAgB,CAAC,CAC5E;KACA;IACF;IACA,MAAM,SAAS,OAAO,MAAM,MAAM,WAAW,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK,OAAO,MAAM;IACjF,IAAI,OAAO,SAAS,WAAW;KAC7B,MAAM,UAAU,IAAIC,QAAgB;MAClC,aAAa,UAAU;MACvB,kBAAkB,OAAO;KAC3B,CAAC;KACD,SAAS,KAAK,OAAO;KACrB,QAAQ,KAAK,OAAO;KACpB;IACF;IACA,IAAI,QAAQ,WAAW,GAAG,OAAO,OAAO,OAAO,KAAK,OAAO,OAAO;IAClE,UAAU;IACV,SAAS,KACP,IAAIC,OAAe;KAAE,aAAa,UAAU;KAAI,SAAS,OAAO,QAAQ;IAAQ,CAAC,CACnF;GACF;GACA,OAAO,OAAO,OAAO,UAAU,YAAY,UAAU;EACvD,CACmB,CAAC,CAAC,KACnB,OAAO,kBACL,QAAQ,WAAW,IACf,OAAO,OACP,OAAO,IAAI,aAAa;GACtB,KAAK,MAAM,aAAa,KAAK,YAAY;IACvC,IAAI,SAAS,MAAM,YAAY,QAAQ,gBAAgB,UAAU,EAAE,GAAG;IACtE,SAAS,KACP,IAAIF,QAAgB;KAAE,aAAa,UAAU;KAAI,QAAQ;IAAgB,CAAC,CAC5E;GACF;GACA,OAAO,OAAO,SAAS;EACzB,CAAC,CAAC,CAAC,KAAK,OAAO,MAAM,CAC3B,CACF;CACF,CAAC;;CAGH,MAAM,cAAc,MAAkB,KAAmB,SACvD,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,kBAAkB,MAAM,KAAK,IAAI;EAUxD,KAAI,OATkBV,OAAe;GACnC,SAAS,KAAK;GACd,MAAM,KAAK;GACX,QAAQ,KAAK;GACb,MAAM,KAAK;GACX,UAAU,KAAK;GACf,cAAc,KAAK;GACnB,YAAY;EACd,CAAC,OACc,KAAK,QAAQ,OAAO,OAAO,MAAM,IAAI;CACtD,CAAC;CAEH,MAAM,qBACJ,MACA,KACA,SAEA,SAAS,iBACL,OAAO,QAAQ,IAAI,KAAK,IAAI,IAAI,aAC9Ba,UACEC,aAAqB,IAAI,GACzB,SAAS,KAAK,EAAE,QAAQ,qBAAqB,cAAc,CAC7D,CACF,IACA,OAAO,QACL,KAAK,aACJ,cACC,UAAU,SAAS,WACf,iBACE,KACA,MACA,UAAU,IACV,UAAU,QACV,UAAU,gBACZ,IACA,OAAO,QAAQ,SAAS,CAChC;CAEN,MAAM,SACJ,MACA,WACA,KACA,SAEA,UAAU,SAAS,WACf,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,OAAO,IAAI,KAAK,IAAI;EACrC,MAAM,CAAC,SAAS,OAAOD,UACrB,CAAC,UAAU,MAAM,GACjB,SAAS,KAAK,EAAE,QAAQ,qBAAqB,cAAc,CAC7D;EACA,IAAI,OAAO,SAAS,UAAU,OAAO,OAAO,MAAM,IAAI;EAEtD,QAAO,OADgB,IAAI,OAAO,MAAM,UAAU,MAAM,EAAA,CACzC;CACjB,CAAC,IACD,OAAO,IAAI,aAAa;EAQtB,KAAI,OAPiB,iBACnB,KACA,MACA,UAAU,IACV,UAAU,QACV,UAAU,gBACZ,EAAA,CACU,SAAS,UAAU,OAAO,OAAO,MAAM,IAAI;EACrD,OAAO,IAAI,OAAO,MAAM,UAAU,gBAAgB;EAClD,OAAO,UAAU;CACnB,CAAC;CAEP,OAAO;EAAE;EAAQ;EAAS;EAAQ;EAAO;CAAU;AACrD;;AAGA,MAAa,oBACX,KACA,MACA,IACA,QACA,qBAEA,OAAO,IAAI,IAAI,IAAI,MAAM,gBAAgB,IAAI,aAAa;CACxD,IAAI,aAAa,MACf,OAAO,IAAIE,SAAc;EAAE;EAAI;EAAQ,UAAU,CAAC;EAAG,QAAQ;CAAU,CAAC;CAC1E,IAAI,CAACC,OAAiB,UAAU,MAAM,GACpC,OAAO,IAAID,SAAc;EAAE;EAAI;EAAQ,UAAU,CAAC,QAAQ;EAAG,QAAQ;CAAiB,CAAC;CAEzF,OAAO,IAAIE,OAAY;EAAE;EAAI;EAAQ;CAAiB,CAAC;AACzD,CAAC"}

package/dist/internal/cloudflare/client.mjs

@@ -0,0 +1,100 @@
+import { NotFound, ProviderConflict, Unauthenticated } from "../../Reason.mjs";
+import { decode, fail } from "../error.mjs";
+import { bearer, classify, rejected, requestJson } from "../http.mjs";
+import { BaseEnvelope, Envelope, Record, Token, Zone } from "./protocol.mjs";
+import { decode as decode$1, encode, isWithinZone } from "./records.mjs";
+import { DateTime, Effect, Schema } from "effect";
+//#region src/internal/cloudflare/client.ts
+const provider = "cloudflare";
+const notFound = new NotFound({
+	entity: "zone",
+	id: "cloudflare"
+});
+/** Cloudflare's "record already exists" family (81056 identical, 81057 same name and content, 81058 CNAME). */
+const conflictCodes = /* @__PURE__ */ new Set([
+	81056,
+	81057,
+	81058
+]);
+const call = (options, path, result, init) => Effect.gen(function* () {
+	const reply = yield* requestJson({
+		fetch: options.fetch,
+		provider,
+		url: `${options.baseUrl}${path}`,
+		init: bearer(options.token, init)
+	});
+	if (reply.status === 404) return yield* fail(notFound);
+	const base = Schema.decodeUnknownOption(BaseEnvelope)(reply.body);
+	if (!reply.ok || base._tag === "None" || !base.value.success) {
+		const detail = base._tag === "Some" ? base.value.errors[0] : void 0;
+		if (detail !== void 0 && conflictCodes.has(detail.code)) return yield* fail(new ProviderConflict({
+			provider,
+			code: String(detail.code),
+			message: detail.message
+		}));
+		return yield* fail(classify(provider, reply.status, reply.headers, detail?.message ?? `Cloudflare request failed with HTTP ${reply.status}`, detail === void 0 ? void 0 : String(detail.code)));
+	}
+	const contract = () => rejected(provider, "Cloudflare response did not match its API contract", "response");
+	const envelope = yield* decode(Envelope, reply.body).pipe(Effect.mapError(contract));
+	return {
+		result: yield* decode(result, envelope.result).pipe(Effect.mapError(contract)),
+		totalPages: envelope.result_info?.total_pages
+	};
+});
+const paginate = (options, path, result, perPage) => Effect.gen(function* () {
+	const rows = [];
+	let page = 1;
+	while (true) {
+		const reply = yield* call(options, path(page), Schema.Array(result));
+		rows.push(...reply.result);
+		if (reply.totalPages === void 0 ? reply.result.length < perPage : page >= reply.totalPages) return rows;
+		page += 1;
+	}
+});
+/** Every zone the credential can see, across accounts; internal zones cannot host records. */
+const listZones = (options, accountId) => paginate(options, (page) => {
+	const query = new URLSearchParams({
+		page: String(page),
+		per_page: "50"
+	});
+	if (accountId !== void 0) query.set("account.id", accountId);
+	return `/zones?${query}`;
+}, Zone, 50).pipe(Effect.map((zones) => zones.filter((zone) => zone.type !== "internal")));
+/** Token expiry from the verify endpoint; `null` when the token never expires or verification is unavailable. */
+/** Token status and expiry from a verify endpoint; an inactive token is `Unauthenticated`. */
+const verifyToken = (options, path) => call(options, path, Token).pipe(Effect.flatMap(({ result }) => result.status === "active" ? Effect.succeed(typeof result.expires_on === "string" ? DateTime.makeUnsafe(result.expires_on) : null) : fail(new Unauthenticated({ message: `Cloudflare token is ${result.status}` }))));
+const tokenExpiry = (options, accountId) => {
+	const verify = (path) => call(options, path, Token).pipe(Effect.flatMap(({ result }) => result.status === "active" ? Effect.succeed(typeof result.expires_on === "string" ? DateTime.makeUnsafe(result.expires_on) : null) : fail(new Unauthenticated({ message: `Cloudflare token is ${result.status}` }))));
+	return verify("/user/tokens/verify").pipe(Effect.map((expiresAt) => ({
+		expiresAt,
+		kind: "user"
+	})), Effect.catchIf((error) => error.reason._tag !== "Unauthenticated" || accountId !== null, () => accountId === null ? Effect.succeed({
+		expiresAt: null,
+		kind: "user"
+	}) : verify(`/accounts/${encodeURIComponent(accountId)}/tokens/verify`).pipe(Effect.map((expiresAt) => ({
+		expiresAt,
+		kind: "account"
+	})), Effect.catchIf((error) => error.reason._tag !== "Unauthenticated", () => Effect.succeed({
+		expiresAt: null,
+		kind: "user"
+	})))));
+};
+const dns = (options, zoneId) => {
+	const base = `/zones/${encodeURIComponent(zoneId)}/dns_records`;
+	return {
+		list: (zone) => paginate(options, (page) => `${base}?${new URLSearchParams({
+			page: String(page),
+			per_page: "100"
+		})}`, Record, 100).pipe(Effect.flatMap((records) => Effect.forEach(records.filter((record) => isWithinZone(record.name, zone)), decode$1))),
+		create: (_zone, record) => call(options, base, Record, {
+			method: "POST",
+			body: JSON.stringify(encode(record))
+		}).pipe(Effect.map(({ result }) => ({ providerRecordId: result.id }))),
+		get: (_zone, providerRecordId) => call(options, `${base}/${encodeURIComponent(providerRecordId)}`, Record).pipe(Effect.flatMap(({ result }) => decode$1(result)), Effect.map(({ record }) => record), Effect.catchIf((error) => error.reason === notFound, () => Effect.succeed(null))),
+		delete: (_zone, providerRecordId) => call(options, `${base}/${encodeURIComponent(providerRecordId)}`, Schema.Unknown, { method: "DELETE" }).pipe(Effect.asVoid)
+	};
+};
+//#endregion
+export { dns, listZones, provider, tokenExpiry, verifyToken };
+
+//# sourceMappingURL=client.mjs.map

package/dist/internal/cloudflare/client.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.mjs","names":["Reason.NotFound","Errors.fail","S","Protocol.BaseEnvelope","Reason.ProviderConflict","Errors.decode","Protocol.Envelope","Protocol.Zone","Protocol.Token","Reason.Unauthenticated","Protocol.Record","Records.isWithinZone","Records.decode","Records.encode"],"sources":["../../../src/internal/cloudflare/client.ts"],"sourcesContent":["import { DateTime, Effect, Schema as S } from \"effect\";\n\nimport type * as DnsRecord from \"../../DnsRecord.ts\";\nimport * as Errors from \"../error.ts\";\nimport * as Reason from \"../../Reason.ts\";\nimport type * as Provider from \"../../Provider.ts\";\nimport { bearer, classify, type Fetch, rejected, requestJson } from \"../http.ts\";\nimport * as Protocol from \"./protocol.ts\";\nimport * as Records from \"./records.ts\";\n\nexport const provider = \"cloudflare\";\n\nconst notFound = new Reason.NotFound({ entity: \"zone\", id: \"cloudflare\" });\n\n/** Cloudflare's \"record already exists\" family (81056 identical, 81057 same name and content, 81058 CNAME). */\nconst conflictCodes = new Set([81056, 81057, 81058]);\n\nexport interface Options {\n  readonly token: string;\n  readonly fetch: Fetch;\n  readonly baseUrl: string;\n}\n\ntype Fx<A> = Effect.Effect<A, Errors.DomainKitError>;\n\nconst call = <R extends S.ConstraintDecoder<unknown>>(\n  options: Options,\n  path: string,\n  result: R,\n  init?: RequestInit,\n): Fx<{ readonly result: R[\"Type\"]; readonly totalPages: number | undefined }> =>\n  Effect.gen(function* () {\n    const reply = yield* requestJson({\n      fetch: options.fetch,\n      provider,\n      url: `${options.baseUrl}${path}`,\n      init: bearer(options.token, init),\n    });\n    if (reply.status === 404) return yield* Errors.fail(notFound);\n    const base = S.decodeUnknownOption(Protocol.BaseEnvelope)(reply.body);\n    if (!reply.ok || base._tag === \"None\" || !base.value.success) {\n      const detail = base._tag === \"Some\" ? base.value.errors[0] : undefined;\n      if (detail !== undefined && conflictCodes.has(detail.code)) {\n        return yield* Errors.fail(\n          new Reason.ProviderConflict({\n            provider,\n            code: String(detail.code),\n            message: detail.message,\n          }),\n        );\n      }\n      return yield* Errors.fail(\n        classify(\n          provider,\n          reply.status,\n          reply.headers,\n          detail?.message ?? `Cloudflare request failed with HTTP ${reply.status}`,\n          detail === undefined ? undefined : String(detail.code),\n        ),\n      );\n    }\n    const contract = () =>\n      rejected(provider, \"Cloudflare response did not match its API contract\", \"response\");\n    const envelope = yield* Errors.decode(Protocol.Envelope, reply.body).pipe(\n      Effect.mapError(contract),\n    );\n    const decoded: R[\"Type\"] = yield* Errors.decode(result, envelope.result).pipe(\n      Effect.mapError(contract),\n    );\n    return { result: decoded, totalPages: envelope.result_info?.total_pages };\n  });\n\nconst paginate = <R extends S.ConstraintDecoder<unknown>>(\n  options: Options,\n  path: (page: number) => string,\n  result: R,\n  perPage: number,\n): Fx<ReadonlyArray<R[\"Type\"]>> =>\n  Effect.gen(function* () {\n    const rows: Array<R[\"Type\"]> = [];\n    let page = 1;\n    while (true) {\n      const reply = yield* call(options, path(page), S.Array(result));\n      rows.push(...reply.result);\n      const last =\n        reply.totalPages === undefined ? reply.result.length < perPage : page >= reply.totalPages;\n      if (last) return rows;\n      page += 1;\n    }\n  });\n\n/** Every zone the credential can see, across accounts; internal zones cannot host records. */\nexport const listZones = (options: Options, accountId?: string): Fx<ReadonlyArray<Protocol.Zone>> =>\n  paginate(\n    options,\n    (page) => {\n      const query = new URLSearchParams({ page: String(page), per_page: \"50\" });\n      if (accountId !== undefined) query.set(\"account.id\", accountId);\n      return `/zones?${query}`;\n    },\n    Protocol.Zone,\n    50,\n  ).pipe(Effect.map((zones) => zones.filter((zone) => zone.type !== \"internal\")));\n\n/** Token expiry from the verify endpoint; `null` when the token never expires or verification is unavailable. */\n/** Token status and expiry from a verify endpoint; an inactive token is `Unauthenticated`. */\nexport const verifyToken = (options: Options, path: string): Fx<DateTime.Utc | null> =>\n  call(options, path, Protocol.Token).pipe(\n    Effect.flatMap(({ result }) =>\n      result.status === \"active\"\n        ? Effect.succeed(\n            typeof result.expires_on === \"string\" ? DateTime.makeUnsafe(result.expires_on) : null,\n          )\n        : Errors.fail(\n            new Reason.Unauthenticated({\n              message: `Cloudflare token is ${result.status}`,\n            }),\n          ),\n    ),\n  );\n\nexport const tokenExpiry = (\n  options: Options,\n  accountId: string | null,\n): Fx<{ readonly expiresAt: DateTime.Utc | null; readonly kind: \"user\" | \"account\" }> => {\n  const verify = (path: string) =>\n    call(options, path, Protocol.Token).pipe(\n      Effect.flatMap(({ result }) =>\n        result.status === \"active\"\n          ? Effect.succeed(\n              typeof result.expires_on === \"string\" ? DateTime.makeUnsafe(result.expires_on) : null,\n            )\n          : Errors.fail(\n              new Reason.Unauthenticated({\n                message: `Cloudflare token is ${result.status}`,\n              }),\n            ),\n      ),\n    );\n  return verify(\"/user/tokens/verify\").pipe(\n    Effect.map((expiresAt) => ({ expiresAt, kind: \"user\" as const })),\n    Effect.catchIf(\n      (error) => error.reason._tag !== \"Unauthenticated\" || accountId !== null,\n      () =>\n        accountId === null\n          ? Effect.succeed({ expiresAt: null, kind: \"user\" as const })\n          : verify(`/accounts/${encodeURIComponent(accountId)}/tokens/verify`).pipe(\n              Effect.map((expiresAt) => ({ expiresAt, kind: \"account\" as const })),\n              Effect.catchIf(\n                (error) => error.reason._tag !== \"Unauthenticated\",\n                () => Effect.succeed({ expiresAt: null, kind: \"user\" as const }),\n              ),\n            ),\n    ),\n  );\n};\n\nexport const dns = (options: Options, zoneId: string): Provider.Dns => {\n  const base = `/zones/${encodeURIComponent(zoneId)}/dns_records`;\n  return {\n    list: (zone) =>\n      paginate(\n        options,\n        (page) => `${base}?${new URLSearchParams({ page: String(page), per_page: \"100\" })}`,\n        Protocol.Record,\n        100,\n      ).pipe(\n        Effect.flatMap((records) =>\n          Effect.forEach(\n            records.filter((record) => Records.isWithinZone(record.name, zone)),\n            Records.decode,\n          ),\n        ),\n      ),\n    create: (_zone, record: DnsRecord.Model) =>\n      call(options, base, Protocol.Record, {\n        method: \"POST\",\n        body: JSON.stringify(Records.encode(record)),\n      }).pipe(Effect.map(({ result }) => ({ providerRecordId: result.id }))),\n    get: (_zone, providerRecordId) =>\n      call(options, `${base}/${encodeURIComponent(providerRecordId)}`, Protocol.Record).pipe(\n        Effect.flatMap(({ result }) => Records.decode(result)),\n        Effect.map(({ record }) => record),\n        Effect.catchIf(\n          (error) => error.reason === notFound,\n          () => Effect.succeed(null),\n        ),\n      ),\n    delete: (_zone, providerRecordId) =>\n      call(options, `${base}/${encodeURIComponent(providerRecordId)}`, S.Unknown, {\n        method: \"DELETE\",\n      }).pipe(Effect.asVoid),\n  };\n};\n"],"mappings":";;;;;;;AAUA,MAAa,WAAW;AAExB,MAAM,WAAW,IAAIA,SAAgB;CAAE,QAAQ;CAAQ,IAAI;AAAa,CAAC;;AAGzE,MAAM,gCAAgB,IAAI,IAAI;CAAC;CAAO;CAAO;AAAK,CAAC;AAUnD,MAAM,QACJ,SACA,MACA,QACA,SAEA,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,OAAO,YAAY;EAC/B,OAAO,QAAQ;EACf;EACA,KAAK,GAAG,QAAQ,UAAU;EAC1B,MAAM,OAAO,QAAQ,OAAO,IAAI;CAClC,CAAC;CACD,IAAI,MAAM,WAAW,KAAK,OAAO,OAAOC,KAAY,QAAQ;CAC5D,MAAM,OAAOC,OAAE,oBAAoBC,YAAqB,CAAC,CAAC,MAAM,IAAI;CACpE,IAAI,CAAC,MAAM,MAAM,KAAK,SAAS,UAAU,CAAC,KAAK,MAAM,SAAS;EAC5D,MAAM,SAAS,KAAK,SAAS,SAAS,KAAK,MAAM,OAAO,KAAK,KAAA;EAC7D,IAAI,WAAW,KAAA,KAAa,cAAc,IAAI,OAAO,IAAI,GACvD,OAAO,OAAOF,KACZ,IAAIG,iBAAwB;GAC1B;GACA,MAAM,OAAO,OAAO,IAAI;GACxB,SAAS,OAAO;EAClB,CAAC,CACH;EAEF,OAAO,OAAOH,KACZ,SACE,UACA,MAAM,QACN,MAAM,SACN,QAAQ,WAAW,uCAAuC,MAAM,UAChE,WAAW,KAAA,IAAY,KAAA,IAAY,OAAO,OAAO,IAAI,CACvD,CACF;CACF;CACA,MAAM,iBACJ,SAAS,UAAU,sDAAsD,UAAU;CACrF,MAAM,WAAW,OAAOI,OAAcC,UAAmB,MAAM,IAAI,CAAC,CAAC,KACnE,OAAO,SAAS,QAAQ,CAC1B;CAIA,OAAO;EAAE,QAAQ,OAHiBD,OAAc,QAAQ,SAAS,MAAM,CAAC,CAAC,KACvE,OAAO,SAAS,QAAQ,CAC1B;EAC0B,YAAY,SAAS,aAAa;CAAY;AAC1E,CAAC;AAEH,MAAM,YACJ,SACA,MACA,QACA,YAEA,OAAO,IAAI,aAAa;CACtB,MAAM,OAAyB,CAAC;CAChC,IAAI,OAAO;CACX,OAAO,MAAM;EACX,MAAM,QAAQ,OAAO,KAAK,SAAS,KAAK,IAAI,GAAGH,OAAE,MAAM,MAAM,CAAC;EAC9D,KAAK,KAAK,GAAG,MAAM,MAAM;EAGzB,IADE,MAAM,eAAe,KAAA,IAAY,MAAM,OAAO,SAAS,UAAU,QAAQ,MAAM,YACvE,OAAO;EACjB,QAAQ;CACV;AACF,CAAC;;AAGH,MAAa,aAAa,SAAkB,cAC1C,SACE,UACC,SAAS;CACR,MAAM,QAAQ,IAAI,gBAAgB;EAAE,MAAM,OAAO,IAAI;EAAG,UAAU;CAAK,CAAC;CACxE,IAAI,cAAc,KAAA,GAAW,MAAM,IAAI,cAAc,SAAS;CAC9D,OAAO,UAAU;AACnB,GACAK,MACA,EACF,CAAC,CAAC,KAAK,OAAO,KAAK,UAAU,MAAM,QAAQ,SAAS,KAAK,SAAS,UAAU,CAAC,CAAC;;;AAIhF,MAAa,eAAe,SAAkB,SAC5C,KAAK,SAAS,MAAMC,KAAc,CAAC,CAAC,KAClC,OAAO,SAAS,EAAE,aAChB,OAAO,WAAW,WACd,OAAO,QACL,OAAO,OAAO,eAAe,WAAW,SAAS,WAAW,OAAO,UAAU,IAAI,IACnF,IACAP,KACE,IAAIQ,gBAAuB,EACzB,SAAS,uBAAuB,OAAO,SACzC,CAAC,CACH,CACN,CACF;AAEF,MAAa,eACX,SACA,cACuF;CACvF,MAAM,UAAU,SACd,KAAK,SAAS,MAAMD,KAAc,CAAC,CAAC,KAClC,OAAO,SAAS,EAAE,aAChB,OAAO,WAAW,WACd,OAAO,QACL,OAAO,OAAO,eAAe,WAAW,SAAS,WAAW,OAAO,UAAU,IAAI,IACnF,IACAP,KACE,IAAIQ,gBAAuB,EACzB,SAAS,uBAAuB,OAAO,SACzC,CAAC,CACH,CACN,CACF;CACF,OAAO,OAAO,qBAAqB,CAAC,CAAC,KACnC,OAAO,KAAK,eAAe;EAAE;EAAW,MAAM;CAAgB,EAAE,GAChE,OAAO,SACJ,UAAU,MAAM,OAAO,SAAS,qBAAqB,cAAc,YAElE,cAAc,OACV,OAAO,QAAQ;EAAE,WAAW;EAAM,MAAM;CAAgB,CAAC,IACzD,OAAO,aAAa,mBAAmB,SAAS,EAAE,eAAe,CAAC,CAAC,KACjE,OAAO,KAAK,eAAe;EAAE;EAAW,MAAM;CAAmB,EAAE,GACnE,OAAO,SACJ,UAAU,MAAM,OAAO,SAAS,yBAC3B,OAAO,QAAQ;EAAE,WAAW;EAAM,MAAM;CAAgB,CAAC,CACjE,CACF,CACR,CACF;AACF;AAEA,MAAa,OAAO,SAAkB,WAAiC;CACrE,MAAM,OAAO,UAAU,mBAAmB,MAAM,EAAE;CAClD,OAAO;EACL,OAAO,SACL,SACE,UACC,SAAS,GAAG,KAAK,GAAG,IAAI,gBAAgB;GAAE,MAAM,OAAO,IAAI;GAAG,UAAU;EAAM,CAAC,KAChFC,QACA,GACF,CAAC,CAAC,KACA,OAAO,SAAS,YACd,OAAO,QACL,QAAQ,QAAQ,WAAWC,aAAqB,OAAO,MAAM,IAAI,CAAC,GAClEC,QACF,CACF,CACF;EACF,SAAS,OAAO,WACd,KAAK,SAAS,MAAMF,QAAiB;GACnC,QAAQ;GACR,MAAM,KAAK,UAAUG,OAAe,MAAM,CAAC;EAC7C,CAAC,CAAC,CAAC,KAAK,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,OAAO,GAAG,EAAE,CAAC;EACvE,MAAM,OAAO,qBACX,KAAK,SAAS,GAAG,KAAK,GAAG,mBAAmB,gBAAgB,KAAKH,MAAe,CAAC,CAAC,KAChF,OAAO,SAAS,EAAE,aAAaE,SAAe,MAAM,CAAC,GACrD,OAAO,KAAK,EAAE,aAAa,MAAM,GACjC,OAAO,SACJ,UAAU,MAAM,WAAW,gBACtB,OAAO,QAAQ,IAAI,CAC3B,CACF;EACF,SAAS,OAAO,qBACd,KAAK,SAAS,GAAG,KAAK,GAAG,mBAAmB,gBAAgB,KAAKV,OAAE,SAAS,EAC1E,QAAQ,SACV,CAAC,CAAC,CAAC,KAAK,OAAO,MAAM;CACzB;AACF"}

package/dist/internal/cloudflare/protocol.mjs

@@ -0,0 +1,59 @@
+import { Schema } from "effect";
+//#region src/internal/cloudflare/protocol.ts
+const ErrorDetail = Schema.Struct({
+	code: Schema.Number,
+	message: Schema.String
+});
+const Message = Schema.Struct({
+	code: Schema.optionalKey(Schema.Number),
+	message: Schema.String
+});
+const ResultInfo = Schema.Struct({
+	count: Schema.optionalKey(Schema.Number),
+	page: Schema.optionalKey(Schema.Number),
+	per_page: Schema.optionalKey(Schema.Number),
+	total_count: Schema.optionalKey(Schema.Number),
+	total_pages: Schema.optionalKey(Schema.Number)
+});
+const BaseEnvelope = Schema.Struct({
+	errors: Schema.Array(ErrorDetail),
+	messages: Schema.optionalKey(Schema.Array(Message)),
+	success: Schema.Boolean
+});
+const Account = Schema.Struct({
+	id: Schema.String,
+	name: Schema.String
+});
+const Zone = Schema.Struct({
+	account: Account,
+	id: Schema.String,
+	name: Schema.String,
+	name_servers: Schema.optionalKey(Schema.Array(Schema.String)),
+	status: Schema.optionalKey(Schema.String),
+	type: Schema.optionalKey(Schema.String)
+});
+const Record = Schema.Struct({
+	content: Schema.optionalKey(Schema.String),
+	data: Schema.optionalKey(Schema.Unknown),
+	id: Schema.String,
+	name: Schema.String,
+	priority: Schema.optionalKey(Schema.Number),
+	proxied: Schema.optionalKey(Schema.Boolean),
+	ttl: Schema.Number,
+	type: Schema.String
+});
+const Token = Schema.Struct({
+	expires_on: Schema.optionalKey(Schema.NullOr(Schema.String)),
+	id: Schema.String,
+	status: Schema.String
+});
+const Envelope = Schema.Struct({
+	errors: Schema.Array(ErrorDetail),
+	result: Schema.Unknown,
+	result_info: Schema.optionalKey(ResultInfo),
+	success: Schema.Boolean
+});
+//#endregion
+export { Account, BaseEnvelope, Envelope, ErrorDetail, Record, ResultInfo, Token, Zone };
+
+//# sourceMappingURL=protocol.mjs.map

package/dist/internal/cloudflare/protocol.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.mjs","names":["S"],"sources":["../../../src/internal/cloudflare/protocol.ts"],"sourcesContent":["import { Schema as S } from \"effect\";\n\nexport const ErrorDetail = S.Struct({ code: S.Number, message: S.String });\n\nconst Message = S.Struct({ code: S.optionalKey(S.Number), message: S.String });\n\nexport const ResultInfo = S.Struct({\n  count: S.optionalKey(S.Number),\n  page: S.optionalKey(S.Number),\n  per_page: S.optionalKey(S.Number),\n  total_count: S.optionalKey(S.Number),\n  total_pages: S.optionalKey(S.Number),\n});\n\nexport const BaseEnvelope = S.Struct({\n  errors: S.Array(ErrorDetail),\n  messages: S.optionalKey(S.Array(Message)),\n  success: S.Boolean,\n});\n\nexport const Account = S.Struct({ id: S.String, name: S.String });\nexport type Account = typeof Account.Type;\n\nexport const Zone = S.Struct({\n  account: Account,\n  id: S.String,\n  name: S.String,\n  name_servers: S.optionalKey(S.Array(S.String)),\n  status: S.optionalKey(S.String),\n  type: S.optionalKey(S.String),\n});\nexport type Zone = typeof Zone.Type;\n\nexport const Record = S.Struct({\n  content: S.optionalKey(S.String),\n  data: S.optionalKey(S.Unknown),\n  id: S.String,\n  name: S.String,\n  priority: S.optionalKey(S.Number),\n  proxied: S.optionalKey(S.Boolean),\n  ttl: S.Number,\n  type: S.String,\n});\nexport type Record = typeof Record.Type;\n\nexport const Token = S.Struct({\n  expires_on: S.optionalKey(S.NullOr(S.String)),\n  id: S.String,\n  status: S.String,\n});\n\nexport const Envelope = S.Struct({\n  errors: S.Array(ErrorDetail),\n  result: S.Unknown,\n  result_info: S.optionalKey(ResultInfo),\n  success: S.Boolean,\n});\n"],"mappings":";;AAEA,MAAa,cAAcA,OAAE,OAAO;CAAE,MAAMA,OAAE;CAAQ,SAASA,OAAE;AAAO,CAAC;AAEzE,MAAM,UAAUA,OAAE,OAAO;CAAE,MAAMA,OAAE,YAAYA,OAAE,MAAM;CAAG,SAASA,OAAE;AAAO,CAAC;AAE7E,MAAa,aAAaA,OAAE,OAAO;CACjC,OAAOA,OAAE,YAAYA,OAAE,MAAM;CAC7B,MAAMA,OAAE,YAAYA,OAAE,MAAM;CAC5B,UAAUA,OAAE,YAAYA,OAAE,MAAM;CAChC,aAAaA,OAAE,YAAYA,OAAE,MAAM;CACnC,aAAaA,OAAE,YAAYA,OAAE,MAAM;AACrC,CAAC;AAED,MAAa,eAAeA,OAAE,OAAO;CACnC,QAAQA,OAAE,MAAM,WAAW;CAC3B,UAAUA,OAAE,YAAYA,OAAE,MAAM,OAAO,CAAC;CACxC,SAASA,OAAE;AACb,CAAC;AAED,MAAa,UAAUA,OAAE,OAAO;CAAE,IAAIA,OAAE;CAAQ,MAAMA,OAAE;AAAO,CAAC;AAGhE,MAAa,OAAOA,OAAE,OAAO;CAC3B,SAAS;CACT,IAAIA,OAAE;CACN,MAAMA,OAAE;CACR,cAAcA,OAAE,YAAYA,OAAE,MAAMA,OAAE,MAAM,CAAC;CAC7C,QAAQA,OAAE,YAAYA,OAAE,MAAM;CAC9B,MAAMA,OAAE,YAAYA,OAAE,MAAM;AAC9B,CAAC;AAGD,MAAa,SAASA,OAAE,OAAO;CAC7B,SAASA,OAAE,YAAYA,OAAE,MAAM;CAC/B,MAAMA,OAAE,YAAYA,OAAE,OAAO;CAC7B,IAAIA,OAAE;CACN,MAAMA,OAAE;CACR,UAAUA,OAAE,YAAYA,OAAE,MAAM;CAChC,SAASA,OAAE,YAAYA,OAAE,OAAO;CAChC,KAAKA,OAAE;CACP,MAAMA,OAAE;AACV,CAAC;AAGD,MAAa,QAAQA,OAAE,OAAO;CAC5B,YAAYA,OAAE,YAAYA,OAAE,OAAOA,OAAE,MAAM,CAAC;CAC5C,IAAIA,OAAE;CACN,QAAQA,OAAE;AACZ,CAAC;AAED,MAAa,WAAWA,OAAE,OAAO;CAC/B,QAAQA,OAAE,MAAM,WAAW;CAC3B,QAAQA,OAAE;CACV,aAAaA,OAAE,YAAY,UAAU;CACrC,SAASA,OAAE;AACb,CAAC"}