domainkit 0.7.0 → 0.9.0

package/dist/Custody.mjs

@@ -0,0 +1,64 @@
+import { __exportAll } from "./_virtual/_rolldown/runtime.mjs";
+import { CryptoFailed, InvalidInput } from "./Reason.mjs";
+import { DomainKitError, fail, isDomainKitError } from "./internal/error.mjs";
+import { decodeKey, generateKey as generateKey$1, importKey, open, seal } from "./internal/aes.mjs";
+import { Config, Context, Effect, Layer, Redacted } from "effect";
+//#region src/Custody.ts
+/**
+* Seals provider credentials before Storage writes them. The default is AES-256-GCM through
+* WebCrypto from one configured key; hosts with a KMS provide their own. There is no plaintext
+* mode.
+*
+* Envelope format: `v1.<iv>.<ciphertext>` with base64url segments and a 12-byte IV. Rotating
+* the key requires re-sealing stored credentials; `open` fails with `CryptoFailed` on a mismatch.
+*/
+var Custody_exports = /* @__PURE__ */ __exportAll({
+	Service: () => Service,
+	fromAsync: () => fromAsync,
+	generateKey: () => generateKey,
+	layer: () => layer,
+	layerConfig: () => layerConfig,
+	layerFromAsync: () => layerFromAsync,
+	make: () => make
+});
+var Service = class extends Context.Service()("@domainkit/Custody") {};
+const make = (options) => Effect.gen(function* () {
+	const raw = decodeKey(Redacted.value(options.key));
+	if (raw === null) return yield* fail(new InvalidInput({
+		message: "Custody key must be 32 bytes encoded as base64 or hex",
+		field: "key"
+	}));
+	const key = yield* importKey(raw);
+	return {
+		seal: (plaintext) => seal(key, plaintext),
+		open: (ciphertext) => open(key, ciphertext)
+	};
+});
+const layer = (options) => Layer.effect(Service)(make(options));
+/** Same options, each field a `Config`. Defaults to `DOMAINKIT_CUSTODY_KEY`. */
+const layerConfig = (options = {}) => Layer.effect(Service)(Effect.gen(function* () {
+	const key = yield* (options.key ?? Config.redacted("DOMAINKIT_CUSTODY_KEY")).pipe(Effect.mapError((cause) => new DomainKitError({ reason: new InvalidInput({
+		message: cause.message,
+		field: "key"
+	}) })));
+	return yield* make({ key });
+}));
+/** A fresh random key in the accepted encoding; for tests, playgrounds, and first-time setup. */
+const generateKey = generateKey$1;
+const cryptoFailed = (operation) => (cause) => isDomainKitError(cause) ? cause : new DomainKitError({ reason: new CryptoFailed({ operation }) });
+/** Wrap a Promise-shaped KMS client; rejections become `CryptoFailed`. */
+const fromAsync = (service) => ({
+	seal: (plaintext) => Effect.tryPromise({
+		try: () => service.seal(Redacted.value(plaintext)),
+		catch: cryptoFailed("seal")
+	}),
+	open: (ciphertext) => Effect.tryPromise({
+		try: () => service.open(ciphertext),
+		catch: cryptoFailed("open")
+	}).pipe(Effect.map((value) => Redacted.make(value)))
+});
+const layerFromAsync = (service) => Layer.succeed(Service)(fromAsync(service));
+//#endregion
+export { Custody_exports, Service, fromAsync, generateKey, layer, layerConfig, layerFromAsync, make };
+
+//# sourceMappingURL=Custody.mjs.map

package/dist/Custody.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Custody.mjs","names":["Aes.decodeKey","Errors.fail","Reason.InvalidInput","Aes.importKey","Aes.seal","Aes.open","Errors.DomainKitError","Aes.generateKey","Errors.isDomainKitError","Reason.CryptoFailed"],"sources":["../src/Custody.ts"],"sourcesContent":["/**\n * Seals provider credentials before Storage writes them. The default is AES-256-GCM through\n * WebCrypto from one configured key; hosts with a KMS provide their own. There is no plaintext\n * mode.\n *\n * Envelope format: `v1.<iv>.<ciphertext>` with base64url segments and a 12-byte IV. Rotating\n * the key requires re-sealing stored credentials; `open` fails with `CryptoFailed` on a mismatch.\n */\nimport { Config, Context, Effect, Layer, Redacted } from \"effect\";\n\nimport * as Errors from \"./internal/error.ts\";\nimport * as Reason from \"./Reason.ts\";\nimport * as Aes from \"./internal/aes.ts\";\n\nexport interface Interface {\n  readonly seal: (\n    plaintext: Redacted.Redacted<string>,\n  ) => Effect.Effect<string, Errors.DomainKitError>;\n  readonly open: (\n    ciphertext: string,\n  ) => Effect.Effect<Redacted.Redacted<string>, Errors.DomainKitError>;\n}\n\nexport class Service extends Context.Service<Service, Interface>()(\"@domainkit/Custody\") {}\n\nexport interface Options {\n  /** 32 bytes, base64 or hex. Rotating it requires re-sealing stored credentials. */\n  readonly key: Redacted.Redacted<string>;\n}\n\nexport const make = (options: Options): Effect.Effect<Interface, Errors.DomainKitError> =>\n  Effect.gen(function* () {\n    const raw = Aes.decodeKey(Redacted.value(options.key));\n    if (raw === null) {\n      return yield* Errors.fail(\n        new Reason.InvalidInput({\n          message: \"Custody key must be 32 bytes encoded as base64 or hex\",\n          field: \"key\",\n        }),\n      );\n    }\n    const key = yield* Aes.importKey(raw);\n    return {\n      seal: (plaintext) => Aes.seal(key, plaintext),\n      open: (ciphertext) => Aes.open(key, ciphertext),\n    };\n  });\n\nexport const layer = (options: Options): Layer.Layer<Service, Errors.DomainKitError> =>\n  Layer.effect(Service)(make(options));\n\n/** Same options, each field a `Config`. Defaults to `DOMAINKIT_CUSTODY_KEY`. */\nexport const layerConfig = (\n  options: { readonly key?: Config.Config<Redacted.Redacted<string>> } = {},\n): Layer.Layer<Service, Errors.DomainKitError> =>\n  Layer.effect(Service)(\n    Effect.gen(function* () {\n      const key = yield* (options.key ?? Config.redacted(\"DOMAINKIT_CUSTODY_KEY\")).pipe(\n        Effect.mapError(\n          (cause) =>\n            new Errors.DomainKitError({\n              reason: new Reason.InvalidInput({ message: cause.message, field: \"key\" }),\n            }),\n        ),\n      );\n      return yield* make({ key });\n    }),\n  );\n\n/** A fresh random key in the accepted encoding; for tests, playgrounds, and first-time setup. */\nexport const generateKey = Aes.generateKey;\n\nexport interface AsyncInterface {\n  readonly seal: (plaintext: string) => Promise<string>;\n  readonly open: (ciphertext: string) => Promise<string>;\n}\n\nconst cryptoFailed = (operation: \"seal\" | \"open\") => (cause: unknown) =>\n  Errors.isDomainKitError(cause)\n    ? cause\n    : new Errors.DomainKitError({ reason: new Reason.CryptoFailed({ operation }) });\n\n/** Wrap a Promise-shaped KMS client; rejections become `CryptoFailed`. */\nexport const fromAsync = (service: AsyncInterface): Interface => ({\n  seal: (plaintext) =>\n    Effect.tryPromise({\n      try: () => service.seal(Redacted.value(plaintext)),\n      catch: cryptoFailed(\"seal\"),\n    }),\n  open: (ciphertext) =>\n    Effect.tryPromise({ try: () => service.open(ciphertext), catch: cryptoFailed(\"open\") }).pipe(\n      Effect.map((value) => Redacted.make(value)),\n    ),\n});\n\nexport const layerFromAsync = (service: AsyncInterface): Layer.Layer<Service> =>\n  Layer.succeed(Service)(fromAsync(service));\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAuBA,IAAa,UAAb,cAA6B,QAAQ,QAA4B,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;AAO1F,MAAa,QAAQ,YACnB,OAAO,IAAI,aAAa;CACtB,MAAM,MAAMA,UAAc,SAAS,MAAM,QAAQ,GAAG,CAAC;CACrD,IAAI,QAAQ,MACV,OAAO,OAAOC,KACZ,IAAIC,aAAoB;EACtB,SAAS;EACT,OAAO;CACT,CAAC,CACH;CAEF,MAAM,MAAM,OAAOC,UAAc,GAAG;CACpC,OAAO;EACL,OAAO,cAAcC,KAAS,KAAK,SAAS;EAC5C,OAAO,eAAeC,KAAS,KAAK,UAAU;CAChD;AACF,CAAC;AAEH,MAAa,SAAS,YACpB,MAAM,OAAO,OAAO,CAAC,CAAC,KAAK,OAAO,CAAC;;AAGrC,MAAa,eACX,UAAuE,CAAC,MAExE,MAAM,OAAO,OAAO,CAAC,CACnB,OAAO,IAAI,aAAa;CACtB,MAAM,MAAM,QAAQ,QAAQ,OAAO,OAAO,SAAS,uBAAuB,EAAA,CAAG,KAC3E,OAAO,UACJ,UACC,IAAIC,eAAsB,EACxB,QAAQ,IAAIJ,aAAoB;EAAE,SAAS,MAAM;EAAS,OAAO;CAAM,CAAC,EAC1E,CAAC,CACL,CACF;CACA,OAAO,OAAO,KAAK,EAAE,IAAI,CAAC;AAC5B,CAAC,CACH;;AAGF,MAAa,cAAcK;AAO3B,MAAM,gBAAgB,eAAgC,UACpDC,iBAAwB,KAAK,IACzB,QACA,IAAIF,eAAsB,EAAE,QAAQ,IAAIG,aAAoB,EAAE,UAAU,CAAC,EAAE,CAAC;;AAGlF,MAAa,aAAa,aAAwC;CAChE,OAAO,cACL,OAAO,WAAW;EAChB,WAAW,QAAQ,KAAK,SAAS,MAAM,SAAS,CAAC;EACjD,OAAO,aAAa,MAAM;CAC5B,CAAC;CACH,OAAO,eACL,OAAO,WAAW;EAAE,WAAW,QAAQ,KAAK,UAAU;EAAG,OAAO,aAAa,MAAM;CAAE,CAAC,CAAC,CAAC,KACtF,OAAO,KAAK,UAAU,SAAS,KAAK,KAAK,CAAC,CAC5C;AACJ;AAEA,MAAa,kBAAkB,YAC7B,MAAM,QAAQ,OAAO,CAAC,CAAC,UAAU,OAAO,CAAC"}

package/dist/DnsRecord.mjs

@@ -0,0 +1,213 @@
+import { __exportAll } from "./_virtual/_rolldown/runtime.mjs";
+import { Model as Model$1, fromStringUnsafe } from "./DomainName.mjs";
+import { Schema } from "effect";
+//#region src/DnsRecord.ts
+/**
+* DNS record requirements a product asks a customer to satisfy, and the observed records a
+* provider or resolver reports back.
+*
+* Constructors are lowercase functions (`DnsRecord.cname(...)`), Effect style. `policy` defaults
+* to `exclusive` for CNAME and `append` for everything else; `ttl` defaults to `null` (provider
+* default); `purpose` is an optional human label the UI shows.
+*/
+var DnsRecord_exports = /* @__PURE__ */ __exportAll({
+	A: () => A,
+	AAAA: () => AAAA,
+	CAA: () => CAA,
+	CNAME: () => CNAME,
+	MX: () => MX,
+	Model: () => Model,
+	NS: () => NS,
+	Observed: () => Observed,
+	Opaque: () => Opaque,
+	Policy: () => Policy,
+	SRV: () => SRV,
+	TXT: () => TXT,
+	Type: () => Type,
+	a: () => a,
+	aaaa: () => aaaa,
+	caa: () => caa,
+	cname: () => cname,
+	data: () => data,
+	equals: () => equals,
+	isDnsRecord: () => isDnsRecord,
+	mx: () => mx,
+	ns: () => ns,
+	sameSet: () => sameSet,
+	srv: () => srv,
+	txt: () => txt
+});
+const Name = Schema.suspend(() => Model$1);
+const Type = Schema.Literals([
+	"A",
+	"AAAA",
+	"CNAME",
+	"TXT",
+	"MX",
+	"CAA",
+	"NS",
+	"SRV"
+]);
+const Policy = Schema.Literals(["exclusive", "append"]);
+const Ttl = Schema.NullOr(Schema.Int.check(Schema.isBetween({
+	minimum: 1,
+	maximum: 2147483647
+})));
+const Port = Schema.Int.check(Schema.isBetween({
+	minimum: 0,
+	maximum: 65535
+}));
+const Priority = Schema.Int.check(Schema.isBetween({
+	minimum: 0,
+	maximum: 65535
+}));
+const Ipv4 = Schema.String.check(Schema.makeFilter((value) => isIpv4(value) ? void 0 : "Expected an IPv4 address"));
+const Ipv6 = Schema.String.check(Schema.makeFilter((value) => isIpv6(value) ? void 0 : "Expected an IPv6 address"));
+const NonEmpty = Schema.String.check(Schema.isMinLength(1));
+const Common = {
+	name: Name,
+	ttl: Ttl,
+	policy: Policy,
+	purpose: Schema.optionalKey(Schema.String)
+};
+var A = class extends Schema.TaggedClass("@domainkit/DnsRecord/A")("A", {
+	...Common,
+	address: Ipv4
+}) {};
+var AAAA = class extends Schema.TaggedClass("@domainkit/DnsRecord/AAAA")("AAAA", {
+	...Common,
+	address: Ipv6
+}) {};
+var CNAME = class extends Schema.TaggedClass("@domainkit/DnsRecord/CNAME")("CNAME", {
+	...Common,
+	target: Name
+}) {};
+var TXT = class extends Schema.TaggedClass("@domainkit/DnsRecord/TXT")("TXT", {
+	...Common,
+	value: NonEmpty
+}) {};
+var MX = class extends Schema.TaggedClass("@domainkit/DnsRecord/MX")("MX", {
+	...Common,
+	exchange: Name,
+	priority: Priority
+}) {};
+var CAA = class extends Schema.TaggedClass("@domainkit/DnsRecord/CAA")("CAA", {
+	...Common,
+	flags: Schema.Int.check(Schema.isBetween({
+		minimum: 0,
+		maximum: 255
+	})),
+	tag: NonEmpty,
+	value: NonEmpty
+}) {};
+var NS = class extends Schema.TaggedClass("@domainkit/DnsRecord/NS")("NS", {
+	...Common,
+	nameserver: Name
+}) {};
+var SRV = class extends Schema.TaggedClass("@domainkit/DnsRecord/SRV")("SRV", {
+	...Common,
+	target: Name,
+	port: Port,
+	priority: Priority,
+	weight: Priority
+}) {};
+const Model = Schema.Union([
+	A,
+	AAAA,
+	CNAME,
+	TXT,
+	MX,
+	CAA,
+	NS,
+	SRV
+]);
+/** A provider record DomainKit cannot model but must not overwrite. */
+var Opaque = class extends Schema.TaggedClass("@domainkit/DnsRecord/Opaque")("Opaque", {
+	name: Schema.String,
+	type: Schema.String,
+	raw: Schema.Unknown
+}) {};
+const Observed = Schema.Union([Model, Opaque]);
+const common = (name, options, defaultPolicy) => ({
+	name: fromStringUnsafe(name),
+	ttl: options.ttl ?? null,
+	policy: options.policy ?? defaultPolicy,
+	...options.purpose === void 0 ? {} : { purpose: options.purpose }
+});
+const a = (input) => new A({
+	...common(input.name, input, "append"),
+	address: input.address
+});
+const aaaa = (input) => new AAAA({
+	...common(input.name, input, "append"),
+	address: input.address
+});
+const cname = (input) => new CNAME({
+	...common(input.name, input, "exclusive"),
+	target: fromStringUnsafe(input.target)
+});
+const txt = (input) => new TXT({
+	...common(input.name, input, "append"),
+	value: input.value
+});
+const mx = (input) => new MX({
+	...common(input.name, input, "append"),
+	exchange: fromStringUnsafe(input.exchange),
+	priority: input.priority
+});
+const caa = (input) => new CAA({
+	...common(input.name, input, "append"),
+	flags: input.flags,
+	tag: input.tag,
+	value: input.value
+});
+const ns = (input) => new NS({
+	...common(input.name, input, "append"),
+	nameserver: fromStringUnsafe(input.nameserver)
+});
+const srv = (input) => new SRV({
+	...common(input.name, input, "append"),
+	target: fromStringUnsafe(input.target),
+	port: input.port,
+	priority: input.priority,
+	weight: input.weight
+});
+const isDnsRecord = (input) => Schema.is(Model)(input);
+/** The record's data portion as a canonical string, for display and zone-file rendering. */
+const data = (record) => {
+	switch (record._tag) {
+		case "A":
+		case "AAAA": return record.address;
+		case "CNAME": return record.target;
+		case "NS": return record.nameserver;
+		case "TXT": return record.value;
+		case "MX": return `${record.priority} ${record.exchange}`;
+		case "CAA": return `${record.flags} ${record.tag} ${record.value}`;
+		case "SRV": return `${record.priority} ${record.weight} ${record.port} ${record.target}`;
+	}
+};
+/**
+* Structural equality over type, name, and data. `ttl`, `policy`, and `purpose` are requirement
+* metadata, not record identity, so they are ignored; TTL drift is reported on plan operations.
+*/
+const equals = (left, right) => {
+	if (left._tag === "Opaque" || right._tag === "Opaque") return left._tag === "Opaque" && right._tag === "Opaque" && left.name === right.name && left.type === right.type && JSON.stringify(left.raw) === JSON.stringify(right.raw);
+	return left._tag === right._tag && left.name === right.name && data(left) === data(right);
+};
+/** `true` when both records occupy the same name and type, regardless of data. */
+const sameSet = (left, right) => left.name === right.name && (left._tag === "Opaque" ? left.type : left._tag) === (right._tag === "Opaque" ? right.type : right._tag);
+function isIpv4(value) {
+	const parts = value.split(".");
+	return parts.length === 4 && parts.every((part) => /^\d{1,3}$/.test(part) && Number(part) <= 255 && String(Number(part)) === part);
+}
+function isIpv6(value) {
+	try {
+		return new URL(`http://[${value}]/`).hostname.startsWith("[");
+	} catch {
+		return false;
+	}
+}
+//#endregion
+export { A, AAAA, CAA, CNAME, DnsRecord_exports, MX, Model, NS, Observed, Opaque, Policy, SRV, TXT, Type, a, aaaa, caa, cname, data, equals, isDnsRecord, mx, ns, sameSet, srv, txt };
+
+//# sourceMappingURL=DnsRecord.mjs.map

package/dist/DnsRecord.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"DnsRecord.mjs","names":["DomainName.Model","DomainName.fromStringUnsafe"],"sources":["../src/DnsRecord.ts"],"sourcesContent":["/**\n * DNS record requirements a product asks a customer to satisfy, and the observed records a\n * provider or resolver reports back.\n *\n * Constructors are lowercase functions (`DnsRecord.cname(...)`), Effect style. `policy` defaults\n * to `exclusive` for CNAME and `append` for everything else; `ttl` defaults to `null` (provider\n * default); `purpose` is an optional human label the UI shows.\n */\nimport { Schema } from \"effect\";\n\nimport * as DomainName from \"./DomainName.ts\";\n\n// DomainName, internal/error, Reason, Plan, and DnsRecord form an import cycle. Field schemas\n// that cross it are read lazily so any module can be the first one evaluated.\nconst Name = Schema.suspend(() => DomainName.Model);\n\nexport const Type = Schema.Literals([\"A\", \"AAAA\", \"CNAME\", \"TXT\", \"MX\", \"CAA\", \"NS\", \"SRV\"]);\nexport type Type = typeof Type.Type;\n\nexport const Policy = Schema.Literals([\"exclusive\", \"append\"]);\nexport type Policy = typeof Policy.Type;\n\nconst Ttl = Schema.NullOr(\n  Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 2_147_483_647 })),\n);\nconst Port = Schema.Int.check(Schema.isBetween({ minimum: 0, maximum: 65_535 }));\nconst Priority = Schema.Int.check(Schema.isBetween({ minimum: 0, maximum: 65_535 }));\nconst Ipv4 = Schema.String.check(\n  Schema.makeFilter<string>((value) => (isIpv4(value) ? undefined : \"Expected an IPv4 address\")),\n);\nconst Ipv6 = Schema.String.check(\n  Schema.makeFilter<string>((value) => (isIpv6(value) ? undefined : \"Expected an IPv6 address\")),\n);\nconst NonEmpty = Schema.String.check(Schema.isMinLength(1));\n\nconst Common = {\n  name: Name,\n  ttl: Ttl,\n  policy: Policy,\n  purpose: Schema.optionalKey(Schema.String),\n};\n\nexport class A extends Schema.TaggedClass<A>(\"@domainkit/DnsRecord/A\")(\"A\", {\n  ...Common,\n  address: Ipv4,\n}) {}\nexport class AAAA extends Schema.TaggedClass<AAAA>(\"@domainkit/DnsRecord/AAAA\")(\"AAAA\", {\n  ...Common,\n  address: Ipv6,\n}) {}\nexport class CNAME extends Schema.TaggedClass<CNAME>(\"@domainkit/DnsRecord/CNAME\")(\"CNAME\", {\n  ...Common,\n  target: Name,\n}) {}\nexport class TXT extends Schema.TaggedClass<TXT>(\"@domainkit/DnsRecord/TXT\")(\"TXT\", {\n  ...Common,\n  value: NonEmpty,\n}) {}\nexport class MX extends Schema.TaggedClass<MX>(\"@domainkit/DnsRecord/MX\")(\"MX\", {\n  ...Common,\n  exchange: Name,\n  priority: Priority,\n}) {}\nexport class CAA extends Schema.TaggedClass<CAA>(\"@domainkit/DnsRecord/CAA\")(\"CAA\", {\n  ...Common,\n  flags: Schema.Int.check(Schema.isBetween({ minimum: 0, maximum: 255 })),\n  tag: NonEmpty,\n  value: NonEmpty,\n}) {}\nexport class NS extends Schema.TaggedClass<NS>(\"@domainkit/DnsRecord/NS\")(\"NS\", {\n  ...Common,\n  nameserver: Name,\n}) {}\nexport class SRV extends Schema.TaggedClass<SRV>(\"@domainkit/DnsRecord/SRV\")(\"SRV\", {\n  ...Common,\n  target: Name,\n  port: Port,\n  priority: Priority,\n  weight: Priority,\n}) {}\n\nexport const Model = Schema.Union([A, AAAA, CNAME, TXT, MX, CAA, NS, SRV]);\nexport type Model = typeof Model.Type;\nexport type Encoded = typeof Model.Encoded;\n\n/** A provider record DomainKit cannot model but must not overwrite. */\nexport class Opaque extends Schema.TaggedClass<Opaque>(\"@domainkit/DnsRecord/Opaque\")(\"Opaque\", {\n  name: Schema.String,\n  type: Schema.String,\n  raw: Schema.Unknown,\n}) {}\nexport const Observed = Schema.Union([Model, Opaque]);\nexport type Observed = typeof Observed.Type;\n\ntype Options = { readonly ttl?: number; readonly policy?: Policy; readonly purpose?: string };\n\nconst common = (name: string, options: Options, defaultPolicy: Policy) => ({\n  name: DomainName.fromStringUnsafe(name),\n  ttl: options.ttl ?? null,\n  policy: options.policy ?? defaultPolicy,\n  ...(options.purpose === undefined ? {} : { purpose: options.purpose }),\n});\n\nexport const a = (input: { readonly name: string; readonly address: string } & Options): A =>\n  new A({ ...common(input.name, input, \"append\"), address: input.address });\nexport const aaaa = (input: { readonly name: string; readonly address: string } & Options): AAAA =>\n  new AAAA({ ...common(input.name, input, \"append\"), address: input.address });\nexport const cname = (\n  input: { readonly name: string; readonly target: string } & Omit<Options, \"policy\">,\n): CNAME =>\n  new CNAME({\n    ...common(input.name, input, \"exclusive\"),\n    target: DomainName.fromStringUnsafe(input.target),\n  });\nexport const txt = (input: { readonly name: string; readonly value: string } & Options): TXT =>\n  new TXT({ ...common(input.name, input, \"append\"), value: input.value });\nexport const mx = (\n  input: { readonly name: string; readonly exchange: string; readonly priority: number } & Options,\n): MX =>\n  new MX({\n    ...common(input.name, input, \"append\"),\n    exchange: DomainName.fromStringUnsafe(input.exchange),\n    priority: input.priority,\n  });\nexport const caa = (\n  input: {\n    readonly name: string;\n    readonly flags: number;\n    readonly tag: string;\n    readonly value: string;\n  } & Options,\n): CAA =>\n  new CAA({\n    ...common(input.name, input, \"append\"),\n    flags: input.flags,\n    tag: input.tag,\n    value: input.value,\n  });\nexport const ns = (input: { readonly name: string; readonly nameserver: string } & Options): NS =>\n  new NS({\n    ...common(input.name, input, \"append\"),\n    nameserver: DomainName.fromStringUnsafe(input.nameserver),\n  });\nexport const srv = (\n  input: {\n    readonly name: string;\n    readonly target: string;\n    readonly port: number;\n    readonly priority: number;\n    readonly weight: number;\n  } & Options,\n): SRV =>\n  new SRV({\n    ...common(input.name, input, \"append\"),\n    target: DomainName.fromStringUnsafe(input.target),\n    port: input.port,\n    priority: input.priority,\n    weight: input.weight,\n  });\n\nexport const isDnsRecord = (input: unknown): input is Model => Schema.is(Model)(input);\n\n/** The record's data portion as a canonical string, for display and zone-file rendering. */\nexport const data = (record: Model): string => {\n  switch (record._tag) {\n    case \"A\":\n    case \"AAAA\":\n      return record.address;\n    case \"CNAME\":\n      return record.target;\n    case \"NS\":\n      return record.nameserver;\n    case \"TXT\":\n      return record.value;\n    case \"MX\":\n      return `${record.priority} ${record.exchange}`;\n    case \"CAA\":\n      return `${record.flags} ${record.tag} ${record.value}`;\n    case \"SRV\":\n      return `${record.priority} ${record.weight} ${record.port} ${record.target}`;\n  }\n};\n\n/**\n * Structural equality over type, name, and data. `ttl`, `policy`, and `purpose` are requirement\n * metadata, not record identity, so they are ignored; TTL drift is reported on plan operations.\n */\nexport const equals = (left: Observed, right: Observed): boolean => {\n  if (left._tag === \"Opaque\" || right._tag === \"Opaque\") {\n    return (\n      left._tag === \"Opaque\" &&\n      right._tag === \"Opaque\" &&\n      left.name === right.name &&\n      left.type === right.type &&\n      JSON.stringify(left.raw) === JSON.stringify(right.raw)\n    );\n  }\n  return left._tag === right._tag && left.name === right.name && data(left) === data(right);\n};\n\n/** `true` when both records occupy the same name and type, regardless of data. */\nexport const sameSet = (left: Observed, right: Observed): boolean =>\n  left.name === right.name &&\n  (left._tag === \"Opaque\" ? left.type : left._tag) ===\n    (right._tag === \"Opaque\" ? right.type : right._tag);\n\nfunction isIpv4(value: string): boolean {\n  const parts = value.split(\".\");\n  return (\n    parts.length === 4 &&\n    parts.every(\n      (part) => /^\\d{1,3}$/.test(part) && Number(part) <= 255 && String(Number(part)) === part,\n    )\n  );\n}\n\nfunction isIpv6(value: string): boolean {\n  try {\n    return new URL(`http://[${value}]/`).hostname.startsWith(\"[\");\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAcA,MAAM,OAAO,OAAO,cAAcA,OAAgB;AAElD,MAAa,OAAO,OAAO,SAAS;CAAC;CAAK;CAAQ;CAAS;CAAO;CAAM;CAAO;CAAM;AAAK,CAAC;AAG3F,MAAa,SAAS,OAAO,SAAS,CAAC,aAAa,QAAQ,CAAC;AAG7D,MAAM,MAAM,OAAO,OACjB,OAAO,IAAI,MAAM,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS;AAAc,CAAC,CAAC,CAC3E;AACA,MAAM,OAAO,OAAO,IAAI,MAAM,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS;AAAO,CAAC,CAAC;AAC/E,MAAM,WAAW,OAAO,IAAI,MAAM,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS;AAAO,CAAC,CAAC;AACnF,MAAM,OAAO,OAAO,OAAO,MACzB,OAAO,YAAoB,UAAW,OAAO,KAAK,IAAI,KAAA,IAAY,0BAA2B,CAC/F;AACA,MAAM,OAAO,OAAO,OAAO,MACzB,OAAO,YAAoB,UAAW,OAAO,KAAK,IAAI,KAAA,IAAY,0BAA2B,CAC/F;AACA,MAAM,WAAW,OAAO,OAAO,MAAM,OAAO,YAAY,CAAC,CAAC;AAE1D,MAAM,SAAS;CACb,MAAM;CACN,KAAK;CACL,QAAQ;CACR,SAAS,OAAO,YAAY,OAAO,MAAM;AAC3C;AAEA,IAAa,IAAb,cAAuB,OAAO,YAAe,wBAAwB,CAAC,CAAC,KAAK;CAC1E,GAAG;CACH,SAAS;AACX,CAAC,CAAC,CAAC,CAAC;AACJ,IAAa,OAAb,cAA0B,OAAO,YAAkB,2BAA2B,CAAC,CAAC,QAAQ;CACtF,GAAG;CACH,SAAS;AACX,CAAC,CAAC,CAAC,CAAC;AACJ,IAAa,QAAb,cAA2B,OAAO,YAAmB,4BAA4B,CAAC,CAAC,SAAS;CAC1F,GAAG;CACH,QAAQ;AACV,CAAC,CAAC,CAAC,CAAC;AACJ,IAAa,MAAb,cAAyB,OAAO,YAAiB,0BAA0B,CAAC,CAAC,OAAO;CAClF,GAAG;CACH,OAAO;AACT,CAAC,CAAC,CAAC,CAAC;AACJ,IAAa,KAAb,cAAwB,OAAO,YAAgB,yBAAyB,CAAC,CAAC,MAAM;CAC9E,GAAG;CACH,UAAU;CACV,UAAU;AACZ,CAAC,CAAC,CAAC,CAAC;AACJ,IAAa,MAAb,cAAyB,OAAO,YAAiB,0BAA0B,CAAC,CAAC,OAAO;CAClF,GAAG;CACH,OAAO,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAI,CAAC,CAAC;CACtE,KAAK;CACL,OAAO;AACT,CAAC,CAAC,CAAC,CAAC;AACJ,IAAa,KAAb,cAAwB,OAAO,YAAgB,yBAAyB,CAAC,CAAC,MAAM;CAC9E,GAAG;CACH,YAAY;AACd,CAAC,CAAC,CAAC,CAAC;AACJ,IAAa,MAAb,cAAyB,OAAO,YAAiB,0BAA0B,CAAC,CAAC,OAAO;CAClF,GAAG;CACH,QAAQ;CACR,MAAM;CACN,UAAU;CACV,QAAQ;AACV,CAAC,CAAC,CAAC,CAAC;AAEJ,MAAa,QAAQ,OAAO,MAAM;CAAC;CAAG;CAAM;CAAO;CAAK;CAAI;CAAK;CAAI;AAAG,CAAC;;AAKzE,IAAa,SAAb,cAA4B,OAAO,YAAoB,6BAA6B,CAAC,CAAC,UAAU;CAC9F,MAAM,OAAO;CACb,MAAM,OAAO;CACb,KAAK,OAAO;AACd,CAAC,CAAC,CAAC,CAAC;AACJ,MAAa,WAAW,OAAO,MAAM,CAAC,OAAO,MAAM,CAAC;AAKpD,MAAM,UAAU,MAAc,SAAkB,mBAA2B;CACzE,MAAMC,iBAA4B,IAAI;CACtC,KAAK,QAAQ,OAAO;CACpB,QAAQ,QAAQ,UAAU;CAC1B,GAAI,QAAQ,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;AACtE;AAEA,MAAa,KAAK,UAChB,IAAI,EAAE;CAAE,GAAG,OAAO,MAAM,MAAM,OAAO,QAAQ;CAAG,SAAS,MAAM;AAAQ,CAAC;AAC1E,MAAa,QAAQ,UACnB,IAAI,KAAK;CAAE,GAAG,OAAO,MAAM,MAAM,OAAO,QAAQ;CAAG,SAAS,MAAM;AAAQ,CAAC;AAC7E,MAAa,SACX,UAEA,IAAI,MAAM;CACR,GAAG,OAAO,MAAM,MAAM,OAAO,WAAW;CACxC,QAAQA,iBAA4B,MAAM,MAAM;AAClD,CAAC;AACH,MAAa,OAAO,UAClB,IAAI,IAAI;CAAE,GAAG,OAAO,MAAM,MAAM,OAAO,QAAQ;CAAG,OAAO,MAAM;AAAM,CAAC;AACxE,MAAa,MACX,UAEA,IAAI,GAAG;CACL,GAAG,OAAO,MAAM,MAAM,OAAO,QAAQ;CACrC,UAAUA,iBAA4B,MAAM,QAAQ;CACpD,UAAU,MAAM;AAClB,CAAC;AACH,MAAa,OACX,UAOA,IAAI,IAAI;CACN,GAAG,OAAO,MAAM,MAAM,OAAO,QAAQ;CACrC,OAAO,MAAM;CACb,KAAK,MAAM;CACX,OAAO,MAAM;AACf,CAAC;AACH,MAAa,MAAM,UACjB,IAAI,GAAG;CACL,GAAG,OAAO,MAAM,MAAM,OAAO,QAAQ;CACrC,YAAYA,iBAA4B,MAAM,UAAU;AAC1D,CAAC;AACH,MAAa,OACX,UAQA,IAAI,IAAI;CACN,GAAG,OAAO,MAAM,MAAM,OAAO,QAAQ;CACrC,QAAQA,iBAA4B,MAAM,MAAM;CAChD,MAAM,MAAM;CACZ,UAAU,MAAM;CAChB,QAAQ,MAAM;AAChB,CAAC;AAEH,MAAa,eAAe,UAAmC,OAAO,GAAG,KAAK,CAAC,CAAC,KAAK;;AAGrF,MAAa,QAAQ,WAA0B;CAC7C,QAAQ,OAAO,MAAf;EACE,KAAK;EACL,KAAK,QACH,OAAO,OAAO;EAChB,KAAK,SACH,OAAO,OAAO;EAChB,KAAK,MACH,OAAO,OAAO;EAChB,KAAK,OACH,OAAO,OAAO;EAChB,KAAK,MACH,OAAO,GAAG,OAAO,SAAS,GAAG,OAAO;EACtC,KAAK,OACH,OAAO,GAAG,OAAO,MAAM,GAAG,OAAO,IAAI,GAAG,OAAO;EACjD,KAAK,OACH,OAAO,GAAG,OAAO,SAAS,GAAG,OAAO,OAAO,GAAG,OAAO,KAAK,GAAG,OAAO;CACxE;AACF;;;;;AAMA,MAAa,UAAU,MAAgB,UAA6B;CAClE,IAAI,KAAK,SAAS,YAAY,MAAM,SAAS,UAC3C,OACE,KAAK,SAAS,YACd,MAAM,SAAS,YACf,KAAK,SAAS,MAAM,QACpB,KAAK,SAAS,MAAM,QACpB,KAAK,UAAU,KAAK,GAAG,MAAM,KAAK,UAAU,MAAM,GAAG;CAGzD,OAAO,KAAK,SAAS,MAAM,QAAQ,KAAK,SAAS,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,KAAK;AAC1F;;AAGA,MAAa,WAAW,MAAgB,UACtC,KAAK,SAAS,MAAM,SACnB,KAAK,SAAS,WAAW,KAAK,OAAO,KAAK,WACxC,MAAM,SAAS,WAAW,MAAM,OAAO,MAAM;AAElD,SAAS,OAAO,OAAwB;CACtC,MAAM,QAAQ,MAAM,MAAM,GAAG;CAC7B,OACE,MAAM,WAAW,KACjB,MAAM,OACH,SAAS,YAAY,KAAK,IAAI,KAAK,OAAO,IAAI,KAAK,OAAO,OAAO,OAAO,IAAI,CAAC,MAAM,IACtF;AAEJ;AAEA,SAAS,OAAO,OAAwB;CACtC,IAAI;EACF,OAAO,IAAI,IAAI,WAAW,MAAM,GAAG,CAAC,CAAC,SAAS,WAAW,GAAG;CAC9D,QAAQ;EACN,OAAO;CACT;AACF"}

package/dist/DomainKit.mjs

@@ -0,0 +1,34 @@
+import { __exportAll } from "./_virtual/_rolldown/runtime.mjs";
+import { DomainKitError } from "./internal/error.mjs";
+import { generateKey, layer as layer$1 } from "./Custody.mjs";
+import { layer as layer$2 } from "./Providers.mjs";
+import { layer as layer$3 } from "./Resolver.mjs";
+import { layerMemory as layerMemory$1 } from "./Storage.mjs";
+import { layer as layer$4 } from "./Connect.mjs";
+import { layer as layer$5 } from "./Provision.mjs";
+import { layer as layer$6 } from "./Cleanup.mjs";
+import { layer as layer$7 } from "./Verify.mjs";
+import { Layer, Redacted } from "effect";
+//#region src/DomainKit.ts
+/**
+* The composed layer. Provides every lifecycle service given a list of providers; the host
+* provides `Storage` and `Custody` beneath it, the same way `Persistence.layer` sits over a
+* backing store in Effect.
+*
+* Defaults: `Resolver.layer` (Cloudflare + Google DoH) and the `Policy` references. Override a
+* policy with `Effect.provideService`; pass `resolver` for a different pool.
+*/
+var DomainKit_exports = /* @__PURE__ */ __exportAll({
+	Error: () => DomainKitError,
+	isError: () => isError,
+	layer: () => layer,
+	layerMemory: () => layerMemory
+});
+const isError = (input) => input instanceof DomainKitError;
+const layer = (options) => Layer.mergeAll(layer$5, layer$6, layer$7).pipe(Layer.provideMerge(layer$4), Layer.provideMerge(Layer.mergeAll(layer$2(options.providers), options.resolver ?? layer$3)));
+/** `layer` with `Storage.layerMemory` and a throwaway custody key. Tests and playgrounds only. */
+const layerMemory = (options) => layer(options).pipe(Layer.provideMerge(Layer.mergeAll(layerMemory$1, layer$1({ key: Redacted.make(generateKey()) }))));
+//#endregion
+export { DomainKit_exports, DomainKitError as Error, isError, layer, layerMemory };
+
+//# sourceMappingURL=DomainKit.mjs.map

package/dist/DomainKit.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"DomainKit.mjs","names":["Provision.layer","Cleanup.layer","Verify.layer","Connect.layer","Providers.layer","Resolver.layer","Storage.layerMemory","Custody.layer","Custody.generateKey"],"sources":["../src/DomainKit.ts"],"sourcesContent":["/**\n * The composed layer. Provides every lifecycle service given a list of providers; the host\n * provides `Storage` and `Custody` beneath it, the same way `Persistence.layer` sits over a\n * backing store in Effect.\n *\n * Defaults: `Resolver.layer` (Cloudflare + Google DoH) and the `Policy` references. Override a\n * policy with `Effect.provideService`; pass `resolver` for a different pool.\n */\nimport { Layer, Redacted } from \"effect\";\n\nimport * as Cleanup from \"./Cleanup.ts\";\nimport * as Connect from \"./Connect.ts\";\nimport * as Custody from \"./Custody.ts\";\nimport { DomainKitError } from \"./internal/error.ts\";\nimport type * as Provider from \"./Provider.ts\";\nimport * as Providers from \"./Providers.ts\";\nimport * as Provision from \"./Provision.ts\";\nimport * as Resolver from \"./Resolver.ts\";\nimport * as Storage from \"./Storage.ts\";\nimport * as Verify from \"./Verify.ts\";\n\nexport { DomainKitError as Error };\nexport type { Category as ErrorCategory } from \"./internal/error.ts\";\n\nexport const isError = (input: unknown): input is DomainKitError => input instanceof DomainKitError;\n\nexport interface Options {\n  readonly providers: ReadonlyArray<Provider.Definition>;\n  /** Replace the public DNS pool (e.g. `Testing.resolver()`); default `Resolver.layer`. */\n  readonly resolver?: Layer.Layer<Resolver.Service>;\n}\n\nexport type Services =\n  | Provision.Service\n  | Cleanup.Service\n  | Connect.Service\n  | Verify.Service\n  | Providers.Service\n  | Resolver.Service;\n\nexport const layer = (\n  options: Options,\n): Layer.Layer<Services, never, Storage.Service | Custody.Service> =>\n  Layer.mergeAll(Provision.layer, Cleanup.layer, Verify.layer).pipe(\n    Layer.provideMerge(Connect.layer),\n    Layer.provideMerge(\n      Layer.mergeAll(Providers.layer(options.providers), options.resolver ?? Resolver.layer),\n    ),\n  );\n\n/** `layer` with `Storage.layerMemory` and a throwaway custody key. Tests and playgrounds only. */\nexport const layerMemory = (\n  options: Options,\n): Layer.Layer<Services | Storage.Service | Custody.Service, DomainKitError> =>\n  layer(options).pipe(\n    Layer.provideMerge(\n      Layer.mergeAll(\n        Storage.layerMemory,\n        Custody.layer({ key: Redacted.make(Custody.generateKey()) }),\n      ),\n    ),\n  );\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAwBA,MAAa,WAAW,UAA4C,iBAAiB;AAgBrF,MAAa,SACX,YAEA,MAAM,SAASA,SAAiBC,SAAeC,OAAY,CAAC,CAAC,KAC3D,MAAM,aAAaC,OAAa,GAChC,MAAM,aACJ,MAAM,SAASC,QAAgB,QAAQ,SAAS,GAAG,QAAQ,YAAYC,OAAc,CACvF,CACF;;AAGF,MAAa,eACX,YAEA,MAAM,OAAO,CAAC,CAAC,KACb,MAAM,aACJ,MAAM,SACJC,eACAC,QAAc,EAAE,KAAK,SAAS,KAAKC,YAAoB,CAAC,EAAE,CAAC,CAC7D,CACF,CACF"}

package/dist/DomainName.mjs

@@ -0,0 +1,100 @@
+import { __exportAll } from "./_virtual/_rolldown/runtime.mjs";
+import { InvalidInput } from "./Reason.mjs";
+import { DomainKitError, fail } from "./internal/error.mjs";
+import { Effect, Option, Schema, SchemaIssue, SchemaTransformation } from "effect";
+import { getDomain } from "tldts";
+//#region src/DomainName.ts
+/**
+* A normalized, IDN-aware hostname. Lifecycle inputs accept plain strings and validate them, so
+* most hosts never construct this directly; it exists for hosts that want the brand in their own
+* types.
+*/
+var DomainName_exports = /* @__PURE__ */ __exportAll({
+	Model: () => Model,
+	candidates: () => candidates,
+	decode: () => decode,
+	fromString: () => fromString,
+	fromStringUnsafe: () => fromStringUnsafe,
+	isDomainName: () => isDomainName,
+	isWithin: () => isWithin
+});
+const labelPattern = /^[a-z0-9_](?:[a-z0-9_-]{0,61}[a-z0-9_])?$/;
+const Branded = Schema.String.check(Schema.makeFilter((value) => isNormalized(value) ? void 0 : "Expected a fully qualified DNS name", { identifier: "DomainName" })).pipe(Schema.brand("@domainkit/DomainName"));
+/** Decodes any hostname spelling into its normalized, branded form; encodes back to a string. */
+const Model = Schema.String.pipe(Schema.decodeTo(Branded, SchemaTransformation.transformOrFail({
+	decode: (input, options) => Effect.try({
+		try: () => normalize(input),
+		catch: (cause) => new SchemaIssue.InvalidValue({ message: errorMessage(cause) }, input, options)
+	}),
+	encode: (domain) => Effect.succeed(domain)
+})));
+/** Validates and normalizes; `None` when the input is not a hostname. */
+const fromString = (input) => {
+	try {
+		return Option.some(normalizeUnsafe(input));
+	} catch {
+		return Option.none();
+	}
+};
+/** Validates and normalizes; throws `DomainKit.Error` (reason `InvalidInput`) when invalid. */
+const fromStringUnsafe = (input) => {
+	try {
+		return normalizeUnsafe(input);
+	} catch (cause) {
+		throw new DomainKitError({ reason: new InvalidInput({
+			message: errorMessage(cause),
+			field: "domain"
+		}) });
+	}
+};
+/** Validates and normalizes inside Effect; fails with reason `InvalidInput`. */
+const decode = (input, field = "domain") => Effect.suspend(() => {
+	try {
+		return Effect.succeed(normalizeUnsafe(input));
+	} catch (cause) {
+		return fail(new InvalidInput({
+			message: errorMessage(cause),
+			field
+		}));
+	}
+});
+const isDomainName = (input) => typeof input === "string" && isNormalized(input);
+/**
+* Zone candidates from the name itself down to the registrable domain, most specific first:
+* `a.b.example.com` -> `a.b.example.com`, `b.example.com`, `example.com`. Empty when the name has
+* no registrable suffix.
+*/
+const candidates = (domain) => {
+	const registrable = getDomain(domain, { allowPrivateDomains: true });
+	if (registrable === null) return [];
+	const labels = domain.split(".");
+	const registrableLabels = registrable.split(".").length;
+	const values = [];
+	for (let index = 0; index <= labels.length - registrableLabels; index += 1) values.push(labels.slice(index).join("."));
+	return values;
+};
+/** `true` when `name` is `zone` or a subdomain of it. */
+const isWithin = (name, zone) => name === zone || name.endsWith(`.${zone}`);
+function isNormalized(value) {
+	return value.length <= 253 && value.includes(".") && value.split(".").every((label) => labelPattern.test(label));
+}
+function normalizeUnsafe(input) {
+	return normalize(input);
+}
+function normalize(input) {
+	const value = input.trim().replace(/\.+$/, "").split(".").map((label) => {
+		if (label.includes("_") || [...label].every((character) => character.charCodeAt(0) <= 127)) return label.toLowerCase();
+		const normalized = new URL(`http://${label}.example`).hostname.split(".")[0];
+		if (normalized === void 0) throw new Error("Domain label could not be normalized");
+		return normalized.toLowerCase();
+	}).join(".");
+	if (!isNormalized(value)) throw new Error(`Expected a fully qualified DNS name, received ${JSON.stringify(input)}`);
+	return value;
+}
+function errorMessage(cause) {
+	return cause instanceof Error ? cause.message : String(cause);
+}
+//#endregion
+export { DomainName_exports, Model, candidates, decode, fromString, fromStringUnsafe, isDomainName, isWithin };
+
+//# sourceMappingURL=DomainName.mjs.map

package/dist/DomainName.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"DomainName.mjs","names":["Errors.DomainKitError","Reason.InvalidInput","Errors.fail"],"sources":["../src/DomainName.ts"],"sourcesContent":["/**\n * A normalized, IDN-aware hostname. Lifecycle inputs accept plain strings and validate them, so\n * most hosts never construct this directly; it exists for hosts that want the brand in their own\n * types.\n */\nimport { Effect, Option, Schema, SchemaIssue, SchemaTransformation } from \"effect\";\nimport { getDomain } from \"tldts\";\n\nimport * as Errors from \"./internal/error.ts\";\nimport * as Reason from \"./Reason.ts\";\n\nconst labelPattern = /^[a-z0-9_](?:[a-z0-9_-]{0,61}[a-z0-9_])?$/;\n\nconst Branded = Schema.String.check(\n  Schema.makeFilter<string>(\n    (value) => (isNormalized(value) ? undefined : \"Expected a fully qualified DNS name\"),\n    { identifier: \"DomainName\" },\n  ),\n).pipe(Schema.brand(\"@domainkit/DomainName\"));\n\n/** Decodes any hostname spelling into its normalized, branded form; encodes back to a string. */\nexport const Model = Schema.String.pipe(\n  Schema.decodeTo(\n    Branded,\n    SchemaTransformation.transformOrFail({\n      decode: (input, options) =>\n        Effect.try({\n          try: () => normalize(input),\n          catch: (cause) =>\n            new SchemaIssue.InvalidValue({ message: errorMessage(cause) }, input, options),\n        }),\n      encode: (domain) => Effect.succeed(domain),\n    }),\n  ),\n);\nexport type Model = typeof Branded.Type;\n\n/** Validates and normalizes; `None` when the input is not a hostname. */\nexport const fromString = (input: string): Option.Option<Model> => {\n  try {\n    return Option.some(normalizeUnsafe(input));\n  } catch {\n    return Option.none();\n  }\n};\n\n/** Validates and normalizes; throws `DomainKit.Error` (reason `InvalidInput`) when invalid. */\nexport const fromStringUnsafe = (input: string): Model => {\n  try {\n    return normalizeUnsafe(input);\n  } catch (cause) {\n    throw new Errors.DomainKitError({\n      reason: new Reason.InvalidInput({ message: errorMessage(cause), field: \"domain\" }),\n    });\n  }\n};\n\n/** Validates and normalizes inside Effect; fails with reason `InvalidInput`. */\nexport const decode = (\n  input: string,\n  field = \"domain\",\n): Effect.Effect<Model, Errors.DomainKitError> =>\n  Effect.suspend(() => {\n    try {\n      return Effect.succeed(normalizeUnsafe(input));\n    } catch (cause) {\n      return Errors.fail(new Reason.InvalidInput({ message: errorMessage(cause), field }));\n    }\n  });\n\nexport const isDomainName = (input: unknown): input is Model =>\n  typeof input === \"string\" && isNormalized(input);\n\n/**\n * Zone candidates from the name itself down to the registrable domain, most specific first:\n * `a.b.example.com` -> `a.b.example.com`, `b.example.com`, `example.com`. Empty when the name has\n * no registrable suffix.\n */\nexport const candidates = (domain: Model): ReadonlyArray<Model> => {\n  const registrable = getDomain(domain, { allowPrivateDomains: true });\n  if (registrable === null) return [];\n  const labels = domain.split(\".\");\n  const registrableLabels = registrable.split(\".\").length;\n  const values: Array<Model> = [];\n  for (let index = 0; index <= labels.length - registrableLabels; index += 1) {\n    values.push(labels.slice(index).join(\".\") as Model);\n  }\n  return values;\n};\n\n/** `true` when `name` is `zone` or a subdomain of it. */\nexport const isWithin = (name: string, zone: string): boolean =>\n  name === zone || name.endsWith(`.${zone}`);\n\nfunction isNormalized(value: string): boolean {\n  return (\n    value.length <= 253 &&\n    value.includes(\".\") &&\n    value.split(\".\").every((label) => labelPattern.test(label))\n  );\n}\n\nfunction normalizeUnsafe(input: string): Model {\n  return normalize(input) as Model;\n}\n\nfunction normalize(input: string): string {\n  const labels = input\n    .trim()\n    .replace(/\\.+$/, \"\")\n    .split(\".\")\n    .map((label) => {\n      if (label.includes(\"_\") || [...label].every((character) => character.charCodeAt(0) <= 127)) {\n        return label.toLowerCase();\n      }\n      const hostname = new URL(`http://${label}.example`).hostname;\n      const normalized = hostname.split(\".\")[0];\n      if (normalized === undefined) throw new Error(\"Domain label could not be normalized\");\n      return normalized.toLowerCase();\n    });\n  const value = labels.join(\".\");\n  if (!isNormalized(value)) {\n    throw new Error(`Expected a fully qualified DNS name, received ${JSON.stringify(input)}`);\n  }\n  return value;\n}\n\nfunction errorMessage(cause: unknown): string {\n  return cause instanceof Error ? cause.message : String(cause);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAWA,MAAM,eAAe;AAErB,MAAM,UAAU,OAAO,OAAO,MAC5B,OAAO,YACJ,UAAW,aAAa,KAAK,IAAI,KAAA,IAAY,uCAC9C,EAAE,YAAY,aAAa,CAC7B,CACF,CAAC,CAAC,KAAK,OAAO,MAAM,uBAAuB,CAAC;;AAG5C,MAAa,QAAQ,OAAO,OAAO,KACjC,OAAO,SACL,SACA,qBAAqB,gBAAgB;CACnC,SAAS,OAAO,YACd,OAAO,IAAI;EACT,WAAW,UAAU,KAAK;EAC1B,QAAQ,UACN,IAAI,YAAY,aAAa,EAAE,SAAS,aAAa,KAAK,EAAE,GAAG,OAAO,OAAO;CACjF,CAAC;CACH,SAAS,WAAW,OAAO,QAAQ,MAAM;AAC3C,CAAC,CACH,CACF;;AAIA,MAAa,cAAc,UAAwC;CACjE,IAAI;EACF,OAAO,OAAO,KAAK,gBAAgB,KAAK,CAAC;CAC3C,QAAQ;EACN,OAAO,OAAO,KAAK;CACrB;AACF;;AAGA,MAAa,oBAAoB,UAAyB;CACxD,IAAI;EACF,OAAO,gBAAgB,KAAK;CAC9B,SAAS,OAAO;EACd,MAAM,IAAIA,eAAsB,EAC9B,QAAQ,IAAIC,aAAoB;GAAE,SAAS,aAAa,KAAK;GAAG,OAAO;EAAS,CAAC,EACnF,CAAC;CACH;AACF;;AAGA,MAAa,UACX,OACA,QAAQ,aAER,OAAO,cAAc;CACnB,IAAI;EACF,OAAO,OAAO,QAAQ,gBAAgB,KAAK,CAAC;CAC9C,SAAS,OAAO;EACd,OAAOC,KAAY,IAAID,aAAoB;GAAE,SAAS,aAAa,KAAK;GAAG;EAAM,CAAC,CAAC;CACrF;AACF,CAAC;AAEH,MAAa,gBAAgB,UAC3B,OAAO,UAAU,YAAY,aAAa,KAAK;;;;;;AAOjD,MAAa,cAAc,WAAwC;CACjE,MAAM,cAAc,UAAU,QAAQ,EAAE,qBAAqB,KAAK,CAAC;CACnE,IAAI,gBAAgB,MAAM,OAAO,CAAC;CAClC,MAAM,SAAS,OAAO,MAAM,GAAG;CAC/B,MAAM,oBAAoB,YAAY,MAAM,GAAG,CAAC,CAAC;CACjD,MAAM,SAAuB,CAAC;CAC9B,KAAK,IAAI,QAAQ,GAAG,SAAS,OAAO,SAAS,mBAAmB,SAAS,GACvE,OAAO,KAAK,OAAO,MAAM,KAAK,CAAC,CAAC,KAAK,GAAG,CAAU;CAEpD,OAAO;AACT;;AAGA,MAAa,YAAY,MAAc,SACrC,SAAS,QAAQ,KAAK,SAAS,IAAI,MAAM;AAE3C,SAAS,aAAa,OAAwB;CAC5C,OACE,MAAM,UAAU,OAChB,MAAM,SAAS,GAAG,KAClB,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,UAAU,aAAa,KAAK,KAAK,CAAC;AAE9D;AAEA,SAAS,gBAAgB,OAAsB;CAC7C,OAAO,UAAU,KAAK;AACxB;AAEA,SAAS,UAAU,OAAuB;CAcxC,MAAM,QAbS,MACZ,KAAK,CAAC,CACN,QAAQ,QAAQ,EAAE,CAAC,CACnB,MAAM,GAAG,CAAC,CACV,KAAK,UAAU;EACd,IAAI,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,cAAc,UAAU,WAAW,CAAC,KAAK,GAAG,GACvF,OAAO,MAAM,YAAY;EAG3B,MAAM,aADW,IAAI,IAAI,UAAU,MAAM,SAAS,CAAC,CAAC,SACxB,MAAM,GAAG,CAAC,CAAC;EACvC,IAAI,eAAe,KAAA,GAAW,MAAM,IAAI,MAAM,sCAAsC;EACpF,OAAO,WAAW,YAAY;CAChC,CACiB,CAAC,CAAC,KAAK,GAAG;CAC7B,IAAI,CAAC,aAAa,KAAK,GACrB,MAAM,IAAI,MAAM,iDAAiD,KAAK,UAAU,KAAK,GAAG;CAE1F,OAAO;AACT;AAEA,SAAS,aAAa,OAAwB;CAC5C,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D"}

package/dist/Plan.mjs

@@ -0,0 +1,102 @@
+import { __exportAll } from "./_virtual/_rolldown/runtime.mjs";
+import { Model as Model$1, Observed as Observed$1, data } from "./DnsRecord.mjs";
+import { decode as decode$1 } from "./internal/error.mjs";
+import { Schema } from "effect";
+//#region src/Plan.ts
+/**
+* A reviewable, digest-bound set of DNS operations. Plans are additive and fail closed: matching
+* records are `Noop`, missing records are `Create`, incompatible state is `Conflict`. A
+* provisioning plan never updates or deletes; a cleanup plan carries `Delete` operations for
+* records a receipt proves DomainKit created.
+*/
+var Plan_exports = /* @__PURE__ */ __exportAll({
+	Conflict: () => Conflict,
+	Create: () => Create,
+	Delete: () => Delete,
+	Digest: () => Digest,
+	Kind: () => Kind,
+	Model: () => Model,
+	Noop: () => Noop,
+	Operation: () => Operation,
+	OperationId: () => OperationId,
+	PlanId: () => PlanId,
+	Version: () => Version,
+	conflicts: () => conflicts,
+	decode: () => decode,
+	encode: () => encode,
+	isApplicable: () => isApplicable,
+	renderInstructions: () => renderInstructions,
+	writes: () => writes
+});
+const Record = Schema.suspend(() => Model$1);
+const Observed = Schema.suspend(() => Observed$1);
+const PlanId = Schema.String.pipe(Schema.brand("@domainkit/PlanId"));
+const Digest = Schema.String.pipe(Schema.brand("@domainkit/Digest"));
+const OperationId = Schema.String.pipe(Schema.brand("@domainkit/OperationId"));
+const Kind = Schema.Literals(["provisioning", "cleanup"]);
+var Create = class extends Schema.TaggedClass("@domainkit/Plan/Create")("Create", {
+	id: OperationId,
+	record: Record
+}) {};
+var Noop = class extends Schema.TaggedClass("@domainkit/Plan/Noop")("Noop", {
+	id: OperationId,
+	record: Record,
+	existing: Observed,
+	ttlDrift: Schema.Boolean
+}) {};
+var Conflict = class extends Schema.TaggedClass("@domainkit/Plan/Conflict")("Conflict", {
+	id: OperationId,
+	record: Record,
+	existing: Schema.Array(Observed),
+	reason: Schema.Literals([
+		"exclusive-name",
+		"cname-collision",
+		"value-mismatch",
+		"opaque",
+		"missing"
+	])
+}) {};
+/** Cleanup only: remove the provider record a receipt proves DomainKit created. */
+var Delete = class extends Schema.TaggedClass("@domainkit/Plan/Delete")("Delete", {
+	id: OperationId,
+	record: Record,
+	providerRecordId: Schema.String
+}) {};
+const Operation = Schema.Union([
+	Create,
+	Noop,
+	Conflict,
+	Delete
+]);
+const Version = Schema.Literal("domainkit.plan.v2");
+var Model = class extends Schema.Class("@domainkit/Plan")({
+	id: PlanId,
+	version: Version,
+	kind: Kind,
+	digest: Digest,
+	domain: Schema.String,
+	zone: Schema.String,
+	provider: Schema.String,
+	attachmentId: Schema.String,
+	operations: Schema.Array(Operation),
+	createdAt: Schema.DateTimeUtcFromString,
+	expiresAt: Schema.DateTimeUtcFromString
+}) {};
+const decode = (input) => decode$1(Model, input);
+const encode = Schema.encodeSync(Model);
+/** `true` when the plan has no conflicts and at least one write (`Create` or `Delete`). */
+const isApplicable = (plan) => conflicts(plan).length === 0 && writes(plan).length > 0;
+const conflicts = (plan) => plan.operations.filter((operation) => operation._tag === "Conflict");
+/** The operations that would touch the provider: creates for provisioning, deletes for cleanup. */
+const writes = (plan) => plan.operations.filter((operation) => operation._tag === "Create" || operation._tag === "Delete");
+/** Manual instructions for hosts whose customers apply records by hand. */
+const renderInstructions = (plan) => plan.operations.map((operation) => {
+	const verb = operation._tag === "Create" ? "ADD" : operation._tag === "Delete" ? "REMOVE" : operation._tag === "Noop" ? "KEEP" : `CONFLICT (${operation.reason})`;
+	const record = operation.record;
+	const ttl = record.ttl === null ? "" : ` ttl=${record.ttl}`;
+	return `${verb} ${record._tag} ${record.name} ${data(record)}${ttl}`;
+}).join("\n");
+//#endregion
+export { Conflict, Create, Delete, Digest, Kind, Model, Noop, Operation, OperationId, PlanId, Plan_exports, Version, conflicts, decode, encode, isApplicable, renderInstructions, writes };
+
+//# sourceMappingURL=Plan.mjs.map

package/dist/Plan.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Plan.mjs","names":["DnsRecord.Model","DnsRecord.Observed","Errors.decode","DnsRecord.data"],"sources":["../src/Plan.ts"],"sourcesContent":["/**\n * A reviewable, digest-bound set of DNS operations. Plans are additive and fail closed: matching\n * records are `Noop`, missing records are `Create`, incompatible state is `Conflict`. A\n * provisioning plan never updates or deletes; a cleanup plan carries `Delete` operations for\n * records a receipt proves DomainKit created.\n */\nimport { Effect, Schema } from \"effect\";\n\nimport * as DnsRecord from \"./DnsRecord.ts\";\nimport * as Errors from \"./internal/error.ts\";\n\n// Read lazily: DnsRecord sits in the same import cycle (see DnsRecord.ts).\nconst Record = Schema.suspend(() => DnsRecord.Model);\nconst Observed = Schema.suspend(() => DnsRecord.Observed);\n\nexport const PlanId = Schema.String.pipe(Schema.brand(\"@domainkit/PlanId\"));\nexport type PlanId = typeof PlanId.Type;\n\nexport const Digest = Schema.String.pipe(Schema.brand(\"@domainkit/Digest\"));\nexport type Digest = typeof Digest.Type;\n\nexport const OperationId = Schema.String.pipe(Schema.brand(\"@domainkit/OperationId\"));\nexport type OperationId = typeof OperationId.Type;\n\nexport const Kind = Schema.Literals([\"provisioning\", \"cleanup\"]);\nexport type Kind = typeof Kind.Type;\n\nexport class Create extends Schema.TaggedClass<Create>(\"@domainkit/Plan/Create\")(\"Create\", {\n  id: OperationId,\n  record: Record,\n}) {}\nexport class Noop extends Schema.TaggedClass<Noop>(\"@domainkit/Plan/Noop\")(\"Noop\", {\n  id: OperationId,\n  record: Record,\n  existing: Observed,\n  ttlDrift: Schema.Boolean,\n}) {}\nexport class Conflict extends Schema.TaggedClass<Conflict>(\"@domainkit/Plan/Conflict\")(\"Conflict\", {\n  id: OperationId,\n  record: Record,\n  existing: Schema.Array(Observed),\n  reason: Schema.Literals([\n    \"exclusive-name\",\n    \"cname-collision\",\n    \"value-mismatch\",\n    \"opaque\",\n    \"missing\",\n  ]),\n}) {}\n/** Cleanup only: remove the provider record a receipt proves DomainKit created. */\nexport class Delete extends Schema.TaggedClass<Delete>(\"@domainkit/Plan/Delete\")(\"Delete\", {\n  id: OperationId,\n  record: Record,\n  providerRecordId: Schema.String,\n}) {}\nexport const Operation = Schema.Union([Create, Noop, Conflict, Delete]);\nexport type Operation = typeof Operation.Type;\n\nexport const Version = Schema.Literal(\"domainkit.plan.v2\");\n\nexport class Model extends Schema.Class<Model>(\"@domainkit/Plan\")({\n  id: PlanId,\n  version: Version,\n  kind: Kind,\n  digest: Digest,\n  domain: Schema.String,\n  zone: Schema.String,\n  provider: Schema.String,\n  attachmentId: Schema.String,\n  operations: Schema.Array(Operation),\n  createdAt: Schema.DateTimeUtcFromString,\n  expiresAt: Schema.DateTimeUtcFromString,\n}) {}\nexport type Encoded = typeof Model.Encoded;\n\nexport const decode = (input: unknown): Effect.Effect<Model, Errors.DomainKitError> =>\n  Errors.decode(Model, input);\nexport const encode: (plan: Model) => Encoded = Schema.encodeSync(Model);\n\n/** `true` when the plan has no conflicts and at least one write (`Create` or `Delete`). */\nexport const isApplicable = (plan: Model): boolean =>\n  conflicts(plan).length === 0 && writes(plan).length > 0;\n\nexport const conflicts = (plan: Model): ReadonlyArray<Conflict> =>\n  plan.operations.filter((operation): operation is Conflict => operation._tag === \"Conflict\");\n\n/** The operations that would touch the provider: creates for provisioning, deletes for cleanup. */\nexport const writes = (plan: Model): ReadonlyArray<Create | Delete> =>\n  plan.operations.filter(\n    (operation): operation is Create | Delete =>\n      operation._tag === \"Create\" || operation._tag === \"Delete\",\n  );\n\n/** Manual instructions for hosts whose customers apply records by hand. */\nexport const renderInstructions = (plan: Model): string =>\n  plan.operations\n    .map((operation) => {\n      const verb =\n        operation._tag === \"Create\"\n          ? \"ADD\"\n          : operation._tag === \"Delete\"\n            ? \"REMOVE\"\n            : operation._tag === \"Noop\"\n              ? \"KEEP\"\n              : `CONFLICT (${operation.reason})`;\n      const record = operation.record;\n      const ttl = record.ttl === null ? \"\" : ` ttl=${record.ttl}`;\n      return `${verb} ${record._tag} ${record.name} ${DnsRecord.data(record)}${ttl}`;\n    })\n    .join(\"\\n\");\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAYA,MAAM,SAAS,OAAO,cAAcA,OAAe;AACnD,MAAM,WAAW,OAAO,cAAcC,UAAkB;AAExD,MAAa,SAAS,OAAO,OAAO,KAAK,OAAO,MAAM,mBAAmB,CAAC;AAG1E,MAAa,SAAS,OAAO,OAAO,KAAK,OAAO,MAAM,mBAAmB,CAAC;AAG1E,MAAa,cAAc,OAAO,OAAO,KAAK,OAAO,MAAM,wBAAwB,CAAC;AAGpF,MAAa,OAAO,OAAO,SAAS,CAAC,gBAAgB,SAAS,CAAC;AAG/D,IAAa,SAAb,cAA4B,OAAO,YAAoB,wBAAwB,CAAC,CAAC,UAAU;CACzF,IAAI;CACJ,QAAQ;AACV,CAAC,CAAC,CAAC,CAAC;AACJ,IAAa,OAAb,cAA0B,OAAO,YAAkB,sBAAsB,CAAC,CAAC,QAAQ;CACjF,IAAI;CACJ,QAAQ;CACR,UAAU;CACV,UAAU,OAAO;AACnB,CAAC,CAAC,CAAC,CAAC;AACJ,IAAa,WAAb,cAA8B,OAAO,YAAsB,0BAA0B,CAAC,CAAC,YAAY;CACjG,IAAI;CACJ,QAAQ;CACR,UAAU,OAAO,MAAM,QAAQ;CAC/B,QAAQ,OAAO,SAAS;EACtB;EACA;EACA;EACA;EACA;CACF,CAAC;AACH,CAAC,CAAC,CAAC,CAAC;;AAEJ,IAAa,SAAb,cAA4B,OAAO,YAAoB,wBAAwB,CAAC,CAAC,UAAU;CACzF,IAAI;CACJ,QAAQ;CACR,kBAAkB,OAAO;AAC3B,CAAC,CAAC,CAAC,CAAC;AACJ,MAAa,YAAY,OAAO,MAAM;CAAC;CAAQ;CAAM;CAAU;AAAM,CAAC;AAGtE,MAAa,UAAU,OAAO,QAAQ,mBAAmB;AAEzD,IAAa,QAAb,cAA2B,OAAO,MAAa,iBAAiB,CAAC,CAAC;CAChE,IAAI;CACJ,SAAS;CACT,MAAM;CACN,QAAQ;CACR,QAAQ,OAAO;CACf,MAAM,OAAO;CACb,UAAU,OAAO;CACjB,cAAc,OAAO;CACrB,YAAY,OAAO,MAAM,SAAS;CAClC,WAAW,OAAO;CAClB,WAAW,OAAO;AACpB,CAAC,CAAC,CAAC,CAAC;AAGJ,MAAa,UAAU,UACrBC,SAAc,OAAO,KAAK;AAC5B,MAAa,SAAmC,OAAO,WAAW,KAAK;;AAGvE,MAAa,gBAAgB,SAC3B,UAAU,IAAI,CAAC,CAAC,WAAW,KAAK,OAAO,IAAI,CAAC,CAAC,SAAS;AAExD,MAAa,aAAa,SACxB,KAAK,WAAW,QAAQ,cAAqC,UAAU,SAAS,UAAU;;AAG5F,MAAa,UAAU,SACrB,KAAK,WAAW,QACb,cACC,UAAU,SAAS,YAAY,UAAU,SAAS,QACtD;;AAGF,MAAa,sBAAsB,SACjC,KAAK,WACF,KAAK,cAAc;CAClB,MAAM,OACJ,UAAU,SAAS,WACf,QACA,UAAU,SAAS,WACjB,WACA,UAAU,SAAS,SACjB,SACA,aAAa,UAAU,OAAO;CACxC,MAAM,SAAS,UAAU;CACzB,MAAM,MAAM,OAAO,QAAQ,OAAO,KAAK,QAAQ,OAAO;CACtD,OAAO,GAAG,KAAK,GAAG,OAAO,KAAK,GAAG,OAAO,KAAK,GAAGC,KAAe,MAAM,IAAI;AAC3E,CAAC,CAAC,CACD,KAAK,IAAI"}

package/dist/Principal.mjs

@@ -0,0 +1,23 @@
+import { __exportAll } from "./_virtual/_rolldown/runtime.mjs";
+import { Context, Layer } from "effect";
+//#region src/Principal.ts
+/**
+* Who is acting. Required by every lifecycle operation and every Storage query; there is no
+* default, so cross-tenant access is a type error rather than a runtime check. `domainkit/server`
+* provides it per request from the host's `Identity`.
+*/
+var Principal_exports = /* @__PURE__ */ __exportAll({
+	Service: () => Service,
+	layer: () => layer,
+	make: () => make
+});
+var Service = class extends Context.Service()("@domainkit/Principal") {};
+const make = (input) => ({
+	ownerId: input.ownerId,
+	actorId: input.actorId
+});
+const layer = (input) => Layer.succeed(Service)(make(input));
+//#endregion
+export { Principal_exports, Service, layer, make };
+
+//# sourceMappingURL=Principal.mjs.map

package/dist/Principal.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Principal.mjs","names":[],"sources":["../src/Principal.ts"],"sourcesContent":["/**\n * Who is acting. Required by every lifecycle operation and every Storage query; there is no\n * default, so cross-tenant access is a type error rather than a runtime check. `domainkit/server`\n * provides it per request from the host's `Identity`.\n */\nimport { Context, Layer } from \"effect\";\n\nexport interface Interface {\n  /** Tenant boundary: organization, workspace, account. Storage scopes every row by it. */\n  readonly ownerId: string;\n  /** The user or automation acting on the tenant's behalf; recorded on approvals and receipts. */\n  readonly actorId: string;\n}\n\nexport class Service extends Context.Service<Service, Interface>()(\"@domainkit/Principal\") {}\n\nexport const make = (input: Interface): Interface => ({\n  ownerId: input.ownerId,\n  actorId: input.actorId,\n});\n\nexport const layer = (input: Interface): Layer.Layer<Service> =>\n  Layer.succeed(Service)(make(input));\n"],"mappings":";;;;;;;;;;;;;AAcA,IAAa,UAAb,cAA6B,QAAQ,QAA4B,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC;AAE5F,MAAa,QAAQ,WAAiC;CACpD,SAAS,MAAM;CACf,SAAS,MAAM;AACjB;AAEA,MAAa,SAAS,UACpB,MAAM,QAAQ,OAAO,CAAC,CAAC,KAAK,KAAK,CAAC"}