domainkit 0.7.0 → 0.9.0

package/dist/internal/cloudflare/records.mjs

@@ -0,0 +1,156 @@
+import { isWithin } from "../../DomainName.mjs";
+import { Opaque, a, aaaa, caa, cname, mx, ns, srv, txt } from "../../DnsRecord.mjs";
+import { Effect, Schema } from "effect";
+//#region src/internal/cloudflare/records.ts
+const Data$1 = Schema.Struct({
+	flags: Schema.optionalKey(Schema.Number),
+	port: Schema.optionalKey(Schema.Number),
+	priority: Schema.optionalKey(Schema.Number),
+	tag: Schema.optionalKey(Schema.String),
+	target: Schema.optionalKey(Schema.String),
+	value: Schema.optionalKey(Schema.String),
+	weight: Schema.optionalKey(Schema.Number)
+});
+/** Records DomainKit cannot model, or cannot parse, come back opaque so plans never touch them. */
+const decode = (record) => Effect.map(decodeRecord(record), (observed) => ({
+	record: observed,
+	providerRecordId: record.id
+}));
+const decodeRecord = (record) => {
+	const opaque = new Opaque({
+		name: record.name,
+		type: record.type,
+		raw: record
+	});
+	const ttl = record.ttl === 1 ? null : record.ttl;
+	const content = record.content;
+	const attempt = () => {
+		switch (record.type) {
+			case "A": return a({
+				name: record.name,
+				address: required(content),
+				...ttlOption(ttl)
+			});
+			case "AAAA": return aaaa({
+				name: record.name,
+				address: required(content),
+				...ttlOption(ttl)
+			});
+			case "CNAME": return cname({
+				name: record.name,
+				target: required(content),
+				...ttlOption(ttl)
+			});
+			case "NS": return ns({
+				name: record.name,
+				nameserver: required(content),
+				...ttlOption(ttl)
+			});
+			case "TXT": return txt({
+				name: record.name,
+				value: unquote(required(content)),
+				...ttlOption(ttl)
+			});
+			case "MX": return mx({
+				name: record.name,
+				exchange: required(content),
+				priority: required(record.priority),
+				...ttlOption(ttl)
+			});
+			case "CAA": {
+				const data = Schema.decodeUnknownSync(Data$1)(record.data);
+				return caa({
+					name: record.name,
+					flags: required(data.flags),
+					tag: required(data.tag),
+					value: required(data.value),
+					...ttlOption(ttl)
+				});
+			}
+			case "SRV": {
+				const data = Schema.decodeUnknownSync(Data$1)(record.data);
+				return srv({
+					name: record.name,
+					target: required(data.target),
+					port: required(data.port),
+					priority: required(data.priority),
+					weight: required(data.weight),
+					...ttlOption(ttl)
+				});
+			}
+			default: return opaque;
+		}
+	};
+	return Effect.sync(() => {
+		try {
+			return attempt();
+		} catch {
+			return opaque;
+		}
+	});
+};
+const encode = (record) => {
+	const common = {
+		name: record.name,
+		proxied: false,
+		ttl: record.ttl ?? 1,
+		type: record._tag
+	};
+	switch (record._tag) {
+		case "A":
+		case "AAAA": return {
+			...common,
+			content: record.address
+		};
+		case "CNAME": return {
+			...common,
+			content: record.target
+		};
+		case "NS": return {
+			...common,
+			content: record.nameserver
+		};
+		case "TXT": return {
+			...common,
+			content: record.value
+		};
+		case "MX": return {
+			...common,
+			content: record.exchange,
+			priority: record.priority
+		};
+		case "CAA": return {
+			...common,
+			data: {
+				flags: record.flags,
+				tag: record.tag,
+				value: record.value
+			}
+		};
+		case "SRV": return {
+			...common,
+			data: {
+				port: record.port,
+				priority: record.priority,
+				target: record.target,
+				weight: record.weight
+			}
+		};
+	}
+};
+const isWithinZone = (name, zone) => isWithin(name, zone);
+function required(value) {
+	if (value === void 0) throw new Error("Cloudflare record field is missing");
+	return value;
+}
+function ttlOption(ttl) {
+	return ttl === null ? {} : { ttl };
+}
+function unquote(value) {
+	const chunks = [...value.matchAll(/"((?:\\.|[^"])*)"/g)];
+	return chunks.length === 0 ? value : chunks.map((match) => (match[1] ?? "").replace(/\\"/g, "\"").replace(/\\\\/g, "\\")).join("");
+}
+//#endregion
+export { decode, encode, isWithinZone };
+
+//# sourceMappingURL=records.mjs.map

package/dist/internal/cloudflare/records.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"records.mjs","names":["Data","S","DnsRecord.Opaque","DnsRecord.a","DnsRecord.aaaa","DnsRecord.cname","DnsRecord.ns","DnsRecord.txt","DnsRecord.mx","DnsRecord.caa","DnsRecord.srv","DomainName.isWithin"],"sources":["../../../src/internal/cloudflare/records.ts"],"sourcesContent":["import { Effect, Schema as S } from \"effect\";\n\nimport * as DnsRecord from \"../../DnsRecord.ts\";\nimport * as DomainName from \"../../DomainName.ts\";\nimport type * as Provider from \"../../Provider.ts\";\nimport type * as Protocol from \"./protocol.ts\";\n\nconst Data = S.Struct({\n  flags: S.optionalKey(S.Number),\n  port: S.optionalKey(S.Number),\n  priority: S.optionalKey(S.Number),\n  tag: S.optionalKey(S.String),\n  target: S.optionalKey(S.String),\n  value: S.optionalKey(S.String),\n  weight: S.optionalKey(S.Number),\n});\n\n/** Records DomainKit cannot model, or cannot parse, come back opaque so plans never touch them. */\nexport const decode = (record: Protocol.Record): Effect.Effect<Provider.ObservedRecord> =>\n  Effect.map(decodeRecord(record), (observed) => ({\n    record: observed,\n    providerRecordId: record.id,\n  }));\n\nconst decodeRecord = (record: Protocol.Record): Effect.Effect<DnsRecord.Observed> => {\n  const opaque = new DnsRecord.Opaque({ name: record.name, type: record.type, raw: record });\n  const ttl = record.ttl === 1 ? null : record.ttl;\n  const content = record.content;\n  const attempt = (): DnsRecord.Observed => {\n    switch (record.type) {\n      case \"A\":\n        return DnsRecord.a({ name: record.name, address: required(content), ...ttlOption(ttl) });\n      case \"AAAA\":\n        return DnsRecord.aaaa({ name: record.name, address: required(content), ...ttlOption(ttl) });\n      case \"CNAME\":\n        return DnsRecord.cname({ name: record.name, target: required(content), ...ttlOption(ttl) });\n      case \"NS\":\n        return DnsRecord.ns({\n          name: record.name,\n          nameserver: required(content),\n          ...ttlOption(ttl),\n        });\n      case \"TXT\":\n        return DnsRecord.txt({\n          name: record.name,\n          value: unquote(required(content)),\n          ...ttlOption(ttl),\n        });\n      case \"MX\":\n        return DnsRecord.mx({\n          name: record.name,\n          exchange: required(content),\n          priority: required(record.priority),\n          ...ttlOption(ttl),\n        });\n      case \"CAA\": {\n        const data = S.decodeUnknownSync(Data)(record.data);\n        return DnsRecord.caa({\n          name: record.name,\n          flags: required(data.flags),\n          tag: required(data.tag),\n          value: required(data.value),\n          ...ttlOption(ttl),\n        });\n      }\n      case \"SRV\": {\n        const data = S.decodeUnknownSync(Data)(record.data);\n        return DnsRecord.srv({\n          name: record.name,\n          target: required(data.target),\n          port: required(data.port),\n          priority: required(data.priority),\n          weight: required(data.weight),\n          ...ttlOption(ttl),\n        });\n      }\n      default:\n        return opaque;\n    }\n  };\n  return Effect.sync(() => {\n    try {\n      return attempt();\n    } catch {\n      return opaque;\n    }\n  });\n};\n\nexport const encode = (record: DnsRecord.Model): Record<string, unknown> => {\n  const common = { name: record.name, proxied: false, ttl: record.ttl ?? 1, type: record._tag };\n  switch (record._tag) {\n    case \"A\":\n    case \"AAAA\":\n      return { ...common, content: record.address };\n    case \"CNAME\":\n      return { ...common, content: record.target };\n    case \"NS\":\n      return { ...common, content: record.nameserver };\n    case \"TXT\":\n      return { ...common, content: record.value };\n    case \"MX\":\n      return { ...common, content: record.exchange, priority: record.priority };\n    case \"CAA\":\n      return { ...common, data: { flags: record.flags, tag: record.tag, value: record.value } };\n    case \"SRV\":\n      return {\n        ...common,\n        data: {\n          port: record.port,\n          priority: record.priority,\n          target: record.target,\n          weight: record.weight,\n        },\n      };\n  }\n};\n\nexport const isWithinZone = (name: string, zone: string): boolean =>\n  DomainName.isWithin(name, zone);\n\nfunction required<A>(value: A | undefined): A {\n  if (value === undefined) throw new Error(\"Cloudflare record field is missing\");\n  return value;\n}\n\nfunction ttlOption(ttl: number | null): { readonly ttl?: number } {\n  return ttl === null ? {} : { ttl };\n}\n\nfunction unquote(value: string): string {\n  const chunks = [...value.matchAll(/\"((?:\\\\.|[^\"])*)\"/g)];\n  return chunks.length === 0\n    ? value\n    : chunks.map((match) => (match[1] ?? \"\").replace(/\\\\\"/g, '\"').replace(/\\\\\\\\/g, \"\\\\\")).join(\"\");\n}\n"],"mappings":";;;;AAOA,MAAMA,SAAOC,OAAE,OAAO;CACpB,OAAOA,OAAE,YAAYA,OAAE,MAAM;CAC7B,MAAMA,OAAE,YAAYA,OAAE,MAAM;CAC5B,UAAUA,OAAE,YAAYA,OAAE,MAAM;CAChC,KAAKA,OAAE,YAAYA,OAAE,MAAM;CAC3B,QAAQA,OAAE,YAAYA,OAAE,MAAM;CAC9B,OAAOA,OAAE,YAAYA,OAAE,MAAM;CAC7B,QAAQA,OAAE,YAAYA,OAAE,MAAM;AAChC,CAAC;;AAGD,MAAa,UAAU,WACrB,OAAO,IAAI,aAAa,MAAM,IAAI,cAAc;CAC9C,QAAQ;CACR,kBAAkB,OAAO;AAC3B,EAAE;AAEJ,MAAM,gBAAgB,WAA+D;CACnF,MAAM,SAAS,IAAIC,OAAiB;EAAE,MAAM,OAAO;EAAM,MAAM,OAAO;EAAM,KAAK;CAAO,CAAC;CACzF,MAAM,MAAM,OAAO,QAAQ,IAAI,OAAO,OAAO;CAC7C,MAAM,UAAU,OAAO;CACvB,MAAM,gBAAoC;EACxC,QAAQ,OAAO,MAAf;GACE,KAAK,KACH,OAAOC,EAAY;IAAE,MAAM,OAAO;IAAM,SAAS,SAAS,OAAO;IAAG,GAAG,UAAU,GAAG;GAAE,CAAC;GACzF,KAAK,QACH,OAAOC,KAAe;IAAE,MAAM,OAAO;IAAM,SAAS,SAAS,OAAO;IAAG,GAAG,UAAU,GAAG;GAAE,CAAC;GAC5F,KAAK,SACH,OAAOC,MAAgB;IAAE,MAAM,OAAO;IAAM,QAAQ,SAAS,OAAO;IAAG,GAAG,UAAU,GAAG;GAAE,CAAC;GAC5F,KAAK,MACH,OAAOC,GAAa;IAClB,MAAM,OAAO;IACb,YAAY,SAAS,OAAO;IAC5B,GAAG,UAAU,GAAG;GAClB,CAAC;GACH,KAAK,OACH,OAAOC,IAAc;IACnB,MAAM,OAAO;IACb,OAAO,QAAQ,SAAS,OAAO,CAAC;IAChC,GAAG,UAAU,GAAG;GAClB,CAAC;GACH,KAAK,MACH,OAAOC,GAAa;IAClB,MAAM,OAAO;IACb,UAAU,SAAS,OAAO;IAC1B,UAAU,SAAS,OAAO,QAAQ;IAClC,GAAG,UAAU,GAAG;GAClB,CAAC;GACH,KAAK,OAAO;IACV,MAAM,OAAOP,OAAE,kBAAkBD,MAAI,CAAC,CAAC,OAAO,IAAI;IAClD,OAAOS,IAAc;KACnB,MAAM,OAAO;KACb,OAAO,SAAS,KAAK,KAAK;KAC1B,KAAK,SAAS,KAAK,GAAG;KACtB,OAAO,SAAS,KAAK,KAAK;KAC1B,GAAG,UAAU,GAAG;IAClB,CAAC;GACH;GACA,KAAK,OAAO;IACV,MAAM,OAAOR,OAAE,kBAAkBD,MAAI,CAAC,CAAC,OAAO,IAAI;IAClD,OAAOU,IAAc;KACnB,MAAM,OAAO;KACb,QAAQ,SAAS,KAAK,MAAM;KAC5B,MAAM,SAAS,KAAK,IAAI;KACxB,UAAU,SAAS,KAAK,QAAQ;KAChC,QAAQ,SAAS,KAAK,MAAM;KAC5B,GAAG,UAAU,GAAG;IAClB,CAAC;GACH;GACA,SACE,OAAO;EACX;CACF;CACA,OAAO,OAAO,WAAW;EACvB,IAAI;GACF,OAAO,QAAQ;EACjB,QAAQ;GACN,OAAO;EACT;CACF,CAAC;AACH;AAEA,MAAa,UAAU,WAAqD;CAC1E,MAAM,SAAS;EAAE,MAAM,OAAO;EAAM,SAAS;EAAO,KAAK,OAAO,OAAO;EAAG,MAAM,OAAO;CAAK;CAC5F,QAAQ,OAAO,MAAf;EACE,KAAK;EACL,KAAK,QACH,OAAO;GAAE,GAAG;GAAQ,SAAS,OAAO;EAAQ;EAC9C,KAAK,SACH,OAAO;GAAE,GAAG;GAAQ,SAAS,OAAO;EAAO;EAC7C,KAAK,MACH,OAAO;GAAE,GAAG;GAAQ,SAAS,OAAO;EAAW;EACjD,KAAK,OACH,OAAO;GAAE,GAAG;GAAQ,SAAS,OAAO;EAAM;EAC5C,KAAK,MACH,OAAO;GAAE,GAAG;GAAQ,SAAS,OAAO;GAAU,UAAU,OAAO;EAAS;EAC1E,KAAK,OACH,OAAO;GAAE,GAAG;GAAQ,MAAM;IAAE,OAAO,OAAO;IAAO,KAAK,OAAO;IAAK,OAAO,OAAO;GAAM;EAAE;EAC1F,KAAK,OACH,OAAO;GACL,GAAG;GACH,MAAM;IACJ,MAAM,OAAO;IACb,UAAU,OAAO;IACjB,QAAQ,OAAO;IACf,QAAQ,OAAO;GACjB;EACF;CACJ;AACF;AAEA,MAAa,gBAAgB,MAAc,SACzCC,SAAoB,MAAM,IAAI;AAEhC,SAAS,SAAY,OAAyB;CAC5C,IAAI,UAAU,KAAA,GAAW,MAAM,IAAI,MAAM,oCAAoC;CAC7E,OAAO;AACT;AAEA,SAAS,UAAU,KAA+C;CAChE,OAAO,QAAQ,OAAO,CAAC,IAAI,EAAE,IAAI;AACnC;AAEA,SAAS,QAAQ,OAAuB;CACtC,MAAM,SAAS,CAAC,GAAG,MAAM,SAAS,oBAAoB,CAAC;CACvD,OAAO,OAAO,WAAW,IACrB,QACA,OAAO,KAAK,WAAW,MAAM,MAAM,GAAA,CAAI,QAAQ,QAAQ,IAAG,CAAC,CAAC,QAAQ,SAAS,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE;AACjG"}

package/dist/internal/config.mjs

@@ -0,0 +1,13 @@
+import { InvalidInput } from "../Reason.mjs";
+import { DomainKitError } from "./error.mjs";
+import { Config, Effect } from "effect";
+//#region src/internal/config.ts
+/** Accept a literal or a `Config`; config failures surface as `InvalidInput` on `field`. */
+const resolve = (value, field) => Config.isConfig(value) ? value.pipe(Effect.mapError((cause) => new DomainKitError({ reason: new InvalidInput({
+	message: cause.message,
+	field
+}) }))) : Effect.succeed(value);
+//#endregion
+export { resolve };
+
+//# sourceMappingURL=config.mjs.map

package/dist/internal/config.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.mjs","names":["Errors.DomainKitError","Reason.InvalidInput"],"sources":["../../src/internal/config.ts"],"sourcesContent":["import { Config, Effect } from \"effect\";\n\nimport * as Errors from \"./error.ts\";\nimport * as Reason from \"../Reason.ts\";\n\n/** Accept a literal or a `Config`; config failures surface as `InvalidInput` on `field`. */\nexport const resolve = <A>(\n  value: A | Config.Config<A>,\n  field: string,\n): Effect.Effect<A, Errors.DomainKitError> =>\n  Config.isConfig(value)\n    ? value.pipe(\n        Effect.mapError(\n          (cause) =>\n            new Errors.DomainKitError({\n              reason: new Reason.InvalidInput({ message: cause.message, field }),\n            }),\n        ),\n      )\n    : Effect.succeed(value);\n"],"mappings":";;;;;AAMA,MAAa,WACX,OACA,UAEA,OAAO,SAAS,KAAK,IACjB,MAAM,KACJ,OAAO,UACJ,UACC,IAAIA,eAAsB,EACxB,QAAQ,IAAIC,aAAoB;CAAE,SAAS,MAAM;CAAS;AAAM,CAAC,EACnE,CAAC,CACL,CACF,IACA,OAAO,QAAQ,KAAK"}

package/dist/internal/conformance/provider.mjs

@@ -0,0 +1,207 @@
+import { cname as cname$1, equals, txt as txt$1 } from "../../DnsRecord.mjs";
+import { InvalidInput, ProviderUnavailable } from "../../Reason.mjs";
+import { DomainKitError, fail } from "../error.mjs";
+import { Service } from "../../Custody.mjs";
+import { fresh } from "../ids.mjs";
+import { Service as Service$1, make } from "../../Principal.mjs";
+import { encodeContext } from "../../Provider.mjs";
+import { Service as Service$2 } from "../../Resolver.mjs";
+import { applied } from "../../Receipt.mjs";
+import { Attachment, Authorization, Credential, Service as Service$3 } from "../../Storage.mjs";
+import { attach, session } from "../../Connect.mjs";
+import { apply, approve, plan } from "../../Provision.mjs";
+import { apply as apply$1, approve as approve$1, plan as plan$1 } from "../../Cleanup.mjs";
+import { layerMemory } from "../../DomainKit.mjs";
+import { DateTime, Effect, Layer } from "effect";
+//#region src/internal/conformance/provider.ts
+const principal = make({
+	ownerId: "conformance",
+	actorId: "conformance"
+});
+const failure = (name, message) => new DomainKitError({ reason: new InvalidInput({
+	message: `provider conformance ${name}: ${message}`,
+	field: "conformance"
+}) });
+const expect = (name, condition, message) => condition ? Effect.void : Effect.fail(failure(name, message));
+/** Attach `zone` to a connection built straight from `credential`, bypassing `authenticate`. */
+const attachZone = (definition, credential, zone) => Effect.gen(function* () {
+	const storage = yield* Service$3;
+	const custody = yield* Service;
+	const now = yield* DateTime.now;
+	const authorization = new Authorization({
+		id: yield* fresh("auth"),
+		ownerId: principal.ownerId,
+		provider: definition.id,
+		method: "token",
+		capabilities: ["dns:read", "dns:write"],
+		context: yield* encodeContext(definition, credential.context),
+		revocation: "active",
+		createdBy: principal.actorId,
+		createdAt: now
+	});
+	yield* storage.authorizations.upsert({
+		authorization,
+		credential: new Credential({
+			ciphertext: yield* custody.seal(credential.secret),
+			expiresAt: null,
+			rotatedAt: now
+		})
+	});
+	const connection = yield* storage.connections.create(authorization.id);
+	const attached = yield* attach({
+		connectionId: connection.id,
+		domain: zone
+	});
+	if (!(attached instanceof Attachment)) return yield* Effect.fail(failure("create-readback-cleanup", `zone ${zone} needs a selection; pass an exact zone`));
+	return attached;
+});
+const cname = (zone, label) => cname$1({
+	name: `${label}.${zone}`,
+	target: "target.example.net",
+	ttl: 300
+});
+const txt = (zone, label, value) => txt$1({
+	name: `${label}.${zone}`,
+	value,
+	ttl: 300
+});
+const recordIds = (receipt) => applied(receipt).map(({ providerRecordId }) => providerRecordId);
+/**
+* Runs create/readback/cleanup, exact-noop, conflict, stale-plan, and partial-apply against a
+* real provider definition, through the same Provision and Cleanup services hosts use.
+*/
+const provider = (definition, credential, zone, options = {}) => {
+	const prefix = options.prefix ?? "domainkit-conformance";
+	const run = (target, body) => Effect.gen(function* () {
+		const attachment = yield* attachZone(target, credential, zone);
+		const { session: session$1, target: resolved } = yield* session(attachment.id);
+		return yield* body(session$1.dns(resolved), attachment);
+	}).pipe(Effect.provideService(Service$1, principal), Effect.provide(layerMemory({
+		providers: [target],
+		resolver: Layer.succeed(Service$2)(silentResolver)
+	})));
+	const cleanup = (dns, ids) => Effect.suspend(() => Effect.forEach(ids(), (id) => dns.delete(zone, id).pipe(Effect.ignore), { discard: true }));
+	const createReadbackCleanup = run(definition, (dns, attachment) => {
+		let created = [];
+		const name = "create-readback-cleanup";
+		return Effect.gen(function* () {
+			const requirements = [cname(zone, `${prefix}-create`), txt(zone, `${prefix}-page`, "domainkit")];
+			const plan$2 = yield* plan({
+				domain: attachment.domain,
+				requirements
+			});
+			yield* expect(name, plan$2.operations.every(({ _tag }) => _tag === "Create"), "expected two Create operations");
+			const receipt = yield* apply(yield* approve(plan$2));
+			created = recordIds(receipt);
+			yield* expect(name, receipt.status === "complete" && created.length === 2, "apply must return a complete receipt with provider record ids");
+			const observed = yield* dns.list(zone);
+			yield* expect(name, requirements.every((requirement) => observed.some(({ record }) => equals(record, requirement))), "list must return every created record, including across provider pages");
+			const cleanupPlan = yield* plan$1({ receiptId: receipt.id });
+			yield* expect(name, cleanupPlan.operations.every(({ _tag }) => _tag === "Delete"), "cleanup plan must delete both records");
+			const cleaned = yield* apply$1(yield* approve$1(cleanupPlan));
+			const remaining = yield* Effect.forEach(created, (id) => dns.get(zone, id));
+			yield* expect(name, cleaned.status === "complete" && remaining.every((record) => record === null), "receipt-bound cleanup must remove every created record");
+			created = [];
+		}).pipe(Effect.ensuring(cleanup(dns, () => created)));
+	});
+	const exactNoop = run(definition, (dns, attachment) => {
+		let created = [];
+		const name = "exact-noop";
+		return Effect.gen(function* () {
+			const requirement = cname(zone, `${prefix}-exact`);
+			const { providerRecordId } = yield* dns.create(zone, requirement);
+			created = [providerRecordId];
+			const plan$3 = yield* plan({
+				domain: attachment.domain,
+				requirements: [requirement]
+			});
+			yield* expect(name, plan$3.operations[0]?._tag === "Noop", "an exact record must plan as Noop");
+			const receipt = yield* apply(yield* approve(plan$3));
+			yield* expect(name, applied(receipt).length === 0, "an exact plan must not create another record");
+		}).pipe(Effect.ensuring(cleanup(dns, () => created)));
+	});
+	const conflict = run(definition, (dns, attachment) => {
+		let created = [];
+		const name = "conflict";
+		return Effect.gen(function* () {
+			const { providerRecordId } = yield* dns.create(zone, txt(zone, `${prefix}-conflict`, "occupied"));
+			created = [providerRecordId];
+			const plan$6 = yield* plan({
+				domain: attachment.domain,
+				requirements: [cname(zone, `${prefix}-conflict`)]
+			});
+			yield* expect(name, plan$6.operations[0]?._tag === "Conflict", "a CNAME over an occupied name must plan as Conflict");
+			const rejected = yield* approve(plan$6).pipe(Effect.result);
+			yield* expect(name, rejected._tag === "Failure" && rejected.failure.reason._tag === "Conflict", "approve must fail closed on conflicts");
+		}).pipe(Effect.ensuring(cleanup(dns, () => created)));
+	});
+	const stalePlan = run(definition, (dns, attachment) => {
+		let created = [];
+		const name = "stale-plan";
+		return Effect.gen(function* () {
+			const requirement = cname(zone, `${prefix}-stale`);
+			const plan$4 = yield* plan({
+				domain: attachment.domain,
+				requirements: [requirement]
+			});
+			const approval = yield* approve(plan$4);
+			const { providerRecordId } = yield* dns.create(zone, requirement);
+			created = [providerRecordId];
+			const stale = yield* apply(approval).pipe(Effect.result);
+			yield* expect(name, stale._tag === "Failure" && stale.failure.reason._tag === "Stale", "apply must reject provider state that changed after approval");
+		}).pipe(Effect.ensuring(cleanup(dns, () => created)));
+	});
+	const partialApplyCleanup = run({
+		...definition,
+		session: (input) => {
+			const session = definition.session(input);
+			return {
+				...session,
+				dns: (target) => {
+					const dns = session.dns(target);
+					let writes = 0;
+					return {
+						...dns,
+						create: (targetZone, record) => {
+							writes += 1;
+							return writes === 2 ? fail(new ProviderUnavailable({
+								provider: definition.id,
+								message: "injected conformance failure"
+							})) : dns.create(targetZone, record);
+						}
+					};
+				}
+			};
+		}
+	}, (dns, attachment) => {
+		let created = [];
+		const name = "partial-apply-cleanup";
+		return Effect.gen(function* () {
+			const plan$5 = yield* plan({
+				domain: attachment.domain,
+				requirements: [cname(zone, `${prefix}-partial-one`), txt(zone, `${prefix}-partial-two`, "domainkit")]
+			});
+			const receipt = yield* apply(yield* approve(plan$5));
+			created = recordIds(receipt);
+			yield* expect(name, receipt.status === "partial" && created.length === 1, "a later write failure must preserve the first confirmed write in a partial receipt");
+			const cleanupPlan = yield* plan$1({ receiptId: receipt.id });
+			yield* apply$1(yield* approve$1(cleanupPlan));
+			const remaining = yield* Effect.forEach(created, (id) => dns.get(zone, id));
+			yield* expect(name, remaining.every((record) => record === null), "partial receipt cleanup must remove the confirmed write");
+			created = [];
+		}).pipe(Effect.ensuring(cleanup(dns, () => created)));
+	});
+	return Effect.all([
+		createReadbackCleanup,
+		exactNoop,
+		conflict,
+		stalePlan,
+		partialApplyCleanup
+	], { discard: true });
+};
+/** Verification is out of scope for the provider contract; keep the pool quiet. */
+const silentResolver = { resolve: () => Effect.succeed([]) };
+//#endregion
+export { provider };
+
+//# sourceMappingURL=provider.mjs.map

package/dist/internal/conformance/provider.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.mjs","names":["Principal.make","Errors.DomainKitError","Reason.InvalidInput","Storage.Service","Custody.Service","Storage.Authorization","Provider.encodeContext","Storage.Credential","Connect.attach","Storage.Attachment","DnsRecord.cname","DnsRecord.txt","Receipt.applied","Connect.session","session","Principal.Service","DomainKit.layerMemory","Resolver.Service","plan","Provision.plan","Provision.apply","Provision.approve","DnsRecord.equals","Cleanup.plan","Cleanup.apply","Cleanup.approve","Errors.fail","Reason.ProviderUnavailable"],"sources":["../../../src/internal/conformance/provider.ts"],"sourcesContent":["import { DateTime, Effect, Layer } from \"effect\";\n\nimport * as Cleanup from \"../../Cleanup.ts\";\nimport * as Connect from \"../../Connect.ts\";\nimport * as Custody from \"../../Custody.ts\";\nimport * as DnsRecord from \"../../DnsRecord.ts\";\nimport * as Errors from \"../error.ts\";\nimport * as Reason from \"../../Reason.ts\";\nimport * as DomainKit from \"../../DomainKit.ts\";\nimport * as Principal from \"../../Principal.ts\";\nimport * as Provider from \"../../Provider.ts\";\nimport * as Provision from \"../../Provision.ts\";\nimport * as Receipt from \"../../Receipt.ts\";\nimport * as Resolver from \"../../Resolver.ts\";\nimport * as Storage from \"../../Storage.ts\";\nimport { fresh } from \"../ids.ts\";\n\nexport const cases = [\n  \"create-readback-cleanup\",\n  \"exact-noop\",\n  \"conflict\",\n  \"stale-plan\",\n  \"partial-apply-cleanup\",\n] as const;\nexport type Case = (typeof cases)[number];\n\nconst principal = Principal.make({ ownerId: \"conformance\", actorId: \"conformance\" });\n\nconst failure = (name: Case, message: string) =>\n  new Errors.DomainKitError({\n    reason: new Reason.InvalidInput({\n      message: `provider conformance ${name}: ${message}`,\n      field: \"conformance\",\n    }),\n  });\n\nconst expect = (name: Case, condition: boolean, message: string) =>\n  condition ? Effect.void : Effect.fail(failure(name, message));\n\ntype Env = Storage.Service | Connect.Service | Provision.Service | Cleanup.Service;\n\n/** Attach `zone` to a connection built straight from `credential`, bypassing `authenticate`. */\nconst attachZone = (\n  definition: Provider.Definition,\n  credential: Provider.Credential,\n  zone: string,\n) =>\n  Effect.gen(function* () {\n    const storage = yield* Storage.Service;\n    const custody = yield* Custody.Service;\n    const now = yield* DateTime.now;\n    const authorization = new Storage.Authorization({\n      id: yield* fresh(\"auth\"),\n      ownerId: principal.ownerId,\n      provider: definition.id,\n      method: \"token\",\n      capabilities: [\"dns:read\", \"dns:write\"],\n      context: yield* Provider.encodeContext(definition, credential.context),\n      revocation: \"active\",\n      createdBy: principal.actorId,\n      createdAt: now,\n    });\n    yield* storage.authorizations.upsert({\n      authorization,\n      credential: new Storage.Credential({\n        ciphertext: yield* custody.seal(credential.secret),\n        expiresAt: null,\n        rotatedAt: now,\n      }),\n    });\n    const connection = yield* storage.connections.create(authorization.id);\n    const attached = yield* Connect.attach({ connectionId: connection.id, domain: zone });\n    if (!(attached instanceof Storage.Attachment)) {\n      return yield* Effect.fail(\n        failure(\"create-readback-cleanup\", `zone ${zone} needs a selection; pass an exact zone`),\n      );\n    }\n    return attached;\n  });\n\nconst cname = (zone: string, label: string) =>\n  DnsRecord.cname({ name: `${label}.${zone}`, target: \"target.example.net\", ttl: 300 });\nconst txt = (zone: string, label: string, value: string) =>\n  DnsRecord.txt({ name: `${label}.${zone}`, value, ttl: 300 });\n\nconst recordIds = (receipt: Receipt.Model) =>\n  Receipt.applied(receipt).map(({ providerRecordId }) => providerRecordId);\n\n/**\n * Runs create/readback/cleanup, exact-noop, conflict, stale-plan, and partial-apply against a\n * real provider definition, through the same Provision and Cleanup services hosts use.\n */\nexport const provider = (\n  definition: Provider.Definition,\n  credential: Provider.Credential,\n  zone: string,\n  options: { readonly prefix?: string } = {},\n): Effect.Effect<void, Errors.DomainKitError> => {\n  const prefix = options.prefix ?? \"domainkit-conformance\";\n  const run = <A>(\n    target: Provider.Definition,\n    body: (\n      dns: Provider.Dns,\n      attachment: Storage.Attachment,\n    ) => Effect.Effect<A, Errors.DomainKitError, Env | Principal.Service>,\n  ) =>\n    Effect.gen(function* () {\n      const attachment = yield* attachZone(target, credential, zone);\n      const { session, target: resolved } = yield* Connect.session(attachment.id);\n      return yield* body(session.dns(resolved), attachment);\n    }).pipe(\n      Effect.provideService(Principal.Service, principal),\n      Effect.provide(\n        DomainKit.layerMemory({\n          providers: [target],\n          resolver: Layer.succeed(Resolver.Service)(silentResolver),\n        }),\n      ),\n    );\n\n  const cleanup = (dns: Provider.Dns, ids: () => ReadonlyArray<string>) =>\n    Effect.suspend(() =>\n      Effect.forEach(ids(), (id) => dns.delete(zone, id).pipe(Effect.ignore), { discard: true }),\n    );\n\n  const createReadbackCleanup = run(definition, (dns, attachment) => {\n    let created: ReadonlyArray<string> = [];\n    const name: Case = \"create-readback-cleanup\";\n    return Effect.gen(function* () {\n      const requirements = [\n        cname(zone, `${prefix}-create`),\n        txt(zone, `${prefix}-page`, \"domainkit\"),\n      ];\n      const plan = yield* Provision.plan({ domain: attachment.domain, requirements });\n      yield* expect(\n        name,\n        plan.operations.every(({ _tag }) => _tag === \"Create\"),\n        \"expected two Create operations\",\n      );\n      const receipt = yield* Provision.apply(yield* Provision.approve(plan));\n      created = recordIds(receipt);\n      yield* expect(\n        name,\n        receipt.status === \"complete\" && created.length === 2,\n        \"apply must return a complete receipt with provider record ids\",\n      );\n      const observed = yield* dns.list(zone);\n      yield* expect(\n        name,\n        requirements.every((requirement) =>\n          observed.some(({ record }) => DnsRecord.equals(record, requirement)),\n        ),\n        \"list must return every created record, including across provider pages\",\n      );\n      const cleanupPlan = yield* Cleanup.plan({ receiptId: receipt.id });\n      yield* expect(\n        name,\n        cleanupPlan.operations.every(({ _tag }) => _tag === \"Delete\"),\n        \"cleanup plan must delete both records\",\n      );\n      const cleaned = yield* Cleanup.apply(yield* Cleanup.approve(cleanupPlan));\n      const remaining = yield* Effect.forEach(created, (id) => dns.get(zone, id));\n      yield* expect(\n        name,\n        cleaned.status === \"complete\" && remaining.every((record) => record === null),\n        \"receipt-bound cleanup must remove every created record\",\n      );\n      created = [];\n    }).pipe(Effect.ensuring(cleanup(dns, () => created)));\n  });\n\n  const exactNoop = run(definition, (dns, attachment) => {\n    let created: ReadonlyArray<string> = [];\n    const name: Case = \"exact-noop\";\n    return Effect.gen(function* () {\n      const requirement = cname(zone, `${prefix}-exact`);\n      const { providerRecordId } = yield* dns.create(zone, requirement);\n      created = [providerRecordId];\n      const plan = yield* Provision.plan({\n        domain: attachment.domain,\n        requirements: [requirement],\n      });\n      yield* expect(name, plan.operations[0]?._tag === \"Noop\", \"an exact record must plan as Noop\");\n      const receipt = yield* Provision.apply(yield* Provision.approve(plan));\n      yield* expect(\n        name,\n        Receipt.applied(receipt).length === 0,\n        \"an exact plan must not create another record\",\n      );\n    }).pipe(Effect.ensuring(cleanup(dns, () => created)));\n  });\n\n  const conflict = run(definition, (dns, attachment) => {\n    let created: ReadonlyArray<string> = [];\n    const name: Case = \"conflict\";\n    return Effect.gen(function* () {\n      const { providerRecordId } = yield* dns.create(\n        zone,\n        txt(zone, `${prefix}-conflict`, \"occupied\"),\n      );\n      created = [providerRecordId];\n      const plan = yield* Provision.plan({\n        domain: attachment.domain,\n        requirements: [cname(zone, `${prefix}-conflict`)],\n      });\n      yield* expect(\n        name,\n        plan.operations[0]?._tag === \"Conflict\",\n        \"a CNAME over an occupied name must plan as Conflict\",\n      );\n      const rejected = yield* Provision.approve(plan).pipe(Effect.result);\n      yield* expect(\n        name,\n        rejected._tag === \"Failure\" && rejected.failure.reason._tag === \"Conflict\",\n        \"approve must fail closed on conflicts\",\n      );\n    }).pipe(Effect.ensuring(cleanup(dns, () => created)));\n  });\n\n  const stalePlan = run(definition, (dns, attachment) => {\n    let created: ReadonlyArray<string> = [];\n    const name: Case = \"stale-plan\";\n    return Effect.gen(function* () {\n      const requirement = cname(zone, `${prefix}-stale`);\n      const plan = yield* Provision.plan({\n        domain: attachment.domain,\n        requirements: [requirement],\n      });\n      const approval = yield* Provision.approve(plan);\n      const { providerRecordId } = yield* dns.create(zone, requirement);\n      created = [providerRecordId];\n      const stale = yield* Provision.apply(approval).pipe(Effect.result);\n      yield* expect(\n        name,\n        stale._tag === \"Failure\" && stale.failure.reason._tag === \"Stale\",\n        \"apply must reject provider state that changed after approval\",\n      );\n    }).pipe(Effect.ensuring(cleanup(dns, () => created)));\n  });\n\n  const flaky: Provider.Definition = {\n    ...definition,\n    session: (input) => {\n      const session = definition.session(input);\n      return {\n        ...session,\n        dns: (target) => {\n          const dns = session.dns(target);\n          let writes = 0;\n          return {\n            ...dns,\n            create: (targetZone, record) => {\n              writes += 1;\n              return writes === 2\n                ? Errors.fail(\n                    new Reason.ProviderUnavailable({\n                      provider: definition.id,\n                      message: \"injected conformance failure\",\n                    }),\n                  )\n                : dns.create(targetZone, record);\n            },\n          };\n        },\n      };\n    },\n  };\n\n  const partialApplyCleanup = run(flaky, (dns, attachment) => {\n    let created: ReadonlyArray<string> = [];\n    const name: Case = \"partial-apply-cleanup\";\n    return Effect.gen(function* () {\n      const plan = yield* Provision.plan({\n        domain: attachment.domain,\n        requirements: [\n          cname(zone, `${prefix}-partial-one`),\n          txt(zone, `${prefix}-partial-two`, \"domainkit\"),\n        ],\n      });\n      const receipt = yield* Provision.apply(yield* Provision.approve(plan));\n      created = recordIds(receipt);\n      yield* expect(\n        name,\n        receipt.status === \"partial\" && created.length === 1,\n        \"a later write failure must preserve the first confirmed write in a partial receipt\",\n      );\n      const cleanupPlan = yield* Cleanup.plan({ receiptId: receipt.id });\n      yield* Cleanup.apply(yield* Cleanup.approve(cleanupPlan));\n      const remaining = yield* Effect.forEach(created, (id) => dns.get(zone, id));\n      yield* expect(\n        name,\n        remaining.every((record) => record === null),\n        \"partial receipt cleanup must remove the confirmed write\",\n      );\n      created = [];\n    }).pipe(Effect.ensuring(cleanup(dns, () => created)));\n  });\n\n  return Effect.all([createReadbackCleanup, exactNoop, conflict, stalePlan, partialApplyCleanup], {\n    discard: true,\n  });\n};\n\n/** Verification is out of scope for the provider contract; keep the pool quiet. */\nconst silentResolver: Resolver.Interface = {\n  resolve: () => Effect.succeed([]),\n};\n"],"mappings":";;;;;;;;;;;;;;;;AA0BA,MAAM,YAAYA,KAAe;CAAE,SAAS;CAAe,SAAS;AAAc,CAAC;AAEnF,MAAM,WAAW,MAAY,YAC3B,IAAIC,eAAsB,EACxB,QAAQ,IAAIC,aAAoB;CAC9B,SAAS,wBAAwB,KAAK,IAAI;CAC1C,OAAO;AACT,CAAC,EACH,CAAC;AAEH,MAAM,UAAU,MAAY,WAAoB,YAC9C,YAAY,OAAO,OAAO,OAAO,KAAK,QAAQ,MAAM,OAAO,CAAC;;AAK9D,MAAM,cACJ,YACA,YACA,SAEA,OAAO,IAAI,aAAa;CACtB,MAAM,UAAU,OAAOC;CACvB,MAAM,UAAU,OAAOC;CACvB,MAAM,MAAM,OAAO,SAAS;CAC5B,MAAM,gBAAgB,IAAIC,cAAsB;EAC9C,IAAI,OAAO,MAAM,MAAM;EACvB,SAAS,UAAU;EACnB,UAAU,WAAW;EACrB,QAAQ;EACR,cAAc,CAAC,YAAY,WAAW;EACtC,SAAS,OAAOC,cAAuB,YAAY,WAAW,OAAO;EACrE,YAAY;EACZ,WAAW,UAAU;EACrB,WAAW;CACb,CAAC;CACD,OAAO,QAAQ,eAAe,OAAO;EACnC;EACA,YAAY,IAAIC,WAAmB;GACjC,YAAY,OAAO,QAAQ,KAAK,WAAW,MAAM;GACjD,WAAW;GACX,WAAW;EACb,CAAC;CACH,CAAC;CACD,MAAM,aAAa,OAAO,QAAQ,YAAY,OAAO,cAAc,EAAE;CACrE,MAAM,WAAW,OAAOC,OAAe;EAAE,cAAc,WAAW;EAAI,QAAQ;CAAK,CAAC;CACpF,IAAI,EAAE,oBAAoBC,aACxB,OAAO,OAAO,OAAO,KACnB,QAAQ,2BAA2B,QAAQ,KAAK,uCAAuC,CACzF;CAEF,OAAO;AACT,CAAC;AAEH,MAAM,SAAS,MAAc,UAC3BC,QAAgB;CAAE,MAAM,GAAG,MAAM,GAAG;CAAQ,QAAQ;CAAsB,KAAK;AAAI,CAAC;AACtF,MAAM,OAAO,MAAc,OAAe,UACxCC,MAAc;CAAE,MAAM,GAAG,MAAM,GAAG;CAAQ;CAAO,KAAK;AAAI,CAAC;AAE7D,MAAM,aAAa,YACjBC,QAAgB,OAAO,CAAC,CAAC,KAAK,EAAE,uBAAuB,gBAAgB;;;;;AAMzE,MAAa,YACX,YACA,YACA,MACA,UAAwC,CAAC,MACM;CAC/C,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,OACJ,QACA,SAKA,OAAO,IAAI,aAAa;EACtB,MAAM,aAAa,OAAO,WAAW,QAAQ,YAAY,IAAI;EAC7D,MAAM,EAAE,SAAA,WAAS,QAAQ,aAAa,OAAOC,QAAgB,WAAW,EAAE;EAC1E,OAAO,OAAO,KAAKC,UAAQ,IAAI,QAAQ,GAAG,UAAU;CACtD,CAAC,CAAC,CAAC,KACD,OAAO,eAAeC,WAAmB,SAAS,GAClD,OAAO,QACLC,YAAsB;EACpB,WAAW,CAAC,MAAM;EAClB,UAAU,MAAM,QAAQC,SAAgB,CAAC,CAAC,cAAc;CAC1D,CAAC,CACH,CACF;CAEF,MAAM,WAAW,KAAmB,QAClC,OAAO,cACL,OAAO,QAAQ,IAAI,IAAI,OAAO,IAAI,OAAO,MAAM,EAAE,CAAC,CAAC,KAAK,OAAO,MAAM,GAAG,EAAE,SAAS,KAAK,CAAC,CAC3F;CAEF,MAAM,wBAAwB,IAAI,aAAa,KAAK,eAAe;EACjE,IAAI,UAAiC,CAAC;EACtC,MAAM,OAAa;EACnB,OAAO,OAAO,IAAI,aAAa;GAC7B,MAAM,eAAe,CACnB,MAAM,MAAM,GAAG,OAAO,QAAQ,GAC9B,IAAI,MAAM,GAAG,OAAO,QAAQ,WAAW,CACzC;GACA,MAAMC,SAAO,OAAOC,KAAe;IAAE,QAAQ,WAAW;IAAQ;GAAa,CAAC;GAC9E,OAAO,OACL,MACAD,OAAK,WAAW,OAAO,EAAE,WAAW,SAAS,QAAQ,GACrD,gCACF;GACA,MAAM,UAAU,OAAOE,MAAgB,OAAOC,QAAkBH,MAAI,CAAC;GACrE,UAAU,UAAU,OAAO;GAC3B,OAAO,OACL,MACA,QAAQ,WAAW,cAAc,QAAQ,WAAW,GACpD,+DACF;GACA,MAAM,WAAW,OAAO,IAAI,KAAK,IAAI;GACrC,OAAO,OACL,MACA,aAAa,OAAO,gBAClB,SAAS,MAAM,EAAE,aAAaI,OAAiB,QAAQ,WAAW,CAAC,CACrE,GACA,wEACF;GACA,MAAM,cAAc,OAAOC,OAAa,EAAE,WAAW,QAAQ,GAAG,CAAC;GACjE,OAAO,OACL,MACA,YAAY,WAAW,OAAO,EAAE,WAAW,SAAS,QAAQ,GAC5D,uCACF;GACA,MAAM,UAAU,OAAOC,QAAc,OAAOC,UAAgB,WAAW,CAAC;GACxE,MAAM,YAAY,OAAO,OAAO,QAAQ,UAAU,OAAO,IAAI,IAAI,MAAM,EAAE,CAAC;GAC1E,OAAO,OACL,MACA,QAAQ,WAAW,cAAc,UAAU,OAAO,WAAW,WAAW,IAAI,GAC5E,wDACF;GACA,UAAU,CAAC;EACb,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,QAAQ,WAAW,OAAO,CAAC,CAAC;CACtD,CAAC;CAED,MAAM,YAAY,IAAI,aAAa,KAAK,eAAe;EACrD,IAAI,UAAiC,CAAC;EACtC,MAAM,OAAa;EACnB,OAAO,OAAO,IAAI,aAAa;GAC7B,MAAM,cAAc,MAAM,MAAM,GAAG,OAAO,OAAO;GACjD,MAAM,EAAE,qBAAqB,OAAO,IAAI,OAAO,MAAM,WAAW;GAChE,UAAU,CAAC,gBAAgB;GAC3B,MAAMP,SAAO,OAAOC,KAAe;IACjC,QAAQ,WAAW;IACnB,cAAc,CAAC,WAAW;GAC5B,CAAC;GACD,OAAO,OAAO,MAAMD,OAAK,WAAW,EAAE,EAAE,SAAS,QAAQ,mCAAmC;GAC5F,MAAM,UAAU,OAAOE,MAAgB,OAAOC,QAAkBH,MAAI,CAAC;GACrE,OAAO,OACL,MACAN,QAAgB,OAAO,CAAC,CAAC,WAAW,GACpC,8CACF;EACF,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,QAAQ,WAAW,OAAO,CAAC,CAAC;CACtD,CAAC;CAED,MAAM,WAAW,IAAI,aAAa,KAAK,eAAe;EACpD,IAAI,UAAiC,CAAC;EACtC,MAAM,OAAa;EACnB,OAAO,OAAO,IAAI,aAAa;GAC7B,MAAM,EAAE,qBAAqB,OAAO,IAAI,OACtC,MACA,IAAI,MAAM,GAAG,OAAO,YAAY,UAAU,CAC5C;GACA,UAAU,CAAC,gBAAgB;GAC3B,MAAMM,SAAO,OAAOC,KAAe;IACjC,QAAQ,WAAW;IACnB,cAAc,CAAC,MAAM,MAAM,GAAG,OAAO,UAAU,CAAC;GAClD,CAAC;GACD,OAAO,OACL,MACAD,OAAK,WAAW,EAAE,EAAE,SAAS,YAC7B,qDACF;GACA,MAAM,WAAW,OAAOG,QAAkBH,MAAI,CAAC,CAAC,KAAK,OAAO,MAAM;GAClE,OAAO,OACL,MACA,SAAS,SAAS,aAAa,SAAS,QAAQ,OAAO,SAAS,YAChE,uCACF;EACF,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,QAAQ,WAAW,OAAO,CAAC,CAAC;CACtD,CAAC;CAED,MAAM,YAAY,IAAI,aAAa,KAAK,eAAe;EACrD,IAAI,UAAiC,CAAC;EACtC,MAAM,OAAa;EACnB,OAAO,OAAO,IAAI,aAAa;GAC7B,MAAM,cAAc,MAAM,MAAM,GAAG,OAAO,OAAO;GACjD,MAAMA,SAAO,OAAOC,KAAe;IACjC,QAAQ,WAAW;IACnB,cAAc,CAAC,WAAW;GAC5B,CAAC;GACD,MAAM,WAAW,OAAOE,QAAkBH,MAAI;GAC9C,MAAM,EAAE,qBAAqB,OAAO,IAAI,OAAO,MAAM,WAAW;GAChE,UAAU,CAAC,gBAAgB;GAC3B,MAAM,QAAQ,OAAOE,MAAgB,QAAQ,CAAC,CAAC,KAAK,OAAO,MAAM;GACjE,OAAO,OACL,MACA,MAAM,SAAS,aAAa,MAAM,QAAQ,OAAO,SAAS,SAC1D,8DACF;EACF,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,QAAQ,WAAW,OAAO,CAAC,CAAC;CACtD,CAAC;CA8BD,MAAM,sBAAsB,IAAI;EA3B9B,GAAG;EACH,UAAU,UAAU;GAClB,MAAM,UAAU,WAAW,QAAQ,KAAK;GACxC,OAAO;IACL,GAAG;IACH,MAAM,WAAW;KACf,MAAM,MAAM,QAAQ,IAAI,MAAM;KAC9B,IAAI,SAAS;KACb,OAAO;MACL,GAAG;MACH,SAAS,YAAY,WAAW;OAC9B,UAAU;OACV,OAAO,WAAW,IACdM,KACE,IAAIC,oBAA2B;QAC7B,UAAU,WAAW;QACrB,SAAS;OACX,CAAC,CACH,IACA,IAAI,OAAO,YAAY,MAAM;MACnC;KACF;IACF;GACF;EACF;CAGkC,IAAI,KAAK,eAAe;EAC1D,IAAI,UAAiC,CAAC;EACtC,MAAM,OAAa;EACnB,OAAO,OAAO,IAAI,aAAa;GAC7B,MAAMT,SAAO,OAAOC,KAAe;IACjC,QAAQ,WAAW;IACnB,cAAc,CACZ,MAAM,MAAM,GAAG,OAAO,aAAa,GACnC,IAAI,MAAM,GAAG,OAAO,eAAe,WAAW,CAChD;GACF,CAAC;GACD,MAAM,UAAU,OAAOC,MAAgB,OAAOC,QAAkBH,MAAI,CAAC;GACrE,UAAU,UAAU,OAAO;GAC3B,OAAO,OACL,MACA,QAAQ,WAAW,aAAa,QAAQ,WAAW,GACnD,oFACF;GACA,MAAM,cAAc,OAAOK,OAAa,EAAE,WAAW,QAAQ,GAAG,CAAC;GACjE,OAAOC,QAAc,OAAOC,UAAgB,WAAW,CAAC;GACxD,MAAM,YAAY,OAAO,OAAO,QAAQ,UAAU,OAAO,IAAI,IAAI,MAAM,EAAE,CAAC;GAC1E,OAAO,OACL,MACA,UAAU,OAAO,WAAW,WAAW,IAAI,GAC3C,yDACF;GACA,UAAU,CAAC;EACb,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,QAAQ,WAAW,OAAO,CAAC,CAAC;CACtD,CAAC;CAED,OAAO,OAAO,IAAI;EAAC;EAAuB;EAAW;EAAU;EAAW;CAAmB,GAAG,EAC9F,SAAS,KACX,CAAC;AACH;;AAGA,MAAM,iBAAqC,EACzC,eAAe,OAAO,QAAQ,CAAC,CAAC,EAClC"}